Skip to content

chore(deps): bump the production-dependencies group across 1 directory with 3 updates - #66

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/production-dependencies-98e79721b4
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/production-dependencies-98e79721b4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 9, 2026 •

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 3 updates in the / directory: @emulators/core, graphql and jose.

Updates @emulators/core from 0.12.3 to 0.13.0

Release notes

Sourced from @​emulators/core's releases.

v0.13.0

New Features

  • Added local MCP server with npx emulate mcp so agents can list services, create configurations, and start or stop emulators through shared CLI tools (#331)

Improvements

  • Centralized CLI commands and startup lifecycle to keep options, startup readiness, and shutdown behavior consistent across CLI and MCP entry points (#332)

Contributors

Changelog

Sourced from @​emulators/core's changelog.

0.13.0

New Features

  • Added local MCP server with npx emulate mcp so agents can list services, create configurations, and start or stop emulators through shared CLI tools (#331)

Improvements

  • Centralized CLI commands and startup lifecycle to keep options, startup readiness, and shutdown behavior consistent across CLI and MCP entry points (#332)

Contributors

Commits

Updates graphql from 16.14.2 to 17.0.2

Release notes

Sourced from graphql's releases.

v17.0.2 (2026-07-03)

Bug Fix 🐞

Polish 💅

Committers: 2

v17.0.1 (2026-06-16)

Bug Fix 🐞

  • #4824 fix(diagnostics): emit asyncStart after promise settlement to match native tracePromise (@​logaretm)

Internal 🏠

Committers: 2

v17.0.0 (2026-06-15)

New Feature 🚀

Bug Fix 🐞

Docs 📝

... (truncated)

Commits
  • 71606d7 chore(release): v17.0.2
  • 101de34 fix: detect default-value changes on input object fields (#4832)
  • 82da713 fix(mapSchemaConfig): fix context for schema argument mapper (#4829)
  • 9617473 chore(release): v17.0.1
  • 851bd6a chore(release): protect latest release channels (#4825)
  • c471d36 fix(diagnostics): emit asyncStart after promise settlement to match native `t...
  • 3f3895f chore(npm): remove obsolete ESM-only package build (#4823)
  • c7e494a chore(release): v17.0.0
  • d977f66 docs: post 17.rc-0 update (#4817)
  • 39f865f docs: document @experimental_disableErrorPropagation (#4820)
  • Additional commits viewable in compare view

Updates jose from 6.2.12 to 6.2.15

Release notes

Sourced from jose's releases.

v6.2.15

Fixes

  • jwe: cancel decompression when output exceeds the limit (67541aa)
  • jwks: reject negative cache durations (a3b296f)
  • jwt: reject negative clockTolerance (67d6c83)

v6.2.14

Fixes

  • types: preserve contextual JWT payload inference (0dbf7a0), closes #911

v6.2.13

Refactor

  • align terminology with JOSE specifications (bafcb74)
  • preserve underlying error causes (724ba24), closes #908
Changelog

Sourced from jose's changelog.

6.2.15 (2026-11-01)

Fixes

  • jwe: cancel decompression when output exceeds the limit (67541aa)
  • jwks: reject negative cache durations (a3b296f)
  • jwt: reject negative clockTolerance (67d6c83)

6.2.14 (2026-10-29)

Fixes

  • types: preserve contextual JWT payload inference (0dbf7a0), closes #911

6.2.13 (2026-10-20)

Refactor

  • align terminology with JOSE specifications (bafcb74)
  • preserve underlying error causes (724ba24), closes #908
Commits
  • f931aa5 chore(release): 6.2.15
  • c2dd2ff test: verify decompression is cancelled on output limit
  • 67d6c83 fix(jwt): reject negative clockTolerance
  • 67541aa fix(jwe): cancel decompression when output exceeds the limit
  • a3b296f fix(jwks): reject negative cache durations
  • f3737f9 chore(deps-dev): bump electron from 45.0.0 to 45.1.0 in /tap/electron
  • f2fbc97 chore(deps-dev): bump workerd in /tap/workerd
  • 4533e9d chore(deps): bump the actions group with 4 updates
  • f9cee77 chore: cleanup after release
  • 5a6a5b6 chore(release): 6.2.14
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Summary by cubic

Updates production dependencies across the monorepo, including a major version bump for graphql (16 → 17) that may require testing for breaking changes.

  • @emulators/core advances to 0.13.0, adding a local MCP server and centralizing CLI startup lifecycle.
  • graphql advances to 17.0.2; review the upstream majors for breaking changes.
  • jose advances to 6.2.15 with fixes for decompression limits and rejection of negative cache durations and clock tolerance.
  • Lockfile now retains @emulators/core@0.12.3 for nested @emulators/* dependencies that still pin the older version.

Written for commit 34be71d. Summary will update on new commits.

Turn on auto-fix

…y with 3 updates

Bumps the production-dependencies group with 3 updates in the / directory: [@emulators/core](https://github.com/vercel-labs/emulate/tree/HEAD/packages/@emulators/core), [graphql](https://github.com/graphql/graphql-js) and [jose](https://github.com/panva/jose).


Updates `@emulators/core` from 0.12.3 to 0.13.0
- [Release notes](https://github.com/vercel-labs/emulate/releases)
- [Changelog](https://github.com/vercel-labs/emulate/blob/main/CHANGELOG.md)
- [Commits](https://github.com/vercel-labs/emulate/commits/v0.13.0/packages/@emulators/core)

Updates `graphql` from 16.14.2 to 17.0.2
- [Release notes](https://github.com/graphql/graphql-js/releases)
- [Commits](graphql/graphql-js@v16.14.2...v17.0.2)

Updates `jose` from 6.2.12 to 6.2.15
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](panva/jose@v6.2.12...v6.2.15)

---
updated-dependencies:
- dependency-name: "@emulators/core"
  dependency-version: 0.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: graphql
  dependency-version: 17.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: jose
  dependency-version: 6.2.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 9, 2026
@greptile-apps

greptile-apps Bot commented Nov 9, 2026

Copy link
Copy Markdown

PR author is in the excluded authors list.

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Added@​emulators/​core@​0.13.0991009096100
Updatedjose@​6.2.12 ⏵ 6.2.16100100100 +194100
Updatedgraphql@​16.14.2 ⏵ 17.0.2100 +110010098100

View full report

@codacy-production

Copy link
Copy Markdown

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric Results
Complexity 0
Duplication 0

View in Codacy

NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants