Dependency Dashboard

[renovate]

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.
View this repository on the Mend.io Web Portal.

Rate-Limited

The following updates are currently rate-limited. To force their creation now, click on a checkbox below.

• chore(deps): update dependency rollup to v4.59.0
• fix(deps): update dependency @astrojs/starlight to ^0.38.0
• chore(deps): update dependency nyc to v18
• chore(deps): update dependency rollup-plugin-visualizer to v7
• chore(deps): update dependency webpack-cli to v7
• fix(deps): update dependency astro to v6
• 🔐 Create all rate-limited PRs at once 🔐

PR Edited (Blocked)

The following updates have been manually edited so Renovate will no longer make changes. To discard all commits and start over, click on a checkbox below.

• chore(deps): update dependency sinon to v21

Pending Status Checks

The following updates await pending status checks. To force their creation now, click on a checkbox below.

• chore(deps): update dependency knip to v6

Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

• chore(deps): update dependency knip to v5.86.0
• chore(deps): update dependency globals to v17
• chore(deps): update dependency node to v24 (node, @types/node)
• chore(deps): update dependency unexpected to v13
• chore(deps): update dependency unexpected-sinon to v11
• fix(deps): update dependency escape-string-regexp to v5
• fix(deps): update dependency find-up to v8
• fix(deps): update dependency is-path-inside to v4
• fix(deps): update dependency yargs to v18
• Click on this checkbox to rebase all open PRs at once

PR Closed (Blocked)

The following updates are blocked by an existing closed PR. To recreate the PR, click on a checkbox below.

• fix(deps): update dependency is-unicode-supported to v2
• fix(deps): update dependency supports-color to v10
• fix(deps): update dependency yargs-parser to v22

Detected Dependencies

github-actions (4)

.github/workflows/nightly-site-deploy.yml (1)

• joelwmale/webhook-action 6cebc9d7dc8435b684e1e1945c0013d9023b76a4

.github/workflows/npm-script.yml (3)

• actions/checkout v6
• actions/setup-node v6
• codecov/codecov-action v5

.github/workflows/octoguide.yml (1)

• OctoGuide/bot 0.21.10

.github/workflows/release-please.yml (4)

• googleapis/release-please-action v4
• actions/checkout v6
• actions/setup-node v6
• node 22 → [Updates: 24]

npm (2)

docs/package.json (7)

• @astrojs/check ^0.9.6 → [Updates: ^0.9.6]
• @astrojs/starlight ^0.37.1 → [Updates: ^0.38.0]
• astro ^5.16.6 → [Updates: ^6.0.0]
• starlight-package-managers ^0.12.0
• typescript ^5.9.3
• debug ^4.4.3
• knip ^5.83.1 → [Updates: ^5.83.1, ^6.0.0]

package.json (69)

• browser-stdout ^1.3.1
• chokidar ^5.0.0
• debug ^4.3.5
• diff ^8.0.3
• escape-string-regexp ^4.0.0 → [Updates: ^5.0.0]
• find-up ^5.0.0 → [Updates: ^8.0.0]
• glob ^13.0.0 → [Updates: ^13.0.0]
• he ^1.2.0
• is-path-inside ^3.0.3 → [Updates: ^4.0.0]
• is-unicode-supported ^0.1.0 → [Updates: ^2.0.0]
• js-yaml ^4.1.0
• minimatch ^10.2.2 → [Updates: ^10.2.2]
• ms ^2.1.3
• picocolors ^1.1.1
• serialize-javascript ^7.0.2 → [Updates: ^7.0.2]
• strip-json-comments ^5.0.3
• supports-color ^8.1.1 → [Updates: ^10.0.0]
• workerpool ^10.0.0
• yargs ^17.7.2 → [Updates: ^18.0.0]
• yargs-parser ^21.1.1 → [Updates: ^22.0.0]
• yargs-unparser ^2.0.0
• @eslint/js ^10.0.0
• @eslint/markdown ^7.5.1
• @rollup/plugin-alias ^6.0.0
• @rollup/plugin-commonjs ^29.0.0 → [Updates: ^29.0.0]
• @rollup/plugin-json ^6.1.0
• @rollup/plugin-multi-entry ^7.1.0
• @rollup/plugin-node-resolve ^16.0.3
• @types/node ^22.15.3 → [Updates: ^22.15.3, ^24.0.0]
• @types/yargs ^17.0.33 → [Updates: ^17.0.33]
• chai ^6.0.0
• coffeescript ^2.6.1
• cross-env ^10.0.0
• eslint ^10.0.0 → [Updates: ^10.0.0]
• eslint-plugin-n ^17.23.1
• fail-on-errors-webpack-plugin ^3.0.0
• globals ^16.5.0 → [Updates: ^17.0.0]
• installed-check ^10.0.0
• karma ^6.4.2 → [Updates: ^6.4.2]
• karma-chrome-launcher ^3.2.0
• karma-mocha ^2.0.1
• karma-mocha-reporter ^2.2.5
• knip ^5.61.3 → [Updates: ^5.61.3, ^6.0.0]
• npm-run-all2 ^8.0.0
• nyc ^17.1.0 → [Updates: ^18.0.0]
• prettier 3.8.1
• ps-list ^9.0.0
• remark ^15.0.0
• remark-github ^12.0.0
• remark-inline-links ^7.0.0
• rewiremock ^3.14.3
• rimraf ^6.0.0
• rollup ^4.52.3 → [Updates: ^4.52.3]
• rollup-plugin-polyfill-node ^0.13.0
• rollup-plugin-visualizer ^6.0.5 → [Updates: ^6.0.5, ^7.0.0]
• semver ^7.7.2 → [Updates: ^7.7.2]
• sinon ^9.0.3 → [Updates: ^21.0.0]
• typescript ^5.8.3
• unexpected ^11.14.0 → [Updates: ^13.0.0]
• unexpected-eventemitter ^2.2.0
• unexpected-map ^3.0.0
• unexpected-set ^3.0.0
• unexpected-sinon ^10.11.2 → [Updates: ^11.0.0]
• webpack ^5.67.0 → [Updates: ^5.67.0]
• webpack-cli ^6.0.0 → [Updates: ^7.0.0]
• node ^20.19.0 || >=22.12.0
• @types/eslint ^9.6.1
• @types/estree ^1.0.7
• webdriverio ^9.0.0

---

• Check this box to trigger a request for Renovate to run again on this repository

[mark-wiemer]

See also #5695 for a recent manual attempt that covers a lot of this

[mark-wiemer]

GHSA-2g4f-4pwh-qvx6 (ajv has ReDoS when using $data option) does not affect Mocha unless Mocha is being used to run untrusted code, which is not what Mocha is designed for. I'm unaware of anyone using Mocha for this. Not a priority to fix, we will update the affected dependency just like any other. If certain users need a more urgent fix, I suggest cloning the repo, bumping the dep, and building yourself. If there is a reasonable scenario impacted by this, please describe it and follow our security policy.

[mark-wiemer]

GHSA-3ppc-4f35-3m26 (minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern) does not affect Mocha unless Mocha is being used to run untrusted code, which is not what Mocha is designed for. I'm unaware of anyone using Mocha for this. Not a priority to fix, we will update the affected dependency just like any other. If certain users need a more urgent fix, I suggest cloning the repo, bumping the dep, and building yourself. If there is a reasonable scenario impacted by this, please describe it and follow our security policy.

[mark-wiemer]

GHSA-73rr-hh4g-fpgx (jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch) does not affect Mocha unless Mocha is being used to run untrusted code, which is not what Mocha is designed for. I'm unaware of anyone using Mocha for this. Not a priority to fix, we will update the affected dependency just like any other. If certain users need a more urgent fix, I suggest cloning the repo, bumping the dep, and building yourself. If there is a reasonable scenario impacted by this, please describe it and follow our security policy.

[ExplodingCabbage]

GHSA-73rr-hh4g-fpgx (jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch) does not affect Mocha unless Mocha is being used to run untrusted code

Based on a quick search of your repo, I don't think it affects Mocha at all; as far as I can see, you never call parsePatch nor applyPatch (the two affected methods).

Regards, the current jsdiff maintainer. :)