Skip to content

deps(deps): bump the weekly-minor-patch group across 1 directory with 7 updates - #1871

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/master/weekly-minor-patch-4f3858767e
Open

dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/master/weekly-minor-patch-4f3858767e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 14, 2026

Copy link
Copy Markdown
Contributor

Bumps the weekly-minor-patch group with 7 updates in the / directory:

Package From To
js-yaml 5.4.0 5.4.1
openai 7.4.0 7.15.0
qs 6.15.3 6.16.0
react 19.2.8 19.3.0
react-dom 19.2.8 19.3.0
webpack 5.109.2 5.110.3
baseline-browser-mapping 2.11.19 2.11.22

Updates js-yaml from 5.4.0 to 5.4.1

Changelog

Sourced from js-yaml's changelog.

[5.4.1] - 2026-08-26

Changed

  • Hard-limit merge sequence size to 100.

Security

  • Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.
Commits

Updates openai from 7.4.0 to 7.15.0

Release notes

Sourced from openai's releases.

v7.15.0

7.15.0 (2026-09-10)

Features

v7.14.0

7.14.0 (2026-09-10)

Features

Bug Fixes

  • deps-dev: bump joi from 18.2.3 to 18.2.5 in /ecosystem-tests/vercel-edge (#2702) (029b805)
  • deps: bump next from 15.5.23 to 15.5.25 in /ecosystem-tests/vercel-edge (#2703) (e9446db)
  • deps: bump sharp from 0.35.3 to 0.35.4 in /ecosystem-tests/vercel-edge (#2704) (ca95705)
  • deps: update remaining tooling and fixture patches (#2712) (bcaabee)

v7.13.0

7.13.0 (2026-09-09)

Features

v7.12.1

7.12.1 (2026-09-09)

Includes the GPT Image 2.5 support from 7.12.0, which was not published to npm.

Features

  • api: add GPT Image 2.5 models and image options (#2705) (6500a16)

Bug Fixes

  • ci: run Cloudflare example regressions before release (#2706) (c5cc31c)

v7.12.0

7.12.0 (2026-09-08)

... (truncated)

Changelog

Sourced from openai's changelog.

7.15.0 (2026-09-10)

Features

7.14.0 (2026-09-10)

Features

Bug Fixes

  • deps-dev: bump joi from 18.2.3 to 18.2.5 in /ecosystem-tests/vercel-edge (#2702) (029b805)
  • deps: bump next from 15.5.23 to 15.5.25 in /ecosystem-tests/vercel-edge (#2703) (e9446db)
  • deps: bump sharp from 0.35.3 to 0.35.4 in /ecosystem-tests/vercel-edge (#2704) (ca95705)
  • deps: update remaining tooling and fixture patches (#2712) (bcaabee)

7.13.0 (2026-09-09)

Features

7.12.1 (2026-09-09)

Includes the GPT Image 2.5 support from 7.12.0, which was not published to npm.

Features

  • api: add GPT Image 2.5 models and image options (#2705) (6500a16)

Bug Fixes

  • ci: run Cloudflare example regressions before release (#2706) (c5cc31c)

7.12.0 (2026-09-08)

Features

  • api: add GPT Image 2.5 models and image options (#2705) (6500a16)

... (truncated)

Commits
  • 50eb4b2 release: 7.15.0 (#2720)
  • 20a47f9 feat(api): add Agents API (#2719)
  • c1f88cd release: 7.14.0 (#2711)
  • c037ba7 feat(api) Add Live API (#2718)
  • fe2d6a3 test: reduce CI subprocess and validation overhead (#2713)
  • bcaabee fix(deps): update remaining tooling and fixture patches (#2712)
  • 029b805 fix(deps-dev): bump joi from 18.2.3 to 18.2.5 in /ecosystem-tests/vercel-edge...
  • e9446db fix(deps): bump next from 15.5.23 to 15.5.25 in /ecosystem-tests/vercel-edge ...
  • ca95705 fix(deps): bump sharp from 0.35.3 to 0.35.4 in /ecosystem-tests/vercel-edge (...
  • a661a7d release: 7.13.0 (#2710)
  • Additional commits viewable in compare view

Updates qs from 6.15.3 to 6.16.0

Changelog

Sourced from qs's changelog.

6.16.0

  • [New] stringify: add a depth option to bound recursion depth (default Infinity)
  • [Fix] stringify: serialize Date values when a filter is provided
  • [Fix] parse: enforce arrayLimit on comma groups under []= when throwOnLimitExceeded is set
  • [Fix] parse: flatten a collection appended to an overflowed array (#571)
  • [Fix] utils: isBuffer: do not invoke a non-callable constructor.isBuffer
  • [Fix] stringify: do not let allowEmptyArrays skip cycle detection (or drop own keys) on an empty array with own properties
  • [Fix] stringify: encode dots in a top-level key with a primitive value when encodeDotInKeys is set (#562)
  • [Docs] threat model: clarify stringify deep-nesting DoS is caller-bounded
  • [Docs] clarify arrayLimit is a representation threshold, not an element-count cap
  • [Tests] parse: remove a test that pinned []= comma groups escaping arrayLimit
  • [Tests] stringify: pin current encodeDotInKeys separator-dot behavior
  • [Dev Deps] update @ljharb/eslint-config, eslint
  • [Dev Deps] update eslint, evalmd
Commits
  • bb9379e v6.16.0
  • 62fd254 [Fix] stringify: serialize Date values when a filter is provided
  • 8859c37 [Fix] parse: enforce arrayLimit on comma groups under []= when `throwOn...
  • 8079adc [Tests] parse: remove a test that pinned []= comma groups escaping `array...
  • d56f48c [Fix] parse: flatten a collection appended to an overflowed array
  • e83d321 [Fix] utils: isBuffer: do not invoke a non-callable constructor.isBuffer
  • 7e87a07 [Dev Deps] update @ljharb/eslint-config, eslint
  • 9a76af2 [Dev Deps] update eslint, evalmd
  • 3a890d4 [Dev Deps] update eslint, evalmd
  • b433a9b [Fix] stringify: do not let allowEmptyArrays skip cycle detection (or dro...
  • Additional commits viewable in compare view

Updates react from 19.2.8 to 19.3.0

Release notes

Sourced from react's releases.

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

New React DOM Features

  • browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #37143, #37241)
    • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #37193)

Notable changes

All Changes

React

... (truncated)

Changelog

Sourced from react's changelog.

19.3.0 (September 9, 2026)

New React Features

New React DOM Features

  • browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #37143, #37241)
    • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #37193)

Notable changes

All Changes

React

... (truncated)

Commits

Updates react-dom from 19.2.8 to 19.3.0

Release notes

Sourced from react-dom's releases.

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

New React DOM Features

  • browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #37143, #37241)
    • Added an onBrowserBailout option to th...

      Description has been truncated


      [!NOTE]
      Medium Risk
      React 19.3 and a large OpenAI client jump can affect rendering and API usage at build/runtime; webpack/minifier updates warrant a full Docusaurus build smoke test.

      Overview
      This PR only updates package-lock.json, resolving newer versions for the weekly Dependabot group—no application source changes.

      Runtime / UI: react and react-dom move 19.2.8 → 19.3.0 (with scheduler 0.28.0), pulling in React 19.3 behavior such as independent transition rendering and new APIs the app does not have to adopt immediately.

      Integrations: openai resolves 7.4.0 → 7.15.0, expanding generated client surface (e.g. Agents/Live API types) and optional peer deps (undici, newer ws).

      Build: webpack 5.109.2 → 5.110.3 drops a direct eslint-scope dependency and pulls a newer minimizer-webpack-plugin (5.10.1 in the tree) with updated terser/schema-utils and extra optional minifier peers.

      Parsing / query strings: js-yaml 5.4.0 → 5.4.1 includes a security hardening around YAML merge key CPU usage; root qs 6.15.3 → 6.16.0 tightens parse/stringify edge cases (nested webpack-dev-server still pins 6.15.3 locally in the lockfile).

      Tooling: baseline-browser-mapping 2.11.19 → 2.11.22; several formerly hoisted eslint-scope / estraverse lock entries are removed as webpack’s tree changes.

      Reviewed by Cursor Bugbot for commit fed9bda. Bugbot is set up for automated code reviews on this repo. Configure here.

… 7 updates

Bumps the weekly-minor-patch group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [js-yaml](https://github.com/nodeca/js-yaml) | `5.4.0` | `5.4.1` |
| [openai](https://github.com/openai/openai-node) | `7.4.0` | `7.15.0` |
| [qs](https://github.com/ljharb/qs) | `6.15.3` | `6.16.0` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.8` | `19.3.0` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.8` | `19.3.0` |
| [webpack](https://github.com/webpack/webpack) | `5.109.2` | `5.110.3` |
| [baseline-browser-mapping](https://github.com/web-platform-dx/baseline-browser-mapping) | `2.11.19` | `2.11.22` |



Updates `js-yaml` from 5.4.0 to 5.4.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@5.4.0...5.4.1)

Updates `openai` from 7.4.0 to 7.15.0
- [Release notes](https://github.com/openai/openai-node/releases)
- [Changelog](https://github.com/openai/openai-node/blob/main/CHANGELOG.md)
- [Commits](openai/openai-node@v7.4.0...v7.15.0)

Updates `qs` from 6.15.3 to 6.16.0
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.15.3...v6.16.0)

Updates `react` from 19.2.8 to 19.3.0
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.0/packages/react)

Updates `react-dom` from 19.2.8 to 19.3.0
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.0/packages/react-dom)

Updates `webpack` from 5.109.2 to 5.110.3
- [Release notes](https://github.com/webpack/webpack/releases)
- [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md)
- [Commits](webpack/webpack@v5.109.2...v5.110.3)

Updates `baseline-browser-mapping` from 2.11.19 to 2.11.22
- [Release notes](https://github.com/web-platform-dx/baseline-browser-mapping/releases)
- [Commits](web-platform-dx/baseline-browser-mapping@v2.11.19...v2.11.22)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 5.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: weekly-minor-patch
- dependency-name: openai
  dependency-version: 7.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: weekly-minor-patch
- dependency-name: qs
  dependency-version: 6.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: weekly-minor-patch
- dependency-name: react
  dependency-version: 19.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: weekly-minor-patch
- dependency-name: react-dom
  dependency-version: 19.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: weekly-minor-patch
- dependency-name: webpack
  dependency-version: 5.110.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: weekly-minor-patch
- dependency-name: baseline-browser-mapping
  dependency-version: 2.11.22
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: weekly-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants