Skip to content

Bump the npm-minor-and-patch group across 1 directory with 8 updates - #17

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/main/npm-minor-and-patch-7d128e609c
Open

Bump the npm-minor-and-patch group across 1 directory with 8 updates#17
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/main/npm-minor-and-patch-7d128e609c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 26, 2026

Copy link
Copy Markdown

Bumps the npm-minor-and-patch group with 8 updates in the / directory:

Package From To
lucide-react 1.45.0 1.47.0
multer 2.3.0 2.4.0
openai 7.15.0 7.22.0
tsx 4.23.13 4.23.15
zod 4.6.2 4.6.5
@playwright/cli 0.1.19 0.1.21
@tauri-apps/cli 2.11.4 2.11.5
@types/node 26.5.1 26.6.2

Updates lucide-react from 1.45.0 to 1.47.0

Release notes

Sourced from lucide-react's releases.

Version 1.47.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.46.0...1.47.0

Version 1.46.0

What's Changed

Full Changelog: lucide-icons/lucide@1.45.0...1.46.0

Commits

Updates multer from 2.3.0 to 2.4.0

Release notes

Sourced from multer's releases.

v2.4.0

Highlights

multer finally supports Google Cloud Functions and Firebase 🎉

These platforms read the request body before your code runs, so multer's classic req.pipe(busboy) received nothing: empty req.body, empty req.files, and nearly a decade of duplicated issues.

The new streamHandler option closes that gap: you decide how the body reaches the parser, so the pre-read rawBody just works (see image).

const multer = require('multer')
const upload = multer({
storage: multer.memoryStorage(),
streamHandler: (req, busboy) => {
// Cloud Functions / Firebase expose the pre-read body here
if (req.rawBody) busboy.end(req.rawBody)
else req.pipe(busboy)
}
})
app.post('/upload', upload.single('file'), (req, res) => {
res.json({ name: req.file.originalname, size: req.file.size })
})

This landed thanks to community PRs going back to 2017; their authors are credited as co-authors in the release.

Important: Security

What's Changed

... (truncated)

Changelog

Sourced from multer's changelog.

2.4.0

  • Fix CVE-2026-88932 (GHSA-3pph-fpjx-jg34)
  • Add filename to LIMIT_FILE_SIZE and LIMIT_UNEXPECTED_FILE errors (#1416)
  • Accept a function for limits, called with the request, to set limits per request (#1133)
  • Add opt-in flush option to DiskStorage to fsync files before the callback runs (#1458)
  • Expose busboy's defCharset, highWaterMark and fileHwm options (#1465)
  • Add streamHandler option to feed busboy from pre-consumed bodies (Google Cloud Functions, Firebase) (#1466)
  • Allow multer.diskStorage() to be called without options (#1471)
  • Decode WHATWG-escaped characters (%0A, %0D, %22) in field names, matching file.originalname since 2.3.0: req.body keys, file.fieldname and err.field now carry the real name. If you matched the escaped spelling as a workaround, use the real name now (#1473)
  • Report the decoded filename in err.filename on LIMIT_FILE_SIZE errors, matching file.originalname (#1478)
  • Reject non-integer or negative limits values at construction time; a float limit silently disabled the check (#1395, #1335)
  • Accept requests with exactly limits.parts parts; LIMIT_PART_COUNT now fires only when the limit is exceeded. If you set parts one higher to work around this, you can drop the extra one (#1446)
  • Files skipped by fileFilter no longer count towards maxCount (#1426)
  • Change the LIMIT_UNEXPECTED_FILE message to "Unexpected file field" (#426)
  • Remove the concat-stream dependency (#1356)
  • Docs: add JSDoc to the public API and document the storage engine stream contract (#1467, #1468)
  • Docs: add FormData upload examples (#896)
  • Docs: remove the translated READMEs (#1463)
  • Internal: run the test suite on macOS (#1464)
Commits
  • 35979e5 2.4.0 (#1469)
  • b888532 chore(deps): bump github/codeql-action/upload-sarif to 4.37.9 (#1474)
  • e6bcd7d chore(deps): bump github/codeql-action/analyze from 4.37.4 to 4.37.9 (#1475)
  • 00dec43 chore(deps): bump github/codeql-action/init from 4.37.4 to 4.37.9 (#1476)
  • 8d5c3b7 feat: allow diskStorage without options (#1471)
  • 02f6e82 fix: report the decoded filename on LIMIT_FILE_SIZE (#1478)
  • bc3f72d fix: decode escaped field names, not just filenames (#1473)
  • 2661325 docs: add JSDoc to the public API (#1467)
  • 53337f9 fix: remove late-completing uploads aborted before the engine names them
  • 7f2c9ab feat: add streamHandler option to feed busboy from pre-consumed bodies (#1466)
  • Additional commits viewable in compare view

Updates openai from 7.15.0 to 7.22.0

Release notes

Sourced from openai's releases.

v7.22.0

7.22.0 (2026-09-22)

Features

  • api: add GPT-6 Sol and Luna model identifiers (#2790) (cff2135)

v7.21.0

7.21.0 (2026-09-22)

Features

  • api: add session environment reset events (#2777) (5de2360)

Bug Fixes

  • api: preserve model choices and improve request handling (#2787) (a4a4396)

Chores

  • api: document response management resources (#2775) (0472fb3)

v7.20.0

7.20.0 (2026-09-19)

Features

  • api: add environment-variable vault credentials (#2768) (fbccf12)
  • api: add external storage configuration management (#2773) (7e89b62)
  • api: add safety case retrieval (#2774) (d357e64)
  • api: add safety warning and deactivation webhook events (#2772) (91c7fb5)
  • api: add SIP media security to incoming call events (#2770) (db9a57b)

Bug Fixes

  • api: Preserve request options in legacy GET calls (#2771) (541eee3)

v7.19.0

7.19.0 (2026-09-18)

Features

... (truncated)

Changelog

Sourced from openai's changelog.

7.22.0 (2026-09-22)

Features

  • api: add GPT-6 Sol and Luna model identifiers (#2790) (cff2135)

7.21.0 (2026-09-22)

Features

  • api: add session environment reset events (#2777) (5de2360)

Bug Fixes

  • api: preserve model choices and improve request handling (#2787) (a4a4396)

Chores

  • api: document response management resources (#2775) (0472fb3)

7.20.0 (2026-09-19)

Features

  • api: add environment-variable vault credentials (#2768) (fbccf12)
  • api: add external storage configuration management (#2773) (7e89b62)
  • api: add safety case retrieval (#2774) (d357e64)
  • api: add safety warning and deactivation webhook events (#2772) (91c7fb5)
  • api: add SIP media security to incoming call events (#2770) (db9a57b)

Bug Fixes

  • api: Preserve request options in legacy GET calls (#2771) (541eee3)

7.19.0 (2026-09-18)

Features

Chores

... (truncated)

Commits

Updates tsx from 4.23.13 to 4.23.15

Release notes

Sourced from tsx's releases.

v4.23.15

4.23.15 (2026-09-20)

Bug Fixes

  • exclude bare builtins from namespace inheritance (38e1588)
  • expose require.cache and require.extensions to tsImport CommonJS modules (2da3407)
  • make namespaced register() overloads portable for declaration emit (562c434)

This release is also available on:

v4.23.14

4.23.14 (2026-09-20)

Bug Fixes

  • restore the CJS bridge namespace for Node 24 require(esm) under tsImport() (#802) (6e5236b)

This release is also available on:

Commits
  • ca66105 test: fix drive-less file URLs in ESM resolver fixtures
  • 2da3407 fix: expose require.cache and require.extensions to tsImport CommonJS modules
  • 38e1588 fix: exclude bare builtins from namespace inheritance
  • 562c434 fix: make namespaced register() overloads portable for declaration emit
  • edfb1f0 build: upgrade pkgroll and externalize CJS loader reference
  • 70e7828 test: upgrade tinyspy for disposable API
  • 9ed2022 ci: avoid duplicate release notifications
  • 872e77f refactor: use disposables for cleanup
  • 6e5236b fix: restore the CJS bridge namespace for Node 24 require(esm) under tsImport...
  • See full diff in compare view

Updates zod from 4.6.2 to 4.6.5

Release notes

Sourced from zod's releases.

v4.6.5

Commits:

  • d2b135cfb7a3582b9eb515756b9166bcb9521f4a docs: add the 4.6.x patch highlights to the 4.6 post
  • f1448f7cee00df9fe1e9ad84a000aa1828cc8bc1 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
  • de65a5cb39ed22a507fac935788f718fa88d104f docs: lead the properties section with the check and add a Zod Mini tab (#6598)
  • 56222cd1532c07bcb91b67df529cab4c0a215330 feat(instanceof): key the .properties() shape off the instance type (#6600)
  • ca0229a404818290e6cdcfefcd7eb2d04bcbb543 Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)"
  • cc4cd4ee9c52fcaa10964e48cc144541e41a5ed9 Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)""
  • 0f3f5ee3ca56c7574bf849e54f79e9a6e02562ee 4.6.5
  • 59bbc03e10c636b9eb3c393dfeb552819774ec21 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump

v4.6.4

A patch on top of 4.6.3.

  • d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)
  • ad32d751 perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#6588)
  • 2bb08717 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
  • f6e1701a chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)

v4.6.3

A patch on top of 4.6.2.

  • 413cce9a fix(v4): make z.properties() a check again (#6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged
  • 75d63ee1 docs: show only the .properties() method form in the 4.6 post
  • 46da9572 docs: match the error-message examples to what the parsers emit
Commits
  • 59bbc03 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump
  • 0f3f5ee 4.6.5
  • cc4cd4e Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, ref...
  • ca0229a Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed w...
  • 56222cd feat(instanceof): key the .properties() shape off the instance type (#6600)
  • de65a5c docs: lead the properties section with the check and add a Zod Mini tab (#6598)
  • f1448f7 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
  • d2b135c docs: add the 4.6.x patch highlights to the 4.6 post
  • 2bb0871 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
  • 743aedb 4.6.4
  • Additional commits viewable in compare view

Updates @playwright/cli from 0.1.19 to 0.1.21

Release notes

Sourced from @​playwright/cli's releases.

v0.1.21

✨ Highlights

  • 🎬 Smooth 60 fps, styleable videos — video-start --fps=60 records smooth 60 fps videos instead of the default 25, and video-start --cursor renders an animated mouse cursor that travels to each action point and stays visible between actions. video-show-actions takes --point-style, --highlight-style and --title-style CSS declarations; the action point marker and the target highlight are now only shown when styled. (microsoft/playwright#42752, microsoft/playwright#42758)
  • 🧰 WebMCP tools show up in the snapshot — the tools a page registers are listed at the top of the page snapshot with their descriptions and input schemas, so webmcp-call can be used without running webmcp-list first. Set webmcp: false in the config file (env PLAYWRIGHT_MCP_WEBMCP=false) to stop collecting page-registered tools. (microsoft/playwright#42671)
  • 🌗 Switch between light and dark color scheme (microsoft/playwright#42243) — an agent working on a dark theme had no way to see it mid-session. New set-color-scheme, set-reduced-motion, set-forced-colors, set-contrast and set-media commands emulate media features on the fly, and the matching clear-* commands reset them. (microsoft/playwright#42668)
  • 📁 Absolute paths in results (microsoft/playwright#42497) — links to snapshots, screenshots, console logs and downloads are relative to the working directory, which a consumer without one cannot resolve. Set filePaths: "absolute" in the config file (env PLAYWRIGHT_MCP_FILE_PATHS=absolute) to get absolute paths instead. (microsoft/playwright#42673)

🐛 Fixes

  • fix(chromium): bypass service workers on the storage state page — state-save no longer runs the site's own scripts, or fails when they redirect, for origins with an active service worker (microsoft/playwright#42656). (#42664, #42741)
  • fix(mcp): keep upload modal, skip short secrets and bad headers — a failed upload keeps the file chooser open so it can be retried, secrets shorter than 4 characters no longer rewrite the whole output with <secret> markers, and route ignores header lines that have no name. (#42713)

📦 Upgrading

npm install -g @playwright/cli@0.1.21

v0.1.20

What's New

🎉 New Commands

  • webmcp-list / webmcp-call — List and call the tools a page registers through the WebMCP API, letting the page do the work instead of driving its UI. When a page has WebMCP tools, the page status reports how many are available (#42613). WebMCP is experimental, see WebMCP in Chrome for how to enable it.

Other Changes

  • Headless sessions now shut down after one hour without commands, so a session an agent never closed no longer holds a browser; run open again to start a new one. Use open --idle-timeout <ms> (config timeouts.idle, env PLAYWRIGHT_MCP_IDLE_TIMEOUT) to change the timeout, 0 disables it. Headed browsers stay open, and attached browsers are only detached when attach --idle-timeout <ms> is set (#42676)
  • The skill includes a guide for attaching screenshots and videos to pull requests with gh --attach (#42645)

Bug Fixes

  • Session daemons exit when their control socket is deleted or replaced, instead of staying alive with the browser (#42454)
  • Explicitly named output files in a nested directory (e.g. screenshot --filename=sub/shot.png) no longer fail with ENOENT (#42540)
  • Video chapters and screencast overlays are no longer hidden behind open dialogs and popovers (#42642)
  • npx playwright test --debug=cli works for tests that create more than one browser context and for every test in a worker, not just the first (#42503)
  • With PLAYWRIGHT_MCP_EXTENSION_TOKEN set, attach --extension fails after 30 seconds with a hint when the extension never connects (e.g. the token belongs to another Chrome profile) instead of hanging forever (#42525)
  • Disable the Chromium sandbox by default on Linux for the bundled Chromium build, which lacks the setuid sandbox helper (#42490)

Upgrading

npm install -g @playwright/cli@0.1.20
Commits

Updates @tauri-apps/cli from 2.11.4 to 2.11.5

Release notes

Sourced from @​tauri-apps/cli's releases.

@​tauri-apps/cli v2.11.5

[2.11.5]

Security fixes

  • 5a87bab12 Record the app version in the trusted comment of updater signatures, so a signed artifact is bound to the version it was released as.

    An update endpoint response is not signed, and the signature only covers the downloaded artifact, so the announced version on its own does not prove which release the url and signature point at. minisign covers the trusted comment with its global signature, which lets the updater plugin compare the two and reject a response that pairs a version number with a different release. Enable requireSignedVersion in the updater plugin configuration to enforce this.

    tauri build fills the version in automatically, and tauri plugin add updater now enables requireSignedVersion for the project it is adding the plugin to. tauri signer sign gains an --app-version flag for signing updater artifacts by hand, and warns when it is omitted.

Dependencies

  • Upgraded to tauri-cli@2.11.5
Commits

Updates @types/node from 26.5.1 to 26.6.2

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the npm-minor-and-patch group across 1 directory with 8 updates
6351b0e 
Bumps the npm-minor-and-patch group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.45.0` | `1.47.0` |
| [multer](https://github.com/expressjs/multer) | `2.3.0` | `2.4.0` |
| [openai](https://github.com/openai/openai-node) | `7.15.0` | `7.22.0` |
| [tsx](https://github.com/privatenumber/tsx) | `4.23.13` | `4.23.15` |
| [zod](https://github.com/colinhacks/zod) | `4.6.2` | `4.6.5` |
| [@playwright/cli](https://github.com/microsoft/playwright-cli) | `0.1.19` | `0.1.21` |
| [@tauri-apps/cli](https://github.com/tauri-apps/tauri) | `2.11.4` | `2.11.5` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.5.1` | `26.6.2` |



Updates `lucide-react` from 1.45.0 to 1.47.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.47.0/packages/lucide-react)

Updates `multer` from 2.3.0 to 2.4.0
- [Release notes](https://github.com/expressjs/multer/releases)
- [Changelog](https://github.com/expressjs/multer/blob/main/CHANGELOG.md)
- [Commits](expressjs/multer@v2.3.0...v2.4.0)

Updates `openai` from 7.15.0 to 7.22.0
- [Release notes](https://github.com/openai/openai-node/releases)
- [Changelog](https://github.com/openai/openai-node/blob/main/CHANGELOG.md)
- [Commits](openai/openai-node@v7.15.0...v7.22.0)

Updates `tsx` from 4.23.13 to 4.23.15
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.23.13...v4.23.15)

Updates `zod` from 4.6.2 to 4.6.5
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.6.2...v4.6.5)

Updates `@playwright/cli` from 0.1.19 to 0.1.21
- [Release notes](https://github.com/microsoft/playwright-cli/releases)
- [Commits](microsoft/playwright-cli@v0.1.19...v0.1.21)

Updates `@tauri-apps/cli` from 2.11.4 to 2.11.5
- [Release notes](https://github.com/tauri-apps/tauri/releases)
- [Commits](https://github.com/tauri-apps/tauri/compare/@tauri-apps/cli-v2.11.4...@tauri-apps/cli-v2.11.5)

Updates `@types/node` from 26.5.1 to 26.6.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

---
updated-dependencies:
- dependency-name: lucide-react
  dependency-version: 1.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: multer
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: openai
  dependency-version: 7.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: tsx
  dependency-version: 4.23.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: zod
  dependency-version: 4.6.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@playwright/cli"
  dependency-version: 0.1.21
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@tauri-apps/cli"
  dependency-version: 2.11.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@types/node"
  dependency-version: 26.6.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 26, 2026
@dependabot
dependabot Bot requested a review from ryusui-hiro as a code owner September 26, 2026 06:44
@dependabot dependabot Bot added javascript Pull requests that update javascript code dependencies Pull requests that update a dependency file labels Sep 26, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ryusui-hiro ryusui-hiro Awaiting requested review from ryusui-hiro ryusui-hiro is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants