Skip to content

deps: bump the all-dependencies group across 1 directory with 21 updates#335

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/all-dependencies-978ea927a8
Closed

deps: bump the all-dependencies group across 1 directory with 21 updates#335
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/all-dependencies-978ea927a8

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 11, 2026 •
edited
Loading

Bumps the all-dependencies group with 21 updates in the / directory:

Package From To
@canton-network/wallet-sdk 0.21.0 1.1.0
@hardlydifficult/websocket 1.0.2 1.0.73
@stellar/stellar-base 14.0.4 15.0.0
axios 1.13.5 1.16.0
dotenv 17.2.4 17.4.2
glob 13.0.1 13.0.6
openapi-fetch 0.16.0 0.17.0
openapi-typescript 7.12.0 7.13.0
ws 8.19.0 8.20.0
zod 4.3.6 4.4.3
@types/node 25.2.2 25.6.0
@typescript-eslint/eslint-plugin 8.55.0 8.59.2
@typescript-eslint/parser 8.55.0 8.59.2
eslint 9.39.2 10.3.0
jest 30.2.0 30.3.0
markdownlint-cli 0.47.0 0.48.0
npm-package-json-lint 9.1.0 10.4.0
prettier 3.8.1 3.8.3
prettier-plugin-packagejson 3.0.0 3.0.2
ts-jest 29.4.6 29.4.9
typescript 5.9.3 6.0.3

Updates @canton-network/wallet-sdk from 0.21.0 to 1.1.0

Release notes

Sourced from @​canton-network/wallet-sdk's releases.

@​canton-network/wallet-sdk@​1.1.0

1.1.0 (2026-04-28)

🚀 Features

  • core-ledger-client: upgrade splice to 0.6.1 (#1681)

🩹 Fixes

  • refactor utils namespace to create sdk offline (#1674)
  • wallet-sdk: fix withdraw command for delegate proxy v1 (1fd497ad)
  • preapproval test script + fetch status command (#1647)

🧱 Updated Dependencies

  • Updated @​canton-network/core-token-standard-service to 1.1.1
  • Updated @​canton-network/core-ledger-client-types to 1.1.1
  • Updated @​canton-network/core-asyncapi-client to 1.1.1
  • Updated @​canton-network/core-provider-ledger to 1.1.1
  • Updated @​canton-network/core-splice-provider to 1.1.1
  • Updated @​canton-network/core-amulet-service to 1.1.1
  • Updated @​canton-network/core-token-standard to 1.1.1
  • Updated @​canton-network/core-splice-client to 1.1.1
  • Updated @​canton-network/core-tx-visualizer to 1.1.1
  • Updated @​canton-network/core-ledger-proto to 1.1.1
  • Updated @​canton-network/core-signing-lib to 1.1.1
  • Updated @​canton-network/core-wallet-auth to 1.1.1
  • Updated @​canton-network/core-acs-reader to 1.9.1
  • Updated @​canton-network/core-tx-parser to 1.1.1
  • Updated @​canton-network/core-types to 1.1.1

❤️ Thank You

Commits
  • 922271a chore(release): publish (#1683)
  • 8b9f111 feat(core-ledger-client): upgrade splice to 0.6.1 (#1681)
  • 4f84113 chore(deps): bump uuid from 11.1.0 to 14.0.0 (#1671)
  • ec5d659 chore: cleanup tsconfigs (#1663)
  • 6af16c1 fix: refactor utils namespace to create sdk offline (#1674)
  • 1fd497a fix(wallet-sdk): fix withdraw command for delegate proxy v1
  • 0e733b9 fix: preapproval test script + fetch status command (#1647)
  • bf6e78a v1 release (#1644)
  • 4555661 Enable DappProvider interoperability with Wallet SDK w/o casting (#1643)
  • 1a2f020 feat: adjust typescript typings for wallet-sdk v1 fields
  • Additional commits viewable in compare view

Updates @hardlydifficult/websocket from 1.0.2 to 1.0.73

Updates @stellar/stellar-base from 14.0.4 to 15.0.0

Release notes

Sourced from @​stellar/stellar-base's releases.

v15.0.0

v15.0.0: Protocol 26

Breaking Changes

  • TransactionBase.networkPassphrase setter now throws an error to enforce immutability (#891).
  • React Native apps using the Hermes engine must polyfill broken typed array methods such as subarray; this compatibility is no longer provided by @stellar/js-xdr. One option is @exodus/patch-broken-hermes-typed-arrays. If needed, please review and consider manually adding it to your project.
  • Construction and encoding of sized XDR integer values now throw on overflow and underflow instead of silently clamping, via @stellar/js-xdr (#133). This may affect code that previously relied on permissive bigint coercion.

Added

  • XDR definitions have been updated to align with Protocol 26 (#944).

Fixed

  • Keypair.verify now returns false instead of throwing when the signature is invalid (#892).
  • Memo.id now correctly rejects negative values, decimal values, and values exceeding the uint64 maximum (2^64 - 1); the error message now correctly says uint64 (#892).
  • Operation._toXDRPrice now accepts price objects with n: 0 (a zero numerator was previously treated as falsy and fell through to float approximation) (#892).
  • SignerKey.decodeSignerKey now reads the exact payload length from the 4-byte length prefix when decoding signedPayload signer keys, preventing data truncation or over-read (#892).
  • TransactionBuilder.cloneFrom now correctly re-encodes extraSigners as StrKey strings (they were previously passed as raw XDR objects) (#892).
  • TransactionBuilder.cloneFrom now uses Math.floor when computing unscaledFee to prevent fractional fee values (#892).
  • TransactionBuilder now floors Date timebounds to integer UNIX timestamps (#892).
  • Auth.bytesToInt64 now correctly handles bytes with upper-32-bit values set by processing each 32-bit half independently (#891).
  • ScInt constructor now correctly handles string input (#891).
  • Soroban.parseTokenAmount now throws when the input value has more decimal places than the specified decimals argument (#891).
  • XDR Array and VarArray decoding now fails fast when the declared array length exceeds the remaining bytes, via @stellar/js-xdr (#132).

Contributors

Full Changelog: stellar/js-stellar-base@v14.1.0...v15.0.0

v14.1.0

v14.1.0

Added

  • Implemented TransactionBuilder.addSacTransferOperation to remove the need for simulation for SAC (Stellar Asset Contract) transfers by creating the appropriate auth entries and footprint (#861).

Fixed

  • TransactionBuilder.build now adds this.sorobanData.resourceFee() to baseFee when provided (#861).
  • The generated XDR type declarations for unions with integer discriminants now use constructors instead of named static methods (stellar/dts-xdr#9) (#874).

Contributors

Full Changelog: stellar/js-stellar-base@v14.0.4...v14.1.0

Changelog

Sourced from @​stellar/stellar-base's changelog.

v15.0.0: Protocol 26

Migration Guide — step-by-step upgrade instructions with code examples and severity ratings.

Breaking Changes

  • TransactionBase.networkPassphrase setter now throws an error to enforce immutability (#891).
  • React Native apps using the Hermes engine must polyfill broken typed array methods such as subarray; this compatibility is no longer provided by @stellar/js-xdr. One option is @exodus/patch-broken-hermes-typed-arrays. If needed, please review and consider manually adding it to your project.
  • Construction and encoding of sized XDR integer values now throw on overflow and underflow instead of silently clamping, via @stellar/js-xdr (#133). This may affect code that previously relied on permissive bigint coercion.

Added

  • XDR definitions have been updated to align with Protocol 26 (#944).

Fixed

  • Keypair.verify now returns false instead of throwing when the signature is invalid (#892).
  • Memo.id now correctly rejects negative values, decimal values, and values exceeding the uint64 maximum (2^64 - 1); the error message now correctly says uint64 (#892).
  • Operation._toXDRPrice now accepts price objects with n: 0 (a zero numerator was previously treated as falsy and fell through to float approximation) (#892).
  • SignerKey.decodeSignerKey now reads the exact payload length from the 4-byte length prefix when decoding signedPayload signer keys, preventing data truncation or over-read (#892).
  • TransactionBuilder.cloneFrom now correctly re-encodes extraSigners as StrKey strings (they were previously passed as raw XDR objects) (#892).
  • TransactionBuilder.cloneFrom now uses Math.floor when computing unscaledFee to prevent fractional fee values (#892).
  • TransactionBuilder now floors Date timebounds to integer UNIX timestamps (#892).
  • Auth.bytesToInt64 now correctly handles bytes with upper-32-bit values set by processing each 32-bit half independently (#891).
  • ScInt constructor now correctly handles string input (#891).
  • Soroban.parseTokenAmount now throws when the input value has more decimal places than the specified decimals argument (#891).
  • XDR Array and VarArray decoding now fails fast when the declared array length exceeds the remaining bytes, via @stellar/js-xdr (#132).

v14.1.0:

Added

  • Implemented TransactionBuilder.addSacTransferOperation to remove the need for simulation for SAC (Stellar Asset Contract) transfers by creating the appropriate auth entries and footprint (#861).

Fixed

  • TransactionBuilder.build now adds this.sorobanData.resourceFee() to baseFee when provided (#861).
  • The generated XDR type declarations for unions with integer discriminants now use constructors instead of named static methods (stellar/dts-xdr#9) (#874).
Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​stellar/stellar-base since your current version.


Updates axios from 1.13.5 to 1.16.0

Release notes

Sourced from axios's releases.

v1.16.0 — May 2, 2026

This release adds support for the QUERY HTTP method and a new ECONNREFUSED error constant, lands a substantial wave of HTTP, fetch, and XHR adapter bug fixes around redirects, aborts, headers, and timeouts, and welcomes 23 new contributors.

⚠️ Notable Changes

A handful of fixes in this release are either security-adjacent or change observable behaviour. Please review before upgrading:

  • Fetch adapter now enforces maxBodyLength and maxContentLength. These limits were silently ignored on the fetch adapter prior to 1.16.0 — anyone relying on them as a safety net (DoS protection, accidental large uploads) had no protection. (#10795)
  • Proxy requests now preserve user-supplied Host headers. Previously, the proxy path could overwrite a custom Host. Virtual-host-style routing through a proxy will now behave correctly. (#10822)
  • Basic auth credentials embedded in URLs are now URL-decoded. If you have percent-encoded credentials in a URL (e.g. https://user:p%40ss@host), the decoded value is what now goes on the wire. (#10825)
  • parseProtocol now strictly requires a colon in the protocol separator. Strings that loosely parsed as protocols before may no longer match. (#10729)
  • Deprecated unescape() replaced with modern UTF-8 encoding. Non-ASCII URL handling is now spec-correct; consumers depending on legacy unescape() quirks may see different output bytes. (#7378)
  • transformRequest input typing change was reverted. The typing change introduced in #10745 was reverted in #10810 after follow-up review — net behavior is unchanged from 1.15.2. (#10745, #10810)

🚀 New Features

  • QUERY HTTP Method: Added support for the QUERY HTTP method across adapters and type definitions. (#10802)
  • ECONNREFUSED Error Constant: Exposed ECONNREFUSED as a constant on AxiosError so callers can match connection-refused failures without comparing string literals (closes #6485). (#10680)
  • Encode Helper Export: Exported the internal encode helper from buildURL so userland param serializers can reuse the same encoding logic that axios uses internally. (#6897)

🐛 Bug Fixes

  • HTTP Adapter — Redirects & Headers: Cleared stale headers when a redirect targets a no-proxy host, fixed the redirect listener chain so listeners no longer stack across hops, restored the missing requestDetails argument on beforeRedirect, preserved user-supplied Host headers when forwarding through a proxy, and properly URL-decoded basic auth credentials. (#10794, #10800, #6241, #10822, #10825)
  • HTTP Adapter — Streams & Timeouts: Preserved the partial response object on AxiosError when a stream is aborted after headers arrive, honoured the timeout option during the connect phase when redirects are disabled, and resolved an unsettled-promise hang when an aborted request was combined with compression and maxRedirects: 0. (#10708, #10819, #7149)
  • Fetch Adapter: Enforced maxBodyLength / maxContentLength in the fetch adapter, set the User-Agent header to match the HTTP adapter, preserved the original abort reason instead of replacing it with a generic error, and deferred global access so importing the module no longer throws a TypeError in restricted environments. (#10795, #10772, #10806, #7260)
  • XHR Adapter: Unsubscribed the cancelToken and AbortSignal listeners on the error, timeout, and abort code paths to prevent leaked subscriptions. (#10787)
  • Error Handling: Attached the parsed response to AxiosError when JSON.parse fails inside dispatchRequest, prevented settle from emitting undefined error codes, and tightened the parseProtocol regex to require a colon in the protocol separator. (#10724, #7276, #10729)
  • Types & Exports: Aligned the CommonJS CancelToken typings with the ESM build, fixed a compiler error caused by RawAxiosHeaders, and re-exported create from the package index. (#7414, #6389, #6460)
  • UTF-8 Encoding: Replaced the deprecated unescape() call with a modern UTF-8 encoding implementation. (#7378)
  • Misc Cleanup: Resolved a batch of small inconsistencies and gadget-level issues across the codebase. (#10833)

🔧 Maintenance & Chores

  • Refactor — ES6 Modernisation: Modernised the utils module and XHR adapter to use ES6 features, and tidied the multipart boundary error message. (#10588, #7419)
  • Tests: Hardened the HTTP test server lifecycle to fix flaky FormData EPIPE failures, fixed Win32 platform support for the pipe tests, and corrected an incorrect test assumption. (#10820, #10791, #10796)
  • Docs: Documented paramsSerializer.encode for strict RFC 3986 query encoding, updated the parseReviver TypeScript definitions and configuration docs for ES2023, added timeout guidance to the README's first async example, and expanded notes around the recent type changes. (#10821, #10782, #10759, #10804)
  • Reverted: Reverted the transformRequest input typing change from #10745 after follow-up review. (#10745, #10810)
  • Dependencies: Bumped actions/setup-node, the github-actions group, and postcss (in /docs) to their latest versions. (#10785, #10813, #10814)
  • Release: Updated changelog and packages, and prepared the 1.16.0 release. (#10790, #10834)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

... (truncated)

Changelog

Sourced from axios's changelog.

v1.16.0 — May 2, 2026

This release adds support for the QUERY HTTP method and a new ECONNREFUSED error constant, lands a substantial wave of HTTP, fetch, and XHR adapter bug fixes around redirects, aborts, headers, and timeouts, and welcomes 23 new contributors.

⚠️ Notable Changes

A handful of fixes in this release are either security-adjacent or change observable behaviour. Please review before upgrading:

  • Fetch adapter now enforces maxBodyLength and maxContentLength. These limits were silently ignored on the fetch adapter prior to 1.16.0 — anyone relying on them as a safety net (DoS protection, accidental large uploads) had no protection. (#10795)
  • Proxy requests now preserve user-supplied Host headers. Previously, the proxy path could overwrite a custom Host. Virtual-host-style routing through a proxy will now behave correctly. (#10822)
  • Basic auth credentials embedded in URLs are now URL-decoded. If you have percent-encoded credentials in a URL (e.g. https://user:p%40ss@host), the decoded value is what now goes on the wire. (#10825)
  • parseProtocol now strictly requires a colon in the protocol separator. Strings that loosely parsed as protocols before may no longer match. (#10729)
  • Deprecated unescape() replaced with modern UTF-8 encoding. Non-ASCII URL handling is now spec-correct; consumers depending on legacy unescape() quirks may see different output bytes. (#7378)
  • transformRequest input typing change was reverted. The typing change introduced in #10745 was reverted in #10810 after follow-up review — net behavior is unchanged from 1.15.2. (#10745, #10810)

🚀 New Features

  • QUERY HTTP Method: Added support for the QUERY HTTP method across adapters and type definitions. (#10802)
  • ECONNREFUSED Error Constant: Exposed ECONNREFUSED as a constant on AxiosError so callers can match connection-refused failures without comparing string literals (closes #6485). (#10680)
  • Encode Helper Export: Exported the internal encode helper from buildURL so userland param serializers can reuse the same encoding logic that axios uses internally. (#6897)

🐛 Bug Fixes

  • HTTP Adapter — Redirects & Headers: Cleared stale headers when a redirect targets a no-proxy host, fixed the redirect listener chain so listeners no longer stack across hops, restored the missing requestDetails argument on beforeRedirect, preserved user-supplied Host headers when forwarding through a proxy, and properly URL-decoded basic auth credentials. (#10794, #10800, #6241, #10822, #10825)
  • HTTP Adapter — Streams & Timeouts: Preserved the partial response object on AxiosError when a stream is aborted after headers arrive, honoured the timeout option during the connect phase when redirects are disabled, and resolved an unsettled-promise hang when an aborted request was combined with compression and maxRedirects: 0. (#10708, #10819, #7149)
  • Fetch Adapter: Enforced maxBodyLength / maxContentLength in the fetch adapter, set the User-Agent header to match the HTTP adapter, preserved the original abort reason instead of replacing it with a generic error, and deferred global access so importing the module no longer throws a TypeError in restricted environments. (#10795, #10772, #10806, #7260)
  • XHR Adapter: Unsubscribed the cancelToken and AbortSignal listeners on the error, timeout, and abort code paths to prevent leaked subscriptions. (#10787)
  • Error Handling: Attached the parsed response to AxiosError when JSON.parse fails inside dispatchRequest, prevented settle from emitting undefined error codes, and tightened the parseProtocol regex to require a colon in the protocol separator. (#10724, #7276, #10729)
  • Types & Exports: Aligned the CommonJS CancelToken typings with the ESM build, fixed a compiler error caused by RawAxiosHeaders, and re-exported create from the package index. (#7414, #6389, #6460)
  • UTF-8 Encoding: Replaced the deprecated unescape() call with a modern UTF-8 encoding implementation. (#7378)
  • Misc Cleanup: Resolved a batch of small inconsistencies and gadget-level issues across the codebase. (#10833)

🔧 Maintenance & Chores

  • Refactor — ES6 Modernisation: Modernised the utils module and XHR adapter to use ES6 features, and tidied the multipart boundary error message. (#10588, #7419)
  • Tests: Hardened the HTTP test server lifecycle to fix flaky FormData EPIPE failures, fixed Win32 platform support for the pipe tests, and corrected an incorrect test assumption. (#10820, #10791, #10796)
  • Docs: Documented paramsSerializer.encode for strict RFC 3986 query encoding, updated the parseReviver TypeScript definitions and configuration docs for ES2023, added timeout guidance to the README's first async example, and expanded notes around the recent type changes. (#10821, #10782, #10759, #10804)
  • Reverted: Reverted the transformRequest input typing change from #10745 after follow-up review. (#10745, #10810)
  • Dependencies: Bumped actions/setup-node, the github-actions group, and postcss (in /docs) to their latest versions. (#10785, #10813, #10814)
  • Release: Updated changelog and packages, and prepared the 1.16.0 release. (#10790, #10834)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

... (truncated)

Commits
  • df53d7d chore(release): prepare release 1.16.0 (#10834)
  • 9d92bcd fix: gadgets and smaller issues (#10833)
  • 5107ee6 fix: prevent undefined error codes in settle (#7276)
  • e573499 fix(fetch): defer global access in fetch adapter (#7260)
  • ad68e1a fix(http): honor timeout during connect without redirects (#10819)
  • 2a51828 fix(http): decode URL basic auth credentials (#10825)
  • 0e8b6bb fix(http): preserve user-supplied Host header when forwarding through a proxy...
  • 79f39e1 docs: document paramsSerializer.encode for strict RFC 3986 query encoding (#1...
  • 0fe3a5f [Docs/Types] Update parseReviver TypeScript definitions for ES2023 and add ...
  • cd6737f chore: matches the sibling responseStream.on(aborted) handler and added tests...
  • Additional commits viewable in compare view
Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates dotenv from 17.2.4 to 17.4.2

Changelog

Sourced from dotenv's changelog.

17.4.2 (2026-04-12)

Changed

  • Improved skill files - tightened up details (#1009)

17.4.1 (2026-04-05)

Changed

  • Change text injecting to injected (#1005)

17.4.0 (2026-04-01)

Added

  • Add skills/ folder with focused agent skills: skills/dotenv/SKILL.md (core usage) and skills/dotenvx/SKILL.md (encryption, multiple environments, variable expansion) for AI coding agent discovery via the skills.sh ecosystem (npx skills add motdotla/dotenv)

Changed

  • Tighten up logs: ◇ injecting env (14) from .env (#1003)

17.3.1 (2026-02-12)

Changed

  • Fix as2 example command in README and update spanish README

17.3.0 (2026-02-12)

Added

  • Add a new README section on dotenv’s approach to the agentic future.

Changed

  • Rewrite README to get humans started more quickly with less noise while simultaneously making more accessible for llms and agents to go deeper into details.
Commits

Updates glob from 13.0.1 to 13.0.6

Commits
Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates openapi-fetch from 0.16.0 to 0.17.0

Release notes

Sourced from openapi-fetch's releases.

openapi-fetch@0.17.0

Minor Changes

  • #2549 a690e52 Thanks @​abumalick! - Add readOnly/writeOnly support via --read-write-markers flag. When enabled, readOnly properties are wrapped with $Read<T> and writeOnly properties with $Write<T>. openapi-fetch uses Readable<T> and Writable<T> helpers to exclude these properties from responses and request bodies respectively.

Patch Changes

  • #2572 9350ddf Thanks @​luis-guideti! - Do not treat Content-Length=0 as empty when Transfer-Encoding is chunked

  • Updated dependencies [a690e52]:

    • openapi-typescript-helpers@0.1.0
Changelog

Sourced from openapi-fetch's changelog.

0.17.0

Minor Changes

  • #2549 a690e52 Thanks @​abumalick! - Add readOnly/writeOnly support via --read-write-markers flag. When enabled, readOnly properties are wrapped with $Read<T> and writeOnly properties with $Write<T>. openapi-fetch uses Readable<T> and Writable<T> helpers to exclude these properties from responses and request bodies respectively.

Patch Changes

  • #2572 9350ddf Thanks @​luis-guideti! - Do not treat Content-Length=0 as empty when Transfer-Encoding is chunked

  • Updated dependencies [a690e52]:

    • openapi-typescript-helpers@0.1.0
Commits
  • 5709d33 [ci] release (#2611)
  • 9350ddf Do not treat Content-Length=0 as empty when Transfer-Encoding is chunked (#2572)
  • a690e52 feat(openapi-typescript): add readOnly/writeOnly support via markers (#2549)
  • a06e6c3 chore(deps): update dependency superagent to v10.3.0 (#2595)
  • See full diff in compare view

Updates openapi-typescript from 7.12.0 to 7.13.0

Release notes

Sourced from openapi-typescript's releases.

openapi-typescript@7.13.0

Minor Changes

  • #2549 a690e52 Thanks @​abumalick! - Add readOnly/writeOnly support via --read-write-markers flag. When enabled, readOnly properties are wrapped with $Read<T> and writeOnly properties with $Write<T>. openapi-fetch uses Readable<T> and Writable<T> helpers to exclude these properties from responses and request bodies respectively.
Changelog

Sourced from openapi-typescript's changelog.

7.13.0

Minor Changes

  • #2549 a690e52 Thanks @​abumalick! - Add readOnly/writeOnly support via --read-write-markers flag. When enabled, readOnly properties are wrapped with $Read<T> and writeOnly properties with $Write<T>. openapi-fetch uses Readable<T> and Writable<T> helpers to exclude these properties from responses and request bodies respectively.
Commits

Updates ws from 8.19.0 to 8.20.0

Release notes

Sourced from ws's releases.

8.20.0

Features

  • Added exports for the PerMessageDeflate class and utilities for the Sec-WebSocket-Extensions and Sec-WebSocket-Protocol headers (d3503c1f).
Commits
  • 8439255 [dist] 8.20.0
  • d3503c1 [minor] Export the PerMessageDeflate class and header utils
  • 3ee5349 [api] Convert the isServer and maxPayload parameters to options
  • 91707b4 [doc] Add missing space
  • 8b55319 [pkg] Update eslint to version 10.0.1
  • ca533a5 [pkg] Update globals to version 17.0.0
  • See full diff in compare view

Updates zod from 4.3.6 to 4.4.3

Release notes

Sourced from zod's releases.

v4.4.3

Commits:

  • 4c2fa95ce3f3390fbc522324e406b4e9e89b88f9 docs: use Zernio primary wordmark for gold sponsor logo
  • 2aeec83eb135e3a83756e973ef44845fc5a455d2 docs: prune lapsed gold sponsors and rebalance logo sizing
  • 7391be88ac1ee5cd02057f5ccc012a1f5df4efd0 docs: prune lapsed silver/bronze sponsors and add active ones
  • 2c703322a21b4e2b12f33f49ea8430c451a68b4f docs: normalize bronze sponsor logos to github avatar pattern
  • 9195250cab0e7950efe39c3926d6c203b4b0a170 docs: remove Mintlify from bronze sponsors (churned)
  • b8dffe9e62f17e6571e6249d05cc5102b54d94e4 docs: remove Numeric and Speakeasy (2+ missed monthly cycles)
  • 1cab69383fcdeae2a366d5e2a2fc4d8fc765d168 fix(v4): restore catch handling for absent object keys (#5937) (#5939)
  • c2be4f819064eed62c7c350a2d399b5faecd15f8 fix(v4): generalize optin/fallback to tr...

    Description has been truncated

@dependabot
deps: bump the all-dependencies group across 1 directory with 21 updates
5e0b6e5 
Bumps the all-dependencies group with 21 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@canton-network/wallet-sdk](https://github.com/hyperledger-labs/splice-wallet-kernel/tree/HEAD/sdk/wallet-sdk) | `0.21.0` | `1.1.0` |
| @hardlydifficult/websocket | `1.0.2` | `1.0.73` |
| [@stellar/stellar-base](https://github.com/stellar/js-stellar-base) | `14.0.4` | `15.0.0` |
| [axios](https://github.com/axios/axios) | `1.13.5` | `1.16.0` |
| [dotenv](https://github.com/motdotla/dotenv) | `17.2.4` | `17.4.2` |
| [glob](https://github.com/isaacs/node-glob) | `13.0.1` | `13.0.6` |
| [openapi-fetch](https://github.com/openapi-ts/openapi-typescript/tree/HEAD/packages/openapi-fetch) | `0.16.0` | `0.17.0` |
| [openapi-typescript](https://github.com/openapi-ts/openapi-typescript/tree/HEAD/packages/openapi-typescript) | `7.12.0` | `7.13.0` |
| [ws](https://github.com/websockets/ws) | `8.19.0` | `8.20.0` |
| [zod](https://github.com/colinhacks/zod) | `4.3.6` | `4.4.3` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.2.2` | `25.6.0` |
| [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `8.55.0` | `8.59.2` |
| [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) | `8.55.0` | `8.59.2` |
| [eslint](https://github.com/eslint/eslint) | `9.39.2` | `10.3.0` |
| [jest](https://github.com/jestjs/jest/tree/HEAD/packages/jest) | `30.2.0` | `30.3.0` |
| [markdownlint-cli](https://github.com/igorshubovych/markdownlint-cli) | `0.47.0` | `0.48.0` |
| [npm-package-json-lint](https://github.com/tclindner/npm-package-json-lint) | `9.1.0` | `10.4.0` |
| [prettier](https://github.com/prettier/prettier) | `3.8.1` | `3.8.3` |
| [prettier-plugin-packagejson](https://github.com/matzkoh/prettier-plugin-packagejson) | `3.0.0` | `3.0.2` |
| [ts-jest](https://github.com/kulshekhar/ts-jest) | `29.4.6` | `29.4.9` |
| [typescript](https://github.com/microsoft/TypeScript) | `5.9.3` | `6.0.3` |



Updates `@canton-network/wallet-sdk` from 0.21.0 to 1.1.0
- [Release notes](https://github.com/hyperledger-labs/splice-wallet-kernel/releases)
- [Changelog](https://github.com/canton-network/wallet-gateway/blob/main/docs/RELEASES.md)
- [Commits](https://github.com/hyperledger-labs/splice-wallet-kernel/commits/@canton-network/wallet-sdk@1.1.0/sdk/wallet-sdk)

Updates `@hardlydifficult/websocket` from 1.0.2 to 1.0.73

Updates `@stellar/stellar-base` from 14.0.4 to 15.0.0
- [Release notes](https://github.com/stellar/js-stellar-base/releases)
- [Changelog](https://github.com/stellar/js-stellar-base/blob/master/CHANGELOG.md)
- [Commits](stellar/js-stellar-base@v14.0.4...v15.0.0)

Updates `axios` from 1.13.5 to 1.16.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.13.5...v1.16.0)

Updates `dotenv` from 17.2.4 to 17.4.2
- [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md)
- [Commits](motdotla/dotenv@v17.2.4...v17.4.2)

Updates `glob` from 13.0.1 to 13.0.6
- [Changelog](https://github.com/isaacs/node-glob/blob/main/changelog.md)
- [Commits](isaacs/node-glob@v13.0.1...v13.0.6)

Updates `openapi-fetch` from 0.16.0 to 0.17.0
- [Release notes](https://github.com/openapi-ts/openapi-typescript/releases)
- [Changelog](https://github.com/openapi-ts/openapi-typescript/blob/main/packages/openapi-fetch/CHANGELOG.md)
- [Commits](https://github.com/openapi-ts/openapi-typescript/commits/openapi-fetch@0.17.0/packages/openapi-fetch)

Updates `openapi-typescript` from 7.12.0 to 7.13.0
- [Release notes](https://github.com/openapi-ts/openapi-typescript/releases)
- [Changelog](https://github.com/openapi-ts/openapi-typescript/blob/main/packages/openapi-typescript/CHANGELOG.md)
- [Commits](https://github.com/openapi-ts/openapi-typescript/commits/openapi-typescript@7.13.0/packages/openapi-typescript)

Updates `ws` from 8.19.0 to 8.20.0
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.19.0...8.20.0)

Updates `zod` from 4.3.6 to 4.4.3
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.3.6...v4.4.3)

Updates `@types/node` from 25.2.2 to 25.6.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@typescript-eslint/eslint-plugin` from 8.55.0 to 8.59.2
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.59.2/packages/eslint-plugin)

Updates `@typescript-eslint/parser` from 8.55.0 to 8.59.2
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.59.2/packages/parser)

Updates `eslint` from 9.39.2 to 10.3.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v9.39.2...v10.3.0)

Updates `jest` from 30.2.0 to 30.3.0
- [Release notes](https://github.com/jestjs/jest/releases)
- [Changelog](https://github.com/jestjs/jest/blob/main/CHANGELOG.md)
- [Commits](https://github.com/jestjs/jest/commits/v30.3.0/packages/jest)

Updates `markdownlint-cli` from 0.47.0 to 0.48.0
- [Release notes](https://github.com/igorshubovych/markdownlint-cli/releases)
- [Commits](igorshubovych/markdownlint-cli@v0.47.0...v0.48.0)

Updates `npm-package-json-lint` from 9.1.0 to 10.4.0
- [Release notes](https://github.com/tclindner/npm-package-json-lint/releases)
- [Changelog](https://github.com/tclindner/npm-package-json-lint/blob/master/CHANGELOG.md)
- [Commits](tclindner/npm-package-json-lint@v9.1.0...v10.4.0)

Updates `prettier` from 3.8.1 to 3.8.3
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.8.1...3.8.3)

Updates `prettier-plugin-packagejson` from 3.0.0 to 3.0.2
- [Release notes](https://github.com/matzkoh/prettier-plugin-packagejson/releases)
- [Commits](matzkoh/prettier-plugin-packagejson@v3.0.0...v3.0.2)

Updates `ts-jest` from 29.4.6 to 29.4.9
- [Release notes](https://github.com/kulshekhar/ts-jest/releases)
- [Changelog](https://github.com/kulshekhar/ts-jest/blob/main/CHANGELOG.md)
- [Commits](kulshekhar/ts-jest@v29.4.6...v29.4.9)

Updates `typescript` from 5.9.3 to 6.0.3
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](microsoft/TypeScript@v5.9.3...v6.0.3)

---
updated-dependencies:
- dependency-name: "@canton-network/wallet-sdk"
  dependency-version: 1.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-dependencies
- dependency-name: "@hardlydifficult/websocket"
  dependency-version: 1.0.73
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: "@stellar/stellar-base"
  dependency-version: 15.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-dependencies
- dependency-name: axios
  dependency-version: 1.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: dotenv
  dependency-version: 17.4.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: glob
  dependency-version: 13.0.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: openapi-fetch
  dependency-version: 0.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: openapi-typescript
  dependency-version: 7.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: ws
  dependency-version: 8.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: zod
  dependency-version: 4.4.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: "@types/node"
  dependency-version: 25.6.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: "@typescript-eslint/eslint-plugin"
  dependency-version: 8.59.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: "@typescript-eslint/parser"
  dependency-version: 8.59.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: eslint
  dependency-version: 10.3.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: all-dependencies
- dependency-name: jest
  dependency-version: 30.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: markdownlint-cli
  dependency-version: 0.48.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: npm-package-json-lint
  dependency-version: 10.4.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: all-dependencies
- dependency-name: prettier
  dependency-version: 3.8.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: prettier-plugin-packagejson
  dependency-version: 3.0.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: ts-jest
  dependency-version: 29.4.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: typescript
  dependency-version: 6.0.3
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: all-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 11, 2026
@socket-security
Copy link
Copy Markdown

socket-security Bot commented May 11, 2026

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedjest@​30.2.0 ⏵ 30.3.0100 +110070 +198100
Updated@​typescript-eslint/​parser@​8.55.0 ⏵ 8.59.2100 +110071 +198100
Updated@​hardlydifficult/​websocket@​1.0.2 ⏵ 1.0.7375100100 +196 +7100
Updated@​typescript-eslint/​eslint-plugin@​8.55.0 ⏵ 8.59.28810080 +198100
Updated@​types/​node@​25.2.2 ⏵ 25.6.01001008196100
Updatedprettier-plugin-packagejson@​3.0.0 ⏵ 3.0.21001008186100
Updatedglob@​13.0.1 ⏵ 13.0.694 -51009985100
Updatedopenapi-typescript@​7.12.0 ⏵ 7.13.099 +1100100 +185 -1100
Updatedmarkdownlint-cli@​0.47.0 ⏵ 0.48.09910010086100
Updatedopenapi-fetch@​0.16.0 ⏵ 0.17.099 +1100100 +186100
Updatedaxios@​1.13.5 ⏵ 1.16.087 -1100 +4010096100
Addedws@​8.20.09810010088100
Updated@​canton-network/​wallet-sdk@​0.21.0 ⏵ 1.1.09710089 +296100
Updatedeslint@​9.39.2 ⏵ 10.3.089 +110010095100
Addedtypescript@​6.0.3100100909890
Updatedprettier@​3.8.1 ⏵ 3.8.39010097 +195100
Updatedts-jest@​29.4.6 ⏵ 29.4.9971009492100
Updatednpm-package-json-lint@​9.1.0 ⏵ 10.4.099 +110010093 +12100
Updateddotenv@​17.2.4 ⏵ 17.4.29910010094100
Updated@​stellar/​stellar-base@​14.0.4 ⏵ 15.0.09710010095 +4100
Updatedzod@​4.3.6 ⏵ 4.4.3100100100 +196100

View full report

@socket-security
Copy link
Copy Markdown

socket-security Bot commented May 11, 2026

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm @typescript-eslint/eslint-plugin is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package.json → npm/@typescript-eslint/eslint-plugin@8.59.2

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript-eslint/eslint-plugin@8.59.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github May 25, 2026

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this May 25, 2026
@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/all-dependencies-978ea927a8 branch May 25, 2026 22:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants