Skip to content

📦 Bump the all-dependencies group across 1 directory with 14 updates - #16374

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/main/all-dependencies-83fb316a1e
Open

📦 Bump the all-dependencies group across 1 directory with 14 updates#16374
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/main/all-dependencies-83fb316a1e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 17, 2026 •
edited by microsoft-github-policy-service Bot
Loading

Copy link
Copy Markdown
Contributor

Bumps the all-dependencies group with 14 updates in the / directory:

Package From To
lage 2.15.12 2.16.1
ts-jest 29.4.11 29.4.12
@types/react 19.2.16 19.2.18
@rnx-kit/jest-preset 0.3.2 0.3.3
semver 7.8.2 7.8.5
@types/lodash 4.17.24 4.17.25
@xmldom/xmldom 0.8.13 0.8.14
@microsoft/1ds-core-js 4.4.1 4.4.3
@microsoft/1ds-post-js 4.4.1 4.4.3
@microsoft/api-extractor 7.58.7 7.58.12
eslint-plugin-jest 29.15.2 29.16.1
memfs 4.57.6 4.68.1
shell-quote 1.8.4 1.10.0
screenshot-desktop 1.15.4 1.15.6

Updates lage from 2.15.12 to 2.16.1

Commits

Updates ts-jest from 29.4.11 to 29.4.12

Release notes

Sourced from ts-jest's releases.

v29.4.12

Please refer to CHANGELOG.md for details.

Changelog

Sourced from ts-jest's changelog.

29.4.12 (2026-07-22)

Features

  • compiler: support TypeScript 7 projects through compatibility aliases (#5386)
Commits
  • 3f05625 chore(release): 29.4.12
  • df28b27 docs: clarify TypeScript version prerequisites
  • c8a614a docs: mention TypeScript 7 setup in README
  • 06c79d4 fix: address TypeScript 7 review feedback
  • f107460 docs: explain TypeScript 7 compatibility setup
  • 3388227 test(e2e): add TypeScript compatibility matrix
  • 891dc73 fix(compiler): support TypeScript 7 compatibility aliases
  • eb135eb build(deps-dev): bump shell-quote from 1.8.4 to 1.10.0 in /examples
  • d5d80a3 ci: pin google osv scan action at v2.3.5
  • 6bf293f build(deps): bump shell-quote from 1.8.4 to 1.10.0 in /website
  • Additional commits viewable in compare view

Updates @types/react from 19.2.16 to 19.2.18

Commits

Updates @rnx-kit/jest-preset from 0.3.2 to 0.3.3

Release notes

Sourced from @​rnx-kit/jest-preset's releases.

@​rnx-kit/jest-preset@​0.3.3

Patch Changes

  • 57d86ad: Replaced find-up with the implementation in a transitive dependency
Changelog

Sourced from @​rnx-kit/jest-preset's changelog.

0.3.3

Patch Changes

  • 57d86ad: Replaced find-up with the implementation in a transitive dependency
Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​rnx-kit/jest-preset since your current version.


Updates semver from 7.8.2 to 7.8.5

Release notes

Sourced from semver's releases.

v7.8.5

7.8.5 (2026-06-19)

Bug Fixes

v7.8.4

7.8.4 (2026-06-09)

Bug Fixes

v7.8.3

7.8.3 (2026-06-08)

Bug Fixes

Chores

Changelog

Sourced from semver's changelog.

7.8.5 (2026-06-19)

Bug Fixes

7.8.4 (2026-06-09)

Bug Fixes

7.8.3 (2026-06-08)

Bug Fixes

Chores

Commits
  • 6e05b76 chore: release 7.8.5 (#879)
  • 9c8692a fix: include prereleases in tilde range lower bound with includePrerelease (#...
  • 8640bd6 chore: release 7.8.4 (#875)
  • e583226 fix: reject numeric segments after x-ranges
  • 6b77aa8 chore: release 7.8.3 (#873)
  • 3485dda chore: bump @​npmcli/eslint-config from 6.0.1 to 7.0.0 (#866)
  • 046da7f fix: align caret includePrerelease lower bounds (#872)
  • See full diff in compare view

Updates @types/lodash from 4.17.24 to 4.17.25

Commits

Updates @xmldom/xmldom from 0.8.13 to 0.8.14

Release notes

Sourced from @​xmldom/xmldom's releases.

0.8.14

Commits

Fixed

  • Security: XMLSerializer.serializeToString() now also rejects invalid element and attribute names when { requireWellFormed: true } is passed, throwing InvalidStateError for a name that is not a valid XML QName (this covers the namespace prefix, which surfaces in the element qualified name or in a synthesized xmlns: declaration). This prevents XML injection via createElement() / setAttribute(), extending the existing requireWellFormed checks to the serialized name set. GHSA-w2rr-34g9-rvrj GHSA-4w3w-2rp5-g8jm

Thank you, @​bhaswanthc, @​jmestwa-coder, for your contributions

Changelog

Sourced from @​xmldom/xmldom's changelog.

0.8.14

Fixed

  • Security: XMLSerializer.serializeToString() now also rejects invalid element and attribute names when { requireWellFormed: true } is passed, throwing InvalidStateError for a name that is not a valid XML QName (this covers the namespace prefix, which surfaces in the element qualified name or in a synthesized xmlns: declaration). This prevents XML injection via createElement() / setAttribute(), extending the existing requireWellFormed checks to the serialized name set. GHSA-w2rr-34g9-rvrj GHSA-4w3w-2rp5-g8jm

Thank you, @​bhaswanthc, @​jmestwa-coder, for your contributions

0.9.10

Fixed

  • Security: XMLSerializer.serializeToString() (and Node.toString(), NodeList.toString()) now accept a requireWellFormed option. When { requireWellFormed: true } is passed, the serializer throws InvalidStateError for injection-prone node content, preventing XML injection via attacker-controlled node data. GHSA-j759-j44w-7fr8 GHSA-x6wf-f3px-wcqx GHSA-f6ww-3ggp-fr8h
    • Comment: throws when data contains -- anywhere, ends with -, or contains characters outside the XML Char production
    • ProcessingInstruction: throws when target contains : or matches xml (case-insensitive), or data contains characters outside the XML Char production or contains ?>
    • DocumentType: throws when publicId fails PubidLiteral, systemId fails SystemLiteral, or internalSubset contains ]>
  • Security: DOM traversal operations (XMLSerializer.serializeToString(), Node.prototype.normalize(), Node.prototype.cloneNode(true), Document.prototype.importNode(node, true), node.textContent getter, getElementsByTagName() / getElementsByTagNameNS() / getElementsByClassName() / getElementById(), Node.prototype.isEqualNode()) are now iterative. Previously, deeply nested DOM trees would exhaust the JavaScript call stack and throw an unrecoverable RangeError. GHSA-2v35-w6hq-6mfw
  • isEqualNode now correctly returns false for CDATASection nodes with different data

Deprecated

  • The splitCDATASections serializer option is deprecated and will be removed in the next breaking release. The automatic splitting of "]]>" in CDATASection data was introduced as a workaround; use requireWellFormed: true or ensure CDATASection data does not contain "]]>" before serialization.

Chore

  • updated dependencies

Thank you, @​Jvr2022, @​praveen-kv, @​TharVid, @​decsecre583, @​tlsbollei, @​KarimTantawey, for your contributions

Commits
  • 8a83f8e 0.8.14
  • c12aaf6 docs: add 0.8.14 changelog entry
  • d8212e6 fix: reject invalid element and attribute names when requireWellFormed
  • 88d9b20 refactor: move XML name pattern from sax.js to conventions.js
  • See full diff in compare view
Maintainer changes

This version was pushed to npm by karfau, a new releaser for @​xmldom/xmldom since your current version.


Updates @microsoft/1ds-core-js from 4.4.1 to 4.4.3

Changelog

Sourced from @​microsoft/1ds-core-js's changelog.

Releases

Note: ES3/IE8 compatibility will be removed in the future v3.x.x releases (scheduled for mid-late 2022), so if you need to retain ES3 compatibility you will need to remain on the 2.x.x versions of the SDK or your runtime will need install polyfill's to your ES3 environment before loading / initializing the SDK.

3.4.3 (July 2nd, 2026)

This is a maintenance release for the 3.4.x version line adding a new SDK statistics feature, a PostChannel reliability fix, and dependency security hardening. The @microsoft/1ds-post-js channel is numbered 4.4.3 and requires v3.4.3.

Significant Changes (since 3.4.2)

  • Customer SDK Stats: Added a new SdkStats feature that periodically collects internal SDK usage/health statistics. It is enabled by default and can be disabled (or explicitly configured) via the featureOptIn configuration (e.g. featureOptIn: { SdkStats: { mode: FeatureOptInMode.disable } }); the collection interval defaults to 15 minutes (sdkStats.int).

  • PostChannel Auto-Flush Stall Fix: Fixed a permanent stall in @microsoft/1ds-post-js where, under sustained intermittent send failures (e.g. a load balancer returning occasional 503s), auto flush could wedge behind the flush() wait-for-idle timer and permanently stop draining the in-memory queue — causing telemetry to be silently dropped as QueueFull until the process was restarted. Auto flush is now fire-and-forget and no longer parks the scheduler waiting for the manager to become completely idle.

  • Dependency Security Hardening: Pinned tar to >=7.5.16 to remediate CVE-2026-53655 and resolved the remaining npm audit findings in build tooling via dependency overrides (js-yaml, yaml, markdown-it, linkify-it). These are build/tooling changes and do not affect the published runtime packages.

Changelog

  • #2746 Fix PostChannel auto-flush permanent stall under sustained intermittent send failures
  • #2745 fix(security): pin tar >=7.5.16 to remediate CVE-2026-53655
  • #2707 Enable Customer SDK Stats
  • Resolve remaining npm audit findings via dependency overrides (js-yaml, yaml, markdown-it, linkify-it)

Full Changelog: microsoft/ApplicationInsights-JS@3.4.2...3.4.3

3.4.2 (June 18th, 2026)

This is a maintenance release for the 3.4.x version line containing security hardening, bug fixes, build tooling improvements, and CI updates. The @microsoft/1ds-post-js channel is numbered 4.4.2 and requires v3.4.2.

Significant Changes (since 3.4.1)

  • Prototype Pollution Hardening: The extend() and objExtend() helpers now filter unsafe keys (__proto__, constructor, prototype) to prevent prototype pollution when merging untrusted objects.

  • Dependency Vulnerability Resolution: Migrated the repository from npm to pnpm for dependency management and resolved all known dependency vulnerabilities. This is a build/tooling change and does not affect the published runtime packages.

  • OsPlugin Field Name Correction: The OsPlugin now emits the correct Common Schema 4.0 field names (ext.os.name and ext.os.ver). Telemetry consumers relying on the previously emitted (incorrect) field names should update to the corrected names.

  • RequestEnvelopeCreator Envelope Name Fix: Fixed RequestEnvelopeCreator so request telemetry is sent with the correct envelope name (Microsoft.ApplicationInsights.{ikey}.Request) instead of RequestData.

  • Offline Channel Reliability: Fixed a missing return after reject() in the offline channel that could lead to a null provider dereference.

  • Fixed [INVALID_ANNOTATION] warnings in Rolldown / Vite 8 consumers (#2736): The per-module dist-es5 output (the package module entry that modern bundlers import) emitted parenthesized PURE tree-shaking annotations with whitespace after the opening parenthesis (e.g. ( /*#__PURE__*/"http.")), which stricter bundlers such as Rolldown (Vite 8) rejected. The build now canonicalizes these annotations to the flush form ((/*#__PURE__*/"http.")) in the dist-es5 output, accepted by all bundlers while preserving the wrapping parentheses required for older Rollup / Webpack / Terser to tree-shake the constants. This complements #2737, which only normalized the rollup-bundled dist/es5 (main) output.

CI / Tooling

  • Dropped Node.js 16 from CI matrix: Node.js 16 is End-of-Life and several dependencies (e.g. puppeteer, @pnpm/error) now require Node.js 18 or later. The CI pipeline no longer runs against Node.js 16.
  • Added Node.js 22 and 24 to CI matrix: The CI pipeline now tests against Node.js 18, 20, 22, and 24.
  • Migrated from npm to pnpm: Dependency management now uses pnpm.

... (truncated)

Commits

Updates @microsoft/1ds-post-js from 4.4.1 to 4.4.3

Changelog

Sourced from @​microsoft/1ds-post-js's changelog.

Releases

Note: ES3/IE8 compatibility will be removed in the future v3.x.x releases (scheduled for mid-late 2022), so if you need to retain ES3 compatibility you will need to remain on the 2.x.x versions of the SDK or your runtime will need install polyfill's to your ES3 environment before loading / initializing the SDK.

3.4.3 (July 2nd, 2026)

This is a maintenance release for the 3.4.x version line adding a new SDK statistics feature, a PostChannel reliability fix, and dependency security hardening. The @microsoft/1ds-post-js channel is numbered 4.4.3 and requires v3.4.3.

Significant Changes (since 3.4.2)

  • Customer SDK Stats: Added a new SdkStats feature that periodically collects internal SDK usage/health statistics. It is enabled by default and can be disabled (or explicitly configured) via the featureOptIn configuration (e.g. featureOptIn: { SdkStats: { mode: FeatureOptInMode.disable } }); the collection interval defaults to 15 minutes (sdkStats.int).

  • PostChannel Auto-Flush Stall Fix: Fixed a permanent stall in @microsoft/1ds-post-js where, under sustained intermittent send failures (e.g. a load balancer returning occasional 503s), auto flush could wedge behind the flush() wait-for-idle timer and permanently stop draining the in-memory queue — causing telemetry to be silently dropped as QueueFull until the process was restarted. Auto flush is now fire-and-forget and no longer parks the scheduler waiting for the manager to become completely idle.

  • Dependency Security Hardening: Pinned tar to >=7.5.16 to remediate CVE-2026-53655 and resolved the remaining npm audit findings in build tooling via dependency overrides (js-yaml, yaml, markdown-it, linkify-it). These are build/tooling changes and do not affect the published runtime packages.

Changelog

  • #2746 Fix PostChannel auto-flush permanent stall under sustained intermittent send failures
  • #2745 fix(security): pin tar >=7.5.16 to remediate CVE-2026-53655
  • #2707 Enable Customer SDK Stats
  • Resolve remaining npm audit findings via dependency overrides (js-yaml, yaml, markdown-it, linkify-it)

Full Changelog: microsoft/ApplicationInsights-JS@3.4.2...3.4.3

3.4.2 (June 18th, 2026)

This is a maintenance release for the 3.4.x version line containing security hardening, bug fixes, build tooling improvements, and CI updates. The @microsoft/1ds-post-js channel is numbered 4.4.2 and requires v3.4.2.

Significant Changes (since 3.4.1)

  • Prototype Pollution Hardening: The extend() and objExtend() helpers now filter unsafe keys (__proto__, constructor, prototype) to prevent prototype pollution when merging untrusted objects.

  • Dependency Vulnerability Resolution: Migrated the repository from npm to pnpm for dependency management and resolved all known dependency vulnerabilities. This is a build/tooling change and does not affect the published runtime packages.

  • OsPlugin Field Name Correction: The OsPlugin now emits the correct Common Schema 4.0 field names (ext.os.name and ext.os.ver). Telemetry consumers relying on the previously emitted (incorrect) field names should update to the corrected names.

  • RequestEnvelopeCreator Envelope Name Fix: Fixed RequestEnvelopeCreator so request telemetry is sent with the correct envelope name (Microsoft.ApplicationInsights.{ikey}.Request) instead of RequestData.

  • Offline Channel Reliability: Fixed a missing return after reject() in the offline channel that could lead to a null provider dereference.

  • Fixed [INVALID_ANNOTATION] warnings in Rolldown / Vite 8 consumers (#2736): The per-module dist-es5 output (the package module entry that modern bundlers import) emitted parenthesized PURE tree-shaking annotations with whitespace after the opening parenthesis (e.g. ( /*#__PURE__*/"http.")), which stricter bundlers such as Rolldown (Vite 8) rejected. The build now canonicalizes these annotations to the flush form ((/*#__PURE__*/"http.")) in the dist-es5 output, accepted by all bundlers while preserving the wrapping parentheses required for older Rollup / Webpack / Terser to tree-shake the constants. This complements #2737, which only normalized the rollup-bundled dist/es5 (main) output.

CI / Tooling

  • Dropped Node.js 16 from CI matrix: Node.js 16 is End-of-Life and several dependencies (e.g. puppeteer, @pnpm/error) now require Node.js 18 or later. The CI pipeline no longer runs against Node.js 16.
  • Added Node.js 22 and 24 to CI matrix: The CI pipeline now tests against Node.js 18, 20, 22, and 24.
  • Migrated from npm to pnpm: Dependency management now uses pnpm.

... (truncated)

Commits

Updates @microsoft/api-extractor from 7.58.7 to 7.58.12

Changelog

Sourced from @​microsoft/api-extractor's changelog.

7.58.12

Tue, 21 Jul 2026 02:53:22 GMT

Patches

  • Improve the performance of the internal excerpt token condensing algorithm from O(n^2) to O(n) by eliminating repeated array splicing and per-merge bookkeeping.

7.58.11

Fri, 17 Jul 2026 00:15:59 GMT

Version update only

7.58.10

Thu, 16 Jul 2026 00:16:13 GMT

Version update only

7.58.9

Sat, 13 Jun 2026 00:16:18 GMT

Version update only

7.58.8

Mon, 08 Jun 2026 15:15:49 GMT

Patches

  • Add support for new d.ts extension format when using TS moduleResolution 'bundler' or 'nodenext'.
Commits
  • f1c7396 Bump versions [skip ci]
  • 75089a6 Update changelogs [skip ci]
  • a0f04af [api-extractor] Fix O(n^2) condenseTokens cost (#5878)
  • 99e0e61 Forbid private static members and refactor existing usages to module scope ...
  • 5e32c62 chore: bump decoupled local dependencies (#5879)
  • 6bb6a2b Bump versions [skip ci]
  • b1b4b14 Update changelogs [skip ci]
  • ddfc8af chore: bump decoupled local dependencies (#5873)
  • 3cde295 Bump versions [skip ci]
  • 65b8144 Update changelogs [skip ci]
  • Additional commits viewable in compare view

Updates eslint-plugin-jest from 29.15.2 to 29.16.1

Release notes

Sourced from eslint-plugin-jest's releases.

v29.16.1

29.16.1 (2026-08-12)

Bug Fixes

  • prefer-comparison-matcher: don't crash on expect chain without a value (#2001) (a4d20e0)
  • prefer-expect-resolves: don't crash on expect chain without a value (#2002) (0cf65de)

v29.16.0

29.16.0 (2026-07-24)

Features

  • valid-expect-with-promise: add checkThenables option for custom promises (#1996) (692c748)

v29.15.5

29.15.5 (2026-07-20)

Bug Fixes

  • allow TypeScript v7 as a peer dependency (#1992) (155ba2e)

v29.15.4

29.15.4 (2026-06-30)

Bug Fixes

  • no-export: don't report on assignment to locals named module (#1976) (da02c0c)

v29.15.3

29.15.3 (2026-06-26)

Bug Fixes

  • no-export: treat describe blocks as test files (#1978) (70568b0)
Changelog

Sourced from eslint-plugin-jest's changelog.

29.16.1 (2026-08-12)

Bug Fixes

  • prefer-comparison-matcher: don't crash on expect chain without a value (#2001) (a4d20e0)
  • prefer-expect-resolves: don't crash on expect chain without a value (#2002) (0cf65de)

29.16.0 (2026-07-24)

Features

  • valid-expect-with-promise: add checkThenables option for custom promises (#1996) (692c748)

29.15.5 (2026-07-20)

Bug Fixes

  • allow TypeScript v7 as a peer dependency (#1992) (155ba2e)

29.15.4 (2026-06-30)

Bug Fixes

  • no-export: don't report on assignment to locals named module (#1976) (da02c0c)

29.15.3 (2026-06-26)

Bug Fixes

  • no-export: treat describe blocks as test files (#1978) (70568b0)
Commits
  • 6ee8626 chore(release): 29.16.1 [skip ci]
  • 0cf65de fix(prefer-expect-resolves): don't crash on expect chain without a value (#...
  • a4d20e0 fix(prefer-comparison-matcher): don't crash on expect chain without a value...
  • 5a6fb45 chore(deps): lock file maintenance (#1999)
  • 91a5417 chore(deps): update actions/checkout action to v7.0.1 (#1991)
  • 82a7ff7 chore(deps): update yarn to v4.18.0 (#1998)
  • 45e3b60 chore(deps): update semantic-release monorepo (#1995)
  • d009793 chore(deps): lock file maintenance (#1985)
  • fea9636 ci: pull Danger from pre-built docker images in GHCR (#1852)
  • 98206fb chore(release): 29.16.0 [skip ci]
  • Additional commits viewable in compare view

Updates memfs from 4.57.6 to 4.68.1

Release notes

Sourced from memfs's releases.

Release v4.68.1

What's Changed

Full Changelog: streamich/memfs@v4.68.0...v4.68.1

Release v4.68.0

What's Changed

Full Changelog: streamich/memfs@v4.67.0...v4.68.0

Release v4.67.0

What's Changed

New Contributors

Full Changelog: streamich/memfs@v4.66.1...v4.67.0

Release v4.66.1

What's Changed

Full Changelog: streamich/memfs@v4.66.0...v4.66.1

Release v4.66.0

What's Changed

Full Changelog: streamich/memfs@v4.65.0...v4.66.0

Release v4.65.0

What's Changed

New Contributors

Full Changelog: streamich/memfs@v4.64.0...v4.65.0

Release v4.64.0

What's Changed

... (truncated)

Commits
  • d1703ac chore: release v4.68.1
  • 8987c43 Merge pull request #1278 from streamich/fix-unlink-dir
  • 559dff9 test: 💍 fixup flaky test
  • 00b1487 fix: 🐛 .unlink() should not delete empty directories
  • caa708b chore: release v4.68.0
  • 083162d Merge pull request #1277 from streamich/fix-birthtime
  • f8176b1 feat: 🎸 return cloned Date objects
  • cc283f3 feat: 🎸 add file birthTime support
  • 9a78fd2 chore: release v4.67.0
  • fa47ecc chore: persist git-fsa directory handle
  • Additional commits viewable in compare view

Updates shell-quote from 1.8.4 to 1.10.0

Changelog

Sourced from shell-quote's changelog.

v1.10.0 - 2026-07-10

Merged

Commits

  • [Fix] parse: match nested ${...} braces so nested parameter expansion is consumed as one substitution c0842c8
  • [Tests] parse: pin single-quote literalness and unmatched-quote handling a0d03e3
  • [readme] remove the space in js code fences so evalmd evaluates them 2116fa3
  • [Tests] quote: pin conservative escaping of =, @, ^, ,, :, ! (#11) 1c36f3f
  • [readme] document that quote outputs POSIX quoting, not cmd.exe/PowerShell 100e96e
  • [readme] document parse's supported parameter-expansion subset e1c75cd
  • [Fix] parse: a backslash inside single quotes must not escape the closing quote 5d460a3
  • [readme] fix stale example outputs 2de86f5
  • [Tests] quote: pin that a backslash with whitespace is not doubled in single quotes (#14) 190e236
  • [readme] quote: use output verbatim; do not re-quote it (#11) 1b36468
  • [Refactor] parse: fix swapped SINGLE_QUOTE/DOUBLE_QUOTE variable names 801af5c
  • [types] fix an error TS v6 ignores but v7 fails on 59bbf8b
  • [Dev Deps] update @arethetypeswrong/cli, evalmd a04d475
  • [Dev Deps] update @arethetypeswrong/ci, eslint d390f9a
  • [Tests] quote: the tilde test escapes every ~, not just a leading one (#9) 617d119

v1.9.0 - 2026-06-24

Commits

  • [New] add types dca6e21
  • [Dev Deps] update eslint 9aa9e8f
  • [Fix] parse: finalize tokens in linear time (GHSA-395f-4hp3-45gv) 7ff5488
  • [actions] update workflows 75e8497
  • [actions] Windows + node 4/6/7: pin eslint to 9 before install, since npm 2/3 cannot stage eslint 10@types/esrecurse 3fb739d
  • [actions] retry npm install on Windows to survive npm 2/3 staging-rename flake abe0163
  • [actions] Windows + node 5/7: install deps with a modern node b4bafa2
  • [Fix] quote: escape leading ~ to prevent shell tilde-expansion 7a76c1a
  • [Dev Deps] update auto-changelog, tape 7184b44
  • [Dev Deps] apparently jackspeak is no longer in the graph 9ba368a
Commits
  • 64988d9 v1.10.0
  • 617d119 [Tests] quote: the tilde test escapes every ~, not just a leading one (#9)
  • 59bbf8b [types] fix an error TS v6 ignores but v7 fails on
  • 190e236 [Tests] quote: pin that a backslash with whitespace is not doubled in singl...
  • a04d475 [Dev Deps] update @arethetypeswrong/cli, evalmd
  • b9545b3 [New] parse: add opt-in splitUnquoted option for shell field-splitting of...
  • 1b36468 [readme] quote: use output verbatim; do not re-quote it (#11)
  • 1c36f3f [Tests] quote: pin conservative escaping of =, @, ^, ,, :, ! (#11)
  • e1c75cd [readme] document parse's supported parameter-expansion subset
  • c0842c8 [Fix] parse: match nested ${...} braces so nested parameter expansion is ...
  • Additional commits viewable in compare view

Updates screenshot-desktop from 1.15.4 to 1.15.6

Release notes

Sourced from screenshot-desktop's releases.

v1.15.6

Maintenance

  • Updated vulnerable transitive brace-expansion dependencies to patched versions.
  • Updated vulnerable transitive js-yaml dependencies to patched versions.
  • npm audit now reports zero vulnerabilities.

Full changelog: bencevans/screenshot-desktop@v1.15.5...v1.15.6

v1.15.5

Security

This release fixes a Windows command-injection vulnerability in options.screen. Applications that pass untrusted input to this option could allow command metacharacters to reach cmd.exe. Requested displays are now validated against the identifiers returned by Windows before capture.

Affected screen-injection versions are earlier than 1.15.2 and versions 1.15.3 through 1.15.4. Version 1.15.2 filtered this input but broke canonical Windows display identifiers; version 1.15.5 provides the complete fix. Users should upgrade to 1.15.5.

Thanks to @​arpitjain099 for responsibly reporting this vulnerability.

What's Changed

@dependabot
📦 Bump the all-dependencies group across 1 directory with 14 updates
428a954 
Bumps the all-dependencies group with 14 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [lage](https://github.com/microsoft/lage) | `2.15.12` | `2.16.1` |
| [ts-jest](https://github.com/kulshekhar/ts-jest) | `29.4.11` | `29.4.12` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.16` | `19.2.18` |
| [@rnx-kit/jest-preset](https://github.com/microsoft/rnx-kit/tree/HEAD/packages/jest-preset) | `0.3.2` | `0.3.3` |
| [semver](https://github.com/npm/node-semver) | `7.8.2` | `7.8.5` |
| [@types/lodash](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/lodash) | `4.17.24` | `4.17.25` |
| [@xmldom/xmldom](https://github.com/xmldom/xmldom) | `0.8.13` | `0.8.14` |
| [@microsoft/1ds-core-js](https://github.com/microsoft/ApplicationInsights-JS) | `4.4.1` | `4.4.3` |
| [@microsoft/1ds-post-js](https://github.com/microsoft/ApplicationInsights-JS) | `4.4.1` | `4.4.3` |
| [@microsoft/api-extractor](https://github.com/microsoft/rushstack/tree/HEAD/apps/api-extractor) | `7.58.7` | `7.58.12` |
| [eslint-plugin-jest](https://github.com/jest-community/eslint-plugin-jest) | `29.15.2` | `29.16.1` |
| [memfs](https://github.com/streamich/memfs) | `4.57.6` | `4.68.1` |
| [shell-quote](https://github.com/ljharb/shell-quote) | `1.8.4` | `1.10.0` |
| [screenshot-desktop](https://github.com/bencevans/screenshot-desktop) | `1.15.4` | `1.15.6` |



Updates `lage` from 2.15.12 to 2.16.1
- [Commits](microsoft/lage@lage_v2.15.12...lage_v2.16.1)

Updates `ts-jest` from 29.4.11 to 29.4.12
- [Release notes](https://github.com/kulshekhar/ts-jest/releases)
- [Changelog](https://github.com/kulshekhar/ts-jest/blob/main/CHANGELOG.md)
- [Commits](kulshekhar/ts-jest@v29.4.11...v29.4.12)

Updates `@types/react` from 19.2.16 to 19.2.18
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `@rnx-kit/jest-preset` from 0.3.2 to 0.3.3
- [Release notes](https://github.com/microsoft/rnx-kit/releases)
- [Changelog](https://github.com/microsoft/rnx-kit/blob/main/packages/jest-preset/CHANGELOG.md)
- [Commits](https://github.com/microsoft/rnx-kit/commits/@rnx-kit/jest-preset@0.3.3/packages/jest-preset)

Updates `semver` from 7.8.2 to 7.8.5
- [Release notes](https://github.com/npm/node-semver/releases)
- [Changelog](https://github.com/npm/node-semver/blob/main/CHANGELOG.md)
- [Commits](npm/node-semver@v7.8.2...v7.8.5)

Updates `@types/lodash` from 4.17.24 to 4.17.25
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/lodash)

Updates `@xmldom/xmldom` from 0.8.13 to 0.8.14
- [Release notes](https://github.com/xmldom/xmldom/releases)
- [Changelog](https://github.com/xmldom/xmldom/blob/master/CHANGELOG.md)
- [Commits](xmldom/xmldom@0.8.13...0.8.14)

Updates `@microsoft/1ds-core-js` from 4.4.1 to 4.4.3
- [Release notes](https://github.com/microsoft/ApplicationInsights-JS/releases)
- [Changelog](https://github.com/microsoft/ApplicationInsights-JS/blob/main/RELEASES.md)
- [Commits](https://github.com/microsoft/ApplicationInsights-JS/commits)

Updates `@microsoft/1ds-post-js` from 4.4.1 to 4.4.3
- [Release notes](https://github.com/microsoft/ApplicationInsights-JS/releases)
- [Changelog](https://github.com/microsoft/ApplicationInsights-JS/blob/main/RELEASES.md)
- [Commits](https://github.com/microsoft/ApplicationInsights-JS/commits)

Updates `@microsoft/api-extractor` from 7.58.7 to 7.58.12
- [Changelog](https://github.com/microsoft/rushstack/blob/main/apps/api-extractor/CHANGELOG.md)
- [Commits](https://github.com/microsoft/rushstack/commits/@microsoft/api-extractor_v7.58.12/apps/api-extractor)

Updates `eslint-plugin-jest` from 29.15.2 to 29.16.1
- [Release notes](https://github.com/jest-community/eslint-plugin-jest/releases)
- [Changelog](https://github.com/jest-community/eslint-plugin-jest/blob/main/CHANGELOG.md)
- [Commits](jest-community/eslint-plugin-jest@v29.15.2...v29.16.1)

Updates `memfs` from 4.57.6 to 4.68.1
- [Release notes](https://github.com/streamich/memfs/releases)
- [Changelog](https://github.com/streamich/memfs/blob/master/CHANGELOG.md)
- [Commits](streamich/memfs@v4.57.6...v4.68.1)

Updates `shell-quote` from 1.8.4 to 1.10.0
- [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md)
- [Commits](ljharb/shell-quote@v1.8.4...v1.10.0)

Updates `screenshot-desktop` from 1.15.4 to 1.15.6
- [Release notes](https://github.com/bencevans/screenshot-desktop/releases)
- [Commits](bencevans/screenshot-desktop@v1.15.4...v1.15.6)

---
updated-dependencies:
- dependency-name: lage
  dependency-version: 2.16.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: ts-jest
  dependency-version: 29.4.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: "@types/react"
  dependency-version: 19.2.18
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: "@rnx-kit/jest-preset"
  dependency-version: 0.3.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: semver
  dependency-version: 7.8.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: "@types/lodash"
  dependency-version: 4.17.25
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: "@xmldom/xmldom"
  dependency-version: 0.8.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: "@microsoft/1ds-core-js"
  dependency-version: 4.4.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: "@microsoft/1ds-post-js"
  dependency-version: 4.4.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: "@microsoft/api-extractor"
  dependency-version: 7.58.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: eslint-plugin-jest
  dependency-version: 29.16.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: memfs
  dependency-version: 4.68.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: shell-quote
  dependency-version: 1.10.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: screenshot-desktop
  dependency-version: 1.15.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 17, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner August 17, 2026 12:27
Copilot AI balanced review requested due to automatic review settings August 17, 2026 12:27
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 17, 2026
Copilot AI reviewed Aug 17, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot wasn't able to review any files in this pull request.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@azure-pipelines

azure-pipelines Bot commented Aug 17, 2026

Copy link
Copy Markdown
Contributor
Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

@vineethkuttan

Vineeth (vineethkuttan) commented Aug 18, 2026

Copy link
Copy Markdown
Contributor

/azp run

@azure-pipelines

azure-pipelines Bot commented Aug 18, 2026

Copy link
Copy Markdown
Contributor
Azure Pipelines:
Successfully started running 1 pipeline(s).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@vineethkuttan