Skip to content

deps(deps): bump the major group across 1 directory with 14 updates - #182

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/major-bc1a4a0a20
Open

deps(deps): bump the major group across 1 directory with 14 updates#182
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/major-bc1a4a0a20

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 17, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the major group with 14 updates in the / directory:

Package From To
@alpacahq/alpaca-trade-api 3.1.3 4.0.1
framer-motion 12.38.0 13.1.0
ioredis 5.10.1 6.0.0
openai 6.36.0 7.4.0
puppeteer 24.42.0 25.7.0
undici 7.25.0 8.10.0
webtorrent 2.8.5 3.0.21
@testing-library/jest-dom 6.9.1 7.0.1
@types/node 25.6.0 26.2.0
@vitejs/plugin-react 5.1.4 6.0.5
eslint 9.39.2 10.8.1
jsdom 29.1.1 30.0.1
@types/jsdom 28.0.0 30.0.0
typescript 5.9.3 7.0.2

Updates @alpacahq/alpaca-trade-api from 3.1.3 to 4.0.1

Release notes

Sourced from @​alpacahq/alpaca-trade-api's releases.

v4.0.1

Patch Changes

  • #298 5344968 Thanks @​Azein! - Update installation and migration documentation to use the stable 4.x release instead of the alpha channel.

v4.0.0

Major Changes

  • #295 9301d5c Thanks @​Azein! - Complete TypeScript rewrite (alpha). New unified Alpaca client for the Trading and Market Data APIs with typed errors, retry/timeout/rate limiting, pagination helpers, ergonomic order builders, and real-time streaming. Dual ESM+CJS build with edge/worker/deno export conditions. Requires Node >= 20.

Minor Changes

  • #295 9301d5c Thanks @​Azein! - Added imbalances stream channel + validateConnection

  • #295 9301d5c Thanks @​Azein! - Preserve full precision for market-data identifiers and extend timestampRaw coverage, all additively:

    • Lossless 64-bit stream ids. The market-data WebSocket now decodes trade/news ids as exact values and exposes them as strings alongside the numeric field: idRaw on trades and cancel-errors, originalIdRaw/correctedIdRaw on corrections, and idRaw on news. This prevents precision loss for ids beyond 2^53; other numeric fields remain a plain number.
    • timestampRaw on more canonical shapes. New getIndexValues and getStockAuctions accessors return canonical IndexValue / DailyAuctions shapes that carry the full-precision timestampRaw (per auction print), matching Bar/Trade/Quote.

  • #295 9301d5c Thanks @​Azein! - Preserve full precision for 64-bit trade ids on the REST side, matching the live stream:

    • Lossless market-data JSON. The market-data REST transport now parses response bodies losslessly, so integer ids beyond 2^53 (in practice crypto trade ids) no longer lose precision. The trading transport is unaffected.
    • idRaw on REST canonical trades. getStockTrades/getCryptoTrades (and their *For variants) now expose an exact idRaw?: string alongside the convenient id: number — identical to the WebSocket stream, so ids backfilled over REST match live ones. Use idRaw to compare, store, or key on an id.
    • Raw-model note (behavioral). On the raw generated models an id past 2^53 (a crypto trade .i) now surfaces as a string at runtime rather than a lossy number, even though the generated type says number. Prefer the canonical accessors, or read the raw .i as the exact string. Stock/option ids, news ids, sizes, volumes, and counts are unaffected.

  • #295 9301d5c Thanks @​Azein! - Market-data timestamps now carry an additive timestampRaw (RFC-3339, nanosecond precision) alongside the existing millisecond timestamp: Date, on both the WebSocket stream and the REST canonical Bar/Trade/Quote shapes. Fixes the v3 nanosecond-truncation issue (#250) without any breaking changes.

  • #295 9301d5c Thanks @​Azein! - Harden HTTP redirect handling to prevent credential leakage. Requests now default to redirect: "error", so a 3xx redirect fails fast instead of being followed. Alpaca's APIs never redirect, and following one off-host would forward the APCA-API-KEY-ID/APCA-API-SECRET-KEY headers to the redirect target — unlike Authorization, custom headers are not stripped on a cross-origin redirect, so this closes a secret-leak vector. A new redirect option (client option and Configuration parameter; per-call initOverrides.redirect still wins) lets you opt back into "follow" when fronting the API with a redirecting proxy.

  • #295 9301d5c Thanks @​Azein! - Bring the REST transport to parity with the Alpaca Java client's resilience and response surfaces:

    • Retry observability. The retry config now accepts onRetry and onGiveUp hooks, each fired with a RetryEvent ({ method, url, attempt, maxRetries, delayMs, status?, error? }): status for status-based retries, error for transient network-error retries. onRetry fires before each delayed retry; onGiveUp fires once when a retryable failure exhausts all attempts. They are pure observability hooks — exceptions thrown from a listener are swallowed so they can never break a request.
    • Typed response-with-headers. New withResponse(...) helper wraps any generated *Raw call and returns a typed AlpacaApiResponse<T>

... (truncated)

Changelog

Sourced from @​alpacahq/alpaca-trade-api's changelog.

4.0.1

Patch Changes

  • #298 5344968 Thanks @​Azein! - Update installation and migration documentation to use the stable 4.x release instead of the alpha channel.

4.0.0

Major Changes

  • #295 9301d5c Thanks @​Azein! - Complete TypeScript rewrite (alpha). New unified Alpaca client for the Trading and Market Data APIs with typed errors, retry/timeout/rate limiting, pagination helpers, ergonomic order builders, and real-time streaming. Dual ESM+CJS build with edge/worker/deno export conditions. Requires Node >= 20.

Minor Changes

  • #295 9301d5c Thanks @​Azein! - Added imbalances stream channel + validateConnection

  • #295 9301d5c Thanks @​Azein! - Preserve full precision for market-data identifiers and extend timestampRaw coverage, all additively:

    • Lossless 64-bit stream ids. The market-data WebSocket now decodes trade/news ids as exact values and exposes them as strings alongside the numeric field: idRaw on trades and cancel-errors, originalIdRaw/correctedIdRaw on corrections, and idRaw on news. This prevents precision loss for ids beyond 2^53; other numeric fields remain a plain number.
    • timestampRaw on more canonical shapes. New getIndexValues and getStockAuctions accessors return canonical IndexValue / DailyAuctions shapes that carry the full-precision timestampRaw (per auction print), matching Bar/Trade/Quote.

  • #295 9301d5c Thanks @​Azein! - Preserve full precision for 64-bit trade ids on the REST side, matching the live stream:

    • Lossless market-data JSON. The market-data REST transport now parses response bodies losslessly, so integer ids beyond 2^53 (in practice crypto trade ids) no longer lose precision. The trading transport is unaffected.
    • idRaw on REST canonical trades. getStockTrades/getCryptoTrades (and their *For variants) now expose an exact idRaw?: string alongside the convenient id: number — identical to the WebSocket stream, so ids backfilled over REST match live ones. Use idRaw to compare, store, or key on an id.
    • Raw-model note (behavioral). On the raw generated models an id past 2^53 (a crypto trade .i) now surfaces as a string at runtime rather than a lossy number, even though the generated type says number. Prefer the canonical accessors, or read the raw .i as the exact string. Stock/option ids, news ids, sizes, volumes, and counts are unaffected.

  • #295 9301d5c Thanks @​Azein! - Market-data timestamps now carry an additive timestampRaw (RFC-3339, nanosecond precision) alongside the existing millisecond timestamp: Date, on both the WebSocket stream and the REST canonical Bar/Trade/Quote shapes. Fixes the v3 nanosecond-truncation issue (#250) without any breaking changes.

  • #295 9301d5c Thanks @​Azein! - Harden HTTP redirect handling to prevent credential leakage. Requests now default to redirect: "error", so a 3xx redirect fails fast instead of being followed. Alpaca's APIs never redirect, and following one off-host would forward the APCA-API-KEY-ID/APCA-API-SECRET-KEY headers to the redirect target — unlike Authorization, custom headers are not stripped on a cross-origin redirect, so this closes a secret-leak vector. A new redirect option (client option and Configuration parameter; per-call initOverrides.redirect still wins) lets you opt back into "follow" when fronting the API with a redirecting proxy.

  • #295 9301d5c Thanks @​Azein! - Bring the REST transport to parity with the Alpaca Java client's resilience and response surfaces:

    • Retry observability. The retry config now accepts onRetry and onGiveUp hooks, each fired with a RetryEvent ({ method, url, attempt, maxRetries, delayMs, status?, error? }): status for status-based retries, error for transient network-error retries. onRetry fires before each delayed retry; onGiveUp fires once when a retryable failure exhausts all attempts. They are pure observability hooks — exceptions thrown from a listener are swallowed so they can never break a request.

... (truncated)

Commits
Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates framer-motion from 12.38.0 to 13.1.0

Changelog

Sourced from framer-motion's changelog.

[13.1.0] 2026-08-10

Added

  • Reorder: Multidimensional reorder.
  • Reorder: Automatic axis detection.
  • Reorder: RTL support.

[13.0.0] 2026-08-05

Changed

  • Removed optional @emotion/is-prop-valid dependency in favour of explicit <MotionConfig isValidProp={isPropValid}>.

Fixed

  • Hardware-accelerated SVG elements correctly apply final style on animation complete.
  • AnimatePresence: Ensure nodes are marked as safe to remove when rendering propagate with no motion children.

[12.43.0] 2026-07-27

Added

  • Hardware acceleration for backgroundColor in supported browsers.
  • Hardware acceleration for SVG elements.

Fixed

  • AnimatePresence: Exiting children no longer interleave with entering children, which could reorder and remount children present in both renders.
  • motion: Throw error when passing a custom motion component an incorrect ref type.

[12.42.2] 2026-07-01

Fixed

  • animateView: Cropped group layers now animate border-radius from the old to new radius.

[12.42.1] 2026-06-30

Fixed

  • animateView: Old layer fade out now cancelled when defining .new().

[12.42.0] 2026-06-24

Changed

  • animateView: Layers are automatically grouped to match their DOM-hierarchy. New .group(false) method opts-out.

Fixed

... (truncated)

Commits
  • adaf7a4 v13.1.0
  • e713759 Updating changelog
  • bc81c03 Updating publish
  • 092b771 Merge pull request #3785 from motiondivision/feature/1400-reorder-grid
  • 025b0f4 Merge pull request #3789 from motiondivision/dependabot/npm_and_yarn/nanoid-3...
  • 2f05af8 Bump nanoid from 3.3.11 to 3.3.18
  • e0780bb Merge pull request #3788 from motiondivision/dependabot/npm_and_yarn/js-yaml-...
  • 29af841 Fix wrapped Reorder insertion behavior
  • 0035e3c Bump js-yaml from 3.15.0 to 3.15.1
  • e4029ce v13.0.0
  • Additional commits viewable in compare view

Updates ioredis from 5.10.1 to 6.0.0

Release notes

Sourced from ioredis's releases.

v6.0.0

6.0.0 (2026-07-31)

Bug Fixes

  • clear stale socket timeout on reconnect (#2148) (6455dbe)
  • cluster: recreate stale connection on circular MOVED (#2135) (08c8967)
  • cluster: validate MOVED slot to prevent Array.prototype pollution (#2151) (9618206), closes #1267
  • command: serialize large integer arguments in decimal notation (#2136) (09b8d04)
  • redis: keep reconnecting when connection closes during client setup (#2099) (#2123) (f9a66bc)
  • sentinel: preserve zero preferred slave priority (#2129) (a3f9f2d)
  • tracing: redact values for GETSET and PSETEX (#2134) (832765d)
  • types: export ScanStreamOptions, RedisStatus and ClusterStatus (#2158) (cf3bf71)

Features

BREAKING CHANGES

  • ioredis now requires Node.js 20 or newer and uses RESP3 by default. Set protocol: 2 to retain the v5 wire protocol.

v6.0.0-beta.1

6.0.0-beta.1 (2026-07-29)

Bug Fixes

  • clear stale socket timeout on reconnect (#2148) (6455dbe)
  • cluster: recreate stale connection on circular MOVED (#2135) (08c8967)
  • cluster: validate MOVED slot to prevent Array.prototype pollution (#2151) (9618206), closes #1267
  • command: serialize large integer arguments in decimal notation (#2136) (09b8d04)
  • redis: keep reconnecting when connection closes during client setup (#2099) (#2123) (f9a66bc)
  • sentinel: preserve zero preferred slave priority (#2129) (a3f9f2d)
  • tracing: redact values for GETSET and PSETEX (#2134) (832765d)

... (truncated)

Changelog

Sourced from ioredis's changelog.

6.0.0 (2026-07-31)

Bug Fixes

  • clear stale socket timeout on reconnect (#2148) (6455dbe)
  • cluster: recreate stale connection on circular MOVED (#2135) (08c8967)
  • cluster: validate MOVED slot to prevent Array.prototype pollution (#2151) (9618206), closes #1267
  • command: serialize large integer arguments in decimal notation (#2136) (09b8d04)
  • redis: keep reconnecting when connection closes during client setup (#2099) (#2123) (f9a66bc)
  • sentinel: preserve zero preferred slave priority (#2129) (a3f9f2d)
  • tracing: redact values for GETSET and PSETEX (#2134) (832765d)
  • types: export ScanStreamOptions, RedisStatus and ClusterStatus (#2158) (cf3bf71)

Features

BREAKING CHANGES

  • ioredis now requires Node.js 20 or newer and uses RESP3 by default. Set protocol: 2 to retain the v5 wire protocol.

5.11.1 (2026-06-04)

Bug Fixes

  • cluster: reconnect to nodes that restart without slot changes (#2096) (c84b2ee)
  • parse protocol-relative Redis URLs as TCP connections (#2125) (131ee24)

5.11.0 (2026-05-26)

Bug Fixes

Features

... (truncated)

Commits

Updates openai from 6.36.0 to 7.4.0

Release notes

Sourced from openai's releases.

v7.4.0

7.4.0 (2026-08-03)

Features

  • api: Add gpt-5.5 model and tool metadata fields (#2049) (6d8fb53)

Bug Fixes

Documentation

Build System

  • deps-dev: bump @​smithy/hash-node from 4.3.5 to 4.4.15 (#2064) (481b325)
  • deps-dev: bump @​types/web from 0.0.194 to 0.0.354 (#2061) (f61f267)
  • deps-dev: bump publint from 0.2.12 to 0.3.22 (#2058) (823d7df)
  • deps: bump dotenv from 16.6.1 to 17.4.2 (#2065) (3576574)
  • deps: bump fast-uri from 3.1.4 to 3.1.5 in /ecosystem-tests/vercel-edge (#2050) (590982f)
  • deps: bump ip-address from 10.2.0 to 10.4.0 in /ecosystem-tests/vercel-edge (#2056) (4d927de)
  • migrate release workflow to upstream release-please (#2048) (d41c272)

v7.3.0

7.3.0 (2026-07-31)

Full Changelog: v7.2.0...v7.3.0

Features

  • api: content provenance checks (c6f9339)

Chores

Documentation

  • organize SDK guides and repository metadata (#2032) (275dff4)
  • remove root-level provider guides (98a2ae7)

... (truncated)

Changelog

Sourced from openai's changelog.

7.4.0 (2026-08-03)

Features

  • api: Add gpt-5.5 model and tool metadata fields (#2049) (6d8fb53)

Bug Fixes

Documentation

Build System

  • deps-dev: bump @​smithy/hash-node from 4.3.5 to 4.4.15 (#2064) (481b325)
  • deps-dev: bump @​types/web from 0.0.194 to 0.0.354 (#2061) (f61f267)
  • deps-dev: bump publint from 0.2.12 to 0.3.22 (#2058) (823d7df)
  • deps: bump dotenv from 16.6.1 to 17.4.2 (#2065) (3576574)
  • deps: bump fast-uri from 3.1.4 to 3.1.5 in /ecosystem-tests/vercel-edge (#2050) (590982f)
  • deps: bump ip-address from 10.2.0 to 10.4.0 in /ecosystem-tests/vercel-edge (#2056) (4d927de)
  • migrate release workflow to upstream release-please (#2048) (d41c272)

7.3.0 (2026-07-31)

Full Changelog: v7.2.0...v7.3.0

Features

  • api: content provenance checks (c6f9339)

Chores

Documentation

  • organize SDK guides and repository metadata (#2032) (275dff4)
  • remove root-level provider guides (98a2ae7)

7.2.0 (2026-07-30)

... (truncated)

Commits
  • 83c437f release: 7.4.0 (#2055)
  • a97cbff ci: prepare checks for merge queue (#2066)
  • 481b325 build(deps-dev): bump @​smithy/hash-node from 4.3.5 to 4.4.15 (#2064)
  • 3576574 build(deps): bump dotenv from 16.6.1 to 17.4.2 (#2065)
  • 823d7df build(deps-dev): bump publint from 0.2.12 to 0.3.22 (#2058)
  • f61f267 build(deps-dev): bump @​types/web from 0.0.194 to 0.0.354 (#2061)
  • 85ea6b2 [dependabot] Configure a seven-day npm cooldown (#2054)
  • 4d927de build(deps): bump ip-address from 10.2.0 to 10.4.0 in /ecosystem-tests/vercel...
  • 590982f build(deps): bump fast-uri from 3.1.4 to 3.1.5 in /ecosystem-tests/vercel-edg...
  • 6d8fb53 feat(api): Add gpt-5.5 model and tool metadata fields (#2049)
  • Additional commits viewable in compare view

Updates puppeteer from 24.42.0 to 25.7.0

Release notes

Sourced from puppeteer's releases.

puppeteer-core: v25.7.0

25.7.0 (2026-08-13)

🎉 Features

🛠️ Fixes

🏗️ Refactor

puppeteer: v25.7.0

25.7.0 (2026-08-13)

🎉 Features

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 25.6.0 to 25.7.0

puppeteer-core: v25.6.0

25.6.0 (2026-08-11)

🎉 Features

🛠️ Fixes

... (truncated)

Changelog

Sourced from puppeteer's changelog.

25.7.0 (2026-08-13)

🎉 Features

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 25.6.0 to 25.7.0

🛠️ Fixes

🏗️ Refactor

25.6.0 (2026-08-11)

♻️ Chores

  • puppeteer: Synchronize puppeteer versions

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • @​puppeteer/browsers bumped from 3.1.0 to 3.2.0

🎉 Features

🛠️ Fixes

  • cdp: do not fail a per-frame fan-out when an OOP iframe goes away (#15300) (e29c4e7)

... (truncated)

Commits

Updates undici from 7.25.0 to 8.10.0

Release notes

Sourced from undici's releases.

v8.10.0

What's Changed

New Contributors

Full Changelog: nodejs/undici@v8.9.0...v8.10.0

v8.9.0

⚠️ Security fixes

High severity

  • GHSA-4cwx-7wf7-3272: malformed qualified private Cache-Control directives could cause cross-user information disclosure in shared caches or a parse-time crash. The cache parser now treats empty qualified directives conservatively and safely handles mixed qualified and unqualified directives. Fixed by 4fe5bc5f with regression coverage in 9f09b49a.

Medium severity

  • GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 7d3cf924.
    • Description has been truncated

@dependabot @github

dependabot Bot commented on behalf of github Aug 17, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@socket-security

socket-security Bot commented Aug 17, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Added@​types/​jsdom@​30.0.01001007389100
Addedopenai@​7.4.078100100100100
Added@​types/​node@​26.2.01001008195100
Addedtypescript@​7.0.29910089100100
Addedwebtorrent@​3.0.2190100100100100
Added@​alpacahq/​alpaca-trade-api@​4.0.19110010092100
Addedpuppeteer@​25.7.0921009397100
Addedundici@​8.10.09310010097100
Addedioredis@​6.0.09410010095100
Added@​vitejs/​plugin-react@​6.0.510010010094100
Addedjsdom@​30.0.19810010095100
Addedeslint@​10.8.19710010095100
Added@​testing-library/​jest-dom@​7.0.110010010096100
Addedframer-motion@​13.1.09910010097100

View full report

@socket-security

socket-security Bot commented Aug 17, 2026 •
edited
Loading

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
License policy violation: npm @typescript/typescript-aix-ppc64 under unrecognized license

License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt)

From: pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-aix-ppc64@7.0.2

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-aix-ppc64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @typescript/typescript-darwin-arm64 under unrecognized license

License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt)

From: pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-darwin-arm64@7.0.2

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-darwin-arm64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @typescript/typescript-darwin-x64 under unrecognized license

License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt)

From: pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-darwin-x64@7.0.2

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-darwin-x64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @typescript/typescript-freebsd-arm64 under unrecognized license

License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt)

From: pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-freebsd-arm64@7.0.2

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-freebsd-arm64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @typescript/typescript-freebsd-x64 under unrecognized license

License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt)

From: pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-freebsd-x64@7.0.2

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-freebsd-x64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @typescript/typescript-linux-arm under unrecognized license

License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt)

From: pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-linux-arm@7.0.2

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-linux-arm@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @typescript/typescript-linux-arm64 under unrecognized license

License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt)

From: pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-linux-arm64@7.0.2

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-linux-arm64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @typescript/typescript-linux-loong64 under unrecognized license

License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt)

From: pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-linux-loong64@7.0.2

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-linux-loong64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @typescript/typescript-linux-mips64el under unrecognized license

License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt)

From: pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-linux-mips64el@7.0.2

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-linux-mips64el@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @typescript/typescript-linux-ppc64 under unrecognized license

License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt)

From: pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-linux-ppc64@7.0.2

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-linux-ppc64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @typescript/typescript-linux-riscv64 under unrecognized license

License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt)

From: pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-linux-riscv64@7.0.2

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-linux-riscv64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @typescript/typescript-linux-s390x under unrecognized license

License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt)

From: pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-linux-s390x@7.0.2

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-linux-s390x@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @typescript/typescript-linux-x64 under unrecognized license

License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt)

From: pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-linux-x64@7.0.2

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-linux-x64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @typescript/typescript-netbsd-arm64 under unrecognized license

License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt)

From: pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-netbsd-arm64@7.0.2

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-netbsd-arm64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @typescript/typescript-netbsd-x64 under unrecognized license

License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt)

From: pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-netbsd-x64@7.0.2

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-netbsd-x64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @typescript/typescript-openbsd-arm64 under unrecognized license

License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt)

From: pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-openbsd-arm64@7.0.2

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-openbsd-arm64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @typescript/typescript-openbsd-x64 under unrecognized license

License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt)

From: pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-openbsd-x64@7.0.2

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-openbsd-x64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @typescript/typescript-sunos-x64 under unrecognized license

License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt)

From: pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-sunos-x64@7.0.2

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-sunos-x64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @typescript/typescript-win32-arm64 under unrecognized license

License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt)

From: pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-win32-arm64@7.0.2

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-win32-arm64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @typescript/typescript-win32-x64 under unrecognized license

License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt)

From: pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-win32-x64@7.0.2

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-win32-x64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm jsdom is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package.json → npm/jsdom@30.0.1

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/jsdom@30.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm rollup under unrecognized license

License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/LICENSE.md)

From: pnpm-lock.yaml → npm/vitest@4.1.8 → npm/@vitejs/plugin-react@6.0.5 → npm/rollup@4.62.4

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/rollup@4.62.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm typescript under unrecognized license

License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt)

From: package.json → npm/typescript@7.0.2

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/typescript@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@ralyodio ralyodio mentioned this pull request Aug 18, 2026
Merged
@ralyodio

ralyodio commented Aug 18, 2026

Copy link
Copy Markdown
Contributor

@dependabot rebase

@dependabot
deps(deps): bump the major group across 1 directory with 14 updates
8e7ee9a 
Bumps the major group with 14 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@alpacahq/alpaca-trade-api](https://github.com/alpacahq/alpaca-trade-api-js) | `3.1.3` | `4.0.1` |
| [framer-motion](https://github.com/motiondivision/motion) | `12.38.0` | `13.1.0` |
| [ioredis](https://github.com/redis/ioredis) | `5.10.1` | `6.0.0` |
| [openai](https://github.com/openai/openai-node) | `6.36.0` | `7.4.0` |
| [puppeteer](https://github.com/puppeteer/puppeteer) | `24.42.0` | `25.7.0` |
| [undici](https://github.com/nodejs/undici) | `7.25.0` | `8.10.0` |
| [webtorrent](https://github.com/webtorrent/webtorrent) | `2.8.5` | `3.0.21` |
| [@testing-library/jest-dom](https://github.com/testing-library/jest-dom) | `6.9.1` | `7.0.1` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.6.0` | `26.2.0` |
| [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `5.1.4` | `6.0.5` |
| [eslint](https://github.com/eslint/eslint) | `9.39.2` | `10.8.1` |
| [jsdom](https://github.com/jsdom/jsdom) | `29.1.1` | `30.0.1` |
| [@types/jsdom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/jsdom) | `28.0.0` | `30.0.0` |
| [typescript](https://github.com/microsoft/TypeScript) | `5.9.3` | `7.0.2` |



Updates `@alpacahq/alpaca-trade-api` from 3.1.3 to 4.0.1
- [Release notes](https://github.com/alpacahq/alpaca-trade-api-js/releases)
- [Changelog](https://github.com/alpacahq/alpaca-trade-api-js/blob/master/CHANGELOG.md)
- [Commits](alpacahq/alpaca-trade-api-js@v3.1.3...v4.0.1)

Updates `framer-motion` from 12.38.0 to 13.1.0
- [Changelog](https://github.com/motiondivision/motion/blob/main/CHANGELOG.md)
- [Commits](motiondivision/motion@v12.38.0...v13.1.0)

Updates `ioredis` from 5.10.1 to 6.0.0
- [Release notes](https://github.com/redis/ioredis/releases)
- [Changelog](https://github.com/redis/ioredis/blob/main/CHANGELOG.md)
- [Commits](redis/ioredis@v5.10.1...v6.0.0)

Updates `openai` from 6.36.0 to 7.4.0
- [Release notes](https://github.com/openai/openai-node/releases)
- [Changelog](https://github.com/openai/openai-node/blob/main/CHANGELOG.md)
- [Commits](openai/openai-node@v6.36.0...v7.4.0)

Updates `puppeteer` from 24.42.0 to 25.7.0
- [Release notes](https://github.com/puppeteer/puppeteer/releases)
- [Changelog](https://github.com/puppeteer/puppeteer/blob/main/CHANGELOG.md)
- [Commits](puppeteer/puppeteer@puppeteer-v24.42.0...puppeteer-v25.7.0)

Updates `undici` from 7.25.0 to 8.10.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.25.0...v8.10.0)

Updates `webtorrent` from 2.8.5 to 3.0.21
- [Release notes](https://github.com/webtorrent/webtorrent/releases)
- [Changelog](https://github.com/webtorrent/webtorrent/blob/master/CHANGELOG.md)
- [Commits](webtorrent/webtorrent@v2.8.5...v3.0.21)

Updates `@testing-library/jest-dom` from 6.9.1 to 7.0.1
- [Release notes](https://github.com/testing-library/jest-dom/releases)
- [Changelog](https://github.com/testing-library/jest-dom/blob/main/CHANGELOG.md)
- [Commits](testing-library/jest-dom@v6.9.1...v7.0.1)

Updates `@types/node` from 25.6.0 to 26.2.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@vitejs/plugin-react` from 5.1.4 to 6.0.5
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.0.5/packages/plugin-react)

Updates `eslint` from 9.39.2 to 10.8.1
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v9.39.2...v10.8.1)

Updates `jsdom` from 29.1.1 to 30.0.1
- [Release notes](https://github.com/jsdom/jsdom/releases)
- [Commits](jsdom/jsdom@v29.1.1...v30.0.1)

Updates `@types/jsdom` from 28.0.0 to 30.0.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/jsdom)

Updates `typescript` from 5.9.3 to 7.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](https://github.com/microsoft/TypeScript/commits)

---
updated-dependencies:
- dependency-name: "@alpacahq/alpaca-trade-api"
  dependency-version: 4.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: major
- dependency-name: "@testing-library/jest-dom"
  dependency-version: 7.0.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: major
- dependency-name: "@types/jsdom"
  dependency-version: 30.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: major
- dependency-name: "@types/node"
  dependency-version: 26.2.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: major
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.0.5
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: major
- dependency-name: eslint
  dependency-version: 10.8.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: major
- dependency-name: framer-motion
  dependency-version: 13.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: major
- dependency-name: ioredis
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: major
- dependency-name: jsdom
  dependency-version: 30.0.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: major
- dependency-name: openai
  dependency-version: 7.4.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: major
- dependency-name: puppeteer
  dependency-version: 25.7.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: major
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: major
- dependency-name: undici
  dependency-version: 8.10.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: major
- dependency-name: webtorrent
  dependency-version: 3.0.21
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title deps(deps): bump the major group with 14 updates deps(deps): bump the major group across 1 directory with 14 updates Aug 18, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/major-bc1a4a0a20 branch from e41140f to 8e7ee9a Compare August 18, 2026 09:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ralyodio