Skip to content

chore(deps-dev): bump mocha from 11.8.0 to 12.0.2 - #304

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/mocha-12.0.2
Closed

chore(deps-dev): bump mocha from 11.8.0 to 12.0.2#304
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/mocha-12.0.2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 21, 2026

Copy link
Copy Markdown
Contributor

Bumps mocha from 11.8.0 to 12.0.2.

Release notes

Sourced from mocha's releases.

v12.0.2

12.0.2 (2026-09-17)

🩹 Fixes

  • fail nested tests on beforeEach failure (#6292) (a75b43b)
  • give CLI reporter-option precedence over config file (#6331) (571110f)
  • propagate spec file path on parallel worker death (#6268) (55a544a)
  • use find-up-simple to workaround ERR_PACKAGE_PATH_NOT_EXPORTED (#6342) (a652ff5)
  • watch existing dirs so first run starts armed (#6263) (f5c8aca)

📚 Documentation

🧹 Chores

v12.0.1

12.0.1 (2026-09-08)

... (truncated)

Changelog

Sourced from mocha's changelog.

12.0.2 (2026-09-17)

🩹 Fixes

  • fail nested tests on beforeEach failure (#6292) (a75b43b)
  • give CLI reporter-option precedence over config file (#6331) (571110f)
  • propagate spec file path on parallel worker death (#6268) (55a544a)
  • use find-up-simple to workaround ERR_PACKAGE_PATH_NOT_EXPORTED (#6342) (a652ff5)
  • watch existing dirs so first run starts armed (#6263) (f5c8aca)

📚 Documentation

🧹 Chores

12.0.1 (2026-09-08)

🩹 Fixes

... (truncated)

Commits
  • 70db1c7 chore(main): release 12.0.2 (#6300)
  • 571110f fix: give CLI reporter-option precedence over config file (#6331)
  • a652ff5 fix: use find-up-simple to workaround ERR_PACKAGE_PATH_NOT_EXPORTED (#6342)
  • a8309fd chore: stop auto-adding PRs to project (#6352)
  • 2668e71 chore: replace find-conflicts with improved smoke versions (#6344)
  • 6728030 chore: add folder for reproducing issues (#6330)
  • e7b7fe1 chore: exclude "v11.x" from "stale branch" workflow (#6338)
  • a923e25 Ping maintainers on stale branch review issues (#6326)
  • 633480c chore: fixup workflow perms in-job (#6327)
  • cd2a730 chore: set author to Mark Wiemer (#6305)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
chore(deps-dev): bump mocha from 11.8.0 to 12.0.2
d8b98b0 
Bumps [mocha](https://github.com/mochajs/mocha) from 11.8.0 to 12.0.2.
- [Release notes](https://github.com/mochajs/mocha/releases)
- [Changelog](https://github.com/mochajs/mocha/blob/main/CHANGELOG.md)
- [Commits](mochajs/mocha@v11.8.0...v12.0.2)

---
updated-dependencies:
- dependency-name: mocha
  dependency-version: 12.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@github-actions

github-actions Bot commented Sep 21, 2026

Copy link
Copy Markdown
Contributor

🛡️ Security Hardening Pipeline Results

Branch: dependabot/npm_and_yarn/mocha-12.0.2
Commit: c72cc8a

Workflow Run: 454
Branch: dependabot/npm_and_yarn/mocha-12.0.2
Commit: c72cc8a

Scan Status

Scanner Status
bandit ⏭️ skipped
checkov ⏭️ skipped
clamav ⏭️ skipped
codeql ✅ PASS
container ⏭️ skipped
dependency-review ✅ PASS
gitleaks ✅ PASS
grype ⏭️ skipped
lint ⏭️ skipped
opengrep ⏭️ skipped
osv ✅ PASS
sbom ⏭️ skipped
supply-chain ⏭️ skipped
trivy-container ⏭️ skipped
trivy-iac ⏭️ skipped
zap ⏭️ skipped

✅ All enabled scanners completed successfully.

Summaries Collected: 4

Scanner Results

🔬 CodeQL SAST (Javascript)

Status: Completed

Findings Summary

Critical High Medium Low Total
0 0 0 0 0

No security findings detected for Javascript.

Artifacts: CodeQL Reports (Javascript)

🔗 Dependency Review

Status: ✅ No issues found

No vulnerable or license-violating dependencies detected in this PR.
📋 View full report

🔑 Gitleaks (Secrets)

No 🔑 Gitleaks (Secrets) findings summary was produced.

📦 OSV (Dependencies)

No 📦 OSV (Dependencies) findings summary was produced.

Generated by Argus

Generated by Argus

@eFAILution eFAILution mentioned this pull request Sep 21, 2026
Merged
5 tasks
eFAILution added a commit that referenced this pull request Sep 21, 2026
@eFAILution
chore(deps-dev): bump the dev-dependencies group with 6 updates (#307)
32b61e2 
Rebuilds #302, #303 and #304 against beta. All three were opened against
main, whose package.json trails beta by everything in #297, so most of
what they propose is already here and their lockfiles no longer apply.

  @release-it/conventional-changelog  ^12.0.0 -> ^12.0.2
  @types/node                         ^26.5.1 -> ^26.6.1
  dotenv                              ^17.4.2 -> ^18.0.0
  js-yaml                             ^5.4.1  -> ^5.4.2
  mocha                               ^12.0.0 -> ^12.0.2
  release-it                          ^21.0.2 -> ^21.1.0

js-yaml is the only one that reaches the packaged extension — src
imports it and esbuild bundles it — and it is a patch. The rest are
tooling.

The root conventional-changelog-conventionalcommits pin stays at 9.3.1;
the 10.x that moves in the lockfile is release-it's own nested copy,
already on 10.x before this change. dotenv is declared but imported
nowhere in the repo, so its major bump is inert — worth removing rather
than tracking, separately.

release-it 21.1.0 pulls in one new transitive package, verkit@0.4.0
(MIT). Every version here was published at least three days ago.

Co-authored-by: eFAILution <eFAILution@users.noreply.github.com>
@eFAILution

eFAILution commented Sep 21, 2026

Copy link
Copy Markdown
Owner

Rebuilt against beta and merged: #307 (32b61e2).

This was opened against main, which trails beta by everything not yet released, so it duplicated versions beta already carried and its diff no longer applied on retarget.

Dependabot reads .github/dependabot.yml from the default branch, so the target-branch: "beta" added in #296 has no effect until it reaches main with the next release. Until then these will keep opening here.

@eFAILution eFAILution closed this Sep 21, 2026
@eFAILution
eFAILution deleted the dependabot/npm_and_yarn/mocha-12.0.2 branch September 21, 2026 18:05
@dependabot @github

dependabot Bot commented on behalf of github Sep 21, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@eFAILution eFAILution

Labels

dependencies npm

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@eFAILution