Skip to content

Bump the npm group across 1 directory with 13 updates - #7

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-aa6dff5407
Open

Bump the npm group across 1 directory with 13 updates#7
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-aa6dff5407

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 18, 2026

Copy link
Copy Markdown

Bumps the npm group with 13 updates in the / directory:

Package From To
@typesafe-ai/sdk 0.6.0 0.7.0
dotenv 18.0.1 18.0.8
express 5.2.1 5.3.0
express-rate-limit 8.7.0 8.7.1
zod 4.6.5 4.6.7
@biomejs/biome 2.5.14 2.5.15
@types/node 26.6.2 26.6.5
concurrently 10.0.5 10.0.6
playwright 1.63.0 1.64.1
tsup 8.5.1 9.0.0
tsx 4.23.13 4.23.15
vite 8.3.0 8.3.4
vitest 5.0.1 5.0.5

Updates @typesafe-ai/sdk from 0.6.0 to 0.7.0

Release notes

Sourced from @​typesafe-ai/sdk's releases.

v0.7.0 (2026-10-14)

Breaking changes

  • require Node.js 22 or newer
  • stop exporting request payload types

Features

  • support images, as an experimental feature enabled with the TypeSafe-Danger-Zone-Images: true header: create them with image() or Image.fromBase64(), then place them in state, question instructions, or criteria, write them into text with withAssets and withAssets.join, or reference them by names you choose in assets
  • add box questions, which locate what their instructions describe in an image; use them with the jev-preview model
  • compress request bodies of 1 KiB or more with zstd on Node.js 22.15 or newer; pass compression: false to send them uncompressed

Bug fixes

  • allow null token counts in usage
  • add more request validation checks
  • reject the returned promise for invalid requests instead of throwing
  • accept score criteria lists built at runtime
  • stop an unhandled rejection on Node.js 22 when a request times out or is aborted mid-body
Changelog

Sourced from @​typesafe-ai/sdk's changelog.

v0.7.0 (2026-10-14)

Breaking changes

  • require Node.js 22 or newer
  • stop exporting request payload types

Features

  • support images, as an experimental feature enabled with the TypeSafe-Danger-Zone-Images: true header: create them with image() or Image.fromBase64(), then place them in state, question instructions, or criteria, write them into text with withAssets and withAssets.join, or reference them by names you choose in assets
  • add box questions, which locate what their instructions describe in an image; use them with the jev-preview model
  • compress request bodies of 1 KiB or more with zstd on Node.js 22.15 or newer; pass compression: false to send them uncompressed

Bug fixes

  • allow null token counts in usage
  • add more request validation checks
  • reject the returned promise for invalid requests instead of throwing
  • accept score criteria lists built at runtime
  • stop an unhandled rejection on Node.js 22 when a request times out or is aborted mid-body
Commits

Updates dotenv from 18.0.1 to 18.0.8

Changelog

Sourced from dotenv's changelog.

18.0.8 (2026-10-14)

Changed

  • Fast parser should strip appended extra quotes (#1073)
  • Type detail improvement (#1074)

18.0.7 (2026-10-09)

Changed

  • Treat undefined settings like quiet: true as null rather than falsey (#1070)
  • CLI should honor DOTENV_QUIET setting in .env file (#1071)

18.0.6 (2026-10-06)

Changed

  • Use smarter parseBoolean not Boolean() to fix override (#1069)

18.0.5 (2026-09-30)

Changed

  • Fix missing typescript module declaration (#1068)
  • Improve performance for large .env files (#1066)

18.0.4 (2026-09-25)

Changed

  • import dotenv/config should default quiet: true (#1063)

18.0.3 (2026-09-22)

Changed

  • Patch DOTENV_QUIET setting when inside .env file (#1059)

18.0.2 (2026-09-21)

Changed

  • Patch additional edge cases for the fast parser (#1056)
Commits
  • e2fe95e 18.0.8
  • 7aa712a type detail improvement
  • 53405b0 Merge pull request #1074 from himanshu748/codex/fix-dotenv-populate-undefined...
  • 0b4843a changelog
  • 55855ab Merge pull request #1073 from xiehuanyi/fix/unicode-unquoting-parity
  • f757811 fix(types): allow undefined values in populate output
  • fde5db2 Keep fast-parser unquoting consistent at Unicode line boundaries
  • 2953207 18.0.7
  • 9944723 make more readable for undefined -> null
  • d455db0 Merge branch 'master' of github.com:motdotla/dotenv
  • Additional commits viewable in compare view

Updates express from 5.2.1 to 5.3.0

Release notes

Sourced from express's releases.

v5.3.0

Highlights

🐞 Bug fixes

  • Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #4893

    Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #7459

🚀 Improvements

  • Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #7366

    // QUERY /reports with If-None-Match: "12345"
app.query('/reports', (req, res) => {
  res.set('ETag', '"12345"');
  res.send(results); // now responds 304 Not Modified
});

  • Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #5167

  • When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903

    app.render('index', null, callback); // now works as expected

  • Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #7234

    res.set('Content-Type', 'text/plain; foo=bar').send('hey');
// -> Content-Type: text/plain; foo=bar; charset=utf-8

  • The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #6464

  • Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @​blakeembrey in #7233

    res.attachment('user.html');
// before -> Content-Disposition: attachment; filename="user.html"
// after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Changelog

Sourced from express's changelog.

5.3.0

🐞 Bug fixes

  • Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #4893

    Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #7459

🚀 Improvements

  • Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #7366

    // QUERY /reports with If-None-Match: "12345"
app.query('/reports', (req, res) => {
  res.set('ETag', '"12345"');
  res.send(results); // now responds 304 Not Modified
});

  • Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #5167

  • When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903

    app.render('index', null, callback); // now works as expected

  • Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #7234

    res.set('Content-Type', 'text/plain; foo=bar').send('hey');
// -> Content-Type: text/plain; foo=bar; charset=utf-8

  • The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #6464

  • Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @​blakeembrey in #7233

    res.attachment('user.html');
// before -> Content-Disposition: attachment; filename="user.html"
// after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for express since your current version.


Updates express-rate-limit from 8.7.0 to 8.7.1

Release notes

Sourced from express-rate-limit's releases.

v8.7.1

You can view the changelog here.

Commits
  • c2e30b3 8.7.1
  • b40a390 v8.7.1 changelog
  • ccbee88 fix: correct es2020/es2022 version mismatch between tsconfig and esbuild comm...
  • 11a143a chore: fix duplicate entries in pnpm-lockfile.yaml (#685)
  • 92f685d chore(deps): bump softprops/action-gh-release from 1 to 3 (#692)
  • 0c7c066 chore(deps): bump actions/checkout from 4.4.0 to 7.0.1 (#694)
  • 9735b69 chore(deps): bump pnpm/action-setup from 3.0.0 to 6.1.0 (#695)
  • 7f401b7 chore(deps): bump actions/setup-node from 4.4.0 to 7.0.0 (#693)
  • 7a49bb0 ci: add guard that fails the build on unpinned GitHub Actions (companion to #...
  • 784c447 ci: pin GitHub Actions to immutable commit SHAs (#690)
  • Additional commits viewable in compare view

Updates zod from 4.6.5 to 4.6.7

Release notes

Sourced from zod's releases.

v4.6.7

Commits:

  • b500a2ee95134f81d74da7911d7378dd2853d042 4.6.7

v4.6.6

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243fb, the pre-rewrite copy of 9c219833 with identical contents.

Commits:

  • 0cd3af5e9f50ad11bbcd4407a46a21b8848ba574 docs: load the en locale directly in Zod Mini
  • 9d5e60f162997b764b40d45aa02481888db50dea docs: import locales from zod/locales, not z.locales
  • 34a626f307871ecbb0123947559328dc52ed5e3e docs: tighten the z.locales tree-shaking note
  • 74304ce5b5796b5edb9a88ceb8e170b6ea3e82df release: stage npm versions instead of publishing them (#6622)
  • b2ef983e0711ff6517d6020b021071e2e5653efa docs: add Code for Japan to bronze sponsors
  • 8fb2faf0584828a6a027d8279db36f6f52784462 docs: crop the Code for Japan logo and list it first in bronze
  • bacad518c41610d654658172d325874bf0ee6290 docs: square the Code for Japan logo to match the other bronze tiles
  • c42596bd1c87e941d7241d10e012c5c196adcc10 release: hold the run on the release-approval environment until the staged versions are approved (#6638)
  • a2ba4a67986a3e6b2b131be30084a2f460d9ea67 fix(types): declare record output and input as members, not base type arguments (#6645)
  • a0ebf970f2d752e5f58527cd2942ff48be4f46bd fix(v4): check array, set and map size bounds before parsing elements (#6652)
  • 529f78dd9431b07f49647fee3aa0819b3f8b66b7 4.6.6
  • 9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 ci: stage at verbose so a failed OIDC token exchange says why
Commits
  • b500a2e 4.6.7
  • 9c21983 ci: stage at verbose so a failed OIDC token exchange says why
  • 529f78d 4.6.6
  • a0ebf97 fix(v4): check array, set and map size bounds before parsing elements (#6652)
  • a2ba4a6 fix(types): declare record output and input as members, not base type argumen...
  • c42596b release: hold the run on the release-approval environment until the staged ve...
  • bacad51 docs: square the Code for Japan logo to match the other bronze tiles
  • 8fb2faf docs: crop the Code for Japan logo and list it first in bronze
  • b2ef983 docs: add Code for Japan to bronze sponsors
  • 74304ce release: stage npm versions instead of publishing them (#6622)
  • Additional commits viewable in compare view

Updates @biomejs/biome from 2.5.14 to 2.5.15

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.15

2.5.15

Patch Changes

  • #10634 b436ba0 Thanks @​subaru-hello! - Added the new nursery rule noReactObjectTypeAsDefaultProp, which disallows array, object, and function values as default props in React components.

    For example, the following snippet triggers the rule.

    function Component({ items = [] }) {
  return items;
}

  • #11956 faa8b37 Thanks @​dyc3! - Added the nursery rule noSvelteExportLet, which disallows declaring Svelte component props with the legacy export let syntax. Use the $props() rune instead.

    <script>
  export let name;
</script>

  • #10816 1b9479e Thanks @​Th3S4mur41! - Added a new nursery rule useLogicalProperties that enforces the use of logical properties in CSS, promoting better internationalization and accessibility practices. The rule supports a direction option with "ltr" as the default and "rtl" as the alternative. This is a first rule covering parts of #9034

    {
  "linter": {
    "rules": {
      "nursery": {
        "useLogicalProperties": {
          "level": "warn",
          "options": {
            "direction": "rtl"
          }
        }
      }
    }
  }
}

  • #11960 1fdb5c2 Thanks @​dyc3! - Added the nursery rule useSvelteKitRuneImports, which reports imports from the deprecated $app/stores module and suggests $app/state instead.

    import { page } from "$app/stores";

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.15

Patch Changes

  • #10634 b436ba0 Thanks @​subaru-hello! - Added the new nursery rule noReactObjectTypeAsDefaultProp, which disallows array, object, and function values as default props in React components.

    For example, the following snippet triggers the rule.

    function Component({ items = [] }) {
  return items;
}

  • #11956 faa8b37 Thanks @​dyc3! - Added the nursery rule noSvelteExportLet, which disallows declaring Svelte component props with the legacy export let syntax. Use the $props() rune instead.

    <script>
  export let name;
</script>

  • #10816 1b9479e Thanks @​Th3S4mur41! - Added a new nursery rule useLogicalProperties that enforces the use of logical properties in CSS, promoting better internationalization and accessibility practices. The rule supports a direction option with "ltr" as the default and "rtl" as the alternative. This is a first rule covering parts of #9034

    {
  "linter": {
    "rules": {
      "nursery": {
        "useLogicalProperties": {
          "level": "warn",
          "options": {
            "direction": "rtl"
          }
        }
      }
    }
  }
}

  • #11960 1fdb5c2 Thanks @​dyc3! - Added the nursery rule useSvelteKitRuneImports, which reports imports from the deprecated $app/stores module and suggests $app/state instead.

    import { page } from "$app/stores";

  • #11723 3b429d1 Thanks @​m1handr! - Fixed #11656: noAstroSetHtmlDirective now correctly reports set:html directives inside Astro template expressions.

... (truncated)

Commits

Updates @types/node from 26.6.2 to 26.6.5

Commits

Updates concurrently from 10.0.5 to 10.0.6

Release notes

Sourced from concurrently's releases.

v10.0.6

What's Changed

New Contributors

Full Changelog: open-cli-tools/concurrently@v10.0.5...v10.0.6

Commits

Updates playwright from 1.63.0 to 1.64.1

Release notes

Sourced from playwright's releases.

v1.64.1

Bug Fixes

  • #43247 [Bug]: _electron.launch intermittently loses a packaged app's first window since 1.64.0
  • #43242 [Regression]: Chromium 155+ aborts a preflighted cross-origin redirect whenever any route is registered (net::ERR_ABORTED)

v1.64.0

🧰 WebMCP

New page.webmcp and frame.webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like any other part of your app:

const browser = await chromium.launch({ args: ['--enable-features=WebMCP'] });
const page = await browser.newPage();
await page.goto('https://example.com');
for (const tool of await page.webmcp.tools())
console.log(tool.name, tool.description);
const result = await page.webmcp.callTool('add', { a: 2, b: 40 });
console.log(result.content[0].text); // "42"

Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as webmcp_<tool>. Pass --no-webmcp to opt out.

playwright-cli exposes them as well:

playwright-cli webmcp-list
playwright-cli webmcp-call search_catalog --params '{"query":"cats"}'

🎬 Better videos

Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:

// playwright.config.ts
import { defineConfig } from '@playwright/test';
export default defineConfig({
use: {
video: {
mode: 'on',
size: { width: 1920, height: 1080 },
fps: 60,
show: {
actions: {
style: {
point: 'width: 20px; height: 20px; border-radius: 50%; background: red',
</tr></table>

... (truncated)

Commits
  • cfe490d cherry-pick(#43353): docs: release notes for v1.64 Python
  • 866cbb8 chore: mark v1.64.1 (#43354)
  • 1b29247 cherry-pick(#43250): fix(electron): do not drop windows that have not navigat...
  • 632d976 cherry-pick(#43249): fix(chromium): disable AvoidCorsURLLoaderRestartOnRedirect
  • 824d0c5 cherry-pick(#43217): chore(dotnet): fix async suffix of optional-arg overload...
  • 606ecd8 cherry-pick(#43192): fix(locators): parse locators the way the client API bui...
  • e4f872c cherry-pick(#43188): feat(api): expose asLocatorDescription via LocalUtils fo...
  • f6a439e cherry-pick(#43189): docs(webmcp): expose WebMCP to all languages
  • e2335c3 cherry-pick(#43174): fix(mcp): do not close the browser twice when the client...
  • d2a436e cherry-pick(#43163): Revert "fix(blob): do not remove existing reports from o...
  • Additional commits viewable in compare view

Updates tsup from 8.5.1 to 9.0.0

Release notes

Sourced from tsup's releases.

v9.0.0

   🚨 Breaking Changes

   🚀 Features

   🐞 Bug Fixes

    View changes on GitHub
Commits
  • 198479b chore: release v9.0.0
  • 3079ea3 feat(type): expose the Plugin type (#1264)
  • 13f68eb ci: enable npm stage publishing
  • 380e94e test: fix failing tests
  • b601adf chore: merge test lockfile into the root as a pnpm workspace
  • 00139a4 chore: cleanup lockfile
  • 6cec950 chore: build tsup with its own source via tsx
  • 6705d39 chore: upgrade deps, replace source-map with source-map-js
  • a2c0810 feat: upgrade esbuild & chokidar
  • 980525e fix: remove baseUrl in tsconfig (#1390)
  • Additional commits viewable in compare view

Updates tsx from 4.23.13 to 4.23.15

Release notes

Sourced from tsx's releases.

v4.23.15

4.23.15 (2026-09-20)

Bug Fixes

  • exclude bare builtins from namespace inheritance (38e1588)
  • expose require.cache and require.extensions to tsImport CommonJS modules (2da3407)
  • make namespaced register() overloads portable for declaration emit (562c434)

This release is also available on:

v4.23.14

4.23.14 (2026-09-20)

Bug Fixes

  • restore the CJS bridge namespace for Node 24 require(esm) under tsImport() (#802) (6e5236b)

This release is also available on:

Commits
  • ca66105 test: fix drive-less file URLs in ESM resolver fixtures
  • 2da3407 fix: expose require.cache and require.extensions to tsImport CommonJS modules
  • 38e1588 fix: exclude bare builtins from namespace inheritance
  • 562c434 fix: make namespaced register() overloads portable for declaration emit
  • edfb1f0 build: upgrade pkgroll and externalize CJS loader reference
  • 70e7828 test: upgrade tinyspy for disposable API
  • 9ed2022 ci: avoid duplicate release notifications
  • 872e77f refactor: use disposables for cleanup
  • 6e5236b fix: restore the CJS bridge namespace for Node 24 require(esm) under tsImport...
  • See full diff in compare view

Updates vite from 8.3.0 to 8.3.4

Release notes

Sourced from vite's releases.

v8.3.4

Features

  • bundled-dev: support import.meta.hot.acceptExports (#23463) (bc0f21c)

Bug Fixes

  • avoid mutating hmr defaults (fix #23575) (#23576) (574d5e3)
  • build: correct preloads when chunkImportMap is enabled with non-root base (#23698) (2a8c0f0)
  • build: wait for in-flight stylesheets in preload helper (fix #23652) (#23662) (036b745)
  • bundled-dev: serve /@vite/client and stub @vite/env (#23664) (5afc5a8)
  • client: skip rewriting unchanged adopted styles (#23697) (fa71469)
  • css: resolve imported preprocessors from their file path with lightningcss (#23688) (cf52011)
  • deps: update all non-major dependencies (#23648) (8a4c19c)
  • deps: update rolldown-related dependencies (#23649) (794516d)
  • dev: a restart requested during a restart used to be dropped (fix #23392) (#23484) (70d56ea)
  • don't treat modules ending with js-like query as js (#23687) (fcb6f12)
  • html: avoid adding filesystem root to watcher (#23689) (3a7f2ae)
  • html: skip caching CSS of chunks in a cycle (fix #23628) (#23636) (15d82f7)
  • optimizer: scan deep imports with custom extensions (#23678) (8579189)
  • remove input option unescaping for now (#23694) (facc2fb)
  • server: match static aliases on path boundaries (#23643) (b28db28)
  • watcher: normalize file before root check in ensureWatchedFile (#23673) (12bb28c)

Performance Improvements

  • module-runner: skip cloning call sites that have no source map (#23646) (3d67486)

Code Refactoring

  • bundled-dev: import CSS HMR helpers from /@vite/client (#23674) (182f5b2)

v8.3.3

Bug Fixes

  • deps: update launch-editor to v2.14.2 (#23654) (22fd1d5)
  • html: filename passed to transformIndexHtml should not include queries (

@dependabot
Bump the npm group across 1 directory with 13 updates
045bd42 
Bumps the npm group with 13 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@typesafe-ai/sdk](https://github.com/typesafe-ai/typesafe-sdk-js) | `0.6.0` | `0.7.0` |
| [dotenv](https://github.com/motdotla/dotenv) | `18.0.1` | `18.0.8` |
| [express](https://github.com/expressjs/express) | `5.2.1` | `5.3.0` |
| [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) | `8.7.0` | `8.7.1` |
| [zod](https://github.com/colinhacks/zod) | `4.6.5` | `4.6.7` |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.5.14` | `2.5.15` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.2` | `26.6.5` |
| [concurrently](https://github.com/open-cli-tools/concurrently) | `10.0.5` | `10.0.6` |
| [playwright](https://github.com/microsoft/playwright) | `1.63.0` | `1.64.1` |
| [tsup](https://github.com/egoist/tsup) | `8.5.1` | `9.0.0` |
| [tsx](https://github.com/privatenumber/tsx) | `4.23.13` | `4.23.15` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.3.0` | `8.3.4` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.1` | `5.0.5` |



Updates `@typesafe-ai/sdk` from 0.6.0 to 0.7.0
- [Release notes](https://github.com/typesafe-ai/typesafe-sdk-js/releases)
- [Changelog](https://github.com/typesafe-ai/typesafe-sdk-js/blob/main/docs/changelog.md)
- [Commits](typesafe-ai/typesafe-sdk-js@v0.6.0...v0.7.0)

Updates `dotenv` from 18.0.1 to 18.0.8
- [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md)
- [Commits](motdotla/dotenv@v18.0.1...v18.0.8)

Updates `express` from 5.2.1 to 5.3.0
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/master/History.md)
- [Commits](expressjs/express@v5.2.1...v5.3.0)

Updates `express-rate-limit` from 8.7.0 to 8.7.1
- [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases)
- [Commits](express-rate-limit/express-rate-limit@v8.7.0...v8.7.1)

Updates `zod` from 4.6.5 to 4.6.7
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.6.5...v4.6.7)

Updates `@biomejs/biome` from 2.5.14 to 2.5.15
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.15/packages/@biomejs/biome)

Updates `@types/node` from 26.6.2 to 26.6.5
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `concurrently` from 10.0.5 to 10.0.6
- [Release notes](https://github.com/open-cli-tools/concurrently/releases)
- [Commits](open-cli-tools/concurrently@v10.0.5...v10.0.6)

Updates `playwright` from 1.63.0 to 1.64.1
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.63.0...v1.64.1)

Updates `tsup` from 8.5.1 to 9.0.0
- [Release notes](https://github.com/egoist/tsup/releases)
- [Commits](egoist/tsup@v8.5.1...v9.0.0)

Updates `tsx` from 4.23.13 to 4.23.15
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.23.13...v4.23.15)

Updates `vite` from 8.3.0 to 8.3.4
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.3.4/packages/vite)

Updates `vitest` from 5.0.1 to 5.0.5
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/vitest)

---
updated-dependencies:
- dependency-name: "@typesafe-ai/sdk"
  dependency-version: 0.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: dotenv
  dependency-version: 18.0.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: express
  dependency-version: 5.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: express-rate-limit
  dependency-version: 8.7.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: zod
  dependency-version: 4.6.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@biomejs/biome"
  dependency-version: 2.5.15
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@types/node"
  dependency-version: 26.6.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: concurrently
  dependency-version: 10.0.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: playwright
  dependency-version: 1.64.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: tsup
  dependency-version: 9.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm
- dependency-name: tsx
  dependency-version: 4.23.15
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: vite
  dependency-version: 8.3.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: vitest
  dependency-version: 5.0.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from Jason-Doyle as a code owner October 18, 2026 23:24
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 18, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Jason-Doyle Jason-Doyle Awaiting requested review from Jason-Doyle Jason-Doyle is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants