Skip to content

Bump the npm_and_yarn group across 7 directories with 16 updates#101

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/custom_nodes/npm_and_yarn-f4e2ce4f4e
Open

Bump the npm_and_yarn group across 7 directories with 16 updates#101
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/custom_nodes/npm_and_yarn-f4e2ce4f4e

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 2, 2026

Bumps the npm_and_yarn group with 12 updates in the /custom_nodes directory:

Package From To
esbuild 0.23.0 0.28.0
tsup 8.2.3 8.5.1
minimatch 3.1.2 3.1.5
js-yaml 3.14.1 3.14.2
@modelcontextprotocol/sdk 1.12.1 1.29.0
cookie 0.6.0 0.7.2
ajv 6.12.6 6.15.0
flatted 3.3.1 3.4.2
glob 10.4.5 10.5.0
jws 4.0.0 4.0.1
picomatch 2.3.1 2.3.2
tmp 0.0.33 removed

Bumps the npm_and_yarn group with 3 updates in the /custom_nodes/examples/image_grid directory: esbuild, minimatch and picomatch.
Bumps the npm_and_yarn group with 3 updates in the /custom_nodes/examples/make_uppercase directory: esbuild, minimatch and picomatch.
Bumps the npm_and_yarn group with 1 update in the /custom_nodes/examples/make_uppercase_vanilla directory: esbuild.
Bumps the npm_and_yarn group with 1 update in the /custom_nodes/examples/wikipedia_fetcher directory: esbuild.
Bumps the npm_and_yarn group with 1 update in the /custom_nodes/packages/node-utils directory: esbuild.
Bumps the npm_and_yarn group with 1 update in the /custom_nodes/packages/utility-nodes directory: esbuild.

Updates esbuild from 0.23.0 to 0.28.0

Release notes

Sourced from esbuild's releases.

v0.28.0

  • Add support for with { type: 'text' } imports (#4435)

    The import text proposal has reached stage 3 in the TC39 process, which means that it's recommended for implementation. It has also already been implemented by Deno and Bun. So with this release, esbuild also adds support for it. This behaves exactly the same as esbuild's existing text loader. Here's an example:

    import string from './example.txt' with { type: 'text' }
console.log(string)

  • Add integrity checks to fallback download path (#4343)

    Installing esbuild via npm is somewhat complicated with several different edge cases (see esbuild's documentation for details). If the regular installation of esbuild's platform-specific package fails, esbuild's install script attempts to download the platform-specific package itself (first with the npm command, and then with a HTTP request to registry.npmjs.org as a last resort).

    This last resort path previously didn't have any integrity checks. With this release, esbuild will now verify that the hash of the downloaded binary matches the expected hash for the current release. This means the hashes for all of esbuild's platform-specific binary packages will now be embedded in the top-level esbuild package. Hopefully this should work without any problems. But just in case, this change is being done as a breaking change release.

  • Update the Go compiler from 1.25.7 to 1.26.1

    This upgrade should not affect anything. However, there have been some significant internal changes to the Go compiler, so esbuild could potentially behave differently in certain edge cases:

    • It now uses the new garbage collector that comes with Go 1.26.
    • The Go compiler is now more aggressive with allocating memory on the stack.
    • The executable format that the Go linker uses has undergone several changes.
    • The WebAssembly build now unconditionally makes use of the sign extension and non-trapping floating-point to integer conversion instructions.

    You can read the Go 1.26 release notes for more information.

v0.27.7

  • Fix lowering of define semantics for TypeScript parameter properties (#4421)

    The previous release incorrectly generated class fields for TypeScript parameter properties even when the configured target environment does not support class fields. With this release, the generated class fields will now be correctly lowered in this case:

    // Original code
class Foo {
  constructor(public x = 1) {}
  y = 2
}
// Old output (with --loader=ts --target=es2021)
class Foo {
constructor(x = 1) {
this.x = x;
__publicField(this, "y", 2);
}
x;
}
// New output (with --loader=ts --target=es2021)
class Foo {

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2024

This changelog documents all esbuild versions published in the year 2024 (versions 0.19.12 through 0.24.2).

0.24.2

  • Fix regression with --define and import.meta (#4010, #4012, #4013)

    The previous change in version 0.24.1 to use a more expression-like parser for define values to allow quoted property names introduced a regression that removed the ability to use --define:import.meta=.... Even though import is normally a keyword that can't be used as an identifier, ES modules special-case the import.meta expression to behave like an identifier anyway. This change fixes the regression.

    This fix was contributed by @​sapphi-red.

0.24.1

  • Allow es2024 as a target in tsconfig.json (#4004)

    TypeScript recently added es2024 as a compilation target, so esbuild now supports this in the target field of tsconfig.json files, such as in the following configuration file:

    {
  "compilerOptions": {
    "target": "ES2024"
  }
}

    As a reminder, the only thing that esbuild uses this field for is determining whether or not to use legacy TypeScript behavior for class fields. You can read more in the documentation.

    This fix was contributed by @​billyjanitsch.

  • Allow automatic semicolon insertion after get/set

    This change fixes a grammar bug in the parser that incorrectly treated the following code as a syntax error:

    class Foo {
  get
  *x() {}
  set
  *y() {}
}

    The above code will be considered valid starting with this release. This change to esbuild follows a similar change to TypeScript which will allow this syntax starting with TypeScript 5.7.

  • Allow quoted property names in --define and --pure (#4008)

    The define and pure API options now accept identifier expressions containing quoted property names. Previously all identifiers in the identifier expression had to be bare identifiers. This change now makes --define and --pure consistent with --global-name, which already supported quoted property names. For example, the following is now possible:

    

    • 






... (truncated)





Commits

    

  • 6a794df publish 0.28.0 to npm
    • 

  • 64ee0ea fix #4435: support with { type: text } imports
    • 

  • ef65aee fix sort order in snapshots_packagejson.txt
    • 

  • 1a26a8e try to fix test-old-ts, also shuffle CI tasks
    • 

  • 556ce6c use '' instead of null to omit build hashes
    • 

  • 8e675a8 ci: allow missing binary hashes for tests
    • 

  • 7067763 Reapply "update go 1.25.7 => 1.26.1"
    • 

  • 39473a9 fix #4343: integrity check for binary download
    • 

  • 2025c9f publish 0.27.7 to npm
    • 

  • c6b586e fix typo in Makefile for @esbuild/win32-x64
    • 

  • Additional commits viewable in compare view
    • 






Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for esbuild since your current version.






Updates tsup from 8.2.3 to 8.5.1



Release notes

Sourced from tsup's releases.




v8.5.1


   🐞 Bug Fixes



    View changes on GitHub


v8.5.0


   🚀 Features



   🐞 Bug Fixes



    View changes on GitHub


v8.4.0


   🚀 Features



   🐞 Bug Fixes



    View changes on GitHub


v8.3.6


   🐞 Bug Fixes



    View changes on GitHub


v8.3.5


   🐞 Bug Fixes



    View changes on GitHub


v8.3.4


No significant changes


    View changes on GitHub





... (truncated)





Commits





Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for tsup since your current version.






Updates tsup from 8.2.3 to 8.5.1



Release notes

Sourced from tsup's releases.




v8.5.1


   🐞 Bug Fixes



    View changes on GitHub


v8.5.0


   🚀 Features



   🐞 Bug Fixes



    View changes on GitHub


v8.4.0


   🚀 Features



   🐞 Bug Fixes



    View changes on GitHub


v8.3.6


   🐞 Bug Fixes



    View changes on GitHub


v8.3.5


   🐞 Bug Fixes



    View changes on GitHub


v8.3.4


No significant changes


    View changes on GitHub





... (truncated)





Commits





Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for tsup since your current version.






Updates minimatch from 3.1.2 to 3.1.5



Commits






Updates js-yaml from 3.14.1 to 3.14.2



Changelog

Sourced from js-yaml's changelog.




[3.14.2] - 2025-11-15


Security


    

  • Backported v4.1.1 fix to v3
    • 



[4.1.1] - 2025-11-12


Security


    

  • Fix prototype pollution issue in yaml merge (<<) operator.
    • 



[4.1.0] - 2021-04-15


Added


    

  • Types are now exported as yaml.types.XXX.
    • 

  • Every type now has options property with original arguments kept as they were
(see yaml.types.int.options as an example).
    • 



Changed


    

  • Schema.extend() now keeps old type order in case of conflicts
(e.g. Schema.extend([ a, b, c ]).extend([ b, a, d ]) is now ordered as abcd instead of cbad).
    • 



[4.0.0] - 2021-01-03


Changed


    

  • Check migration guide to see details for all breaking changes.
    • 

  • Breaking: "unsafe" tags !!js/function, !!js/regexp, !!js/undefined are
moved to js-yaml-js-types package.
    • 

  • Breaking: removed safe* functions. Use load, loadAll, dump
instead which are all now safe by default.
    • 

  • yaml.DEFAULT_SAFE_SCHEMA and yaml.DEFAULT_FULL_SCHEMA are removed, use
yaml.DEFAULT_SCHEMA instead.
    • 

  • yaml.Schema.create(schema, tags) is removed, use schema.extend(tags) instead.
    • 

  • !!binary now always mapped to Uint8Array on load.
    • 

  • Reduced nesting of /lib folder.
    • 

  • Parse numbers according to YAML 1.2 instead of YAML 1.1 (01234 is now decimal,
0o1234 is octal, 1:23 is parsed as string instead of base60).
    • 

  • dump() no longer quotes :, [, ], (, ) except when necessary, #470, #557.
    • 

  • Line and column in exceptions are now formatted as (X:Y) instead of
at line X, column Y (also present in compact format), #332.
    • 

  • Code snippet created in exceptions now contains multiple lines with line numbers.
    • 

  • dump() now serializes undefined as null in collections and removes keys with
undefined in mappings, #571.
    • 

  • dump() with skipInvalid=true now serializes invalid items in collections as null.
    • 

  • Custom tags starting with ! are now dumped as !tag instead of !<!tag>, #576.
    • 

  • Custom tags starting with tag:yaml.org,2002: are now shorthanded using !!, #258.
    • 



Added


    

  • Added .mjs (es modules) support.
    • 

  • Added quotingType and forceQuotes options for dumper to configure
string literal style, #290, #529.
    • 

  • Added styles: { '!!null': 'empty' } option for dumper
(serializes { foo: null } as "foo: "), #570.
    • 






... (truncated)





Commits






Updates @modelcontextprotocol/sdk from 1.12.1 to 1.29.0



Release notes

Sourced from @​modelcontextprotocol/sdk's releases.




v1.29.0


What's Changed



New Contributors



Full Changelog: modelcontextprotocol/typescript-sdk@v1.28.0...v1.29.0


v1.28.0


What's Changed



New Contributors



Full Changelog: modelcontextprotocol/typescript-sdk@v1.27.1...v1.28.0


v1.27.1


What's Changed



New Contributors



Full Changelog: modelcontextprotocol/typescript-sdk@v1.27.0...v1.27.1


v1.27.0


What's Changed





... (truncated)





Commits





Maintainer changes

This version was pushed to npm by pcarleton, a new releaser for @​modelcontextprotocol/sdk since your current version.






Updates cookie from 0.6.0 to 0.7.2



Release notes

Sourced from cookie's releases.




v0.7.2


Fixed


    

  • Fix object assignment of hasOwnProperty (#177)  bc38ffd
    • 



jshttp/cookie@v0.7.1...v0.7.2


0.7.1


Fixed


    

  • Allow leading dot for domain (#174)

      

    • Although not permitted in the spec, some users expect this to work and user agents ignore the leading dot according to spec
      • 

    

    • 

  • Add fast path for serialize without options, use obj.hasOwnProperty when parsing (#172)
    • 



jshttp/cookie@v0.7.0...v0.7.1


0.7.0



jshttp/cookie@v0.6.0...v0.7.0







Commits





Maintainer changes

This version was pushed to npm by blakeembrey, a new releaser for cookie since your current version.






Updates qs from 6.11.0 to 6.13.0



Changelog

Sourced from qs's changelog.




6.13.0


    

  • [New] parse: add strictDepth option (#511)
    • 

  • [Tests] use npm audit instead of aud
    • 



6.12.5


    

  • [Fix] fix regressions from robustness refactor
    • 

  • [actions] update reusable workflows
    • 



6.12.4


    

  • [Robustness] avoid .push, use void
    • 

  • [readme] clarify parseArrays and arrayLimit documentation (#543)
    • 

  • [readme] document that addQueryPrefix does not add ? to empty output (#418)
    • 

  • [readme] replace runkit CI badge with shields.io check-runs badge
    • 

  • [actions] fix rebase workflow permissions
    • 



6.12.3


    

  • [Fix] parse: properly account for strictNullHandling when allowEmptyArrays
    • 

  • [meta] fix changelog indentation
    • 



6.12.2


    

  • [Fix] parse: parse encoded square brackets (#506)
    • 

  • [readme] add CII best practices badge
    • 



6.12.1


    

  • [Fix] parse: Disable decodeDotInKeys by default to restore previous behavior (#501)
    • 

  • [Performance] utils: Optimize performance under large data volumes, reduce memory usage, and speed up processing (#502)
    • 

  • [Refactor] utils: use +=
    • 

  • [Tests] increase coverage
    • 



6.12.0


    

  • [New] parse/stringify: add decodeDotInKeys/encodeDotKeys options (#488)
    • 

  • [New] parse: add duplicates option
    • 

  • [New] parse/stringify: add allowEmptyArrays option to allow [] in object values (#487)
    • 

  • [Refactor] parse/stringify: move allowDots config logic to its own variable
    • 

  • [Refactor] stringify: move option-handling code into normalizeStringifyOptions
    • 

  • [readme] update readme, add logos (#484)
    • 

  • [readme] stringify: clarify default arrayFormat behavior
    • 

  • [readme] fix line wrapping
    • 

  • [readme] remove dead badges
    • 

  • [Deps] update side-channel
    • 

  • [meta] make the dist build 50% smaller
    • 

  • [meta] add sideEffects flag
    • 

  • [meta] run build in prepack, not prepublish
    • 

  • [Tests] parse: remove useless tests; add coverage
    • 

  • [Tests] stringify: increase coverage
    • 

  • [Tests] use mock-property
    • 

  • [Tests] stringify: improve coverage
    • 

  • [Dev Deps] update @ljharb/eslint-config , aud, has-override-mistake, has-property-descriptors, mock-property, npmignore, object-inspect, tape
    • 

  • [Dev Deps] pin glob, since v10.3.8+ requires a broken jackspeak
    • 






... (truncated)





Commits

    

  • 5cf516c v6.13.0
    • 

  • 8d56df2 [New] parse: add strictDepth option
    • 

  • c9a6694 [Tests] use npm audit instead of aud
    • 

  • f90cc35 v6.12.3
    • 

  • 1bf9f7a [Fix] parse: properly account for strictNullHandling when allowEmptyArrays
    • 

  • 7ebf48b [meta] fix changelog indentation
    • 

  • d0dff11 v6.12.2
    • 

  • f0b8d03 [Dev Deps] update @ljharb/eslint-config, object-inspect, tape
    • 

  • 81835ff [Fix]: parse: parse encoded square brackets
    • 

  • db47dcc [readme] add CII best practices badge
    • 

  • Additional commits viewable in compare view
    • 







Updates send from 0.18.0 to 0.19.2



Release notes

Sourced from send's releases.




0.19.2


What's Changed



Full Changelog: pillarjs/send@0.19.1...0.19.2


0.19.1


What's Changed



Full Changelog: pillarjs/send@0.19.0...0.19.1


0.19.0


What's Changed



New Contributors



Full Changelog: pillarjs/send@0.18.0...0.19.0







Changelog

Sourced from send's changelog.




0.19.2 / 2025-12-15


    

  • deps: use tilde notation for dependencies
    • 

  • deps: http-errors@~2.0.1
    • 

  • deps: statuses@~2.0.2
    • 



0.19.1 / 2024-10-09


    

  • deps: encodeurl@~2.0.0
    • 



0.19.0 / 2024-09-10


    

  • Remove link renderization in html while redirecting
    • 








Commits





Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for send since your current version.






Updates ajv from 6.12.6 to 6.15.0



Commits






Updates flatted from 3.3.1 to 3.4.2



Commits

    

  • 3bf0909 3.4.2
    • 

  • 885ddcc fix CWE-1321
    • 

  • 0bdba70 added flatted-view to the benchmark
    • 

  • 2a02dce 3.4.1
    • 

  • fba4e8f Merge pull request #89 from WebReflection/python-fix
    • 

  • 5fe8648 added "when in Rome" also a test for PHP
    • 

  • 53517ad some minor improvement
    • 

  • b3e2a0c Fixing recursion issue in Python too
    • 

  • c4b46db Add SECURITY.md for security policy and reporting
    • 

  • f86d071 Create dependabot.yml for version updates
    • 

  • Additional commits viewable in compare view
    • 







Updates glob from 10.4.5 to 10.5.0



Commits






Updates jws from 4.0.0 to 4.0.1



Release notes

Sourced from jws's releases.




v4.0.1


Changed


    

  • Fix advisory GHSA-869p-cjfg-cm3x: createSign and createVerify now require
that a non empty secret is provided (via opts.secret, opts.privateKey or opts.key)
when using HMAC algorithms.
    • 

  • Upgrading JWA version to 2.0.1, addressing a compatibility issue for Node >= 25.
    • 








Changelog

Sourced from jws's changelog.




[4.0.1]


Changed


    

  • Fix advisory GHSA-869p-cjfg-cm3x: createSign and createVerify now require
that a non empty secret is provided (via opts.secret, opts.privateKey or opts.key)
when using HMAC algorithms.
    • 

  • Upgrading JWA version to 2.0.1, adressing a compatibility issue for Node >= 25.
    • 



[3.2.3]


Changed


    

  • Fix advisory GHSA-869p-cjfg-cm3x: createSign and createVerify now require
that a non empty secret is provided (via opts.secret, opts.privateKey or opts.key)
when using HMAC algorithms.
    • 

  • Upgrading JWA version to 1.4.2, adressing a compatibility issue for Node >= 25.
    • 



[3.0.0]


Changed



2.0.0 - 2015-01-30


Changed


    

  • 

    BREAKING: Default payload encoding changed from binary to
utf8. utf8 is a is a more sensible default than binary because
many payloads, as far as I can tell, will contain user-facing
strings that could be in any language. ([6b6de48])
    

    • 

  • 

    Code reorganization, thanks [@​fearphage]! (

    

  
  



      


          

          
  
  

    
  
    
    

  

  

  



                    

          
        





  





    



      

  
        

  

      

  
  

  
          

  

    

      


  

      
        @dependabot
  




      

        
          Bump the npm_and_yarn group across 7 directories with 16 updates
        

          
                        
      


      

        

    
    
    

  

    


      


      

        

          

    
    
    

  

  

    
  



        

      


      

        
          b035dfc
        
      

    

  

    

      
Bumps the npm_and_yarn group with 12 updates in the /custom_nodes directory:

| Package | From | To |
| --- | --- | --- |
| [esbuild](https://github.com/evanw/esbuild) | `0.23.0` | `0.28.0` |
| [tsup](https://github.com/egoist/tsup) | `8.2.3` | `8.5.1` |
| [minimatch](https://github.com/isaacs/minimatch) | `3.1.2` | `3.1.5` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `3.14.1` | `3.14.2` |
| [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.12.1` | `1.29.0` |
| [cookie](https://github.com/jshttp/cookie) | `0.6.0` | `0.7.2` |
| [ajv](https://github.com/ajv-validator/ajv) | `6.12.6` | `6.15.0` |
| [flatted](https://github.com/WebReflection/flatted) | `3.3.1` | `3.4.2` |
| [glob](https://github.com/isaacs/node-glob) | `10.4.5` | `10.5.0` |
| [jws](https://github.com/brianloveswords/node-jws) | `4.0.0` | `4.0.1` |
| [picomatch](https://github.com/micromatch/picomatch) | `2.3.1` | `2.3.2` |
| [tmp](https://github.com/raszi/node-tmp) | `0.0.33` | `removed` |

Bumps the npm_and_yarn group with 3 updates in the /custom_nodes/examples/image_grid directory: [esbuild](https://github.com/evanw/esbuild), [minimatch](https://github.com/isaacs/minimatch) and [picomatch](https://github.com/micromatch/picomatch).
Bumps the npm_and_yarn group with 3 updates in the /custom_nodes/examples/make_uppercase directory: [esbuild](https://github.com/evanw/esbuild), [minimatch](https://github.com/isaacs/minimatch) and [picomatch](https://github.com/micromatch/picomatch).
Bumps the npm_and_yarn group with 1 update in the /custom_nodes/examples/make_uppercase_vanilla directory: [esbuild](https://github.com/evanw/esbuild).
Bumps the npm_and_yarn group with 1 update in the /custom_nodes/examples/wikipedia_fetcher directory: [esbuild](https://github.com/evanw/esbuild).
Bumps the npm_and_yarn group with 1 update in the /custom_nodes/packages/node-utils directory: [esbuild](https://github.com/evanw/esbuild).
Bumps the npm_and_yarn group with 1 update in the /custom_nodes/packages/utility-nodes directory: [esbuild](https://github.com/evanw/esbuild).


Updates `esbuild` from 0.23.0 to 0.28.0
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2024.md)
- [Commits](evanw/esbuild@v0.23.0...v0.28.0)

Updates `tsup` from 8.2.3 to 8.5.1
- [Release notes](https://github.com/egoist/tsup/releases)
- [Commits](egoist/tsup@v8.2.3...v8.5.1)

Updates `tsup` from 8.2.3 to 8.5.1
- [Release notes](https://github.com/egoist/tsup/releases)
- [Commits](egoist/tsup@v8.2.3...v8.5.1)

Updates `minimatch` from 3.1.2 to 3.1.5
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v3.1.2...v3.1.5)

Updates `js-yaml` from 3.14.1 to 3.14.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@3.14.1...3.14.2)

Updates `@modelcontextprotocol/sdk` from 1.12.1 to 1.29.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@1.12.1...v1.29.0)

Updates `cookie` from 0.6.0 to 0.7.2
- [Release notes](https://github.com/jshttp/cookie/releases)
- [Commits](jshttp/cookie@v0.6.0...v0.7.2)

Updates `qs` from 6.11.0 to 6.13.0
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.11.0...v6.13.0)

Updates `send` from 0.18.0 to 0.19.2
- [Release notes](https://github.com/pillarjs/send/releases)
- [Changelog](https://github.com/pillarjs/send/blob/master/HISTORY.md)
- [Commits](pillarjs/send@0.18.0...0.19.2)

Updates `ajv` from 6.12.6 to 6.15.0
- [Release notes](https://github.com/ajv-validator/ajv/releases)
- [Commits](ajv-validator/ajv@v6.12.6...v6.15.0)

Updates `flatted` from 3.3.1 to 3.4.2
- [Commits](WebReflection/flatted@v3.3.1...v3.4.2)

Updates `glob` from 10.4.5 to 10.5.0
- [Changelog](https://github.com/isaacs/node-glob/blob/main/changelog.md)
- [Commits](isaacs/node-glob@v10.4.5...v10.5.0)

Updates `jws` from 4.0.0 to 4.0.1
- [Release notes](https://github.com/brianloveswords/node-jws/releases)
- [Changelog](https://github.com/auth0/node-jws/blob/master/CHANGELOG.md)
- [Commits](auth0/node-jws@v4.0.0...v4.0.1)

Updates `path-to-regexp` from 0.1.10 to 0.1.13
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/v.0.1.13/History.md)
- [Commits](pillarjs/path-to-regexp@v0.1.10...v.0.1.13)

Updates `picomatch` from 2.3.1 to 2.3.2
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@2.3.1...2.3.2)

Updates `rollup` from 4.19.1 to 4.60.2
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.19.1...v4.60.2)

Removes `tmp`

Updates `esbuild` from 0.12.29 to 0.25.0
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2024.md)
- [Commits](evanw/esbuild@v0.23.0...v0.28.0)

Updates `minimatch` from 3.1.2 to 3.1.5
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v3.1.2...v3.1.5)

Updates `picomatch` from 2.3.1 to 2.3.2
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@2.3.1...2.3.2)

Updates `esbuild` from 0.12.29 to 0.25.0
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2024.md)
- [Commits](evanw/esbuild@v0.23.0...v0.28.0)

Updates `minimatch` from 3.1.2 to 3.1.5
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v3.1.2...v3.1.5)

Updates `picomatch` from 2.3.1 to 2.3.2
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@2.3.1...2.3.2)

Updates `esbuild` from 0.12.29 to 0.25.0
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2024.md)
- [Commits](evanw/esbuild@v0.23.0...v0.28.0)

Updates `esbuild` from 0.12.29 to 0.25.0
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2024.md)
- [Commits](evanw/esbuild@v0.23.0...v0.28.0)

Updates `esbuild` from 0.23.1 to 0.28.0
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2024.md)
- [Commits](evanw/esbuild@v0.23.0...v0.28.0)

Updates `esbuild` from 0.23.1 to 0.28.0
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2024.md)
- [Commits](evanw/esbuild@v0.23.0...v0.28.0)

---
updated-dependencies:
- dependency-name: esbuild
  dependency-version: 0.28.0
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: tsup
  dependency-version: 8.5.1
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: tsup
  dependency-version: 8.5.1
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: minimatch
  dependency-version: 3.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 3.14.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.29.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: cookie
  dependency-version: 0.7.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.13.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: send
  dependency-version: 0.19.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ajv
  dependency-version: 6.15.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: flatted
  dependency-version: 3.4.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: glob
  dependency-version: 10.5.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: jws
  dependency-version: 4.0.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: path-to-regexp
  dependency-version: 0.1.13
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: picomatch
  dependency-version: 2.3.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: rollup
  dependency-version: 4.60.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: tmp
  dependency-version: 
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: esbuild
  dependency-version: 0.25.0
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: minimatch
  dependency-version: 3.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: picomatch
  dependency-version: 2.3.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: esbuild
  dependency-version: 0.25.0
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: minimatch
  dependency-version: 3.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: picomatch
  dependency-version: 2.3.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: esbuild
  dependency-version: 0.25.0
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: esbuild
  dependency-version: 0.25.0
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: esbuild
  dependency-version: 0.28.0
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: esbuild
  dependency-version: 0.28.0
  dependency-type: direct:development
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>

    







  








      

  
            

    

      
    

    


      


          @dependabot
dependabot
Bot



            added
      

  dependencies

  Pull requests that update a dependency file

      

  javascript

  Pull requests that update javascript code

  labels


      May 2, 2026

    

  



  

  

    
  


  

      


  This was referenced May 2, 2026





  


  

      
   Closed

  






      







  


  

      
   Closed

  






  













  
  

    

      

  










  








  
      

  
    Sign up for free
    to join this conversation on GitHub.
    Already have an account?
    Sign in to comment


  










      

  

    
    

    

  

    Reviewers
  


    

    No reviews






    
    
    

    

  


      
  

    Assignees
  



        


    No one assigned







      


  


  

    Labels
  



    

      

    dependencies

  Pull requests that update a dependency file
  

    javascript

  Pull requests that update javascript code








      

  

    

        

    Projects
  


        




    None yet




  



      


  

    
  

    Milestone
  


      No milestone





    
      
          


  

    

      
        

          
  

    Development
  



            


Successfully merging this pull request may close these issues.





  
  



      
    

  




      

    

  
        

  

    

      0 participants