chore(deps): (deps): bump the production group across 1 directory with 8 updates by dependabot[bot] · Pull Request #969 · tidev/titanium-cli

dependabot · 2026-08-06T14:55:05Z

Bumps the production group with 5 updates in the / directory:

Package	From	To
chalk	`5.6.2`	`6.0.0`
execa	`9.6.1`	`10.0.1`
fs-extra	`11.3.6`	`11.4.0`
pretty-bytes	`7.1.0`	`7.1.1`
undici	`8.5.0`	`8.9.0`

Updates chalk from 5.6.2 to 6.0.0

Release notes

Sourced from chalk's releases.

v6.0.0

Breaking

Require Node.js 22 8a94e0e

Improvements

Add underline styles and underline colors (#689) 4c304dd

Improve performance 5729845 fa5cff2

Fixes

Treat a numeric FORCE_COLOR as an exact level (#688) e912931

Downsample ansi256() and bgAnsi256() to 16 colors at level 1 (#687) ff549c5

chalk/chalk@v5.6.2...v6.0.0

Commits

661317e 6.0.0
5729845 Improve performance
4c304dd Add extended underline styles and underline colors (#689)
e912931 Fix: Treat a numeric FORCE_COLOR as an exact level (#688)
8a94e0e Require Node.js 22
fa5cff2 Optimize 2-argument calls (#670)
ff549c5 Fix: Downsample ansi256() and bgAnsi256() to 16 colors at level 1 (#687)
678e550 Tweaks
aa06bb5 Fix typos (#664)
See full diff in compare view

Updates execa from 9.6.1 to 10.0.1

Release notes

Sourced from execa's releases.

v10.0.1

Fix preferLocal argument escaping edge-case on Windows (#1259) e771733

sindresorhus/execa@v10.0.0...v10.0.1

v10.0.0

Breaking

Require Node.js 22. (#1243) 04b4454

The subprocess is now a normal promise, instead of a ChildProcess instance augmented with promise methods. All the methods and properties documented by Execa are unchanged. Node.js-specific ChildProcess APIs (such as .on(), .send(), .ref() and .unref()) must now be accessed through the new subprocess.nodeChildProcess property. (#1255) ade74bf
const subprocess = execa('node', ['file.js']);
- subprocess.on('spawn', onSpawn);
+ subprocess.nodeChildProcess.on('spawn', onSpawn);
Removed execaCommand() and execaCommandSync(). Use the template string syntax instead, which splits on spaces. If the command is a dynamic string, split it with https://github.com/sindresorhus/execa/blob/HEAD[https://github.com/sindresorhus/execa/blob/HEAD`https://github.com/sindresorhus/execa/blob/HEADphttps://github.com/sindresorhus/execa/blob/HEADahttps://github.com/sindresorhus/execa/blob/HEADrhttps://github.com/sindresorhus/execa/blob/HEADshttps://github.com/sindresorhus/execa/blob/HEADehttps://github.com/sindresorhus/execa/blob/HEADChttps://github.com/sindresorhus/execa/blob/HEADohttps://github.com/sindresorhus/execa/blob/HEADmhttps://github.com/sindresorhus/execa/blob/HEADmhttps://github.com/sindresorhus/execa/blob/HEADahttps://github.com/sindresorhus/execa/blob/HEADnhttps://github.com/sindresorhus/execa/blob/HEADdhttps://github.com/sindresorhus/execa/blob/HEADShttps://github.com/sindresorhus/execa/blob/HEADthttps://github.com/sindresorhus/execa/blob/HEADrhttps://github.com/sindresorhus/execa/blob/HEADihttps://github.com/sindresorhus/execa/blob/HEADnhttps://github.com/sindresorhus/execa/blob/HEADghttps://github.com/sindresorhus/execa/blob/HEAD(https://github.com/sindresorhus/execa/blob/HEAD)https://github.com/sindresorhus/execa/blob/HEAD`https://github.com/sindresorhus/execa/blob/HEAD]https://github.com/sindresorhus/execa/blob/HEAD(https://github.com/sindresorhus/execa/blob/HEADdhttps://github.com/sindresorhus/execa/blob/HEADohttps://github.com/sindresorhus/execa/blob/HEADchttps://github.com/sindresorhus/execa/blob/HEADshttps://github.com/sindresorhus/execa/blob/HEAD/https://github.com/sindresorhus/execa/blob/HEADahttps://github.com/sindresorhus/execa/blob/HEADphttps://github.com/sindresorhus/execa/blob/HEADihttps://github.com/sindresorhus/execa/blob/HEAD.https://github.com/sindresorhus/execa/blob/HEADmhttps://github.com/sindresorhus/execa/blob/HEADdhttps://github.com/sindresorhus/execa/blob/HEAD#https://github.com/sindresorhus/execa/blob/HEADphttps://github.com/sindresorhus/execa/blob/HEADahttps://github.com/sindresorhus/execa/blob/HEADrhttps://github.com/sindresorhus/execa/blob/HEADshttps://github.com/sindresorhus/execa/blob/HEADehttps://github.com/sindresorhus/execa/blob/HEADchttps://github.com/sindresorhus/execa/blob/HEADohttps://github.com/sindresorhus/execa/blob/HEADmhttps://github.com/sindresorhus/execa/blob/HEADmhttps://github.com/sindresorhus/execa/blob/HEADahttps://github.com/sindresorhus/execa/blob/HEADnhttps://github.com/sindresorhus/execa/blob/HEADdhttps://github.com/sindresorhus/execa/blob/HEADshttps://github.com/sindresorhus/execa/blob/HEADthttps://github.com/sindresorhus/execa/blob/HEADrhttps://github.com/sindresorhus/execa/blob/HEADihttps://github.com/sindresorhus/execa/blob/HEADnhttps://github.com/sindresorhus/execa/blob/HEADghttps://github.com/sindresorhus/execa/blob/HEADchttps://github.com/sindresorhus/execa/blob/HEADohttps://github.com/sindresorhus/execa/blob/HEADmhttps://github.com/sindresorhus/execa/blob/HEADmhttps://github.com/sindresorhus/execa/blob/HEADahttps://github.com/sindresorhus/execa/blob/HEADnhttps://github.com/sindresorhus/execa/blob/HEADdhttps://github.com/sindresorhus/execa/blob/HEAD)https://github.com/sindresorhus/execa/blob/HEAD. (#1244) 3ced394
- await execaCommand('npm run build');
+ await execa`npm run build`;

await execaCommand(commandString);


await execa${parseCommandString(commandString)};
Removed the old undocumented stdio: [..., 'ipc'] syntax. Use the ipc: true option instead. (#1245) dcf611c
- await execa('node', ['file.js'], {stdio: ['pipe', 'pipe', 'pipe', 'ipc']});
+ await execa('node', ['file.js'], {ipc: true});
When the input or inputFile option is combined with an inherited stdin (for example stdio: 'inherit'), the explicit input is now used, instead of being ignored. To combine multiple inputs, pass an array like stdin: ['inherit', {string: 'input'}]. (#1232) 3ed0544

Improvements

Terminate the subprocess' descendant processes by using the killDescendants option. This is useful when the subprocess spawns its own processes, such as when using the shell option. (#1256) 84fa0ec
await execa('npm', ['run', 'build'], {killDescendants: true, timeout: 5000});
Convert the subprocess to a web stream by using https://github.com/sindresorhus/execa/blob/HEAD[https://github.com/sindresorhus/execa/blob/HEAD`https://github.com/sindresorhus/execa/blob/HEADshttps://github.com/sindresorhus/execa/blob/HEADuhttps://github.com/sindresorhus/execa/blob/HEADbhttps://github.com/sindresorhus/execa/blob/HEADphttps://github.com/sindresorhus/execa/blob/HEADrhttps://github.com/sindresorhus/execa/blob/HEADohttps://github.com/sindresorhus/execa/blob/HEADchttps://github.com/sindresorhus/execa/blob/HEADehttps://github.com/sindresorhus/execa/blob/HEADshttps://github.com/sindresorhus/execa/blob/HEADshttps://github.com/sindresorhus/execa/blob/HEAD.https://github.com/sindresorhus/execa/blob/HEADrhttps://github.com/sindresorhus/execa/blob/HEADehttps://github.com/sindresorhus/execa/blob/HEADahttps://github.com/sindresorhus/execa/blob/HEADdhttps://github.com/sindresorhus/execa/blob/HEADahttps://github.com/sindresorhus/execa/blob/HEADbhttps://github.com/sindresorhus/execa/blob/HEADlhttps://github.com/sindresorhus/execa/blob/HEADehttps://github.com/sindresorhus/execa/blob/HEADShttps://github.com/sindresorhus/execa/blob/HEADthttps://github.com/sindresorhus/execa/blob/HEADrhttps://github.com/sindresorhus/execa/blob/HEADehttps://github.com/sindresorhus/execa/blob/HEADahttps://github.com/sindresorhus/execa/blob/HEADmhttps://github.com/sindresorhus/execa/blob/HEAD(https://github.com/sindresorhus/execa/blob/HEAD)https://github.com/sindresorhus/execa/blob/HEAD`https://github.com/sindresorhus/execa/blob/HEAD]https://github.com/sindresorhus/execa/blob/HEAD(https://github.com/sindresorhus/execa/blob/HEADdhttps://github.com/sindresorhus/execa/blob/HEADohttps://github.com/sindresorhus/execa/blob/HEADchttps://github.com/sindresorhus/execa/blob/HEADshttps://github.com/sindresorhus/execa/blob/HEAD/https://github.com/sindresorhus/execa/blob/HEADahttps://github.com/sindresorhus/execa/blob/HEADphttps://github.com/sindresorhus/execa/blob/HEADihttps://github.com/sindresorhus/execa/blob/HEAD.https://github.com/sindresorhus/execa/blob/HEADmhttps://github.com/sindresorhus/execa/blob/HEADdhttps://github.com/sindresorhus/execa/blob/HEAD#https://github.com/sindresorhus/execa/blob/HEADshttps://github.com/sindresorhus/execa/blob/HEADuhttps://github.com/sindresorhus/execa/blob/HEADbhttps://github.com/sindresorhus/execa/blob/HEADphttps://github.com/sindresorhus/execa/blob/HEADrhttps://github.com/sindresorhus/execa/blob/HEADohttps://github.com/sindresorhus/execa/blob/HEADchttps://github.com/sindresorhus/execa/blob/HEADehttps://github.com/sindresorhus/execa/blob/HEADshttps://github.com/sindresorhus/execa/blob/HEADshttps://github.com/sindresorhus/execa/blob/HEADrhttps://github.com/sindresorhus/execa/blob/HEADehttps://github.com/sindresorhus/execa/blob/HEADahttps://github.com/sindresorhus/execa/blob/HEADdhttps://github.com/sindresorhus/execa/blob/HEADahttps://github.com/sindresorhus/execa/blob/HEADbhttps://github.com/sindresorhus/execa/blob/HEADlhttps://github.com/sindresorhus/execa/blob/HEADehttps://github.com/sindresorhus/execa/blob/HEADshttps://github.com/sindresorhus/execa/blob/HEADthttps://github.com/sindresorhus/execa/blob/HEADrhttps://github.com/sindresorhus/execa/blob/HEADehttps://github.com/sindresorhus/execa/blob/HEADahttps://github.com/sindresorhus/execa/blob/HEADmhttps://github.com/sindresorhus/execa/blob/HEADrhttps://github.com/sindresorhus/execa/blob/HEADehttps://github.com/sindresorhus/execa/blob/HEADahttps://github.com/sindresorhus/execa/blob/HEADdhttps://github.com/sindresorhus/execa/blob/HEADahttps://github.com/sindresorhus/execa/blob/HEADbhttps://github.com/sindresorhus/execa/blob/HEADlhttps://github.com/sindresorhus/execa/blob/HEADehttps://github.com/sindresorhus/execa/blob/HEADohttps://github.com/sindresorhus/execa/blob/HEADphttps://github.com/sindresorhus/execa/blob/HEADthttps://github.com/sindresorhus/execa/blob/HEADihttps://github.com/sindresorhus/execa/blob/HEADohttps://github.com/sindresorhus/execa/blob/HEADnhttps://github.com/sindresorhus/execa/blob/HEADshttps://github.com/sindresorhus/execa/blob/HEAD)https://github.com/sindresorhus/execa/blob/HEAD, https://github.com/sindresorhus/execa/blob/HEAD[https://github.com/sindresorhus/execa/blob/HEAD`https://github.com/sindresorhus/execa/blob/HEADshttps://github.com/sindresorhus/execa/blob/HEADuhttps://github.com/sindresorhus/execa/blob/HEADbhttps://github.com/sindresorhus/execa/blob/HEADphttps://github.com/sindresorhus/execa/blob/HEADrhttps://github.com/sindresorhus/execa/blob/HEADohttps://github.com/sindresorhus/execa/blob/HEADchttps://github.com/sindresorhus/execa/blob/HEADehttps://github.com/sindresorhus/execa/blob/HEADshttps://github.com/sindresorhus/execa/blob/HEADshttps://github.com/sindresorhus/execa/blob/HEAD.https://github.com/sindresorhus/execa/blob/HEADwhttps://github.com/sindresorhus/execa/blob/HEADrhttps://github.com/sindresorhus/execa/blob/HEADihttps://github.com/sindresorhus/execa/blob/HEADthttps://github.com/sindresorhus/execa/blob/HEADahttps://github.com/sindresorhus/execa/blob/HEADbhttps://github.com/sindresorhus/execa/blob/HEADlhttps://github.com/sindresorhus/execa/blob/HEADehttps://github.com/sindresorhus/execa/blob/HEADShttps://github.com/sindresorhus/execa/blob/HEADthttps://github.com/sindresorhus/execa/blob/HEADrhttps://github.com/sindresorhus/execa/blob/HEADehttps://github.com/sindresorhus/execa/blob/HEADahttps://github.com/sindresorhus/execa/blob/HEADmhttps://github.com/sindresorhus/execa/blob/HEAD(https://github.com/sindresorhus/execa/blob/HEAD)https://github.com/sindresorhus/execa/blob/HEAD`https://github.com/sindresorhus/execa/blob/HEAD]https://github.com/sindresorhus/execa/blob/HEAD(https://github.com/sindresorhus/execa/blob/HEADdhttps://github.com/sindresorhus/execa/blob/HEADohttps://github.com/sindresorhus/execa/blob/HEADchttps://github.com/sindresorhus/execa/blob/HEADshttps://github.com/sindresorhus/execa/blob/HEAD/https://github.com/sindresorhus/execa/blob/HEADahttps://github.com/sindresorhus/execa/blob/HEADphttps://github.com/sindresorhus/execa/blob/HEADihttps://github.com/sindresorhus/execa/blob/HEAD.https://github.com/sindresorhus/execa/blob/HEADmhttps://github.com/sindresorhus/execa/blob/HEADdhttps://github.com/sindresorhus/execa/blob/HEAD#https://github.com/sindresorhus/execa/blob/HEADshttps://github.com/sindresorhus/execa/blob/HEADuhttps://github.com/sindresorhus/execa/blob/HEADbhttps://github.com/sindresorhus/execa/blob/HEADphttps://github.com/sindresorhus/execa/blob/HEADrhttps://github.com/sindresorhus/execa/blob/HEADohttps://github.com/sindresorhus/execa/blob/HEADchttps://github.com/sindresorhus/execa/blob/HEADehttps://github.com/sindresorhus/execa/blob/HEADshttps://github.com/sindresorhus/execa/blob/HEADshttps://github.com/sindresorhus/execa/blob/HEADwhttps://github.com/sindresorhus/execa/blob/HEADrhttps://github.com/sindresorhus/execa/blob/HEADihttps://github.com/sindresorhus/execa/blob/HEADthttps://github.com/sindresorhus/execa/blob/HEADahttps://github.com/sindresorhus/execa/blob/HEADbhttps://github.com/sindresorhus/execa/blob/HEADlhttps://github.com/sindresorhus/execa/blob/HEADehttps://github.com/sindresorhus/execa/blob/HEADshttps://github.com/sindresorhus/execa/blob/HEADthttps://github.com/sindresorhus/execa/blob/HEADrhttps://github.com/sindresorhus/execa/blob/HEADehttps://github.com/sindresorhus/execa/blob/HEADahttps://github.com/sindresorhus/execa/blob/HEADmhttps://github.com/sindresorhus/execa/blob/HEADwhttps://github.com/sindresorhus/execa/blob/HEADrhttps://github.com/sindresorhus/execa/blob/HEADihttps://github.com/sindresorhus/execa/blob/HEADthttps://github.com/sindresorhus/execa/blob/HEADahttps://github.com/sindresorhus/execa/blob/HEADbhttps://github.com/sindresorhus/execa/blob/HEADlhttps://github.com/sindresorhus/execa/blob/HEADehttps://github.com/sindresorhus/execa/blob/HEADohttps://github.com/sindresorhus/execa/blob/HEADphttps://github.com/sindresorhus/execa/blob/HEADthttps://github.com/sindresorhus/execa/blob/HEADihttps://github.com/sindresorhus/execa/blob/HEADohttps://github.com/sindresorhus/execa/blob/HEADnhttps://github.com/sindresorhus/execa/blob/HEADshttps://github.com/sindresorhus/execa/blob/HEAD)https://github.com/sindresorhus/execa/blob/HEAD or https://github.com/sindresorhus/execa/blob/HEAD[https://github.com/sindresorhus/execa/blob/HEAD`https://github.com/sindresorhus/execa/blob/HEADshttps://github.com/sindresorhus/execa/blob/HEADuhttps://github.com/sindresorhus/execa/blob/HEADbhttps://github.com/sindresorhus/execa/blob/HEADphttps://github.com/sindresorhus/execa/blob/HEADrhttps://github.com/sindresorhus/execa/blob/HEADohttps://github.com/sindresorhus/execa/blob/HEADchttps://github.com/sindresorhus/execa/blob/HEADehttps://github.com/sindresorhus/execa/blob/HEADshttps://github.com/sindresorhus/execa/blob/HEADshttps://github.com/sindresorhus/execa/blob/HEAD.https://github.com/sindresorhus/execa/blob/HEADthttps://github.com/sindresorhus/execa/blob/HEADrhttps://github.com/sindresorhus/execa/blob/HEADahttps://github.com/sindresorhus/execa/blob/HEADnhttps://github.com/sindresorhus/execa/blob/HEADshttps://github.com/sindresorhus/execa/blob/HEADfhttps://github.com/sindresorhus/execa/blob/HEADohttps://github.com/sindresorhus/execa/blob/HEADrhttps://github.com/sindresorhus/execa/blob/HEADmhttps://github.com/sindresorhus/execa/blob/HEADShttps://github.com/sindresorhus/execa/blob/HEADthttps://github.com/sindresorhus/execa/blob/HEADrhttps://github.com/sindresorhus/execa/blob/HEADehttps://github.com/sindresorhus/execa/blob/HEADahttps://github.com/sindresorhus/execa/blob/HEADmhttps://github.com/sindresorhus/execa/blob/HEAD(https://github.com/sindresorhus/execa/blob/HEAD)https://github.com/sindresorhus/execa/blob/HEAD`https://github.com/sindresorhus/execa/blob/HEAD]https://github.com/sindresorhus/execa/blob/HEAD(https://github.com/sindresorhus/execa/blob/HEADdhttps://github.com/sindresorhus/execa/blob/HEADohttps://github.com/sindresorhus/execa/blob/HEADchttps://github.com/sindresorhus/execa/blob/HEADshttps://github.com/sindresorhus/execa/blob/HEAD/https://github.com/sindresorhus/execa/blob/HEADahttps://github.com/sindresorhus/execa/blob/HEADphttps://github.com/sindresorhus/execa/blob/HEADihttps://github.com/sindresorhus/execa/blob/HEAD.https://github.com/sindresorhus/execa/blob/HEADmhttps://github.com/sindresorhus/execa/blob/HEADdhttps://github.com/sindresorhus/execa/blob/HEAD#https://github.com/sindresorhus/execa/blob/HEADshttps://github.com/sindresorhus/execa/blob/HEADuhttps://github.com/sindresorhus/execa/blob/HEADbhttps://github.com/sindresorhus/execa/blob/HEADphttps://github.com/sindresorhus/execa/blob/HEADrhttps://github.com/sindresorhus/execa/blob/HEADohttps://github.com/sindresorhus/execa/blob/HEADchttps://github.com/sindresorhus/execa/blob/HEADehttps://github.com/sindresorhus/execa/blob/HEADshttps://github.com/sindresorhus/execa/blob/HEADshttps://github.com/sindresorhus/execa/blob/HEADthttps://github.com/sindresorhus/execa/blob/HEADrhttps://github.com/sindresorhus/execa/blob/HEADahttps://github.com/sindresorhus/execa/blob/HEADnhttps://github.com/sindresorhus/execa/blob/HEADshttps://github.com/sindresorhus/execa/blob/HEADfhttps://github.com/sindresorhus/execa/blob/HEADohttps://github.com/sindresorhus/execa/blob/HEADrhttps://github.com/sindresorhus/execa/blob/HEADmhttps://github.com/sindresorhus/execa/blob/HEADshttps://github.com/sindresorhus/execa/blob/HEADthttps://github.com/sindresorhus/execa/blob/HEADrhttps://github.com/sindresorhus/execa/blob/HEADehttps://github.com/sindresorhus/execa/blob/HEADahttps://github.com/sindresorhus/execa/blob/HEADmhttps://github.com/sindresorhus/execa/blob/HEADdhttps://github.com/sindresorhus/execa/blob/HEADuhttps://github.com/sindresorhus/execa/blob/HEADphttps://github.com/sindresorhus/execa/blob/HEADlhttps://github.com/sindresorhus/execa/blob/HEADehttps://github.com/sindresorhus/execa/blob/HEADxhttps://github.com/sindresorhus/execa/blob/HEADohttps://github.com/sindresorhus/execa/blob/HEADphttps://github.com/sindresorhus/execa/blob/HEADthttps://github.com/sindresorhus/execa/blob/HEADihttps://github.com/sindresorhus/execa/blob/HEADohttps://github.com/sindresorhus/execa/blob/HEADnhttps://github.com/sindresorhus/execa/blob/HEADshttps://github.com/sindresorhus/execa/blob/HEAD)https://github.com/sindresorhus/execa/blob/HEAD. (#1254) 29d9cfc
</tr></table> 

... (truncated)

Commits

8017b27 10.0.1
e771733 Fix preferLocal argument escaping edge-case on Windows (#1259)
499fe80 Meta tweaks
e389369 10.0.0
3d9d820 Improve taskkill usage (#1258)
5944b2d Update dev dependencies (#1257)
84fa0ec Add killDescendants option to also terminate descendant processes (#1256)
ade74bf Add nodeChildProcess to subprocess promises and make the subprocess a norma...
29d9cfc Add .readableStream(), .writableStream() and .transformStream() methods...
522654a Fix flaky test
Additional commits viewable in compare view

Updates fs-extra from 11.3.6 to 11.4.0

Changelog

Sourced from fs-extra's changelog.

11.4.0 / 2026-07-23

Proper EEXIST error when trying to create a symlink and the dest already exists as a broken symlink (#925, #1076)

Commits

53a8d1a 11.4.0
9c2d3c9 Throw EEXIST when ensureSymlink dest is a broken symlink (#1076)
See full diff in compare view

Updates pretty-bytes from 7.1.0 to 7.1.1

Release notes

Sourced from pretty-bytes's releases.

v7.1.1

Fix numbers less than 1 having excessive precision af55eb9

sindresorhus/pretty-bytes@v7.1.0...v7.1.1

Commits

fd7eb38 7.1.1
af55eb9 Fix numbers less than 1 having excessive precision
See full diff in compare view

Updates undici from 8.5.0 to 8.9.0

Release notes

Sourced from undici's releases.

v8.9.0

⚠️ Security fixes

High severity

GHSA-4cwx-7wf7-3272: malformed qualified private Cache-Control directives could cause cross-user information disclosure in shared caches or a parse-time crash. The cache parser now treats empty qualified directives conservatively and safely handles mixed qualified and unqualified directives. Fixed by 4fe5bc5f with regression coverage in 9f09b49a.

Medium severity

GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 7d3cf924.

GHSA-jr45-8vmc-qm54: optional whitespace around = in qualified no-cache and private directives could bypass shared-cache restrictions and disclose authenticated data across users. Cache-Control parsing now normalizes these forms and applies conservative cache decisions. Fixed by c601fff1.

GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by e11a68ed, with corrected fixtures in 2b3f7493.

GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by 10d93fc3.

Additional hardening

Undici now validates non-string header values after coercion, including array elements, preventing crafted toString() or Symbol.toPrimitive implementations from introducing CRLF sequences. This defense-in-depth change was made in 354a151f.

What's Changed

fix(decompress): preserve response trailers by @Ram-blip in nodejs/undici#5572

build(deps-dev): bump ws from 8.21.0 to 8.21.1 by @dependabot[bot] in nodejs/undici#5576

fix: validate coerced header values for CRLF by @mcollina in nodejs/undici#5579

fix: handle frozen globalThis in setGlobalDispatcher by @mhayk in nodejs/undici#5574

Ignore auto-generated .npmrc on Windows by @tsctx in nodejs/undici#5583

New Contributors

@mhayk made their first contribution in nodejs/undici#5574

Full Changelog: nodejs/undici@v8.8.0...v8.9.0

v8.8.0

What's Changed

fetch: use ReadableStreamTee for cloning streams by @KhafraDev in nodejs/undici#5517

fix(benchmarks): adjust got after v15 upgrade by @slagiewka in nodejs/undici#5526

feat(mock): support asynchronous reply options callbacks by @Develop-KIM in nodejs/undici#5534

docs: clarify proxy threat model by @mcollina in nodejs/undici#5530

docs: clarify MockAgent pool usage by @vibhor-aggr in nodejs/undici#5542

docs: clarify parser timeout precision by @vibhor-aggr in nodejs/undici#5543

fix: handle flat alternating header arrays in cache normalizeHeaders by @mcollina in nodejs/undici#5536

chore(benchmarks): require(esm) on ESM-only packages by @slagiewka in nodejs/undici#5527

fix: run idle socket validation off setImmediate instead of setTimeout by @carlotestor in nodejs/undici#5499

docs: add custom interceptor example by @vibhor-aggr in nodejs/undici#5548

fix(h1): ignore type of service errors by @mcollina in nodejs/undici#5547

fix(fetch): convert null init in Response.json by @Ram-blip in nodejs/undici#5540

fix(redirect): remove body headers after POST-to-GET by @Ram-blip in nodejs/undici#5551

build(deps-dev): bump fast-check from 4.8.0 to 4.9.0 by @dependabot[bot] in nodejs/undici#5556

fix(h2): allow stream-bodied requests to multiplex on a busy session by @GiHoon1123 in nodejs/undici#5538

fix(h2): destroy aborted stream synchronously instead of via setImmediate by @staylor in nodejs/undici#5559

fix(decompress): skip HEAD responses by @Ram-blip in nodejs/undici#5564

ci: build undici with node.js v26 by @shivarm in nodejs/undici#5237

... (truncated)

Commits

21a8e1e Bumped v8.9.0 (#5589)
7d3cf92 fix: validate blob body content type
c601fff fix(cache): harden cache directive parsing
2b3f749 test(retry): correct broken content-range fixtures in retry-handler.js
e11a68e fix(retry): reject partial content length mismatch
9f09b49 test: cover crash on mixed unqualified and qualified private cache directives
4fe5bc5 fix: handle empty qualified private cache directive
10d93fc fix: harden cookie domain, path, and unparsed attribute validation
a17e301 Ignore auto-generated .npmrc on Windows (#5583)
a0922b0 fix: handle frozen globalThis in setGlobalDispatcher (#5574)
Additional commits viewable in compare view

Updates nanoid from 3.3.16 to 3.3.17

Release notes

Sourced from nanoid's releases.

3.3.17

Fixed infinite loop on zero size.

Changelog

Sourced from nanoid's changelog.

3.3.17

Fixed infinite loop on zero size.

Commits

73d6716 Release 3.3.17 version
f9d13f1 Sync 0 size behaviour with PostCSS 5
See full diff in compare view

Updates postcss from 8.5.25 to 8.5.26

Release notes

Sourced from postcss's releases.

8.5.26

Fixed list.split() regression (by @lazerg).

Track symlinks in path protection in source map loading (by @drengir1).

Changelog

Sourced from postcss's changelog.

8.5.26

Fixed list.split() regression (by @lazerg).

Track symlinks in path protection in source map loading (by @drengir1).

Commits

07b2577 Release 8.5.26 version
47de6b9 Update CI
1493a83 Fix Rule#selectors losing the empty selector (#2129)
180db16 Typo
29e9e00 Resolve symlinks before the previous-source-map containment check (#2125)
3ba8f84 Update dependencies
87e72f6 Update lock file
caaeeb9 Upgrade nanoid to fix infinite loop on zero size (#2124)
3609b6f Explain how to type plugin options
fbad419 docs: show ESM and TypeScript plugin declaration (#2118)
See full diff in compare view

Updates yoctocolors from 2.1.2 to 2.2.0

Release notes

Sourced from yoctocolors's releases.

v2.2.0

Add extended underline styles and underline colors a613227

sindresorhus/yoctocolors@v2.1.2...v2.2.0

Commits

a02a16e 2.2.0
a613227 Add extended underline styles and underline colors
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…h 8 updates Bumps the production group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [chalk](https://github.com/chalk/chalk) | `5.6.2` | `6.0.0` | | [execa](https://github.com/sindresorhus/execa) | `9.6.1` | `10.0.1` | | [fs-extra](https://github.com/jprichardson/node-fs-extra) | `11.3.6` | `11.4.0` | | [pretty-bytes](https://github.com/sindresorhus/pretty-bytes) | `7.1.0` | `7.1.1` | | [undici](https://github.com/nodejs/undici) | `8.5.0` | `8.9.0` | Updates `chalk` from 5.6.2 to 6.0.0 - [Release notes](https://github.com/chalk/chalk/releases) - [Commits](chalk/chalk@v5.6.2...v6.0.0) Updates `execa` from 9.6.1 to 10.0.1 - [Release notes](https://github.com/sindresorhus/execa/releases) - [Commits](sindresorhus/execa@v9.6.1...v10.0.1) Updates `fs-extra` from 11.3.6 to 11.4.0 - [Changelog](https://github.com/jprichardson/node-fs-extra/blob/master/CHANGELOG.md) - [Commits](jprichardson/node-fs-extra@11.3.6...11.4.0) Updates `pretty-bytes` from 7.1.0 to 7.1.1 - [Release notes](https://github.com/sindresorhus/pretty-bytes/releases) - [Commits](sindresorhus/pretty-bytes@v7.1.0...v7.1.1) Updates `undici` from 8.5.0 to 8.9.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v8.5.0...v8.9.0) Updates `nanoid` from 3.3.16 to 3.3.17 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](ai/nanoid@3.3.16...3.3.17) Updates `postcss` from 8.5.25 to 8.5.26 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.25...8.5.26) Updates `yoctocolors` from 2.1.2 to 2.2.0 - [Release notes](https://github.com/sindresorhus/yoctocolors/releases) - [Commits](sindresorhus/yoctocolors@v2.1.2...v2.2.0) --- updated-dependencies: - dependency-name: chalk dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production - dependency-name: execa dependency-version: 10.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production - dependency-name: fs-extra dependency-version: 11.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: pretty-bytes dependency-version: 7.1.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production - dependency-name: undici dependency-version: 8.9.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: nanoid dependency-version: 3.3.17 dependency-type: indirect update-type: version-update:semver-patch dependency-group: production - dependency-name: postcss dependency-version: 8.5.26 dependency-type: indirect update-type: version-update:semver-patch dependency-group: production - dependency-name: yoctocolors dependency-version: 2.2.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: production ... Signed-off-by: dependabot[bot] <support@github.com>

socket-security · 2026-08-06T14:55:47Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	chalk@5.6.2 ⏵ 6.0.0			⁺¹
	pretty-bytes@7.1.1
	execa@9.6.1 ⏵ 10.0.1			⁺¹
	fs-extra@11.4.0
	undici@8.9.0

View full report

dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 6, 2026

Navigation Menu

Uh oh!

Uh oh!

chore(deps): (deps): bump the production group across 1 directory with 8 updates - #969

chore(deps): (deps): bump the production group across 1 directory with 8 updates#969
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-7735d0a7a5

dependabot Bot commented on behalf of github Aug 6, 2026

Uh oh!

socket-security Bot commented Aug 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 6, 2026

v6.0.0

Breaking

Improvements

Fixes

v10.0.1

v10.0.0

Breaking

Improvements

11.4.0 / 2026-07-23

v7.1.1

v8.9.0

⚠️ Security fixes

High severity

Medium severity

Additional hardening

What's Changed

New Contributors

v8.8.0

What's Changed

3.3.17

3.3.17

8.5.26

8.5.26

v2.2.0

Uh oh!

socket-security Bot commented Aug 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants