[dependabot]

Bumps the npm-production group with 3 updates in the / directory: js-yaml, mqtt and zod.

Updates js-yaml from 5.4.3 to 5.5.0

Changelog

Sourced from js-yaml's changelog.

[5.5.0] - 2026-10-16

Changed

• Updated argparse to v3.
• Updated development dependencies.

Fixed

• Correct percent-encoding of shorthand and verbatim tags.
• Reject ,, ], and } at the start of block plain scalars, #801.
• Report the exact position of non-printable characters in errors, #801.

Commits

• cb62b2d 5.5.0 released
• 87aed90 Deps bump
• 3aec511 Fix error positions for non-printable characters, #801
• 11aa483 Reject flow indicators at the start of block plain scalars, #801
• 339d8e0 Refactor tag encoder and decoder to match the YAML specification
• See full diff in compare view

Updates mqtt from 5.16.0 to 5.16.1

Release notes

Sourced from mqtt's releases.

Release 5.16.1

5.16.1 (2026-10-14)

Bug Fixes

• reconnect instead of ending a client whose stream is already destroyed (#2068) (569bb31)
• schedule browser process.nextTick with queueMicrotask (#2056) (648b79c), closes #2074

Changelog

Sourced from mqtt's changelog.

5.16.1 (2026-10-14)

Bug Fixes

• reconnect instead of ending a client whose stream is already destroyed (#2068) (569bb31)
• schedule browser process.nextTick with queueMicrotask (#2056) (648b79c), closes #2074

Commits

• 66a9708 chore(release): 5.16.1
• 569bb31 fix: reconnect instead of ending a client whose stream is already destroyed (...
• 648b79c fix: schedule browser process.nextTick with queueMicrotask (#2056)
• See full diff in compare view

Updates zod from 4.6.5 to 4.6.7

Release notes

Sourced from zod's releases.

v4.6.7

Commits:

• b500a2ee95134f81d74da7911d7378dd2853d042 4.6.7

v4.6.6

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243fb, the pre-rewrite copy of 9c219833 with identical contents.

Commits:

• 0cd3af5e9f50ad11bbcd4407a46a21b8848ba574 docs: load the en locale directly in Zod Mini
• 9d5e60f162997b764b40d45aa02481888db50dea docs: import locales from zod/locales, not z.locales
• 34a626f307871ecbb0123947559328dc52ed5e3e docs: tighten the z.locales tree-shaking note
• 74304ce5b5796b5edb9a88ceb8e170b6ea3e82df release: stage npm versions instead of publishing them (#6622)
• b2ef983e0711ff6517d6020b021071e2e5653efa docs: add Code for Japan to bronze sponsors
• 8fb2faf0584828a6a027d8279db36f6f52784462 docs: crop the Code for Japan logo and list it first in bronze
• bacad518c41610d654658172d325874bf0ee6290 docs: square the Code for Japan logo to match the other bronze tiles
• c42596bd1c87e941d7241d10e012c5c196adcc10 release: hold the run on the release-approval environment until the staged versions are approved (#6638)
• a2ba4a67986a3e6b2b131be30084a2f460d9ea67 fix(types): declare record output and input as members, not base type arguments (#6645)
• a0ebf970f2d752e5f58527cd2942ff48be4f46bd fix(v4): check array, set and map size bounds before parsing elements (#6652)
• 529f78dd9431b07f49647fee3aa0819b3f8b66b7 4.6.6
• 9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 ci: stage at verbose so a failed OIDC token exchange says why

Commits

• b500a2e 4.6.7
• 9c21983 ci: stage at verbose so a failed OIDC token exchange says why
• 529f78d 4.6.6
• a0ebf97 fix(v4): check array, set and map size bounds before parsing elements (#6652)
• a2ba4a6 fix(types): declare record output and input as members, not base type argumen...
• c42596b release: hold the run on the release-approval environment until the staged ve...
• bacad51 docs: square the Code for Japan logo to match the other bronze tiles
• 8fb2faf docs: crop the Code for Japan logo and list it first in bronze
• b2ef983 docs: add Code for Japan to bronze sponsors
• 74304ce release: stage npm versions instead of publishing them (#6622)
• Additional commits viewable in compare view

[github-actions]

🔍 Manual review required

This PR updates:

• Dependencies: js-yaml, mqtt, zod
• Type: direct:production
• Update: version-update:semver-minor

Reason: Production dependency

Please review the changes carefully before merging.

Checklist:

• Check breaking changes in changelog
• Review migration guide (if applicable)
• Verify tests pass
• Consider impact on production code

[pkg-pr-new]

Open in StackBlitz

@ya-modbus/cli

npm i https://pkg.pr.new/@ya-modbus/cli@662

@ya-modbus/device-profiler

npm i https://pkg.pr.new/@ya-modbus/device-profiler@662

@ya-modbus/driver-dds024mr

npm i https://pkg.pr.new/@ya-modbus/driver-dds024mr@662

@ya-modbus/driver-dds519mr

npm i https://pkg.pr.new/@ya-modbus/driver-dds519mr@662

@ya-modbus/driver-ex9em

npm i https://pkg.pr.new/@ya-modbus/driver-ex9em@662

@ya-modbus/driver-loader

npm i https://pkg.pr.new/@ya-modbus/driver-loader@662

@ya-modbus/driver-or-we-514

npm i https://pkg.pr.new/@ya-modbus/driver-or-we-514@662

@ya-modbus/driver-or-we-516

npm i https://pkg.pr.new/@ya-modbus/driver-or-we-516@662

@ya-modbus/driver-sdk

npm i https://pkg.pr.new/@ya-modbus/driver-sdk@662

@ya-modbus/driver-sdm630

npm i https://pkg.pr.new/@ya-modbus/driver-sdm630@662

@ya-modbus/driver-types

npm i https://pkg.pr.new/@ya-modbus/driver-types@662

@ya-modbus/driver-xymd1

npm i https://pkg.pr.new/@ya-modbus/driver-xymd1@662

@ya-modbus/emulator

npm i https://pkg.pr.new/@ya-modbus/emulator@662

@ya-modbus/mqtt-bridge

npm i https://pkg.pr.new/@ya-modbus/mqtt-bridge@662

@ya-modbus/transport

npm i https://pkg.pr.new/@ya-modbus/transport@662

ya-modbus

npm i https://pkg.pr.new/ya-modbus@662

ya-modbus-bridge

npm i https://pkg.pr.new/ya-modbus-bridge@662

ya-modbus-emulator

npm i https://pkg.pr.new/ya-modbus-emulator@662

ya-modbus-profile

npm i https://pkg.pr.new/ya-modbus-profile@662

commit: 97eee61

[github-actions]

🔍 Manual review required

This PR updates:

• Dependencies: js-yaml, mqtt, zod
• Type: direct:production
• Update: version-update:semver-minor

Reason: Production dependency

Please review the changes carefully before merging.

Checklist:

• Check breaking changes in changelog
• Review migration guide (if applicable)
• Verify tests pass
• Consider impact on production code

[github-actions]

🔍 Manual review required

This PR updates:

• Dependencies: js-yaml, mqtt, zod
• Type: direct:production
• Update: version-update:semver-minor

Reason: Production dependency

Please review the changes carefully before merging.

Checklist:

• Check breaking changes in changelog
• Review migration guide (if applicable)
• Verify tests pass
• Consider impact on production code

[groupsky]

Merged at night by the hq-jobs job dependabot-merge, after the review in #677 (comment) and green CI.