Bump the node group across 1 directory with 7 updates by dependabot[bot] · Pull Request #153 · paritytech/bcts

dependabot · 2026-08-17T04:55:10Z

Bumps the node group with 7 updates in the / directory:

Package	From	To
@changesets/cli	`2.31.1`	`3.0.0`
typescript	`6.0.3`	`7.0.2`
@nuxtjs/seo	`5.3.6`	`5.3.12`
nuxt-gtag	`4.1.0`	`5.0.0`
@noble/post-quantum	`0.6.1`	`0.7.0`
@types/pako	`2.0.4`	`3.0.0`
@types/better-sqlite3	`7.6.13`	`9.6.0`

Updates @changesets/cli from 2.31.1 to 3.0.0

Release notes

Sourced from @changesets/cli's releases.

@changesets/cli@3.0.0

Major Changes

#2128 7113c01 Thanks @Andarist! - Renamed the changeset tag command to changeset git-tag.

#2074 3599e47 Thanks @bluwy! - Set supported package manager versions in "engines" field, including npm >=10.9.0, pnpm >=10.0.0, and yarn >=4.5.2.

#1860 92b1c1b Thanks @mixelburg! - changeset version now exits with code 1 when there are no unreleased changesets, instead of silently exiting with code 0.

This makes it easier to detect when a version step is a no-op — for example, to prevent accidentally publishing packages with incorrect version tags when using --snapshot mode.

#1482 df424a4 Thanks @Andarist! - Bumped supported Node versions to ^22.11 || ^24 || >=26

#1994 062530b Thanks @bluwy! - The prettier option in .changeset/config.json has been removed in favor of format. format supports "auto", "prettier", "oxfmt", "deno", and "dprint", and false disables formatting. If you previously used prettier: false, migrate to format: false or remove the option to use automatic formatter detection.

#2190 96b65ee Thanks @bluwy! - Move versioned prerelease changesets to .changeset/pre/ folder instead of accumulating in the root and tracking the versioned changeset ids in the .changeset/pre.json file. Existing pre.json will auto-migrate to this new structure on the next run of changeset version or when calling changeset status.

This change allows easier management of versioned prerelease changesets (for the final stable release) and current queued changesets (for the next prerelease). Changesets in .changeset/pre/ can be edited or deleted depending if it's still relevant for the final stable release of a package. There's no need to synchronize the changeset ids in pre.json if certain changesets are deleted.

#2145 f5887ff Thanks @Andarist! - Removed Yarn Classic support

#2097 8c88f6a Thanks @Andarist! - Packages with only prerelease versions published will now be published with the prerelease tag in the prerelease mode if the target registry doesn't auto-assign latest tag. npm registry itself does that and such packages will continue to be released with latest tag (and not with the configured prerelease tag).

#1879 c76b232 Thanks @beeequeue! - Removed warning messages about using v1 configs. They will now be silently ignored.

#1655 db46911 Thanks @bluwy! - Update @manypkg/get-packages which drops support for detecting packages in Bolt monorepos and adds support for npm monorepos

#1651 e1df862 Thanks @bluwy! - Remove support for the --sinceMaster flag for changeset status. Use --since=master or --since=main instead.

#2117 813bbf3 Thanks @bluwy! - Remove the pre.json initialVersions property and handling as it's unused internally

#1961 07278a7 Thanks @beeequeue! - CommitFunctions can now be both sync and async, and the defaultCommitFunctions are now sync.

#1482 df424a4 Thanks @Andarist! - From now on this package is going to be published as ES module.

#1652 a0b5326 Thanks @bluwy! - Remove support for the deprecated ___experimentalUnsafeOptions_WILL_CHANGE_IN_PATCH.useCalculatedVersionForSnapshots config. The snapshot.useCalculatedVersion config should be used instead.

#2186 3910adf Thanks @Andarist! - Private packages are no longer versioned by default. Set privatePackages to true to opt into versioning and tagging them, or set privatePackages.version to true to version them without tagging.

#1879 c76b232 Thanks @beeequeue! - Migrated from enquirer + @inquirer/launch-editor to @clack/prompts + launch-editor.

This means the CLI flows will have minor changes, but they are largely the same.

This change also fixes various issues related to enquirer like cancelling prompts crashing the CLI.

#2090 3aae903 Thanks @beeequeue! - Peer dependencies now bump packages that depend on them by patch instead of major.

This means a peer dependency update is no longer assumed (forced) to be a breaking change.

If the dependent package is not compatible with the peer's new release you should manually add a major changeset describing why and how to migrate.

... (truncated)

Changelog

Sourced from @changesets/cli's changelog.

3.0.0

Major Changes

#2128 7113c01 Thanks @Andarist! - Renamed the changeset tag command to changeset git-tag.

#2074 3599e47 Thanks @bluwy! - Set supported package manager versions in "engines" field, including npm >=10.9.0, pnpm >=10.0.0, and yarn >=4.5.2.

#1860 92b1c1b Thanks @mixelburg! - changeset version now exits with code 1 when there are no unreleased changesets, instead of silently exiting with code 0.

This makes it easier to detect when a version step is a no-op — for example, to prevent accidentally publishing packages with incorrect version tags when using --snapshot mode.

#1482 df424a4 Thanks @Andarist! - Bumped supported Node versions to ^22.11 || ^24 || >=26

#1994 062530b Thanks @bluwy! - The prettier option in .changeset/config.json has been removed in favor of format. format supports "auto", "prettier", "oxfmt", "deno", and "dprint", and false disables formatting. If you previously used prettier: false, migrate to format: false or remove the option to use automatic formatter detection.

#2190 96b65ee Thanks @bluwy! - Move versioned prerelease changesets to .changeset/pre/ folder instead of accumulating in the root and tracking the versioned changeset ids in the .changeset/pre.json file. Existing pre.json will auto-migrate to this new structure on the next run of changeset version or when calling changeset status.

This change allows easier management of versioned prerelease changesets (for the final stable release) and current queued changesets (for the next prerelease). Changesets in .changeset/pre/ can be edited or deleted depending if it's still relevant for the final stable release of a package. There's no need to synchronize the changeset ids in pre.json if certain changesets are deleted.

#2145 f5887ff Thanks @Andarist! - Removed Yarn Classic support

#2097 8c88f6a Thanks @Andarist! - Packages with only prerelease versions published will now be published with the prerelease tag in the prerelease mode if the target registry doesn't auto-assign latest tag. npm registry itself does that and such packages will continue to be released with latest tag (and not with the configured prerelease tag).

#1879 c76b232 Thanks @beeequeue! - Removed warning messages about using v1 configs. They will now be silently ignored.

#1655 db46911 Thanks @bluwy! - Update @manypkg/get-packages which drops support for detecting packages in Bolt monorepos and adds support for npm monorepos

#1651 e1df862 Thanks @bluwy! - Remove support for the --sinceMaster flag for changeset status. Use --since=master or --since=main instead.

#2117 813bbf3 Thanks @bluwy! - Remove the pre.json initialVersions property and handling as it's unused internally

#1961 07278a7 Thanks @beeequeue! - CommitFunctions can now be both sync and async, and the defaultCommitFunctions are now sync.

#1482 df424a4 Thanks @Andarist! - From now on this package is going to be published as ES module.

#1652 a0b5326 Thanks @bluwy! - Remove support for the deprecated ___experimentalUnsafeOptions_WILL_CHANGE_IN_PATCH.useCalculatedVersionForSnapshots config. The snapshot.useCalculatedVersion config should be used instead.

#2186 3910adf Thanks @Andarist! - Private packages are no longer versioned by default. Set privatePackages to true to opt into versioning and tagging them, or set privatePackages.version to true to version them without tagging.

#1879 c76b232 Thanks @beeequeue! - Migrated from enquirer + @inquirer/launch-editor to @clack/prompts + launch-editor.

This means the CLI flows will have minor changes, but they are largely the same.

This change also fixes various issues related to enquirer like cancelling prompts crashing the CLI.

#2090 3aae903 Thanks @beeequeue! - Peer dependencies now bump packages that depend on them by patch instead of major.

This means a peer dependency update is no longer assumed (forced) to be a breaking change.

... (truncated)

Commits

f442221 Version Packages (#2235)
e3facad Version Packages (next) (#2228)
c98af4c Do not bump ignored independent packages when exiting pre mode (#2092)
496ca21 Build(deps-dev): Bump the development-dependencies group with 6 updates (#2225)
d1053ac Build(deps): Bump the production-dependencies group across 1 directory with 2...
68ea6ec Fix linked and fixed glob patterns expansion (#2222)
c1b6f8c fix missing coloring of name (#2218)
a53d1f8 Remove old atlaskit changelogs (#2217)
7bcb2d2 Build(deps-dev): Bump the development-dependencies group across 1 directory w...
baa658d Version Packages (next) (#2192)
Additional commits viewable in compare view

Updates typescript from 6.0.3 to 7.0.2

Commits

See full diff in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

Updates @nuxtjs/seo from 5.3.6 to 5.3.12

Release notes

Sourced from @nuxtjs/seo's releases.

v5.3.12

   🐞 Bug Fixes

shared:

Resolve partial i18n routes - by @harlan-zw in harlan-zw/nuxt-seo#612 (330a1)

Resolve canonical locale domains - by @harlan-zw in harlan-zw/nuxt-seo#613 (9a04d)

    View changes on GitHub

v5.3.11

   🚀 Features

shared:

Add runtime-safe i18n route resolution - by @harlan-zw (5213e)

Add runtime-safe i18n route resolution - by @harlan-zw in harlan-zw/nuxt-seo#611 (c9cb5)

   🐞 Bug Fixes

Support Nitro 3 internal raw fetches - by @harlan-zw in harlan-zw/nuxt-seo#605 (2618d)

shared:

Emit resolvable H3 server types - by @agantelin and @harlan-zw in harlan-zw/nuxt-seo#608 (7372c)

Harden runtime i18n resolution - by @harlan-zw (11f8f)

Satisfy source-stub typecheck - by @harlan-zw (ab0f6)

    View changes on GitHub

v5.3.10

   🐞 Bug Fixes

Support Nitro 3 internal raw fetches - by @harlan-zw in harlan-zw/nuxt-seo#605 (2618d)

    View changes on GitHub

v5.3.9

   🐞 Bug Fixes

shared: Scope Nitro 3 ofetch alias - by @harlan-zw in harlan-zw/nuxt-seo#603 (0a15e)

    View changes on GitHub

v5.3.8

   🚀 Features

shared: Add event-aware Nitro fetch - by @harlan-zw in harlan-zw/nuxt-seo#601 (ac5ef)

   🐞 Bug Fixes

shared: Support nuxt-i18n-micro localized routes - by @harlan-zw in harlan-zw/nuxt-seo#600 (8656c)

    View changes on GitHub

... (truncated)

Commits

b0b8309 chore: release v5.3.12
d19b682 chore: ci
a270d8e chore: ci
0688e15 chore: bump deps
d63e76a chore: release v5.3.11
7b219b0 test(seo): update ai-ready prerender assertions
d75aa56 test: compare Nitro 2 and Nitro 3 output (#604)
f8b74a9 chore: release v5.3.9
bfd51bf chore: release v5.3.8
4723783 chore: release v5.3.7
See full diff in compare view

Updates nuxt-gtag from 4.1.0 to 5.0.0

Release notes

Sourced from nuxt-gtag's releases.

v5.0.0

Migration

Nuxt 4 is required. The module no longer supports Nuxt 3. Nothing else in your configuration changes on that account.

A tag ID named twice is configured once. If the same ID appeared in both the id option and the tags array, both entries used to reach the config command, and the second overwrote the first. Only one survives now, and it is the id entry, which carries the top-level initCommands and config. Move any settings you kept in the duplicate tags entry up to the top level, or drop the id option and keep the entry in tags.

An existing dataLayer no longer stops initialization. initialize() used to do nothing at all when window.dataLayer was already present, which a third-party snippet such as Google Tag Manager creates before Nuxt hydrates. The module tracks the IDs it configured itself instead, so it now configures its tags alongside such a snippet rather than silently standing down. If you relied on the old behavior to let GTM own the page, stop calling initialize() – or set enabled to false.

   🚨 Breaking Changes

Require Nuxt 4 - by @johannschopplich (f9d2e)

   🐞 Bug Fixes

Accept a mixed array of tag IDs and tag objects - by @johannschopplich (38562)

Configure a tag ID that initialize receives at runtime - by @johannschopplich (23694)

Configure each tag ID exactly once - by @johannschopplich (92aab)

Track configured tag IDs instead of inferring them from dataLayer - by @johannschopplich (c3bd0)

    View changes on GitHub

Commits

fb10088 chore: release v5.0.0
2f5d9b8 chore: drop the release-age pins that have aged out
efdc67a chore: drop the duplicate env entry from the ignore file
ca037ef docs: move the migration guides to the release notes
57f8352 docs: add the v5 migration notes and correct the composable descriptions
c837470 chore: drop the lint glob for a directory that does not exist
9fdddd7 ci: publish through OIDC alone
5359972 refactor: drop the no-op toRaw from resolveTags
5cd1976 ci: run the test suite on push and pull request
36f47ba docs: drop the Nuxt version the module already declares
Additional commits viewable in compare view

Updates @noble/post-quantum from 0.6.1 to 0.7.0

Release notes

Sourced from @noble/post-quantum's releases.

0.7.0

Breaking

hybrid: legacy aliases removed. XWing/MLKEM768X25519 → ml_kem768_x25519, MLKEM768P256 → ml_kem768_p256, MLKEM1024P384 → ml_kem1024_p384, QSFMLKEM768P256 → QSF_ml_kem768_p256, QSFMLKEM1024P384 → QSF_ml_kem1024_p384, KitchenSinkMLKEM768X25519 → KitchenSink_ml_kem768_x25519.

utils: afunction no longer exported — moved to @noble/curves/utils.js.

Other

Falcon: Fix length check in detached (non-default) falcon

MultiplyNTTs intermediate overflow — a1*b1*zeta could reach ~2³⁵; now mod(mod(a1*b1)*zeta + a0*b0).

ML-DSA sign entropy ordering — randomness drawn before secret-key decoding, so an RNG throw can't leave partially-decoded key material live.

ML-DSA externalMu length-checks msg as 64-byte µ; ML-KEM detaches the caller's public key before caching; equalBytes validates its inputs; stricter checks and messages throughout.

Up to 2x speed boost for SLH-DSA

+16-42% speed boost for hybrid ml-kem-768+x25519

Upgrade noble deps to 2.3.0

Reduce on-disk unpacked size, 813kb → 654kb (-159kb): by disabling source maps (they became less relevant).

Full Changelog: paulmillr/noble-post-quantum@2.2.0...2.3.0

Commits

75c18a6 Release 0.7.0.
40c6b5c Update docs
602ebaa Fix bigint literals
3e63cde Fix pkg.json
ca6e054 Upgrade deps
da11fa2 Reduce code
8bff5fa Update jsbt and deps
68e5046 test: use new syntax
42ec4df hybrid: remove legacy aliases (use new ones)
6ee24a1 readme
Additional commits viewable in compare view

Updates @types/pako from 2.0.4 to 3.0.0

Commits

See full diff in compare view

Updates @types/better-sqlite3 from 7.6.13 to 9.6.0

Commits

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the node group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@changesets/cli](https://github.com/changesets/changesets/tree/HEAD/packages/cli) | `2.31.1` | `3.0.0` | | [typescript](https://github.com/microsoft/TypeScript) | `6.0.3` | `7.0.2` | | [@nuxtjs/seo](https://github.com/harlan-zw/nuxt-seo/tree/HEAD/packages/nuxt-seo) | `5.3.6` | `5.3.12` | | [nuxt-gtag](https://github.com/johannschopplich/nuxt-gtag) | `4.1.0` | `5.0.0` | | [@noble/post-quantum](https://github.com/paulmillr/noble-post-quantum) | `0.6.1` | `0.7.0` | | [@types/pako](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/pako) | `2.0.4` | `3.0.0` | | [@types/better-sqlite3](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/better-sqlite3) | `7.6.13` | `9.6.0` | Updates `@changesets/cli` from 2.31.1 to 3.0.0 - [Release notes](https://github.com/changesets/changesets/releases) - [Changelog](https://github.com/changesets/changesets/blob/main/packages/cli/CHANGELOG.md) - [Commits](https://github.com/changesets/changesets/commits/@changesets/cli@3.0.0/packages/cli) Updates `typescript` from 6.0.3 to 7.0.2 - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](https://github.com/microsoft/TypeScript/commits) Updates `@nuxtjs/seo` from 5.3.6 to 5.3.12 - [Release notes](https://github.com/harlan-zw/nuxt-seo/releases) - [Changelog](https://github.com/harlan-zw/nuxt-seo/blob/main/CHANGELOG.md) - [Commits](https://github.com/harlan-zw/nuxt-seo/commits/v5.3.12/packages/nuxt-seo) Updates `nuxt-gtag` from 4.1.0 to 5.0.0 - [Release notes](https://github.com/johannschopplich/nuxt-gtag/releases) - [Commits](johannschopplich/nuxt-gtag@v4.1.0...v5.0.0) Updates `@noble/post-quantum` from 0.6.1 to 0.7.0 - [Release notes](https://github.com/paulmillr/noble-post-quantum/releases) - [Commits](paulmillr/noble-post-quantum@0.6.1...0.7.0) Updates `@types/pako` from 2.0.4 to 3.0.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/pako) Updates `@types/better-sqlite3` from 7.6.13 to 9.6.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/better-sqlite3) --- updated-dependencies: - dependency-name: "@changesets/cli" dependency-version: 3.0.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: node - dependency-name: typescript dependency-version: 7.0.2 dependency-type: direct:development update-type: version-update:semver-major dependency-group: node - dependency-name: "@nuxtjs/seo" dependency-version: 5.3.12 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: node - dependency-name: nuxt-gtag dependency-version: 5.0.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: node - dependency-name: "@noble/post-quantum" dependency-version: 0.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: node - dependency-name: "@types/pako" dependency-version: 3.0.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: node - dependency-name: "@types/better-sqlite3" dependency-version: 9.6.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: node ... Signed-off-by: dependabot[bot] <support@github.com>

socket-security · 2026-08-17T04:57:11Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
npm/@types/pako@3.0.0
npm/@nuxtjs/seo@5.3.6 ⏵ 5.3.12	⁺¹		⁺¹
npm/@types/better-sqlite3@9.6.0
npm/@changesets/cli@2.31.1 ⏵ 3.0.0	⁺²	^-25
npm/nuxt-gtag@4.1.0 ⏵ 5.0.0	⁺¹		⁺⁷
npm/@noble/post-quantum@0.7.0

View full report

dependabot Bot assigned leonardocustodio Aug 17, 2026

dependabot Bot requested a review from leonardocustodio as a code owner August 17, 2026 04:55

dependabot Bot added the dependencies label Aug 17, 2026

Navigation Menu

Uh oh!

Bump the node group across 1 directory with 7 updates - #153

Bump the node group across 1 directory with 7 updates#153
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/node-b637430099

dependabot Bot commented on behalf of github Aug 17, 2026

Uh oh!

socket-security Bot commented Aug 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 17, 2026

@​changesets/cli@​3.0.0

Major Changes

3.0.0

Major Changes

v5.3.12

🐞 Bug Fixes

View changes on GitHub

v5.3.11

🚀 Features

🐞 Bug Fixes

View changes on GitHub

v5.3.10

🐞 Bug Fixes

View changes on GitHub

v5.3.9

🐞 Bug Fixes

View changes on GitHub

v5.3.8

🚀 Features

🐞 Bug Fixes

View changes on GitHub

v5.0.0

Migration

🚨 Breaking Changes

🐞 Bug Fixes

View changes on GitHub

0.7.0

Breaking

Other

Uh oh!

socket-security Bot commented Aug 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

`@changesets/cli@3`.0.0