build(deps): bump the dependencies group across 1 directory with 8 updates by dependabot[bot] · Pull Request #6 · foreverworks/mcps

dependabot · 2026-11-13T09:15:16Z

Bumps the dependencies group with 8 updates in the / directory:

Package	From	To
marked	`18.1.1`	`18.2.0`
vitest	`5.0.5`	`5.1.0`
undici	`8.12.3`	`8.12.4`
fast-xml-parser	`5.11.2`	`5.12.0`
@bitwarden/cli	`2026.10.0`	`2026.10.1`
@simplewebauthn/server	`14.0.3`	`14.1.0`
@googleapis/sheets	`18.1.1`	`18.1.2`
@notionhq/client	`5.28.0`	`5.31.1`

Updates marked from 18.1.1 to 18.2.0

Release notes

Sourced from marked's releases.

v18.2.0

18.2.0 (2026-11-09)

Bug Fixes

keep hard line breaks in image alt text (#4187) (ed54c54)

let emphasis open after the other delimiter character (#4169) (219492a)

let emphasis open and close in angle brackets that are not html (#4190) (7bfa1f7)

preserve zero from named extension renderers (#4199) (b81a00a)

text after a heading or code block in a nested list item is pulled into the outer item (#4179) (4cb767a)

Features

add lastToken to lexer state (#4160) (e4ab77f)

v18.1.3

18.1.3 (2026-11-02)

Bug Fixes

allow trailing tabs after a setext heading underline (#4152) (1f1b480)

avoid quadratic scan for unmatched emphasis delimiters (#4103) (eab1e48), closes #4099

await promise arrays from walkTokens extensions (#4153) (c38704c)

cli: honor defaults and config when outputting tokens (#4146) (9470e8f)

collapse internal whitespace when normalizing link labels (#4157) (02c73e8)

do not allow a blank line inside a link reference definition label (#4165) (f3d21af)

don't treat an escaped ) or quote as an inline link or title closer (#4151) (9cb84e0)

end a list item before a lazy line after an html block (#4159) (7ba42f4)

end blockquote before a lazy line after a table (#4161) (e7dcf52)

isolate extension names from Object.prototype (#4177) (5cb03bd)

keep a block quote open after a lazy line in a nested block quote (#4175) (1d7272f)

only close a code fence with the opening fence character (#4164) (1d4d8fe)

preserve zero-valued custom renderer results (#4162) (e43ceef)

recognize task list items when a tab follows the checkbox (#4163) (64a299d)

start a GFM www autolink only at a word boundary (#4166) (84beefb)

Performance Improvements

fix backtracking in padantic html (#4173) (2d4a23c)

v18.1.2

18.1.2 (2026-10-26)

Bug Fixes

... (truncated)

Commits

afba454 chore(release): 18.2.0 [skip ci]
7220efa chore(deps-dev): bump rimraf from 6.1.3 to 6.1.4 (#4212)
6fd880c chore(deps-dev): bump tslib from 2.8.1 to 2.9.1 (#4211)
8ac3e20 docs: list --version in the man page and fix --no- option spelling (#4192)
e4ab77f feat: add lastToken to lexer state (#4160)
219492a fix: let emphasis open after the other delimiter character (#4169)
b81a00a fix: preserve zero from named extension renderers (#4199)
7bfa1f7 fix: let emphasis open and close in angle brackets that are not html (#4190)
4cb767a fix: text after a heading or code block in a nested list item is pulled into ...
ed54c54 fix: keep hard line breaks in image alt text (#4187)
Additional commits viewable in compare view

Updates vitest from 5.0.5 to 5.1.0

Release notes

Sourced from vitest's releases.

v5.1.0

🚀 Features

Add --last-failed to run only failed tests - by @sheremet-va in vitest-dev/vitest#11558 (82f63)

Support Temporal.Instant and Temporal.ZonedDateTime in vi.setSystemTime() - by @Prajwal2246, Prajwal2246, Claude Opus 5.5 (1M context), @hi-ogawa and Codex (GPT-6) in vitest-dev/vitest#11321 (f150f)

Introduce --since-last-run flag - by @sheremet-va in vitest-dev/vitest#11516 (08bd9)

Expose per-retry/repeat attempt result - by @hi-ogawa, Codex (GPT-6) and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11232 (21be4)

Support fake timers for node:timers and node:timers/promise - by @hi-ogawa, OpenCode and Codex (GPT-6) in vitest-dev/vitest#10899 (fbe97)

Allow coverage providers to store data in fs module cache - by @AriPerkkio in vitest-dev/vitest#11747 (54a2b)

Interactively review failed snapshots - by @macarie and @hi-ogawa in vitest-dev/vitest#11325 (54e5b)

browser:

Mock modules through an import map - by @sheremet-va in vitest-dev/vitest#11534 (707f8)

Drop experimental label from trace view - by @hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11518 (44c3c)

Introduce experimental pointer API - by @macarie in vitest-dev/vitest#10780 (5dc09)

Capture aria snapshot in trace view - by @hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11492 (0cc39)

Show trace steps timeline on terminal on test failure - by @hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11594 (973dc)

Add failure-only trace view mode - by @hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11612 (d5d7d)

Enable failure-only trace view by default - by @hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11766 (f37b6)

coverage:

V8 to support ignoreNode option - by @erickserra and @AriPerkkio in vitest-dev/vitest#11688 (e02db)

experimental:

Add trace timeline for node - by @hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11753 (4e985)

Add message option to vi.waitFor and vi.waitUntil - by @hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11754 (fd145)

🐞 Bug Fixes

Rerun setup files after --changed filtering - by @sheremet-va in vitest-dev/vitest#11621 (3a39c)

Return the mock to concurrent imports - by @sheremet-va in vitest-dev/vitest#11623 (1453b)

Don't fail on console log pending at teardown - by @sheremet-va in vitest-dev/vitest#11619 (a60b8)

Reference chai types in every d.ts chunk - by @sheremet-va in vitest-dev/vitest#11618 (fb150)

Detect mock factory cycles that form later - by @sheremet-va in vitest-dev/vitest#11642 (e9554)

Skip fs module cache for typed import.meta.glob - by @sheremet-va in vitest-dev/vitest#11666 (79501)

Run tests that import a deleted file - by @sheremet-va in vitest-dev/vitest#11669 (80aa1)

Keep syntax highlighting in code frames - by @sheremet-va in vitest-dev/vitest#11705 (d39f5)

Respect CLI filters when prewarming browsers - by @sheremet-va and Benjamin Tang in vitest-dev/vitest#11706 (10947)

Read cached source as utf-8 - by @juan-fernandez in vitest-dev/vitest#11682 and vitest-dev/vitest#11709 (867a5)

Inherit watch from the root config in projects - by @nstepien and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11724 (77c12)

Prefix expect.poll message to all errors - by @hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11756 (cab58)

Support api.port 0 - by @hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11641 (3667c)

Show attempts in test error logs of retried tests - by @hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11696 (77a94)

Preserve rootDir in project paths - by @btea in vitest-dev/vitest#11816 (bf96d)

browser:

Change default port to 23315 - by @hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11640 (a2ec4)

Advance fake timers in actions and expect.element - by @julienw, @hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11242 (68190)

Drop trace view warning without html reporter - by @hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11665 (e6407)

Detect shared chunks via the optimizer - by @sheremet-va in vitest-dev/vitest#11661 (e2e9c)

Clear screenshot stability timeout - by @sheremet-va in vitest-dev/vitest#11659 (fbe37)

Measure prepare duration with one clock - by @sheremet-va in vitest-dev/vitest#11667 (a3ed4)

Keep failure screenshot per attempt - by @hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11694 (a5022)

Print trace timeline of each attempt - by @hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11695 (27229)

... (truncated)

Commits

7a38449 chore: release v5.1.0 (#11838)
a5ec316 fix(vm): keep assignable accessor globals writable in node environment (#11834)
e46c6c1 refactor: share trace types and utils (#11825)
9e23ce5 refactor(snapshot): unify review update with SnapshotState update (#11790)
a0e33cc chore: eliminate lint error (#11822)
fd145d8 feat(experimental): add message option to vi.waitFor and vi.waitUntil (#11754)
4e98551 feat(experimental): add trace timeline for node (#11753)
bf96dad fix: preserve rootDir in project paths (#11816)
54e5b8a feat: interactively review failed snapshots (#11325)
4277075 fix(expect): keep soft .resolves/.rejects error location (#11792)
Additional commits viewable in compare view

Updates undici from 8.12.3 to 8.12.4

Release notes

Sourced from undici's releases.

v8.12.4

⚠️ Security Fixes

This release fixes six vulnerabilities.

CVE-2026-116592 / GHSA-mqg3-3v4r-cm32 (high)

Undici 8.12.2 and 8.12.3 could cache the final response from a redirect chain under the original request key without applying the origin, cache policy, freshness, or Vary requirements of every intermediate hop. This could poison a cache or expose one user's response to another user. The fix validates every redirect hop, combines their Vary fields, limits freshness and stale serving to the most restrictive hop, and invalidates persistent SQLite entries written by vulnerable releases.

CVE-2026-120474 / GHSA-7xg3-fphp-28hg (medium)

A shared cache used with compose(redirect(), cache()) could store a credential-dependent response from a same-origin redirect under the original URL. A later authenticated or unauthenticated request could then receive another user's response. Redirected requests carrying Authorization, Cookie, or Proxy-Authorization are no longer stored under the original alias key.

CVE-2026-116630 / GHSA-5rm8-gv32-r954 (medium)

A cross-origin redirect during cache revalidation could let a 304 Not Modified response from the redirect target validate a cached response from the original origin. Undici now checks that the revalidation target matches the cached URL and that any returned validator matches the stored representation before replaying the cached body.

CVE-2026-120415 / GHSA-9v6h-8rgp-m69f (medium)

The redirect interceptor did not strip credentials correctly when request headers were supplied as an array of [name, value] pairs. With a header-normalizing interceptor outside redirect(), credentials could be sent to a cross-origin redirect target. Undici now handles both tuple arrays and flat header arrays when removing sensitive headers.

CVE-2026-120222 / GHSA-3g9m-rv3r-w5w2 (medium)

A downstream handler exception during cache replay could escape as an uncaught exception or unhandled promise rejection and terminate the process. This included dump size-limit failures, excessive Content-Encoding values in decompress, asynchronous cache-store failures, and cached-body replay after a 304. These failures are now reported as request errors.

CVE-2026-120423 / GHSA-r4pc-4jcp-7pqc (medium)

fetch() could skip Subresource Integrity verification when valid integrity metadata was separated or surrounded by ASCII whitespace other than a space, including a horizontal tab. Integrity metadata is now split on all ASCII whitespace before SHA-256, SHA-384, or SHA-512 verification.

What's Changed

docs: clarify that origin is optional only for origin-bound dispatchers by @attilayener in nodejs/undici#5994

fix(mock): ignore the trailing slash before a query string by @lprnmns in nodejs/undici#6031

build(deps-dev): bump eslint from 10.12.0 to 10.13.0 by @dependabot[bot] in nodejs/undici#6059

build(deps-dev): bump neostandard from 0.14.0 to 0.14.1 by @dependabot[bot] in nodejs/undici#6058

docs: add QUERY to the documented retry default methods by @qodelicious in nodejs/undici#6062

docs: fix a couple of typos by @qodelicious in nodejs/undici#6057

build(deps): bump cronometro from 6.0.3 to 7.0.1 in /benchmarks by @dependabot[bot] in nodejs/undici#5969

fix: let interim 1xx responses through DecoratorHandler by @mrityunjay-pandey in nodejs/undici#6028

fix(types): declare FormData prototype methods by @RlxChap2 in nodejs/undici#6056

fix(cache): ignore SQLITE_BUSY in the sqlite cache store by @isHeSatoshi in nodejs/undici#6049

fix(http2): keep persistent error sink on released streams by @mcollina in nodejs/undici#5983

fix(h2): replay requests whose HEADERS raced a GOAWAY by @mohamed-rdr in nodejs/undici#6065

build(deps-dev): bump @fastify/busboy from 3.2.3 to 3.2.4 by @dependabot[bot] in nodejs/undici#6102

build(deps-dev): bump undici from 6.29.0 to 6.29.1 by @dependabot[bot] in nodejs/undici#6103

disable wasm SIMD on the RISC-V by @hrw in nodejs/undici#6041

fix(mock): expose aborted on the mock dispatch controller by @santiago-su in nodejs/undici#5964

fix(fetch): avoid eager reads from async iterable bodies by @Kesavamoorthig06 in nodejs/undici#5990

fix(h2): preserve accepted streams with deferred ids by @EpicHigh in nodejs/undici#6090

fix(fetch): preserve abort propagation after garbage collection by @BridgeAR in nodejs/undici#6070

... (truncated)

Commits

779ee3e Bumped v8.12.4 (#6162)
10fa822 docs: remove security release notes
6228fc5 docs: add security release notes
1dd2657 test(cache): align redirect caching with hop policy
8ea1d61 fix(cache): detect an actual redirect, not a plain revalidation
4257261 test(cache): cover credentialed revalidation refresh
aa7ccff fix(cache): treat proxy-authorization as a credential when caching redirects
8cf5ce1 test(cache): cover proxy-authorization credential on same-origin redirect
26c42c2 fix(cache): do not cache credential-bearing same-origin redirects under the a...
e958661 test: cover decompress too-many-content-encodings throw on async cache replay
Additional commits viewable in compare view

Updates fast-xml-parser from 5.11.2 to 5.12.0

Release notes

Sourced from fast-xml-parser's releases.

v5.12.0

What's Changed

fix: add endIndex to the CommonJS XMLMetaData declaration by @dualfroz in NaturalIntelligence/fast-xml-parser#896

Bump zizmorcore/zizmor-action from 0.6.1 to 0.8.0 by @dependabot[bot] in NaturalIntelligence/fast-xml-parser#906

Bump actions/setup-node from 7.0.0 to 7.1.0 by @dependabot[bot] in NaturalIntelligence/fast-xml-parser#904

fix: preserve original metadata offsets for CRLF input by @Sskift in NaturalIntelligence/fast-xml-parser#911

docs: update NASA link in users list by @CodeVertex55 in NaturalIntelligence/fast-xml-parser#885

README.md: fix documentation links by @maxlath in NaturalIntelligence/fast-xml-parser#872

test: drop shadowed ignoreAttributes option by @rajanpanth in NaturalIntelligence/fast-xml-parser#863

New Contributors

@dualfroz made their first contribution in NaturalIntelligence/fast-xml-parser#896

@Sskift made their first contribution in NaturalIntelligence/fast-xml-parser#911

@CodeVertex55 made their first contribution in NaturalIntelligence/fast-xml-parser#885

@maxlath made their first contribution in NaturalIntelligence/fast-xml-parser#872

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.11.2...v5.12.0

Changelog

Sourced from fast-xml-parser's changelog.

Note: If you find missing information about particular minor version, that version must have been changed without any functional change in this library.

Note: Due to some last quick changes on v4, detail of v4.5.3 & v4.5.4 are not updated here. v4.5.4x is the last tag of v4 in github repository. I'm extremely sorry for the confusion

5.12.0 / 2026-11-03

perf improvement for stop node: After the first failure in a given stop node, the function stops using readTagExp and switches to a cheap fallback.

devdep:jasmine 7.0

deps:

@nodable/entities v3.1.0

fast-xml-builder v1.3.1

is-unsafe v2.0.3

strnum v2.5.1

fix cjs typing

fix: preserve original metadata offsets for CRLF input (#911) (By sskift)

5.11.2 / 2026-09-29

fix (#875): decode Uint8Array XML input as UTF-8 (By emme1t)

fix (#880) :type EntityDecoderOptions.setXmlVersion's version as a number (By Yevhenii Kotyrlo)

5.11.1 / 2026-08-27

fix: validator; Replace regex with a single-pass scanner for attribute tokens, eliminating quadratic behavior on long whitespace runs.

5.11.0 / 2026-08-16

feat: support for endIndex in node metadata (#850) [By Pavel Dranichnikov]

fix: don't crash on a closing tag with no matching opening tag (#861) [By Haïm Dimer]

fix: DOCTYPE to read SYSTEM/PUBLIC

deps: strnum v2.4.2

5.10.1 / 2026-07-17

fix: multiple DOCTYPE declarations.

deps: @nodable/entities for treeshaking

5.10.0 / 2026-07-11

upgrade:

xml-naming v0.3.0: cache support

PEM v1.6.2: sibling bug fix

is-unsafe v2.0.0: tree shaking

*5.9.3 / 2026-06-19

update strnum

*5.9.2 / 2026-06-17

dummy release to test changes in github action

*5.9.1 / 2026-06-17

dummy release to test release from github action

*5.9.0 / 2026-06-15

update strnum to 2.3.0

... (truncated)

Commits

976470f 5.12.0
e6703ce update changelog
cad3004 update browser bundle
404b15e deps update
1792392 devdep: jasmine 7
edea043 specs: No duplicate suit or test name
0c36593 perf: stopnode
5680565 test: drop shadowed ignoreAttributes option (#863)
6b855c2 README.md: fix documentation links (#872)
4ad1388 docs: update NASA link in users list (#885)
Additional commits viewable in compare view

Updates @bitwarden/cli from 2026.10.0 to 2026.10.1

Release notes

Sourced from @bitwarden/cli's releases.

Desktop v2026.10.1

What's Changed

⚙️ Maintenance

[PM-45367] fix: point commercial Chocolatey package at the commercial installer by @addisonbeck in #23995

bump version to 10.0.1 for chocolatey release by @addisonbeck in #24068

Full Changelog: bitwarden/clients@desktop-v2026.10.0...desktop-v2026.10.1

Browser v2026.10.1

What's Changed

💙 Community Highlight

[PM-44168] Render the popup loading spinner only while loading by @Lolig4 in #23528

Feature Development

[CL-1246] feat: Add keyboard shortcut hints to search component by @BryanCunningham in #22830

[PM-43953] Extension introduce new experience by @jengstrom-bw in #23467

[PM-44108] perf: Add performance measurements to unlock and sync by @quexten in #23476

feat(tests): add basic key-management e2e test suite by @quexten in #23477

[PM-41469] Create new import controls component by @harr1424 in #23503

[CL-1257] feat: Add column customization to bit-table-v2 by @BryanCunningham in #23531

[CL-1257][CL-1368] feat: Let users customize vault items table columns by @BryanCunningham in #23532

[PM-44267] Gate basic auth requests by a user opt-in setting by @jprusik in #23583

[PM-44316] Harden basic auth responses by @jprusik in #23585

[PM-44246] introduce tab-lifecycle module by @audreyality in #23625

[PM-44451] Add 1Password direct import through the SDK on desktop and in the extension by @detunized in #23627

[CL-1364] Make header suffix slot visible when breadcrumbs are h1 by @vleague2 in #23630

[PM-44025] feat: Anchor popovers to elements inside library components by @BryanCunningham in #23649

[CL-1365] feat: Add hover reveal directives by @BryanCunningham in #23650

[PM-44693] Emit http auth event on credential release by @jprusik in #23764

[CL-1369] feat: Wrap active filter chips in a chip group by @BryanCunningham in #23804

[PM-44027] feat: Add the filters step to the VFO1 walkthrough by @gbubemismith in #23851

[PM-42405] feat: Push feature flags from ConfigService.renewConfig by @coroiu in #23867

[CL-1371] filter row spotlight by @BryanCunningham in #23870

🐛 Bug fixes

Bug/pm 13954/passwordboss json import by @adudek-bw in #22845

[PM-42643 ] Tools-owned URL validation by @harr1424 in #23160

[CL-1325] fix: Keep the vfo1 filter dialog open across popup close by @BryanCunningham in #23348

PM-39163 Automatic Login not working by @dan-livefront in #23392

PM-24268 resolve close by @bmbitwarden in #23593

[PM-36815] fix: credit card autofill in tightly sized iframes by @bensbits91 in #23605

PM-42338 folder assigned by @bmbitwarden in #23629

[PM-44494] fix(biometrics): fix biometric id update enrollment despite failed biometrics by @quexten in #23646

fix(export): fix v2 support for account restricted exports by @quexten in #23648

[PM-44496] Fill TOTP instead of username in ambiguous 2FA fields by @bw-dmitriy in #23670

[PM-44509] fix: use sentence-case "My folder" label on import page by @gbubemismith in #23685

... (truncated)

Commits

91214c3 bump desktop version (#24119)
f58e4f1 [CL-1366] Stop importing ngx-toastr's full stylesheet to workaround Chromium ...
c203449 fix(biometrics): race condition unchecks biometric unlock when turned on. (#2...
4bf4b7a fix: block Families sponsorships in Gov region (#23826) (#23997)
7b8412a Bumped client version(s) (#23963)
0a1fffa Autosync the updated translations (#23965)
230c273 Autosync the updated translations (#23964)
d1a7df0 Autosync the updated translations (#23966)
537e921 Autosync the updated translations (#23743)
93f76d8 Autosync the updated translations (#23742)
Additional commits viewable in compare view

Updates @simplewebauthn/server from 14.0.3 to 14.1.0

Release notes

Sourced from @simplewebauthn/server's releases.

v14.1.0

Changes:

[server] Support for the FIDO Convenience Metadata Service has been added with the new ConvenienceMetadataService. See https://simplewebauthn.dev/docs/advanced/server/metadata-service#convenience-metadata-service for more info (#812)

[server] verifyRegistrationResponse() and verifyAuthenticationResponse() will now raise a SimpleWebAuthnError when expectedRPID or expectedOrigin are not valid values (#824)

[server] "android-key" attestation statement verification now checks that the x5c root certificate is a known one before verifying the certificate chain (#821)

[server] "android-key" attestation statement verification now knows about the new Google Android Key Attestation CA1 trust anchor (#820)

[server] "tpm" attestation statement verification now properly parses non-TPM_ALG_NULL schemes in pubArea (#822)

Changelog

Sourced from @simplewebauthn/server's changelog.

v14.1.0

Changes:

[server] Support for the FIDO Convenience Metadata Service has been added with the new ConvenienceMetadataService. See https://simplewebauthn.dev/docs/advanced/server/metadata-service#convenience-metadata-service for more info (#812)

[server] verifyRegistrationResponse() and verifyAuthenticationResponse() will now raise a SimpleWebAuthnError when expectedRPID or expectedOrigin are not valid values (#824)

[server] "android-key" attestation statement verification now checks that the x5c root certificate is a known one before verifying the certificate chain (#821)

[server] "android-key" attestation statement verification now knows about the new Google Android Key Attestation CA1 trust anchor (#820)

[server] "tpm" attestation statement verification now properly parses non-TPM_ALG_NULL schemes in pubArea (#822)

Commits

01d1a64 Fix deno publish issue
f8b71cb Update server version to v14.1.0
60c34a1 Require ASCII inputs for expectedRPID and expectedOrigin (#824)
8f41b23 Improve TPM pubArea parsing (#822)
6a87602 Mount better defenses against malicious cert chains in Android Key attestatio...
a0d9d94 Add Google Android Key Attestation CA1 trust anchor (#820)
96f0f24 Fix copy-pasted "teeEnforced" w/"softwareEnforced" in Android Key error messa...
df53178 Add support for FIDO Convenience MDS (#812)
See full diff in compare view

Updates @googleapis/sheets from 18.1.1 to 18.1.2

Commits

e4a2e79 chore: release main (#4059)
b0bca20 feat: regenerate index files
fde5d01 feat(workstations): update the API
9d2706c feat(vmwareengine): update the API
5b8c49c feat(vision): update the API
<...
Description has been truncated

…dates Bumps the dependencies group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [marked](https://github.com/markedjs/marked) | `18.1.1` | `18.2.0` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.5` | `5.1.0` | | [undici](https://github.com/nodejs/undici) | `8.12.3` | `8.12.4` | | [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) | `5.11.2` | `5.12.0` | | [@bitwarden/cli](https://github.com/bitwarden/clients) | `2026.10.0` | `2026.10.1` | | [@simplewebauthn/server](https://github.com/MasterKale/SimpleWebAuthn/tree/HEAD/packages/server) | `14.0.3` | `14.1.0` | | [@googleapis/sheets](https://github.com/googleapis/google-api-nodejs-client) | `18.1.1` | `18.1.2` | | [@notionhq/client](https://github.com/makenotion/notion-sdk-js) | `5.28.0` | `5.31.1` | Updates `marked` from 18.1.1 to 18.2.0 - [Release notes](https://github.com/markedjs/marked/releases) - [Commits](markedjs/marked@v18.1.1...v18.2.0) Updates `vitest` from 5.0.5 to 5.1.0 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.1.0/packages/vitest) Updates `undici` from 8.12.3 to 8.12.4 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v8.12.3...v8.12.4) Updates `fast-xml-parser` from 5.11.2 to 5.12.0 - [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases) - [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md) - [Commits](NaturalIntelligence/fast-xml-parser@v5.11.2...v5.12.0) Updates `@bitwarden/cli` from 2026.10.0 to 2026.10.1 - [Release notes](https://github.com/bitwarden/clients/releases) - [Commits](bitwarden/clients@cli-v2026.10.0...cli-v2026.10.1) Updates `@simplewebauthn/server` from 14.0.3 to 14.1.0 - [Release notes](https://github.com/MasterKale/SimpleWebAuthn/releases) - [Changelog](https://github.com/MasterKale/SimpleWebAuthn/blob/master/CHANGELOG.md) - [Commits](https://github.com/MasterKale/SimpleWebAuthn/commits/v14.1.0/packages/server) Updates `@googleapis/sheets` from 18.1.1 to 18.1.2 - [Release notes](https://github.com/googleapis/google-api-nodejs-client/releases) - [Commits](googleapis/google-api-nodejs-client@iam-v18.1.1...sheets-v18.1.2) Updates `@notionhq/client` from 5.28.0 to 5.31.1 - [Release notes](https://github.com/makenotion/notion-sdk-js/releases) - [Commits](makenotion/notion-sdk-js@v5.28.0...v5.31.1) --- updated-dependencies: - dependency-name: marked dependency-version: 18.2.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: vitest dependency-version: 5.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: undici dependency-version: 8.12.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: fast-xml-parser dependency-version: 5.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: "@bitwarden/cli" dependency-version: 2026.10.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: "@simplewebauthn/server" dependency-version: 14.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: "@googleapis/sheets" dependency-version: 18.1.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: "@notionhq/client" dependency-version: 5.31.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 13, 2026

Navigation Menu

Repository navigation

build(deps): bump the dependencies group across 1 directory with 8 updates - #6

build(deps): bump the dependencies group across 1 directory with 8 updates#6
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dependencies-972ef8c431

dependabot Bot commented on behalf of github Nov 13, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Nov 13, 2026

v18.2.0

18.2.0 (2026-11-09)

Bug Fixes

Features

v18.1.3

18.1.3 (2026-11-02)

Bug Fixes

Performance Improvements

v18.1.2

18.1.2 (2026-10-26)

Bug Fixes

v5.1.0

🚀 Features

🐞 Bug Fixes

v8.12.4

⚠️ Security Fixes

CVE-2026-116592 / GHSA-mqg3-3v4r-cm32 (high)

CVE-2026-120474 / GHSA-7xg3-fphp-28hg (medium)

CVE-2026-116630 / GHSA-5rm8-gv32-r954 (medium)

CVE-2026-120415 / GHSA-9v6h-8rgp-m69f (medium)

CVE-2026-120222 / GHSA-3g9m-rv3r-w5w2 (medium)

CVE-2026-120423 / GHSA-r4pc-4jcp-7pqc (medium)

What's Changed

v5.12.0

What's Changed

New Contributors

Desktop v2026.10.1

What's Changed

⚙️ Maintenance

Browser v2026.10.1

What's Changed

💙 Community Highlight

Feature Development

🐛 Bug fixes

v14.1.0

v14.1.0

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants