Skip to content

📦 Bump the all-dependencies group across 1 directory with 5 updates#16279

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/main/all-dependencies-16e591fb55
Open

📦 Bump the all-dependencies group across 1 directory with 5 updates#16279
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/main/all-dependencies-16e591fb55

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the all-dependencies group with 5 updates in the / directory:

Package From To
lage 2.15.12 2.15.13
semver 7.8.2 7.8.5
@microsoft/1ds-core-js 4.4.1 4.4.2
@microsoft/1ds-post-js 4.4.1 4.4.2
memfs 4.57.6 4.57.8

Updates lage from 2.15.12 to 2.15.13

Commits

Updates semver from 7.8.2 to 7.8.5

Release notes

Sourced from semver's releases.

v7.8.5

7.8.5 (2026-06-19)

Bug Fixes

v7.8.4

7.8.4 (2026-06-09)

Bug Fixes

v7.8.3

7.8.3 (2026-06-08)

Bug Fixes

Chores

Changelog

Sourced from semver's changelog.

7.8.5 (2026-06-19)

Bug Fixes

7.8.4 (2026-06-09)

Bug Fixes

7.8.3 (2026-06-08)

Bug Fixes

Chores

Commits
  • 6e05b76 chore: release 7.8.5 (#879)
  • 9c8692a fix: include prereleases in tilde range lower bound with includePrerelease (#...
  • 8640bd6 chore: release 7.8.4 (#875)
  • e583226 fix: reject numeric segments after x-ranges
  • 6b77aa8 chore: release 7.8.3 (#873)
  • 3485dda chore: bump @​npmcli/eslint-config from 6.0.1 to 7.0.0 (#866)
  • 046da7f fix: align caret includePrerelease lower bounds (#872)
  • See full diff in compare view

Updates @microsoft/1ds-core-js from 4.4.1 to 4.4.2

Changelog

Sourced from @​microsoft/1ds-core-js's changelog.

Releases

Note: ES3/IE8 compatibility will be removed in the future v3.x.x releases (scheduled for mid-late 2022), so if you need to retain ES3 compatibility you will need to remain on the 2.x.x versions of the SDK or your runtime will need install polyfill's to your ES3 environment before loading / initializing the SDK.

3.4.2 (June 18th, 2026)

This is a maintenance release for the 3.4.x version line containing security hardening, bug fixes, build tooling improvements, and CI updates. The @microsoft/1ds-post-js channel is numbered 4.4.2 and requires v3.4.2.

Significant Changes (since 3.4.1)

  • Prototype Pollution Hardening: The extend() and objExtend() helpers now filter unsafe keys (__proto__, constructor, prototype) to prevent prototype pollution when merging untrusted objects.

  • Dependency Vulnerability Resolution: Migrated the repository from npm to pnpm for dependency management and resolved all known dependency vulnerabilities. This is a build/tooling change and does not affect the published runtime packages.

  • OsPlugin Field Name Correction: The OsPlugin now emits the correct Common Schema 4.0 field names (ext.os.name and ext.os.ver). Telemetry consumers relying on the previously emitted (incorrect) field names should update to the corrected names.

  • RequestEnvelopeCreator Envelope Name Fix: Fixed RequestEnvelopeCreator so request telemetry is sent with the correct envelope name (Microsoft.ApplicationInsights.{ikey}.Request) instead of RequestData.

  • Offline Channel Reliability: Fixed a missing return after reject() in the offline channel that could lead to a null provider dereference.

  • Fixed [INVALID_ANNOTATION] warnings in Rolldown / Vite 8 consumers (#2736): The per-module dist-es5 output (the package module entry that modern bundlers import) emitted parenthesized PURE tree-shaking annotations with whitespace after the opening parenthesis (e.g. ( /*#__PURE__*/"http.")), which stricter bundlers such as Rolldown (Vite 8) rejected. The build now canonicalizes these annotations to the flush form ((/*#__PURE__*/"http.")) in the dist-es5 output, accepted by all bundlers while preserving the wrapping parentheses required for older Rollup / Webpack / Terser to tree-shake the constants. This complements #2737, which only normalized the rollup-bundled dist/es5 (main) output.

CI / Tooling

  • Dropped Node.js 16 from CI matrix: Node.js 16 is End-of-Life and several dependencies (e.g. puppeteer, @pnpm/error) now require Node.js 18 or later. The CI pipeline no longer runs against Node.js 16.
  • Added Node.js 22 and 24 to CI matrix: The CI pipeline now tests against Node.js 18, 20, 22, and 24.
  • Migrated from npm to pnpm: Dependency management now uses pnpm.

Changelog

  • #2733 fix: Migrate from npm to pnpm and resolve all dependency vulnerabilities
  • #2742 fix(ci): repair Node.js CI (Chrome install, bundle-size limits, ts-async offline-channel hang)
  • #2737 fix: remove invalid PURE literal annotations and add bundle validation tests
  • #2736 fix: canonicalize PURE annotations in dist-es5 (module) output to fix Rolldown/Vite 8 [INVALID_ANNOTATION] warnings
  • #2735 fix: prevent prototype pollution in extend() and objExtend() via unsafe key filtering
  • #2734 fix(offline-channel): Add missing return after reject() to prevent null provider dereference
  • #2732 fix(OsPlugin): use correct CS 4.0 field names ext.os.name and ext.os.ver
  • #2731 Drop Node.js 16 from CI matrix; add Node.js 22 and 24
  • #2729 Potential fix for code scanning alert no. 2273: Workflow does not contain permissions
  • #2728 Potential fix for code scanning alert no. 5940: Unused variable, import, function or class
  • #2727 Potential fix for code scanning alert no. 5402: Semicolon insertion
  • #2726 Potential fix for code scanning alert no. 5401: Unused variable, import, function or class
  • #2725 Potential fix for code scanning alert no. 4240: Semicolon insertion
  • #2724 fix: RequestEnvelopeCreator sends "RequestData" as envelope name instead of "Microsoft.ApplicationInsights.{ikey}.Request"
  • #2722 Update Components
  • #2721 Add CfgSync documentation

Full Changelog: microsoft/ApplicationInsights-JS@3.4.1...3.4.2

... (truncated)

Commits

Updates @microsoft/1ds-post-js from 4.4.1 to 4.4.2

Changelog

Sourced from @​microsoft/1ds-post-js's changelog.

Releases

Note: ES3/IE8 compatibility will be removed in the future v3.x.x releases (scheduled for mid-late 2022), so if you need to retain ES3 compatibility you will need to remain on the 2.x.x versions of the SDK or your runtime will need install polyfill's to your ES3 environment before loading / initializing the SDK.

3.4.2 (June 18th, 2026)

This is a maintenance release for the 3.4.x version line containing security hardening, bug fixes, build tooling improvements, and CI updates. The @microsoft/1ds-post-js channel is numbered 4.4.2 and requires v3.4.2.

Significant Changes (since 3.4.1)

  • Prototype Pollution Hardening: The extend() and objExtend() helpers now filter unsafe keys (__proto__, constructor, prototype) to prevent prototype pollution when merging untrusted objects.

  • Dependency Vulnerability Resolution: Migrated the repository from npm to pnpm for dependency management and resolved all known dependency vulnerabilities. This is a build/tooling change and does not affect the published runtime packages.

  • OsPlugin Field Name Correction: The OsPlugin now emits the correct Common Schema 4.0 field names (ext.os.name and ext.os.ver). Telemetry consumers relying on the previously emitted (incorrect) field names should update to the corrected names.

  • RequestEnvelopeCreator Envelope Name Fix: Fixed RequestEnvelopeCreator so request telemetry is sent with the correct envelope name (Microsoft.ApplicationInsights.{ikey}.Request) instead of RequestData.

  • Offline Channel Reliability: Fixed a missing return after reject() in the offline channel that could lead to a null provider dereference.

  • Fixed [INVALID_ANNOTATION] warnings in Rolldown / Vite 8 consumers (#2736): The per-module dist-es5 output (the package module entry that modern bundlers import) emitted parenthesized PURE tree-shaking annotations with whitespace after the opening parenthesis (e.g. ( /*#__PURE__*/"http.")), which stricter bundlers such as Rolldown (Vite 8) rejected. The build now canonicalizes these annotations to the flush form ((/*#__PURE__*/"http.")) in the dist-es5 output, accepted by all bundlers while preserving the wrapping parentheses required for older Rollup / Webpack / Terser to tree-shake the constants. This complements #2737, which only normalized the rollup-bundled dist/es5 (main) output.

CI / Tooling

  • Dropped Node.js 16 from CI matrix: Node.js 16 is End-of-Life and several dependencies (e.g. puppeteer, @pnpm/error) now require Node.js 18 or later. The CI pipeline no longer runs against Node.js 16.
  • Added Node.js 22 and 24 to CI matrix: The CI pipeline now tests against Node.js 18, 20, 22, and 24.
  • Migrated from npm to pnpm: Dependency management now uses pnpm.

Changelog

  • #2733 fix: Migrate from npm to pnpm and resolve all dependency vulnerabilities
  • #2742 fix(ci): repair Node.js CI (Chrome install, bundle-size limits, ts-async offline-channel hang)
  • #2737 fix: remove invalid PURE literal annotations and add bundle validation tests
  • #2736 fix: canonicalize PURE annotations in dist-es5 (module) output to fix Rolldown/Vite 8 [INVALID_ANNOTATION] warnings
  • #2735 fix: prevent prototype pollution in extend() and objExtend() via unsafe key filtering
  • #2734 fix(offline-channel): Add missing return after reject() to prevent null provider dereference
  • #2732 fix(OsPlugin): use correct CS 4.0 field names ext.os.name and ext.os.ver
  • #2731 Drop Node.js 16 from CI matrix; add Node.js 22 and 24
  • #2729 Potential fix for code scanning alert no. 2273: Workflow does not contain permissions
  • #2728 Potential fix for code scanning alert no. 5940: Unused variable, import, function or class
  • #2727 Potential fix for code scanning alert no. 5402: Semicolon insertion
  • #2726 Potential fix for code scanning alert no. 5401: Unused variable, import, function or class
  • #2725 Potential fix for code scanning alert no. 4240: Semicolon insertion
  • #2724 fix: RequestEnvelopeCreator sends "RequestData" as envelope name instead of "Microsoft.ApplicationInsights.{ikey}.Request"
  • #2722 Update Components
  • #2721 Add CfgSync documentation

Full Changelog: microsoft/ApplicationInsights-JS@3.4.1...3.4.2

... (truncated)

Commits

Updates memfs from 4.57.6 to 4.57.8

Release notes

Sourced from memfs's releases.

Release v4.57.8

What's Changed

New Contributors

Full Changelog: streamich/memfs@v4.57.7...v4.57.8

Release v4.57.7

What's Changed

Full Changelog: streamich/memfs@v4.57.6...v4.57.7

Commits
  • 29b912b chore: release v4.57.8
  • b5c6c62 Merge pull request #1261 from chatman-media/fix/truncate-negative-length-memo...
  • f2be1ce fix: 🐛 clamp negative truncate length to zero
  • bbcc695 chore: release v4.57.7
  • c67f51e Merge pull request #1260 from streamich/snapshot-fix
  • d20c3e9 fix: 🐛 do not allow relative paths in snapshot restoration
  • See full diff in compare view

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Jun 23, 2026
@dependabot dependabot Bot requested a review from a team as a code owner June 23, 2026 12:21
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Jun 23, 2026
@dependabot
📦 Bump the all-dependencies group across 1 directory with 5 updates
e2c5337 
Bumps the all-dependencies group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [lage](https://github.com/microsoft/lage) | `2.15.12` | `2.15.13` |
| [semver](https://github.com/npm/node-semver) | `7.8.2` | `7.8.5` |
| [@microsoft/1ds-core-js](https://github.com/microsoft/ApplicationInsights-JS) | `4.4.1` | `4.4.2` |
| [@microsoft/1ds-post-js](https://github.com/microsoft/ApplicationInsights-JS) | `4.4.1` | `4.4.2` |
| [memfs](https://github.com/streamich/memfs) | `4.57.6` | `4.57.8` |



Updates `lage` from 2.15.12 to 2.15.13
- [Commits](microsoft/lage@lage_v2.15.12...lage_v2.15.13)

Updates `semver` from 7.8.2 to 7.8.5
- [Release notes](https://github.com/npm/node-semver/releases)
- [Changelog](https://github.com/npm/node-semver/blob/main/CHANGELOG.md)
- [Commits](npm/node-semver@v7.8.2...v7.8.5)

Updates `@microsoft/1ds-core-js` from 4.4.1 to 4.4.2
- [Release notes](https://github.com/microsoft/ApplicationInsights-JS/releases)
- [Changelog](https://github.com/microsoft/ApplicationInsights-JS/blob/main/RELEASES.md)
- [Commits](https://github.com/microsoft/ApplicationInsights-JS/commits)

Updates `@microsoft/1ds-post-js` from 4.4.1 to 4.4.2
- [Release notes](https://github.com/microsoft/ApplicationInsights-JS/releases)
- [Changelog](https://github.com/microsoft/ApplicationInsights-JS/blob/main/RELEASES.md)
- [Commits](https://github.com/microsoft/ApplicationInsights-JS/commits)

Updates `memfs` from 4.57.6 to 4.57.8
- [Release notes](https://github.com/streamich/memfs/releases)
- [Changelog](https://github.com/streamich/memfs/blob/master/CHANGELOG.md)
- [Commits](streamich/memfs@v4.57.6...v4.57.8)

---
updated-dependencies:
- dependency-name: "@microsoft/1ds-core-js"
  dependency-version: 4.4.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: "@microsoft/1ds-post-js"
  dependency-version: 4.4.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: lage
  dependency-version: 2.15.13
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: memfs
  dependency-version: 4.57.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: semver
  dependency-version: 7.8.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/main/all-dependencies-16e591fb55 branch from 332fef9 to e2c5337 Compare June 24, 2026 02:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants