Skip to content

chore(deps): bump the production-dependencies group across 1 directory with 4 updates#60

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-d35d33aa63
Open

chore(deps): bump the production-dependencies group across 1 directory with 4 updates#60
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-d35d33aa63

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 15, 2026

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 4 updates in the / directory: accounts, incur, undici and viem.

Updates accounts from 0.14.11 to 0.15.1

Release notes

Sourced from accounts's releases.

accounts@0.15.1

Patch Changes

  • 03c1161: Added string and { address } forms to the wallet_connect identity.email capability for requiring a specific email.

accounts@0.15.0

Minor Changes

  • 2cfca91: Updated viem (>=2.54.0) and ox (~0.14.30) for the config-id-free TIP-1061 multisig format, removing genesisConfigId from the multisig relay ResolveConfig, Operation, and Status shapes.

accounts@0.14.12

Patch Changes

  • 186b1f7: Added provider MPP account resolution parameters for locally managed access keys.
  • 2e092e9: Added exact access-key selection for provider-backed mppx parameters.
  • d5c0d66: Changed Mount.auto to allow trusted hosts to use iframe mounts without IntersectionObserver v2 support.
  • 98a8138: Added identity to Provider.create, minting verified-email id tokens from a configured OIDC issuer when local adapters fulfill wallet_connect.
  • 4aa479d: Add SIWE resources to wallet_connect auth challenges, support server-provided SIWE statements in Handler.auth, and preserve extra auth verify JSON fields.
Changelog

Sourced from accounts's changelog.

0.15.1

Patch Changes

  • 03c1161: Added string and { address } forms to the wallet_connect identity.email capability for requiring a specific email.

0.15.0

Minor Changes

  • 2cfca91: Updated viem (>=2.54.0) and ox (~0.14.30) for the config-id-free TIP-1061 multisig format, removing genesisConfigId from the multisig relay ResolveConfig, Operation, and Status shapes.

0.14.12

Patch Changes

  • 186b1f7: Added provider MPP account resolution parameters for locally managed access keys.
  • 2e092e9: Added exact access-key selection for provider-backed mppx parameters.
  • d5c0d66: Changed Mount.auto to allow trusted hosts to use iframe mounts without IntersectionObserver v2 support.
  • 98a8138: Added identity to Provider.create, minting verified-email id tokens from a configured OIDC issuer when local adapters fulfill wallet_connect.
  • 4aa479d: Add SIWE resources to wallet_connect auth challenges, support server-provided SIWE statements in Handler.auth, and preserve extra auth verify JSON fields.
Commits

Updates incur from 0.4.8 to 0.4.11

Release notes

Sourced from incur's releases.

incur@0.4.11

Patch Changes

  • 4de8518: Fixed --mcp stdio transport loading against @modelcontextprotocol/server prereleases that export it from ./stdio.

incur@0.4.10

Patch Changes

  • a94480c: Added mcp doctor command that smoke-tests MCP initialization and tool listing without calling tools.
  • f069769: Added MCP tool name and description metadata overrides for commands, including duplicate exposed-name validation.
  • 309d566: Added support for non-object MCP output schemas by omitting them from tool registration while preserving JSON text output.

incur@0.4.9

Patch Changes

  • 0720a24: Added custom global options support via globals and globalAlias on Cli.create().
  • 7e94269: Added destructive command hints to generated skill files.
  • a14e41d: Fixed BigInt serialization across JSON, JSONL, MCP, and fetch output paths.
  • cb05897: Fixed MCP registration command detection for global, local, and source-launched CLIs.
  • 15c9068: Defaulted MCP-over-HTTP to stateless transport behavior and returned 405 for unsupported stateless methods.
  • 1c52be9: Lazy-loaded YAML and MCP SDK imports outside plain command runs.
  • dc0faff: Added typed MCP command metadata for instructions and annotations.
  • 1cbe459: Fixed HTTP and MCP command input validation to return standard validation field errors for object-shaped inputs.
  • 43c1551: Added banner option to Cli.create for displaying custom content above root help output with sync/async functions, error swallowing, and mode targeting.
  • a0f469f: Fixed streaming command terminal records so HTTP NDJSON responses preserved returned c.ok() CTA metadata, represented returned or yielded c.error() values as terminal errors, included terminal duration metadata, unwound generators on response cancellation, and preserved IncurError.retryable metadata in streaming machine-format errors.
  • 9a43129: Surfaced c.ok(..., { cta }) metadata on MCP tool responses under _meta.cta.
  • a0f469f: Fixed generated and synced skills to use the same command projection as CLI skill output, avoided duplicate skills for command aliases, preserved output schemas and examples consistently, and included the fetch gateway skill hint for fetch-based commands.
  • bffbdf4: Typed the root command hint option on Cli.create.
Changelog

Sourced from incur's changelog.

0.4.11

Patch Changes

  • 4de8518: Fixed --mcp stdio transport loading against @modelcontextprotocol/server prereleases that export it from ./stdio.

0.4.10

Patch Changes

  • a94480c: Added mcp doctor command that smoke-tests MCP initialization and tool listing without calling tools.
  • f069769: Added MCP tool name and description metadata overrides for commands, including duplicate exposed-name validation.
  • 309d566: Added support for non-object MCP output schemas by omitting them from tool registration while preserving JSON text output.

0.4.9

Patch Changes

  • 0720a24: Added custom global options support via globals and globalAlias on Cli.create().
  • 7e94269: Added destructive command hints to generated skill files.
  • a14e41d: Fixed BigInt serialization across JSON, JSONL, MCP, and fetch output paths.
  • cb05897: Fixed MCP registration command detection for global, local, and source-launched CLIs.
  • 15c9068: Defaulted MCP-over-HTTP to stateless transport behavior and returned 405 for unsupported stateless methods.
  • 1c52be9: Lazy-loaded YAML and MCP SDK imports outside plain command runs.
  • dc0faff: Added typed MCP command metadata for instructions and annotations.
  • 1cbe459: Fixed HTTP and MCP command input validation to return standard validation field errors for object-shaped inputs.
  • 43c1551: Added banner option to Cli.create for displaying custom content above root help output with sync/async functions, error swallowing, and mode targeting.
  • a0f469f: Fixed streaming command terminal records so HTTP NDJSON responses preserved returned c.ok() CTA metadata, represented returned or yielded c.error() values as terminal errors, included terminal duration metadata, unwound generators on response cancellation, and preserved IncurError.retryable metadata in streaming machine-format errors.
  • 9a43129: Surfaced c.ok(..., { cta }) metadata on MCP tool responses under _meta.cta.
  • a0f469f: Fixed generated and synced skills to use the same command projection as CLI skill output, avoided duplicate skills for command aliases, preserved output schemas and examples consistently, and included the fetch gateway skill hint for fetch-based commands.
  • bffbdf4: Typed the root command hint option on Cli.create.
Commits

Updates undici from 8.5.0 to 8.7.0

Release notes

Sourced from undici's releases.

v8.7.0

What's Changed

New Contributors

Full Changelog: nodejs/undici@v8.6.0...v8.7.0

v8.6.0

What's Changed

... (truncated)

Commits
  • cb4c2f1 Bumped v8.7.0 (#5501)
  • a8d1a95 fix: auto-detect HTTP proxy tunneling (#5116)
  • cb30e58 fix: add static buildDispatch method to RedirectHandler type definition (#5442)
  • 0c08579 fix(h2): requeue request on GOAWAY'd session instead of crashing (#5453)
  • e5b3364 fix(h2): guard onResponse against a 'response' event delivered after completi...
  • c0007f4 docs: add reproduction guide and update bug report template (#5451)
  • e529cab fix: ignore an unparseable Set-Cookie Expires attribute (#5488)
  • 754742c fix(h2): destroy the stream on abort instead of relying on close() (#5462)
  • db34f5f fix(readable): ignore late consume chunks (#5375)
  • 4ea05a8 fix: reject non-ascii octets in validateCookiePath (#5452)
  • Additional commits viewable in compare view

Updates viem from 2.54.0 to 2.54.6

Release notes

Sourced from viem's releases.

viem@2.54.6

Patch Changes

  • #4807 f1ac4480d0c1c6f29bf709f116068e903643ecad Thanks @​jxom! - viem/tempo: Supported calling token .call builders without a Client (restores the pre-2.54 call signature). When the Client is omitted, token must be a TIP20 token id or contract address, and formatted amounts require explicit decimals.

viem@2.54.5

Patch Changes

viem@2.54.4

Patch Changes

viem@2.54.3

Patch Changes

viem@2.54.2

Patch Changes

viem@2.54.1

Patch Changes

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the production-dependencies group across 1 director…
0e73528 
…y with 4 updates

Bumps the production-dependencies group with 4 updates in the / directory: [accounts](https://github.com/tempoxyz/accounts), [incur](https://github.com/wevm/incur), [undici](https://github.com/nodejs/undici) and [viem](https://github.com/wevm/viem).


Updates `accounts` from 0.14.11 to 0.15.1
- [Release notes](https://github.com/tempoxyz/accounts/releases)
- [Changelog](https://github.com/tempoxyz/accounts/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tempoxyz/accounts/compare/accounts@0.14.11...accounts@0.15.1)

Updates `incur` from 0.4.8 to 0.4.11
- [Release notes](https://github.com/wevm/incur/releases)
- [Changelog](https://github.com/wevm/incur/blob/main/CHANGELOG.md)
- [Commits](https://github.com/wevm/incur/compare/incur@0.4.8...incur@0.4.11)

Updates `undici` from 8.5.0 to 8.7.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v8.5.0...v8.7.0)

Updates `viem` from 2.54.0 to 2.54.6
- [Release notes](https://github.com/wevm/viem/releases)
- [Commits](https://github.com/wevm/viem/compare/viem@2.54.0...viem@2.54.6)

---
updated-dependencies:
- dependency-name: accounts
  dependency-version: 0.15.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: incur
  dependency-version: 0.4.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: undici
  dependency-version: 8.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: viem
  dependency-version: 2.54.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 15, 2026
@socket-security

socket-security Bot commented Jul 15, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Addedincur@​0.4.117710010097100
Updatedaccounts@​0.14.11 ⏵ 0.15.17910099 +199 +2100
Addedundici@​8.7.09710010097100
Addedviem@​2.54.69710010098100

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants