chore(deps): bump the typescript-runtime-deps group in /runtimes/typescript with 10 updates by dependabot[bot] · Pull Request #378 · datastax/ai-workbench

dependabot · 2026-06-11T17:25:52Z

Bumps the typescript-runtime-deps group in /runtimes/typescript with 10 updates:

Package	From	To
@opentelemetry/auto-instrumentations-node	`0.76.0`	`0.77.0`
@opentelemetry/exporter-trace-otlp-http	`0.218.0`	`0.219.0`
@opentelemetry/resources	`2.7.1`	`2.8.0`
@opentelemetry/sdk-node	`0.218.0`	`0.219.0`
@scalar/hono-api-reference	`0.10.20`	`0.11.3`
hono	`4.12.23`	`4.12.25`
read-excel-file	`9.0.10`	`9.2.0`
@types/node	`25.9.1`	`25.9.3`
knip	`6.15.0`	`6.16.1`
write-excel-file	`4.0.7`	`4.1.1`

Updates @opentelemetry/auto-instrumentations-node from 0.76.0 to 0.77.0

Release notes

Sourced from @opentelemetry/auto-instrumentations-node's releases.

auto-instrumentations-node: v0.77.0

0.77.0 (2026-06-11)

Features

add @opentelemetry/instrumentation-host-metrics and integrate into auto-instrumentations-node (#3492) (16bee31)

deps: update deps matching '@opentelemetry/*' (#3567) (bd569b5)

Dependencies

The following workspace dependencies were updated

dependencies

@opentelemetry/instrumentation-amqplib bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-aws-lambda bumped from ^0.70.0 to ^0.71.0

@opentelemetry/instrumentation-aws-sdk bumped from ^0.73.0 to ^0.74.0

@opentelemetry/instrumentation-bunyan bumped from ^0.63.0 to ^0.64.0

@opentelemetry/instrumentation-cassandra-driver bumped from ^0.63.0 to ^0.64.0

@opentelemetry/instrumentation-connect bumped from ^0.61.0 to ^0.62.0

@opentelemetry/instrumentation-cucumber bumped from ^0.34.0 to ^0.35.0

@opentelemetry/instrumentation-dataloader bumped from ^0.35.0 to ^0.36.0

@opentelemetry/instrumentation-dns bumped from ^0.61.0 to ^0.62.0

@opentelemetry/instrumentation-express bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-fs bumped from ^0.37.0 to ^0.38.0

@opentelemetry/instrumentation-generic-pool bumped from ^0.61.0 to ^0.62.0

@opentelemetry/instrumentation-graphql bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-hapi bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-host-metrics bumped from ^0.1.0 to ^0.2.0

@opentelemetry/instrumentation-ioredis bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-kafkajs bumped from ^0.27.0 to ^0.28.0

@opentelemetry/instrumentation-knex bumped from ^0.62.0 to ^0.63.0

@opentelemetry/instrumentation-koa bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-lru-memoizer bumped from ^0.62.0 to ^0.63.0

@opentelemetry/instrumentation-memcached bumped from ^0.61.0 to ^0.62.0

@opentelemetry/instrumentation-mongodb bumped from ^0.71.0 to ^0.72.0

@opentelemetry/instrumentation-mongoose bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-mysql bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-mysql2 bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-nestjs-core bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-net bumped from ^0.62.0 to ^0.63.0

@opentelemetry/instrumentation-openai bumped from ^0.16.0 to ^0.17.0

@opentelemetry/instrumentation-oracledb bumped from ^0.43.0 to ^0.44.0

@opentelemetry/instrumentation-pg bumped from ^0.70.0 to ^0.71.0

@opentelemetry/instrumentation-pino bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-redis bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-restify bumped from ^0.63.0 to ^0.64.0

@opentelemetry/instrumentation-router bumped from ^0.62.0 to ^0.63.0

@opentelemetry/instrumentation-runtime-node bumped from ^0.31.0 to ^0.32.0

@opentelemetry/instrumentation-socket.io bumped from ^0.65.0 to ^0.66.0

... (truncated)

Changelog

Sourced from @opentelemetry/auto-instrumentations-node's changelog.

0.77.0 (2026-06-11)

Features

add @opentelemetry/instrumentation-host-metrics and integrate into auto-instrumentations-node (#3492) (16bee31)

deps: update deps matching '@opentelemetry/*' (#3567) (bd569b5)

Dependencies

The following workspace dependencies were updated

dependencies

@opentelemetry/instrumentation-amqplib bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-aws-lambda bumped from ^0.70.0 to ^0.71.0

@opentelemetry/instrumentation-aws-sdk bumped from ^0.73.0 to ^0.74.0

@opentelemetry/instrumentation-bunyan bumped from ^0.63.0 to ^0.64.0

@opentelemetry/instrumentation-cassandra-driver bumped from ^0.63.0 to ^0.64.0

@opentelemetry/instrumentation-connect bumped from ^0.61.0 to ^0.62.0

@opentelemetry/instrumentation-cucumber bumped from ^0.34.0 to ^0.35.0

@opentelemetry/instrumentation-dataloader bumped from ^0.35.0 to ^0.36.0

@opentelemetry/instrumentation-dns bumped from ^0.61.0 to ^0.62.0

@opentelemetry/instrumentation-express bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-fs bumped from ^0.37.0 to ^0.38.0

@opentelemetry/instrumentation-generic-pool bumped from ^0.61.0 to ^0.62.0

@opentelemetry/instrumentation-graphql bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-hapi bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-host-metrics bumped from ^0.1.0 to ^0.2.0

@opentelemetry/instrumentation-ioredis bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-kafkajs bumped from ^0.27.0 to ^0.28.0

@opentelemetry/instrumentation-knex bumped from ^0.62.0 to ^0.63.0

@opentelemetry/instrumentation-koa bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-lru-memoizer bumped from ^0.62.0 to ^0.63.0

@opentelemetry/instrumentation-memcached bumped from ^0.61.0 to ^0.62.0

@opentelemetry/instrumentation-mongodb bumped from ^0.71.0 to ^0.72.0

@opentelemetry/instrumentation-mongoose bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-mysql bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-mysql2 bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-nestjs-core bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-net bumped from ^0.62.0 to ^0.63.0

@opentelemetry/instrumentation-openai bumped from ^0.16.0 to ^0.17.0

@opentelemetry/instrumentation-oracledb bumped from ^0.43.0 to ^0.44.0

@opentelemetry/instrumentation-pg bumped from ^0.70.0 to ^0.71.0

@opentelemetry/instrumentation-pino bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-redis bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-restify bumped from ^0.63.0 to ^0.64.0

@opentelemetry/instrumentation-router bumped from ^0.62.0 to ^0.63.0

@opentelemetry/instrumentation-runtime-node bumped from ^0.31.0 to ^0.32.0

@opentelemetry/instrumentation-socket.io bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-tedious bumped from ^0.37.0 to ^0.38.0

... (truncated)

Commits

4e52a90 chore: release main (#3524)
bd569b5 feat(deps): update deps matching '@opentelemetry/*' (#3567)
16bee31 feat: add @opentelemetry/instrumentation-host-metrics and integrate into auto...
See full diff in compare view

Updates @opentelemetry/exporter-trace-otlp-http from 0.218.0 to 0.219.0

Release notes

Sourced from @opentelemetry/exporter-trace-otlp-http's releases.

experimental/v0.219.0

0.219.0

💥 Breaking Changes

fix(configuration)!: stop removing null values from parsed config object #6679 @trentm

It is now the responsibility of the user of a parsed declarative config object, typically just the sdk-node package, to handle null values.

fix(api-logs)!: Removed NOOP_LOGGER and NoopLogger exports from @opentelemetry/api-logs. Use createNoopLogger(): Logger instead. #6713 @dyladan

feat(api-logs)!: rename scopeAttributes to attributes in LoggerOptions #6573 @pichlermarc

fix(sdk-node)!: remove buildSamplerFromConfig export #6784 @trentm

🚀 Features

feat(sdk-node): wire up metric producers from declarative config #6712 @MikeGoldsmith

feat(sdk-logs)!: add support for attributes in LoggerOptions #6573 @pichlermarc

🐛 Bug Fixes

fix(sdk-node): pass all config properties to log record exporters in declarative config #6708 @MikeGoldsmith

fix(sdk-node): warn and ignore zero exporter timeout in declarative config #6711 @MikeGoldsmith

fix(sdk-node): pass gRPC credentials and headers to span exporter in declarative config #6705 @MikeGoldsmith

fix(otlp-transformer): do not attempt to skip groups #6704 @pichlermarc

fix(otlp-grpc-exporter-base): recreate client after 5 consecutive DEADLINE_EXCEEDED to recover from connection dropped deadlock #6296 @afharo

fix(browser-detector): use the right semantic convention for user agent resource attribute #6729 @david-luna

fix(browser-detector): user agent resource attribute always #6754 @david-luna

fix(opentelemetry-exporter-prometheus): handle additional edge cases in metric name conversion #6727 @cjihrig

fix(sdk-logs): avoid null dereference in BatchLogRecordProcessor._flushAll when an in-flight export completes between awaits #6763 @Janealter

fix(configuration): improve environment variable substitution to handle all the cases shown in the spec #6757 @trentm

📚 Documentation

docs(otlp-exporter-base): index the package's public API in generated docs so types like OTLPExporterNodeConfigBase resolve and link from consumer exporter pages #6725 @devareddy05

🏠 Internal

refactor(configuration): remove redundant env var parsing in EnvironmentConfigFactory #6710 @MikeGoldsmith

Commits

13a035b chore: prepare next release (#6756)
4b13587 Merge commit from fork
71d195c chore(renovate): set minimumReleaseAge to 3 days (#6792)
555fca6 Update renovate.json to use matchManagers (#6141)
b711a81 docs(otlp-exporter-base): add typedoc entry points so public API is indexed a...
da70402 fix(ci): supply-chain sec: disable caching in release-related workflow (#6790)
002267b chore: complete the move to the smaller SPDX license header (#6791)
056ef9c feat(sdk-metrics): implement metric reader metrics (#6449)
3bd69ce fix(configuration): improve environment variable substitution to handle all t...
bfbda7c docs(exporter-trace-otlp-grpc): import CompressionAlgorithm from otlp-exporte...
Additional commits viewable in compare view

Updates @opentelemetry/resources from 2.7.1 to 2.8.0

Release notes

Sourced from @opentelemetry/resources's releases.

v2.8.0

2.8.0

🚀 Features

feat(sdk-trace-base): pretty-print SpanImpl, Tracer, and BasicTracerProvider via util.inspect so they render through diag and console.log #6690 @mcollina

feat(sdk-metrics): implement metric reader self-observability metrics #6449 @anuraaga

feat(core): add hrTimeToSeconds #6449 @anuraaga

🐛 Bug Fixes

fix(core): limit processing of incoming "baggage" header to 8192 bytes @pichlermarc

Changelog

Sourced from @opentelemetry/resources's changelog.

2.8.0

🚀 Features

feat(sdk-trace-base): pretty-print SpanImpl, Tracer, and BasicTracerProvider via util.inspect so they render through diag and console.log #6690 @mcollina

feat(sdk-metrics): implement metric reader self-observability metrics #6449 @anuraaga

feat(core): add hrTimeToSeconds #6449 @anuraaga

🐛 Bug Fixes

fix(core): limit processing of incoming "baggage" header to 8192 bytes @pichlermarc

Commits

13a035b chore: prepare next release (#6756)
4b13587 Merge commit from fork
71d195c chore(renovate): set minimumReleaseAge to 3 days (#6792)
555fca6 Update renovate.json to use matchManagers (#6141)
b711a81 docs(otlp-exporter-base): add typedoc entry points so public API is indexed a...
da70402 fix(ci): supply-chain sec: disable caching in release-related workflow (#6790)
002267b chore: complete the move to the smaller SPDX license header (#6791)
056ef9c feat(sdk-metrics): implement metric reader metrics (#6449)
3bd69ce fix(configuration): improve environment variable substitution to handle all t...
bfbda7c docs(exporter-trace-otlp-grpc): import CompressionAlgorithm from otlp-exporte...
Additional commits viewable in compare view

Updates @opentelemetry/sdk-node from 0.218.0 to 0.219.0

Release notes

Sourced from @opentelemetry/sdk-node's releases.

experimental/v0.219.0

0.219.0

💥 Breaking Changes

fix(configuration)!: stop removing null values from parsed config object #6679 @trentm

It is now the responsibility of the user of a parsed declarative config object, typically just the sdk-node package, to handle null values.

fix(api-logs)!: Removed NOOP_LOGGER and NoopLogger exports from @opentelemetry/api-logs. Use createNoopLogger(): Logger instead. #6713 @dyladan

feat(api-logs)!: rename scopeAttributes to attributes in LoggerOptions #6573 @pichlermarc

fix(sdk-node)!: remove buildSamplerFromConfig export #6784 @trentm

🚀 Features

feat(sdk-node): wire up metric producers from declarative config #6712 @MikeGoldsmith

feat(sdk-logs)!: add support for attributes in LoggerOptions #6573 @pichlermarc

🐛 Bug Fixes

fix(sdk-node): pass all config properties to log record exporters in declarative config #6708 @MikeGoldsmith

fix(sdk-node): warn and ignore zero exporter timeout in declarative config #6711 @MikeGoldsmith

fix(sdk-node): pass gRPC credentials and headers to span exporter in declarative config #6705 @MikeGoldsmith

fix(otlp-transformer): do not attempt to skip groups #6704 @pichlermarc

fix(otlp-grpc-exporter-base): recreate client after 5 consecutive DEADLINE_EXCEEDED to recover from connection dropped deadlock #6296 @afharo

fix(browser-detector): use the right semantic convention for user agent resource attribute #6729 @david-luna

fix(browser-detector): user agent resource attribute always #6754 @david-luna

fix(opentelemetry-exporter-prometheus): handle additional edge cases in metric name conversion #6727 @cjihrig

fix(sdk-logs): avoid null dereference in BatchLogRecordProcessor._flushAll when an in-flight export completes between awaits #6763 @Janealter

fix(configuration): improve environment variable substitution to handle all the cases shown in the spec #6757 @trentm

📚 Documentation

docs(otlp-exporter-base): index the package's public API in generated docs so types like OTLPExporterNodeConfigBase resolve and link from consumer exporter pages #6725 @devareddy05

🏠 Internal

refactor(configuration): remove redundant env var parsing in EnvironmentConfigFactory #6710 @MikeGoldsmith

Commits

13a035b chore: prepare next release (#6756)
4b13587 Merge commit from fork
71d195c chore(renovate): set minimumReleaseAge to 3 days (#6792)
555fca6 Update renovate.json to use matchManagers (#6141)
b711a81 docs(otlp-exporter-base): add typedoc entry points so public API is indexed a...
da70402 fix(ci): supply-chain sec: disable caching in release-related workflow (#6790)
002267b chore: complete the move to the smaller SPDX license header (#6791)
056ef9c feat(sdk-metrics): implement metric reader metrics (#6449)
3bd69ce fix(configuration): improve environment variable substitution to handle all t...
bfbda7c docs(exporter-trace-otlp-grpc): import CompressionAlgorithm from otlp-exporte...
Additional commits viewable in compare view

Updates @scalar/hono-api-reference from 0.10.20 to 0.11.3

Changelog

Sourced from @scalar/hono-api-reference's changelog.

0.11.3

0.11.2

0.11.1

0.11.0

Minor Changes
#9422: Add a nonce option for Content Security Policy support.

When you pass a nonce, the rendered HTML stamps it onto the inline <script> and the CDN <script> tag (and Scalar's own <style> tags, plus a matching <meta property="csp-nonce">). This lets the API Reference run under a strict script-src with no unsafe-inline and no unsafe-eval.
ApiReference({
  url: '/openapi.json',
  // Match this value in your `script-src` CSP directive.
  nonce: 'r4nd0m',
})
Note: style-src still needs 'unsafe-inline'. The reference renders inline style="…" attributes, which a CSP nonce can never authorize (nonces only apply to <script>, <style> and <link> elements), so a nonce-only style-src is not possible. The win is a fully strict script-src.

Commits

See full diff in compare view

Updates hono from 4.12.23 to 4.12.25

Release notes

Sourced from hono's releases.

v4.12.25

Security fixes

This release includes fixes for the following security issues:

CORS Middleware reflects any Origin with credentials when origin defaults to the wildcard

Affects: hono/cors. Fixes the wildcard origin reflecting the request Origin and sending Access-Control-Allow-Credentials: true when credentials: true is set without an explicit origin, where any site a logged-in user visited could make credentialed cross-origin requests and read responses from cookie-authenticated endpoints. GHSA-88fw-hqm2-52qc

Body Limit Middleware can be bypassed on AWS Lambda by understating Content-Length

Affects: hono/body-limit on AWS Lambda (hono/aws-lambda, hono/lambda-edge). Fixes the request being built with the client-declared Content-Length while the body is delivered fully buffered, where a client could declare a small Content-Length with a much larger body and slip past the configured size limit. GHSA-rv63-4mwf-qqc2

Path traversal in serve-static on Windows via encoded backslash (%5C)

Affects: serveStatic on Windows (Node, Bun, Deno adapters). Fixes the path guard allowing a lone backslash, where an encoded backslash (%5C) decoded to \ was treated as a separator by the Windows path resolver, letting a single URL segment escape into a middleware-guarded subtree. GHSA-wwfh-h76j-fc44

AWS Lambda adapter merges multiple Set-Cookie headers into one value, dropping cookies on ALB single-header and Lattice

Affects: hono/aws-lambda. Fixes multiple Set-Cookie response headers being joined into one comma-separated value for ALB single-header responses and VPC Lattice v2, where the value could not be split back into individual cookies and clients silently dropped or misparsed them. GHSA-j6c9-x7qj-28xf

Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest

Affects: hono/lambda-edge. Fixes repeated request headers being written with overwrite instead of append, where only the last value of a header such as X-Forwarded-For reached the application and the remaining values were silently dropped. GHSA-wgpf-jwqj-8h8p

v4.12.24

What's Changed

docs(contribution): simplifyAI Usage Policy by @yusukebe in honojs/hono#4972

chore: remove @types/glob by @rtritto in honojs/hono#4978

fix(bearer-auth): mention verifyToken in missing-options error message by @tan7vir in honojs/hono#4987

refactor(language): Test/improve tests on languages middleware by @iNeoO in honojs/hono#4980

fix(utils/ipaddr): expand "::" to eight zero groups by @youcefzemmar in honojs/hono#4973

fix: clean up config files trailing comma, stale excludes, typesVersions gaps, jsr paths by @Mohammad-Faiz-Cloud-Engineer in honojs/hono#4982

refactor(timing): Test/add test for middleware timing by @iNeoO in honojs/hono#4991

fix(utils/ipaddr): render the unspecified address binary as "::" by @sarathfrancis90 in honojs/hono#4998

Full Changelog: honojs/hono@v4.12.23...v4.12.24

Commits

fce483e 4.12.25
751ba41 Merge commit from fork
f0b094d Merge commit from fork
fa5f9bf Merge commit from fork
3892a6c Merge commit from fork
74c2cf8 test(aws-lambda): update integration tests (#5012)
7ae7cba Merge commit from fork
1b13848 chore(ci): bump codecov-action to v7.0.0 (#5011)
5fdde5a 4.12.24
c78932d fix(utils/ipaddr): render the unspecified address binary as "::" (#4998)
Additional commits viewable in compare view

Updates read-excel-file from 9.0.10 to 9.2.0

Changelog

Sourced from read-excel-file's changelog.

9.2.0 / 11.06.2026

Reverted the shift from unzipper to fflate in Node.js code.

The reason is that unzipper turns out to be 2x faster than fflate because fflate reimplements decompression in pure javascript while unzipper uses Node.js's "native" module zlib which is written in C.

Replaced unzipper with unzipper-esm.

This fixes the long-present bug when bundlers can't bundle an app that uses unzipper package because of that dynamic require() statement.

9.1.0 / 07.06.2026

Merged Stian Jensen's pull request that replaces unzipper package with fflate. This prunes 15 packages from node_modules (unzipper plus 14 transitive deps, e.g. bluebird, fs-extra, readable-stream).

9.0.7 / 28.04.2026

Merged Toni G's fix for a bug when error.row was always equal to 1.

Re-added schema parameter in readSheet() function.

9.0.0 / 18.04.2026

If you were using parseData() function:

Rewrote the code of the parseData() function and renamed it to parseSheetData().

The result of parseSheetData() function is now { errors, objects }. If there're no errors, errors will be undefined. Otherwise, errors will be a non-empty array and objects will be undefined.

Previously the result of parseSheetData() function was [{ errors, object }, ...], i.e. the errors were split between each particular data row. Now the errors are combined for all data rows. The rationale is that it's simpler to handle the result of the function this way.

Re-added row: number property to the error object. It's the number of the data row that caused the error, starting from 1.

Added columnIndex: number property to the error object.

Renamed some of the exported TypeScript types:

ParseDataCustomType → ParseSheetDataCustomType

ParseDataCustomTypeErrorMessage → ParseSheetDataCustomTypeErrorMessage

ParseDataCustomTypeErrorReason → ParseSheetDataCustomTypeErrorReason

ParseDataError → ParseSheetDataError

ParseDataValueRequiredError → ParseSheetDataValueRequiredError

ParseDataResult → ParseSheetDataResult

In a schema, a nested object could be declared as: { required: true/false, schema: { ... } }. This is still true but the required flag is now only allowed to be either undefined or false, so true value is not allowed. The reason is quite simple. If a nested object as a whole is marked as required: true, and then it happens to be empty, a "required" error should be returned for it. But that error would also have to include a column title, and a nested object simply can't be pinned down to a single column in a sheet because it is by definition spread over multiple columns. So instead of marking a nested object as a whole with required: true, mark the specific required properties of it.

8.0.0 / 11.03.2026

If you were using the default exported function:

Renamed the default exported function to a named exported function readSheet.

Old: import readExcelFile from "read-excel-file/browser"

New: import { readSheet } from "read-excel-file/browser"

And same for other exports like "read-excel-file/node", etc.

The default exported function now returns a different kind of result. Specifically, now it returns all available sheets — an array of objects: [{ sheet: "Sheet 1", data: [['a1','b1','c1'],['a2','b2','c2']] }, ...].

The default exported function used to return sheet names when passed getSheets: true parameter. Now, instead of that, the default exported function just returns all available sheets, from which one could get the sheet names.

If you were using readSheetNames() function:

... (truncated)

Commits

03fb66f 9.2.0
614dc0d Update CHANGELOG.md
5188016 Re-added unzipper as unzipper-esm cause it's faster than fflate
7b20c02 9.1.1
5eeb838 Prefixed Node.js "native" package names with "node:"
381d8a7 Comment on AsyncZipInflate
10e7984 9.1.0
13428cc Merged Stian Jensen's PR that replaces unzipper with fflate + refactored it
See full diff in compare view

Updates @types/node from 25.9.1 to 25.9.3

Commits

See full diff in compare view

Updates knip from 6.15.0 to 6.16.1

Release notes

Sourced from knip's releases.

Release 6.16.1

Resolve SvelteKit ./$types in monorepos (resolve #1778) (370ef4cefec6540ee7d58249cc402f479ec76405)

Release 6.16.0

Update sponsors data + fix sponsors layout on narrow screen (fadf13aad5ebc36f7bc2fbc7615bfa77681d3660)

Detect binaries and entry files in node:child_process calls (fc3598cfac640a2ae53b0113883574bf15bc5d47)

It works™ (2d9ce845121484ef3ff84e4a761cfd98891d6c09)

Extend known issues doc w/ workaround (close #1763) (fcd444bf4c6b2ddc5d7bb0ebfd6f3991cf5d0be2)

Support ignoreExportsUsedInFile per workspace (close #1495) (4b898a971105d865d86d4dc81bc694721bff8793)

feat(vscode): add workspaceRoot config option to enable use in a VSCode workspace that does not have package.json at the workspace root (#1667) (7c1ebef6ab6d1c5a7f2f920d4243241246b53f4b) - thanks @anmilleriii!

Replace minimist with node:util.parseArgs (resolve #1492) (b360c5ce1acfbb2cbd5f4e92ecca6c9b461ae094)

Preserve minimist numeric coercion and --no-x negation (c12153ce0601378354421e454a6b6bbab74ae9fb)

Simplify parseArgs adapter (ba15e413be7515620e4224b21483a1a87659dc34)

Detect and credit registered custom elements (resolve #1394) (62dcda5fa46ccf6bdd94175b725fd38678049319)

Add Lit and FAST plugins to detect @customElement classes (348d2c9decf09bb61ab47477bc6cc57e4b089ec3)

Add new testimonials (77fd7ed7dffaccfa8bc024105fe81dbe09b70671)

Scope custom path aliases per workspace (resolve #1775) (d908099b52e4fd93b7947bafecbabeddfc7847f3)

Restructure tests (ec4c77941d42aef54bed9e4dd1cae8e8784aa147)

Simplify boolean check in parseArgs adapter (ba6865de03785eb49b2adf833f7f769eece78d49)

Scope static custom-element define detection to the FAST plugin (94632cddd15f75eadd204cb480b3df6c1f2a842d)

Add Custom Elements feature docs page (230bd734652f3a269b70da09cd26ac7e80a210cd)

Update known-issues.md (f1f4c1bceef9a6575d7b31cc1340538ea894f824)

Fix crash on backtick string literals in plugin config (resolve #1776) (f1adc7fbd68fc52a89a4d2a4d6b17d905d051de7)

Format (e4720cab435be48e1a40afa8c548e21bdb74b14e)

Fix backtick string literals in require() and plugin-name config arrays (#1776) (d14eb053331daaaeaec89c3c8e04cfeeba7580af)

Credit custom elements via aliases, scoped registries, and static blocks (d7cbe12bd904f65b20016bdd2dfd4a5d7c5c1524)

Improve Stencil plugin: credit @Component and recognize test files (152d73052f87f29b348abbab90e117cfb97dd69b)

Add Catalyst plugin to credit bare @controller custom elements (8a37f8c25b03cd4e55bd18ba822906be35fcd97b)

Document Stencil, Catalyst, static-block custom el reg. (105fba3a829f1cf4cf871035dbc9c170b0de7bc1)

Auto-format md (f4fcf4e1c6a399d761151fc367125416e7741675)

Commits

a3169ec Release knip@6.16.1
370ef4c Resolve SvelteKit ./$types in monorepos (resolve #1778)
e9a5a64 Release knip@6.16.0
8a37f8c Add Catalyst plugin to credit bare @controller custom elements
152d730 Improve Stencil plugin: credit @Component and recognize test files
d7cbe12 Credit custom elements via aliases, scoped registries, and static blocks
d14eb05 Fix backtick string literals in require() and plugin-name config arrays (#1776)
f1adc7f Fix crash on backtick string literals in plugin config (resolve #1776)
94632cd Scope static custom-element define detection to the FAST plugin
ba6865d Simplify boolean check in parseArgs adapter
Additional commits viewable in compare view

Updates write-excel-file from 4.0.7 to 4.1.1

Changelog

Sourced from write-excel-file's changelog.

4.1.2 / 10.06.2026

Added transformElementContent() function in custom "feature" API.

Currently, it only supports the following files:

xl/worksheets/sheet{id}.xml

xl/workbook.xml

4.1.0 / 07.06.2026

In write-excel-file/node export, replaced archiver dependency with fflate. In other words, in Node.js, .xlsx file internals zipping is now done by fflate package rather than archiver package.

"Features" can now transform XML element attributes in the form of a JSON object. See the new transformElementAttributes() function.

Currently, it only supports the following files:

xl/worksheets/sheet{id}.xml

xl/workbook.xml

The /utility subpackage now exports two additional functions:

getCellAddress(rowIndex, columnIndex) — Converts cell row and column indexes to an address like A1, B2, etc.

convertDateToSerialNumber(date) — Converts a Date to an XLSX "serial number".

4.0.6 / 07.05.2026

Applied a fix suggested by Didier Richard for a bug when findElementInsideElement() utility function crashed if the element doesn't exist.

4.0.5 / 01.05.2026

Applied a fix suggested by @stewartfeasby for a bug when using conditional formatting together with span or rowSpan property of a cell object resulted in a corrupt .xlsx file.

Renamed span property of a cell object to columnSpan.

The old name still works but is deprecated.

Added some new functions in write-excel-file/utility subpackage:

getChildElements()

insertElementMarkupAccordingToOrderOfSiblings()

getOrderOfSiblings()

If you were using escapeAttributeName(), escapeAttributeValue() or escapeTextContent() functions from write-excel-file/utility subpackage:

escapeAttributeName(), escapeAttributeValue(), escapeTextContent() functions no longer remove "illegal characters" (i.e. prohibited ranges of UTF-8 characters — "control characters" or "surrogate blocks") because the names of these functions specifically say "escape", not "escape and remove illegal characters".

Those functions are now deprecated.

Use the new exported functions instead:

sanitizeAttributeName()

sanitizeAttributeValue()

sanitizeTextContent()

The new functions also remove any invalid characters such as "=" in attribute name, etc, which the old functions didn't do.

If you were using findElements() or findElementsInsideElement() functions from write-excel-file/utility subpackage:

... (truncated)

Commits

cea8cff 4.1.1
bd4c159 Prefixed node.js native module imports with node:
0d32cd1 4.1.0
88998ca #13. Added @onparallel/write-excel-file-hide-rows-and-columns feature link
3f11389 #16. Export getCellAddress() and convertDateToSerialNumber() from `/utili...
0cafd79 Added fflate issue link
ee5661b typo
16afd5e Replaced archiver with fflate
a0124be Update CHANGELOG.md
6e06a59 Added XML element attributes manipulation in "features"
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the typescript-runtime-deps group in /runtimes/typescript with 10 updates: | Package | From | To | | --- | --- | --- | | [@opentelemetry/auto-instrumentations-node](https://github.com/open-telemetry/opentelemetry-js-contrib/tree/HEAD/packages/auto-instrumentations-node) | `0.76.0` | `0.77.0` | | [@opentelemetry/exporter-trace-otlp-http](https://github.com/open-telemetry/opentelemetry-js) | `0.218.0` | `0.219.0` | | [@opentelemetry/resources](https://github.com/open-telemetry/opentelemetry-js) | `2.7.1` | `2.8.0` | | [@opentelemetry/sdk-node](https://github.com/open-telemetry/opentelemetry-js) | `0.218.0` | `0.219.0` | | [@scalar/hono-api-reference](https://github.com/scalar/scalar/tree/HEAD/integrations/hono) | `0.10.20` | `0.11.3` | | [hono](https://github.com/honojs/hono) | `4.12.23` | `4.12.25` | | [read-excel-file](https://gitlab.com/catamphetamine/read-excel-file) | `9.0.10` | `9.2.0` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.9.1` | `25.9.3` | | [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip) | `6.15.0` | `6.16.1` | | [write-excel-file](https://gitlab.com/catamphetamine/write-excel-file) | `4.0.7` | `4.1.1` | Updates `@opentelemetry/auto-instrumentations-node` from 0.76.0 to 0.77.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js-contrib/blob/main/packages/auto-instrumentations-node/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-js-contrib/commits/auto-instrumentations-node-v0.77.0/packages/auto-instrumentations-node) Updates `@opentelemetry/exporter-trace-otlp-http` from 0.218.0 to 0.219.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.218.0...experimental/v0.219.0) Updates `@opentelemetry/resources` from 2.7.1 to 2.8.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@v2.7.1...v2.8.0) Updates `@opentelemetry/sdk-node` from 0.218.0 to 0.219.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.218.0...experimental/v0.219.0) Updates `@scalar/hono-api-reference` from 0.10.20 to 0.11.3 - [Release notes](https://github.com/scalar/scalar/releases) - [Changelog](https://github.com/scalar/scalar/blob/main/integrations/hono/CHANGELOG.md) - [Commits](https://github.com/scalar/scalar/commits/HEAD/integrations/hono) Updates `hono` from 4.12.23 to 4.12.25 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.23...v4.12.25) Updates `read-excel-file` from 9.0.10 to 9.2.0 - [Changelog](https://gitlab.com/catamphetamine/read-excel-file/blob/master/CHANGELOG.md) - [Commits](https://gitlab.com/catamphetamine/read-excel-file/compare/v9.0.10...v9.2.0) Updates `@types/node` from 25.9.1 to 25.9.3 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `knip` from 6.15.0 to 6.16.1 - [Release notes](https://github.com/webpro-nl/knip/releases) - [Commits](https://github.com/webpro-nl/knip/commits/knip@6.16.1/packages/knip) Updates `write-excel-file` from 4.0.7 to 4.1.1 - [Changelog](https://gitlab.com/catamphetamine/write-excel-file/blob/main/CHANGELOG.md) - [Commits](https://gitlab.com/catamphetamine/write-excel-file/compare/v4.0.7...v4.1.1) --- updated-dependencies: - dependency-name: "@opentelemetry/auto-instrumentations-node" dependency-version: 0.77.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: typescript-runtime-deps - dependency-name: "@opentelemetry/exporter-trace-otlp-http" dependency-version: 0.219.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: typescript-runtime-deps - dependency-name: "@opentelemetry/resources" dependency-version: 2.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: typescript-runtime-deps - dependency-name: "@opentelemetry/sdk-node" dependency-version: 0.219.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: typescript-runtime-deps - dependency-name: "@scalar/hono-api-reference" dependency-version: 0.11.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: typescript-runtime-deps - dependency-name: hono dependency-version: 4.12.25 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: typescript-runtime-deps - dependency-name: read-excel-file dependency-version: 9.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: typescript-runtime-deps - dependency-name: "@types/node" dependency-version: 25.9.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: typescript-runtime-deps - dependency-name: knip dependency-version: 6.16.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: typescript-runtime-deps - dependency-name: write-excel-file dependency-version: 4.1.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: typescript-runtime-deps ... Signed-off-by: dependabot[bot] <support@github.com>

…deps (#379) tests/lib/tracing.test.ts imports both packages, but neither was declared — they only resolved as phantom dependencies hoisted to the root of node_modules. The typescript-runtime-deps bump (#378) moved @opentelemetry/sdk-trace-base 2.8.0 to nested-only placement under its twelve consumers, so 'tsc --noEmit' now fails on every branch with TS2307 (Cannot find module '@opentelemetry/sdk-trace-base'). Declaring both as devDependencies pins them at the root; the lockfile churn is npm deduping the twelve nested sdk-trace-base copies back into the single hoisted entry.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 11, 2026

erichare merged commit 65fc19a into main Jun 11, 2026
8 of 9 checks passed

erichare deleted the dependabot/npm_and_yarn/runtimes/typescript/typescript-runtime-deps-e3d5352dc7 branch June 11, 2026 17:26

erichare mentioned this pull request Jun 11, 2026

fix: declare OpenTelemetry test deps to unbreak typecheck on main #379

Merged

4 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the typescript-runtime-deps group in /runtimes/typescript with 10 updates#378

chore(deps): bump the typescript-runtime-deps group in /runtimes/typescript with 10 updates#378
erichare merged 1 commit into
mainfrom
dependabot/npm_and_yarn/runtimes/typescript/typescript-runtime-deps-e3d5352dc7

dependabot Bot commented on behalf of github Jun 11, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Jun 11, 2026

auto-instrumentations-node: v0.77.0

0.77.0 (2026-06-11)

Features

Dependencies

0.77.0 (2026-06-11)

Features

Dependencies

experimental/v0.219.0

0.219.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

📚 Documentation

🏠 Internal

v2.8.0

2.8.0

🚀 Features

🐛 Bug Fixes

2.8.0

🚀 Features

🐛 Bug Fixes

experimental/v0.219.0

0.219.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

📚 Documentation

🏠 Internal

0.11.3

0.11.2

0.11.1

0.11.0

Minor Changes

v4.12.25

Security fixes

CORS Middleware reflects any Origin with credentials when origin defaults to the wildcard

Body Limit Middleware can be bypassed on AWS Lambda by understating Content-Length

Path traversal in serve-static on Windows via encoded backslash (%5C)

AWS Lambda adapter merges multiple Set-Cookie headers into one value, dropping cookies on ALB single-header and Lattice

Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest

v4.12.24

What's Changed

9.2.0 / 11.06.2026

9.1.0 / 07.06.2026

9.0.7 / 28.04.2026

9.0.0 / 18.04.2026

8.0.0 / 11.03.2026

Release 6.16.1

Release 6.16.0

4.1.2 / 10.06.2026

4.1.0 / 07.06.2026

4.0.6 / 07.05.2026

4.0.5 / 01.05.2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard

Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`

Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)

AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice