Skip to content

Bump the npm-minor-patch group across 1 directory with 4 updates - #707

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-patch-a8567c99f6
Closed

Bump the npm-minor-patch group across 1 directory with 4 updates#707
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-patch-a8567c99f6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm-minor-patch group with 4 updates in the / directory: js-yaml, marked, mppx and posthog-node.

Updates js-yaml from 5.2.2 to 5.2.3

Changelog

Sourced from js-yaml's changelog.

[5.2.3] - 2026-08-01

Fixed

  • Prevent prototype fallback when resolving tags and mapping entries, #782.
  • Resolve !!timestamp years 0000-0099 correctly, #775.
  • Preserve implicit null mapping values before document markers and reject unpaired mapping event streams, #784.
  • Preserve folded scalar values with tab-indented lines when round-tripping a parsed AST through present(); dump() and loading are unaffected, #780.
Commits
  • 6740445 5.2.3 released
  • 94e766d Update changelog
  • c3bd7ca Polish previous commit, #780
  • 00209b6 presenter: treat a tab-indented line in a folded scalar as more-indented (#780)
  • 40fcb4f Fix missing mapping values before document markers and reject unpaired mappin...
  • 49280f3 Fix !!timestamp resolution for years 0000-0099, #775
  • 355dc96 fix: prevent prototype fallback in tag and harden object lookups, #782 (than...
  • d524f83 docs: add contributing guidelines
  • See full diff in compare view

Updates marked from 18.0.7 to 18.0.9

Release notes

Sourced from marked's releases.

v18.0.9

18.0.9 (2026-08-04)

Bug Fixes

  • an unmatched strong run before emphasis stays literal (#4008) (e8544e6)
  • Fix spurious deeper nesting in a blockquote continuation (#4030) (452f1ed)
  • pedantic foo: and "word" emphasis parsing (#3999) (823093f)

v18.0.8

18.0.8 (2026-08-04)

Bug Fixes

  • fall back to default checkbox renderer when extension returns false (#4023) (e1b6139)
Commits
  • 8e858a4 chore(release): 18.0.9 [skip ci]
  • 641e5df docs: explain partial extensions in use (#4033)
  • 452f1ed fix: Fix spurious deeper nesting in a blockquote continuation (#4030)
  • e8544e6 fix: an unmatched strong run before emphasis stays literal (#4008)
  • 823093f fix: pedantic foo: and "word" emphasis parsing (#3999)
  • 12a84a8 chore(release): 18.0.8 [skip ci]
  • 3a1a706 chore(deps-dev): bump undici from 6.24.0 to 6.27.0 (#4042)
  • 58ed4af chore(deps-dev): bump eslint from 10.7.0 to 10.8.0 (#4032)
  • 01539fb chore(deps-dev): bump @​semantic-release/git from 10.0.1 to 11.0.1 (#4031)
  • e1b6139 fix: fall back to default checkbox renderer when extension returns false (#4023)
  • Additional commits viewable in compare view

Updates mppx from 0.8.14 to 0.8.15

Release notes

Sourced from mppx's releases.

mppx@0.8.15

Patch Changes

  • 053d37d: Bumped postcss (via vite/vite-plus) and tar (via prool) to patched versions, resolving a path-traversal advisory in postcss's source map loading and a stack-overflow DoS advisory in tar's path filtering.
  • f538450: Replaced the expired Viem preview with the current published release, preserved primitive subscription authorization validation with the updated signature types, and resolved the brace-expansion audit advisory.
  • 7a277bc: Fixed mppx validate intermittently reporting a false InsufficientBalance error when paying with an ephemeral Tempo testnet wallet, mislabeling resolved chains in payment errors, and skipping other payment methods after a Tempo testnet challenge succeeded.
  • 36bc41e: Fixed repeated session challenge retries and durable session rollback after failed payments.
  • c69087a: Refreshed expired session challenges before creating later WebSocket vouchers.
  • 538e515: Prevent sponsored Tempo charges from returning a fresh payment challenge after a concurrent budget reconciliation observes their onchain receipt.
  • b900118: Fixed Tempo relay charges to delegate push payment finalization without re-broadcasting transactions.
  • f4ac248: Fixed low-level session fetches retrying vouchers for unaccepted channel opens.
Changelog

Sourced from mppx's changelog.

0.8.15

Patch Changes

  • 053d37d: Bumped postcss (via vite/vite-plus) and tar (via prool) to patched versions, resolving a path-traversal advisory in postcss's source map loading and a stack-overflow DoS advisory in tar's path filtering.
  • f538450: Replaced the expired Viem preview with the current published release, preserved primitive subscription authorization validation with the updated signature types, and resolved the brace-expansion audit advisory.
  • 7a277bc: Fixed mppx validate intermittently reporting a false InsufficientBalance error when paying with an ephemeral Tempo testnet wallet, mislabeling resolved chains in payment errors, and skipping other payment methods after a Tempo testnet challenge succeeded.
  • 36bc41e: Fixed repeated session challenge retries and durable session rollback after failed payments.
  • c69087a: Refreshed expired session challenges before creating later WebSocket vouchers.
  • 538e515: Prevent sponsored Tempo charges from returning a fresh payment challenge after a concurrent budget reconciliation observes their onchain receipt.
  • b900118: Fixed Tempo relay charges to delegate push payment finalization without re-broadcasting transactions.
  • f4ac248: Fixed low-level session fetches retrying vouchers for unaccepted channel opens.
Commits
  • 1231afd chore: version packages (#706)
  • f4ac248 fix: retry unaccepted session opens (#719)
  • 7532e5b chore(deps-dev): bump the npm-development group across 1 directory with 4 upd...
  • d4683a7 chore(deps): bump actions/checkout in the github-actions group (#716)
  • 28818f0 chore(deps): bump @​hono/node-server (#704)
  • f538450 fix: refresh viem and audit dependencies (#717)
  • 7a277bc fix: make mppx validate exercise real testnet payments reliably (#711)
  • 053d37d fix: bump postcss and tar to patched versions (#712)
  • c69087a fix(tempo): refresh websocket session challenges (#709)
  • 36bc41e fix: preserve session state across retries (#701)
  • Additional commits viewable in compare view

Updates posthog-node from 5.46.1 to 5.47.9

Release notes

Sourced from posthog-node's releases.

posthog-node@5.47.9

5.47.9

Patch Changes

  • #4350 facb4c1 Thanks @​marandaneto! - Fix enableExceptionAutocapture suppressing Node's default crash on unhandled promise rejections; fatal rejections in strict or warn-with-error-code mode and rejections handled by another unhandledRejection listener are no longer captured. (2026-08-04)

posthog-node@5.47.8

5.47.8

Patch Changes

posthog-node@5.47.7

5.47.7

Patch Changes

posthog-node@5.47.6

5.47.6

Patch Changes

  • #4381 f3a71a1 Thanks @​marandaneto! - Clear completed lifecycle timeout handles so successful shutdowns do not leave timers running. (2026-08-03)
  • Updated dependencies [f3a71a1]:
    • @​posthog/core@​1.46.4

posthog-node@5.47.5

5.47.5

Patch Changes

  • #4155 eb0a793 Thanks @​ATKasem! - fix: personProperties and groupProperties on the feature flag methods are no longer typed as Record<string, string>, so numeric and boolean values type-check without a cast. Local evaluation already handled them — matchProperty takes Record<string, any> and compares numerically for gt/gte/lt/lte — only the public types disagreed. These now use the shared Properties type (personProperties?: Properties, groupProperties?: Record<string, Properties>), matching setPersonPropertiesForFlags/setGroupPropertiesForFlags so the any can be narrowed later. Types only, no runtime change. (2026-08-03)
  • Updated dependencies [eb0a793]:
    • @​posthog/core@​1.46.3

posthog-node@5.47.4

5.47.4

Patch Changes

... (truncated)

Changelog

Sourced from posthog-node's changelog.

5.47.9

Patch Changes

  • #4350 facb4c1 Thanks @​marandaneto! - Fix enableExceptionAutocapture suppressing Node's default crash on unhandled promise rejections; fatal rejections in strict or warn-with-error-code mode and rejections handled by another unhandledRejection listener are no longer captured. (2026-08-04)

5.47.8

Patch Changes

5.47.7

Patch Changes

5.47.6

Patch Changes

  • #4381 f3a71a1 Thanks @​marandaneto! - Clear completed lifecycle timeout handles so successful shutdowns do not leave timers running. (2026-08-03)
  • Updated dependencies [f3a71a1]:
    • @​posthog/core@​1.46.4

5.47.5

Patch Changes

  • #4155 eb0a793 Thanks @​ATKasem! - fix: personProperties and groupProperties on the feature flag methods are no longer typed as Record<string, string>, so numeric and boolean values type-check without a cast. Local evaluation already handled them — matchProperty takes Record<string, any> and compares numerically for gt/gte/lt/lte — only the public types disagreed. These now use the shared Properties type (personProperties?: Properties, groupProperties?: Record<string, Properties>), matching setPersonPropertiesForFlags/setGroupPropertiesForFlags so the any can be narrowed later. Types only, no runtime change. (2026-08-03)
  • Updated dependencies [eb0a793]:
    • @​posthog/core@​1.46.3

5.47.4

Patch Changes

... (truncated)

Commits
  • 1466fdd chore: update versions and lockfile [version bump]
  • facb4c1 fix(node): preserve unhandled rejection semantics (#4350)
  • 4d8df50 fix(mcp): respect reserved argument ownership (#4379)
  • 66ef274 chore: update versions and lockfile [version bump]
  • d4ffb83 fix(node): schedule feature flag polling after requests settle (#4348)
  • 7d2bdbb chore: update versions and lockfile [version bump]
  • 1cf9c6d fix(node): bound stack source context file reads (#4352)
  • e4edb42 chore: update versions and lockfile [version bump]
  • f3a71a1 fix: clear completed lifecycle timeout handles (#4381)
  • 3e2e446 chore: update versions and lockfile [version bump]
  • Additional commits viewable in compare view

@dependabot @github

dependabot Bot commented on behalf of github Aug 7, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@socket-security

socket-security Bot commented Aug 7, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatednpm/​posthog-node@​5.46.1 ⏵ 5.47.992 +110079 +1100 +1100
Updatednpm/​marked@​18.0.7 ⏵ 18.0.9100100100 +19880
Updatednpm/​mppx@​0.8.14 ⏵ 0.8.1582 +1100100 +198 +1100
Updatednpm/​js-yaml@​5.2.2 ⏵ 5.2.3100 +1100100 +194 +3100

View full report

@MikeyPetrillo

MikeyPetrillo commented Aug 7, 2026

Copy link
Copy Markdown
Owner

@dependabot rebase

@dependabot
Bump the npm-minor-patch group across 1 directory with 4 updates
fb63ec9 
Bumps the npm-minor-patch group with 4 updates in the / directory: [js-yaml](https://github.com/nodeca/js-yaml), [marked](https://github.com/markedjs/marked), [mppx](https://github.com/wevm/mppx) and [posthog-node](https://github.com/PostHog/posthog-js/tree/HEAD/packages/node).


Updates `js-yaml` from 5.2.2 to 5.2.3
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@5.2.2...5.2.3)

Updates `marked` from 18.0.7 to 18.0.9
- [Release notes](https://github.com/markedjs/marked/releases)
- [Commits](markedjs/marked@v18.0.7...v18.0.9)

Updates `mppx` from 0.8.14 to 0.8.15
- [Release notes](https://github.com/wevm/mppx/releases)
- [Changelog](https://github.com/wevm/mppx/blob/main/CHANGELOG.md)
- [Commits](https://github.com/wevm/mppx/compare/mppx@0.8.14...mppx@0.8.15)

Updates `posthog-node` from 5.46.1 to 5.47.9
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/node/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/commits/posthog-node@5.47.9/packages/node)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 5.2.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: marked
  dependency-version: 18.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: mppx
  dependency-version: 0.8.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: posthog-node
  dependency-version: 5.47.8
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title Bump the npm-minor-patch group with 4 updates Bump the npm-minor-patch group across 1 directory with 4 updates Aug 7, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/npm-minor-patch-a8567c99f6 branch from bf6e50c to fb63ec9 Compare August 7, 2026 12:50
@MikeyPetrillo MikeyPetrillo mentioned this pull request Aug 7, 2026
Merged
@MikeyPetrillo

MikeyPetrillo commented Aug 7, 2026

Copy link
Copy Markdown
Owner

Superseded: these exact four bumps (js-yaml 5.2.3, marked 18.0.9, mppx 0.8.15, posthog-node 5.47.8) are now on main via #711.

Merging this PR directly kept returning HTTP 500 from the merge API across six attempts while mergeable was true, so the changes were brought in through the dev branch instead. That had the side benefit of testing them alongside the rest of the branch rather than against a base from before today: mpp-shim 36/36 with the real mppx client (the only bump on the money path), util-kit 21/21, find 76/76, wish 54/54, canary-coverage 148/148, plus the full CI suite.

Closing as already applied.

@dependabot @github

dependabot Bot commented on behalf of github Aug 7, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/npm-minor-patch-a8567c99f6 branch August 7, 2026 13:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@MikeyPetrillo