Skip to content

chore(deps-dev): bump the root-packages group across 1 directory with 5 updates - #44

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/root-packages-8215d0a2d0
Open

chore(deps-dev): bump the root-packages group across 1 directory with 5 updates#44
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/root-packages-8215d0a2d0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 8, 2026

Copy link
Copy Markdown

Bumps the root-packages group with 5 updates in the / directory:

Package From To
@types/node 20.19.1 26.6.6
html-minifier 4.0.0 5.0.1
imagemin-cli 7.0.0 8.0.0
lighthouse 11.7.1 13.6.0
markdownlint-cli 0.37.0 0.50.0

Updates @types/node from 20.19.1 to 26.6.6

Commits

Updates html-minifier from 4.0.0 to 5.0.1

Changelog

Sourced from html-minifier's changelog.

[5.0.1] - 2026-11-03

Fixed

  • Fixed two regular expression denial-of-service (ReDoS) issues (GHSA-9wmg-23wv-h297—thanks @​aweiaaaaa), each causing quadratic (O(n²)) backtracking on the minify() path, now replaced by linear-time scans:
    • A long htmlmin:ignore block without tags, with collapseWhitespace enabled
    • A long whitespace run inside an ignoreCustomFragments match, with default options

[5.0.0] - 2026-11-03

Fixed

  • Fixed decodeEntities (and minifyJS, in event handler attributes) turning an escaped ampersand into one that starts a character reference, which changed the value browsers read (e.g., title="&copy b" → title="&copy b", read as “© b,” now kept; and in text, &[#169](https://github.com/j9t/html-minifier/issues/169) → &[#169](https://github.com/j9t/html-minifier/issues/169), now &amp#169)
  • Fixed decodeEntities (and minifyJS, in event handler attributes) leaving character references without a semicolon in attributes undecoded where browsers decode them (e.g., title="&copy b", now title="© b")

Changed

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for html-minifier since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates imagemin-cli from 7.0.0 to 8.0.0

Release notes

Sourced from imagemin-cli's releases.

v8.0.0

Breaking

  • Require Node.js 18 44ee151

Improvements

  • Update dependencies 44ee151

imagemin/imagemin-cli@v7.0.0...v8.0.0

Commits

Updates lighthouse from 11.7.1 to 13.6.0

Release notes

Sourced from lighthouse's releases.

v13.6.0

13.6.0 (2026-10-27)

Full Changelog

We expect this release to ship in the DevTools of Chrome 159, and to PageSpeed Insights within a week.

New contributors

Thanks to our new contributors 👽🐷🐰🐯🐻!

Notable Changes

  • CLI bulk URL auditing: The CLI now supports auditing multiple URLs sequentially in a single command—either by passing multiple URL arguments or via --url-file (with --fail-fast to abort on the first failure) (#17404). Default report filenames now include the URL pathname (<hostname>-<pathname>_<date>) to avoid collisions across pages on the same host (#17405, #17423).
  • Lantern simulation improvements: Upgraded trace_engine (0.0.66 and 0.0.67) and updated request/graph modeling to improve simulation accuracy (#17307, #17379):
    • Network & protocol modeling: Treated HTTP/3 connections as multiplexed, credited consumed H2 overflow bytes across simulation steps, excluded connectionless requests from active connection counts, and improved origin RTT/throughput estimation and redirect handling (#17415).
    • Dependency graph & metrics: Added v8.compileModule and v8.evaluateModule trace event attribution, used protocol renderBlocking status for render-blocking priority (#16869), used FCP graphs when text LCP occurs in the same frame as FCP, and fixed simulated LCP breakdown calculations (#17269) and trace-mode navigation/URL handling (#17431, #17433).
  • Agentic Resource Discovery (ARD) v0.91: Updated the ard-schema audit and gatherer to the ARD v0.91 specification (ard.json replacing ai-catalog.json), supporting discovery via Link HTTP headers, <link rel="ard">, and /.well-known/ard.json, warning on legacy ai-catalog locations, and displaying the ARD spec version in the report footer (#17258, #17259, #17260, #17448, #17452).
  • Performance insight numericValue: Performance insight audits now populate numericValue and numericUnit from estimated time or byte savings (#17346), and select the correct navigation when traces contain multiple navigations (#17174).
  • Memory and gathering optimizations: Reduced peak memory usage during runs by streaming traces (ReturnAsStream), reusing script sources from trace events, evicting decoded frame buffers in speedline, and releasing intermediate gatherer and trace engine state (#17286, #17289, #17290, #17407).

Core

  • fix cycle tracking and built-in type checks in deep-equals (#17422)
  • release retained gatherer and trace engine intermediate state (#17290)
  • populate numericValue on performance insight audits (#17346)
  • do not throw when robots.txt or llms.txt content is null (#17294)
  • fail robots-txt and llms-txt on HTTP 429 (#17295)
  • fix insight audits picking the wrong navigation's data (#17174)
  • ard: include ARD spec version in LHR credits and report footer (#17452)
  • ard: sync port with upstream f073b1e (#17448)
  • ard: make upstream sync check content-based (#17261)
  • ard: report legacy and unreachable discovery sources (#17260)
  • ard: discover manifests per spec §5.1 (#17259)
  • ard: port conformance test to ARD v0.91 (#17258)
  • baseline: link to developer.chrome.com docs (#17177)
  • baseline: show baseline_low_date for Widely Available features (#17337)
  • baseline: fix getLowDate for high features, move web-features to devDeps (#17283)
  • cdt: convert core/lib/cdt to ESM (#17340)
  • config: throw when module is missing from bundledModules in bundled env (#17398)
  • driver: skip clearDataForOrigin when origin is null (#17347)
  • full-page-screenshot: preserve emulated width during resize (#17330)
  • image-elements: skip source rules when HTML dimensions are explicit (#17287)
  • lantern-metric: use last main-frame navigation in trace mode (#17433)

... (truncated)

Changelog

Sourced from lighthouse's changelog.

13.6.0 (2026-10-27)

Full Changelog

We expect this release to ship in the DevTools of Chrome 159, and to PageSpeed Insights within a week.

New contributors

Thanks to our new contributors 👽🐷🐰🐯🐻!

Notable Changes

  • CLI bulk URL auditing: The CLI now supports auditing multiple URLs sequentially in a single command—either by passing multiple URL arguments or via --url-file (with --fail-fast to abort on the first failure) (#17404). Default report filenames now include the URL pathname (<hostname>-<pathname>_<date>) to avoid collisions across pages on the same host (#17405, #17423).
  • Lantern simulation improvements: Upgraded trace_engine (0.0.66 and 0.0.67) and updated request/graph modeling to improve simulation accuracy (#17307, #17379):
    • Network & protocol modeling: Treated HTTP/3 connections as multiplexed, credited consumed H2 overflow bytes across simulation steps, excluded connectionless requests from active connection counts, and improved origin RTT/throughput estimation and redirect handling (#17415).
    • Dependency graph & metrics: Added v8.compileModule and v8.evaluateModule trace event attribution, used protocol renderBlocking status for render-blocking priority (#16869), used FCP graphs when text LCP occurs in the same frame as FCP, and fixed simulated LCP breakdown calculations (#17269) and trace-mode navigation/URL handling (#17431, #17433).
  • Agentic Resource Discovery (ARD) v0.91: Updated the ard-schema audit and gatherer to the ARD v0.91 specification (ard.json replacing ai-catalog.json), supporting discovery via Link HTTP headers, <link rel="ard">, and /.well-known/ard.json, warning on legacy ai-catalog locations, and displaying the ARD spec version in the report footer (#17258, #17259, #17260, #17448, #17452).
  • Performance insight numericValue: Performance insight audits now populate numericValue and numericUnit from estimated time or byte savings (#17346), and select the correct navigation when traces contain multiple navigations (#17174).
  • Memory and gathering optimizations: Reduced peak memory usage during runs by streaming traces (ReturnAsStream), reusing script sources from trace events, evicting decoded frame buffers in speedline, and releasing intermediate gatherer and trace engine state (#17286, #17289, #17290, #17407).

Core

  • fix cycle tracking and built-in type checks in deep-equals (#17422)
  • release retained gatherer and trace engine intermediate state (#17290)
  • populate numericValue on performance insight audits (#17346)
  • do not throw when robots.txt or llms.txt content is null (#17294)
  • fail robots-txt and llms-txt on HTTP 429 (#17295)
  • fix insight audits picking the wrong navigation's data (#17174)
  • ard: include ARD spec version in LHR credits and report footer (#17452)
  • ard: sync port with upstream f073b1e (#17448)
  • ard: make upstream sync check content-based (#17261)
  • ard: report legacy and unreachable discovery sources (#17260)
  • ard: discover manifests per spec §5.1 (#17259)
  • ard: port conformance test to ARD v0.91 (#17258)
  • baseline: link to developer.chrome.com docs (#17177)
  • baseline: show baseline_low_date for Widely Available features (#17337)
  • baseline: fix getLowDate for high features, move web-features to devDeps (#17283)
  • cdt: convert core/lib/cdt to ESM (#17340)
  • config: throw when module is missing from bundledModules in bundled env (#17398)
  • driver: skip clearDataForOrigin when origin is null (#17347)
  • full-page-screenshot: preserve emulated width during resize (#17330)
  • image-elements: skip source rules when HTML dimensions are explicit (#17287)
  • lantern-metric: use last main-frame navigation in trace mode (#17433)
  • lcp-network-record: rename artifact, include Media requests (#17324)

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for lighthouse since your current version.


Updates markdownlint-cli from 0.37.0 to 0.50.0

Release notes

Sourced from markdownlint-cli's releases.

v0.50.0

  • Update markdownlint dependency to 0.42.0
    • Improve MD011/MD018/MD020/MD043/MD051/MD055/MD060
    • Add regular expression denial of service protection
    • Add support for reporting issues with front matter
    • Update dependencies
  • Update all dependencies via Dependabot

v0.49.1

  • Update markdownlint dependency to 0.41.1
    • Improve MD029
    • Fix module resolution under webpack
    • Update dependencies
  • Update all dependencies via Dependabot

v0.49.0

  • Update markdownlint dependency to 0.41.0
    • Improve MD022/MD028/MD035/MD042/MD051/MD060
    • Remove handling of inline directive syntax (frequent false positives)
    • Remove support for end-of-life Node version 20
  • Update all dependencies via Dependabot

v0.48.0

  • Update all dependencies via Dependabot

v0.47.0

  • Add output and exit code support for warnings
  • Update markdownlint dependency to 0.40.0
    • Improve MD011/MD013/MD051/MD060
  • Update all dependencies via Dependabot

v0.46.0

  • Replace glob dependency with tinyglobby (smaller and fewer dependencies)
  • Update markdownlint dependency to 0.39.0
    • Add MD060/table-column-style
    • Improve MD001/MD007/MD009/MD010/MD029/MD033/MD037/MD059
  • Update all dependencies via Dependabot

v0.45.0

  • Update markdownlint dependency to 0.38.0
    • Add MD059/descriptive-link-text
    • Improve MD025/MD027/MD036/MD038/MD041/MD043/MD045/MD051/MD052
    • Remove support for end-of-life Node version 18
  • Update all dependencies via Dependabot

v0.44.0

  • Update markdownlint dependency to 0.37.4
    • Convert module to ECMAScript (breaking change)
    • Stop using require, convert to import
    • Improve MD032

... (truncated)

Commits
  • cbcdc46 Bump version 0.50.0
  • ff6af70 Freshen package-lock.json by deleting and recreating via "npm install".
  • 0502602 Bump ava from 8.0.2 to 8.1.0
  • 43d3ef1 Bump ignore from 7.0.12 to 7.0.13
  • c05789e Bump js-yaml from 5.4.3 to 5.5.0
  • 92d6e13 Bump markdownlint from 0.41.1 to 0.42.0
  • fb4a7ee Bump ava from 8.0.1 to 8.0.2
  • 1fc4af4 Bump markdown-it from 15.0.2 to 15.0.3
  • 364797e Bump smol-toml from 1.9.0 to 1.9.1
  • 24967a4 Bump js-yaml from 5.4.2 to 5.4.3
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps-dev): bump the root-packages group across 1 directory with…
22cd062 
… 5 updates

Bumps the root-packages group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `20.19.1` | `26.6.6` |
| [html-minifier](https://github.com/j9t/html-minifier) | `4.0.0` | `5.0.1` |
| [imagemin-cli](https://github.com/imagemin/imagemin-cli) | `7.0.0` | `8.0.0` |
| [lighthouse](https://github.com/GoogleChrome/lighthouse) | `11.7.1` | `13.6.0` |
| [markdownlint-cli](https://github.com/igorshubovych/markdownlint-cli) | `0.37.0` | `0.50.0` |



Updates `@types/node` from 20.19.1 to 26.6.6
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `html-minifier` from 4.0.0 to 5.0.1
- [Changelog](https://github.com/j9t/html-minifier/blob/main/CHANGELOG.md)
- [Commits](https://github.com/j9t/html-minifier/commits)

Updates `imagemin-cli` from 7.0.0 to 8.0.0
- [Release notes](https://github.com/imagemin/imagemin-cli/releases)
- [Commits](imagemin/imagemin-cli@v7.0.0...v8.0.0)

Updates `lighthouse` from 11.7.1 to 13.6.0
- [Release notes](https://github.com/GoogleChrome/lighthouse/releases)
- [Changelog](https://github.com/GoogleChrome/lighthouse/blob/main/changelog.md)
- [Commits](GoogleChrome/lighthouse@v11.7.1...v13.6.0)

Updates `markdownlint-cli` from 0.37.0 to 0.50.0
- [Release notes](https://github.com/igorshubovych/markdownlint-cli/releases)
- [Commits](igorshubovych/markdownlint-cli@v0.37.0...v0.50.0)

---
updated-dependencies:
- dependency-name: "@types/node"
  dependency-version: 26.6.6
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: root-packages
- dependency-name: html-minifier
  dependency-version: 5.0.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: root-packages
- dependency-name: imagemin-cli
  dependency-version: 8.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: root-packages
- dependency-name: lighthouse
  dependency-version: 13.6.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: root-packages
- dependency-name: markdownlint-cli
  dependency-version: 0.50.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: root-packages
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from matbrgz as a code owner November 8, 2026 03:44
@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Nov 8, 2026 •
edited
Loading

Copy link
Copy Markdown

Deploying iplibrary-website with  Cloudflare Pages  Cloudflare Pages

Latest commit: 22cd062
Status: ✅  Deploy successful!
Preview URL: https://d1f4249c.iplibrary-website.pages.dev
Branch Preview URL: https://dependabot-npm-and-yarn-root-famn.iplibrary-website.pages.dev

View logs

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 8, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@matbrgz matbrgz Awaiting requested review from matbrgz matbrgz is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants