Skip to content

package-lock.json#44967

Open
Laksan99 wants to merge 6 commits into
github:mainfrom
Laksan99:main
Open

package-lock.json#44967
Laksan99 wants to merge 6 commits into
github:mainfrom
Laksan99:main

Conversation

@Laksan99

@Laksan99 Laksan99 commented Jun 28, 2026 •
edited
Loading

Copy link
Copy Markdown

<!--
Thank you for contributing to this project! You must fill out the information below before we can review this pull request. By explaining why you're making a change (or linking to an issue) and what changes you've made, we can triage your pull request to the best possible team for review.
-->

Why:

Closes:

What's being changed (if available, include any code snippets, screenshots, or gifs):

Check off the following:

  • A subject matter expert (SME) has reviewed the technical accuracy of the content in this PR. In most cases, the author can be the SME. Open source contributions may require an SME review from GitHub staff.
  • The changes in this PR meet the docs fundamentals that are required for all content.
  • All CI checks are passing and the changes look good in the review environment.

dependabot Bot and others added 6 commits May 13, 2026 19:55
@dependabot
Bump the npm_and_yarn group across 1 directory with 6 updates
715d14e 
Bumps the npm_and_yarn group with 4 updates in the / directory: [next](https://github.com/vercel/next.js), [fast-uri](https://github.com/fastify/fast-uri), [flatted](https://github.com/WebReflection/flatted) and [immutable](https://github.com/immutable-js/immutable-js).


Updates `next` from 16.2.3 to 16.2.6
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v16.2.3...v16.2.6)

Updates `protobufjs` from 7.5.5 to 7.5.8
- [Release notes](https://github.com/protobufjs/protobuf.js/releases)
- [Changelog](https://github.com/protobufjs/protobuf.js/blob/protobufjs-v7.5.8/CHANGELOG.md)
- [Commits](protobufjs/protobuf.js@protobufjs-v7.5.5...protobufjs-v7.5.8)

Updates `@opentelemetry/exporter-prometheus` from 0.215.0 to 0.218.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@experimental/v0.215.0...experimental/v0.218.0)

Updates `fast-uri` from 3.0.1 to 3.1.2
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.0.1...v3.1.2)

Updates `flatted` from 3.3.3 to 3.4.2
- [Commits](WebReflection/flatted@v3.3.3...v3.4.2)

Updates `immutable` from 5.1.1 to 5.1.5
- [Release notes](https://github.com/immutable-js/immutable-js/releases)
- [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md)
- [Commits](immutable-js/immutable-js@v5.1.1...v5.1.5)

---
updated-dependencies:
- dependency-name: next
  dependency-version: 16.2.6
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: protobufjs
  dependency-version: 7.5.8
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@opentelemetry/exporter-prometheus"
  dependency-version: 0.218.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fast-uri
  dependency-version: 3.1.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: flatted
  dependency-version: 3.4.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: immutable
  dependency-version: 5.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@Laksan99
Bump the npm_and_yarn group across 1 directory with 6 updates
d0a2e61 
Bumps the npm_and_yarn group with 4 updates in the / directory: [next](https://github.com/vercel/next.js), [fast-uri](https://github.com/fastify/fast-uri), [flatted](https://github.com/WebReflection/flatted) and [immutable](https://github.com/immutable-js/immutable-js).

Updates `next` from 16.2.3 to 16.2.6
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/vercel/next.js/releases">next's releases</a>.</em></p>
<blockquote>
<h2>v16.2.6</h2>
<blockquote>
<p>[!NOTE]
This release contains security fixes and backported bug fixes. It does <strong>not</strong> include all pending features/changes on canary.</p>
</blockquote>
<h3>Security Fixes</h3>
<p>The following advisories have been addressed:</p>
<p><strong>High:</strong></p>
<ul>
<li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-8h8q-6873-q5fj">GHSA-8h8q-6873-q5fj: Denial of Service with Server Components</a></li>
<li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f">GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes</a></li>
<li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-26hh-7cqf-hhc6">GHSA-26hh-7cqf-hhc6: Middleware / Proxy bypass in App Router applications via segment-prefetch routes - <strong>Incomplete Fix Follow-Up</strong></a></li>
<li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-mg66-mrh9-m8jx">GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components</a></li>
<li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-492v-c6pp-mqqv">GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection</a></li>
<li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-c4j6-fc7j-m34r">GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades</a></li>
<li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-36qx-fr4f-26g5">GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n</a></li>
</ul>
<p><strong>Moderate:</strong></p>
<ul>
<li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-ffhc-5mcf-pf4q">GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces</a></li>
<li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-gx5p-jg67-6x7h">GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input</a></li>
<li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-h64f-5h5j-jqjh">GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API</a></li>
<li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-wfc6-r584-vfw7">GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses</a></li>
</ul>
<p><strong>Low:</strong></p>
<ul>
<li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-vfv6-92ff-j949">GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting</a></li>
<li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-3g8h-86w9-wvmq">GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned</a></li>
</ul>
<h3>Core Changes</h3>
<ul>
<li>fix: preserve HTTP access fallbacks during prerender recovery (<a href="https://redirect.github.com/vercel/next.js/issues/92231">#92231</a>)</li>
<li>Fix fallback route params case in app-page handler (<a href="https://redirect.github.com/vercel/next.js/issues/91737">#91737</a>)</li>
<li>Fix invalid HTML response for route-level RSC requests in deployment adapter (<a href="https://redirect.github.com/vercel/next.js/issues/91541">#91541</a>)</li>
<li>Patch setHeader for direct route handlers (<a href="https://redirect.github.com/vercel/next.js/issues/93101">#93101</a>)</li>
<li>Include deployment id in <code>cacheHandlers</code> keys (<a href="https://redirect.github.com/vercel/next.js/issues/93453">#93453</a>)</li>
<li>Fix double-encoding of URL pathname parts in client param parsing (<a href="https://redirect.github.com/vercel/next.js/issues/93491">#93491</a>)</li>
</ul>
<h2>v16.2.5</h2>
<blockquote>
<p>[!NOTE]
This release contains security fixes and backported bug fixes. It does <strong>not</strong> include all pending features/changes on canary.</p>
</blockquote>
<h3>Security Fixes</h3>
<p>The following advisories have been addressed:</p>
<p><strong>High:</strong></p>
<ul>
<li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-8h8q-6873-q5fj">GHSA-8h8q-6873-q5fj: Denial of Service with Server Components</a></li>
<li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f">GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes</a></li>
<li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-mg66-mrh9-m8jx">GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components</a></li>
<li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-492v-c6pp-mqqv">GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection</a></li>
<li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-c4j6-fc7j-m34r">GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/vercel/next.js/commit/ee6e79b1792a4d401ddf2480f40a83549fe8e722"><code>ee6e79b</code></a> v16.2.6</li>
<li><a href="https://github.com/vercel/next.js/commit/afa053d9eb9c2a68c7eba43e84fe6bed8babcd45"><code>afa053d</code></a> Turbopack: Match proxy matchers with webpack implementation (<a href="https://redirect.github.com/vercel/next.js/issues/93594">#93594</a>)</li>
<li><a href="https://github.com/vercel/next.js/commit/97a154e5bbee0cb1ac3fb8aa4db66ac36e796e3d"><code>97a154e</code></a> Turbopack: Fix middleware matcher suffix (<a href="https://redirect.github.com/vercel/next.js/issues/93590">#93590</a>)</li>
<li><a href="https://github.com/vercel/next.js/commit/83899bc89103d4df1479e065c7c1e09d4698a7b6"><code>83899bc</code></a> [backport] Disable build caches for production/staging/force-preview deploys ...</li>
<li><a href="https://github.com/vercel/next.js/commit/7b222b90954d607fc28a34e9b360a9b1636bc206"><code>7b222b9</code></a> [backport][test] Pin package manager to patch versions (<a href="https://redirect.github.com/vercel/next.js/issues/93595">#93595</a>)</li>
<li><a href="https://github.com/vercel/next.js/commit/a8dc24f1fe23d4a22d24fac734837f7c824138f7"><code>a8dc24f</code></a> [backport] Turbopack: more strict vergen setup (<a href="https://redirect.github.com/vercel/next.js/issues/93587">#93587</a>)</li>
<li><a href="https://github.com/vercel/next.js/commit/766148f9cd48c0e218acafcd0f15defc14871bf4"><code>766148f</code></a> v16.2.5</li>
<li><a href="https://github.com/vercel/next.js/commit/0dd94836a8b43209fcfefa448c141683c22c1a27"><code>0dd9483</code></a> fix: add explicit checks for RSC header (<a href="https://redirect.github.com/vercel/next.js/issues/83">#83</a>) (<a href="https://redirect.github.com/vercel/next.js/issues/98">#98</a>)</li>
<li><a href="https://github.com/vercel/next.js/commit/d166096c399c4fc4e09cd2d1bf26dca6579a855d"><code>d166096</code></a> fix proxy matching for segment prefetch URLs (<a href="https://redirect.github.com/vercel/next.js/issues/89">#89</a>) (<a href="https://redirect.github.com/vercel/next.js/issues/96">#96</a>)</li>
<li><a href="https://github.com/vercel/next.js/commit/9d50c0b7190f59c470308578e12882788819f14c"><code>9d50c0b</code></a> Strip next-resume header from incoming requests (<a href="https://redirect.github.com/vercel/next.js/issues/92">#92</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/vercel/next.js/compare/v16.2.3...v16.2.6">compare view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for next since your current version.</p>
</details>
<br />

Updates `protobufjs` from 7.5.5 to 7.5.8
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/protobufjs/protobuf.js/releases">protobufjs's releases</a>.</em></p>
<blockquote>
<h2>protobufjs: v7.5.8</h2>
<h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.7...protobufjs-v7.5.8">7.5.8</a> (2026-05-12)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>Backport parser hardening to 7.x (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2245">#2245</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/54b593ffd960f7fe4b0c448a12542c3de0a0cf26">54b593f</a>)</li>
</ul>
<h2>protobufjs: v7.5.7</h2>
<h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.6...protobufjs-v7.5.7">7.5.7</a> (2026-05-09)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>Restore first-match namespace lookup (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2236">#2236</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/cc7d59559d4e8c533a35218310c67f4a5dda54f5">cc7d595</a>)</li>
</ul>
<h2>protobufjs: v7.5.6</h2>
<h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.5...protobufjs-v7.5.6">7.5.6</a> (2026-04-27)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>Backport input hardening and CLI fixes to 7.x (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2173">#2173</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/75392ea1b78bdc4faba027b5db44ad7c50e9c454">75392ea</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/protobufjs/protobuf.js/blob/protobufjs-v7.5.8/CHANGELOG.md">protobufjs's changelog</a>.</em></p>
<blockquote>
<h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.7...protobufjs-v7.5.8">7.5.8</a> (2026-05-12)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>Backport parser hardening to 7.x (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2245">#2245</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/54b593ffd960f7fe4b0c448a12542c3de0a0cf26">54b593f</a>)</li>
</ul>
<h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.6...protobufjs-v7.5.7">7.5.7</a> (2026-05-09)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>Restore first-match namespace lookup (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2236">#2236</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/cc7d59559d4e8c533a35218310c67f4a5dda54f5">cc7d595</a>)</li>
</ul>
<h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.5...protobufjs-v7.5.6">7.5.6</a> (2026-04-27)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>Backport input hardening and CLI fixes to 7.x (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2173">#2173</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/75392ea1b78bdc4faba027b5db44ad7c50e9c454">75392ea</a>)</li>
</ul>
<h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.3...protobufjs-v7.5.4">7.5.4</a> (2025-08-15)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>invalid syntax in descriptor.proto (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2092">#2092</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/5a3769a465fead089a533ad55c21d069299df760">5a3769a</a>)</li>
</ul>
<h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.2...protobufjs-v7.5.3">7.5.3</a> (2025-05-28)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>descriptor extensions handling post-editions (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2075">#2075</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/6e255d4ad6982cc857f26e1731c2cedcf5796f68">6e255d4</a>)</li>
</ul>
<h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.1...protobufjs-v7.5.2">7.5.2</a> (2025-05-14)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>ensure that types are always resolved (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2068">#2068</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/4b51cb2b8450b77f9f5de1c562e7fae93b19d040">4b51cb2</a>)</li>
</ul>
<h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.0...protobufjs-v7.5.1">7.5.1</a> (2025-05-08)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>optimize regressions from editions implementations (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2066">#2066</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/6406d4c18afae309fc7b5f4a24d9674d85da180b">6406d4c</a>)</li>
<li>reserved field inside group blocks fail parsing (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2058">#2058</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/56782bff0c4b5132806eb1a6bc4d08f930c4aaad">56782bf</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/protobufjs/protobuf.js/commit/d7035f9b7f06210ea343cab1f2f1cc18ee5cc1d6"><code>d7035f9</code></a> chore: release protobufjs-v7.x (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2248">#2248</a>)</li>
<li><a href="https://github.com/protobufjs/protobuf.js/commit/54b593ffd960f7fe4b0c448a12542c3de0a0cf26"><code>54b593f</code></a> fix: Backport parser hardening to 7.x (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2245">#2245</a>)</li>
<li><a href="https://github.com/protobufjs/protobuf.js/commit/e88fcea1635f79c414e8a070e164d38ea99e104a"><code>e88fcea</code></a> chore: release protobufjs-v7.x (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2239">#2239</a>)</li>
<li><a href="https://github.com/protobufjs/protobuf.js/commit/cc7d59559d4e8c533a35218310c67f4a5dda54f5"><code>cc7d595</code></a> fix: Restore first-match namespace lookup (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2236">#2236</a>)</li>
<li><a href="https://github.com/protobufjs/protobuf.js/commit/3abc9b54d67a7102785c6dfd8bf6610f545d445b"><code>3abc9b5</code></a> chore: release protobufjs-v7.x (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2190">#2190</a>)</li>
<li><a href="https://github.com/protobufjs/protobuf.js/commit/a0bf2dfdd8a75aa62ce5a1ff47a52b9b8f1ea793"><code>a0bf2df</code></a> fix: Update CLI peer dependency (7.x) (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2189">#2189</a>)</li>
<li><a href="https://github.com/protobufjs/protobuf.js/commit/2189e5beeca6a70e4c104dfdb9fb8200bc5f81fe"><code>2189e5b</code></a> chore: release protobufjs-v7.x (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2174">#2174</a>)</li>
<li><a href="https://github.com/protobufjs/protobuf.js/commit/75392ea1b78bdc4faba027b5db44ad7c50e9c454"><code>75392ea</code></a> fix: Backport input hardening and CLI fixes to 7.x (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2173">#2173</a>)</li>
<li><a href="https://github.com/protobufjs/protobuf.js/commit/8af8d7c0e9800879625f7d0d4a7fb51beb4410cd"><code>8af8d7c</code></a> chore(ci): Fix 7.x release please configuration (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2169">#2169</a>)</li>
<li><a href="https://github.com/protobufjs/protobuf.js/commit/e92ca42244ad67203b48d836290062dae037ead6"><code>e92ca42</code></a> chore(ci): Enable release-please for 7.x (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2166">#2166</a>)</li>
<li>See full diff in <a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.5.5...protobufjs-v7.5.8">compare view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for protobufjs since your current version.</p>
</details>
<br />

Updates `@opentelemetry/exporter-prometheus` from 0.215.0 to 0.218.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-js/releases">@​opentelemetry/exporter-prometheus's releases</a>.</em></p>
<blockquote>
<h2>experimental/v0.218.0</h2>
<h2>0.218.0</h2>
<h3>:rocket: Features</h3>
<ul>
<li>feat(otlp-transformer): replace protobufjs metrics serialization with custom implementation <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6629">#6625</a> <a href="https://github.com/pichlermarc"><code>@​pichlermarc</code></a></li>
<li>feat(configuration): show all config validation errors, if there are multiple <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6683">#6683</a> <a href="https://github.com/trentm"><code>@​trentm</code></a></li>
<li>feat(sdk-node): allow startNodeSDK() without an arg <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6688">#6688</a> <a href="https://github.com/trentm"><code>@​trentm</code></a></li>
</ul>
<h3>:house: Internal</h3>
<ul>
<li>refactor(sdk-logs): alias <code>LoggerProviderConfig</code> to <code>LoggerProviderOptions</code> <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6691">#6691</a> <a href="https://github.com/david-luna"><code>@​david-luna</code></a></li>
<li>refactor(sdk-logs): use <code>Logger.enabled()</code> within <code>Logger.emit()</code> implementation <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6680">#6680</a> <a href="https://github.com/david-luna"><code>@​david-luna</code></a></li>
</ul>
<h2>experimental/v0.217.0</h2>
<h2>0.217.0</h2>
<h3>:rocket: Features</h3>
<ul>
<li>feat(otlp-transformer): replace protobufjs trace serialization with custom implementation <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6625">#6625</a> <a href="https://github.com/pichlermarc"><code>@​pichlermarc</code></a></li>
<li>feat(configuration): auto-generate TypeScript types from OTel declarative config JSON schema (stable v1.0.0) using <code>json-schema-to-typescript</code> and <code>ajv</code> <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6533">#6533</a> <a href="https://github.com/MikeGoldsmith"><code>@​MikeGoldsmith</code></a></li>
<li>feat(configuration, sdk-node): <code>startNodeSDK()</code> code path now uses <code>log_level</code> configuration to setup a DiagConsoleLogger <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6668">#6668</a> <a href="https://github.com/trentm"><code>@​trentm</code></a>
<ul>
<li>Note that allowed values for <code>log_level</code> in a configuration YAML file are <em>not</em> the same set as for <code>OTEL_LOG_LEVEL</code>. Use <code>log_level: trace</code> to see <em>all</em> logs (equivalent of <code>OTEL_LOG_LEVEL=ALL</code>). Use <code>log_level: fatal</code> to effectively disable the SDK's internal diagnostic logger (equivalent of <code>OTEL_LOG_LEVEL=NONE</code>).</li>
<li>If <code>log_level</code> is not specified, a diagnostic console logger at &quot;info&quot; level will be setup.</li>
<li>An invalid YAML config file will now result in a noop OTel SDK.</li>
</ul>
</li>
</ul>
<h3>:bug: Bug Fixes</h3>
<ul>
<li>fix(configuration): do not validate <code>OTEL_CONFIG_FILE</code> value before using it for file config <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6643">#6643</a> <a href="https://github.com/trentm"><code>@​trentm</code></a></li>
<li>fix(configuration): improve how 'additionalProperties' in JSON schema is translated to TS types <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6650">#6650</a> <a href="https://github.com/trentm"><code>@​trentm</code></a></li>
<li>fix(configuration): remove stripMinItems and preprocessNullArrays from validation/parsing <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6657">#6657</a> <a href="https://github.com/trentm"><code>@​trentm</code></a></li>
<li>fix(configuration): improve handling of enums in generated types <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6659">#6659</a> <a href="https://github.com/trentm"><code>@​trentm</code></a></li>
<li>fix(configuration): improve the technique for removing '| null' on types the JSON Schema <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6662">#6662</a> <a href="https://github.com/trentm"><code>@​trentm</code></a></li>
<li>fix(sampler-jaeger-remote): add missing axios dep <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6656">#6656</a> <a href="https://github.com/trentm"><code>@​trentm</code></a></li>
<li>fix(exporter-prometheus): handle malformed URLs in Prometheus exporter request handler <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6674">#6674</a> <a href="https://github.com/homanp"><code>@​homanp</code></a></li>
</ul>
<h2>experimental/v0.216.0</h2>
<h2>0.216.0</h2>
<h3>:rocket: Features</h3>
<ul>
<li>feat(sdk-node): wire attribute_keys from declarative configuration to ViewOptions.attributesProcessors <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6427">#6427</a> <a href="https://github.com/ravitheja4531-cell"><code>@​ravitheja4531-cell</code></a></li>
<li>feat(sdk-node): set TracerProvider in startNodeSDK() <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6607">#6607</a> <a href="https://github.com/maryliag"><code>@​maryliag</code></a></li>
</ul>
<h3>:bug: Bug Fixes</h3>
<ul>
<li>fix(instrumentation-xml-http-request): avoid unwrapping <code>XMLHttpRequest</code> API when disabling <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6611">#6611</a> <a href="https://github.com/david-luna"><code>@​david-luna</code></a></li>
<li>fix(instrumentation-fetch): tolerate non-writable <code>globalThis.fetch</code> and fix premature <code>_isEnabled</code> / <code>_isFetchPatched</code> flips in <code>enable()</code> <a href="https://github.com/brunorodmoreira"><code>@​brunorodmoreira</code></a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/06ad0eaaecbd49f5ead871325f852cc2a3454079"><code>06ad0ea</code></a> chore: prepare next release (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6703">#6703</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/38ca257e64ebd13f5603d5539f8a48d6d9232037"><code>38ca257</code></a> feat(otlp-transformer): replace protobufjs metrics serialization with custom ...</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/013c60085b84351a4c1e4e4f79e3dd67c56661cd"><code>013c600</code></a> chore: prepare next release (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6699">#6699</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/b7a0c63bde39d7916fdb73cbb3d64cf1c93282c5"><code>b7a0c63</code></a> feat(semantic-conventions): update semantic conventions to v1.41.1 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6695">#6695</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/774143b2c6667c6537c000ab48ea5ce998278ca0"><code>774143b</code></a> chore(renovate): add minimumReleaseAge to config (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6697">#6697</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/e0dafe0d9fadaccf7dd8d7b02dd85531356e2ac1"><code>e0dafe0</code></a> fix(otlp-exporter-base): remove brackets from IPv6 hostname in HTTP transport...</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/f804c93d1d6d903036b8bf38f8c3713dbbaf0360"><code>f804c93</code></a> chore(deps): update github/codeql-action digest to 68bde55 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6682">#6682</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/95e48e7afcc475ded350b95b43070c54591ecbbb"><code>95e48e7</code></a> refactor(sdk-logs): alias <code>LoggerProviderConfig</code> to <code>LoggerProviderOptions</code> (...</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/907b627d9ada25844b0f06551ecd9bbda5c0ea4f"><code>907b627</code></a> feat(sdk-node): allow startNodeSDK() without an arg (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6688">#6688</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/0d1526198fafe7f90078ff353103d0427e6c64d4"><code>0d15261</code></a> docs: Add SIG meeting info and welcoming language (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6689">#6689</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/open-telemetry/opentelemetry-js/compare/experimental/v0.215.0...experimental/v0.218.0">compare view</a></li>
</ul>
</details>
<br />

Updates `fast-uri` from 3.0.1 to 3.1.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/fastify/fast-uri/releases">fast-uri's releases</a>.</em></p>
<blockquote>
<h2>v3.1.2</h2>
<h2>⚠️ Security Release</h2>
<ul>
<li>Fix for <a href="https://github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc">https://github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc</a></li>
</ul>
<h2>What's Changed</h2>
<ul>
<li>Handle malformed fragment decoding as a parse error by <a href="https://github.com/mcollina"><code>@​mcollina</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/171">fastify/fast-uri#171</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/fastify/fast-uri/compare/v3.1.1...v3.1.2">https://github.com/fastify/fast-uri/compare/v3.1.1...v3.1.2</a></p>
<h2>v3.1.1</h2>
<h2>⚠️ Security Release</h2>
<ul>
<li>Fix for <a href="https://github.com/fastify/fast-uri/security/advisories/GHSA-q3j6-qgpj-74h6">https://github.com/fastify/fast-uri/security/advisories/GHSA-q3j6-qgpj-74h6</a></li>
</ul>
<h2>What's Changed</h2>
<ul>
<li>build(deps-dev): bump tsd from 0.32.0 to 0.33.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/fastify/fast-uri/pull/148">fastify/fast-uri#148</a></li>
<li>build(deps): bump actions/checkout from 4 to 5 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/fastify/fast-uri/pull/149">fastify/fast-uri#149</a></li>
<li>chore(.npmrc): ignore scripts by <a href="https://github.com/Fdawgs"><code>@​Fdawgs</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/150">fastify/fast-uri#150</a></li>
<li>build(deps-dev): remove <code>@​fastify/pre-commit</code> by <a href="https://github.com/Fdawgs"><code>@​Fdawgs</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/151">fastify/fast-uri#151</a></li>
<li>build(deps): bump actions/setup-node from 4 to 5 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/fastify/fast-uri/pull/152">fastify/fast-uri#152</a></li>
<li>ci(ci): add concurrency config by <a href="https://github.com/Fdawgs"><code>@​Fdawgs</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/153">fastify/fast-uri#153</a></li>
<li>build(deps): bump actions/setup-node from 5 to 6 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/fastify/fast-uri/pull/154">fastify/fast-uri#154</a></li>
<li>build(deps): bump actions/checkout from 5 to 6 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/fastify/fast-uri/pull/156">fastify/fast-uri#156</a></li>
<li>chore(license): standardise license notice by <a href="https://github.com/Fdawgs"><code>@​Fdawgs</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/159">fastify/fast-uri#159</a></li>
<li>style: remove trailing whitespace by <a href="https://github.com/Fdawgs"><code>@​Fdawgs</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/161">fastify/fast-uri#161</a></li>
<li>ci: remove unused github files by <a href="https://github.com/Tony133"><code>@​Tony133</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/162">fastify/fast-uri#162</a></li>
<li>chore: update readme by <a href="https://github.com/Tony133"><code>@​Tony133</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/164">fastify/fast-uri#164</a></li>
<li>build(deps): bump fastify/workflows/.github/workflows/plugins-ci-package-manager.yml from 5 to 6 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/fastify/fast-uri/pull/165">fastify/fast-uri#165</a></li>
<li>build(deps): bump fastify/workflows/.github/workflows/plugins-ci.yml from 5 to 6 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/fastify/fast-uri/pull/166">fastify/fast-uri#166</a></li>
<li>build(deps-dev): bump neostandard from 0.12.2 to 0.13.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/fastify/fast-uri/pull/167">fastify/fast-uri#167</a></li>
<li>ci: add lock-threads workflow by <a href="https://github.com/Fdawgs"><code>@​Fdawgs</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/169">fastify/fast-uri#169</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/Tony133"><code>@​Tony133</code></a> made their first contribution in <a href="https://redirect.github.com/fastify/fast-uri/pull/162">fastify/fast-uri#162</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/fastify/fast-uri/compare/v3.1.0...v3.1.1">https://github.com/fastify/fast-uri/compare/v3.1.0...v3.1.1</a></p>
<h2>v3.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li>ci: remove master branch support by <a href="https://github.com/Fdawgs"><code>@​Fdawgs</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/126">fastify/fast-uri#126</a></li>
<li>chore(test) remove .gitkeep by <a href="https://github.com/Fdawgs"><code>@​Fdawgs</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/128">fastify/fast-uri#128</a></li>
<li>ci(ci): set job permissions by <a href="https://github.com/Fdawgs"><code>@​Fdawgs</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/129">fastify/fast-uri#129</a></li>
<li>ci: set permissions at workflow level by <a href="https://github.com/Fdawgs"><code>@​Fdawgs</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/131">fastify/fast-uri#131</a></li>
<li>ci: set workflow permissions to read-only by default by <a href="https://github.com/Fdawgs"><code>@​Fdawgs</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/132">fastify/fast-uri#132</a></li>
<li>ci(ci): restore job level permissions by <a href="https://github.com/Fdawgs"><code>@​Fdawgs</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/133">fastify/fast-uri#133</a></li>
<li>build(deps-dev): bump tsd from 0.31.2 to 0.32.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/fastify/fast-uri/pull/134">fastify/fast-uri#134</a></li>
<li>ci(ci): pin actions to commit-hash by <a href="https://github.com/Fdawgs"><code>@​Fdawgs</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/135">fastify/fast-uri#135</a></li>
<li>ci: add node 24 to test matrix by <a href="https://github.com/Fdawgs"><code>@​Fdawgs</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/136">fastify/fast-uri#136</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/fastify/fast-uri/commit/919dd8ea7689fcc220d0d9b71307f5095e723ef9"><code>919dd8e</code></a> Bumped v3.1.2</li>
<li><a href="https://github.com/fastify/fast-uri/commit/c65ba573714af6b8e19e481d9444c27bc4355d07"><code>c65ba57</code></a> fixup: linting</li>
<li><a href="https://github.com/fastify/fast-uri/commit/6c86c17c3d76fb93aa3700ec6c0fa00faeb97293"><code>6c86c17</code></a> Merge commit from fork</li>
<li><a href="https://github.com/fastify/fast-uri/commit/a95158ad308df4d92bbde4eba699ce5165e9f796"><code>a95158a</code></a> Handle malformed fragment decoding without throwing (<a href="https://redirect.github.com/fastify/fast-uri/issues/171">#171</a>)</li>
<li><a href="https://github.com/fastify/fast-uri/commit/cea547c91c6aae610041b17b75792ca4aa035a6d"><code>cea547c</code></a> Bumped v3.1.1</li>
<li><a href="https://github.com/fastify/fast-uri/commit/876ce79b662c3e5015e4e7dffe6f37752ad34f35"><code>876ce79</code></a> Merge commit from fork</li>
<li><a href="https://github.com/fastify/fast-uri/commit/dcdf690b71a7bb3a19887ada65a9ab160d83bcc0"><code>dcdf690</code></a> ci: add lock-threads workflow (<a href="https://redirect.github.com/fastify/fast-uri/issues/169">#169</a>)</li>
<li><a href="https://github.com/fastify/fast-uri/commit/c860e6589b1ac346f66e114b4eadb9613768108c"><code>c860e65</code></a> build(deps-dev): bump neostandard from 0.12.2 to 0.13.0 (<a href="https://redirect.github.com/fastify/fast-uri/issues/167">#167</a>)</li>
<li><a href="https://github.com/fastify/fast-uri/commit/9b4c6dc82fde0ca44e674403ece9185d85bb6d5f"><code>9b4c6dc</code></a> build(deps): bump fastify/workflows/.github/workflows/plugins-ci.yml (<a href="https://redirect.github.com/fastify/fast-uri/issues/166">#166</a>)</li>
<li><a href="https://github.com/fastify/fast-uri/commit/85d09a9f7aa76b32c2bb005a90a71e144c361d24"><code>85d09a9</code></a> build(deps): bump fastify/workflows/.github/workflows/plugins-ci-package-mana...</li>
<li>Additional commits viewable in <a href="https://github.com/fastify/fast-uri/compare/v3.0.1...v3.1.2">compare view</a></li>
</ul>
</details>
<br />

Updates `flatted` from 3.3.3 to 3.4.2
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/WebReflection/flatted/commit/3bf09091c3562e17a0647bc06710dd6097079cf7"><code>3bf0909</code></a> 3.4.2</li>
<li><a href="https://github.com/WebReflection/flatted/commit/885ddcc33cf9657caf38c57c7be45ae1c5272802"><code>885ddcc</code></a> fix CWE-1321</li>
<li><a href="https://github.com/WebReflection/flatted/commit/0bdba705d130f00892b1b8fcc80cf4cdea0631e3"><code>0bdba70</code></a> added flatted-view to the benchmark</li>
<li><a href="https://github.com/WebReflection/flatted/commit/2a02dce7c641dec31194c67663f9b0b12e62da20"><code>2a02dce</code></a> 3.4.1</li>
<li><a href="https://github.com/WebReflection/flatted/commit/fba4e8f2e113665da275b19cd0f695f3d98e9416"><code>fba4e8f</code></a> Merge pull request <a href="https://redirect.github.com/WebReflection/flatted/issues/89">#89</a> from WebReflection/python-fix</li>
<li><a href="https://github.com/WebReflection/flatted/commit/5fe86485e6df7f7f34a07a2a85498bd3e17384e7"><code>5fe8648</code></a> added &quot;when in Rome&quot; also a test for PHP</li>
<li><a href="https://github.com/WebReflection/flatted/commit/53517adbefe724fe472b2f9ebcdb01910d0ae3f0"><code>53517ad</code></a> some minor improvement</li>
<li><a href="https://github.com/WebReflection/flatted/commit/b3e2a0c387bf446435fec45ad7f05299f012346f"><code>b3e2a0c</code></a> Fixing recursion issue in Python too</li>
<li><a href="https://github.com/WebReflection/flatted/commit/c4b46dbcbf782326e54ea1b65d3ebb1dc7a23fad"><code>c4b46db</code></a> Add SECURITY.md for security policy and reporting</li>
<li><a href="https://github.com/WebReflection/flatted/commit/f86d071e0f70de5a7d8200198824a3f07fc9c988"><code>f86d071</code></a> Create dependabot.yml for version updates</li>
<li>Additional commits viewable in <a href="https://github.com/WebReflection/flatted/compare/v3.3.3...v3.4.2">compare view</a></li>
</ul>
</details>
<br />

Updates `immutable` from 5.1.1 to 5.1.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/immutable-js/immutable-js/releases">immutable's releases</a>.</em></p>
<blockquote>
<h2>v5.1.5</h2>
<h2>What's Changed</h2>
<ul>
<li>Fix Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable</li>
<li>Upgrade devtools and use immutable version by <a href="https://github.com/jdeniau"><code>@​jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2158">immutable-js/immutable-js#2158</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/immutable-js/immutable-js/compare/v5.1.4...v5.1.5">https://github.com/immutable-js/immutable-js/compare/v5.1.4...v5.1.5</a></p>
<h2>v5.1.4</h2>
<h2>What's Changed</h2>
<ul>
<li>Migrate some files to TS by <a href="https://github.com/jdeniau"><code>@​jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2125">immutable-js/immutable-js#2125</a>
<ul>
<li>Iterator.ts</li>
<li>PairSorting.ts</li>
<li>toJS.ts</li>
<li>Math.ts</li>
<li>Hash.ts</li>
</ul>
</li>
<li>Extract CollectionHelperMethods and convert to TS by <a href="https://github.com/jdeniau"><code>@​jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2131">immutable-js/immutable-js#2131</a></li>
<li>Use npm <a href="https://docs.npmjs.com/trusted-publishers">trusted publishing only</a> to avoid token stealing.</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Fix/a11y issues by <a href="https://github.com/lyannel"><code>@​lyannel</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2136">immutable-js/immutable-js#2136</a></li>
<li>Doc add Map.get signature update by <a href="https://github.com/borracciaBlu"><code>@​borracciaBlu</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2138">immutable-js/immutable-js#2138</a></li>
<li>fix(doc):minor-issues#2132 by <a href="https://github.com/JayMeDotDot"><code>@​JayMeDotDot</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2133">immutable-js/immutable-js#2133</a></li>
<li>Fix algolia search by <a href="https://github.com/jdeniau"><code>@​jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2135">immutable-js/immutable-js#2135</a></li>
<li>Typo in OrderedMap by <a href="https://github.com/jdeniau"><code>@​jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2144">immutable-js/immutable-js#2144</a></li>
</ul>
<h3>Internal</h3>
<ul>
<li>chore: Sort all imports and activate eslint import rule by <a href="https://github.com/jdeniau"><code>@​jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2119">immutable-js/immutable-js#2119</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/JayMeDotDot"><code>@​JayMeDotDot</code></a> made their first contribution in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2133">immutable-js/immutable-js#2133</a></li>
<li><a href="https://github.com/lyannel"><code>@​lyannel</code></a> made their first contribution in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2136">immutable-js/immutable-js#2136</a></li>
<li><a href="https://github.com/borracciaBlu"><code>@​borracciaBlu</code></a> made their first contribution in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2138">immutable-js/immutable-js#2138</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/immutable-js/immutable-js/compare/v5.1.3...v5.1.4">https://github.com/immutable-js/immutable-js/compare/v5.1.3...v5.1.4</a></p>
<h2>v5.1.3</h2>
<h2>What's Changed</h2>
<h3>TypeScript</h3>
<ul>
<li>fix: allow readonly map entry constructor by <a href="https://github.com/septs"><code>@​septs</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2123">immutable-js/immutable-js#2123</a></li>
</ul>
<h3>Documentation</h3>
<p>There has been a huge amount of changes in the documentation, mainly migrate from an autogenerated documentation from .d.ts file, to a proper documentation in markdown.
The playground has been included on nearly all method examples.</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md">immutable's changelog</a>.</em></p>
<blockquote>
<h2>5.1.5</h2>
<ul>
<li>Fix Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable</li>
</ul>
<h2>5.1.4</h2>
<ul>
<li>Migrate some files to TS by <a href="https://github.com/jdeniau"><code>@​jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2125">immutable-js/immutable-js#2125</a>
<ul>
<li>Iterator.ts</li>
<li>PairSorting.ts</li>
<li>toJS.ts</li>
<li>Math.ts</li>
<li>Hash.ts</li>
</ul>
</li>
<li>Extract CollectionHelperMethods and convert to TS by <a href="https://github.com/jdeniau"><code>@​jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2131">immutable-js/immutable-js#2131</a></li>
<li>Use npm <a href="https://docs.npmjs.com/trusted-publishers">trusted publishing only</a> to avoid token stealing.</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Fix/a11y issues by <a href="https://github.com/lyannel"><code>@​lyannel</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2136">immutable-js/immutable-js#2136</a></li>
<li>Doc add Map.get signature update by <a href="https://github.com/borracciaBlu"><code>@​borracciaBlu</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2138">immutable-js/immutable-js#2138</a></li>
<li>fix(doc):minor-issues#2132 by <a href="https://github.com/JayMeDotDot"><code>@​JayMeDotDot</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2133">immutable-js/immutable-js#2133</a></li>
<li>Fix algolia search by <a href="https://github.com/jdeniau"><code>@​jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2135">immutable-js/immutable-js#2135</a></li>
<li>Typo in OrderedMap by <a href="https://github.com/jdeniau"><code>@​jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2144">immutable-js/immutable-js#2144</a></li>
</ul>
<h3>Internal</h3>
<ul>
<li>chore: Sort all imports and activate eslint import rule by <a href="https://github.com/jdeniau"><code>@​jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2119">immutable-js/immutable-js#2119</a></li>
</ul>
<h2>5.1.3</h2>
<h3>TypeScript</h3>
<ul>
<li>fix: allow readonly map entry constructor by <a href="https://github.com/septs"><code>@​septs</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2123">immutable-js/immutable-js#2123</a></li>
</ul>
<h3>Documentation</h3>
<p>There has been a huge amount of changes in the documentation, mainly migrate from an autogenerated documentation from .d.ts file, to a proper documentation in markdown.
The playground has been included on nearly all method examples.
We added a page about browser extensions too: <a href="https://immutable-js.com/browser-extension/">https://immutable-js.com/browser-extension/</a></p>
<h3>Internal</h3>
<ul>
<li>replace rimraf by a node script by <a href="https://github.com/jdeniau"><code>@​jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2113">immutable-js/immutable-js#2113</a></li>
<li>remove warning for tseslint config by <a href="https://github.com/jdeniau"><code>@​jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2114">immutable-js/immutable-js#2114</a></li>
<li>Use default tsconfig for tests by <a href="https://github.com/jdeniau"><code>@​jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2055">immutable-js/immutable-js#2055</a></li>
<li>add tests for arrCopy by <a href="https://github.com/jdeniau"><code>@​jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2120">immutable-js/immutable-js#2120</a></li>
</ul>
<h2>5.1.2</h2>
<ul>
<li>Revert previous assertion as it introduced a regression <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2102">#2102</a> by <a href="https://github.com/giggo1604"><code>@​giggo1604</code></a></li>
<li>Merge should work with empty record <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2103">#2103</a> by <a href="https://github.com/jdeniau"><code>@​jdeniau</code></a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/immutable-js/immutable-js/commit/b37b85568632227751ddc8a16034cacc0f42b652"><code>b37b855</code></a> 5.1.5</li>
<li><a href="https://github.com/immutable-js/immutable-js/commit/16b3313fdf2c5f579f10799e22869f6909abf945"><code>16b3313</code></a> Merge commit from fork</li>
<li><a href="https://github.com/immutable-js/immutable-js/commit/fd2ef4977ee654c5bf26368dbf2f983c8d679bd6"><code>fd2ef49</code></a> fix new proto key injection</li>
<li><a href="https://github.com/immutable-js/immutable-js/commit/6734b7b2af7e9dadf517eb9473cc64d2dfe2e301"><code>6734b7b</code></a> fix Prototype Pollution in mergeDeep, toJS, etc.</li>
<li><a href="https://github.com/immutable-js/immutable-js/commit/6f772de1e44dcde14128e48d19081a7a077f2162"><code>6f772de</code></a> Merge pull request <a href="https://redirect.github.com/immutable-js/immutable-js/issues/2175">#2175</a> from immutable-js/dependabot/npm_and_yarn/rollup-4.59.0</li>
<li><a href="https://github.com/immutable-js/immutable-js/commit/5f3dc61fd0e231654f04a850b8764e7e864c54b3"><code>5f3dc61</code></a> Bump rollup from 4.34.8 to 4.59.0</li>
<li><a href="https://github.com/immutable-js/immutable-js/commit/049a594410962c13dfd0f2d0bf0ef2154271079e"><code>049a594</code></a> Merge pull request <a href="https://redirect.github.com/immutable-js/immutable-js/issues/2173">#2173</a> from immutable-js/dependabot/npm_and_yarn/lodash-4.1...</li>
<li><a href="https://github.com/immutable-js/immutable-js/commit/2481a77331122eea4ace8afd4842042c6ae7510c"><code>2481a77</code></a> Merge pull request <a href="https://redirect.github.com/immutable-js/immutable-js/issues/2172">#2172</a> from mrazauskas/update-tstyche</li>
<li><a href="https://github.com/immutable-js/immutable-js/commit/eb047790b44dac8e5ace49529a5c9928edfc8e12"><code>eb04779</code></a> Bump lodash from 4.17.21 to 4.17.23</li>
<li><a href="https://github.com/immutable-js/immutable-js/commit/b973bf3b6242c9966143169825e1e14248c07c31"><code>b973bf3</code></a> format</li>
<li>Additional commits viewable in <a href="https://github.com/immutable-js/immutable-js/compare/v5.1.1...v5.1.5">compare view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for immutable since your current version.</p>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/Laksan99/docs/network/alerts).

</details>

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Upgrade dependencies to pick up security fixes and stability improvements. Key changes: `next` → 16.2.6 and `@opentelemetry/sdk-node` → 0.218.0, plus lockfile updates.

- **Dependencies**
  - `next` 16.2.6 (security and bug fixes).
  - `@opentelemetry/sdk-node` 0.218.0 (config and DX improvements).
  - `fast-uri` 3.1.2 (security fix for malformed fragments).
  - `flatted` 3.4.2 (CWE-1321 fix).
  - `immutable` 5.1.5 (prototype pollution fix).
  - `protobufjs` 7.5.8 (parser hardening).

<sup>Written for commit 715d14e. Summary will update on new commits.</sup>

<!-- End of auto-generated description by cubic. -->
@dependabot
Bump the npm_and_yarn group across 1 directory with 2 updates
4c79dbe 
Bumps the npm_and_yarn group with 2 updates in the / directory: [brace-expansion](https://github.com/juliangruber/brace-expansion) and [protobufjs](https://github.com/protobufjs/protobuf.js).


Updates `brace-expansion` from 1.1.13 to 5.0.6
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.13...v5.0.6)

Updates `protobufjs` from 8.0.1 to 8.4.0
- [Release notes](https://github.com/protobufjs/protobuf.js/releases)
- [Changelog](https://github.com/protobufjs/protobuf.js/blob/master/CHANGELOG.md)
- [Commits](protobufjs/protobuf.js@protobufjs-v8.0.1...protobufjs-v8.4.0)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 5.0.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: protobufjs
  dependency-version: 8.4.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@Laksan99
Bump the npm_and_yarn group across 1 directory with 2 updates
b893998 
Bumps the npm_and_yarn group with 2 updates in the / directory: [brace-expansion](https://github.com/juliangruber/brace-expansion) and [protobufjs](https://github.com/protobufjs/protobuf.js).

Updates `brace-expansion` from 1.1.13 to 5.0.6
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/juliangruber/brace-expansion/releases">brace-expansion's releases</a>.</em></p>
<blockquote>
<h2>v4.0.1</h2>
<ul>
<li>fmt  5a5cc17</li>
<li>Fix potential ReDoS Vulnerability or Inefficient Regular Expression (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/65">#65</a>)  0b6a978</li>
</ul>
<hr />
<p><a href="https://github.com/juliangruber/brace-expansion/compare/v4.0.0...v4.0.1">https://github.com/juliangruber/brace-expansion/compare/v4.0.0...v4.0.1</a></p>
<h2>v4.0.0</h2>
<ul>
<li>feat: use string replaces instead of splits (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/64">#64</a>)  278132b</li>
<li>fmt  dd72a59</li>
<li>add <code>tea.yaml</code>  70e4c1b</li>
</ul>
<p><a href="https://github.com/juliangruber/brace-expansion/compare/v3.0.0...v4.0.0">https://github.com/juliangruber/brace-expansion/compare/v3.0.0...v4.0.0</a></p>
<p>As a precaution to not risk breaking anything with 278132b, this is a new semver major release</p>
<h2>v3.0.1</h2>
<ul>
<li>pkg: publish on tag 3.x  3059c07</li>
<li>fmt  8229e6f</li>
<li>Fix potential ReDoS Vulnerability or Inefficient Regular Expression (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/65">#65</a>)  15f9b3c</li>
</ul>
<hr />
<p><a href="https://github.com/juliangruber/brace-expansion/compare/v3.0.0...v3.0.1">https://github.com/juliangruber/brace-expansion/compare/v3.0.0...v3.0.1</a></p>
<h2>v3.0.0</h2>
<ul>
<li>Switch to ES Modules and balanced-match 3.0.0 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/62">#62</a>)  c0360e8</li>
<li>added jsdoc (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/55">#55</a>)  68c0e37</li>
<li>node 16 is EOL  9e781e9</li>
<li>add standard  3494c4d</li>
<li>use const and let (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/57">#57</a>)  dd5a4cb</li>
<li>docs  6dad209</li>
<li>remove <code>test</code>  e3dd8ae</li>
<li>ci: update node versions  d23ede9</li>
<li>docs: add <a href="https://github.com/lanodan"><code>@​lanodan</code></a> to contributors  1eb3fa4</li>
<li>docs  1e7c9cd</li>
<li>switch from tape to test module (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/60">#60</a>)  2520537</li>
<li>Bump minimist from 1.2.5 to 1.2.6 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/59">#59</a>)  61a94f1</li>
<li>Bump path-parse from 1.0.6 to 1.0.7 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/51">#51</a>)  dc741cf</li>
<li>docs: add back ci badge  8ee5626</li>
<li>Add github actions, remove travis. Closes <a href="https://redirect.github.com/juliangruber/brace-expansion/issues/52">#52</a> (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/53">#53</a>)  5c8756a</li>
<li>CI: Drop unused sudo: false Travis directive (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/50">#50</a>)  05978a7</li>
</ul>
<p><a href="https://github.com/juliangruber/brace-expansion/compare/v2.0.1...v3.0.0">https://github.com/juliangruber/brace-expansion/compare/v2.0.1...v3.0.0</a></p>
<h2>v2.0.2</h2>
<ul>
<li>pkg: publish on tag 2.x  14f1d91</li>
<li>fmt  ed7780a</li>
<li>Fix potential ReDoS Vulnerability or Inefficient Regular Expression (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/65">#65</a>)  36603d5</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/juliangruber/brace-expansion/commit/46317b5d8779c151d24f65c9c139cd076f91a1c3"><code>46317b5</code></a> 5.0.6</li>
<li><a href="https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5"><code>c0b095b</code></a> Merge commit from fork</li>
<li><a href="https://github.com/juliangruber/brace-expansion/commit/ec5602085a81ca7c954f6780c6a3aef0b1e200cf"><code>ec56020</code></a> Bump picomatch from 4.0.3 to 4.0.4 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/93">#93</a>)</li>
<li><a href="https://github.com/juliangruber/brace-expansion/commit/87939017c6cb6be56b98c6fa2059b073315cd534"><code>8793901</code></a> 5.0.5</li>
<li><a href="https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051"><code>9a02af5</code></a> Merge commit from fork</li>
<li><a href="https://github.com/juliangruber/brace-expansion/commit/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a"><code>daa71bc</code></a> Bump tar from 7.5.10 to 7.5.11 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/92">#92</a>)</li>
<li><a href="https://github.com/juliangruber/brace-expansion/commit/799e5f7a222b0ea29052090b80fab2125a846543"><code>799e5f7</code></a> Bump tar from 7.5.9 to 7.5.10 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/90">#90</a>)</li>
<li><a href="https://github.com/juliangruber/brace-expansion/commit/012c230b7f71ca0c43febfa2dc3b710f63f129dd"><code>012c230</code></a> 5.0.4</li>
<li><a href="https://github.com/juliangruber/brace-expansion/commit/243c491714270462decf1293b395e0aa6f6c15c4"><code>243c491</code></a> Fix handling of brackets. Closes <a href="https://redirect.github.com/juliangruber/brace-expansion/issues/87">#87</a></li>
<li><a href="https://github.com/juliangruber/brace-expansion/commit/609f8588070198ca6ff7132d2f78bbae5c991b93"><code>609f858</code></a> Correct incorrect brace-expansion import (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/89">#89</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/juliangruber/brace-expansion/compare/v1.1.13...v5.0.6">compare view</a></li>
</ul>
</details>
<details>
<summary>Install script changes</summary>
<p>This version adds <code>prepare</code> script that runs during installation. Review the package contents before updating.</p>
</details>
<br />

Updates `protobufjs` from 8.0.1 to 8.4.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/protobufjs/protobuf.js/releases">protobufjs's releases</a>.</em></p>
<blockquote>
<h2>protobufjs: v8.4.0</h2>
<h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v8.3.0...protobufjs-v8.4.0">8.4.0</a> (2026-05-18)</h2>
<h3>Features</h3>
<ul>
<li>Support BigInt conversions (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2257">#2257</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/36873e69285251a7b6db8d14c8858fc31ef521d8">36873e6</a>)</li>
</ul>
<h2>protobufjs: v8.3.0</h2>
<h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v8.2.1...protobufjs-v8.3.0">8.3.0</a> (2026-05-13)</h2>
<h3>Features</h3>
<ul>
<li>Improve generated typings (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2244">#2244</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/faa424e3837fe43f1f010b0ccdeb583d808a57cf">faa424e</a>)</li>
</ul>
<h2>protobufjs: v8.2.1</h2>
<h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v8.2.0...protobufjs-v8.2.1">8.2.1</a> (2026-05-13)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>Consolidate depth limit checks (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2246">#2246</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/9050289ad214ea351d3b030cbc74385e81e02d79">9050289</a>)</li>
<li>Preserve explicit enum zero if not the default (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2249">#2249</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/9621b35eb1f6bbecf098f8f5ba59e8d02eca7524">9621b35</a>)</li>
</ul>
<h3>Performance Improvements</h3>
<ul>
<li>Slightly optimize generated code (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2242">#2242</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/c41160cda6a5f65b0960b194e7f32dd7e7d5ed49">c41160c</a>)</li>
</ul>
<h2>protobufjs: v8.2.0</h2>
<h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v8.0.3...protobufjs-v8.2.0">8.2.0</a> (2026-05-09)</h2>
<h3>Features</h3>
<ul>
<li>Add finishInto() for zero-copy serialization into existing buffers (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2196">#2196</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/657d6f1328fa9bb55c5be2b8055e68f8da4da98b">657d6f1</a>)</li>
<li>Add textformat extension (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2233">#2233</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/4639e2960789f4cc58af1908934caaf14c1fadbc">4639e29</a>)</li>
<li><strong>cli:</strong> Add optional protoc-gen-pbjs plugin (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2231">#2231</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/c9b6a2d2a6f81dd78812a6ce177fa7a5f9de885d">c9b6a2d</a>)</li>
<li><strong>cli:</strong> Align json-module with static-module output (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2227">#2227</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/a015091a5862bdae9eb213b6554ab7e5b36187cb">a015091</a>)</li>
<li>Roundtrip unknown fields (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2209">#2209</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/76fa03c252542b607e4c81a4fe4db12aa1f948af">76fa03c</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>Accept URL-safe base64 input (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2207">#2207</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/57a3821de0d2ffdac06973be49554dea0332bb7f">57a3821</a>)</li>
<li>Also resolve common definitions by file name (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2218">#2218</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/e533950dbdc1a5e31ca3611e711a9042019c18c3">e533950</a>)</li>
<li>Apply oneof last-value wins during decode (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2193">#2193</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/cf35cdc23237c06e7de603fa8fe36e47b7c037e0">cf35cdc</a>)</li>
<li>Consistently handle scalar map keys (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2186">#2186</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/29b11834520bc4ab0bb377933e4efefbf95f93b2">29b1183</a>)</li>
<li>Consistently reject truncated strings (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2205">#2205</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/689e911efa3b7e81ea20f29ae2cd725566891c6a">689e911</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/protobufjs/protobuf.js/blob/master/CHANGELOG.md">protobufjs's changelog</a>.</em></p>
<blockquote>
<h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v8.3.0...protobufjs-v8.4.0">8.4.0</a> (2026-05-18)</h2>
<h3>Features</h3>
<ul>
<li>Support BigInt conversions (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2257">#2257</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/36873e69285251a7b6db8d14c8858fc31ef521d8">36873e6</a>)</li>
</ul>
<h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v8.2.1...protobufjs-v8.3.0">8.3.0</a> (2026-05-13)</h2>
<h3>Features</h3>
<ul>
<li>Improve generated typings (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2244">#2244</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/faa424e3837fe43f1f010b0ccdeb583d808a57cf">faa424e</a>)</li>
</ul>
<h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v8.2.0...protobufjs-v8.2.1">8.2.1</a> (2026-05-13)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>Consolidate depth limit checks (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2246">#2246</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/9050289ad214ea351d3b030cbc74385e81e02d79">9050289</a>)</li>
<li>Preserve explicit enum zero if not the default (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2249">#2249</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/9621b35eb1f6bbecf098f8f5ba59e8d02eca7524">9621b35</a>)</li>
</ul>
<h3>Performance Improvements</h3>
<ul>
<li>Slightly optimize generated code (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2242">#2242</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/c41160cda6a5f65b0960b194e7f32dd7e7d5ed49">c41160c</a>)</li>
</ul>
<h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v8.0.3...protobufjs-v8.2.0">8.2.0</a> (2026-05-09)</h2>
<h3>Features</h3>
<ul>
<li>Add finishInto() for zero-copy serialization into existing buffers (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2196">#2196</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/657d6f1328fa9bb55c5be2b8055e68f8da4da98b">657d6f1</a>)</li>
<li>Add textformat extension (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2233">#2233</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/4639e2960789f4cc58af1908934caaf14c1fadbc">4639e29</a>)</li>
<li><strong>cli:</strong> Add optional protoc-gen-pbjs plugin (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2231">#2231</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/c9b6a2d2a6f81dd78812a6ce177fa7a5f9de885d">c9b6a2d</a>)</li>
<li><strong>cli:</strong> Align json-module with static-module output (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2227">#2227</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/a015091a5862bdae9eb213b6554ab7e5b36187cb">a015091</a>)</li>
<li>Roundtrip unknown fields (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2209">#2209</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/76fa03c252542b607e4c81a4fe4db12aa1f948af">76fa03c</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>Accept URL-safe base64 input (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2207">#2207</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/57a3821de0d2ffdac06973be49554dea0332bb7f">57a3821</a>)</li>
<li>Also resolve common definitions by file name (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2218">#2218</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/e533950dbdc1a5e31ca3611e711a9042019c18c3">e533950</a>)</li>
<li>Apply oneof last-value wins during decode (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2193">#2193</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/cf35cdc23237c06e7de603fa8fe36e47b7c037e0">cf35cdc</a>)</li>
<li>Consistently handle scalar map keys (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2186">#2186</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/29b11834520bc4ab0bb377933e4efefbf95f93b2">29b1183</a>)</li>
<li>Consistently reject truncated strings (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2205">#2205</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/689e911efa3b7e81ea20f29ae2cd725566891c6a">689e911</a>)</li>
<li>Correct parsedOptions TypeScript types (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2217">#2217</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/dbe8d7775a46bebaf644461dce586fa29be242f6">dbe8d77</a>)</li>
<li>Decode bool values from full varints (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2192">#2192</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/7b8d5c111a5e517be219872fb36f4dcfe2b6d371">7b8d5c1</a>)</li>
<li>Decode fields by full wire tag (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2197">#2197</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/f6264b1890e85885a22fa323d983f46b6ba9a05e">f6264b1</a>)</li>
<li>Decode missing map message values as empty messages (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2206">#2206</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/51c1a4fd77169565bc6248f996f698ee396c90f0">51c1a4f</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/protobufjs/protobuf.js/commit/7c6e6f47fb5e12da2302f34a8e4fc8781234bef0"><code>7c6e6f4</code></a> chore: release master (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2259">#2259</a>)</li>
<li><a href="https://github.com/protobufjs/protobuf.js/commit/36873e69285251a7b6db8d14c8858fc31ef521d8"><code>36873e6</code></a> feat: Support BigInt conversions (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2257">#2257</a>)</li>
<li><a href="https://github.com/protobufjs/protobuf.js/commit/f4c4385b3536b3276d4d498f30de254642d3d63f"><code>f4c4385</code></a> docs: Share JSDoc patch with API docs (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2252">#2252</a>)</li>
<li><a href="https://github.com/protobufjs/protobuf.js/commit/a7993762d7440b9f33b98eb8c4a2f51b663971eb"><code>a799376</code></a> chore: release master (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2251">#2251</a>)</li>
<li><a href="https://github.com/protobufjs/protobuf.js/commit/faa424e3837fe43f1f010b0ccdeb583d808a57cf"><code>faa424e</code></a> feat: Improve generated typings (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2244">#2244</a>)</li>
<li><a href="https://github.com/protobufjs/protobuf.js/commit/c1251d94643a723de83196b29e1e7183b0b1bcca"><code>c1251d9</code></a> chore: release master (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2243">#2243</a>)</li>
<li><a href="https://github.com/protobufjs/protobuf.js/commit/cb44b9bb4afbca89a67163ff8796b6a4cdf9a3fa"><code>cb44b9b</code></a> deps: Update CLI peer depdedency</li>
<li><a href="https://github.com/protobufjs/protobuf.js/commit/9621b35eb1f6bbecf098f8f5ba59e8d02eca7524"><code>9621b35</code></a> fix: Preserve explicit enum zero if not the default (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2249">#2249</a>)</li>
<li><a href="https://github.com/protobufjs/protobuf.js/commit/bddae34c6fe85c6dcf76b653112992fb81788b5a"><code>bddae34</code></a> chore: Add FUNDING.yml</li>
<li><a href="https://github.com/protobufjs/protobuf.js/commit/9050289ad214ea351d3b030cbc74385e81e02d79"><code>9050289</code></a> fix: Consolidate depth limit checks (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2246">#2246</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v8.0.1...protobufjs-v8.4.0">compare view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for protobufjs since your current version.</p>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/Laksan99/docs/network/alerts).

</details>

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Update `brace-expansion` to 5.0.6 and `protobufjs` to 8.4.0 to fix a ReDoS risk and add BigInt support and other upstream fixes. Only `package-lock.json` changed.

- **Dependencies**
  - `brace-expansion`: 1.1.13 → 5.0.6 (addresses regex DoS vulnerability)
  - `protobufjs`: 8.0.1 → 8.4.0 (BigInt conversions, typing improvements, bug fixes)

<sup>Written for commit 4c79dbe. Summary will update on new commits. <a href="https://cubic.dev/pr/Laksan99/docs/pull/2?utm_source=github">Review in cubic</a></sup>

<!-- End of auto-generated description by cubic. -->
@dependabot
Bump the npm_and_yarn group across 1 directory with 10 updates
d40b69d 
Bumps the npm_and_yarn group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@opentelemetry/core](https://github.com/open-telemetry/opentelemetry-js) | `2.7.0` | `2.8.0` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.1` | `4.2.0` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.0.18` | `4.1.0` |
| [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) | `7.29.0` | `7.29.7` |
| [form-data](https://github.com/form-data/form-data) | `4.0.5` | `4.0.6` |
| [form-data](https://github.com/form-data/form-data) | `2.5.5` | `2.5.6` |
| [markdown-it](https://github.com/markdown-it/markdown-it) | `14.1.0` | `removed` |
| [tmp](https://github.com/raszi/node-tmp) | `0.2.5` | `0.2.7` |



Updates `@opentelemetry/core` from 2.7.0 to 2.8.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@v2.7.0...v2.8.0)

Updates `js-yaml` from 4.1.1 to 4.2.0
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/commits)

Updates `vitest` from 4.0.18 to 4.1.0
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.0/packages/vitest)

Updates `@babel/core` from 7.29.0 to 7.29.7
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.29.7/packages/babel-core)

Updates `@grpc/grpc-js` from 1.14.3 to 1.14.4
- [Release notes](https://github.com/grpc/grpc-node/releases)
- [Commits](https://github.com/grpc/grpc-node/compare/@grpc/grpc-js@1.14.3...@grpc/grpc-js@1.14.4)

Updates `protobufjs` from 7.6.0 to 7.6.4
- [Release notes](https://github.com/protobufjs/protobuf.js/releases)
- [Changelog](https://github.com/protobufjs/protobuf.js/blob/protobufjs-v7.6.4/CHANGELOG.md)
- [Commits](protobufjs/protobuf.js@protobufjs-v7.6.0...protobufjs-v7.6.4)

Updates `form-data` from 4.0.5 to 4.0.6
- [Release notes](https://github.com/form-data/form-data/releases)
- [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md)
- [Commits](form-data/form-data@v4.0.5...v4.0.6)

Updates `form-data` from 2.5.5 to 2.5.6
- [Release notes](https://github.com/form-data/form-data/releases)
- [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md)
- [Commits](form-data/form-data@v4.0.5...v4.0.6)

Removes `markdown-it`

Updates `tmp` from 0.2.5 to 0.2.7
- [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md)
- [Commits](raszi/node-tmp@v0.2.5...v0.2.7)

Updates `vite` from 7.3.2 to 7.3.5
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v7.3.5/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v7.3.5/packages/vite)

---
updated-dependencies:
- dependency-name: "@opentelemetry/core"
  dependency-version: 2.8.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 4.2.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: vitest
  dependency-version: 4.1.0
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: "@babel/core"
  dependency-version: 7.29.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@grpc/grpc-js"
  dependency-version: 1.14.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: protobufjs
  dependency-version: 7.6.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: form-data
  dependency-version: 4.0.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: form-data
  dependency-version: 2.5.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: markdown-it
  dependency-version:
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: tmp
  dependency-version: 0.2.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 7.3.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@Laksan99
Bump the npm_and_yarn group across 1 directory with 10 updates
f74bd5f 
Bumps the npm_and_yarn group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@opentelemetry/core](https://github.com/open-telemetry/opentelemetry-js) | `2.7.0` | `2.8.0` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.1` | `4.2.0` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.0.18` | `4.1.0` |
| [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) | `7.29.0` | `7.29.7` |
| [form-data](https://github.com/form-data/form-data) | `4.0.5` | `4.0.6` |
| [form-data](https://github.com/form-data/form-data) | `2.5.5` | `2.5.6` |
| [markdown-it](https://github.com/markdown-it/markdown-it) | `14.1.0` | `removed` |
| [tmp](https://github.com/raszi/node-tmp) | `0.2.5` | `0.2.7` |


Updates `@opentelemetry/core` from 2.7.0 to 2.8.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-js/releases">@​opentelemetry/core's releases</a>.</em></p>
<blockquote>
<h2>v2.8.0</h2>
<h2>2.8.0</h2>
<h3>:rocket: Features</h3>
<ul>
<li>feat(sdk-trace-base): pretty-print <code>SpanImpl</code>, <code>Tracer</code>, and <code>BasicTracerProvider</code> via <code>util.inspect</code> so they render through <code>diag</code> and <code>console.log</code> <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6690">#6690</a> <a href="https://github.com/mcollina"><code>@​mcollina</code></a></li>
<li>feat(sdk-metrics): implement metric reader self-observability metrics <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6449">#6449</a> <a href="https://github.com/anuraaga"><code>@​anuraaga</code></a></li>
<li>feat(core): add <code>hrTimeToSeconds</code> <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6449">#6449</a> <a href="https://github.com/anuraaga"><code>@​anuraaga</code></a></li>
</ul>
<h3>:bug: Bug Fixes</h3>
<ul>
<li>fix(core): limit processing of incoming &quot;baggage&quot; header to 8192 bytes <a href="https://github.com/pichlermarc"><code>@​pichlermarc</code></a></li>
</ul>
<h2>v2.7.1</h2>
<h2>2.7.1</h2>
<h3>:bug: Bug Fixes</h3>
<ul>
<li>fix(core, api): defer trace state validation. Deprecate trace state implementation in api <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6459">#6459</a> <a href="https://github.com/david-luna"><code>@​david-luna</code></a>
<ul>
<li><strong>important:</strong> this bug fix may be breaking for certain uses of <code>TraceState</code>
<ul>
<li><code>set</code> now returns the same <code>TraceState</code> instance if key/value are invalid or makes the while trace state invalid.</li>
<li><code>unset</code> now returns the same <code>TraceState</code> instance if key is not present.</li>
<li>best-effort parsing of invalid <code>TraceState</code>s has changed: when multiple keys with the same name are present, the most recent one will win.</li>
</ul>
</li>
</ul>
</li>
</ul>
<h3>:house: Internal</h3>
<ul>
<li>perf(sdk-trace-base): optimize TraceIdRatioBasedSampler performance <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6284">#6284</a> <a href="https://github.com/AbhiPrasad"><code>@​AbhiPrasad</code></a></li>
<li>perf(sdk-metrics): reduce loop overhead in sdk hot paths <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6593">#6593</a> <a href="https://github.com/mcollina"><code>@​mcollina</code></a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md">@​opentelemetry/core's changelog</a>.</em></p>
<blockquote>
<h2>2.8.0</h2>
<h3>:rocket: Features</h3>
<ul>
<li>feat(sdk-trace-base): pretty-print <code>SpanImpl</code>, <code>Tracer</code>, and <code>BasicTracerProvider</code> via <code>util.inspect</code> so they render through <code>diag</code> and <code>console.log</code> <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6690">#6690</a> <a href="https://github.com/mcollina"><code>@​mcollina</code></a></li>
<li>feat(sdk-metrics): implement metric reader self-observability metrics <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6449">#6449</a> <a href="https://github.com/anuraaga"><code>@​anuraaga</code></a></li>
<li>feat(core): add <code>hrTimeToSeconds</code> <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6449">#6449</a> <a href="https://github.com/anuraaga"><code>@​anuraaga</code></a></li>
</ul>
<h3>:bug: Bug Fixes</h3>
<ul>
<li>fix(core): limit processing of incoming &quot;baggage&quot; header to 8192 bytes <a href="https://github.com/pichlermarc"><code>@​pichlermarc</code></a></li>
</ul>
<h2>2.7.1</h2>
<h3>:bug: Bug Fixes</h3>
<ul>
<li>fix(core, api): defer trace state validation. Deprecate trace state implementation in api <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6459">#6459</a> <a href="https://github.com/david-luna"><code>@​david-luna</code></a>
<ul>
<li><strong>important:</strong> this bug fix may be breaking for certain uses of <code>TraceState</code>
<ul>
<li><code>set</code> now returns the same <code>TraceState</code> instance if key/value are invalid or makes the while trace state invalid.</li>
<li><code>unset</code> now returns the same <code>TraceState</code> instance if key is not present.</li>
<li>best-effort parsing of invalid <code>TraceState</code>s has changed: when multiple keys with the same name are present, the most recent one will win.</li>
</ul>
</li>
</ul>
</li>
</ul>
<h3>:house: Internal</h3>
<ul>
<li>perf(sdk-trace-base): optimize TraceIdRatioBasedSampler performance <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6284">#6284</a> <a href="https://github.com/AbhiPrasad"><code>@​AbhiPrasad</code></a></li>
<li>test: test Node.js 26 in CI <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6671">#6671</a> <a href="https://github.com/cjihrig"><code>@​cjihrig</code></a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/13a035bc695996cf4aec885fef7b9866f48bc555"><code>13a035b</code></a> chore: prepare next release (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6756">#6756</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/4b13587d1e08b47baf153e5312ccd08a3240d074"><code>4b13587</code></a> Merge commit from fork</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/71d195c508320295f1892aaed1ee2f1971ffb470"><code>71d195c</code></a> chore(renovate): set minimumReleaseAge to 3 days (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6792">#6792</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/555fca6ce94fb8d40a5f869dbd28e43143b4e730"><code>555fca6</code></a> Update renovate.json to use matchManagers (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6141">#6141</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/b711a81d5262904245d70f1857b6f3bc811b22cd"><code>b711a81</code></a> docs(otlp-exporter-base): add typedoc entry points so public API is indexed a...</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/da704029ccd291d65402f3d1c469bd3f25aec047"><code>da70402</code></a> fix(ci): supply-chain sec: disable caching in release-related workflow (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6790">#6790</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/002267b1c639aac1d2f1d6e5c7ac3ed023109ea0"><code>002267b</code></a> chore: complete the move to the smaller SPDX license header (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6791">#6791</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/056ef9c4e1ddf9306477b7ce26acc7be489f9c6c"><code>056ef9c</code></a> feat(sdk-metrics): implement metric reader metrics (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6449">#6449</a>)</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/3bd69ce18011f9a16a7231489d9c3acc8294e8d9"><code>3bd69ce</code></a> fix(configuration): improve environment variable substitution to handle all t...</li>
<li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/bfbda7c2d90e1686f51cd0fc4d02d785ab9a9cc0"><code>bfbda7c</code></a> docs(exporter-trace-otlp-grpc): import CompressionAlgorithm from otlp-exporte...</li>
<li>Additional commits viewable in <a href="https://github.com/open-telemetry/opentelemetry-js/compare/v2.7.0...v2.8.0">compare view</a></li>
</ul>
</details>
<br />

Updates `js-yaml` from 4.1.1 to 4.2.0
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md">js-yaml's changelog</a>.</em></p>
<blockquote>
<h2>[4.2.0] - 2026-06-01</h2>
<h3>Added</h3>
<ul>
<li>Added <code>docs/safety.md</code> with notes about processing untrusted YAML.</li>
<li>Added <code>maxDepth</code> (100) loader option. Not a problem, but gives a better
exception instead of RangeError on stack overflow.</li>
<li>Added <code>maxMergeSeqLength</code> (20) loader option. Not a problem after <code>merge</code> fix,
but an additional restriction for safety.</li>
<li>Added sourcemaps to <code>dist/</code> builds.</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Stop resolving numbers with underscores as numeric scalars, <a href="https://redirect.github.com/nodeca/js-yaml/issues/627">#627</a>.</li>
<li>Switched dev toolchains to Vite / neostandard.</li>
<li>Updated demo.</li>
<li>Reorganized tests.</li>
<li><code>dist/</code> files are no longer kept in the repository.</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fix parsing of properties on the first implicit block mapping key, <a href="https://redirect.github.com/nodeca/js-yaml/issues/62">#62</a>.</li>
<li>Fix trailing whitespace handling when folding flow scalar lines, <a href="https://redirect.github.com/nodeca/js-yaml/issues/307">#307</a>.</li>
<li>Reject top-level block scalars without content indentation, <a href="https://redirect.github.com/nodeca/js-yaml/issues/280">#280</a>.</li>
<li>Ensure numbers survive round-trip, <a href="https://redirect.github.com/nodeca/js-yaml/issues/737">#737</a>.</li>
<li>Fix test coverage for issue <a href="https://redirect.github.com/nodeca/js-yaml/issues/221">#221</a>.</li>
<li>Fix flow scalar trailing whitespace folding, <a href="https://redirect.github.com/nodeca/js-yaml/issues/307">#307</a>.</li>
<li>Fix digits in YAML named tag handles.</li>
</ul>
<h3>Security</h3>
<ul>
<li>Fix potential DoS via quadratic complexity in merge - deduplicate repeated
elements (makes sense for malformed files &gt; 10K).</li>
</ul>
<h2>[3.14.2] - 2025-11-15</h2>
<h3>Security</h3>
<ul>
<li>Backported v4.1.1 fix to v3</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a href="https://github.com/nodeca/js-yaml/commits">compare view</a></li>
</ul>
</details>
<br />

Updates `vitest` from 4.0.18 to 4.1.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/vitest-dev/vitest/releases">vitest's releases</a>.</em></p>
<blockquote>
<h2>v4.1.0</h2>
<p>Vitest 4.1 is out!</p>
<p>This release page lists all changes made to the project during the 4.1 beta. To get a review of all the new features, read our <a href="https://vitest.dev/blog/vitest-4-1">blog post</a>.</p>
<h3>   🚀 Features</h3>
<ul>
<li>Return a disposable from doMock()  -  by <a href="https://github.com/kirkwaiblinger"><code>@​kirkwaiblinger</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9332">vitest-dev/vitest#9332</a> <a href="https://github.com/vitest-dev/vitest/commit/e3e659a96"><!-- raw HTML omitted -->(e3e65)<!-- raw HTML omitted --></a></li>
<li>Added chai style assertions  -  by <a href="https://github.com/ronnakamoto"><code>@​ronnakamoto</code></a> and <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/8842">vitest-dev/vitest#8842</a> <a href="https://github.com/vitest-dev/vitest/commit/841df9ac5"><!-- raw HTML omitted -->(841df)<!-- raw HTML omitted --></a></li>
<li>Update to sinon/fake-timers v15 and add <code>setTickMode</code> to timer controls  -  by <a href="https://github.com/atscott"><code>@​atscott</code></a> and <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/8726">vitest-dev/vitest#8726</a> <a href="https://github.com/vitest-dev/vitest/commit/4b480aaed"><!-- raw HTML omitted -->(4b480)<!-- raw HTML omitted --></a></li>
<li>Expose matcher types  -  by <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9448">vitest-dev/vitest#9448</a> <a href="https://github.com/vitest-dev/vitest/commit/3e4b913b1"><!-- raw HTML omitted -->(3e4b9)<!-- raw HTML omitted --></a></li>
<li>Add <code>toTestSpecification</code> to reported tasks  -  by <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9464">vitest-dev/vitest#9464</a> <a href="https://github.com/vitest-dev/vitest/commit/1a4705da9"><!-- raw HTML omitted -->(1a470)<!-- raw HTML omitted --></a></li>
<li>Show a warning if <code>vi.mock</code> or <code>vi.hoisted</code> are declared outside of top level of the module  -  by <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9387">vitest-dev/vitest#9387</a> <a href="https://github.com/vitest-dev/vitest/commit/5db54a468"><!-- raw HTML omitted -->(5db54)<!-- raw HTML omitted --></a></li>
<li>Track and display expectedly failed tests (.fails) in UI and CLI  -  by <a href="https://github.com/Copilot"><code>@​Copilot</code></a>, <strong>sheremet-va</strong> and <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9476">vitest-dev/vitest#9476</a> <a href="https://github.com/vitest-dev/vitest/commit/77d75fd34"><!-- raw HTML omitted -->(77d75)<!-- raw HTML omitted --></a></li>
<li>Support tags  -  by <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9478">vitest-dev/vitest#9478</a> <a href="https://github.com/vitest-dev/vitest/commit/de7c8a521"><!-- raw HTML omitted -->(de7c8)<!-- raw HTML omitted --></a></li>
<li>Implement <code>aroundEach</code> and <code>aroundAll</code> hooks  -  by <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9450">vitest-dev/vitest#9450</a> <a href="https://github.com/vitest-dev/vitest/commit/2a8cb9dc2"><!-- raw HTML omitted -->(2a8cb)<!-- raw HTML omitted --></a></li>
<li>Stabilize experimental features  -  by <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9529">vitest-dev/vitest#9529</a> <a href="https://github.com/vitest-dev/vitest/commit/b5fd2a16a"><!-- raw HTML omitted -->(b5fd2)<!-- raw HTML omitted --></a></li>
<li>Accept <code>new</code> or <code>all</code> in <code>--update</code> flag  -  by <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9543">vitest-dev/vitest#9543</a> <a href="https://github.com/vitest-dev/vitest/commit/a5acf28a5"><!-- raw HTML omitted -->(a5acf)<!-- raw HTML omitted --></a></li>
<li>Support <code>meta</code> in test options  -  by <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9535">vitest-dev/vitest#9535</a> <a href="https://github.com/vitest-dev/vitest/commit/7d622e3d1"><!-- raw HTML omitted -->(7d622)<!-- raw HTML omitted --></a></li>
<li>Support type inference with a new <code>test.extend</code> syntax  -  by <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9550">vitest-dev/vitest#9550</a> <a href="https://github.com/vitest-dev/vitest/commit/e53854fcc"><!-- raw HTML omitted -->(e5385)<!-- raw HTML omitted --></a></li>
<li>Support vite 8 beta, fix type issues in the config with different vite versions  -  by <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9587">vitest-dev/vitest#9587</a> <a href="https://github.com/vitest-dev/vitest/commit/990281dfd"><!-- raw HTML omitted -->(99028)<!-- raw HTML omitted --></a></li>
<li>Add assertion helper to hide internal stack traces  -  by <a href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a> and <strong>Claude Opus 4.6</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9594">vitest-dev/vitest#9594</a> <a href="https://github.com/vitest-dev/vitest/commit/eeb0ae2f8"><!-- raw HTML omitted -->(eeb0a)<!-- raw HTML omitted --></a></li>
<li>Store failure screenshots using artifacts API  -  by <a href="https://github.com/macarie"><code>@​macarie</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9588">vitest-dev/vitest#9588</a> <a href="https://github.com/vitest-dev/vitest/commit/24603e3c4"><!-- raw HTML omitted -->(24603)<!-- raw HTML omitted --></a></li>
<li>Allow <code>vitest list</code> to statically collect tests instead of running files to collect them  -  by <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9630">vitest-dev/vitest#9630</a> <a href="https://github.com/vitest-dev/vitest/commit/7a8e7fc20"><!-- raw HTML omitted -->(7a8e7)<!-- raw HTML omitted --></a></li>
<li>Add <code>--detect-async-leaks</code>  -  by <a href="https://github.com/AriPerkkio"><code>@​AriPerkkio</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9528">vitest-dev/vitest#9528</a> <a href="https://github.com/vitest-dev/vitest/commit/c594d4af3"><!-- raw HTML omitted -->(c594d)<!-- raw HTML omitted --></a></li>
<li>Implement <code>mockThrow</code> and <code>mockThrowOnce</code>  -  by <a href="https://github.com/thor-juhasz"><code>@​thor-juhasz</code></a> and <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9512">vitest-dev/vitest#9512</a> <a href="https://github.com/vitest-dev/vitest/commit/619179fb7"><!-- raw HTML omitted -->(61917)<!-- raw HTML omitted --></a></li>
<li>Support <code>update: &quot;none&quot;</code> and add docs about snapshots behavior on CI  -  by <a href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9700">vitest-dev/vitest#9700</a> <a href="https://github.com/vitest-dev/vitest/commit/05f1854e2"><!-- raw HTML omitted -->(05f18)<!-- raw HTML omitted --></a></li>
<li>Support playwright <code>launchOptions</code> with <code>connectOptions</code>  -  by <a href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9702">vitest-dev/vitest#9702</a> <a href="https://github.com/vitest-dev/vitest/commit/f0ff1b2a0"><!-- raw HTML omitted -->(f0ff1)<!-- raw HTML omitted --></a></li>
<li>Add <code>page/locator.mark</code> API to enhance playwright trace  -  by <a href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9652">vitest-dev/vitest#9652</a> <a href="https://github.com/vitest-dev/vitest/commit/d0ee546fe"><!-- raw HTML omitted -->(d0ee5)<!-- raw HTML omitted --></a></li>
<li><strong>api</strong>:
<ul>
<li>Support tests starting or ending with <code>test</code> in <code>experimental_parseSpecification</code>  -  by <a href="https://github.com/jgillick"><code>@​jgillick</code></a> and <strong>Jeremy Gillick</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9235">vitest-dev/vitest#9235</a> <a href="https://github.com/vitest-dev/vitest/commit/2f367fad3"><!-- raw HTML omitted -->(2f367)<!-- raw HTML omitted --></a></li>
<li>Add filters to <code>createSpecification</code>  -  by <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9336">vitest-dev/vitest#9336</a> <a href="https://github.com/vitest-dev/vitest/commit/c8e6c7fbf"><!-- raw HTML omitted -->(c8e6c)<!-- raw HTML omitted --></a></li>
<li>Expose <code>runTestFiles</code> as alternative to <code>runTestSpecifications</code>  -  by <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9443">vitest-dev/vitest#9443</a> <a href="https://github.com/vitest-dev/vitest/commit/43d761821"><!-- raw HTML omitted -->(43d76)<!-- raw HTML omitted --></a></li>
<li>Add <code>allowWrite</code> and <code>allowExec</code> options to <code>api</code>  -  by <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9350">vitest-dev/vitest#9350</a> <a href="https://github.com/vitest-dev/vitest/commit/20e00ef78"><!-- raw HTML omitted -->(20e00)<!-- raw HTML omitted --></a></li>
<li>Allow passing down test cases to <code>toTestSpecification</code>  -  by <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9627">vitest-dev/vitest#9627</a> <a href="https://github.com/vitest-dev/vitest/commit/6f17d5ddf"><!-- raw HTML omitted -->(6f17d)<!-- raw HTML omitted --></a></li>
</ul>
</li>
<li><strong>browser</strong>:
<ul>
<li>Add <code>userEvent.wheel</code> API  -  by <a href="https://github.com/macarie"><code>@​macarie</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9188">vitest-dev/vitest#9188</a> <a href="https://github.com/vitest-dev/vitest/commit/660801979"><!-- raw HTML omitted -->(66080)<!-- raw HTML omitted --></a></li>
<li>Add <code>filterNode</code> option to prettyDOM for filtering browser assertion error output  -  by <a href="https://github.com/Copilot"><code>@​Copilot</code></a>, <strong>sheremet-va</strong> and <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9475">vitest-dev/vitest#9475</a> <a href="https://github.com/vitest-dev/vitest/commit/d3220fcd8"><!-- raw HTML omitted -->(d3220)<!-- raw HTML omitted --></a></li>
<li>Support playwright persistent context  -  by <a href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a>, <strong>Claude Opus 4.6</strong> and <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9229">vitest-dev/vitest#9229</a> <a href="https://github.com/vitest-dev/vitest/commit/f865d2ba4"><!-- raw HTML omitted -->(f865d)<!-- raw HTML omitted --></a></li>
<li>Added <code>detailsPanelPosition</code> option and button  -  by <a href="https://github.com/shairez"><code>@​shairez</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9525">vitest-dev/vitest#9525</a> <a href="https://github.com/vitest-dev/vitest/commit/c8a31147c"><!-- raw HTML omitted -->(c8a31)<!-- raw HTML omitted --></a></li>
<li>Use BlazeDiff instead of pixelmatch  -  by <a href="https://github.com/macarie"><code>@​macarie</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9514">vitest-dev/vitest#9514</a> <a href="https://github.com/vitest-dev/vitest/commit/309362089"><!-- raw HTML omitted -->(30936)<!-- raw HTML omitted --></a></li>
<li>Add <code>findElement</code> and enable strict mode in webdriverio and preview  -  by <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9677">vitest-dev/vitest#9677</a> <a href="https://github.com/vitest-dev/vitest/commit/c3f37721c"><!-- raw HTML omitted -->(c3f37)<!-- raw HTML omitted --></a></li>
</ul>
</li>
<li><strong>cli</strong>:
<ul>
<li>Add <a href="https://github.com/bomb"><code>@​bomb</code></a>.sh/tab completions  -  by <a href="https://github.com/AmirSa12"><code>@​AmirSa12</code></a> and <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/8639">vitest-dev/vitest#8639</a> <a href="https://github.com/vitest-dev/vitest/commit/200f31704"><!-- raw HTML omitted -->(200f3)<!-- raw HTML omitted --></a></li>
</ul>
</li>
<li><strong>coverage</strong>:
<ul>
<li>Support <code>ignore start/stop</code> ignore hints  -  by <a href="https://github.com/AriPerkkio"><code>@​AriPerkkio</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9204">vitest-dev/vitest#9204</a> <a href="https://github.com/vitest-dev/vitest/commit/e59c94ba6"><!-- raw HTML omitted -->(e59c9)<!-- raw HTML omitted --></a></li>
<li>Add <code>coverage.changed</code> option to report only changed files  -  by <a href="https://github.com/kykim00"><code>@​kykim00</code></a> and <a href="https://github.com/AriPerkkio"><code>@​AriPerkkio</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9521">vitest-dev/vitest#9521</a> <a href="https://github.com/vitest-dev/vitest/commit/1d9392c67"><!-- raw HTML omitted -->(1d939)<!-- raw HTML omitted --></a></li>
</ul>
</li>
<li><strong>experimental</strong>:
<ul>
<li>Add <code>onModuleRunner</code> hook to <code>worker.init</code>  -  by <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9286">vitest-dev/vitest#9286</a> <a href="https://github.com/vitest-dev/vitest/commit/e977f3deb"><!-- raw HTML omitted -->(e977f)<!-- raw HTML omitted --></a></li>
<li>Option to disable the module runner  -  by <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> and <a href="https://github.com/AriPerkkio"><code>@​AriPerkkio</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9210">vitest-dev/vitest#9210</a> <a href="https://github.com/vitest-dev/vitest/commit/9be6121ee"><!-- raw HTML omitted -->(9be61)<!-- raw HTML omitted --></a></li>
</ul>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/vitest-dev/vitest/commit/4150b913171bda3971a4a4c47c633c26d0c6ae45"><code>4150b91</code></a> chore: release v4.1.0</li>
<li><a href="https://github.com/vitest-dev/vitest/commit/1de0aa22dd6311a93546a75a3c58a6be519c1baf"><code>1de0aa2</code></a> fix: correctly identify concurrent test during static analysis (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9846">#9846</a>)</li>
<li><a href="https://github.com/vitest-dev/vitest/commit/c3cac1c1b5a91d921942e9391fbd94841717363f"><code>c3cac1c</code></a> fix: use isAgent check, not just TTY, for watch mode (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9841">#9841</a>)</li>
<li><a href="https://github.com/vitest-dev/vitest/commit/eab68ba2b8ea6f89717c0b885c573579659d7c3b"><code>eab68ba</code></a> chore(deps): update all non-major dependencies (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9824">#9824</a>)</li>
<li><a href="https://github.com/vitest-dev/vitest/commit/031f02a89be34491c441b4da9c4e2bacb7db71df"><code>031f02a</code></a> fix: allow catch/finally for async assertion (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9827">#9827</a>)</li>
<li><a href="https://github.com/vitest-dev/vitest/commit/3e9e096a231fa0ec6475da82e36cbd6fcc9bc8f9"><code>3e9e096</code></a> feat(reporters): add <code>agent</code> reporter to reduce ai agent token usage (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9779">#9779</a>)</li>
<li><a href="https://github.com/vitest-dev/vitest/commit/0c2c01361a95dd26d0d7fd7bc38bcca8dbc6e5d2"><code>0c2c013</code></a> chore: release v4.1.0-beta.6</li>
<li><a href="https://github.com/vitest-dev/vitest/commit/8181e06e765f4d043818b244c76795022fa78ff6"><code>8181e06</code></a> fix: <code>hideSkippedTests</code> should not hide <code>test.todo</code> (fix <a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9562">#9562</a>) (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9781">#9781</a>)</li>
<li><a href="https://github.com/vitest-dev/vitest/commit/a8216b0014b83612e40ef49f919d5293b68717b3"><code>a8216b0</code></a> fix: manual and redirect mock shouldn't <code>load</code> or <code>transform</code> original module...</li>
<li><a href="https://github.com/vitest-dev/vitest/commit/689a22a1b8c79595f6f4ae82d2b43c895d7f1c50"><code>689a22a</code></a> fix(browser): types of <code>getCDPSession</code> and <code>cdp()</code> (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/9716">#9716</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/vitest-dev/vitest/commits/v4.1.0/packages/vitest">compare view</a></li>
</ul>
</details>
<br />

Updates `@babel/core` from 7.29.0 to 7.29.7
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/babel/babel/releases">@​babel/core's releases</a>.</em></p>
<blockquote>
<h2>v7.29.7 (2026-05-25)</h2>
<p>Re-release all packages with npm provenance attestations</p>
<h2>v7.29.6 (2026-05-25)</h2>
<h4>:bug: Bug Fix</h4>
<ul>
<li><code>babel-generator</code>
<ul>
<li><a href="https://redirect.github.com/babel/babel/pull/18014">#18014</a> Catchup source map position in preserveFormat (<a href="https://github.com/nicolo-ribaudo"><code>@​nicolo-ribaudo</code></a>)</li>
</ul>
</li>
<li><code>babel-core</code>
<ul>
<li><a href="https://redirect.github.com/babel/babel/pull/18001">#18001</a> [7.x packport]Improve input source map handling (<a href="https://github.com/JLHwung"><code>@​JLHwung</code></a>)</li>
</ul>
</li>
<li><code>babel-core</code>, <code>babel-generator</code>
<ul>
<li><a href="https://redirect.github.com/babel/babel/pull/17998">#17998</a> Preserve original identifier names from input sourcemaps (<a href="https://github.com/babel/babel/tree/HEAD/packages/babel-core/issues/17992">#17992</a>) (<a href="https://github.com/Andarist"><code>@​Andarist</code></a>)</li>
</ul>
</li>
</ul>
<h4>Committers: 3</h4>
<ul>
<li>Huáng Jùnliàng (<a href="https://github.com/JLHwung"><code>@​JLHwung</code></a>)</li>
<li>Mateusz Burzyński (<a href="https://github.com/Andarist"><code>@​Andarist</code></a>)</li>
<li>Nicolò Ribaudo (<a href="https://github.com/nicolo-ribaudo"><code>@​nicolo-ribaudo</code></a>)</li>
</ul>
<h2>v7.29.5 (2026-05-05)</h2>
<h4>:house:  Internal</h4>
<ul>
<li><code>babel-preset-env</code>
<ul>
<li>Update <code>@babel/*</code> dependencies</li>
</ul>
</li>
</ul>
<h2>v7.29.4 (2026-05-05)</h2>
<h4>:bug: Bug Fix</h4>
<ul>
<li><code>babel-plugin-transform-modules-systemjs</code>
<ul>
<li><a href="https://redirect.github.com/babel/babel/pull/17974">#17974</a> [7.x backport]fix(systemjs): improve module string name support (<a href="https://github.com/JLHwung"><code>@​JLHwung</code></a>)</li>
</ul>
</li>
</ul>
<h4>Committers: 1</h4>
<ul>
<li>Huáng Jùnliàng (<a href="https://github.com/JLHwung"><code>@​JLHwung</code></a>)</li>
</ul>
<h2>v7.29.3 (2026-04-30)</h2>
<h4>:eyeglasses: Spec Compliance</h4>
<ul>
<li><code>babel-parser</code>
<ul>
<li><a href="https://redirect.github.com/babel/babel/pull/17923">#17923</a> Support flow extends bound (<a href="https://github.com/JLHwung"><code>@​JLHwung</code></a>)</li>
</ul>
</li>
</ul>
<h4>:bug: Bug Fix</h4>
<ul>
<li><code>babel-helper-create-class-features-plugin</code>, <code>babel-plugin-proposal-decorators</code>
<ul>
<li><a href="https://redirect.github.com/babel/babel/pull/17931">#17931</a> fix(decorators): replace super within all removed static elements (<a href="https://github.com/JLHwung"><code>@​JLHwung</code></a>)</li>
</ul>
</li>
<li><code>babel-register</code>
<ul>
<li><a href="https://redirect.github.com/babel/babel/pull/17915">#17915</a> Fix thread synchronization issues in <code>@babel/register</code> (<a href="https://github.com/liuxingbaoyu"><code>@​liuxingbaoyu</code></a>)</li>
</ul>
</li>
<li><code>babel-compat-data</code>, <code>babel-plugin-bugfix-safari-rest-destructuring-rhs-array</code>, <code>babel-preset-env</code>
<ul>
<li><a href="https://redirect.github.com/babel/babel/pull/17788">#17788</a> Add bugfix plugin for Safari array rest destructuring bug (<a href="https://github.com/JLHwung"><code>@​JLHwung</code></a>)</li>
</ul>
</li>
</ul>
<h4>:nail_care: Polish</h4>
<ul>
<li><code>babel-parser</code></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/babel/babel/commit/4fba7541180bf5f58256d8e358b544e3831ad090"><code>4fba754</code></a> v7.29.7</li>
<li><a href="https://github.com/babel/babel/commit/04ea6b27fdac8f40c3481aec2080ac9678779509"><code>04ea6b2</code></a> v7.29.6</li>
<li><a href="https://github.com/babel/babel/commit/99f498a9b9fa0b900d603fbe8f6601bb3b9e42bb"><code>99f498a</code></a> [7.x packport]Improve input source map handling (<a href="https://github.com/babel/babel/tree/HEAD/packages/babel-core/issues/18001">#18001</a>)</li>
<li><a href="https://github.com/babel/babel/commit/feba0a3654c596bd369d1ef1231f5d56666d56dc"><code>feba0a3</code></a> Preserve original identifier names from input sourcemaps (<a href="https://github.com/babel/babel/tree/HEAD/packages/babel-core/issues/17992">#17992</a>) (<a href="https://github.com/babel/babel/tree/HEAD/packages/babel-core/issues/17998">#17998</a>)</li>
<li>See full diff in <a href="https://github.com/babel/babel/commits/v7.29.7/packages/babel-core">compare view</a></li>
</ul>
</details>
<br />

Updates `@grpc/grpc-js` from 1.14.3 to 1.14.4
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/grpc/grpc-node/releases">@​grpc/grpc-js's releases</a>.</em></p>
<blockquote>
<h2><code>@​grpc/grpc-js</code> 1.14.4</h2>
<ul>
<li>Fix a bug that could cause servers to crash when handling malformed requests (<a href="https://github.com/grpc/grpc-node/security/advisories/GHSA-5375-pq7m-f5r2">advisory GHSA-5375-pq7m-f5r2</a>)</li>
<li>Fix a bug that could cause clients and servers to crash when handling malformed compressed messages (<a href="https://github.com/grpc/grpc-node/security/advisories/GHSA-99f4-grh7-6pcq">advisory GHSA-99f4-grh7-6pcq</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/grpc/grpc-node/commit/a380735ba9b0351214f2faa578350a559dd486ff"><code>a380735</code></a> Merge pull request <a href="https://redirect.github.com/grpc/grpc-node/issues/3052">#3052</a> from murgatroid99/grpc-js_1.14.4</li>
<li><a href="https://github.com/grpc/grpc-node/commit/5b8d37b03d91122ec0b9bc5e27dd26ffa7448337"><code>5b8d37b</code></a> Merge commit from fork</li>
<li><a href="https://github.com/grpc/grpc-node/commit/6a97456cc88d2b74e1527b356de98bf8ee8d7a40"><code>6a97456</code></a> Merge commit from fork</li>
<li><a href="https://github.com/grpc/grpc-node/commit/e5e0b1d3ff14fa7c5eeef10b309d694bc3ff7e96"><code>e5e0b1d</code></a> grpc-js: Bump version to 1.14.4</li>
<li><a href="https://github.com/grpc/grpc-node/commit/5029a2668164d1ba6de6ed4dcf6d35d5c4ff6cf4"><code>5029a26</code></a> Make compression error a static string</li>
<li><a href="https://github.com/grpc/grpc-node/commit/2fe55fd76a8bb59eaab5f39e3552b5f84985a163"><code>2fe55fd</code></a> Fix crashes when receiving malformed compressed data</li>
<li><a href="https://github.com/grpc/grpc-node/commit/234f9172b2ff35e586ca7d4e788557aad5985668"><code>234f917</code></a> Fix server crash when handling invalid requests</li>
<li><a href="https://github.com/grpc/grpc-node/commit/acef8d4adfa091188e9dd572cedf4d87b0f69b21"><code>acef8d4</code></a> Merge pull request <a href="https://redirect.github.com/grpc/grpc-node/issues/3043">#3043</a> from murgatroid99/rbac_types_change_fix_1.14</li>
<li><a href="https://github.com/grpc/grpc-node/commit/4f3c58fda2136eb0038a39d54804acb06a8419ea"><code>4f3c58f</code></a> grpc-js-xds: Update RBAC code to handle Node type change, pin <code>@​types/node</code></li>
<li>See full diff in <a href="https://github.com/grpc/grpc-node/compare/@grpc/grpc-js@1.14.3...@grpc/grpc-js@1.14.4">compare view</a></li>
</ul>
</details>
<br />

Updates `protobufjs` from 7.6.0 to 7.6.4
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/protobufjs/protobuf.js/releases">protobufjs's releases</a>.</em></p>
<blockquote>
<h2>protobufjs: v7.6.4</h2>
<h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.6.3...protobufjs-v7.6.4">7.6.4</a> (2026-06-12)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>Reconfigure and speed up CI (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2329">#2329</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/574f761c05b007dab6595ca1eaed86436579ba3f">574f761</a>)</li>
<li>Remove inquire submodule (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2327">#2327</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/06ddd07064329032aae6db586e2d54938b591792">06ddd07</a>)</li>
</ul>
<h2>protobufjs: v7.6.3</h2>
<h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.6.2...protobufjs-v7.6.3">7.6.3</a> (2026-06-09)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>Avoid name collisions in generated code (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2311">#2311</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/78a9576269a5b590c54686a8122e78e28135cd50">78a9576</a>)</li>
<li>Preserve null conversion behavior for fieldless messages (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2312">#2312</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/df91652aa5cb1ee0204566252df85cbe752298a6">df91652</a>)</li>
</ul>
<h2>protobufjs: v7.6.2</h2>
<h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.6.1...protobufjs-v7.6.2">7.6.2</a> (2026-05-30)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>Backport consistency and correctness fixes (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2294">#2294</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/a92f72e1cb731f06040a7917d3e041666d5f5601">a92f72e</a>)</li>
</ul>
<h2>protobufjs: v7.6.1</h2>
<h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.6.0...protobufjs-v7.6.1">7.6.1</a> (2026-05-22)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>Backport misc utility hardening (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2280">#2280</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/8a45c13d22ec2d05ab1b7935fcb5331ea59a9cd0">8a45c13</a>)</li>
<li>Treat fixed64 as unsigned in converters (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2266">#2266</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/479dfdcc690feb9f71986049d3d38c7a0f979abb">479dfdc</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/protobufjs/protobuf.js/blob/protobufjs-v7.6.4/CHANGELOG.md">protobufjs's changelog</a>.</em></p>
<blockquote>
<h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.6.3...protobufjs-v7.6.4">7.6.4</a> (2026-06-12)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>Reconfigure and speed up CI (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2329">#2329</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/574f761c05b007dab6595ca1eaed86436579ba3f">574f761</a>)</li>
<li>Remove inquire submodule (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2327">#2327</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/06ddd07064329032aae6db586e2d54938b591792">06ddd07</a>)</li>
</ul>
<h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.6.2...protobufjs-v7.6.3">7.6.3</a> (2026-06-09)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>Avoid name collisions in generated code (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2311">#2311</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/78a9576269a5b590c54686a8122e78e28135cd50">78a9576</a>)</li>
<li>Preserve null conversion behavior for fieldless messages (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2312">#2312</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/df91652aa5cb1ee0204566252df85cbe752298a6">df91652</a>)</li>
</ul>
<h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.6.1...protobufjs-v7.6.2">7.6.2</a> (2026-05-30)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>Backport consistency and correctness fixes (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2294">#2294</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/a92f72e1cb731f06040a7917d3e041666d5f5601">a92f72e</a>)</li>
</ul>
<h2><a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.6.0...protobufjs-v7.6.1">7.6.1</a> (2026-05-22)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>Backport misc utility hardening (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2280">#2280</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/8a45c13d22ec2d05ab1b7935fcb5331ea59a9cd0">8a45c13</a>)</li>
<li>Treat fixed64 as unsigned in converters (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2266">#2266</a>) (<a href="https://github.com/protobufjs/protobuf.js/commit/479dfdcc690feb9f71986049d3d38c7a0f979abb">479dfdc</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/protobufjs/protobuf.js/commit/f8f64efbfc5b52997beb7549e7ea722704320cb1"><code>f8f64ef</code></a> chore: release protobufjs-v7.x (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2330">#2330</a>)</li>
<li><a href="https://github.com/protobufjs/protobuf.js/commit/574f761c05b007dab6595ca1eaed86436579ba3f"><code>574f761</code></a> fix: Reconfigure and speed up CI (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2329">#2329</a>)</li>
<li><a href="https://github.com/protobufjs/protobuf.js/commit/06ddd07064329032aae6db586e2d54938b591792"><code>06ddd07</code></a> fix: Remove inquire submodule (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2327">#2327</a>)</li>
<li><a href="https://github.com/protobufjs/protobuf.js/commit/1d3796d7d29830c73eec792ccbe769be6aa020ac"><code>1d3796d</code></a> chore: release protobufjs-v7.x (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2317">#2317</a>)</li>
<li><a href="https://github.com/protobufjs/protobuf.js/commit/df91652aa5cb1ee0204566252df85cbe752298a6"><code>df91652</code></a> fix: Preserve null conversion behavior for fieldless messages (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2312">#2312</a>)</li>
<li><a href="https://github.com/protobufjs/protobuf.js/commit/78a9576269a5b590c54686a8122e78e28135cd50"><code>78a9576</code></a> fix: Avoid name collisions in generated code (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2311">#2311</a>)</li>
<li><a href="https://github.com/protobufjs/protobuf.js/commit/ec90ef9ccc30fffe6ea9ea37e45781071898229d"><code>ec90ef9</code></a> chore: release protobufjs-v7.x (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2295">#2295</a>)</li>
<li><a href="https://github.com/protobufjs/protobuf.js/commit/a92f72e1cb731f06040a7917d3e041666d5f5601"><code>a92f72e</code></a> fix: Backport consistency and correctness fixes (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2294">#2294</a>)</li>
<li><a href="https://github.com/protobufjs/protobuf.js/commit/f0b50d2fa1247d6652618190c2d6602e6830b90d"><code>f0b50d2</code></a> chore: release protobufjs-v7.x (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2268">#2268</a>)</li>
<li><a href="https://github.com/protobufjs/protobuf.js/commit/8a45c13d22ec2d05ab1b7935fcb5331ea59a9cd0"><code>8a45c13</code></a> fix: Backport misc utility hardening (<a href="https://redirect.github.com/protobufjs/protobuf.js/issues/2280">#2280</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.6.0...protobufjs-v7.6.4">compare view</a></li>
</ul>
</details>
<br />

Updates `form-data` from 4.0.5 to 4.0.6
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/form-data/form-data/blob/master/CHANGELOG.md">form-data's changelog</a>.</em></p>
<blockquote>
<h2><a href="https://github.com/form-data/form-data/compare/v4.0.5...v4.0.6">v4.0.6</a> - 2026-06-12</h2>
<h3>Commits</h3>
<ul>
<li>[Fix] escape CR, LF, and <code>&quot;</code> in field names and filenames <a href="https://github.com/form-data/form-data/commit/8dff42c6da654ed4e7ad4acb7f8ccd3831217c99"><code>8dff42c</code></a></li>
<li>[Dev Deps] update <code>@ljharb/eslint-config</code>, <code>auto-changelog</code>, <code>tape</code> <a href="https://github.com/form-data/form-data/commit/f31d21ef10bf46e46344c3ee4f99acbef6be43e1"><code>f31d21e</code></a></li>
<li>[Deps] update <code>hasown</code>, <code>mime-types</code> <a href="https://github.com/form-data/form-data/commit/92ae0eb5da94d6f01925d5f4fcffb2a1e50ed7cd"><code>92ae0eb</code></a></li>
<li>[Dev Deps] update <code>js-randomness-predictor</code> <a href="https://github.com/form-data/form-data/commit/67b0f65c2e0b065a511d42227d35e4d367644e97"><code>67b0f65</code></a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435"><code>64190db</code></a> v4.0.6</li>
<li><a href="https://github.com/form-data/form-data/commit/92ae0eb5da94d6f01925d5f4fcffb2a1e50ed7cd"><code>92ae0eb</code></a> [Deps] update <code>hasown</code>, <code>mime-types</code></li>
<li><a href="https://github.com/form-data/form-data/commit/f31d21ef10bf46e46344c3ee4f99acbef6be43e1"><code>f31d21e</code></a> [Dev Deps] update <code>@ljharb/eslint-config</code>, <code>auto-changelog</code>, <code>tape</code></li>
<li><a href="https://github.com/form-data/form-data/commit/8dff42c6da654ed4e7ad4acb7f8ccd3831217c99"><code>8dff42c</code></a> [Fix] escape CR, LF, and <code>&quot;</code> in field names and filenames</li>
<li><a href="https://github.com/form-data/form-data/commit/67b0f65c2e0b065a511d42227d35e4d367644e97"><code>67b0f65</code></a> [Dev Deps] update <code>js-randomness-predictor</code></li>
<li>See full diff in <a href="https://github.com/form-data/form-data/compare/v4.0.5...v4.0.6">compare view</a></li>
</ul>
</details>
<br />

Updates `form-data` from 2.5.5 to 2.5.6
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/form-data/form-data/blob/master/CHANGELOG.md">form-data's changelog</a>.</em></p>
<blockquote>
<h2><a href="https://github.com/form-data/form-data/compare/v4.0.5...v4.0.6">v4.0.6</a> - 2026-06-12</h2>
<h3>Commits</h3>
<ul>
<li>[Fix] escape CR, LF, and <code>&quot;</code> in field names and filenames <a href="https://github.com/form-data/form-data/commit/8dff42c6da654ed4e7ad4acb7f8ccd3831217c99"><code>8dff42c</code></a></li>
<li>[Dev Deps] update <code>@ljharb/eslint-config</code>, <code>auto-changelog</code>, <code>tape</code> <a href="https://github.com/form-data/form-data/commit/f31d21ef10bf46e46344c3ee4f99acbef6be43e1"><code>f31d21e</code></a></li>
<li>[Deps] update <code>hasown</code>, <code>mime-types</code> <a href="https://github.com/form-data/form-data/commit/92ae0eb5da94d6f01925d5f4fcffb2a1e50ed7cd"><code>92ae0eb</code></a></li>
<li>[Dev Deps] update <code>js-randomness-predictor</code> <a href="https://github.com/form-data/form-data/commit/67b0f65c2e0b065a511d42227d35e4d367644e97"><code>67b0f65</code></a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435"><code>64190db</code></a> v4.0.6</li>
<li><a href="https://github.com/form-data/form-data/commit/92ae0eb5da94d6f01925d5f4fcffb2a1e50ed7cd"><code>92ae0eb</code></a> [Deps] update <code>hasown</code>, <code>mime-types</code></li>
<li><a href="https://github.com/form-data/form-data/commit/f31d21ef10bf46e46344c3ee4f99acbef6be43e1"><code>f31d21e</code></a> [Dev Deps] update <code>@ljharb/eslint-config</code>, <code>auto-changelog</code>, <code>tape</code></li>
<li><a href="https://github.com/form-data/form-data/commit/8dff42c6da654ed4e7ad4acb7f8ccd3831217c99"><code>8dff42c</code></a> [Fix] escape CR, LF, and <code>&quot;</code> in field names and filenames</li>
<li><a href="https://github.com/form-data/form-data/commit/67b0f65c2e0b065a511d42227d35e4d367644e97"><code>67b0f65</code></a> [Dev Deps] update <code>js-randomness-predictor</code></li>
<li>See full diff in <a href="https://github.com/form-data/form-data/compare/v4.0.5...v4.0.6">compare view</a></li>
</ul>
</details>
<br />

Removes `markdown-it`

Updates `tmp` from 0.2.5 to 0.2.7
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/raszi/node-tmp/commit/8ea1f37d75c67569e0f151448330d52f7babf211"><code>8ea1f37</code></a> Bump up the version</li>
<li><a href="https://github.com/raszi/node-tmp/commit/8f24f788a356b5d45c9bec894632bd4931338153"><code>8f24f78</code></a> Merge commit from fork</li>
<li><a href="https://github.com/raszi/node-tmp/commit/ce787f37aaacccad921ae90990c9da33481fe59c"><code>ce787f3</code></a> Reject non-string prefix, postfix, template</li>
<li><a href="https://github.com/raszi/node-tmp/commit/41f71598d03f104a67e0448a7cb9bd4efcdd5980"><code>41f7159</code></a> Bump up the version</li>
<li><a href="https://github.com/raszi/node-tmp/commit/efa4a06f24374797ae32ab2b6ae39b7a611ae429"><code>efa4a06</code></a> Merge commit from fork</li>
<li><a href="https://github.com/raszi/node-tmp/commit/7ef2728ce0211b8110b2033dfe62eaf030341acf"><code>7ef2728</code></a> Check for relative values</li>
<li>See full diff in <a href="https://github.com/raszi/node-tmp/compare/v0.2.5...v0.2.7">compare view</a></li>
</ul>
</details>
<br />

Updates `vite` from 7.3.2 to 7.3.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/vitejs/vite/releases">vite's releases</a>.</em></p>
<blockquote>
<h2>v7.3.5</h2>
<p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.3.5/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p>
<h2>v7.3.3</h2>
<p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.3.3/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/vitejs/vite/blob/v7.3.5/packages/vite/CHANGELOG.md">vite's changelog</a>.</em></p>
<blockquote>
<h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v7.3.3...v7.3.5">7.3.5</a> (2026-06-01)<!-- raw HTML omitted --></h2>
<h3>Bug Fixes</h3>
<ul>
<li>backport <a href="https://redirect.github.com/vitejs/vite/issues/22572">#22572</a>, reject windows alternate paths (<a href="https://redirect.github.com/vitejs/vite/issues/22574">#22574</a>) (<a href="https://github.com/vitejs/vite/commit/8c1855607b7c9884c4565d897ee98899a008a2d0">8c18556</a>)</li>
<li><strong>deps:</strong> backport <a href="https://redirect.github.com/vitejs/vite/issues/22571">#22571</a>, reject UNC paths for launch-editor-middleware (<a href="https://redirect.github.com/vitejs/vite/issues/22573">#22573</a>) (<a href="https://github.com/vitejs/vite/commit/f20d64bef6e0ef1e4fa7a9783281c7bba0ce5292">f20d64b</a>)</li>
</ul>
<h3>Miscellaneous Chores</h3>
<ul>
<li>skip v7.3.4 release (<a href="https://github.com/vitejs/vite/commit/8a6a0c9fc734dbfe293ac33a4954506ee50430e1">8a6a0c9</a>)</li>
</ul>
<h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v7.3.3...v7.3.4">7.3.4</a> (2026-06-01)<!-- raw HTML omitted --></h2>
<h3>Bug Fixes</h3>
<ul>
<li>backport <a href="https://redirect.github.com/vitejs/vite/issues/22572">#22572</a>, reject windows alternate paths (<a href="https://redirect.github.com/vitejs/vite/issues/22574">#22574</a>) (<a href="https://github.com/vitejs/vite/commit/8c1855607b7c9884c4565d897ee98899a008a2d0">8c18556</a>)</li>
<li><strong>deps:</strong> backport <a href="https://redirect.github.com/vitejs/vite/issues/22571">#22571</a>, reject UNC paths for launch-editor-middleware (<a href="https://redirect.github.com/vitejs/vite/issues/22573">#22573</a>) (<a href="https://github.com/vitejs/vite/commit/f20d64bef6e0ef1e4fa7a9783281c7bba0ce5292">f20d64b</a>)</li>
</ul>
<h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v7.3.2...v7.3.3">7.3.3</a> (2026-05-07)<!-- raw HTML omitted --></h2>
<h3>Bug Fixes</h3>
<ul>
<li>avoid destructure lowering for newer safari (<a href="https://redirect.github.com/vitejs/vite/issues/22346">#22346</a>) (<a href="https://github.com/vitejs/vite/commit/5ab51c0f76f0896175e02ad797c1f5fe116d02f4">5ab51c0</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/vitejs/vite/commit/077945cb60df372a52cf999b6e532ba70fac7423"><code>077945c</code></a> release: v7.3.5</li>
<li><a href="https://github.com/vitejs/vite/commit/8a6a0c9fc734dbfe293ac33a4954506ee50430e1"><code>8a6a0c9</code></a> chore: skip v7.3.4 release</li>
<li><a href="https://github.com/vitejs/vite/commit/8c1855607b7c9884c4565d897ee98899a008a2d0"><code>8c18556</code></a> fix: backport <a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22572">#22572</a>, reject windows alternate paths (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22574">#22574</a>)</li>
<li><a href="https://github.com/vitejs/vite/commit/f20d64bef6e0ef1e4fa7a9783281c7bba0ce5292"><code>f20d64b</code></a> fix(deps): backport <a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22571">#22571</a>, reject UNC paths for launch-editor-middleware (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/2">#2</a>...</li>
<li><a href="https://github.com/vitejs/vite/commit/ca31424cccb075c88131132b929a63527d0e2b69"><code>ca31424</code></a> release: v7.3.3</li>
<li><a href="https://github.com/vitejs/vite/commit/5ab51c0f76f0896175e02ad797c1f5fe116d02f4"><code>5ab51c0</code></a> fix: avoid destructure lowering for newer safari (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22346">#22346</a>)</li>
<li>See full diff in <a href="https://github.com/vitejs/vite/commits/v7.3.5/packages/vite">compare view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/Laksan99/docs/network/alerts).

</details>

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Update dependencies for stability, security, and dev/test tooling. Upgrades the OpenTelemetry stack, `js-yaml`, and `vitest`; removes `markdown-it`.

- **Dependencies**
  - OpenTelemetry: `@opentelemetry/core` → 2.8.0 and align `@opentelemetry/sdk-node`, `@opentelemetry/instrumentation-http`, `@opentelemetry/exporter-trace-otlp-proto` to 0.219.x.
  - `js-yaml` → 4.2.0 with new safety limits and parser fixes.
  - `vitest` → 4.1.0 for improved testing features and fixes.
  - `markdownlint` → 0.41.0.
  - Lockfile updates: `@babel/core` 7.29.7, `@grpc/grpc-js` 1.14.4 (security fixes), `protobufjs` 7.6.4, `form-data` 4.0.6/2.5.6, `tmp` 0.2.7, `vite` 7.3.5; removes `markdown-it`.

<sup>Written for commit d40b69d9733f7d82af516c8f9d0320531585be69. Summary will update on new commits.</sup>

<a href="https://cubic.dev/pr/Laksan99/docs/pull/8?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>

<!-- End of auto-generated description by cubic. -->
@welcome

welcome Bot commented Jun 28, 2026

Copy link
Copy Markdown

Thanks for opening this pull request! A GitHub docs team member should be by to give feedback soon. In the meantime, please check out the contributing guidelines.

@github-actions github-actions Bot added the triage Do not begin working on this issue until triaged by the team label Jun 28, 2026
@github-actions

github-actions Bot commented Jun 28, 2026

Copy link
Copy Markdown
Contributor

👋 Hey there spelunker. It looks like you've modified some files that we can't accept as contributions:

  • package-lock.json
  • package.json

You'll need to revert all of the files you changed that match that list using GitHub Desktop or git checkout origin/main <file name>. Once you get those files reverted, we can continue with the review process. :octocat:

The complete list of files we can't accept are:

  • .devcontainer/**
  • .github/**
  • data/reusables/rai/**
  • Dockerfile*
  • src/**
  • package*.json
  • content/actions/how-tos/security-for-github-actions/security-hardening-your-deployments/**

We also can't accept contributions to files in the content directory with frontmatter contentType: rai.

@github-actions

github-actions Bot commented Jun 28, 2026

Copy link
Copy Markdown
Contributor

How to review these changes 👓

Thank you for your contribution. To review these changes, choose one of the following options:

A Hubber will need to deploy your changes internally to review.

Table of review links

Note: Please update the URL for your staging server or codespace.

This pull request contains code changes, so we will not generate a table of review links.

🤖 This comment is automatically generated.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

triage Do not begin working on this issue until triaged by the team

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Laksan99