Skip to content

Chore(deps): bump the npm-dependencies group across 1 directory with 18 updates - #46

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-dependencies-2ec8f54bcb
Open

Chore(deps): bump the npm-dependencies group across 1 directory with 18 updates#46
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-dependencies-2ec8f54bcb

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 5, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm-dependencies group with 18 updates in the / directory:

Package From To
@fastify/static 9.1.3 10.1.3
@github/copilot-sdk 1.0.6 1.0.11
fastify 5.9.0 5.12.1
marked 15.0.12 18.0.11
sharp 0.35.3 0.35.4
tar 7.5.19 7.5.22
zod 4.4.3 4.5.2
@astrojs/starlight 0.41.3 0.41.10
@types/node 22.20.0 22.20.1
@vitest/coverage-v8 4.1.9 4.1.11
astro 7.0.6 7.2.9
globals 17.7.0 17.11.0
prettier 3.9.4 3.9.6
tsx 4.23.0 4.23.12
typescript 6.0.3 7.0.2
typescript-eslint 8.62.1 8.68.0
vitest 4.1.9 4.1.11
@flotiq/flotiq-api-sdk 1.1.0 1.1.2

Updates @fastify/static from 9.1.3 to 10.1.3

Release notes

Sourced from @​fastify/static's releases.

v10.1.3

What's Changed

Full Changelog: fastify/fastify-static@v10.1.2...v10.1.3

v10.1.2

⚠️ Security Release

What's Changed

Full Changelog: fastify/fastify-static@v10.1.1...v10.1.2

v10.1.1

⚠️ Security Release

What's Changed

Full Changelog: fastify/fastify-static@v10.1.0...v10.1.1

v10.1.0

What's Changed

New Contributors

Full Changelog: fastify/fastify-static@v10.0.0...v10.1.0

v10.0.0

Breaking Changes

  • setHeaders now using FastifyReply instead of Response.

You should refactor your code to use the reply helpers. For example,

// Before
const fastify = require('fastify')({logger: true})
</tr></table>

... (truncated)

Commits

Updates @github/copilot-sdk from 1.0.6 to 1.0.11

Release notes

Sourced from @​github/copilot-sdk's releases.

v1.0.11

What's Changed

New Contributors

Full Changelog: github/copilot-sdk@v1.0.9...v1.0.11

v1.0.11-preview.2

Feature: rewind support across all SDKs

The Copilot runtime supports rewinding conversation history and tracked file changes. SDKs can now opt into file-change tracking via a new enableFileChangeTracking session option, and then use rewind to restore the session to an earlier checkpoint. (#2321)

// TypeScript
const session = await client.startSession({ enableFileChangeTracking: true });
const rewindPoints = await session.rpc.session.listRewindPoints();
await session.rpc.session.rewind({ rewindPointId: rewindPoints[0].id });
// C#
var session = await client.StartSessionAsync(new SessionOptions { EnableFileChangeTracking = true });
var points = await session.Rpc.Session.ListRewindPointsAsync();
await session.Rpc.Session.RewindAsync(new RewindParams { RewindPointId = points[0].Id });
</tr></table>

... (truncated)

Changelog

Sourced from @​github/copilot-sdk's changelog.

Changelog

All notable changes to the Copilot SDK are documented in this file.

This changelog is automatically generated by an AI agent when stable releases are published. See GitHub Releases for the full list.

[Unreleased]

Feature: cancellation for host-owned external tools

Host-owned external tool callbacks are now cancelled when their runtime request completes or their SDK session terminates. The cancellation primitive is idiomatic per SDK: .NET passes a request token to AIFunction, Node.js exposes ToolInvocation.signal, Go cancels ToolInvocation.TraceContext, Java cancels the returned CompletableFuture, Python cancels the handler task, and Rust drops the handler future. Go handlers that retain TraceContext for background work must derive a separate lifetime because the invocation context is cancelled when the request ends.

Feature: declare application identity with client info

Client options now accept optional client info (application name and version, integration name and version) across all six SDKs, exposed idiomatically per language (clientInfo in Node.js, client_info in Python and Rust, ClientInfo in Go and .NET, setClientInfo in Java). When set, the SDK forwards it on the server.connect handshake so the telemetry the runtime emits on the connection is attributed to the application and its Copilot integration instead of the runtime's own build. All fields are optional, and leaving client info unset keeps the runtime's default attribution. See Client info.

Feature: Node Agent Factories pagination and run notifications

The experimental Node.js Agent Factories convenience API now supports paginated run history. Existing session.factory.listRuns() calls still return the runs array, while calls with afterSeq, beforeSeq, or limit return the full page with cursor and truncation metadata.

Factory run and resume options now accept notifyOnComplete and logPhaseNames. The SDK forwards these options to the Copilot CLI for new and resumed runs.

Feature: selectable ask_user session behavior

Session create and cold resume now accept a language-specific askUserVariant option with legacy and elicitation values. SDK sessions retain the legacy question-and-answer tool by default. Select elicitation and provide an elicitation handler to expose the structured form-based ask_user tool.

Feature: rotating session-scoped GitHub credentials

All six SDKs can now acquire short-lived GitHub credentials through a session-scoped callback. The SDK registers the callback before session create or resume, maps initial and refresh requests to the owning session, and removes registrations on rollback, replacement, session close, and client close. Static per-session gitHubToken credentials remain supported and are mutually exclusive with the callback.

Token responses use the shared tagged token/cancelled shape and require expiresIn, expressed as the positive number of seconds remaining when the callback completes. See github/copilot-agent-runtime#16381 for the runtime credential-authority implementation.

Initial acquisition occurs during create or resume; cancellation, callback errors, and invalid credentials reject that operation instead of falling back to ambient authentication. Idle sessions refresh only before their next credential-consuming operation.

Feature: extensions can request sensitive environment variables

Copilot CLI extensions can now ask for named sensitive environment variables when they join a session. joinSession() accepts a requestedEnvironmentVariables option listing the variable names the extension needs. The CLI shows a permission prompt naming the extension and the exact variables requested. On approval, only those variables reach that extension and their values are written into the extension process's process.env before joinSession() resolves. On denial, joinSession() rejects, the extension does not load, and its tools never reach the model.

An approval is remembered against the exact set of names the user saw, so an extension that later asks for one more variable prompts again. Names that are unset, or that the CLI does not filter from extensions, are not prompted for. This is the client half of the feature; it requires a Copilot CLI that supports extension environment access, and older CLIs ignore the request and grant nothing.

import { joinSession } from "@github/copilot-sdk/extension";
const session = await joinSession({
requestedEnvironmentVariables: ["GITHUB_TOKEN"],
});
const token = process.env.GITHUB_TOKEN;

... (truncated)

Commits
  • a550258 sdk: Forward decisionContext on permission replies across languages (#2294)
  • 1935fd3 Add built-in plugin directory support (#2330)
  • 3b0d556 [SDK/Factories] Add argsSchema To The Factory Authoring Surface (#2315)
  • f0c89d1 Fix codegen for internal runtime schemas (#2331)
  • 811adc0 [maven-release-plugin] prepare for next development iteration
  • 89b68c1 [maven-release-plugin] prepare release java/v1.0.11-preview.2
  • 9ce1577 docs: update version references to 1.0.11-preview.2
  • 5c2dec4 test(java): skip linux runtime tests on other platforms (#2325)
  • 4134c5e fix(java): scope documentation version updates (#2324)
  • d9a6fab [java] Add linux-x64 implementation of in process Copilot CLI (#2301)
  • Additional commits viewable in compare view

Updates fastify from 5.9.0 to 5.12.1

Release notes

Sourced from fastify's releases.

v5.12.1

⚠️ Security release

What's Changed

Full Changelog: fastify/fastify@v5.12.0...v5.12.1

v5.12.0

What's Changed

Full Changelog: fastify/fastify@v5.11.3...v5.12.0

v5.11.3

What's Changed

New Contributors

Full Changelog: fastify/fastify@v5.11.2...v5.11.3

v5.11.2

What's Changed

... (truncated)

Commits

Updates marked from 15.0.12 to 18.0.11

Release notes

Sourced from marked's releases.

v18.0.11

18.0.11 (2026-08-24)

Bug Fixes

  • do not nest a link inside a link (#4051) (e250e31)
  • inlineTokens rebuilds the reflink-mask preamble per call (#4040) (0653c24)
  • keep emphasis in the text of a rejected reference link (#4059) (b699db3)

v18.0.10

18.0.10 (2026-08-18)

Bug Fixes

  • keep the em/strong mask the same length as the source (#4044) (681373c)
  • parse EOF backtick fences after paragraphs (#4039) (81bd750)
  • place task checkboxes after list loose is finalized (#4046) (b8cf7dc), closes #4045

v18.0.9

18.0.9 (2026-08-04)

Bug Fixes

  • an unmatched strong run before emphasis stays literal (#4008) (e8544e6)
  • Fix spurious deeper nesting in a blockquote continuation (#4030) (452f1ed)
  • pedantic foo: and "word" emphasis parsing (#3999) (823093f)

v18.0.8

18.0.8 (2026-08-04)

Bug Fixes

  • fall back to default checkbox renderer when extension returns false (#4023) (e1b6139)

v18.0.7

18.0.7 (2026-07-21)

Bug Fixes

  • Avoid O(n^2) backtracking in HTML block close and tilde interrupt regexes (#4014) (f945fc5), closes #3991
  • Avoid O(n^2) masked source rebuild in inline tokenizer (#4017) (9154f8f)
  • keep empty list after blockquote as a sibling block (#4004) (3f144a0)
  • preserve code spans adjacent to tildes (#4012) (0de7188)
  • Recognize setext headings whose first line starts with # (#4015) (f056437), closes #1
  • treat a line of only tabs as a blank line between paragraphs (#4007) (bc2f121)

... (truncated)

Commits
  • 53cb13f chore(release): 18.0.11 [skip ci]
  • 0c6b2a6 docs: add adaptable bullet point (#4058)
  • c430a64 chore(deps-dev): bump eslint from 10.8.1 to 10.9.0 (#4069)
  • b699db3 fix: keep emphasis in the text of a rejected reference link (#4059)
  • 0653c24 fix: inlineTokens rebuilds the reflink-mask preamble per call (#4040)
  • e250e31 fix: do not nest a link inside a link (#4051)
  • 8698d35 chore(release): 18.0.10 [skip ci]
  • 58367a5 chore(deps-dev): bump eslint from 10.8.0 to 10.8.1 (#4055)
  • a426c4d chore(deps-dev): bump esbuild from 0.28.1 to 0.28.2 (#4056)
  • a5cf277 chore(deps-dev): bump highlight.js from 11.11.1 to 11.12.0 (#4057)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for marked since your current version.


Updates sharp from 0.35.3 to 0.35.4

Release notes

Sourced from sharp's releases.

v0.35.4

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.3

v0.35.4-rc.0

Commits
  • 7f1a0a2 Release v0.35.4
  • f927818 Upgrade to sharp-libvips v1.3.3
  • e802092 Prerelease v0.35.4-rc.0
  • e13eb2f CI: Fix wasm32 build (#4589)
  • a82a0b3 Upgrade to libvips v8.18.6
  • 8044fe4 Bound resize dimensions to coordinate limit
  • 147f859 Docs: changelog entries for #4578 #4584
  • ee5bfb8 Tests: use yauzl directly rather than via extract-zip wrapper
  • 7a77889 Bump uraimo/run-on-arch-action from 3.1.0 to 3.2.0 (#4588)
  • ea5bef2 Improve support for input Streams finishing before output is requested (#4584)
  • Additional commits viewable in compare view

Updates tar from 7.5.19 to 7.5.22

Commits

Updates zod from 4.4.3 to 4.5.2

Release notes

Sourced from zod's releases.

v4.5.2

Commits:

  • a354314ac04fdd5484aa62dd5c3a4b553211a0e4 fix(docs): keep blog posts out of the docs collection (#6484)
  • d378c42aff6869f0929058a7923cd775880f5c4c ci: drop canary publishing from the release workflow (#6487)
  • 212b941791e7faae078e17645eb612824fd8f79a fix(v4): let a prototype method getter answer a bare call so vi.spyOn works (#6488)
  • e7576f542a7bc7ef3cc5eeec237714fd0e6b6e98 docs(blog): let the page show through the navbar in dark mode (#6489)
  • fedb06fafe33a66ce0b5c236ad2557e0a5a170fe fix(docs): match the blog TOC hover bar to the 2px active indicator
  • 6c932fcb2eea6eb671710ea058ca9fdc382ada89 chore: bump devcontainer image to Node 24 (#6470)
  • 6635d9dd367a664109de83c021995821f48efa29 docs(blog): soften the "method memoization" attribution
  • 019ae299cc75daa132bf1acf59086a520abf6b85 fix(docs): drop ISR on the docs route so the home page hydrates
  • 652bb438aa4c626c1cd7948c6849c4691239fca7 chore(docs): drop the scroll log from the route-change scroller
  • 571c8e8a3d73b4305f4abfdd6977773cc12f2bf5 fix(docs): render blog tabs with the stock fumadocs tab card
  • 9a193aa24b4efa3b315b91d4c56c8bc385b8513f 4.5.2

v4.5.1

Commits:

  • 2e862dbf89da2835e5206a8fd3d3be61afe3cf7f ci: gate the GitHub release and JSR publish on the version being live on npm
  • 8e03380510db36fa6fda979fc78a375fdea8021c 4.5.1

v4.5.0

Zod 4.5 is now available.

npm install zod@latest

At a glance:

@dependabot
Chore(deps): bump the npm-dependencies group across 1 directory with …
ad242ca 
…18 updates

Bumps the npm-dependencies group with 18 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@fastify/static](https://github.com/fastify/fastify-static) | `9.1.3` | `10.1.3` |
| [@github/copilot-sdk](https://github.com/github/copilot-sdk) | `1.0.6` | `1.0.11` |
| [fastify](https://github.com/fastify/fastify) | `5.9.0` | `5.12.1` |
| [marked](https://github.com/markedjs/marked) | `15.0.12` | `18.0.11` |
| [sharp](https://github.com/lovell/sharp) | `0.35.3` | `0.35.4` |
| [tar](https://github.com/isaacs/node-tar) | `7.5.19` | `7.5.22` |
| [zod](https://github.com/colinhacks/zod) | `4.4.3` | `4.5.2` |
| [@astrojs/starlight](https://github.com/withastro/starlight/tree/HEAD/packages/starlight) | `0.41.3` | `0.41.10` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `22.20.0` | `22.20.1` |
| [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.1.9` | `4.1.11` |
| [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `7.0.6` | `7.2.9` |
| [globals](https://github.com/sindresorhus/globals) | `17.7.0` | `17.11.0` |
| [prettier](https://github.com/prettier/prettier) | `3.9.4` | `3.9.6` |
| [tsx](https://github.com/privatenumber/tsx) | `4.23.0` | `4.23.12` |
| [typescript](https://github.com/microsoft/TypeScript) | `6.0.3` | `7.0.2` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.62.1` | `8.68.0` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.9` | `4.1.11` |
| @flotiq/flotiq-api-sdk | `1.1.0` | `1.1.2` |



Updates `@fastify/static` from 9.1.3 to 10.1.3
- [Release notes](https://github.com/fastify/fastify-static/releases)
- [Commits](fastify/fastify-static@v9.1.3...v10.1.3)

Updates `@github/copilot-sdk` from 1.0.6 to 1.0.11
- [Release notes](https://github.com/github/copilot-sdk/releases)
- [Changelog](https://github.com/github/copilot-sdk/blob/main/CHANGELOG.md)
- [Commits](github/copilot-sdk@v1.0.6...v1.0.11)

Updates `fastify` from 5.9.0 to 5.12.1
- [Release notes](https://github.com/fastify/fastify/releases)
- [Commits](fastify/fastify@v5.9.0...v5.12.1)

Updates `marked` from 15.0.12 to 18.0.11
- [Release notes](https://github.com/markedjs/marked/releases)
- [Commits](markedjs/marked@v15.0.12...v18.0.11)

Updates `sharp` from 0.35.3 to 0.35.4
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](lovell/sharp@v0.35.3...v0.35.4)

Updates `tar` from 7.5.19 to 7.5.22
- [Release notes](https://github.com/isaacs/node-tar/releases)
- [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md)
- [Commits](isaacs/node-tar@v7.5.19...v7.5.22)

Updates `zod` from 4.4.3 to 4.5.2
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.4.3...v4.5.2)

Updates `@astrojs/starlight` from 0.41.3 to 0.41.10
- [Release notes](https://github.com/withastro/starlight/releases)
- [Changelog](https://github.com/withastro/starlight/blob/main/packages/starlight/CHANGELOG.md)
- [Commits](https://github.com/withastro/starlight/commits/@astrojs/starlight@0.41.10/packages/starlight)

Updates `@types/node` from 22.20.0 to 22.20.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@vitest/coverage-v8` from 4.1.9 to 4.1.11
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/coverage-v8)

Updates `astro` from 7.0.6 to 7.2.9
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.2.9/packages/astro)

Updates `globals` from 17.7.0 to 17.11.0
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](sindresorhus/globals@v17.7.0...v17.11.0)

Updates `prettier` from 3.9.4 to 3.9.6
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.9.4...3.9.6)

Updates `tsx` from 4.23.0 to 4.23.12
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.23.0...v4.23.12)

Updates `typescript` from 6.0.3 to 7.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](microsoft/TypeScript@v6.0.3...v7.0.2)

Updates `typescript-eslint` from 8.62.1 to 8.68.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.68.0/packages/typescript-eslint)

Updates `vitest` from 4.1.9 to 4.1.11
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest)

Updates `@flotiq/flotiq-api-sdk` from 1.1.0 to 1.1.2

---
updated-dependencies:
- dependency-name: "@fastify/static"
  dependency-version: 10.1.3
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: "@github/copilot-sdk"
  dependency-version: 1.0.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: fastify
  dependency-version: 5.12.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: marked
  dependency-version: 18.0.11
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: sharp
  dependency-version: 0.35.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: tar
  dependency-version: 7.5.22
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: zod
  dependency-version: 4.5.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: "@astrojs/starlight"
  dependency-version: 0.41.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: "@types/node"
  dependency-version: 22.20.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: "@vitest/coverage-v8"
  dependency-version: 4.1.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: astro
  dependency-version: 7.2.9
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: globals
  dependency-version: 17.11.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: prettier
  dependency-version: 3.9.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: tsx
  dependency-version: 4.23.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: typescript-eslint
  dependency-version: 8.68.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: vitest
  dependency-version: 4.1.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: "@flotiq/flotiq-api-sdk"
  dependency-version: 1.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 5, 2026
@dependabot
dependabot Bot requested a review from rgembalik as a code owner September 5, 2026 08:16
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 5, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@rgembalik rgembalik Awaiting requested review from rgembalik rgembalik is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants