🆙 npm(deps): Bump the npm group across 1 directory with 7 updates by dependabot[bot] · Pull Request #183 · ActionsDesk/github-actions-allow-list-as-code-action

dependabot · 2026-07-28T06:35:41Z

Bumps the npm group with 7 updates in the / directory:

Package	From	To
js-yaml	`4.2.0`	`5.2.2`
@eslint/markdown	`8.0.2`	`8.0.3`
@vercel/ncc	`0.38.4`	`0.44.1`
eslint	`10.4.1`	`10.8.0`
globals	`17.6.0`	`17.8.0`
lint-staged	`17.0.7`	`17.2.0`
proxy-agent	`8.0.1`	`8.0.2`

Updates js-yaml from 4.2.0 to 5.2.2

Changelog

Sourced from js-yaml's changelog.

[5.2.2] - 2026-07-24

Fixed

Quote flow scalars where a colon precedes a flow indicator, #773.

Security

Avoid exponential parsing time for nested flow sequence pairs.

[5.2.1] - 2026-07-02

Fixed

Add Map support to !!omap (should work when realMapTag used)

Security

Remove quadratic complexity from !!omap addItem. Regression from v5 (usually not critical, because YAML11_SCHEMA is not default anymore).

4.3.0, 3.15.0 - 2026-06-27

Security

Backported maxTotalMergeKeys option.

[5.2.0] - 2026-06-26

Added

Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.

Added maxAliases (-1) loader option to limit the number of YAML aliases per document.

Removed

maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

Fixed

Round-trip of integers with exponential form (>= 1e21)

[5.1.0] - 2026-06-23

Added

Collection tags can finalize an incrementally populated carrier into a different result value.

Changed

[breaking] quoteStyle now selects the preferred quote style; use the restored forceQuotes option to force quoting non-key strings.

[5.0.0] - 2026-06-20

Added

... (truncated)

Commits

3c29559 5.2.2 released
3e5240f parser: avoid reparsing flow sequence pair keys
bd7ebb2 fix: quote flow scalars where a colon precedes a flow indicator (#773)
ac16b42 5.2.1 released
4a864e5 Deps bump
39f3211 !!omap: add Map support and remove quadratic complexity
ff17f1e Changelog update
8ed15f1 deps bump
1a562dc Fix changelog link
c28ed5e 5.2.0 released
Additional commits viewable in compare view

Updates @eslint/markdown from 8.0.2 to 8.0.3

Release notes

Sourced from @eslint/markdown's releases.

v8.0.3

8.0.3 (2026-07-01)

Bug Fixes

type compatibility issue between Markdown v8 and ESLint v9.39.x (#648) (3986839)

update dependency @eslint/plugin-kit to ^0.7.2 (#665) (645b0c3)

Changelog

Sourced from @eslint/markdown's changelog.

8.0.3 (2026-07-01)

Bug Fixes

type compatibility issue between Markdown v8 and ESLint v9.39.x (#648) (3986839)

update dependency @eslint/plugin-kit to ^0.7.2 (#665) (645b0c3)

Commits

e93e014 chore: release 8.0.3 🚀 (#666)
5c16c41 docs: Update README sponsors
f5b6548 docs: Update README sponsors
c627dca docs: Update README sponsors
54d3323 chore: update non-major dev-dependencies to v3.8.4 (#670)
d006b8a docs: Update README sponsors
3986839 fix: type compatibility issue between Markdown v8 and ESLint v9.39.x (#648)
133ddaa docs: Update README sponsors
c154e51 docs: Update README sponsors
15e6148 chore: update dependency @eslint/json to v2 (#668)
Additional commits viewable in compare view

Updates @vercel/ncc from 0.38.4 to 0.44.1

Release notes

Sourced from @vercel/ncc's releases.

0.44.1

0.44.1 (2026-06-29)

Bug Fixes

preserve runtime createRequire in ESM builds (#1334) (8f0aefd), closes #1312

0.44.0

0.44.0 (2026-06-09)

Features

read permissions pr.yml (#1323) (5ea625e)

0.43.0

0.43.0 (2026-06-09)

Changes

BREAKING CHANGE: add Node 24 and 26 support, remove 20 (#1318) (#1305)

switch npm releases to trusted publishing (OIDC) (#1325) (#1327) (#1328) (#1329) (#1330) (#1331) (#1332)

switch package management to pnpm (#1321)

fix predictable global cache directory in /tmp enables symlink/hijack risks (#1314)

reorder extension resolution to prioritise TypeScript over JSON (#1315)

support TypeScript 6 transpile builds (#1316)

Commits

8f0aefd fix: preserve runtime createRequire in ESM builds (#1334)
b9c6310 chore: Update vm2 to latest version (3.11.5) (#1333)
88be21f chore(deps): Bump actions/checkout from 5 to 6 (#1300)
5ea625e feat: read permissions pr.yml (#1323)
a1ff315 feat: remove npm devDependency (#1332)
9e077ab feat: add publishConfig to package.json (#1331)
7290aa7 feat(ci): upgrade python and remove LLVM LTO flags from MSVC build to fix Nod...
a428a10 feat: publish using node@24 (#1329)
3192116 feat: use canonical package repository metadata (#1328)
4461a52 feat: lock semantic-release publish dependencies (#1327)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @vercel/ncc since your current version.

Updates eslint from 10.4.1 to 10.8.0

Release notes

Sourced from eslint's releases.

v10.8.0

Features

2fee9bb feat: export ConfigObject from eslint/config (#21082) (sethamus)

Bug Fixes

6b8d2f7 fix: escape reserved characters in rule id in html formatter (#21129) (Francesco Trotta)

9091071 fix: prevent no-unreachable-loop crash when all loop types are ignored (#21116) (Pixel)

e23fafe fix: prefer-object-spread add semicolon when adding parenthesis (#21081) (synthex-byte)

20b5ad0 fix: quadratic-time regex in prefer-template (#21096) (Milos Djermanovic)

8b6f6c0 fix: apply ignore configs to computed methods in class-methods-use-this (#21094) (Pixel)

b2c608c fix: NewExpression with parenthesized callee in preserve-caught-error (#21083) (Francesco Trotta)

Documentation

6ddf858 docs: fix broken Specify Parser Options anchor link (#21106) (Minsu)

784dfbe docs: Clarify no-eq-null description (#21120) (Park Harin)

7ec733a docs: Fix typos and grammar in glossary (#21095) (Marry (Subin Yang))

92bb13f docs: replace quake link (#21108) (Jung Hyeon Jun)

68eb4a5 docs: fix broken Specify Globals anchor links in rule pages (#21103) (Minsu)

d28f697 docs: replace Code Climate CLI links with Qlty CLI links (#21099) (Jung Hyeon Jun)

eccc68d docs: correct --suppressions-location option description (#21093) (Ga eun Lee)

c5963f7 docs: Update README (GitHub Actions Bot)

Chores

4fbf46d test: pin webpack version to 5.108.4 (#21137) (Francesco Trotta)

2d063e2 chore: update HTTP URLs to HTTPS in JSDoc and comments (#21101) (Bo Hyun Kim)

eccbe7b test: add error locations to no-class-assign (#21123) (devoil)

e7d1e43 ci: bump actions/setup-go from 6 to 7 (#21118) (dependabot[bot])

e9d66d0 ci: bump actions/setup-node from 6 to 7 (#21119) (dependabot[bot])

ee225b6 test: Add error location details to no-eq-null rule (#21117) (Park Harin)

044a627 chore: update minimatch to ^10.2.5 (#21107) (김채영)

fb09aa8 chore: update ecosystem plugins (#21115) (ESLint Bot)

5abd878 test: add error locations to no-proto (#21114) (Gihyeon Jeong / 정기현)

9715887 test: Add error location details to no-div-regex (#21110) (Park Harin)

a746ec6 test: add error locations to no-new-wrappers (#21109) (Gihyeon Jeong / 정기현)

8dde645 test: add error locations to no-ex-assign (#21102) (devoil)

13ab0ec test: add error locations to no-label-var (#21098) (Gihyeon Jeong / 정기현)

a99906f test: Add error location details to no-delete-var rule (#21105) (Park Harin)

c47e8dc chore: add missing backticks to languages/js/index.js (#21104) (beeen)

0174428 chore: add missing backticks to translate-cli-options.js (#21097) (dongkyu lee)

3d36589 chore: add missing backticks to serialization.js (#21091) (이규환)

dcc9312 test: add error locations to eqeqeq (#21090) (Ga eun Lee)

2710b18 ci: Add explicit permissions to rebuild-docs-sites workflow (#21089) (Marry (Subin Yang))

5d2f866 chore: update dependency prettier to v3.9.5 (#21086) (renovate[bot])

d584e31 chore: fix failing ecosystem test for eslint-plugin-unicorn (#21084) (Francesco Trotta)

bf3eda0 chore: update ecosystem plugins (#21079) (ESLint Bot)

v10.7.0

Features

cf2a9bf feat: add errorClassNames option to preserve-caught-error rule (#21032) (sethamus)

f8b873a feat: max-nested-callbacks option for constructor callbacks (#21063) (fnx)

... (truncated)

Commits

749dfed 10.8.0
4bd0d75 Build: changelog update for 10.8.0
4fbf46d test: pin webpack version to 5.108.4 (#21137)
6ddf858 docs: fix broken Specify Parser Options anchor link (#21106)
784dfbe docs: Clarify no-eq-null description (#21120)
6b8d2f7 fix: escape reserved characters in rule id in html formatter (#21129)
2d063e2 chore: update HTTP URLs to HTTPS in JSDoc and comments (#21101)
eccbe7b test: add error locations to no-class-assign (#21123)
2fee9bb feat: export ConfigObject from eslint/config (#21082)
e7d1e43 ci: bump actions/setup-go from 6 to 7 (#21118)
Additional commits viewable in compare view

Updates globals from 17.6.0 to 17.8.0

Release notes

Sourced from globals's releases.

v17.8.0

Update globals (2026-07-01) (#347) 7394811

sindresorhus/globals@v17.7.0...v17.8.0

v17.7.0

Update globals (2026-06-22) (#345) 33b75f9

sindresorhus/globals@v17.6.0...v17.7.0

Commits

36c7659 17.8.0
7394811 Update globals (2026-07-01) (#347)
a19670c 17.7.0
9611620 Update actions (#346)
33b75f9 Update globals (2026-06-22) (#345)
887dd52 Fix build script (#344)
See full diff in compare view

Updates lint-staged from 17.0.7 to 17.2.0

Release notes

Sourced from lint-staged's releases.

v17.2.0

Minor Changes
#1823 ee156cc - The chunking of tasks based on maximum command line argument length has been re-implemented to be more precise. Now the chunking happens based on the final generated command string, instead of just the list of staged files like previously. This benefits mainly Windows platforms and function commands like:
/** @type {import('lint-staged').Configuration} */
export default {
  "*.ts": () => "tsc", // Run "tsc" when any TS file is changed (for entire project)
};
Where the spawned command is literally "tsc" without any extra arguments. Previously, this was still chunked when a lot of files were staged. Now, it probably won't be chunked because the length of the command is just three letters.

Also, native JavaScript/Node.js function tasks won't be chunked at all, when previously they were run multiple times when chunked:
/** @type {import('lint-staged').Configuration} */
export default {
  "*.js": {
    title: "Log staged JS files to console",
    task: async (files) => {
      console.log("Staged JS files:", files);
    },
  },
};
v17.1.1

Patch Changes

#1820 a626a9f - It's now possible to set --max-arg-length=Infinity to effectively disable chunking of tasks based on the number of staged files. The parsing and validation of the numeric CLI options --max-arg-length and --concurrency has been improved.

v17.1.0

Minor Changes
#1816 7568d4f - The console output of lint-staged has been simplified so that there's less interactive spinners and more explicit messages like "Started…" -> "Done!". The primary purpose of this was to remove Listr2, a very large dependency.

Before:

Size of node_modules/ after installing: 1561.7 kB with 29 packages.

Fancy interactive spinners, but output dynamically changes:
✔ Backed up original state in git stash (0b191303)
✔ Running tasks for staged files...
✔ Staging changes from tasks...
✔ Cleaning up temporary files...

... (truncated)

Changelog

Sourced from lint-staged's changelog.

17.2.0

Minor Changes
#1823 ee156cc - The chunking of tasks based on maximum command line argument length has been re-implemented to be more precise. Now the chunking happens based on the final generated command string, instead of just the list of staged files like previously. This benefits mainly Windows platforms and function commands like:
/** @type {import('lint-staged').Configuration} */
export default {
  "*.ts": () => "tsc", // Run "tsc" when any TS file is changed (for entire project)
};
Where the spawned command is literally "tsc" without any extra arguments. Previously, this was still chunked when a lot of files were staged. Now, it probably won't be chunked because the length of the command is just three letters.

Also, native JavaScript/Node.js function tasks won't be chunked at all, when previously they were run multiple times when chunked:
/** @type {import('lint-staged').Configuration} */
export default {
  "*.js": {
    title: "Log staged JS files to console",
    task: async (files) => {
      console.log("Staged JS files:", files);
    },
  },
};
17.1.1

Patch Changes

#1820 a626a9f - It's now possible to set --max-arg-length=Infinity to effectively disable chunking of tasks based on the number of staged files. The parsing and validation of the numeric CLI options --max-arg-length and --concurrency has been improved.

17.1.0

Minor Changes
#1816 7568d4f - The console output of lint-staged has been simplified so that there's less interactive spinners and more explicit messages like "Started…" -> "Done!". The primary purpose of this was to remove Listr2, a very large dependency.

Before:

Size of node_modules/ after installing: 1561.7 kB with 29 packages.

Fancy interactive spinners, but output dynamically changes:
✔ Backed up original state in git stash (0b191303)
✔ Running tasks for staged files...

... (truncated)

Commits

fb540fb Merge pull request #1824 from lint-staged/changeset-release/main
dc0a738 chore(changeset): release
60cbb88 Merge pull request #1823 from lint-staged/reimplement-chunk-files
2354dc4 build(deps): update dependencies
0516e7f docs: adjust debug logs
e22f6ed style: run oxfmt on README.md
37e8e1a fix: restore chunking of git add command after running tasks
2c75f1d chore: remove unused file
ee156cc feat: add improved lazy-chunking of command strings
baa7c98 feat: remove current chunkFiles implementation
Additional commits viewable in compare view

Updates proxy-agent from 8.0.1 to 8.0.2

Release notes

Sourced from proxy-agent's releases.

proxy-agent@8.0.2

Patch Changes

Updated dependencies [1852c75]

Updated dependencies [d8f2926]

Updated dependencies [84e85ed]

Updated dependencies [8487a78]

Updated dependencies [3ebf4b2]

Updated dependencies [ce0243e]

https-proxy-agent@9.1.0

http-proxy-agent@9.1.0

pac-proxy-agent@9.1.0

socks-proxy-agent@10.1.0

Changelog

Sourced from proxy-agent's changelog.

8.0.2

Patch Changes

Updated dependencies [1852c75]

Updated dependencies [d8f2926]

Updated dependencies [84e85ed]

Updated dependencies [8487a78]

Updated dependencies [3ebf4b2]

Updated dependencies [ce0243e]

https-proxy-agent@9.1.0

http-proxy-agent@9.1.0

pac-proxy-agent@9.1.0

socks-proxy-agent@10.1.0

Commits

b7e5f7c test: increase timeout for flaky keepAlive test on Windows (#434)
065d1ff Version Packages (#416)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the npm group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.2.0` | `5.2.2` | | [@eslint/markdown](https://github.com/eslint/markdown) | `8.0.2` | `8.0.3` | | [@vercel/ncc](https://github.com/vercel/ncc) | `0.38.4` | `0.44.1` | | [eslint](https://github.com/eslint/eslint) | `10.4.1` | `10.8.0` | | [globals](https://github.com/sindresorhus/globals) | `17.6.0` | `17.8.0` | | [lint-staged](https://github.com/lint-staged/lint-staged) | `17.0.7` | `17.2.0` | | [proxy-agent](https://github.com/TooTallNate/proxy-agents/tree/HEAD/packages/proxy-agent) | `8.0.1` | `8.0.2` | Updates `js-yaml` from 4.2.0 to 5.2.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.2.0...5.2.2) Updates `@eslint/markdown` from 8.0.2 to 8.0.3 - [Release notes](https://github.com/eslint/markdown/releases) - [Changelog](https://github.com/eslint/markdown/blob/main/CHANGELOG.md) - [Commits](eslint/markdown@v8.0.2...v8.0.3) Updates `@vercel/ncc` from 0.38.4 to 0.44.1 - [Release notes](https://github.com/vercel/ncc/releases) - [Commits](vercel/ncc@0.38.4...0.44.1) Updates `eslint` from 10.4.1 to 10.8.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.4.1...v10.8.0) Updates `globals` from 17.6.0 to 17.8.0 - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](sindresorhus/globals@v17.6.0...v17.8.0) Updates `lint-staged` from 17.0.7 to 17.2.0 - [Release notes](https://github.com/lint-staged/lint-staged/releases) - [Changelog](https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md) - [Commits](lint-staged/lint-staged@v17.0.7...v17.2.0) Updates `proxy-agent` from 8.0.1 to 8.0.2 - [Release notes](https://github.com/TooTallNate/proxy-agents/releases) - [Changelog](https://github.com/TooTallNate/proxy-agents/blob/main/packages/proxy-agent/CHANGELOG.md) - [Commits](https://github.com/TooTallNate/proxy-agents/commits/proxy-agent@8.0.2/packages/proxy-agent) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 5.2.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: npm - dependency-name: "@eslint/markdown" dependency-version: 8.0.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@vercel/ncc" dependency-version: 0.44.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm - dependency-name: eslint dependency-version: 10.8.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm - dependency-name: globals dependency-version: 17.8.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm - dependency-name: lint-staged dependency-version: 17.2.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm - dependency-name: proxy-agent dependency-version: 8.0.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added the dependency 🤖 label Jul 28, 2026

dependabot Bot requested review from a team and stoe as code owners July 28, 2026 06:35

stoe enabled auto-merge (squash) July 28, 2026 07:04

stoe approved these changes Jul 28, 2026

View reviewed changes

stoe merged commit 8d28b39 into main Jul 28, 2026
3 checks passed

stoe deleted the dependabot/npm_and_yarn/npm-4b3c2b955e branch July 28, 2026 07:05

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

🆙 npm(deps): Bump the npm group across 1 directory with 7 updates - #183

🆙 npm(deps): Bump the npm group across 1 directory with 7 updates#183
stoe merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-4b3c2b955e

dependabot Bot commented on behalf of github Jul 28, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 28, 2026

[5.2.2] - 2026-07-24

Fixed

Security

[5.2.1] - 2026-07-02

Fixed

Security

4.3.0, 3.15.0 - 2026-06-27

Security

[5.2.0] - 2026-06-26

Added

Removed

Fixed

[5.1.0] - 2026-06-23

Added

Changed

[5.0.0] - 2026-06-20

Added

v8.0.3

8.0.3 (2026-07-01)

Bug Fixes

8.0.3 (2026-07-01)

Bug Fixes

0.44.1

0.44.1 (2026-06-29)

Bug Fixes

0.44.0

0.44.0 (2026-06-09)

Features

0.43.0

0.43.0 (2026-06-09)

Changes

v10.8.0

Features

Bug Fixes

Documentation

Chores

v10.7.0

Features

v17.8.0

v17.7.0

v17.2.0

Minor Changes

v17.1.1

Patch Changes

v17.1.0

Minor Changes

17.2.0

Minor Changes

17.1.1

Patch Changes

17.1.0

Minor Changes

proxy-agent@8.0.2

Patch Changes

8.0.2

Patch Changes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant