Skip to content

chore(deps): bump the dependencies group across 1 directory with 6 updates#730

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/dependencies-eea1e73d49
Open

chore(deps): bump the dependencies group across 1 directory with 6 updates#730
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/dependencies-eea1e73d49

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 25, 2026

Bumps the dependencies group with 6 updates in the / directory:

Package From To
hyperid 3.3.0 4.0.0
ipaddr.js 2.3.0 2.4.0
ssri 13.0.1 14.0.0
@npmcli/arborist 9.4.2 9.5.0
npm-pick-manifest 11.0.3 12.0.0
cacache 20.0.4 21.0.0

Updates hyperid from 3.3.0 to 4.0.0

Release notes

Sourced from hyperid's releases.

v4.0.0

What's Changed

Full Changelog: mcollina/hyperid@v3.3.0...v4.0.0

Commits
  • 4298362 Bumped v4.0.0
  • 5040f5a chore: bump nanoid to ^5.1.9 and refresh benchmarks
  • b7e4cd8 test
  • 0ccfd26 chore: bump buffer to ^6.0.3 and bloomfilter to ^1.1.0 (#41)
  • aa7414e fix: update CI badge to use GitHub Actions endpoint
  • a5a341d modernize: neostandard, drop uuid, refresh CI matrix (#40)
  • See full diff in compare view

Updates ipaddr.js from 2.3.0 to 2.4.0

Changelog

Sourced from ipaddr.js's changelog.

2.4.0 - 2026-05-03

  • remove Bower support
  • add RFC9637, RFC9602, RFC8215, RFC3879 reserved address ranges
Commits
  • 61bd6df Bump version.
  • f563e5c Add RFC9637, RFC9602, RFC8215, RFC3879 reserved address ranges.
  • 9992db9 Rename 2001:10::/28 from deprecated to deprecatedOrchid.
  • 5686480 Indicate which RFCs reserved some IPv6 ranges.
  • 9199d3f Remove bower.json
  • 1915d22 spelling: string
  • 85eb23c spelling: javascript
  • 4222342 spelling: ip v6
  • 1c76a35 spelling: hexadecimal
  • 82e4b6d spelling: addresses
  • Additional commits viewable in compare view

Updates ssri from 13.0.1 to 14.0.0

Release notes

Sourced from ssri's releases.

v14.0.0

14.0.0 (2026-05-08)

⚠️ BREAKING CHANGES

  • ssri now supports node ^22.22.2 || ^24.15.0 || >=26.0.0
  • template-oss-apply

Features

Chores

Changelog

Sourced from ssri's changelog.

14.0.0 (2026-05-08)

⚠️ BREAKING CHANGES

  • ssri now supports node ^22.22.2 || ^24.15.0 || >=26.0.0
  • template-oss-apply

Features

Chores

Commits

Updates @npmcli/arborist from 9.4.2 to 9.5.0

Release notes

Sourced from @​npmcli/arborist's releases.

arborist: v9.5.0

9.5.0 (2026-05-06)

Features

Bug Fixes

arborist: v9.4.3

9.4.3 (2026-04-22)

Bug Fixes

Changelog

Sourced from @​npmcli/arborist's changelog.

9.5.0 (2023-02-14)

Features

Bug Fixes

Dependencies

Commits

Updates npm-pick-manifest from 11.0.3 to 12.0.0

Release notes

Sourced from npm-pick-manifest's releases.

v12.0.0

12.0.0 (2026-05-18)

⚠️ BREAKING CHANGES

  • npm-pick-manifest now supports node ^22.22.2 || ^24.15.0 || >=26.0.0
  • template-oss-apply

Features

Dependencies

Chores

Changelog

Sourced from npm-pick-manifest's changelog.

12.0.0 (2026-05-18)

⚠️ BREAKING CHANGES

  • npm-pick-manifest now supports node ^22.22.2 || ^24.15.0 || >=26.0.0
  • template-oss-apply

Features

Dependencies

Chores

Commits
  • bc160ab chore: release 12.0.0 (#178)
  • 60b6749 deps: npm-package-arg@14.0.0
  • da16b63 deps: npm-normalize-package-bin@6.0.0
  • 20c56b2 deps: npm-install-checks@9.0.0
  • 46c4246 chore: template-oss-apply
  • 1b71e65 feat!: bump to new node engine range
  • 60cde68 feat!: template-oss-apply
  • 756de4f chore: bumping @​npmcli/template-oss from 4.30.0 to 5.1.0
  • e343270 chore: bump @​npmcli/template-oss from 4.29.0 to 4.30.0 (#171)
  • 7003a5d chore: bump @​npmcli/template-oss from 4.28.1 to 4.29.0 (#170)
  • Additional commits viewable in compare view

Updates cacache from 20.0.4 to 21.0.0

Release notes

Sourced from cacache's releases.

v21.0.0

21.0.0 (2026-05-18)

⚠️ BREAKING CHANGES

  • cacache now supports node ^22.22.2 || ^24.15.0 || >=26.0.0
  • template-oss-apply

Features

Dependencies

Chores

Changelog

Sourced from cacache's changelog.

21.0.0 (2026-05-18)

⚠️ BREAKING CHANGES

  • cacache now supports node ^22.22.2 || ^24.15.0 || >=26.0.0
  • template-oss-apply

Features

Dependencies

Chores

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the dependencies group across 1 directory with 6 up…
22a98a4 
…dates

Bumps the dependencies group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [hyperid](https://github.com/mcollina/hyperid) | `3.3.0` | `4.0.0` |
| [ipaddr.js](https://github.com/whitequark/ipaddr.js) | `2.3.0` | `2.4.0` |
| [ssri](https://github.com/npm/ssri) | `13.0.1` | `14.0.0` |
| [@npmcli/arborist](https://github.com/npm/cli/tree/HEAD/workspaces/arborist) | `9.4.2` | `9.5.0` |
| [npm-pick-manifest](https://github.com/npm/npm-pick-manifest) | `11.0.3` | `12.0.0` |
| [cacache](https://github.com/npm/cacache) | `20.0.4` | `21.0.0` |



Updates `hyperid` from 3.3.0 to 4.0.0
- [Release notes](https://github.com/mcollina/hyperid/releases)
- [Commits](mcollina/hyperid@v3.3.0...v4.0.0)

Updates `ipaddr.js` from 2.3.0 to 2.4.0
- [Changelog](https://github.com/whitequark/ipaddr.js/blob/main/Changes.md)
- [Commits](whitequark/ipaddr.js@v2.3.0...v2.4.0)

Updates `ssri` from 13.0.1 to 14.0.0
- [Release notes](https://github.com/npm/ssri/releases)
- [Changelog](https://github.com/npm/ssri/blob/main/CHANGELOG.md)
- [Commits](npm/ssri@v13.0.1...v14.0.0)

Updates `@npmcli/arborist` from 9.4.2 to 9.5.0
- [Release notes](https://github.com/npm/cli/releases)
- [Changelog](https://github.com/npm/cli/blob/v9.5.0/CHANGELOG.md)
- [Commits](https://github.com/npm/cli/commits/v9.5.0/workspaces/arborist)

Updates `npm-pick-manifest` from 11.0.3 to 12.0.0
- [Release notes](https://github.com/npm/npm-pick-manifest/releases)
- [Changelog](https://github.com/npm/npm-pick-manifest/blob/main/CHANGELOG.md)
- [Commits](npm/npm-pick-manifest@v11.0.3...v12.0.0)

Updates `cacache` from 20.0.4 to 21.0.0
- [Release notes](https://github.com/npm/cacache/releases)
- [Changelog](https://github.com/npm/cacache/blob/main/CHANGELOG.md)
- [Commits](npm/cacache@v20.0.4...v21.0.0)

---
updated-dependencies:
- dependency-name: hyperid
  dependency-version: 4.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: ipaddr.js
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: ssri
  dependency-version: 14.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: "@npmcli/arborist"
  dependency-version: 9.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: npm-pick-manifest
  dependency-version: 12.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: cacache
  dependency-version: 21.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels May 25, 2026
@dependabot dependabot Bot requested a review from a team as a code owner May 25, 2026 14:54
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels May 25, 2026
@changeset-bot
Copy link
Copy Markdown

changeset-bot Bot commented May 25, 2026

⚠️ No Changeset found

Latest commit: 22a98a4

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@socket-security
Copy link
Copy Markdown

socket-security Bot commented May 25, 2026

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Added@​npmcli/​arborist@​9.5.07310010098100
Addedipaddr.js@​2.4.010010010086100
Addedhyperid@​4.0.010010010087100
Addedssri@​14.0.010010010090100
Addednpm-pick-manifest@​12.0.010010010091100
Addedcacache@​21.0.09910010092100

View full report

@socket-security
Copy link
Copy Markdown

socket-security Bot commented May 25, 2026

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm @npmcli/arborist is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: workspaces/tree-walker/package.json → npm/@npmcli/arborist@9.5.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@npmcli/arborist@9.5.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants