An open index of dependabot pull requests across open source projects.

Bump the npm group across 3 directories with 4 updates

Closed
Number: #3598
Type: Pull Request
State: Closed
Author: dependabot[bot] dependabot[bot]
Association: Contributor
Comments: 5
Created: August 01, 2025 at 12:36 AM UTC
(about 1 month ago)
Updated: August 01, 2025 at 04:53 AM UTC
(about 1 month ago)
Closed: August 01, 2025 at 04:53 AM UTC
(about 1 month ago)
Time to Close: about 4 hours
Labels:
dependencies javascript
Assignees:
poad
Description:

Bumps the npm group with 3 updates in the /example/app directory: web-vitals, pnpm and typescript.
Bumps the npm group with 2 updates in the /example/cdk directory: pnpm and typescript.
Bumps the npm group with 2 updates in the /package directory: pnpm and typescript.

Updates web-vitals from 5.0.3 to 5.1.0

Changelog

Sourced from web-vitals's changelog.

v5.1.0 (2025-07-31)

  • Register visibility-change early (#637)
  • Only finalize LCP on user events (isTrusted=true) (#635)
  • Fallback to default getSelector if custom function is null or undefined (#634)
Commits

Updates pnpm from 10.13.1 to 10.14.0

Release notes

Sourced from pnpm's releases.

pnpm 10.14

Minor Changes

  • Added support for JavaScript runtime installation

    Declare Node.js, Deno, or Bun in devEngines.runtime (inside package.json) and let pnpm download and pin it automatically.

    Usage example:

    {
      "devEngines": {
        "runtime": {
          "name": "node",
          "version": "^24.4.0",
          "onFail": "download" // we only support the "download" value for now
        }
      }
    }
    

    How it works:

    1. pnpm install resolves your specified range to the latest matching runtime version.
    2. The exact version (and checksum) is saved in the lockfile.
    3. Scripts use the local runtime, ensuring consistency across environments.

    Why this is better:

    1. This new setting supports also Deno and Bun (vs. our Node-only settings useNodeVersion and executionEnv.nodeVersion)
    2. Supports version ranges (not just a fixed version).
    3. The resolved version is stored in the pnpm lockfile, along with an integrity checksum for future validation of the Node.js content's validity.
    4. It can be used on any workspace project (like executionEnv.nodeVersion). So, different projects in a workspace can use different runtimes.
    5. For now devEngines.runtime setting will install the runtime locally, which we will improve in future versions of pnpm by using a shared location on the computer.

    Related PR: #9755.

  • Add --cpu, --libc, and --os to pnpm install, pnpm add, and pnpm dlx to customize supportedArchitectures via the CLI #7510.

Patch Changes

  • Fix a bug in which pnpm add downloads packages whose libc differ from pnpm.supportedArchitectures.libc.
  • The integrities of the downloaded Node.js artifacts are verified #9750.
  • Allow dlx to parse CLI flags and options between the dlx command and the command to run or between the dlx command and -- #9719.
  • pnpm install --prod should removing hoisted dev dependencies #9782.
  • Fix an edge case bug causing local tarballs to not re-link into the virtual store. This bug would happen when changing the contents of the tarball without renaming the file and running a filtered install.
  • Fix a bug causing pnpm install to incorrectly assume the lockfile is up to date after changing a local tarball that has peers dependencies.

Platinum Sponsors

... (truncated)

Changelog

Sourced from pnpm's changelog.

10.14.0

Minor Changes

  • Added support for JavaScript runtime resolution

    Declare Node.js, Deno, or Bun in devEngines.runtime (inside package.json) and let pnpm download and pin it automatically.

    Usage example:

    {
      "devEngines": {
        "runtime": {
          "name": "node",
          "version": "^24.4.0",
          "onFail": "download" (we only support the "download" value for now)
        }
      }
    }
    

    How it works:

    1. pnpm install resolves your specified range to the latest matching runtime version.
    2. The exact version (and checksum) is saved in the lockfile.
    3. Scripts use the local runtime, ensuring consistency across environments.

    Why this is better:

    1. This new setting supports also Deno and Bun (vs. our Node-only settings useNodeVersion and executionEnv.nodeVersion)
    2. Supports version ranges (not just a fixed version).
    3. The resolved version is stored in the pnpm lockfile, along with an integrity checksum for future validation of the Node.js content's validity.
    4. It can be used on any workspace project (like executionEnv.nodeVersion). So, different projects in a workspace can use different runtimes.
    5. For now devEngines.runtime setting will install the runtime locally, which we will improve in future versions of pnpm by using a shared location on the computer.

    Related PR: #9755.

  • Add --cpu, --libc, and --os to pnpm install, pnpm add, and pnpm dlx to customize supportedArchitectures via the CLI #7510.

Patch Changes

  • Fix a bug in which pnpm add downloads packages whose libc differ from pnpm.supportedArchitectures.libc.
  • The integrities of the downloaded Node.js artifacts are verified #9750.
  • Allow dlx to parse CLI flags and options between the dlx command and the command to run or between the dlx command and -- #9719.
  • pnpm install --prod should removing hoisted dev dependencies #9782.
  • Fix an edge case bug causing local tarballs to not re-link into the virtual store. This bug would happen when changing the contents of the tarball without renaming the file and running a filtered install.
  • Fix a bug causing pnpm install to incorrectly assume the lockfile is up to date after changing a local tarball that has peers dependencies.
Commits

Updates typescript from 5.8.3 to 5.9.2

Release notes

Sourced from typescript's releases.

TypeScript 5.9

Release notes pending.

Downloads are available on:

TypeScript 5.9 RC

For release notes, check out the release announcement

Downloads are available on:

TypeScript 5.9 Beta

For release notes, check out the release announcement.

Downloads are available on:

Commits
  • be86783 Give more specific errors for verbatimModuleSyntax (#62113)
  • 22ef577 LEGO: Pull request from lego/hb_5378966c-b857-470a-8675-daebef4a6da1_20250714...
  • d5a414c Don't use noErrorTruncation when printing types with maximumLength set (#...
  • f14b5c8 Remove unused and confusing dom.iterable.d.ts file (#62037)
  • 2778e84 Restore AbortSignal.abort (#62086)
  • 65cb4bd LEGO: Pull request from lego/hb_5378966c-b857-470a-8675-daebef4a6da1_20250710...
  • 9e20e03 Clear out checker-level stacks on pop (#62016)
  • 87740bc Fix for Issue 61081 (#61221)
  • 833a8d4 Fix Symbol completion priority and cursor positioning (#61945)
  • 0018c9f LEGO: Pull request from lego/hb_5378966c-b857-470a-8675-daebef4a6da1_20250702...
  • Additional commits viewable in compare view

Updates electron-to-chromium from 1.5.192 to 1.5.194

Commits

Updates pnpm from 10.13.1 to 10.14.0

Release notes

Sourced from pnpm's releases.

pnpm 10.14

Minor Changes

  • Added support for JavaScript runtime installation

    Declare Node.js, Deno, or Bun in devEngines.runtime (inside package.json) and let pnpm download and pin it automatically.

    Usage example:

    {
      "devEngines": {
        "runtime": {
          "name": "node",
          "version": "^24.4.0",
          "onFail": "download" // we only support the "download" value for now
        }
      }
    }
    

    How it works:

    1. pnpm install resolves your specified range to the latest matching runtime version.
    2. The exact version (and checksum) is saved in the lockfile.
    3. Scripts use the local runtime, ensuring consistency across environments.

    Why this is better:

    1. This new setting supports also Deno and Bun (vs. our Node-only settings useNodeVersion and executionEnv.nodeVersion)
    2. Supports version ranges (not just a fixed version).
    3. The resolved version is stored in the pnpm lockfile, along with an integrity checksum for future validation of the Node.js content's validity.
    4. It can be used on any workspace project (like executionEnv.nodeVersion). So, different projects in a workspace can use different runtimes.
    5. For now devEngines.runtime setting will install the runtime locally, which we will improve in future versions of pnpm by using a shared location on the computer.

    Related PR: #9755.

  • Add --cpu, --libc, and --os to pnpm install, pnpm add, and pnpm dlx to customize supportedArchitectures via the CLI #7510.

Patch Changes

  • Fix a bug in which pnpm add downloads packages whose libc differ from pnpm.supportedArchitectures.libc.
  • The integrities of the downloaded Node.js artifacts are verified #9750.
  • Allow dlx to parse CLI flags and options between the dlx command and the command to run or between the dlx command and -- #9719.
  • pnpm install --prod should removing hoisted dev dependencies #9782.
  • Fix an edge case bug causing local tarballs to not re-link into the virtual store. This bug would happen when changing the contents of the tarball without renaming the file and running a filtered install.
  • Fix a bug causing pnpm install to incorrectly assume the lockfile is up to date after changing a local tarball that has peers dependencies.

Platinum Sponsors

... (truncated)

Changelog

Sourced from pnpm's changelog.

10.14.0

Minor Changes

  • Added support for JavaScript runtime resolution

    Declare Node.js, Deno, or Bun in devEngines.runtime (inside package.json) and let pnpm download and pin it automatically.

    Usage example:

    {
      "devEngines": {
        "runtime": {
          "name": "node",
          "version": "^24.4.0",
          "onFail": "download" (we only support the "download" value for now)
        }
      }
    }
    

    How it works:

    1. pnpm install resolves your specified range to the latest matching runtime version.
    2. The exact version (and checksum) is saved in the lockfile.
    3. Scripts use the local runtime, ensuring consistency across environments.

    Why this is better:

    1. This new setting supports also Deno and Bun (vs. our Node-only settings useNodeVersion and executionEnv.nodeVersion)
    2. Supports version ranges (not just a fixed version).
    3. The resolved version is stored in the pnpm lockfile, along with an integrity checksum for future validation of the Node.js content's validity.
    4. It can be used on any workspace project (like executionEnv.nodeVersion). So, different projects in a workspace can use different runtimes.
    5. For now devEngines.runtime setting will install the runtime locally, which we will improve in future versions of pnpm by using a shared location on the computer.

    Related PR: #9755.

  • Add --cpu, --libc, and --os to pnpm install, pnpm add, and pnpm dlx to customize supportedArchitectures via the CLI #7510.

Patch Changes

  • Fix a bug in which pnpm add downloads packages whose libc differ from pnpm.supportedArchitectures.libc.
  • The integrities of the downloaded Node.js artifacts are verified #9750.
  • Allow dlx to parse CLI flags and options between the dlx command and the command to run or between the dlx command and -- #9719.
  • pnpm install --prod should removing hoisted dev dependencies #9782.
  • Fix an edge case bug causing local tarballs to not re-link into the virtual store. This bug would happen when changing the contents of the tarball without renaming the file and running a filtered install.
  • Fix a bug causing pnpm install to incorrectly assume the lockfile is up to date after changing a local tarball that has peers dependencies.
Commits

Updates typescript from 5.8.3 to 5.9.2

Release notes

Sourced from typescript's releases.

TypeScript 5.9

Release notes pending.

Downloads are available on:

TypeScript 5.9 RC

For release notes, check out the release announcement

Downloads are available on:

TypeScript 5.9 Beta

For release notes, check out the release announcement.

Downloads are available on:

Commits
  • be86783 Give more specific errors for verbatimModuleSyntax (#62113)
  • 22ef577 LEGO: Pull request from lego/hb_5378966c-b857-470a-8675-daebef4a6da1_20250714...
  • d5a414c Don't use noErrorTruncation when printing types with maximumLength set (#...
  • f14b5c8 Remove unused and confusing dom.iterable.d.ts file (#62037)
  • 2778e84 Restore AbortSignal.abort (#62086)
  • 65cb4bd LEGO: Pull request from lego/hb_5378966c-b857-470a-8675-daebef4a6da1_20250710...
  • 9e20e03 Clear out checker-level stacks on pop (#62016)
  • 87740bc Fix for Issue 61081 (#61221)
  • 833a8d4 Fix Symbol completion priority and cursor positioning (#61945)
  • 0018c9f LEGO: Pull request from lego/hb_5378966c-b857-470a-8675-daebef4a6da1_20250702...
  • Additional commits viewable in compare view

Updates pnpm from 10.13.1 to 10.14.0

Release notes

Sourced from pnpm's releases.

pnpm 10.14

Minor Changes

  • Added support for JavaScript runtime installation

    Declare Node.js, Deno, or Bun in devEngines.runtime (inside package.json) and let pnpm download and pin it automatically.

    Usage example:

    {
      "devEngines": {
        "runtime": {
          "name": "node",
          "version": "^24.4.0",
          "onFail": "download" // we only support the "download" value for now
        }
      }
    }
    

    How it works:

    1. pnpm install resolves your specified range to the latest matching runtime version.
    2. The exact version (and checksum) is saved in the lockfile.
    3. Scripts use the local runtime, ensuring consistency across environments.

    Why this is better:

    1. This new setting supports also Deno and Bun (vs. our Node-only settings useNodeVersion and executionEnv.nodeVersion)
    2. Supports version ranges (not just a fixed version).
    3. The resolved version is stored in the pnpm lockfile, along with an integrity checksum for future validation of the Node.js content's validity.
    4. It can be used on any workspace project (like executionEnv.nodeVersion). So, different projects in a workspace can use different runtimes.
    5. For now devEngines.runtime setting will install the runtime locally, which we will improve in future versions of pnpm by using a shared location on the computer.

    Related PR: #9755.

  • Add --cpu, --libc, and --os to pnpm install, pnpm add, and pnpm dlx to customize supportedArchitectures via the CLI #7510.

Patch Changes

  • Fix a bug in which pnpm add downloads packages whose libc differ from pnpm.supportedArchitectures.libc.
  • The integrities of the downloaded Node.js artifacts are verified #9750.
  • Allow dlx to parse CLI flags and options between the dlx command and the command to run or between the dlx command and -- #9719.
  • pnpm install --prod should removing hoisted dev dependencies #9782.
  • Fix an edge case bug causing local tarballs to not re-link into the virtual store. This bug would happen when changing the contents of the tarball without renaming the file and running a filtered install.
  • Fix a bug causing pnpm install to incorrectly assume the lockfile is up to date after changing a local tarball that has peers dependencies.

Platinum Sponsors

... (truncated)

Changelog

Sourced from pnpm's changelog.

10.14.0

Minor Changes

  • Added support for JavaScript runtime resolution

    Declare Node.js, Deno, or Bun in devEngines.runtime (inside package.json) and let pnpm download and pin it automatically.

    Usage example:

    {
      "devEngines": {
        "runtime": {
          "name": "node",
          "version": "^24.4.0",
          "onFail": "download" (we only support the "download" value for now)
        }
      }
    }
    

    How it works:

    1. pnpm install resolves your specified range to the latest matching runtime version.
    2. The exact version (and checksum) is saved in the lockfile.
    3. Scripts use the local runtime, ensuring consistency across environments.

    Why this is better:

    1. This new setting supports also Deno and Bun (vs. our Node-only settings useNodeVersion and executionEnv.nodeVersion)
    2. Supports version ranges (not just a fixed version).
    3. The resolved version is stored in the pnpm lockfile, along with an integrity checksum for future validation of the Node.js content's validity.
    4. It can be used on any workspace project (like executionEnv.nodeVersion). So, different projects in a workspace can use different runtimes.
    5. For now devEngines.runtime setting will install the runtime locally, which we will improve in future versions of pnpm by using a shared location on the computer.

    Related PR: #9755.

  • Add --cpu, --libc, and --os to pnpm install, pnpm add, and pnpm dlx to customize supportedArchitectures via the CLI #7510.

Patch Changes

  • Fix a bug in which pnpm add downloads packages whose libc differ from pnpm.supportedArchitectures.libc.
  • The integrities of the downloaded Node.js artifacts are verified #9750.
  • Allow dlx to parse CLI flags and options between the dlx command and the command to run or between the dlx command and -- #9719.
  • pnpm install --prod should removing hoisted dev dependencies #9782.
  • Fix an edge case bug causing local tarballs to not re-link into the virtual store. This bug would happen when changing the contents of the tarball without renaming the file and running a filtered install.
  • Fix a bug causing pnpm install to incorrectly assume the lockfile is up to date after changing a local tarball that has peers dependencies.
Commits

Updates typescript from 5.8.3 to 5.9.2

Release notes

Sourced from typescript's releases.

TypeScript 5.9

Release notes pending.

Downloads are available on:

TypeScript 5.9 RC

For release notes, check out the release announcement

Downloads are available on:

TypeScript 5.9 Beta

For release notes, check out the release announcement.

Downloads are available on:

Commits
  • be86783 Give more specific errors for verbatimModuleSyntax (#62113)
  • 22ef577 LEGO: Pull request from lego/hb_5378966c-b857-470a-8675-daebef4a6da1_20250714...
  • d5a414c Don't use noErrorTruncation when printing types with maximumLength set (#...
  • f14b5c8 Remove unused and confusing dom.iterable.d.ts file (#62037)
  • 2778e84 Restore AbortSignal.abort (#62086)
  • 65cb4bd LEGO: Pull request from lego/hb_5378966c-b857-470a-8675-daebef4a6da1_20250710...
  • 9e20e03 Clear out checker-level stacks on pop (#62016)
  • 87740bc Fix for Issue 61081 (#61221)
  • 833a8d4 Fix Symbol completion priority and cursor positioning (#61945)
  • 0018c9f LEGO: Pull request from lego/hb_5378966c-b857-470a-8675-daebef4a6da1_20250702...
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
Pull Request Statistics
Commits:
1
Files Changed:
6
Additions:
+202
Deletions:
-202
Package Dependencies
Package:
web-vitals
Ecosystem:
npm
Version Change:
5.0.3 → 5.1.0
Update Type:
Minor
Package:
typescript
Ecosystem:
npm
Version Change:
5.8.3 → 5.9.2
Update Type:
Minor
Ecosystem:
npm
Version Change:
1.5.192 → 1.5.194
Update Type:
Patch
Package:
pnpm
Ecosystem:
npm
Version Change:
10.13.1 → 10.14.0
Update Type:
Minor
Technical Details
ID: 4381543
UUID: 2711581800
Node ID: PR_kwDOH6QSIM6hn3Ro
Host: GitHub
Repository: poad/github-cognito-oidc-proxy
Merge State: Dirty