Skip to content

chore(deps): bump the production-dependencies group across 1 directory with 7 updates - #8

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-88d74e74ab
Open

chore(deps): bump the production-dependencies group across 1 directory with 7 updates#8
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-88d74e74ab

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 21, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the production-dependencies group with 7 updates in the / directory:

Package From To
@inquirer/prompts 7.10.1 8.7.2
jszip 3.10.1 3.10.2
mammoth 1.12.0 1.12.3
openai 6.49.0 7.18.0
ora 8.2.0 9.4.1
pdf-parse 1.1.4 2.4.5
yaml 2.9.0 2.9.1

Updates @inquirer/prompts from 7.10.1 to 8.7.2

Release notes

Sourced from @​inquirer/prompts's releases.

@​inquirer/prompts@​8.7.2

What's new

  • Fixed a race where keystrokes batched in the same tick as the key that settled a prompt could still reach keypress handlers after the prompt was done, cancelled, or aborted (@inquirer/core, #2255, closes #1816).
  • confirm() now trims surrounding whitespace from answers before matching yes/no keywords (@inquirer/confirm, #2254).

Included

  • @inquirer/checkbox@^5.2.5
  • @inquirer/confirm@^6.3.2
  • @inquirer/editor@^5.3.3
  • @inquirer/expand@^5.1.5
  • @inquirer/input@^5.1.6
  • @inquirer/number@^4.2.3
  • @inquirer/password@^5.2.2
  • @inquirer/rawlist@^5.3.5
  • @inquirer/search@^4.3.3
  • @inquirer/select@^5.2.5

@​inquirer/prompts@​8.7.1

What's new

  • All bundled prompts now pin @inquirer/type to an exact version in their published manifests. Since these type definitions leak into consumers' tsc runs, a semver range on the types-only dependency could break downstream TypeScript builds without any change to Inquirer.js itself (#2247, fixes #2244).

Included

  • @inquirer/checkbox@^5.2.4
  • @inquirer/confirm@^6.3.1
  • @inquirer/editor@^5.3.2
  • @inquirer/expand@^5.1.4
  • @inquirer/input@^5.1.5
  • @inquirer/number@^4.2.2
  • @inquirer/password@^5.2.1
  • @inquirer/rawlist@^5.3.4
  • @inquirer/search@^4.3.2
  • @inquirer/select@^5.2.4

@​inquirer/prompts@​8.7.0

What's new

  • password gains the toggleMask option (ctrl+t to reveal the typed value).
  • confirm now matches localized yes/no answers per-locale.
  • Prettified prompt and theme types for better IDE display.
  • Added inquirer-grouped-checkbox to the community prompts list (#2236).

Included

... (truncated)

Commits
  • cbdb34b chore: Publish new release
  • 8340d2d fix(@​inquirer/core): clear hook effects before settling prompts
  • 2475e07 test(@​inquirer/core): cover hook cleanup error semantics
  • 15cd8d3 fix(confirm): ignore surrounding whitespace in answers
  • 9cb0da6 chore(deps): Bump github/codeql-action/analyze from 4.37.7 to 4.37.9
  • 1c750bc chore(deps-dev): Bump the build group with 3 updates (#2251)
  • 81f1525 chore(deps-dev): Bump @​types/node in the types group (#2252)
  • 7c27f26 chore(deps-dev): Bump oxfmt in the formatting group (#2249)
  • 6119088 chore(deps): Bump github/codeql-action/init from 4.37.7 to 4.37.9 (#2250)
  • 0d167c0 chore(deps-dev): Bump the linting group with 4 updates (#2248)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​inquirer/prompts since your current version.


Updates jszip from 3.10.1 to 3.10.2

Changelog

Sourced from jszip's changelog.

v3.10.2 2026-09-09

  • Fix cross-realm binary type detection in getTypeOf. Fixes #759 (see #578)
  • Add missing types for JSZip.defaults. Fixes #690 (see #927)
  • Fix Blob support in Node.js 18 and up. Fixes #941 (see #955)
Commits
Maintainer changes

This version was pushed to npm by jkoops, a new releaser for jszip since your current version.


Updates mammoth from 1.12.0 to 1.12.3

Changelog

Sourced from mammoth's changelog.

1.12.3

  • Avoid excessive backtracking when parsing an unterminated string with many escape sequences. The previous behaviour would allow maliciously crafted documents to cause a denial of service.

    Note that it is still strongly recommended to process untrusted documents in a separate thread with a timeout to avoid potential similar issues.

  • Handle complex field separator and end characters without corresponding start characters.

1.12.2

  • Avoid prototype pollution when reading the styles defined in a document. This avoids an issue where a maliciously crafted document could be used to set externalFileAccess to true.

1.12.1

  • Fix: on Windows, when an image's content type includes a backslash in the subpart, files may be written outside of the directory set by --output-dir.

  • Detect and ignore numbering levels that use numStyleLink to refer to themselves.

Commits
  • 71fe5da Bump version to 1.12.3
  • 5fe085d Update node to 26.8.2
  • f1fc26f Start warning with capital letter
  • 62d4d33 Handle missing complex field start characters
  • dc49225 Avoid excessive backtracking when parsing unterminated strings
  • 8706034 Bump version to 1.12.2
  • 2888fa1 Create objects without prototypes when used as map with arbitrary keys
  • 31f0c37 Avoid prototype pollution when reading styles
  • e3b9cec Bump version to 1.12.1
  • c69ea62 Ignore numbering levels that use numStyleLink to refer to themselves
  • Additional commits viewable in compare view

Updates openai from 6.49.0 to 7.18.0

Release notes

Sourced from openai's releases.

v7.18.0

7.18.0 (2026-09-17)

Features

Bug Fixes

  • api: validate WebSocket results and preserve header defaults (#2763) (a7e830b)

Chores

v7.17.0

7.17.0 (2026-09-16)

Features

Bug Fixes

  • ci: retry transient Deno download failures (#2752) (e39037b)
  • preserve chat runner abort reasons (#2607) (eda4d0c)
  • realtime: preserve native WebSocket error causes (#2715) (58fa72a)
  • responses: reject function-based API keys in WebSocket constructors (#2586) (eea7618)
  • runners: reject unfinished turns in streaming runTools (#2716) (937ed67)
  • streaming: emit terminal SSE events missing a trailing blank line (#2726) (94d6418)
  • zod: omit impossible optional branch in strict schemas (#2751) (2b4c2c7)

Chores

  • update lint tooling and tailor anti-slop for the SDK (#2753) (21a03c2)

Documentation

  • examples: preserve split UTF-8 in raw stream consumer (#2714) (f44152a)

... (truncated)

Changelog

Sourced from openai's changelog.

7.18.0 (2026-09-17)

Features

Bug Fixes

  • api: validate WebSocket results and preserve header defaults (#2763) (a7e830b)

Chores

7.17.0 (2026-09-16)

Features

Bug Fixes

  • ci: retry transient Deno download failures (#2752) (e39037b)
  • preserve chat runner abort reasons (#2607) (eda4d0c)
  • realtime: preserve native WebSocket error causes (#2715) (58fa72a)
  • responses: reject function-based API keys in WebSocket constructors (#2586) (eea7618)
  • runners: reject unfinished turns in streaming runTools (#2716) (937ed67)
  • streaming: emit terminal SSE events missing a trailing blank line (#2726) (94d6418)
  • zod: omit impossible optional branch in strict schemas (#2751) (2b4c2c7)

Chores

  • update lint tooling and tailor anti-slop for the SDK (#2753) (21a03c2)

Documentation

  • examples: preserve split UTF-8 in raw stream consumer (#2714) (f44152a)

7.16.0 (2026-09-15)

... (truncated)

Commits

Updates ora from 8.2.0 to 9.4.1

Release notes

Sourced from ora's releases.

v9.4.1

  • Fix type definitions (#257) 431ebc4
  • Fix failText type to accept unknown instead of Error, matching the actual promise rejection value bc3a283

sindresorhus/ora@v9.4.0...v9.4.1

v9.4.0

  • Add successSymbol and failSymbol options to oraPromise 3d2e0a9

sindresorhus/ora@v9.3.0...v9.4.0

v9.3.0

  • Reduce flicker in rendering 2ab4f76

sindresorhus/ora@v9.2.0...v9.3.0

v9.2.0

  • Update stdin-discarder dependency (#251) 020eaba

sindresorhus/ora@v9.1.0...v9.2.0

v9.1.0

  • Support external writes to stream (console.log) while spinning d2b543a
  • Replace strip-ansi dependency with native stripVTControlCharacters (#249) 68d50e5

sindresorhus/ora@v9.0.0...v9.1.0

v9.0.0

Breaking

  • Require Node.js 20 7aca06d

Fixes

  • Fix clearing in some cases aa51538
  • Fix frame() not displaying dynamic prefixText/suffixText from functions 0f19f57
  • Fix multiline text exceeding console height leaving garbage when scrolling 45d30ad

... (truncated)

Commits

Updates pdf-parse from 1.1.4 to 2.4.5

Release notes

Sourced from pdf-parse's releases.

Release v2.4.5

What's Changed

🚨 Breaking Changes

📚 Documentation

Full Changelog: mehmet-kozan/pdf-parse@v2.4.4...v2.4.5

Release v2.4.4

What's Changed

🚨 Breaking Changes

✨ New Features

📚 Documentation

🧰 Other Changes

Full Changelog: mehmet-kozan/pdf-parse@v2.4.3...v2.4.4

Release v2.4.4-beta.1

What's Changed

🚨 Breaking Changes

✨ New Features

📚 Documentation

🧰 Other Changes

... (truncated)

Commits
  • e8e800b Remove Tidelift funding option
  • 614e669 Integration test dependency fix (#38)
  • cff0ae1 For browser build, set the background web worker explicitly. (#37)
  • 54937b6 Update README.md
  • 1e87edd Update API Extractor config and rename API docs
  • c153bf7 Release v2.4.4 and update README formatting
  • 69eec3e NPM publish workflow now triggers only on published releases. (#33)
  • 1bfae05 Command-line interface for quick PDF processing implemented. (#32)
  • 8a7a044 CDN urls updated pdf-parse/utils replaced with pdf-parse/node (#31)
  • 4b6c46e getTable() return type changed. (#30)
  • Additional commits viewable in compare view
Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates yaml from 2.9.0 to 2.9.1

Release notes

Sourced from yaml's releases.

v2.9.1

  • Limit recursive merge aliases (#685, #713)
  • Simplify line unfolding during quoted string parsing (#714)
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the production-dependencies group across 1 director…
bb15c7f 
…y with 7 updates

Bumps the production-dependencies group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@inquirer/prompts](https://github.com/SBoudrias/Inquirer.js) | `7.10.1` | `8.7.2` |
| [jszip](https://github.com/Stuk/jszip) | `3.10.1` | `3.10.2` |
| [mammoth](https://github.com/mwilliamson/mammoth.js) | `1.12.0` | `1.12.3` |
| [openai](https://github.com/openai/openai-node) | `6.49.0` | `7.18.0` |
| [ora](https://github.com/sindresorhus/ora) | `8.2.0` | `9.4.1` |
| [pdf-parse](https://github.com/mehmet-kozan/pdf-parse) | `1.1.4` | `2.4.5` |
| [yaml](https://github.com/eemeli/yaml) | `2.9.0` | `2.9.1` |



Updates `@inquirer/prompts` from 7.10.1 to 8.7.2
- [Release notes](https://github.com/SBoudrias/Inquirer.js/releases)
- [Commits](https://github.com/SBoudrias/Inquirer.js/compare/@inquirer/[email protected]...@inquirer/[email protected])

Updates `jszip` from 3.10.1 to 3.10.2
- [Changelog](https://github.com/Stuk/jszip/blob/main/CHANGES.md)
- [Commits](Stuk/jszip@v3.10.1...v3.10.2)

Updates `mammoth` from 1.12.0 to 1.12.3
- [Release notes](https://github.com/mwilliamson/mammoth.js/releases)
- [Changelog](https://github.com/mwilliamson/mammoth.js/blob/master/NEWS)
- [Commits](mwilliamson/mammoth.js@1.12.0...1.12.3)

Updates `openai` from 6.49.0 to 7.18.0
- [Release notes](https://github.com/openai/openai-node/releases)
- [Changelog](https://github.com/openai/openai-node/blob/main/CHANGELOG.md)
- [Commits](openai/openai-node@v6.49.0...v7.18.0)

Updates `ora` from 8.2.0 to 9.4.1
- [Release notes](https://github.com/sindresorhus/ora/releases)
- [Commits](sindresorhus/ora@v8.2.0...v9.4.1)

Updates `pdf-parse` from 1.1.4 to 2.4.5
- [Release notes](https://github.com/mehmet-kozan/pdf-parse/releases)
- [Commits](mehmet-kozan/pdf-parse@v1.1.4...v2.4.5)

Updates `yaml` from 2.9.0 to 2.9.1
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.9.0...v2.9.1)

---
updated-dependencies:
- dependency-name: "@inquirer/prompts"
  dependency-version: 8.7.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: jszip
  dependency-version: 3.10.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: mammoth
  dependency-version: 1.12.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: openai
  dependency-version: 7.18.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: ora
  dependency-version: 9.4.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: pdf-parse
  dependency-version: 2.4.5
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: yaml
  dependency-version: 2.9.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants