chore(deps-dev): bump the npm-dependencies group across 1 directory with 15 updates

[dependabot]

Bumps the npm-dependencies group with 15 updates in the / directory:

Package	From	To
@apidevtools/json-schema-ref-parser	15.3.5	16.0.2
@redocly/cli	2.31.6	2.52.1
@types/glob	7.2.0	9.0.0
@types/node	25.9.1	26.5.1
axios	1.17.0	1.20.0
js-yaml	4.2.0	5.4.2
openapi-to-postmanv2	6.0.1	6.3.3
postman-collection	5.3.0	5.3.1
prettier	3.8.3	3.9.6
query-string	9.4.0	9.5.1
tar	7.5.16	7.5.22
tar-stream	3.2.0	3.2.1
typescript	6.0.3	7.0.2
yaml	2.9.0	2.9.1
yargs	18.0.0	18.1.0

Updates @apidevtools/json-schema-ref-parser from 15.3.5 to 16.0.2

Release notes

Sourced from @​apidevtools/json-schema-ref-parser's releases.

v16.0.2

16.0.2 (2026-09-06)

Bug Fixes

• harden reference handling and update dependencies (2d69896)

v16.0.1

16.0.1 (2026-08-26)

Bug Fixes

• exclude paths before resolving references (#431) (cdc9aa3)

v16.0.0

16.0.0 (2026-08-14)

• chore!: require Node.js 22 and update dependencies (117061b)

BREAKING CHANGES

• Node.js versions before 22.19.0 are no longer supported.

v15.5.2

15.5.2 (2026-08-14)

Bug Fixes

• decode %3F back to "?" in toFileSystemPath (#427) (#428) (cc2fc04)

v15.5.1

15.5.1 (2026-07-30)

Bug Fixes

• harden reference resolution and HTTP safety (e8190c1)

v15.5.0

15.5.0 (2026-07-09)

Bug Fixes

• stabilize cross-platform CI (8bfeec2)

... (truncated)

Commits

• 32c008d ci: install native pnpm directly on Windows
• 2d69896 fix: harden reference handling and update dependencies
• cdc9aa3 fix: exclude paths before resolving references (#431)
• 117061b chore!: require Node.js 22 and update dependencies
• cc2fc04 fix: decode %3F back to "?" in toFileSystemPath (#427) (#428)
• e8190c1 fix: harden reference resolution and HTTP safety
• cb0c2de Bump dependencies and migrate to Oxlint and Oxfmt (#426)
• a8e6b4d test: allow time for deep reference chain
• 8bfeec2 fix: stabilize cross-platform CI
• 09959ba feat: handle cyclic reference chains safely
• Additional commits viewable in compare view

Updates @redocly/cli from 2.31.6 to 2.52.1

Release notes

Sourced from @​redocly/cli's releases.

@​redocly/cli@​2.52.1

Patch Changes

• Updated redoc to the 2.5.4 version to fix accessibility problems in the HTML produced by build-docs. Added the lang attribute to the default build-docs template.

@​redocly/cli@​2.52.0

Minor Changes

• Added agent skills for AI coding assistants: redocly-cli for everyday CLI usage, redocly-lint-rules for writing configurable rules and custom plugins. Install them with npx skills add https://redocly.com.
• Added an experimental inspect-node-types command to navigate the Redocly's node type tree of an API description. inspect-node-types helps pick the correct subject types for a configurable rule or the correct visitor for a custom plugin.
• Added a strategy option to the component-name-unique rule, matching the --component-names-strategy option of the bundle command.
• Added an experimental introspect-mcp command that analyzes a running MCP server and records its tools, prompts, resources, and capabilities. introspect-mcp records its findings in the x-mcp extension of an OpenAPI description.

Patch Changes

• Updated @​redocly/openapi-core to v2.52.0.

@​redocly/cli@​2.51.2

Patch Changes

• Updated fast-uri to the 3.1.7 version to resolve CVE-2026-75931, CVE-2026-75975, CVE-2026-75899, and CVE-2026-76172.
• Fixed drift and coverage failing to match a path template whose segment mixes literal text with parameters, such as /instances/{worldId}:{instanceId}.
• Fixed an issue where Redocly config resolution failed when plugins used ESM syntax.
• Updated @​redocly/openapi-core to v2.51.2.

@​redocly/cli@​2.51.1

Patch Changes

• Fixed an issue where generate-arazzo produced a malformed remote description URL in sourceDescriptions (https:// collapsed to https:/) when --output-file was provided.
• Fixed an issue where $faker.string.email() used without options generated addresses at the undefined.com domain.
• Updated @​redocly/respect-core to v2.51.1.
• Updated @faker-js/faker to the 10.6.0 version to resolve the high severity advisory GHSA-qxc2-j82w-r537.

@​redocly/cli@​2.51.0

Minor Changes

• Enhanced the generate-arazzo command to print a ready-to-run respect command after generation, including an --input placeholder for every workflow input.
• Added --with-ai, --ai-provider, --ai-model, --ai-concurrency, and --max-workflows options to the generate-arazzo command. --with-ai uses a local AI CLI (claude, codex, or cursor) and OpenAPI descriptions to redesign the generated one-workflow-per-operation skeleton into multi-step workflows. The AI designs at most --max-workflows workflows (default 10), and the generated file is marked as AI-inferred. For descriptions that don't fit a single prompt, the AI first selects scenarios from a compact operation index, then it designs each workflow separately.

Patch Changes

• Fixed an issue where respect and the x-security-scheme-required-values rule incorrectly rejected x-security HTTP schemes written with non-lowercase casing (such as Basic, Bearer, or Digest). RFC 7235 scheme names are case-insensitive.

... (truncated)

Commits

• 3fa9963 chore: 🔖 release new versions (#3110)
• e15102c docs: mention the redocly-lint-rules skill (#3102)
• 1fa5819 fix: bump @​redocly/mock-server to 0.11.0-next.2 (#3109)
• 93c155f fix: update redoc to 2.5.4 to resolve accessibility issues in build-docs (#3107)
• 2586b31 chore: 🔖 release new versions (#3094)
• 90bb574 chore: update redocly config to v0.56.0 (#3105)
• af8c9bd feat: add introspect-mcp command (#3101)
• abc3555 feat: add support for the strategy parameter in component-name-unique rule (#...
• b14e21a docs: add info about boolean values should be false (#3103)
• 8447573 chore: update changelog for v1 (#3100)
• Additional commits viewable in compare view

Updates @types/glob from 7.2.0 to 9.0.0

Commits

• See full diff in compare view

Updates @types/node from 25.9.1 to 26.5.1

Commits

• See full diff in compare view

Updates axios from 1.17.0 to 1.20.0

Release notes

Sourced from axios's releases.

v1.20.0 — August 19, 2026

This release hardens runtime option handling, adds RFC 9110 status-code aliases, fixes Node.js and XHR reliability issues, and refreshes project tooling and documentation.

⚠️ Breaking Changes & Deprecations

• HTTP Status Naming: Added ContentTooLarge (413) and UnprocessableContent (422), while retaining PayloadTooLarge and UnprocessableEntity as backward-compatible deprecated aliases. (#11082)

🔒 Security Fixes

• Runtime Option Handling: Hardened behavioral configuration reads against shared and foreign prototype pollution and normalized unsafe interceptor replacement objects. This also clarifies Fetch redirect and custom implementation behavior, HTTP/2 DNS and proxy handling, CIDR-based NO_PROXY matching, and malformed data URI rejection; see the PR for documented compatibility effects. (#11141)

🐛 Bug Fixes

• Interceptor Lifecycle: Prevented unbounded handler-array growth by trimming trailing ejected interceptors without changing iteration semantics, and kept interceptor operations safe when the public handlers field is nullish. (#11087, #11118)
• Request Error Preservation: Prevented custom Error.prepareStackTrace implementations that return non-string values from replacing the original request failure with an unrelated TypeError. (#11109)
• XHR Reliability: Navigation-canceled requests now reject with ECONNABORTED instead of resolving with status 0, while successful downloads flush their final progress callback during the live loadend dispatch. (#11094, #11121)
• Node.js Socket Memory: Removed request-context retention from per-socket error listeners, preventing completed response data from being pinned for the lifetime of pooled keep-alive sockets. (#11091)
• Core Methods and HTTP Errors: Prevented structural method-header buckets from leaking into outgoing headers, standardized invalid DNS lookup and httpVersion failures as AxiosError.ERR_BAD_OPTION_VALUE, and corrected the timeoutErrorMessage merge strategy. (#11096)

🔧 Maintenance & Chores

• Dependencies: Updated fast-uri, postcss, js-yaml, mocha, development-tooling groups, and GitHub Actions dependencies. (#11092, #11098, #11099, #11106, #11107, #11122, #11123, #11126, #11127, #11133, #11140, #11143, #11144)
• Documentation: Applied the v1.19.0 documentation updates, added the missing fs import to the README stream example, introduced localized global search, and repaired the interceptor test link. (#11101, #11113, #11097, #11119)
• Sponsorship: Updated sponsorship links and data and added ScrapingBee as a sponsor. (#11124, #11136, #11137)
• CI and Release: Switched ESM smoke tests to locked dependencies and synchronized package and runtime version metadata for v1.20.0. (#11128, #11152)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

• @​yens1 (#11109)
• @​Sasireddy001 (#11113)
• @​ari-token-security (#11094)
• @​timothyokooboh (#11097)
• @​gi9439041-png (#11119)
• @​Hashim1999164 (#11082)
• @​v-dev-cl (#11091)
• @​r0h1tb (#11118)
• @​ostapondo (#11121)

Full Changelog (axios/axios@v1.19.0...v1.20.0)

v1.19.0 - July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

• Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

... (truncated)

Changelog

Sourced from axios's changelog.

Changelog

v1.19.0 — July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

• Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

🚀 New Features

• Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers. (#11043, #11081)
• Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)
• HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)

🐛 Bug Fixes

• Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)

• Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)

• Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)

• Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)

• URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11008, #11038)

• Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)

• Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (#11044, #11059)

• Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (#11061)

• Synchronous Interceptors: Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (#11071)

🔧 Maintenance & Chores

• Dependencies: Updated development and test tooling, the docs fixture's Axios version, and GitHub Actions integrations including Checkout, Setup Node, Setup Deno, and Zizmor. (#11031, #11055, #11056, #11058, #11079, #11080, #11088, #11089, #11090)
• Build Outputs: Limited sourcemap generation to published minified bundles, removing broken map references from non-minified builds. (#11054)
• Form Data Internals: Centralized FormData header handling and made the Node.js adapter tolerate getHeaders() returning undefined under the content-only policy. (#11062)
• Developer Experience: Ignored common local AI-tooling directories and fixed a constant-reassignment crash when the development sandbox serves its root path. (#11032, #11073)
• Documentation: Updated sponsor information, clarified that baseURL is not a path-security boundary, scoped provenance claims to attested releases, and corrected the configuration-defaults documentation. (#11041, #11068, #11076, #11078)
• Publishing: Simplified v1 publishing to use the npm version bundled with Node.js 26 and updated package metadata for the 1.19.0 release. (#11083, #11095)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve Axios:

• @​afonsojramos (#11028)
• @​MahinAnowar (#11006)
• @​yassertawfik4 (#11024)
• @​AnandSundar (#11029)
• @​lin-hongkuan (#11035)
• @​Wali007-lab (#11054)
• @​magicdawn (#11043)

... (truncated)

Commits

• 84a9f3b chore(release): prepare release 1.20.0 (#11152)
• e6824ee fix: core methodList, HTTP adapter errors, and add tests (#11096)
• d8a919f fix(xhr): flush final progress during the live loadend dispatch (#11121)
• 2d2a21a fix(interceptors): tolerate nullish handlers in syncHandlerEntries (#11118)
• d19040b fix: harden runtime option handling (#11141)
• e0a02dd chore(deps): bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 in the github-...
• d10cb3a chore(deps-dev): bump the development_dependencies group with 4 updates (#11143)
• 2c94646 chore(deps): bump js-yaml and mocha in /tests/smoke/cjs (#11133)
• 76c12bc chore(deps-dev): bump js-yaml from 4.3.0 to 4.3.1 (#11140)
• ba98559 docs: add ScrapingBee sponsor (#11137)
• Additional commits viewable in compare view

Updates js-yaml from 4.2.0 to 5.4.2

Changelog

Sourced from js-yaml's changelog.

[5.4.2] - 2026-09-13

Fixed

• forceQuotes no longer quotes non-string scalars, #798.

[5.4.1] - 2026-08-26

Changed

• Hard-limit merge sequence size to 100.

Security

• Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

[5.4.0] - 2026-08-25

Added

• Added the scalarStyleRules dumper option to customize string formatting. See Scalar styling for details.

Changed

• [breaking] Flattened the low-level AST node style representation. Scalar and collection nodes now use SCALAR_STYLE and COLLECTION_STYLE values; explicit tags use the separate tagged property. Alias nodes now contain only kind and anchor. This only affects code that directly constructs or edits AST nodes.
• [breaking] The sortKeys option was rewritten using AST mutation to avoid side effects.
• Reworked scalar style selection. This can change formatting without changing loaded values; in particular, whitespace-only strings are now double-quoted.

Fixed

• Accept a byte order mark at the start of each document in a stream, #791.
• Produce valid flow mappings with quoteFlowKeys and flowSkipColonSpace, including alias and property-only keys, #786.
• Preserve empty scalar items when converting block sequences to flow style.
• Do not apply the 1024-character simple-key limit to flow mapping keys.
• Count Unicode code points, rather than UTF-16 code units, for the 1024-character simple-key limit.
• Add an explicit document-end marker after keep-chomped block scalars when needed to preserve trailing newlines.

[5.3.0] - 2026-08-14

This release focuses on reworking the documentation and making small architectural improvements before moving forward.

... (truncated)

Commits

• 494400b 5.4.2 released
• 6d8adb4 Fix forceQuotes quoting non-string scalars, #798
• e5a3ba0 5.4.1 released
• e54dea3 Hard-limit merge sequence size to 100
• dfd3a29 Cleanup 6a8e05f, #797
• 6a8e05f fix: count empty merge sources against maxTotalMergeKeys (#797)
• 6b4ff5e 5.4.0 released
• 3b3625e Update changelog
• 4f25a74 Fix file name
• 3bd003b Expose new scalar styling API
• Additional commits viewable in compare view

Updates openapi-to-postmanv2 from 6.0.1 to 6.3.3

Changelog

Sourced from openapi-to-postmanv2's changelog.

[v6.3.3] - 2026-08-11

[v6.3.2] - 2026-07-31

Fixed

• Upgraded lodash and js-yaml to patch security advisories (SECINV-136)

[v6.3.1] - 2026-07-23

[v6.3.0] - 2026-07-07

[v6.2.0] - 2026-06-29

[v6.1.0] - 2026-06-09

Commits

• 92cd21e Merge pull request #972 from postmanlabs/release/v6.3.3
• adc84f8 Prepare release v6.3.3
• efe045a Merge pull request #971 from postmanlabs/feature/fix-non-stringified-env
• a905fa4 Preserve bare Postman variables in JSON request/response bodies during sync
• fec5eab Merge pull request #969 from postmanlabs/fix/npm-publish-oidc-develop
• 242ef8d ci: self-contained OIDC npm publish (public repo cannot use private reusable ...
• 1334cce Merge pull request #968 from postmanlabs/fix/npm-publish-oidc
• 09469cb ci: self-contained OIDC npm publish (public repo cannot use private reusable ...
• dc26169 Merge pull request #967 from postmanlabs/release/v6.3.2
• 92ce7c7 Merge pull request #966 from postmanlabs/release/v6.3.2
• Additional commits viewable in compare view

Updates postman-collection from 5.3.0 to 5.3.1

Changelog

Sourced from postman-collection's changelog.

5.3.1: date: 2026-07-21 chores: - Updated dependencies

Commits

• e2453a5 Merge branch 'release/5.3.1'
• cb9434d Release v5.3.1
• de8aadf Updated dependencies
• 834fd56 Merge branch 'release/5.3.0' into develop
• See full diff in compare view

Updates prettier from 3.8.3 to 3.9.6

Release notes

Sourced from prettier's releases.

3.9.6

What's Changed

• Preserve quotes for methods named new (prettier/prettier#19621 by @​kovsu)
• Support import defer in typescript parser (prettier/prettier#19624, prettier/prettier#19675 by @​fisker)
• Added a new official plugin @prettier/plugin-yuku 🚀 (prettier/prettier#19628, prettier/prettier#19629 by @​fisker)

🔗 Changelog

3.9.5

🔗 Changelog

3.9.4

• Angular: Format @content(name) -> @content (name) to align with other block syntax (#19499 by @​fisker)

🔗 Changelog

3.9.3

• Markdown: Fix unexpected removal of characters in liquid syntax (prettier/prettier#19489 by @​seiyab)
• TypeScript: Allow decorators to be used with declare on class fields (prettier/prettier#19492 by @​evoactivity)

🔗 Changelog

3.9.1

• CLI: Fix ignored file has been cached incorrectly (#19483 by @​kovsu)

🔗 Changelog

3.9.0

diff

🔗 Prettier 3.9: Major parser upgrades and Formatting improvements

3.8.5

• Fix Flow variance annotation print (#19022 by @​marcoww6)

🔗 Changelog

3.8.4

• Markdown: Fix blank lines between list items and nested sub-lists being removed in Markdown/MDX (prettier/prettier#17746 by @​byplayer)

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.6

diff

TypeScript: Preserve quotes for methods named new (#19621 by @​kovsu)

// Input
interface Container {
  "new"(id: string): number;
}
// Prettier 3.9.5
interface Container {
new(id: string): number;
}
// Prettier 3.9.6
interface Container {
"new"(id: string): number;
}

TypeScript: Support import defer (#19624, #19675 by @​fisker)

// Input
import defer * as foo from "foo";
// Prettier 3.9.5
import * as foo from "foo";
// Prettier 3.9.6
import defer * as foo from "foo";

JavaScript: Added a new official plugin @prettier/plugin-yuku (#19628, #19629 by @​fisker)

@prettier/plugin-yuku is powered by Yuku (A high-performance JavaScript/TypeScript compiler toolchain written in Zig).

This plugin includes two new parsers: yuku (JavaScript syntax) and yuku-ts (TypeScript syntax).

To use this plugin:

1. Install the plugin:

   yarn add --dev prettier @prettier/plugin-yuku

... (truncated)

Commits

• 8f0c950 Release 3.9.6
• e910764 Update changelog
• ec3f1c7 Update typescript-eslint to v8.65.0 (#19675)
• 73d2efc Update Yuku parser to v0.7.0 (#19664)
• dd5e24e Preserve quotes for TSMethodSignature nodes named new (#19621)
• c03ab4e Update dependency eslint-plugin-unicorn to v72 (#19633)
• b74dd53 Update Yuku parser to v0.6.5 (#19654)
• f1b594e Update dependency eslint-plugin-simple-import-sort to v14 (#19655)
• 0d9dfb6 Update Yuku parser to v0.6.4 (#19650)
• 3bbb815 Remove typescript-only directory (#19636)
• Additional commits viewable in compare view

Updates query-string from 9.4.0 to 9.5.1

Release notes

Sourced from query-string's releases.

v9.5.1

• Fix stringifyUrl() dropping a leading # in the fragment identifier and throwing on some absolute URLs 47b5b30

---

sindresorhus/query-string@v9.5.0...v9.5.1

v9.5.0

• Update dependencies 55e453d

---

sindresorhus/query-string@v9.4.1...v9.5.0

v9.4.1

• Fix relative URLs with fragments 872fb6f

---

sindresorhus/query-string@v9.4.0...v9.4.1

Commits

• 7fd8133 9.5.1
• 47b5b30 Fix stringifyUrl() dropping a leading # in the fragment identifier and th...
• aae373a 9.5.0
• 55e453d Update dependencies
• c69443c 9.4.1
• 872fb6f Fix relative URLs with fragments
• f5daa07 Create security.md
• See full diff in compare view

Updates tar from 7.5.16 to 7.5.22

Commits

• 2a22bfc 7.5.22
• df1cd8d Allow transform to be falsey
• 0cd9cc3 7.5.21
• 631ae59 list: prevent unbounded recursion
• ebbb720 7.5.20
• 2f27196 fix: fully disable and dispose of unzip when aborting parser
• be440da 7.5.19
• 2812e93 add maxDecompressionRatio guard against explosive decompression
• 9ecd4d2 7.5.18
• 9e78bf0 refuse to let header size be less than 0
• Additional commits viewable in compare view

Updates tar-stream from 3.2.0 to 3.2.1

Commits

• 246572f 3.2.1
• 5aa24f7 Add TypeScript typings (#179)
• See full diff in compare view

Updates typescript from 6.0.3 to 7.0.2

Release notes

Sourced from typescript's releases.

TypeScript 7.0.2

https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/

This tag was originally released at: https://github.com/microsoft/typescript-go/releases/tag/typescript%2Fv7.0.2

Commits

• 1e4744d Merge branch 'main' into ts7-release
• a5a219cmicrosoft/typescript-go#4558
• ecfe30d Update status localization
• 5de25b5 Hide executable name in TypeScript status
• d7ce74a Show bundled TypeScript version for packaged servers
• 29be66a Correct TS 7 release version to 7.0.2
• ed2bd1b Merge branch 'main' into ts7-release
• 8873075 Bump the github-actions group across 1 directory with 3 updates (microsoft/ty...
• 9427131 Set up stable / nightly extension split, other prep (microsoft/typescript-go#...
• d4eaca5microsoft/typescript-go#4549
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

Updates yaml from 2.9.0 to 2.9.1

Release notes

Sourced from yaml's releases.

v2.9.1

• Limit recursive merge aliases (#685, #713)
• Simplify line unfolding during quoted string parsing (#714)

Commits

• 1440ecd 2.9.1
• c699bc5 fix: Simplify line unfolding during quoted string parsing (#714)
• d11ce77 fix: Limit recursive merge aliases (#713)
• c5f49f4 chore: Update docs-slate
• See full diff in compare view

Updates yargs from 18.0.0 to 18.1.0

Changelog

Sourced from yargs's changelog.

18.1.0 (2026-07-26)

Features

• ignore bun when getting bin name (b77831c)

Bug Fixes

• lang: 'count' for de locale (#2476) (971e351)
• local prototype pollution vulnerability in apply-extends (437f3a4)
• locale: add Georgian translation (#2474) (086aeaa)

17.7.3 (2026-06-19)

Bug Fixes

• fix: use entry point with file extension for anything that supports exports (#2514) (c7597e3)

16.2.2 (2026-06-19)

Bug Fixes

• fix: use entry point with .cjs file extension for yargs export (#2546) (6feb819)

Commits

• 8878a89 chore(main): release 18.1.0 (#2475)
• db916b4 chore: add workflow_dispatch for release-please (#2564)
• 4153e0f chore: improve build robustness (#2554)
• 186d2e6 docs: clarify nargs option-like values (#2551)
• c615633 docs: fix various typos in source code (#2525)
• 7c76d0a docs: fix broken links in api.md (#2549)
• 37e2e5b chore: fix .wrap() docs (#2493)
• 547e300 chore: update the easy dependencies (#2552)
• e086681 chore(deps): update dependency cross-env to v10 (#2480)
• 88f548c chore: fix typos (#2492)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by shadowspawn, a new releaser for yargs since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (un...

Description has been truncated

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.

_{Tip: disable this comment in your organization's Code Review settings.}