Skip to content

chore(deps): bump the npm_and_yarn group across 3 directories with 9 updates - #1532

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-e02d63b01b
Open

chore(deps): bump the npm_and_yarn group across 3 directories with 9 updates#1532
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-e02d63b01b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 10, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 8 updates in the / directory:

Package From To
@vitest/browser 4.1.8 4.1.10
js-yaml 4.3.0 4.3.2
@faker-js/faker 9.9.0 10.5.0
fastify 5.8.5 5.12.1
astro 5.18.2 7.2.8
sharp 0.33.5 0.35.4
dompurify 3.4.12 3.4.13
nodemailer 7.0.13 9.1.1

Bumps the npm_and_yarn group with 2 updates in the /apps/api directory: @faker-js/faker and fastify.
Bumps the npm_and_yarn group with 2 updates in the /apps/outreach directory: astro and sharp.

Updates @vitest/browser from 4.1.8 to 4.1.10

Release notes

Sourced from @​vitest/browser's releases.

v4.1.10

   🐞 Bug Fixes

    View changes on GitHub

v4.1.9

🐞 Bug Fixes

View changes on GitHub
Commits
  • db616d2 chore: release v4.1.10 (#10718)
  • 5c18dd2 fix(browser): check fs access in builtin commands [backport to v4] (#10680)
  • a7a61e7 chore: release v4.1.9 (#10598)
  • fbc626c fix(browser): wait for iframe tester readiness before preparing (#10497) [bac...
  • 7fb2965 fix(browser): wait for orchestrator readiness before resolving browser sessio...
  • See full diff in compare view

Updates js-yaml from 4.3.0 to 4.3.2

Changelog

Sourced from js-yaml's changelog.

4.3.2 - 2026-08-26

Changed

  • [backport] Hard-limit merge sequence size to 100.

Security

  • [backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

4.3.1 - 2026-07-31

Security

  • [backport] Remove quadratic complexity from !!omap duplicate key detection.
Commits

Updates @faker-js/faker from 9.9.0 to 10.5.0

Release notes

Sourced from @​faker-js/faker's releases.

v10.5.0

What's Changed

... (truncated)

Changelog

Sourced from @​faker-js/faker's changelog.

10.5.0 (2026-06-17)

New Locales

  • locale: add color to cy (#3816) (5a6379f)
  • locale: add Farsi airline module locale (#3789) (f4a1c3e)
  • locale: add mn_MN_cyrl (Mongolian) locale (#3796) (d17c0f1)
  • locale: Add more realistic Greek address data (#3792) (6153eb7)
  • locale: Add postal_address and improved secondary_address for es (#3798) (6c2a0ab)
  • locale: add sl_SI locale, location module (#3652) (28d4f7c)
  • locale: add Welsh (cy) animal type definitions (#3842) (50a5ec9)
  • locale: add Welsh (cy) book format definitions (#3846) (#3846) (2b32d6e)
  • locale: add Welsh (cy) building numbers definition (#3892) (4996a2b)
  • locale: add Welsh (cy) city name definitions (#3884) (ac36c22)
  • locale: add Welsh (cy) continents definitions (#3880) (03a1682)
  • locale: add Welsh (cy) county definitions (#3849) (f51d28a)
  • locale: add Welsh (cy) direction definitions (#3840) (d862071)
  • locale: add Welsh (cy) internet domain suffix definitions (#3865) (#3865) (fb2e2cb)
  • locale: add Welsh (cy) phone number definitions (#3878) (70994db)
  • locale: add Welsh (cy) postal address definitions (#3850) (e72fd7c)
  • locale: add Welsh (cy) postcode definitions (#3851) (1afbd59)
  • locale: add Welsh (cy) sex definitions (#3824) (6f29eb7)
  • locale: add Welsh (cy) state definitions (#3891) (#3891) (606d47c)
  • locale: add Welsh (cy) street name definitions (#3889) (143789e)
  • locale: add Welsh (cy) vehicle fuel definitions (#3845) (29c918a)
  • locale: extend tr person last names (#3839) (f433771)
  • locale: improved en_GB postcodes (#3864) (a4e5039)
  • locale: improved en_IE postal_address (#3797) (fb3ffd3)

Features

  • add first standalone module functions (#3818) (5d4f5de)
  • date: add ability to provide date range for recent and soon (#3844) (0bc038d)
  • date: add ability to provide year range for past and future (#3783) (237e7dc)
  • food: expand plant-based dish and pattern variety (#3887) (5eaf729)
  • introduce FakerCore (#2838) (68e15d7)
  • location: add postal address generation (#3760) (753bec6)
  • number: add distributor functions (#3375) (325e402)
  • phone: mobile style for phone.number (#3583) (cd5953b)

Bug Fixes

  • date: incorrect date boundary in past and future (#3827) (0446411)
  • finance: routingNumber now uses real FederalReserveRoutingSymbol from lookup table. (#3429) (c53c1fe)
  • food: correct fruit and vegetable locale data (#3800) (30a812a)
  • handle single-character fromRegExp patterns (#3877) (ec6cc3b)
  • helpers: ignore wrapper characters in fromRegExp (#3795) (9e2c0e3)

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​faker-js/faker since your current version.


Updates fastify from 5.8.5 to 5.12.1

Release notes

Sourced from fastify's releases.

v5.12.1

⚠️ Security release

What's Changed

Full Changelog: fastify/fastify@v5.12.0...v5.12.1

v5.12.0

What's Changed

Full Changelog: fastify/fastify@v5.11.3...v5.12.0

v5.11.3

What's Changed

New Contributors

Full Changelog: fastify/fastify@v5.11.2...v5.11.3

v5.11.2

What's Changed

... (truncated)

Commits

Updates astro from 5.18.2 to 7.2.8

Release notes

Sourced from astro's releases.

astro@7.2.8

Patch Changes

astro@7.2.7

Patch Changes

  • #17415 55d38c8 Thanks @​iseraph-dev! - Deserializes each route once when loading the SSR manifest

  • #17772 023b48b Thanks @​matthewp! - Fixes route selection for normalized request paths in adapter and development request handling

  • #17819 633855b Thanks @​matthewp! - Updates generated and default Cloudflare compatibility_date values to match the installed runtime and requires Wrangler ^4.125.0

  • #17813 ae26d18 Thanks @​matthewp! - Fixes rewrite() and next(payload) for GET and HEAD requests with host-provided bodies

  • #17816 a0d2fe3 Thanks @​astro-factory! - Fixes the experimental svgOptimizer not generating unique per-file ID prefixes when using SVGO's prefixIds plugin

astro@7.2.6

Patch Changes

  • #17812 29af6da Thanks @​matthewp! - Fixes a bug where new FetchState(request) could fail in development when server dependencies were optimized

astro@7.2.5

Patch Changes

  • #17758 5f419e2 Thanks @​astro-factory! - Fixes a bug where experimental_getFontFileURL() rejected valid font URLs when using the Cloudflare adapter

  • #17416 493796b Thanks @​iseraph-dev! - Skips no-op pathname writes when normalizing SSR request URLs

  • #17712 bd374b7 Thanks @​fkatsuhiro! - Updates deprecation messages target from Astro 7 to 8

  • #17719 dac1768 Thanks @​astrobot-houston! - Fixes session ID validation to reject non-UUID cookie values before using them as storage keys

  • #17770 84eb7e7 Thanks @​astro-factory! - Fixes --mode, --site, --base, --out-dir, --verbose, --silent, and --open flags being silently dropped when using astro dev --background or astro preview --background

  • #17713 d035290 Thanks @​wakqasahmed! - Fixes content-modules.mjs not removing entries for deleted or renamed content files, which could cause Vite to attempt to resolve non-existent modules

    As part of this fix, #moduleImports is now fully rebuilt from deferredRender entries before every write, so a module import added only through the public addModuleImport() API without a corresponding deferredRender entry in the store will no longer be preserved across writes.

  • #17743 adc750f Thanks @​contactjawad! - Fixes Astro.preferredLocale and Astro.preferredLocaleList ignoring Accept-Language quality values when they are absent or 0. An entry without an explicit q= now correctly counts as quality 1.0 (per RFC 7231) and an entry with q=0 is treated as not acceptable, so the highest-quality locale is selected regardless of header order.

  • #17757 660991c Thanks @​astro-factory! - Fixes build errors showing wrong file location, missing line:col, and misleading hints when a plugin error (e.g. from MDX) is wrapped by Vite's build error

  • #17783 60b14ff Thanks @​matthewp! - Fixes a type error when passing an image from a content collection image() schema to a component or <Image />. The schema returned by image() was missing the apng format, so it no longer matched the type of an imported image.

  • #17664 d483125 Thanks @​astrobot-houston! - Fixes an issue where Astro CSP support didn't correctly handle cases "unsafe-inline" resource. Now when "unsafe-inline", Astro won't emit hashes for the directive specified.

... (truncated)

Changelog

Sourced from astro's changelog.

7.2.8

Patch Changes

7.2.7

Patch Changes

  • #17415 55d38c8 Thanks @​iseraph-dev! - Deserializes each route once when loading the SSR manifest

  • #17772 023b48b Thanks @​matthewp! - Fixes route selection for normalized request paths in adapter and development request handling

  • #17819 633855b Thanks @​matthewp! - Updates generated and default Cloudflare compatibility_date values to match the installed runtime and requires Wrangler ^4.125.0

  • #17813 ae26d18 Thanks @​matthewp! - Fixes rewrite() and next(payload) for GET and HEAD requests with host-provided bodies

  • #17816 a0d2fe3 Thanks @​astro-factory! - Fixes the experimental svgOptimizer not generating unique per-file ID prefixes when using SVGO's prefixIds plugin

7.2.6

Patch Changes

  • #17812 29af6da Thanks @​matthewp! - Fixes a bug where new FetchState(request) could fail in development when server dependencies were optimized

7.2.5

Patch Changes

  • #17758 5f419e2 Thanks @​astro-factory! - Fixes a bug where experimental_getFontFileURL() rejected valid font URLs when using the Cloudflare adapter

  • #17416 493796b Thanks @​iseraph-dev! - Skips no-op pathname writes when normalizing SSR request URLs

  • #17712 bd374b7 Thanks @​fkatsuhiro! - Updates deprecation messages target from Astro 7 to 8

  • #17719 dac1768 Thanks @​astrobot-houston! - Fixes session ID validation to reject non-UUID cookie values before using them as storage keys

  • #17770 84eb7e7 Thanks @​astro-factory! - Fixes --mode, --site, --base, --out-dir, --verbose, --silent, and --open flags being silently dropped when using astro dev --background or astro preview --background

  • #17713 d035290 Thanks @​wakqasahmed! - Fixes content-modules.mjs not removing entries for deleted or renamed content files, which could cause Vite to attempt to resolve non-existent modules

    As part of this fix, #moduleImports is now fully rebuilt from deferredRender entries before every write, so a module import added only through the public addModuleImport() API without a corresponding deferredRender entry in the store will no longer be preserved across writes.

  • #17743 adc750f Thanks @​contactjawad! - Fixes Astro.preferredLocale and Astro.preferredLocaleList ignoring Accept-Language quality values when they are absent or 0. An entry without an explicit q= now correctly counts as quality 1.0 (per RFC 7231) and an entry with q=0 is treated as not acceptable, so the highest-quality locale is selected regardless of header order.

  • #17757 660991c Thanks @​astro-factory! - Fixes build errors showing wrong file location, missing line:col, and misleading hints when a plugin error (e.g. from MDX) is wrapped by Vite's build error

... (truncated)

Commits

Updates sharp from 0.33.5 to 0.35.4

Release notes

Sourced from sharp's releases.

v0.35.4

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.3

v0.35.4-rc.0

... (truncated)

Commits
  • 7f1a0a2 Release v0.35.4
  • f927818 Upgrade to sharp-libvips v1.3.3
  • e802092 Prerelease v0.35.4-rc.0
  • e13eb2f CI: Fix wasm32 build (#4589)
  • a82a0b3 Upgrade to libvips v8.18.6
  • 8044fe4 Bound resize dimensions to coordinate limit
  • 147f859 Docs: changelog entries for #4578 #4584
  • ee5bfb8 Tests: use yauzl directly rather than via extract-zip wrapper
  • 7a77889 Bump uraimo/run-on-arch-action from 3.1.0 to 3.2.0 (

…updates

Bumps the npm_and_yarn group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@vitest/browser](https://github.com/vitest-dev/vitest/tree/HEAD/packages/browser) | `4.1.8` | `4.1.10` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `4.3.0` | `4.3.2` |
| [@faker-js/faker](https://github.com/faker-js/faker) | `9.9.0` | `10.5.0` |
| [fastify](https://github.com/fastify/fastify) | `5.8.5` | `5.12.1` |
| [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `5.18.2` | `7.2.8` |
| [sharp](https://github.com/lovell/sharp) | `0.33.5` | `0.35.4` |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.4.12` | `3.4.13` |
| [nodemailer](https://github.com/nodemailer/nodemailer) | `7.0.13` | `9.1.1` |

Bumps the npm_and_yarn group with 2 updates in the /apps/api directory: [@faker-js/faker](https://github.com/faker-js/faker) and [fastify](https://github.com/fastify/fastify).
Bumps the npm_and_yarn group with 2 updates in the /apps/outreach directory: [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) and [sharp](https://github.com/lovell/sharp).


Updates `@vitest/browser` from 4.1.8 to 4.1.10
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/browser)

Updates `js-yaml` from 4.3.0 to 4.3.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.3.0...4.3.2)

Updates `@faker-js/faker` from 9.9.0 to 10.5.0
- [Release notes](https://github.com/faker-js/faker/releases)
- [Changelog](https://github.com/faker-js/faker/blob/next/CHANGELOG.md)
- [Commits](faker-js/faker@v9.9.0...v10.5.0)

Updates `fastify` from 5.8.5 to 5.12.1
- [Release notes](https://github.com/fastify/fastify/releases)
- [Commits](fastify/fastify@v5.8.5...v5.12.1)

Updates `astro` from 5.18.2 to 7.2.8
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.2.8/packages/astro)

Updates `sharp` from 0.33.5 to 0.35.4
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](lovell/sharp@v0.33.5...v0.35.4)

Updates `dompurify` from 3.4.12 to 3.4.13
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.12...3.4.13)

Updates `nodemailer` from 7.0.13 to 9.1.1
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](nodemailer/nodemailer@v7.0.13...v9.1.1)

Updates `svgo` from 4.0.1 to 4.1.0
- [Release notes](https://github.com/svg/svgo/releases)
- [Commits](svg/svgo@v4.0.1...v4.1.0)

Updates `@faker-js/faker` from 9.9.0 to 10.5.0
- [Release notes](https://github.com/faker-js/faker/releases)
- [Changelog](https://github.com/faker-js/faker/blob/next/CHANGELOG.md)
- [Commits](faker-js/faker@v9.9.0...v10.5.0)

Updates `fastify` from 5.8.5 to 5.12.1
- [Release notes](https://github.com/fastify/fastify/releases)
- [Commits](fastify/fastify@v5.8.5...v5.12.1)

Updates `astro` from 5.18.2 to 7.2.8
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.2.8/packages/astro)

Updates `sharp` from 0.33.5 to 0.35.4
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](lovell/sharp@v0.33.5...v0.35.4)

---
updated-dependencies:
- dependency-name: "@vitest/browser"
  dependency-version: 4.1.10
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 4.3.2
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: "@faker-js/faker"
  dependency-version: 10.5.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: fastify
  dependency-version: 5.12.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: astro
  dependency-version: 7.2.8
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: sharp
  dependency-version: 0.35.4
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: dompurify
  dependency-version: 3.4.13
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: nodemailer
  dependency-version: 9.1.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: svgo
  dependency-version: 4.1.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@faker-js/faker"
  dependency-version: 10.5.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: fastify
  dependency-version: 5.12.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: astro
  dependency-version: 7.2.8
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: sharp
  dependency-version: 0.35.4
  dependency-type: direct:development
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from joshunrau as a code owner September 10, 2026 16:06
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants