Skip to content

deps(deps): bump the runtime group across 1 directory with 10 updates - #130

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/runtime-609af65d03
Open

deps(deps): bump the runtime group across 1 directory with 10 updates#130
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/runtime-609af65d03

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 16, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the runtime group with 10 updates in the / directory:

Package From To
@modelcontextprotocol/sdk 1.29.0 1.30.0
adm-zip 0.6.0 0.6.1
katex 0.18.1 0.18.7
open 11.0.0 11.0.3
pdfjs-dist 6.2.108 6.3.289
playwright 1.62.0 1.63.0
texlyre-busytex 1.2.3 1.4.0
tsx 4.23.1 4.23.13
ws 8.21.1 8.21.3
zod 4.4.3 4.6.4

Updates @modelcontextprotocol/sdk from 1.29.0 to 1.30.0

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

1.30.0

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@v1.29.0...1.30.0

Commits
  • 2d889f2 chore: bump version to 1.30.0 (#2563)
  • e3f3daa Fix SSE keep-alive timer lifecycle in Streamable HTTP server transport (v1.x)...
  • bb5a718 fix(deps): widen @​hono/node-server past GHSA-frvp-7c67-39w9 (#2549)
  • 1dad263 fix: send SSE keep-alive comment frames from Streamable HTTP server transport...
  • 69749aa Validate Content-Type by parsed media type instead of substring match (v1.x) ...
  • 369513d fix: support Zod 3.25 method literals (#2368)
  • e7ee57c v1 stdio buffer limit (#2239)
  • c36e1ef Add end-to-end test suite (#2167)
  • bf1e022 chore(ci): switch publish to OIDC trusted publishing (#1839)
  • 9edbab7 fix(server): prioritize zod issues and format them (#1503)
  • See full diff in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​modelcontextprotocol/sdk since your current version.


Updates adm-zip from 0.6.0 to 0.6.1

Release notes

Sourced from adm-zip's releases.

v0.6.1

Full Changelog: cthackers/adm-zip@v0.6.0...v0.6.1

  • Updated dev dependencies
  • Fixed uncaught crash in async decompression on malformed DEFLATE data
  • Fixed addLocalFolder following symlinks out of the archived folder
  • Stripped setuid/setgid/sticky bits from extracted file permissions
  • Enforced the decompression size cap on the async path and for size 0
  • Rejected archives with duplicate entry names
  • Blocked extraction from writing through symlinks inside the target
  • Routed malformed-header parse errors through the async callback
  • Rejected zip entries whose declared data extent runs past the buffer
  • Fixed addLocalFolderPromise hanging on empty folders and swallowing errors
  • Fixed addLocalFolderAsync2 mangling local paths on Windows
Commits
  • cb2cf9b Fixed addLocalFolderAsync2 mangling local paths on Windows
  • 54902b6 Fixed addLocalFolderPromise hanging on empty folders and swallowing errors
  • 73131bd Fixed CI
  • 758898d Rejected zip entries whose declared data extent runs past the buffer
  • 74b6e9f Routed malformed-header parse errors through the async callback
  • eaa35fa Blocked extraction from writing through symlinks inside the target
  • 1e015e3 Increment version
  • 05101d4 Rejected archives with duplicate entry names
  • 4916006 Enforced the decompression size cap on the async path and for size 0
  • 6a63c33 Stripped setuid/setgid/sticky bits from extracted file permissions
  • Additional commits viewable in compare view

Updates katex from 0.18.1 to 0.18.7

Release notes

Sourced from katex's releases.

v0.18.7

0.18.7 (2026-09-06)

Features

v0.18.6

0.18.6 (2026-09-05)

Bug Fixes

  • array: preserve tags on empty final rows (#4277) (02d552c)

v0.18.5

0.18.5 (2026-08-31)

Bug Fixes

v0.18.4

0.18.4 (2026-08-10)

Bug Fixes

v0.18.3

0.18.3 (2026-08-09)

Bug Fixes

v0.18.2

0.18.2 (2026-08-08)

Bug Fixes

Changelog

Sourced from katex's changelog.

0.18.7 (2026-09-06)

Features

0.18.6 (2026-09-05)

Bug Fixes

  • array: preserve tags on empty final rows (#4277) (02d552c)

0.18.5 (2026-08-31)

Bug Fixes

0.18.4 (2026-08-10)

Bug Fixes

0.18.3 (2026-08-09)

Bug Fixes

0.18.2 (2026-08-08)

Bug Fixes

Commits
  • cd5ec4f chore(release): 0.18.7 [ci skip]
  • ab509fd feat: add \reflectbox and \mapsfrom support (#4262)
  • 9eb45b7 chore(release): 0.18.6 [ci skip]
  • 02d552c fix(array): preserve tags on empty final rows (#4277)
  • 49904aa chore(deps): update dependency browserslist to v4.28.7 [security] (#4280)
  • 2d2a177 chore(deps): bump github/codeql-action from 4.37.8 to 4.37.9 (#4275)
  • 7f46076 chore(release): 0.18.5 [ci skip]
  • 6805538 fix(char): accept U+10FFFF (#4265)
  • 0df23bb chore(deps): bump github/codeql-action from 4.37.7 to 4.37.8 (#4273)
  • bd78fad chore(deps): update dependency commander to v15 (#4271)
  • Additional commits viewable in compare view

Updates open from 11.0.0 to 11.0.3

Release notes

Sourced from open's releases.

v11.0.3

  • Fix Windows launches being killed when the parent process exits 734b821

sindresorhus/open@v11.0.2...v11.0.3

v11.0.2

  • Update dependencies 6f006ad

sindresorhus/open@v11.0.1...v11.0.2

v11.0.1

  • Fix WSL failure when the working directory is unreachable from Windows 6ac3fe4

sindresorhus/open@v11.0.0...v11.0.1

Commits

Updates pdfjs-dist from 6.2.108 to 6.3.289

Release notes

Sourced from pdfjs-dist's releases.

v6.3.289

This release contains improvements for accessibility, annotation editing, annotation rendering, font conversion, image decoding, performance, text selection and the viewer.

Changes since v6.2.108

... (truncated)

Commits
  • 1c8020a Merge pull request #21841 from Snuffleupagus/src-core-misc-fixes
  • 67c035f Inline the PDFDocument.prototype._parseHasJSActions method
  • c58a275 Move some WorkerTask class field definitions out of the constructor
  • d1725ab Merge pull request #21837 from Snuffleupagus/rm-ColorSpace-getoutputlength
  • 159dca9 Remove the unused getOutputLength method from the ColorSpace classes (PR ...
  • 8801a6a Merge pull request #21835 from Snuffleupagus/getViewerPreferences-tests
  • 08a0600 Merge pull request #21834 from Snuffleupagus/markInfo-Map
  • 2895922 Improve unit-test coverage for the getViewerPreferences functionality
  • 16b94d1 [api-minor] Convert markInfo to return data in a Map
  • c3257df Merge pull request #21833 from mozilla/update-locales
  • Additional commits viewable in compare view

Updates playwright from 1.62.0 to 1.63.0

Release notes

Sourced from playwright's releases.

v1.63.0

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock. Tests that share a lock name never run concurrently, across files, workers and projects, while everything else keeps running in parallel:

test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});

A test can hold multiple locks, and test.describe() accepts a lock for the whole group. Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the subtree, so you no longer need to locate the iframe first:

// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();

The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended replacement for the :visible CSS pseudo-class:

await page.locator('button').visible().click();

🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments, and test.step() accepts subtitle and params options for your own steps:

await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });

Reporters receive them via testStep.subtitle and testStep.params. For Playwright API

... (truncated)

Commits
  • 1b025d7 chore: mark v1.63.0 (#42569)
  • 0b9956d cherry-pick(#42568): docs(test): mark test.step subtitle option as since v1.63
  • 13dbf10 cherry-pick(#42552): docs: release notes for v1.63
  • e93b64e cherry-pick(#42566): feat(test): add subtitle option to test.step (#42567)
  • 2b7a5f2 test: response.body() for content-encoding:identity (#42537)
  • 648a67c fix(mcp): create parent directories for explicitly named files (#42540)
  • 7894f56 docs(mcp): clarify how tool file names are resolved (#42538)
  • 52900a1 devops: restore npm publishing from GitHub Actions (#42550)
  • 8c47f59 docs(csharp): fix nonexistent method names in guide examples (#42507)
  • bd6e552 chore(video): emit frames with real timestamps, drop frame number quantizatio...
  • Additional commits viewable in compare view

Updates texlyre-busytex from 1.2.3 to 1.4.0

Release notes

Sourced from texlyre-busytex's releases.

BusyTeX Assets v1.4.0

TeX Live 2026 Complete BusyTeX WASM assets archive

BusyTeX Assets v1.3.1

TeX Live 2026 Complete BusyTeX WASM assets archive

BusyTeX Assets v1.3.0

TeX Live 2026 Complete BusyTeX WASM assets archive

Commits
  • 1d9ba82 Added biber support
  • c202309 Fixed busytex assets to load correct paths from server
  • 01225ff Reference by font names now supported
  • See full diff in compare view

Updates tsx from 4.23.1 to 4.23.13

Release notes

Sourced from tsx's releases.

v4.23.13

4.23.13 (2026-08-30)

Bug Fixes

  • cache: bound shared transform cache memory (#835) (28e1f12)

This release is also available on:

v4.23.12

4.23.12 (2026-08-10)

Bug Fixes

  • shim import.meta when tokens are split by comments or newlines (#829) (ed9d330), closes #828

This release is also available on:

v4.23.11

4.23.11 (2026-08-07)

Bug Fixes

  • preserve async ESM require fallback (55cbece)

This release is also available on:

v4.23.10

4.23.10 (2026-08-07)

Bug Fixes

This release is also available on:

v4.23.9

4.23.9 (2026-08-06)

... (truncated)

Commits
  • 28e1f12 fix(cache): bound shared transform cache memory (#835)
  • ed9d330 fix: shim import.meta when tokens are split by comments or newlines (#829)
  • 651f5be test: cover CommonJS TypeScript import.meta paths
  • bd3bc64 test: cover CommonJS loader source fallback
  • 55cbece fix: preserve async ESM require fallback
  • 6c5ba85 docs: document CommonJS default interop
  • ec1bcd5 fix: support nyc coverage discovery (#710)
  • b6e5b48 docs: clarify CommonJS default imports
  • 2f55884 fix: map Node test locations
  • de935d5 docs: document Node source-map stack formatting
  • Additional commits viewable in compare view

Updates ws from 8.21.1 to 8.21.3

Release notes

Sourced from ws's releases.

8.21.3

Bug fixes

  • The server now correctly rejects permessage-deflate offers if the incoming client_max_window_bits parameter value is smaller than its configured clientMaxWindowBits (e97a20ea).

8.21.2

Bug fixes

  • Fixed a test for CITGM (2eb3be0b).
Commits
  • c791e70 [dist] 8.21.3
  • e97a20e [fix] Reject offers with client_max_window_bits below config
  • 787ebf2 [dist] 8.21.2
  • b4d62eb Revert "[ci] Trust Coveralls Homebrew tap"
  • e4bb883 [security] Use GitHub PVR as main reporting channel
  • 2eb3be0 [test] Skip test on Node.js versions where it does not apply
  • See full diff in compare view

Updates zod from 4.4.3 to 4.6.4

Release notes

Sourced from zod's releases.

v4.6.4

A patch on top of 4.6.3.

  • d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)
  • ad32d751 perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#6588)
  • 2bb08717 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
  • f6e1701a chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)

v4.6.3

A patch on top of 4.6.2.

  • 413cce9a fix(v4): make z.properties() a check again (#6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged
  • 75d63ee1 docs: show only the .properties() method form in the 4.6 post
  • 46da9572 docs: match the error-message examples to what the parsers emit

v4.6.2

A patch on top of 4.6.1.

v4.6.1

A patch on top of 4.6.0.

v4.6.0

Zod 4.6 is now available.

npm install zod@latest

At a glance:

  • .validate() — checks input validity without building a result (up to 35x faster than .safeParse().success on a compiled schema)
  • z.instanceof().properties() — validates properties of an instance
  • fromJSONSchema() — enforces six validation keywords it used to ignore
  • z.iban() — electronic-format IBAN plus mod-97 checksum
  • z.withParser() — installs a parser generated elsewhere, for environments without new Function
  • Faster CommonJS — drops the getter on every export (~3x faster z.validate() under require)
  • Memory retention in recursive schemas — releases the parsed input, fixing a 4.5 out-of-memory regression
  • @zod/mini — Zod Mini as a standalone package, versioned in lockstep with zod since 4.5

.validate()

... (truncated)

Commits
  • 2bb0871 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
  • 743aedb 4.6.4
  • f6e1701 chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)
  • d6bc1e3 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by...
  • ad32d75 perf: reduce validation and schema allocation overhead (#6588)
  • 12e6272 4.6.3
  • 413cce9 fix(v4): make z.properties() a check again (#6594)
  • 75d63ee docs: show only the .properties() method form in the 4.6 post
  • 46da957 docs: match the error-message examples to what the parsers emit
  • e359f73 4.6.2
  • Additional commits viewable in compare view

@dependabot @github

dependabot Bot commented on behalf of github Sep 16, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/runtime-609af65d03 branch 2 times, most recently from a9e792a to 2b15954 Compare September 16, 2026 07:26
@dependabot
deps(deps): bump the runtime group across 1 directory with 10 updates
20a4c6d 
Bumps the runtime group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.29.0` | `1.30.0` |
| [adm-zip](https://github.com/cthackers/adm-zip) | `0.6.0` | `0.6.1` |
| [katex](https://github.com/KaTeX/KaTeX) | `0.18.1` | `0.18.7` |
| [open](https://github.com/sindresorhus/open) | `11.0.0` | `11.0.3` |
| [pdfjs-dist](https://github.com/mozilla/pdf.js) | `6.2.108` | `6.3.289` |
| [playwright](https://github.com/microsoft/playwright) | `1.62.0` | `1.63.0` |
| [texlyre-busytex](https://github.com/TeXlyre/texlyre-busytex) | `1.2.3` | `1.4.0` |
| [tsx](https://github.com/privatenumber/tsx) | `4.23.1` | `4.23.13` |
| [ws](https://github.com/websockets/ws) | `8.21.1` | `8.21.3` |
| [zod](https://github.com/colinhacks/zod) | `4.4.3` | `4.6.4` |



Updates `@modelcontextprotocol/sdk` from 1.29.0 to 1.30.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@v1.29.0...1.30.0)

Updates `adm-zip` from 0.6.0 to 0.6.1
- [Release notes](https://github.com/cthackers/adm-zip/releases)
- [Changelog](https://github.com/cthackers/adm-zip/blob/master/history.md)
- [Commits](cthackers/adm-zip@v0.6.0...v0.6.1)

Updates `katex` from 0.18.1 to 0.18.7
- [Release notes](https://github.com/KaTeX/KaTeX/releases)
- [Changelog](https://github.com/KaTeX/KaTeX/blob/main/CHANGELOG.md)
- [Commits](KaTeX/KaTeX@v0.18.1...v0.18.7)

Updates `open` from 11.0.0 to 11.0.3
- [Release notes](https://github.com/sindresorhus/open/releases)
- [Commits](sindresorhus/open@v11.0.0...v11.0.3)

Updates `pdfjs-dist` from 6.2.108 to 6.3.289
- [Release notes](https://github.com/mozilla/pdf.js/releases)
- [Commits](mozilla/pdf.js@v6.2.108...v6.3.289)

Updates `playwright` from 1.62.0 to 1.63.0
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.62.0...v1.63.0)

Updates `texlyre-busytex` from 1.2.3 to 1.4.0
- [Release notes](https://github.com/TeXlyre/texlyre-busytex/releases)
- [Commits](TeXlyre/texlyre-busytex@assets-v1.2.3...assets-v1.4.0)

Updates `tsx` from 4.23.1 to 4.23.13
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.23.1...v4.23.13)

Updates `ws` from 8.21.1 to 8.21.3
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.21.1...8.21.3)

Updates `zod` from 4.4.3 to 4.6.4
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.4.3...v4.6.4)

---
updated-dependencies:
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime
- dependency-name: adm-zip
  dependency-version: 0.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: runtime
- dependency-name: katex
  dependency-version: 0.18.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: runtime
- dependency-name: open
  dependency-version: 11.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: runtime
- dependency-name: pdfjs-dist
  dependency-version: 6.3.289
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime
- dependency-name: playwright
  dependency-version: 1.63.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime
- dependency-name: texlyre-busytex
  dependency-version: 1.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime
- dependency-name: tsx
  dependency-version: 4.23.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: runtime
- dependency-name: ws
  dependency-version: 8.21.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: runtime
- dependency-name: zod
  dependency-version: 4.6.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/runtime-609af65d03 branch from 2b15954 to 20a4c6d Compare September 16, 2026 07:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants