Skip to content

chore(deps): bump the production-dependencies group across 1 directory with 8 updates - #88

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/app/production-dependencies-e62bbe585a
Open

chore(deps): bump the production-dependencies group across 1 directory with 8 updates#88
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/app/production-dependencies-e62bbe585a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 26, 2026

Copy link
Copy Markdown

Bumps the production-dependencies group with 8 updates in the /app directory:

Package From To
@modelcontextprotocol/sdk 1.30.0 1.32.1
better-sqlite3 13.0.1 13.0.3
electron-updater 6.8.9 6.8.10
jose 5.10.0 6.2.12
node-llama-cpp 3.19.1 3.22.2
pidusage 4.0.1 4.1.0
tesseract.js 5.1.1 7.0.0
undici 8.10.0 8.12.3

Updates @modelcontextprotocol/sdk from 1.30.0 to 1.32.1

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

1.32.1

What's Changed

Full Changelog: modelcontextprotocol/typescript-sdk@1.32.0...1.32.1

1.32.0

Upgrade notes

  • Redirects: the HTTP client transports now follow a redirect only when it stays on the same origin (same scheme, host and port; http to https on the same host is allowed). A deployment whose endpoint redirects to another host or port either configures the final URL or sets redirectPolicy: 'follow' on StreamableHTTPClientTransport or SSEClientTransport. In browsers, a redirected request fails unless that option is set.
  • New options, both off unless you set them: maxToolInputElements on McpServer limits the number of array elements and object members in a tool call's arguments. expectedResource on requireBearerAuth accepts only tokens issued for this server (the token's audience).

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@1.31.0...1.32.0

1.31.0

Upgrade notes

  • Stored OAuth tokens and client information now include an issuer field. Storage that rejects unknown fields needs to allow it.
  • Pass expectedIssuer when constructing ClientCredentialsProvider, PrivateKeyJwtProvider or StaticPrivateKeyJwtProvider. Constructing them without it is deprecated.

What's Changed

Full Changelog: modelcontextprotocol/typescript-sdk@1.30.1...1.31.0

1.30.1

What's Changed

New Contributors

... (truncated)

Commits
  • ff07b00 chore: bump version to 1.32.1 (#2954)
  • 8a74d50 [v1.x] docs: point the README at v2 and say what v1.x supports (#2942)
  • a8cf503 [v1.x] docs: state the principles in CLAUDE.md (#2939)
  • 32549b0 chore: bump version to 1.32.0 (#2935)
  • 588d51d [v1.x] test(e2e): cover tools/call and prompts/get without arguments (#2931)
  • 5a0724d [v1.x] feat(auth): add expectedResource to requireBearerAuth (#2930)
  • 0ca0b62 [v1.x] fix(server): accept tools/call and prompts/get requests that omit argu...
  • fd26801 [v1.x] feat(server): add maxToolInputElements option to limit the number of e...
  • 727075b [v1.x] fix(tasks): keep tasks of the in-memory task store within the session ...
  • 0ff6377 [v1.x] examples: close idle sessions and cap the session map (#2914)
  • Additional commits viewable in compare view

Updates better-sqlite3 from 13.0.1 to 13.0.3

Release notes

Sourced from better-sqlite3's releases.

v13.0.3

What's Changed

Full Changelog: WiseLibs/better-sqlite3@v13.0.2...v13.0.3

v13.0.2

What's Changed

New Contributors

Full Changelog: WiseLibs/better-sqlite3@v13.0.1...v13.0.2

Commits

Updates electron-updater from 6.8.9 to 6.8.10

Release notes

Sourced from electron-updater's releases.

electron-updater@6.8.10

Patch Changes

  • Fix: make multi-range differential downloads work on real servers. Three independent defects made downloadUpdate fall back to a full download with Response ends without calling any handlers: [#10219](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/electron-updater/issues/10219) 7dd7f8a @​claude

    • DataSplitter only recognised CRLF. Some CDNs answer multipart/byteranges with bare LF line endings, so no part was ever split and the whole response accumulated in memory. Header lists now end at whichever of \r\n\r\n / \n\n comes first, and the <EOL>--boundary separator size follows the line ending the server actually uses.
    • A header-list terminator split across two chunks was never found: only the new chunk was searched, the buffered bytes never were, so the parser locked onto the next part's header instead. Only the last few bytes of an unfinished header list are now carried over and searched together with the next chunk, instead of accumulating the whole list.
    • The 10s watchdog armed when a batch response ends was never disarmed after that batch succeeded. With more than 1000 operations (several range requests) it failed the whole download whenever a later batch took longer than the grace period.

  • Fix: keep the cached blockmap consistent with the cached installer. A download round that did not produce a new blockmap (e.g. the differential download was skipped because the cached installer was evicted) now removes the cached current.blockmap instead of leaving a stale one next to the freshly cached file, which poisoned the next differential download and surfaced as a generic sha512 checksum mismatch before falling back to a full download (#10097). Leftover pending blockmaps from previous update rounds are also cleared before a fresh download. sha512-mismatch logging now distinguishes a differential download that failed against stale/corrupt cached inputs (including whether the old blockmap came from the local cache or the server) from a genuine checksum failure of a fully downloaded file. [#10163](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/electron-updater/issues/10163) 1dfe1a9 @​claude

Changelog

Sourced from electron-updater's changelog.

6.8.10

Patch Changes

  • Fix: make multi-range differential downloads work on real servers. Three independent defects made downloadUpdate fall back to a full download with Response ends without calling any handlers: [#10219](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/electron-updater/issues/10219) 7dd7f8a @​claude

    • DataSplitter only recognised CRLF. Some CDNs answer multipart/byteranges with bare LF line endings, so no part was ever split and the whole response accumulated in memory. Header lists now end at whichever of \r\n\r\n / \n\n comes first, and the <EOL>--boundary separator size follows the line ending the server actually uses.
    • A header-list terminator split across two chunks was never found: only the new chunk was searched, the buffered bytes never were, so the parser locked onto the next part's header instead. Only the last few bytes of an unfinished header list are now carried over and searched together with the next chunk, instead of accumulating the whole list.
    • The 10s watchdog armed when a batch response ends was never disarmed after that batch succeeded. With more than 1000 operations (several range requests) it failed the whole download whenever a later batch took longer than the grace period.

  • Fix: keep the cached blockmap consistent with the cached installer. A download round that did not produce a new blockmap (e.g. the differential download was skipped because the cached installer was evicted) now removes the cached current.blockmap instead of leaving a stale one next to the freshly cached file, which poisoned the next differential download and surfaced as a generic sha512 checksum mismatch before falling back to a full download (#10097). Leftover pending blockmaps from previous update rounds are also cleared before a fresh download. sha512-mismatch logging now distinguishes a differential download that failed against stale/corrupt cached inputs (including whether the old blockmap came from the local cache or the server) from a genuine checksum failure of a fully downloaded file. [#10163](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/electron-updater/issues/10163) 1dfe1a9 @​claude

Commits
  • 5cdf017 chore(deploy): Release v26.17.0 (electron-updater@6.8.10) (v26) (#10191)
  • 7dd7f8a fix(updater): make multi-range differential downloads work on real servers (v...
  • 1dfe1a9 fix(electron-updater): keep cached blockmap consistent with cached installer ...
  • See full diff in compare view

Updates jose from 5.10.0 to 6.2.12

Release notes

Sourced from jose's releases.

v6.2.12

Documentation

  • clarify and shorten public API guidance (be62530)

Refactor

  • simplify JWS and JWE operation cores (92e9640)

Performance

  • avoid copying AES-GCM output (6925d43)
  • deduplicate pending jwks key imports (bf5138b)
  • encode single-signature JWS input once (7bc9a33)
  • normalize General JWE shared headers once (78637bd)
  • normalize jwks selection metadata once (fd3ae3f)
  • use native encoding for larger ASCII strings (b23a6f3)

v6.2.11

Documentation

  • render subpath indexes as tables (94589ee)
  • shorten API index descriptions (681482f)

Refactor

  • model JWE key management modes (e01dda6)
  • types: reduce declaration repetition (55b970f)

v6.2.10

Fixes

  • jose: consume serialization members once (9bee285)
  • jose: reject empty protected and JWE AAD members (8da4145)
  • jose: validate serialized header values (b711d8f)
  • jwe: conceal invalid decrypted CEK lengths (41fafe0)
  • jwe: enforce AES-GCM tag boundaries (9a5b744)
  • jwe: validate explicit encryption parameters (7a02697)
  • jwk: accept empty octet-sequence keys (3f871e7)
  • jwk: normalize key resolution inputs (f54ee7b)
  • jwks: enforce verification key metadata (f9ba510)
  • jwks: order overlapping remote reloads (9a1a913)
  • jwks: reject invalid remote duration values (7bdb9e5)
  • jwk: validate ext and key_ops parameters (4d91c37)
  • jws: reject mixed payload encoding modes (dc69713)
  • jws: validate unencoded payload strings (541f282)
  • jwt: enforce explicit verification policies (b347182)
  • jwt: prevent replacing protected headers (ae07d09)
  • jwt: reject invalid duration inputs (282f9aa)
  • jwt: validate builder claim values (ea03f83)

... (truncated)

Changelog

Sourced from jose's changelog.

6.2.12 (2026-09-05)

Documentation

  • clarify and shorten public API guidance (be62530)

Refactor

  • simplify JWS and JWE operation cores (92e9640)

Performance

  • avoid copying AES-GCM output (6925d43)
  • deduplicate pending jwks key imports (bf5138b)
  • encode single-signature JWS input once (7bc9a33)
  • normalize General JWE shared headers once (78637bd)
  • normalize jwks selection metadata once (fd3ae3f)
  • use native encoding for larger ASCII strings (b23a6f3)

6.2.11 (2026-09-04)

Documentation

  • render subpath indexes as tables (94589ee)
  • shorten API index descriptions (681482f)

Refactor

  • model JWE key management modes (e01dda6)
  • types: reduce declaration repetition (55b970f)

6.2.10 (2026-08-21)

Fixes

  • jose: consume serialization members once (9bee285)
  • jose: reject empty protected and JWE AAD members (8da4145)
  • jose: validate serialized header values (b711d8f)
  • jwe: conceal invalid decrypted CEK lengths (41fafe0)
  • jwe: enforce AES-GCM tag boundaries (9a5b744)
  • jwe: validate explicit encryption parameters (7a02697)
  • jwk: accept empty octet-sequence keys (3f871e7)
  • jwk: normalize key resolution inputs (f54ee7b)
  • jwks: enforce verification key metadata (f9ba510)
  • jwks: order overlapping remote reloads (9a1a913)
  • jwks: reject invalid remote duration values (7bdb9e5)
  • jwk: validate ext and key_ops parameters (4d91c37)
  • jws: reject mixed payload encoding modes (dc69713)
  • jws: validate unencoded payload strings (541f282)
  • jwt: enforce explicit verification policies (b347182)

... (truncated)

Commits
  • 505a55b chore(release): 6.2.12
  • 7bc9a33 perf: encode single-signature JWS input once
  • 78637bd perf: normalize General JWE shared headers once
  • bf5138b perf: deduplicate pending jwks key imports
  • b23a6f3 perf: use native encoding for larger ASCII strings
  • fd3ae3f perf: normalize jwks selection metadata once
  • 6925d43 perf: avoid copying AES-GCM output
  • be62530 docs: clarify and shorten public API guidance
  • 1b41312 build: preserve README when generation fails
  • 0b51829 build: check tree-shaking for every public binding
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for jose since your current version.


Updates node-llama-cpp from 3.19.1 to 3.22.2

Release notes

Sourced from node-llama-cpp's releases.

v3.22.2

✨ New: Jev-like structured decisions with any model

3.22.2 (2026-10-17)

Bug Fixes

Shipped with llama.cpp release v0.7.0

To use the latest llama.cpp release available, run npx -n node-llama-cpp source download --release latest. (learn more)

v3.22.1

✨ New: Jev-like structured decisions with any model

3.22.1 (2026-09-28)

Bug Fixes

Shipped with llama.cpp release v0.5.0

To use the latest llama.cpp release available, run npx -n node-llama-cpp source download --release latest. (learn more)

v3.22.0

✨ New: Jev-like structured decisions with any model

3.22.0 (2026-09-27)

Features

... (truncated)

Commits

Updates pidusage from 4.0.1 to 4.1.0

Changelog

Sourced from pidusage's changelog.

4.1.0

  • gwmi: invoke powershell with -NoProfile -NonInteractive so stats polling no longer executes user profile scripts
  • win: detect wmic once without spawning a process, add useGwmi option to skip the detection
  • fixes DEP0190 deprecation warning on node 24 (#191)
  • drop safe-buffer, pidusage has no runtime dependencies anymore
Commits

Updates tesseract.js from 5.1.1 to 7.0.0

Release notes

Sourced from tesseract.js's releases.

v7.0.0

What's Changed

  • Significant improvements to recognition speed (by @​fanchenkong1 in naptha/tesseract.js#1039)
    • A new relaxedsimd build takes advantage of the latest WASM and hardware capabilities.
    • Upgrading from v6 to v7 reduces runtimes by ~15-35% (depending on device and use-case). The highest uplifts are currently seen on the latest Intel processors.
  • Dropped support for Node.js v14.
  • Various minor changes

New Contributors

Full Changelog: naptha/tesseract.js@v6.0.1...v7.0.0

v6.0.1

What's Changed

  • Switched from using node-fetch to using built-in fetch implementation for Node.js v18 and newer.
    • This resolves a nuisance dependency-related warning message reported in #876
  • Various minor updates

Full Changelog: naptha/tesseract.js@v6.0.0...v6.0.1

v6.0.0

What's Changed

  • Fixed memory leaks (#977)
    • This version fixed a long-standing issue where memory would rise over time, eventually leading to a crash.
  • Reduced runtime and memory usage for most users by updating default formats (#916).
  • Fixed compatibility with Electron main process (#925)
  • Fixed bug where user-provided parameters were overwritten by defaults (#975).

Breaking Changes

  1. All outputs formats other than text are now disabled by default.
    • To re-enable the hocr output (for example), set the following: worker.recognize(image, {}, { hocr: true })
      • See here for a list of possible output formats.
  2. The JavaScript object output format (blocks) was tweaked.
    • Only the array of blocks (blocks) is returned.
      • Previous versions would automatically generate lists of every unit of text (words, symbols, etc.).
        • If needed, these should now be generated by the user.
    • Only text-based blocks are reported.
      • Previous versions reported non-text blocks when detected by Tesseract (e.g. line segments).
    • The shape of some objects were changed.
      • See the type declarations for reference on properties.
      • The main properties--text and bbox--are unchanged.
  3. Various functions and options marked as depreciated previously have been removed.
    1. This includes worker.initialize and worker.loadLanguage, along with several depreciated options from v2.

See #993 for additional discussion about this release.

New Contributors

... (truncated)

Commits

Updates undici from 8.10.0 to 8.12.3

Release notes

Sourced from undici's releases.

v8.12.3

What's Changed

New Contributors

Full Changelog: nodejs/undici@v8.12.2...v8.12.3

v8.12.2

Security fixes

High severity

Denial of service via TLS 1.2 certificate-changing renegotiation

CVE-2026-87018 · GHSA-qrxm-fqhp-jwvm

A malicious or compromised HTTPS server could crash the Node.js process by initiating TLS 1.2 renegotiation and presenting a different, CA-trusted certificate whose hostname did not match the requested host. The resulting socket error reached an assertion in undici's HTTP/1.1 and HTTP/2 connection handling. This release handles post-connect certificate errors without terminating the process.

TLS certificate validation bypass through dropped Agent options

CVE-2026-109383 · GHSA-2m5v-pch6-74hx

Agent used a JSON-based clone for constructor options, which silently removed function-valued TLS options such as checkServerIdentity. Applications relying on custom certificate or public-key verification could therefore accept a certificate that the callback was intended to reject. This release preserves TLS options when creating per-origin dispatchers.

Cache poisoning and cross-user disclosure through cross-origin redirects

CVE-2026-109829 · GHSA-4w7w-5xrc-9h26

When an originless Agent combined redirect and shared-cache interceptors as compose(redirect(), cache()), a response from a cross-origin redirect could be stored under the original URL. This could allow persistent cache poisoning or disclosure of user-specific responses to later callers. This release verifies the response origin before caching and preserves redirect-hop cache-control policy.

Denial of service through excessive Content-Encoding values

CVE-2026-109869 · GHSA-xjj6-f33q-929c

A malicious HTTP server could crash the Node.js process by returning more than five content codings and closing the connection before sending the body. Although fetch() rejected the response, an error from an orphaned internal stream could remain unhandled. This release validates the content-encoding chain before creating the body stream and aborts oversized chains safely.

Medium severity

Denial of service through the decompress interceptor

CVE-2026-87029 · GHSA-55wc-3pg8-jfw6

... (truncated)

Commits
  • ff9cc5e Bumped v8.12.3 (#6053)
  • 0bbf614 fix(pool): keep caller async context for queued requests (#5982)
  • aa1eef1 fix(h2): replace a connection that stops responding after a stream timeout (#...
  • e34b872 docs: document the options of interceptors.cache() (#6050)
  • e8f3423 build(deps-dev): bump eslint from 9.39.4 to 10.12.0 (#5967)
  • b777e40 build(deps-dev): bump neostandard from 0.13.0 to 0.14.0 (#6006)
  • 43700ff ci: use Python 3.14 for the WPT server on macOS (#6029)
  • bb6cc0a Bumped v8.12.2 (#6021)
  • b217373 fix(websocket): bound automatic PONG writes under backpressure
  • 789ef26 fix(eventsource): bound retained SSE parser state
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the production-dependencies group across 1 director…
1bd4db0 
…y with 8 updates

Bumps the production-dependencies group with 8 updates in the /app directory:

| Package | From | To |
| --- | --- | --- |
| [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.30.0` | `1.32.1` |
| [better-sqlite3](https://github.com/WiseLibs/better-sqlite3) | `13.0.1` | `13.0.3` |
| [electron-updater](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/electron-updater) | `6.8.9` | `6.8.10` |
| [jose](https://github.com/panva/jose) | `5.10.0` | `6.2.12` |
| [node-llama-cpp](https://github.com/withcatai/node-llama-cpp) | `3.19.1` | `3.22.2` |
| [pidusage](https://github.com/soyuka/pidusage) | `4.0.1` | `4.1.0` |
| [tesseract.js](https://github.com/naptha/tesseract.js) | `5.1.1` | `7.0.0` |
| [undici](https://github.com/nodejs/undici) | `8.10.0` | `8.12.3` |



Updates `@modelcontextprotocol/sdk` from 1.30.0 to 1.32.1
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@1.30.0...1.32.1)

Updates `better-sqlite3` from 13.0.1 to 13.0.3
- [Release notes](https://github.com/WiseLibs/better-sqlite3/releases)
- [Commits](WiseLibs/better-sqlite3@v13.0.1...v13.0.3)

Updates `electron-updater` from 6.8.9 to 6.8.10
- [Release notes](https://github.com/electron-userland/electron-builder/releases)
- [Changelog](https://github.com/electron-userland/electron-builder/blob/electron-updater@6.8.10/packages/electron-updater/CHANGELOG.md)
- [Commits](https://github.com/electron-userland/electron-builder/commits/electron-updater@6.8.10/packages/electron-updater)

Updates `jose` from 5.10.0 to 6.2.12
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](panva/jose@v5.10.0...v6.2.12)

Updates `node-llama-cpp` from 3.19.1 to 3.22.2
- [Release notes](https://github.com/withcatai/node-llama-cpp/releases)
- [Commits](withcatai/node-llama-cpp@v3.19.1...v3.22.2)

Updates `pidusage` from 4.0.1 to 4.1.0
- [Changelog](https://github.com/soyuka/pidusage/blob/main/CHANGELOG.md)
- [Commits](soyuka/pidusage@v4.0.1...v4.1.0)

Updates `tesseract.js` from 5.1.1 to 7.0.0
- [Release notes](https://github.com/naptha/tesseract.js/releases)
- [Commits](naptha/tesseract.js@v5.1.1...v7.0.0)

Updates `undici` from 8.10.0 to 8.12.3
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v8.10.0...v8.12.3)

---
updated-dependencies:
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.32.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: better-sqlite3
  dependency-version: 13.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: electron-updater
  dependency-version: 6.8.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: jose
  dependency-version: 6.2.12
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: node-llama-cpp
  dependency-version: 3.22.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: pidusage
  dependency-version: 4.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: tesseract.js
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: undici
  dependency-version: 8.12.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants