deps(deps): bump the major group with 8 updates by dependabot[bot] · Pull Request #136 · profullstack/media-streamer

dependabot · 2026-07-20T16:18:04Z

Bumps the major group with 8 updates:

Package	From	To
@alpacahq/alpaca-trade-api	`3.1.3`	`4.0.1`
puppeteer	`24.42.0`	`25.3.0`
undici	`7.25.0`	`8.8.0`
webtorrent	`2.8.5`	`3.0.16`
@types/node	`25.6.0`	`26.1.1`
@vitejs/plugin-react	`5.1.4`	`6.0.3`
eslint	`9.39.2`	`10.7.0`
typescript	`5.9.3`	`7.0.2`

Updates @alpacahq/alpaca-trade-api from 3.1.3 to 4.0.1

Release notes

Sourced from @alpacahq/alpaca-trade-api's releases.

v4.0.1

Patch Changes

#298 5344968 Thanks @Azein! - Update installation and migration documentation to use the stable 4.x release instead of the alpha channel.

v4.0.0

Major Changes

#295 9301d5c Thanks @Azein! - Complete TypeScript rewrite (alpha). New unified Alpaca client for the Trading and Market Data APIs with typed errors, retry/timeout/rate limiting, pagination helpers, ergonomic order builders, and real-time streaming. Dual ESM+CJS build with edge/worker/deno export conditions. Requires Node >= 20.

Minor Changes

#295 9301d5c Thanks @Azein! - Added imbalances stream channel + validateConnection

#295 9301d5c Thanks @Azein! - Preserve full precision for market-data identifiers and extend timestampRaw coverage, all additively:

Lossless 64-bit stream ids. The market-data WebSocket now decodes trade/news ids as exact values and exposes them as strings alongside the numeric field: idRaw on trades and cancel-errors, originalIdRaw/correctedIdRaw on corrections, and idRaw on news. This prevents precision loss for ids beyond 2^53; other numeric fields remain a plain number.

timestampRaw on more canonical shapes. New getIndexValues and getStockAuctions accessors return canonical IndexValue / DailyAuctions shapes that carry the full-precision timestampRaw (per auction print), matching Bar/Trade/Quote.

#295 9301d5c Thanks @Azein! - Preserve full precision for 64-bit trade ids on the REST side, matching the live stream:

Lossless market-data JSON. The market-data REST transport now parses response bodies losslessly, so integer ids beyond 2^53 (in practice crypto trade ids) no longer lose precision. The trading transport is unaffected.

idRaw on REST canonical trades. getStockTrades/getCryptoTrades (and their *For variants) now expose an exact idRaw?: string alongside the convenient id: number — identical to the WebSocket stream, so ids backfilled over REST match live ones. Use idRaw to compare, store, or key on an id.

Raw-model note (behavioral). On the raw generated models an id past 2^53 (a crypto trade .i) now surfaces as a string at runtime rather than a lossy number, even though the generated type says number. Prefer the canonical accessors, or read the raw .i as the exact string. Stock/option ids, news ids, sizes, volumes, and counts are unaffected.

#295 9301d5c Thanks @Azein! - Market-data timestamps now carry an additive timestampRaw (RFC-3339, nanosecond precision) alongside the existing millisecond timestamp: Date, on both the WebSocket stream and the REST canonical Bar/Trade/Quote shapes. Fixes the v3 nanosecond-truncation issue (#250) without any breaking changes.

#295 9301d5c Thanks @Azein! - Harden HTTP redirect handling to prevent credential leakage. Requests now default to redirect: "error", so a 3xx redirect fails fast instead of being followed. Alpaca's APIs never redirect, and following one off-host would forward the APCA-API-KEY-ID/APCA-API-SECRET-KEY headers to the redirect target — unlike Authorization, custom headers are not stripped on a cross-origin redirect, so this closes a secret-leak vector. A new redirect option (client option and Configuration parameter; per-call initOverrides.redirect still wins) lets you opt back into "follow" when fronting the API with a redirecting proxy.

#295 9301d5c Thanks @Azein! - Bring the REST transport to parity with the Alpaca Java client's resilience and response surfaces:

Retry observability. The retry config now accepts onRetry and onGiveUp hooks, each fired with a RetryEvent ({ method, url, attempt, maxRetries, delayMs, status?, error? }): status for status-based retries, error for transient network-error retries. onRetry fires before each delayed retry; onGiveUp fires once when a retryable failure exhausts all attempts. They are pure observability hooks — exceptions thrown from a listener are swallowed so they can never break a request.

Typed response-with-headers. New withResponse(...) helper wraps any generated *Raw call and returns a typed AlpacaApiResponse<T>

... (truncated)

Changelog

Sourced from @alpacahq/alpaca-trade-api's changelog.

4.0.1

Patch Changes

#298 5344968 Thanks @Azein! - Update installation and migration documentation to use the stable 4.x release instead of the alpha channel.

4.0.0

Major Changes

#295 9301d5c Thanks @Azein! - Complete TypeScript rewrite (alpha). New unified Alpaca client for the Trading and Market Data APIs with typed errors, retry/timeout/rate limiting, pagination helpers, ergonomic order builders, and real-time streaming. Dual ESM+CJS build with edge/worker/deno export conditions. Requires Node >= 20.

Minor Changes

#295 9301d5c Thanks @Azein! - Added imbalances stream channel + validateConnection

#295 9301d5c Thanks @Azein! - Preserve full precision for market-data identifiers and extend timestampRaw coverage, all additively:

Lossless 64-bit stream ids. The market-data WebSocket now decodes trade/news ids as exact values and exposes them as strings alongside the numeric field: idRaw on trades and cancel-errors, originalIdRaw/correctedIdRaw on corrections, and idRaw on news. This prevents precision loss for ids beyond 2^53; other numeric fields remain a plain number.

timestampRaw on more canonical shapes. New getIndexValues and getStockAuctions accessors return canonical IndexValue / DailyAuctions shapes that carry the full-precision timestampRaw (per auction print), matching Bar/Trade/Quote.

#295 9301d5c Thanks @Azein! - Preserve full precision for 64-bit trade ids on the REST side, matching the live stream:

Lossless market-data JSON. The market-data REST transport now parses response bodies losslessly, so integer ids beyond 2^53 (in practice crypto trade ids) no longer lose precision. The trading transport is unaffected.

idRaw on REST canonical trades. getStockTrades/getCryptoTrades (and their *For variants) now expose an exact idRaw?: string alongside the convenient id: number — identical to the WebSocket stream, so ids backfilled over REST match live ones. Use idRaw to compare, store, or key on an id.

Raw-model note (behavioral). On the raw generated models an id past 2^53 (a crypto trade .i) now surfaces as a string at runtime rather than a lossy number, even though the generated type says number. Prefer the canonical accessors, or read the raw .i as the exact string. Stock/option ids, news ids, sizes, volumes, and counts are unaffected.

#295 9301d5c Thanks @Azein! - Market-data timestamps now carry an additive timestampRaw (RFC-3339, nanosecond precision) alongside the existing millisecond timestamp: Date, on both the WebSocket stream and the REST canonical Bar/Trade/Quote shapes. Fixes the v3 nanosecond-truncation issue (#250) without any breaking changes.

#295 9301d5c Thanks @Azein! - Harden HTTP redirect handling to prevent credential leakage. Requests now default to redirect: "error", so a 3xx redirect fails fast instead of being followed. Alpaca's APIs never redirect, and following one off-host would forward the APCA-API-KEY-ID/APCA-API-SECRET-KEY headers to the redirect target — unlike Authorization, custom headers are not stripped on a cross-origin redirect, so this closes a secret-leak vector. A new redirect option (client option and Configuration parameter; per-call initOverrides.redirect still wins) lets you opt back into "follow" when fronting the API with a redirecting proxy.

#295 9301d5c Thanks @Azein! - Bring the REST transport to parity with the Alpaca Java client's resilience and response surfaces:

Retry observability. The retry config now accepts onRetry and onGiveUp hooks, each fired with a RetryEvent ({ method, url, attempt, maxRetries, delayMs, status?, error? }): status for status-based retries, error for transient network-error retries. onRetry fires before each delayed retry; onGiveUp fires once when a retryable failure exhausts all attempts. They are pure observability hooks — exceptions thrown from a listener are swallowed so they can never break a request.

... (truncated)

Commits

d704cea chore: version packages (#299)
5344968 fix: remove alpha from docs (#298)
6ece844 chore: version packages (#297)
9301d5c Ts alpha (#295)
247c407 Version bump (#280)
See full diff in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates puppeteer from 24.42.0 to 25.3.0

Release notes

Sourced from puppeteer's releases.

puppeteer-core: v25.3.0

25.3.0 (2026-07-01)

🎉 Features

support installing extensions for browser contexts (#15164) (118d84d)

🛠️ Fixes

handle swaps without a timer (#15198) (2356a15)

normalize duplicate set-cookie headers using newline (#15173) (55787d5)

roll to Firefox 152.0.3 (#15158) (2d64852)

roll to Firefox 152.0.4 (#15195) (d382a21)

📄 Documentation

fix the typos on documentation (#15167) (ab74e6a)

Dependencies

The following workspace dependencies were updated

dependencies

@puppeteer/browsers bumped from 3.0.5 to 3.0.6

puppeteer: v25.3.0

25.3.0 (2026-07-01)

♻️ Chores

puppeteer: Synchronize puppeteer versions

Dependencies

The following workspace dependencies were updated

dependencies

@puppeteer/browsers bumped from 3.0.5 to 3.0.6

puppeteer-core bumped from 25.2.1 to 25.3.0

puppeteer-core: v25.2.1

25.2.1 (2026-06-24)

🛠️ Fixes

... (truncated)

Changelog

Sourced from puppeteer's changelog.

25.3.0 (2026-07-01)

♻️ Chores

puppeteer: Synchronize puppeteer versions

Dependencies

The following workspace dependencies were updated

dependencies

@puppeteer/browsers bumped from 3.0.5 to 3.0.6

🎉 Features

support installing extensions for browser contexts (#15164) (118d84d)

🛠️ Fixes

handle swaps without a timer (#15198) (2356a15)

normalize duplicate set-cookie headers using newline (#15173) (55787d5)

roll to Firefox 152.0.3 (#15158) (2d64852)

roll to Firefox 152.0.4 (#15195) (d382a21)

📄 Documentation

fix the typos on documentation (#15167) (ab74e6a)

25.2.1 (2026-06-24)

♻️ Chores

puppeteer: Synchronize puppeteer versions

Dependencies

The following workspace dependencies were updated

dependencies

puppeteer-core bumped from 25.2.0 to 25.2.1

🛠️ Fixes

... (truncated)

Commits

58d9b02 chore: release main (#15165)
d382a21 fix: roll to Firefox 152.0.4 (#15195)
2356a15 fix: handle swaps without a timer (#15198)
537232e chore(webmcp): Clean unnecessary Protocol interfaces (#15199)
ab74e6a docs: fix the typos on documentation (#15167)
9560bcf chore(deps-dev): bump the dev-dependencies group across 1 directory with 20 u...
04a9587 refactor: extract zip archives with yauzl instead of CLI tools (#15085)
54143a6 chore: fix the typos on the code test and API documentation (#15169)
55787d5 fix: normalize duplicate set-cookie headers using newline (#15173)
118d84d feat: support installing extensions for browser contexts (#15164)
Additional commits viewable in compare view

Updates undici from 7.25.0 to 8.8.0

Release notes

Sourced from undici's releases.

v8.8.0

What's Changed

fetch: use ReadableStreamTee for cloning streams by @KhafraDev in nodejs/undici#5517

fix(benchmarks): adjust got after v15 upgrade by @slagiewka in nodejs/undici#5526

feat(mock): support asynchronous reply options callbacks by @Develop-KIM in nodejs/undici#5534

docs: clarify proxy threat model by @mcollina in nodejs/undici#5530

docs: clarify MockAgent pool usage by @vibhor-aggr in nodejs/undici#5542

docs: clarify parser timeout precision by @vibhor-aggr in nodejs/undici#5543

fix: handle flat alternating header arrays in cache normalizeHeaders by @mcollina in nodejs/undici#5536

chore(benchmarks): require(esm) on ESM-only packages by @slagiewka in nodejs/undici#5527

fix: run idle socket validation off setImmediate instead of setTimeout by @carlotestor in nodejs/undici#5499

docs: add custom interceptor example by @vibhor-aggr in nodejs/undici#5548

fix(h1): ignore type of service errors by @mcollina in nodejs/undici#5547

fix(fetch): convert null init in Response.json by @Ram-blip in nodejs/undici#5540

fix(redirect): remove body headers after POST-to-GET by @Ram-blip in nodejs/undici#5551

build(deps-dev): bump fast-check from 4.8.0 to 4.9.0 by @dependabot[bot] in nodejs/undici#5556

fix(h2): allow stream-bodied requests to multiplex on a busy session by @GiHoon1123 in nodejs/undici#5538

fix(h2): destroy aborted stream synchronously instead of via setImmediate by @staylor in nodejs/undici#5559

fix(decompress): skip HEAD responses by @Ram-blip in nodejs/undici#5564

ci: build undici with node.js v26 by @shivarm in nodejs/undici#5237

docs: clarify top-level request option url fields by @vibhor-aggr in nodejs/undici#5545

test: add unexpected disconnect guards to http2 tests by @Develop-KIM in nodejs/undici#5533

fix: track origins by client map key in Agent teardown by @emmayusufu in nodejs/undici#5537

fix: enforce must-revalidate and proxy-revalidate over max-stale and stale-if-error by @jeswr in nodejs/undici#5511

fix(retry): handle Retry-After zero delay by @Ram-blip in nodejs/undici#5519

fix: honor stale-if-error on connection errors during revalidation by @jeswr in nodejs/undici#5513

fix: store revalidation-only responses so etag revalidation can engage by @jeswr in nodejs/undici#5515

fix(h2): prevent uncaughtException from onHttp2SocketError accessing undefined kClient by @mcollina in nodejs/undici#5546

fix(h2): complete request stream on 'end' instead of waiting for 'close' by @staylor in nodejs/undici#5560

fix: invalidate Location and Content-Location URIs on unsafe methods by @jeswr in nodejs/undici#5514

test: deflake invalid websocket close status test by @mcollina in nodejs/undici#5550

refactor: replace tspl with node:test t.plan in connect-timeout tests by @mcollina in nodejs/undici#5518

fix(h2): release completed requests from queue by @staylor in nodejs/undici#5569

New Contributors

@Develop-KIM made their first contribution in nodejs/undici#5534

@carlotestor made their first contribution in nodejs/undici#5499

@GiHoon1123 made their first contribution in nodejs/undici#5538

@emmayusufu made their first contribution in nodejs/undici#5537

Full Changelog: nodejs/undici@v8.7.0...v8.8.0

v8.7.0

What's Changed

test: guard balanced-pool error port lookup by @mcollina in nodejs/undici#5463

perf: optimize http/2 request hot path by @mcollina in nodejs/undici#5483

fix: do not reject open-ended Range values in simpleRangeHeaderValue by @spokodev in nodejs/undici#5490

fix(eventsource): set use-URL-credentials flag by @Ram-blip in nodejs/undici#5489

test: deflake connect-timeout watchdog by @mcollina in nodejs/undici#5197

docs: correct npm script name and JSON syntax in examples by @lenoxfernando in nodejs/undici#5496

... (truncated)

Commits

1760faa Bumped v8.8.0 (#5575)
f87273e fix(h2): release completed requests from queue (#5569)
1383989 refactor: replace tspl with node:test t.plan in connect-timeout tests (#5518)
c6d37d2 test: deflake invalid websocket close status test (#5550)
1ca0912 fix: invalidate Location and Content-Location URIs on unsafe methods (#5514)
87270e4 fix(h2): complete request stream on 'end' instead of waiting for 'close' (#5560)
85b35e7 fix(h2): prevent uncaughtException from onHttp2SocketError accessing undefine...
de01bab fix: store revalidation-only responses so etag revalidation can engage (#5515)
e1cc0d4 fix: honor stale-if-error on connection errors during revalidation (#5513)
dc7c044 fix(retry): handle Retry-After zero delay (#5519)
Additional commits viewable in compare view

Updates webtorrent from 2.8.5 to 3.0.16

Release notes

Sourced from webtorrent's releases.

v3.0.16

3.0.16 (2026-05-29)

Bug Fixes

perf: utp speed (#3068) (668ccdd)

v3.0.15

3.0.15 (2026-05-29)

Bug Fixes

server path2 (#3067) (6498e62)

v3.0.14

3.0.14 (2026-05-28)

Bug Fixes

http server encoding (#3064) (9c5b70d)

v3.0.13

3.0.13 (2026-05-27)

Bug Fixes

deps: update dependency bittorrent-protocol to ^5.0.6 (#3061) (f64f8a0)

v3.0.12

3.0.12 (2026-05-27)

Bug Fixes

pe tests (#3060) (bc76c3d)

v3.0.11

3.0.11 (2026-05-27)

Bug Fixes

deps: update dependency ut_pex to v5 (#3058) (47d3b7b)

v3.0.10

3.0.10 (2026-05-26)

... (truncated)

Changelog

Sourced from webtorrent's changelog.

3.0.16 (2026-05-29)

Bug Fixes

perf: utp speed (#3068) (668ccdd)

3.0.15 (2026-05-29)

Bug Fixes

server path2 (#3067) (6498e62)

3.0.14 (2026-05-28)

Bug Fixes

http server encoding (#3064) (9c5b70d)

3.0.13 (2026-05-27)

Bug Fixes

deps: update dependency bittorrent-protocol to ^5.0.6 (#3061) (f64f8a0)

3.0.12 (2026-05-27)

Bug Fixes

pe tests (#3060) (bc76c3d)

3.0.11 (2026-05-27)

Bug Fixes

deps: update dependency ut_pex to v5 (#3058) (47d3b7b)

3.0.10 (2026-05-26)

Bug Fixes

deps: update dependency torrent-piece to ^4.0.1 (#3059) (f734c27)

3.0.9 (2026-05-26)

... (truncated)

Commits

44f782d chore(release): 3.0.16
668ccdd fix(perf): utp speed (#3068)
f122edf chore(release): 3.0.15
6498e62 fix: server path2 (#3067)
11dac14 chore(release): 3.0.14
9c5b70d fix: http server encoding (#3064)
3dfb8eb chore(release): 3.0.13
f64f8a0 fix(deps): update dependency bittorrent-protocol to ^5.0.6 (#3061)
9b350cf chore(release): 3.0.12
bc76c3d fix: pe tests (#3060)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for webtorrent since your current version.

Updates @types/node from 25.6.0 to 26.1.1

Commits

See full diff in compare view

Updates @vitejs/plugin-react from 5.1.4 to 6.0.3

Release notes

Sourced from @vitejs/plugin-react's releases.

plugin-react@6.0.3

No release notes provided.

plugin-react@6.0.2

Allow all options in reactCompilerPreset (#1189)

This is a type only change. Only compilationMode and target options were available for reactCompilerPreset.

plugin-react@6.0.1

Expand @rolldown/plugin-babel peer dep range (#1146)

Expanded @rolldown/plugin-babel peer dep range to include ^0.2.0.

plugin-react@6.0.0

Remove Babel Related Features (#1123)

Vite 8+ can handle React Refresh Transform by Oxc and doesn't need Babel for it. With that, there are no transform applied that requires Babel. To reduce the installation size of this plugin, babel is no longer a dependency of this plugin and the related features are removed.

If you are using Babel, you can use @rolldown/plugin-babel together with this plugin:
 import { defineConfig } from 'vite'
 import react from '@vitejs/plugin-react'
+import babel from '@rolldown/plugin-babel'
export default defineConfig({
plugins: [


react({



  babel: {



    plugins: ['@babel/plugin-proposal-throw-expressions'],



  },



}),





react(),



babel({



  plugins: ['@babel/plugin-proposal-throw-expressions'],



}),

]
})
For React compiler users, you can use reactCompilerPreset for easier setup with preconfigured filter to improve build performance:
 import { defineConfig } from 'vite'
-import react from '@vitejs/plugin-react'
+import react, { reactCompilerPreset } from '@vitejs/plugin-react'
+import babel from '@rolldown/plugin-babel'
export default defineConfig({
plugins: [
</tr></table>

... (truncated)

Changelog

Sourced from @vitejs/plugin-react's changelog.

6.0.3 (2026-06-23)

6.0.2 (2026-05-14)

Allow all options in reactCompilerPreset (#1189)

This is a type only change. Only compilationMode and target options were available for reactCompilerPreset.

6.0.1 (2026-03-13)

Expand @rolldown/plugin-babel peer dep range (#1146)

Expanded @rolldown/plugin-babel peer dep range to include ^0.2.0.

6.0.0 (2026-03-12)

6.0.0-beta.0 (2026-03-03)

Remove Babel Related Features (#1123)

Vite 8+ can handle React Refresh Transform by Oxc and doesn't need Babel for it. With that, there are no transform applied that requires Babel. To reduce the installation size of this plugin, babel is no longer a dependency of this plugin and the related features are removed.

If you are using Babel, you can use @rolldown/plugin-babel together with this plugin:
 import { defineConfig } from 'vite'
 import react from '@vitejs/plugin-react'
+import babel from '@rolldown/plugin-babel'
export default defineConfig({
plugins: [


react({



  babel: {



    plugins: ['@babel/plugin-proposal-throw-expressions'],



  },



}),





react(),



babel({



  plugins: ['@babel/plugin-proposal-throw-expressions'],



}),

]
})
For React compiler users, you can use reactCompilerPreset for easier setup with preconfigured filter to improve build performance:
 import { defineConfig } from 'vite'
-import react from '@vitejs/plugin-react'
+import react, { reactCompilerPreset } from '@vitejs/plugin-react'
</tr></table> 

... (truncated)

Commits

640fd35 release: plugin-react@6.0.3
889efb0 fix(deps): update all non-major dependencies (#1249)
6c57dd4 fix(plugin-react): use '/' base in bundledDev preamble to fix non-root base p...
3cc33a7 fix(deps): update react-related dependencies (#1245)
c0f7c7f docs: mention the Biome rule in the "Consistent components exports" section (...
cd80f0f fix(deps): update all non-major dependencies (#1241)
e38acca fix(deps): update all non-major dependencies (#1227)
9a9bb26 perf(react): improve react compiler preset so that slightly more modules are ...
6535b55 release: plugin-react@6.0.2
bf0e43b feat(react): whitelist debugging-options (#1189)
Additional commits viewable in compare view

Updates eslint from 9.39.2 to 10.7.0

Release notes

Sourced from eslint's releases.

v10.7.0

Features

cf2a9bf feat: add errorClassNames option to preserve-caught-error rule (#21032) (sethamus)

f8b873a feat: max-nested-callbacks option for constructor callbacks (#21063) (fnx)

557fde8 feat: support computed Number.parseInt member access in radix rule (#21041) (Pixel)

0b4a73b feat: add suggestions to no-compare-neg-zero (#21034) (den$)

96cdd42 feat: report invalid signed numeric radix values in radix rule (#21030) (Pixel)

Bug Fixes

3e7bf15 fix: apply ignoreClassesWithImplements to class expressions (#21069) (Pixel)

0d7d70c fix: insert cause outside wrapping parens in preserve-caught-error (#21062) (Mahin Anowar)

75ec753 fix: handle static template literals in eqeqeq rule (#21058) (Pixel)

b717a22 fix: prevent eqeqeq null option from reporting non-equality operators (#21057) (Pixel)

e35b05f fix: avoid no-invalid-regexp false positive for shadowed RegExp (#21051) (Pixel)

a3172b6 fix: avoid no-control-regex false positive for shadowed RegExp (#21050) (Pixel)

d1f637e fix: parenthesize sequence expression operands in no-implicit-coercion (#21045) (spokodev)

8859baf fix: avoid prefer-numeric-literals false positive for shadowed globals (#21047) (한국)

a9e5961 fix: use-isnan false positive on shadowed NaN/Number (#20958) (sethamus)

8a240a7 fix: avoid false positives in radix rule for spread arguments (#21044) (Pixel)

Documentation

c30d808 docs: Update README (GitHub Actions Bot)

5139800 docs: document ESLint migration codemods in v9 and v10 guides (#20980) (Alex Bit)

04174cb docs: Update README (GitHub Actions Bot)

026e130 docs: update semver policy for bug fixes (#21048) (Milos Djermanovic)

9d42fef docs: Update README (GitHub Actions Bot)

b230159 docs: Update README (GitHub Actions Bot)

0129972 docs: correct **/.js glob to **/*.js in config files guide (#21036) (EduardF1)

Chores

9489379 chore: update dependency @eslint/eslintrc to ^3.3.6 (#21076) (renovate[bot])

81a4774 chore: updates for v9.39.5 release (Jenkins)

9835414 chore: enable $ExpectType annotations in all TypeScript files (#21071) (Francesco Trotta)

72adf6b chore: restrict markdownlint-cli2 updates in renovate (#21067) (lumir)

833ec10 chore: update dependency prettier to v3.9.4 (#21061) (renovate[bot])

7ea106d chore: update ecosystem plugins (#21059) (ESLint Bot)

8fb550e chore: add prettier update commit to .git-blame-ignore-revs (#21056) (lumir)

e4e1166 chore: update dependency prettier to v3.9.1 (#21055) (renovate[bot])

0493f53 chore: update prettier to v3.9.0 (#21054) (Pixel)

1056a99 chore: update dependency prettier to v3.8.5 (#21049) (renovate[bot])

4d4155d ci: run ecosystem tests on pull requests (#21027) (sethamus)

993539f chore: update dependency @eslint/json to ^2.0.1 (#21042) (renovate[bot])

53f8b69 test: add error locations to no-constant-binary-expression (#21039) (lumir)

5ab71d5 refactor: clean up radix rule internals (#21015) (Pixel)

a80a9a4 chore: update ecosystem plugins (#21035) (ESLint Bot)

7c9a029 ci: add Node.js 26 to CI (#20847) (lumir)

v10.6.0

Features

b1f9106 feat: detect Symbol() and BigInt() in no-constant-binary-expression (#20981) (Taejin Kim)

... (truncated)

Commits

fabd99b 10.7.0
37c5e75 Build: changelog update for 10.7.0

Bumps the major group with 8 updates: | Package | From | To | | --- | --- | --- | | [@alpacahq/alpaca-trade-api](https://github.com/alpacahq/alpaca-trade-api-js) | `3.1.3` | `4.0.1` | | [puppeteer](https://github.com/puppeteer/puppeteer) | `24.42.0` | `25.3.0` | | [undici](https://github.com/nodejs/undici) | `7.25.0` | `8.8.0` | | [webtorrent](https://github.com/webtorrent/webtorrent) | `2.8.5` | `3.0.16` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.6.0` | `26.1.1` | | [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `5.1.4` | `6.0.3` | | [eslint](https://github.com/eslint/eslint) | `9.39.2` | `10.7.0` | | [typescript](https://github.com/microsoft/TypeScript) | `5.9.3` | `7.0.2` | Updates `@alpacahq/alpaca-trade-api` from 3.1.3 to 4.0.1 - [Release notes](https://github.com/alpacahq/alpaca-trade-api-js/releases) - [Changelog](https://github.com/alpacahq/alpaca-trade-api-js/blob/master/CHANGELOG.md) - [Commits](alpacahq/alpaca-trade-api-js@v3.1.3...v4.0.1) Updates `puppeteer` from 24.42.0 to 25.3.0 - [Release notes](https://github.com/puppeteer/puppeteer/releases) - [Changelog](https://github.com/puppeteer/puppeteer/blob/main/CHANGELOG.md) - [Commits](puppeteer/puppeteer@puppeteer-v24.42.0...puppeteer-v25.3.0) Updates `undici` from 7.25.0 to 8.8.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.25.0...v8.8.0) Updates `webtorrent` from 2.8.5 to 3.0.16 - [Release notes](https://github.com/webtorrent/webtorrent/releases) - [Changelog](https://github.com/webtorrent/webtorrent/blob/master/CHANGELOG.md) - [Commits](webtorrent/webtorrent@v2.8.5...v3.0.16) Updates `@types/node` from 25.6.0 to 26.1.1 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@vitejs/plugin-react` from 5.1.4 to 6.0.3 - [Release notes](https://github.com/vitejs/vite-plugin-react/releases) - [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.0.3/packages/plugin-react) Updates `eslint` from 9.39.2 to 10.7.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v9.39.2...v10.7.0) Updates `typescript` from 5.9.3 to 7.0.2 - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](https://github.com/microsoft/TypeScript/commits) --- updated-dependencies: - dependency-name: "@alpacahq/alpaca-trade-api" dependency-version: 4.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: major - dependency-name: puppeteer dependency-version: 25.3.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: major - dependency-name: undici dependency-version: 8.8.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: major - dependency-name: webtorrent dependency-version: 3.0.16 dependency-type: direct:production update-type: version-update:semver-major dependency-group: major - dependency-name: "@types/node" dependency-version: 26.1.1 dependency-type: direct:development update-type: version-update:semver-major dependency-group: major - dependency-name: "@vitejs/plugin-react" dependency-version: 6.0.3 dependency-type: direct:development update-type: version-update:semver-major dependency-group: major - dependency-name: eslint dependency-version: 10.7.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: major - dependency-name: typescript dependency-version: 7.0.2 dependency-type: direct:development update-type: version-update:semver-major dependency-group: major ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-07-20T16:18:05Z

Labels

The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

github-actions · 2026-07-20T16:18:24Z

vu1nz Security Review

0 finding(s) in PR #?

No security issues found.

socket-security · 2026-07-20T16:19:07Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@types/node@26.1.1
	undici@8.8.0
	typescript@7.0.2
	@alpacahq/alpaca-trade-api@4.0.1
	webtorrent@3.0.16
	@vitejs/plugin-react@6.0.3
	puppeteer@25.3.0
	eslint@10.7.0

View full report

socket-security · 2026-07-20T16:19:09Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Publisher changed: npm `@typescript/typescript-aix-ppc64` is now published by microsoft1es Author: microsoft1es From: pnpm-lock.yaml → `npm/typescript@7.0.2` → `npm/@typescript/typescript-aix-ppc64@7.0.2` ℹ Read more on: This package \| This alert \| What is unstable ownership? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-aix-ppc64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `@typescript/typescript-aix-ppc64` under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt) From: pnpm-lock.yaml → `npm/typescript@7.0.2` → `npm/@typescript/typescript-aix-ppc64@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-aix-ppc64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Publisher changed: npm `@typescript/typescript-darwin-arm64` is now published by microsoft1es Author: microsoft1es From: pnpm-lock.yaml → `npm/typescript@7.0.2` → `npm/@typescript/typescript-darwin-arm64@7.0.2` ℹ Read more on: This package \| This alert \| What is unstable ownership? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-darwin-arm64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `@typescript/typescript-darwin-arm64` under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt) From: pnpm-lock.yaml → `npm/typescript@7.0.2` → `npm/@typescript/typescript-darwin-arm64@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-darwin-arm64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Publisher changed: npm `@typescript/typescript-darwin-x64` is now published by microsoft1es Author: microsoft1es From: pnpm-lock.yaml → `npm/typescript@7.0.2` → `npm/@typescript/typescript-darwin-x64@7.0.2` ℹ Read more on: This package \| This alert \| What is unstable ownership? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-darwin-x64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `@typescript/typescript-darwin-x64` under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt) From: pnpm-lock.yaml → `npm/typescript@7.0.2` → `npm/@typescript/typescript-darwin-x64@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-darwin-x64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Publisher changed: npm `@typescript/typescript-freebsd-arm64` is now published by microsoft1es Author: microsoft1es From: pnpm-lock.yaml → `npm/typescript@7.0.2` → `npm/@typescript/typescript-freebsd-arm64@7.0.2` ℹ Read more on: This package \| This alert \| What is unstable ownership? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-freebsd-arm64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `@typescript/typescript-freebsd-arm64` under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt) From: pnpm-lock.yaml → `npm/typescript@7.0.2` → `npm/@typescript/typescript-freebsd-arm64@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-freebsd-arm64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Publisher changed: npm `@typescript/typescript-freebsd-x64` is now published by microsoft1es Author: microsoft1es From: pnpm-lock.yaml → `npm/typescript@7.0.2` → `npm/@typescript/typescript-freebsd-x64@7.0.2` ℹ Read more on: This package \| This alert \| What is unstable ownership? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-freebsd-x64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `@typescript/typescript-freebsd-x64` under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt) From: pnpm-lock.yaml → `npm/typescript@7.0.2` → `npm/@typescript/typescript-freebsd-x64@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-freebsd-x64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Publisher changed: npm `@typescript/typescript-linux-arm` is now published by microsoft1es Author: microsoft1es From: pnpm-lock.yaml → `npm/typescript@7.0.2` → `npm/@typescript/typescript-linux-arm@7.0.2` ℹ Read more on: This package \| This alert \| What is unstable ownership? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-linux-arm@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `@typescript/typescript-linux-arm` under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt) From: pnpm-lock.yaml → `npm/typescript@7.0.2` → `npm/@typescript/typescript-linux-arm@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-linux-arm@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Publisher changed: npm `@typescript/typescript-linux-arm64` is now published by microsoft1es Author: microsoft1es From: pnpm-lock.yaml → `npm/typescript@7.0.2` → `npm/@typescript/typescript-linux-arm64@7.0.2` ℹ Read more on: This package \| This alert \| What is unstable ownership? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-linux-arm64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `@typescript/typescript-linux-arm64` under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt) From: pnpm-lock.yaml → `npm/typescript@7.0.2` → `npm/@typescript/typescript-linux-arm64@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-linux-arm64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Publisher changed: npm `@typescript/typescript-linux-loong64` is now published by microsoft1es Author: microsoft1es From: pnpm-lock.yaml → `npm/typescript@7.0.2` → `npm/@typescript/typescript-linux-loong64@7.0.2` ℹ Read more on: This package \| This alert \| What is unstable ownership? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-linux-loong64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `@typescript/typescript-linux-loong64` under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt) From: pnpm-lock.yaml → `npm/typescript@7.0.2` → `npm/@typescript/typescript-linux-loong64@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-linux-loong64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Publisher changed: npm `@typescript/typescript-linux-mips64el` is now published by microsoft1es Author: microsoft1es From: pnpm-lock.yaml → `npm/typescript@7.0.2` → `npm/@typescript/typescript-linux-mips64el@7.0.2` ℹ Read more on: This package \| This alert \| What is unstable ownership? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-linux-mips64el@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `@typescript/typescript-linux-mips64el` under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt) From: pnpm-lock.yaml → `npm/typescript@7.0.2` → `npm/@typescript/typescript-linux-mips64el@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-linux-mips64el@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Publisher changed: npm `@typescript/typescript-linux-ppc64` is now published by microsoft1es Author: microsoft1es From: pnpm-lock.yaml → `npm/typescript@7.0.2` → `npm/@typescript/typescript-linux-ppc64@7.0.2` ℹ Read more on: This package \| This alert \| What is unstable ownership? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-linux-ppc64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `@typescript/typescript-linux-ppc64` under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt) From: pnpm-lock.yaml → `npm/typescript@7.0.2` → `npm/@typescript/typescript-linux-ppc64@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-linux-ppc64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Publisher changed: npm `@typescript/typescript-linux-riscv64` is now published by microsoft1es Author: microsoft1es From: pnpm-lock.yaml → `npm/typescript@7.0.2` → `npm/@typescript/typescript-linux-riscv64@7.0.2` ℹ Read more on: This package \| This alert \| What is unstable ownership? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-linux-riscv64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `@typescript/typescript-linux-riscv64` under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt) From: pnpm-lock.yaml → `npm/typescript@7.0.2` → `npm/@typescript/typescript-linux-riscv64@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-linux-riscv64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Publisher changed: npm `@typescript/typescript-linux-s390x` is now published by microsoft1es Author: microsoft1es From: pnpm-lock.yaml → `npm/typescript@7.0.2` → `npm/@typescript/typescript-linux-s390x@7.0.2` ℹ Read more on: This package \| This alert \| What is unstable ownership? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-linux-s390x@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `@typescript/typescript-linux-s390x` under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/NOTICE.txt) From: pnpm-lock.yaml → `npm/typescript@7.0.2` → `npm/@typescript/typescript-linux-s390x@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-linux-s390x@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Publisher changed: npm `@typescript/typescript-linux-x64` is now published by microsoft1es Author: microsoft1es From: pnpm-lock.yaml → `npm/typescript@7.0.2` → `npm/@typescript/typescript-linux-x64@7.0.2` ℹ Read more on: This package \| This alert \| What is unstable ownership? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-linux-x64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
See 18 more rows in the dashboard

View full report

dependabot · 2026-07-21T03:22:20Z

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

ralyodio closed this Jul 21, 2026

ralyodio deleted the dependabot/npm_and_yarn/major-aa8b6358f8 branch July 21, 2026 03:22

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

deps(deps): bump the major group with 8 updates#136

deps(deps): bump the major group with 8 updates#136
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/major-aa8b6358f8

dependabot Bot commented on behalf of github Jul 20, 2026

Uh oh!

dependabot Bot commented on behalf of github Jul 20, 2026

Uh oh!

github-actions Bot commented Jul 20, 2026

Uh oh!

socket-security Bot commented Jul 20, 2026

Uh oh!

socket-security Bot commented Jul 20, 2026

Uh oh!

dependabot Bot commented on behalf of github Jul 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 20, 2026

v4.0.1

Patch Changes

v4.0.0

Major Changes

Minor Changes

4.0.1

Patch Changes

4.0.0

Major Changes

Minor Changes

puppeteer-core: v25.3.0

25.3.0 (2026-07-01)

🎉 Features

🛠️ Fixes

📄 Documentation

Dependencies

puppeteer: v25.3.0

25.3.0 (2026-07-01)

♻️ Chores

Dependencies

puppeteer-core: v25.2.1

25.2.1 (2026-06-24)

🛠️ Fixes

25.3.0 (2026-07-01)

♻️ Chores

Dependencies

🎉 Features

🛠️ Fixes

📄 Documentation

25.2.1 (2026-06-24)

♻️ Chores

Dependencies

🛠️ Fixes

v8.8.0

What's Changed

New Contributors

v8.7.0

What's Changed

v3.0.16

3.0.16 (2026-05-29)

Bug Fixes

v3.0.15

3.0.15 (2026-05-29)

Bug Fixes

v3.0.14

3.0.14 (2026-05-28)

Bug Fixes

v3.0.13

3.0.13 (2026-05-27)

Bug Fixes

v3.0.12

3.0.12 (2026-05-27)

Bug Fixes

v3.0.11

3.0.11 (2026-05-27)

Bug Fixes

v3.0.10

3.0.10 (2026-05-26)

3.0.16 (2026-05-29)

Bug Fixes

3.0.15 (2026-05-29)

Bug Fixes

3.0.14 (2026-05-28)

Bug Fixes

3.0.13 (2026-05-27)

Bug Fixes

3.0.12 (2026-05-27)

Bug Fixes

3.0.11 (2026-05-27)

Bug Fixes

3.0.10 (2026-05-26)

Bug Fixes

3.0.9 (2026-05-26)

plugin-react@6.0.3

plugin-react@6.0.2

Allow all options in reactCompilerPreset (#1189)

plugin-react@6.0.1

Expand `@rolldown/plugin-babel` peer dep range (#1146)

Expand `@rolldown/plugin-babel` peer dep range (#1146)