[dependabot]

Bumps @logtape/logtape from 2.3.2 to 2.3.8.

Changelog

Sourced from @​logtape/logtape's changelog.

Version 2.3.8

Released on September 26, 2026.

@​logtape/logtape

• Improved the performance of logging calls that are disabled by the logger's lowestLevel, or whose category has neither a sink nor a filter to reach. Such calls now return before building a log record, instead of building and then discarding one. For example, logger.debug("...") on a logger configured with lowestLevel: "info" is now about ten times faster on Node.js and Deno. [#227, #228]

  As a result, lazy() values given to Logger.with() are no longer evaluated for such calls made with a template literal or a callback, matching the behavior of calls made with a message string.

#227: dahlia/logtape#227 #228: dahlia/logtape#228

Version 2.3.7

Released on September 22, 2026.

@​logtape/logtape

• Added sanitize option to the TextFormatterOptions interface. Pass an object to adjust the policy, or false to restore the previous behavior. [[GHSA-hp6w-c2ch-g44w]]

• Added SanitizationOptions interface. [[GHSA-hp6w-c2ch-g44w]]

• Added sanitizeControlSequences() function. [[GHSA-hp6w-c2ch-g44w]]

• Fixed the built-in text formatters emitting control characters and ANSI escape sequences from a log record's message and category verbatim. An attacker who influenced a string logged in the message position (e.g. logger.info(untrustedString)) could reposition the cursor or clear the screen on an operator's terminal, or overwrite previously printed log lines with forged entries. getTextFormatter(), getAnsiColorFormatter(), and defaultConsoleFormatter() now escape ESC-introduced sequences other than SGR color codes, the remaining C0 control characters, DEL, and the C1 controls (U+0080–U+009F). Values interpolated into the message were already escaped by the value renderer and are unaffected. [[GHSA-hp6w-c2ch-g44w]]

... (truncated)

Commits

• 8a03f31 Merge tag '2.2.11' into 2.3-maintenance
• 53239ce Merge tag '2.1.15' into 2.2-maintenance
• a3b5627 Merge tag '2.0.24' into 2.1-maintenance
• 051d031 Skip building records for disabled log calls
• 8a798d0 Version bump
• 68857b3 Merge tag '2.2.10' into 2.3-maintenance
• 928716e Version bump
• 93c40e4 Merge tag '2.1.14' into 2.2-maintenance
• 4d6cc05 Version bump
• 00f216a Merge tag '2.0.23' into 2.1-maintenance
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)