Skip to content

chore(deps): Update npm-deps - #713

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-deps
Open

renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-deps

Conversation

@renovate

@renovate renovate Bot commented Oct 7, 2026 •

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@modelcontextprotocol/sdk (source) 1.31.0 → 1.32.1 age confidence
@napi-rs/canvas 1.0.9 → 1.0.10 age confidence
@redocly/cli 2.55.0 → 2.60.0 age confidence
@types/node (source) 24.19.0 → 24.19.1 age confidence
@vitest/coverage-v8 (source) 5.0.2 → 5.0.3 age confidence
docx (source) 9.8.1 → 9.9.0 age confidence
dotenv 18.0.5 → 18.0.6 age confidence
express-rate-limit 8.7.0 → 8.7.1 age confidence
pdfjs-dist (source) 6.3.289 → 6.4.299 age confidence
pg (source) 8.23.0 → 8.23.1 age confidence
pino (source) 10.3.1 → 10.4.0 age confidence
pino-pretty 13.1.3 → 13.2.0 age confidence
typescript-eslint (source) 8.71.0 → 8.71.1 age confidence
vitest (source) 5.0.2 → 5.0.3 age confidence

Release Notes

modelcontextprotocol/typescript-sdk (@​modelcontextprotocol/sdk)

v1.32.1

Compare Source

What's Changed

Full Changelog: modelcontextprotocol/typescript-sdk@1.32.0...1.32.1

v1.32.0

Compare Source

Upgrade notes

  • Redirects: the HTTP client transports now follow a redirect only when it stays on the same origin (same scheme, host and port; http to https on the same host is allowed). A deployment whose endpoint redirects to another host or port either configures the final URL or sets redirectPolicy: 'follow' on StreamableHTTPClientTransport or SSEClientTransport. In browsers, a redirected request fails unless that option is set.
  • New options, both off unless you set them: maxToolInputElements on McpServer limits the number of array elements and object members in a tool call's arguments. expectedResource on requireBearerAuth accepts only tokens issued for this server (the token's audience).

What's Changed

  • [v1.x] fix(client): follow redirects only within the endpoint's origin by @​claude[bot] in #​2902
  • docs: point SECURITY.md at GitHub Security Advisories (v1.x) by @​claude[bot] in #​2910
  • [v1.x] examples: close idle sessions and cap the session map by @​maxisbey in #​2914
  • [v1.x] fix(tasks): keep tasks of the in-memory task store within the session that created them by @​claude[bot] in #​2925
  • [v1.x] feat(server): add maxToolInputElements option to limit the number of elements in tool-call arguments by @​claude[bot] in #​2927
  • [v1.x] fix(server): accept tools/call and prompts/get requests that omit arguments by @​raashish1601 in #​2045
  • [v1.x] feat(auth): add expectedResource to requireBearerAuth by @​claude[bot] in #​2930
  • [v1.x] test(e2e): cover tools/call and prompts/get without arguments by @​claude[bot] in #​2931
  • chore: bump version to 1.32.0 by @​claude[bot] in #​2935

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@1.31.0...1.32.0

Brooooooklyn/canvas (@​napi-rs/canvas)

v1.0.10

Compare Source

Bug Fixes
Features
Redocly/redocly-cli (@​redocly/cli)

v2.60.0

Compare Source

Minor Changes
  • Added the --file-name-conflicts-severity option for the split command to control how file name conflicts are reported.
Patch Changes
  • Fixed an issue where split lost content when two components, paths, webhooks, channels, operations, or code samples got the same file name.

    Warning: split output may differ from older releases: when several names would share one file, each later file now gets a -n suffix, where n is its order, for example user-2.yaml next to User.yaml.

v2.59.0

Compare Source

Minor Changes
  • Improved redocly recheck to lint the description fields of API descriptions.
    Findings report the source line and column.
    You can suppress the findings by file, rule, and pointer, or adjust rules for descriptions only.

    Note: ResolvedRecheckConfig gains a required descriptionRules field.
    Library code that builds that object by hand must set it.

Patch Changes
  • Updated brace-expansion to 2.1.7 and 5.0.12, dompurify to 3.4.16, fast-uri to 3.1.8, and js-yaml to 5.4.3 to resolve CVE-2026-102276, CVE-2026-102277, CVE-2026-102278, CVE-2026-86472, GHSA-p98j-92pf-mc4p, and GHSA-r3ph-w7gj-g6xm.
  • Updated oxfmt to 0.72.0 and tinypool to 2.2.0 to resolve CVE-2026-104848 and CVE-2026-104849.
  • Updated proxy-addr to 2.0.8 and source-map-js to 1.2.2 to resolve CVE-2026-90711 and CVE-2026-93749.
  • Updated @​redocly/openapi-core to v2.59.0.
  • Updated @​redocly/recheck to v2.59.0.
  • Updated @​redocly/reunite-integration to v2.59.0.

v2.58.2

Compare Source

Patch Changes
  • Fixed an issue where the generated PHP client failed with Undefined constant "OPERATIONS" when OPcache preload was enabled.
  • Updated @​redocly/client-generator to v0.4.23.

v2.58.1

Compare Source

Patch Changes
  • Improved performance of the no-invalid-media-type-examples, no-invalid-schema-examples, and no-invalid-parameter-examples rules by reusing validators for schemas that are referenced or repeated.
  • Updated @​redocly/openapi-core to v2.58.1.
  • Updated @​redocly/reunite-integration to v2.58.1.

v2.58.0

Compare Source

v2.57.0

Compare Source

Minor Changes
  • Added const checking to the no-enum-type-mismatch rule: a const value must conform to the schema's type, the same way every enum value does.

    Note: linting output may include new errors for schemas whose const value doesn't match their type.

Patch Changes
  • Fixed an issue where no-enum-type-mismatch dropped violations and reported a wrong location when type was written as an array.
  • Updated @​redocly/openapi-core to v2.57.0.

v2.56.1

Compare Source

Patch Changes

v2.56.0

Compare Source

Minor Changes
  • Added support for applying Overlay documents to the bundle command output.
    Pass overlays with the new --overlay option or list them under overlays for an API in redocly.yaml.
  • Added support for linting Overlay 1.1 and 1.2 documents, including the copy action field, the $self field, and reusable actions in components.actions.
    The spec-ref-siblings rule now checks the fields next to a reusable action $ref in Overlay documents.
Patch Changes
vitest-dev/vitest (@​vitest/coverage-v8)

v5.0.3

Compare Source

   🐞 Bug Fixes
    View changes on GitHub
dolanmiu/docx (docx)

v9.9.0

Compare Source

What's Changed

New: docx/layout — lay out documents as Word does

A new docx/layout entry point that works out where everything lands on the page, the way Word does. It writes the page numbers of tables of contents, page references (including \p and their own formats), PAGE/SECTION fields and caption numbers (SEQ) "clean", so Word opens the document without asking to update fields. It can read an existing .docx (to fill in a template's page numbers or check Word's own pages), and it returns the pages of a document and what is on each. Where it meets something it doesn't follow yet, it stops and says so, or it makes a best guess if you ask it to.

What it covers:

  • Text measurement: measures text with Pretext in the page's fonts, using Word's width tables, the font files you give it, fonts the document embeds and Office's own fonts. Handles italics, the bold Word makes itself, kerning, ligatures, and letters a font lacks. Supports Greek, Cyrillic, Vietnamese, Latin Extended, Chinese, Japanese, Korean, Thai, Arabic and right-to-left text, plus East Asian font hints and high ANSI fonts.
  • Lines and paragraphs: makes each line as tall as its fonts' ascents and descents, with pictures on the baseline. Squeezes the spaces of justified and distributed lines, and covers paragraph borders, auto and contextual spacing, and indents in characters and lines. Also covers tabs (decimal tabs and tabs past the margin), soft hyphens, hyphenation, hidden text and marks, tracked changes, superscript, small caps, emphasis marks, run borders, fitted text, phonetic guides and drop caps.
  • Lists: numbers lists and places their numbers as Word does, including bordered and Word 6 list numbers and list styles.
  • Tables: sizes tables given no widths (autofit), widens columns for long words, and handles merged cells and tables inside cells. Breaks rows across pages, repeats header rows, and covers set row heights, borders that meet and space between cells. Also covers table style parts, text running up or down cells, deleted rows, floating tables, and tables a share of the page wide.
  • Sections, columns and page numbers: lays out columns of different widths and evens them out before continuous section breaks. Covers next-column sections, kept paragraphs taller than a column, gutters and booklets, and page numbers in every format, with chapter numbers and restarts.
  • Footnotes and endnotes: numbers and places them, continues them across pages, and lays them out in columns, table rows and kept paragraphs. Also covers separators and continuation separators, and endnote pages.
  • Drawings and frames: wraps text around pictures, shapes and floating tables, including drawings that overlap. Covers text frames, VML text boxes, shapes, objects and pictures, and header pictures.
  • Equations: lays out linear and built-up equations and follows the document's math settings. Covers accents, limits, brackets, scripts and pre-scripts, phantoms, boxes and equation arrays.
  • East Asian layout and compatibility: covers document grids, text running down the page, Japanese line rules, compressed punctuation and grid indents. Supports compatibility modes 11, 12 and 14, suppressTopSpacing, useFELayout, HTML divisions, and imported documents (w:altChunk).
  • Verified against Word: layout probes and Word's PDFs of them are kept in scripts/layout-probes, and every line of each demo is checked against Word's own output.
All layout PRs

#​3591, #​3592, #​3593, #​3595, #​3596, #​3600, #​3602, #​3603, #​3604, #​3605, #​3606, #​3607, #​3608, #​3609, #​3610, #​3611, #​3612, #​3613, #​3614, #​3615, #​3616, #​3617, #​3618, #​3619, #​3620, #​3621, #​3622, #​3625, #​3626, #​3627, #​3628, #​3629, #​3630, #​3631, #​3632, #​3633, #​3634, #​3635, #​3636, #​3637, #​3638, #​3639, #​3640, #​3641, #​3648, #​3649, #​3650, #​3651, #​3652, #​3653, #​3654, #​3655, #​3656, #​3658, #​3659, #​3660, #​3661, #​3662, #​3663, #​3664, #​3665, #​3666, #​3667, #​3668, #​3669, #​3670, #​3671, #​3672, #​3673, #​3674, #​3675, #​3676, #​3677, #​3678, #​3679, #​3680, #​3681, #​3682, #​3683, #​3684, #​3685, #​3686, #​3687, #​3688, #​3689, #​3690, #​3700, #​3701, #​3702, #​3703, #​3704, #​3705, #​3706, #​3707, #​3708, #​3709, #​3710, #​3711, #​3712, #​3723, #​3724, #​3725, #​3726, #​3727, #​3728, #​3729, #​3730

Other changes

New Contributors

Full Changelog: dolanmiu/docx@9.8.1...9.9.0

motdotla/dotenv (dotenv)

v18.0.6

Compare Source

Changed
  • Use smarter parseBoolean not Boolean() to fix override (#​1069)
express-rate-limit/express-rate-limit (express-rate-limit)

v8.7.1

Compare Source

You can view the changelog here.

mozilla/pdf.js (pdfjs-dist)

v6.4.299

Compare Source

This release contains improvements for annotation rendering, font conversion, form handling, pattern rendering, performance, text selection and the viewer.

Changes since v6.3.289

[!IMPORTANT]
✂ PR body was truncated to here.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies Dependency updates and supply-chain label Oct 7, 2026
@coderabbitai

coderabbitai Bot commented Oct 7, 2026 •

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration
  • Configuration used: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 9dd317ea-e88e-491c-bbb1-8b5ef2f671ff

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

@renovate
renovate Bot force-pushed the renovate/npm-deps branch from 7bb5147 to 6a9620c Compare October 7, 2026 17:13
@renovate renovate Bot changed the title chore(deps): Update dependency @redocly/cli to v2.56.0 chore(deps): Update npm-deps Oct 7, 2026
@renovate
renovate Bot force-pushed the renovate/npm-deps branch 11 times, most recently from e0f9f03 to a2be215 Compare October 14, 2026 01:03
@renovate
renovate Bot force-pushed the renovate/npm-deps branch from a2be215 to d67cd17 Compare October 14, 2026 17:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Dependency updates and supply-chain

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants