Skip to content

📦 Bump the all-dependencies group across 1 directory with 7 updates#16277

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/main/all-dependencies-89cb61c47f
Open

📦 Bump the all-dependencies group across 1 directory with 7 updates#16277
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/main/all-dependencies-89cb61c47f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 22, 2026 •
edited by microsoft-github-policy-service Bot
Loading

Copy link
Copy Markdown
Contributor

Bumps the all-dependencies group with 7 updates in the / directory:

Package From To
lage 2.15.12 2.15.13
@types/react 19.2.16 19.2.17
semver 7.8.2 7.8.5
@microsoft/1ds-core-js 4.4.1 4.4.2
@microsoft/1ds-post-js 4.4.1 4.4.2
@microsoft/api-extractor 7.58.7 7.58.9
memfs 4.57.6 4.57.8

Updates lage from 2.15.12 to 2.15.13

Commits

Updates @types/react from 19.2.16 to 19.2.17

Commits

Updates semver from 7.8.2 to 7.8.5

Release notes

Sourced from semver's releases.

v7.8.5

7.8.5 (2026-06-19)

Bug Fixes

v7.8.4

7.8.4 (2026-06-09)

Bug Fixes

v7.8.3

7.8.3 (2026-06-08)

Bug Fixes

Chores

Changelog

Sourced from semver's changelog.

7.8.5 (2026-06-19)

Bug Fixes

7.8.4 (2026-06-09)

Bug Fixes

7.8.3 (2026-06-08)

Bug Fixes

Chores

Commits
  • 6e05b76 chore: release 7.8.5 (#879)
  • 9c8692a fix: include prereleases in tilde range lower bound with includePrerelease (#...
  • 8640bd6 chore: release 7.8.4 (#875)
  • e583226 fix: reject numeric segments after x-ranges
  • 6b77aa8 chore: release 7.8.3 (#873)
  • 3485dda chore: bump @​npmcli/eslint-config from 6.0.1 to 7.0.0 (#866)
  • 046da7f fix: align caret includePrerelease lower bounds (#872)
  • See full diff in compare view

Updates @microsoft/1ds-core-js from 4.4.1 to 4.4.2

Changelog

Sourced from @​microsoft/1ds-core-js's changelog.

Releases

Note: ES3/IE8 compatibility will be removed in the future v3.x.x releases (scheduled for mid-late 2022), so if you need to retain ES3 compatibility you will need to remain on the 2.x.x versions of the SDK or your runtime will need install polyfill's to your ES3 environment before loading / initializing the SDK.

3.4.2 (June 18th, 2026)

This is a maintenance release for the 3.4.x version line containing security hardening, bug fixes, build tooling improvements, and CI updates. The @microsoft/1ds-post-js channel is numbered 4.4.2 and requires v3.4.2.

Significant Changes (since 3.4.1)

  • Prototype Pollution Hardening: The extend() and objExtend() helpers now filter unsafe keys (__proto__, constructor, prototype) to prevent prototype pollution when merging untrusted objects.

  • Dependency Vulnerability Resolution: Migrated the repository from npm to pnpm for dependency management and resolved all known dependency vulnerabilities. This is a build/tooling change and does not affect the published runtime packages.

  • OsPlugin Field Name Correction: The OsPlugin now emits the correct Common Schema 4.0 field names (ext.os.name and ext.os.ver). Telemetry consumers relying on the previously emitted (incorrect) field names should update to the corrected names.

  • RequestEnvelopeCreator Envelope Name Fix: Fixed RequestEnvelopeCreator so request telemetry is sent with the correct envelope name (Microsoft.ApplicationInsights.{ikey}.Request) instead of RequestData.

  • Offline Channel Reliability: Fixed a missing return after reject() in the offline channel that could lead to a null provider dereference.

  • Fixed [INVALID_ANNOTATION] warnings in Rolldown / Vite 8 consumers (#2736): The per-module dist-es5 output (the package module entry that modern bundlers import) emitted parenthesized PURE tree-shaking annotations with whitespace after the opening parenthesis (e.g. ( /*#__PURE__*/"http.")), which stricter bundlers such as Rolldown (Vite 8) rejected. The build now canonicalizes these annotations to the flush form ((/*#__PURE__*/"http.")) in the dist-es5 output, accepted by all bundlers while preserving the wrapping parentheses required for older Rollup / Webpack / Terser to tree-shake the constants. This complements #2737, which only normalized the rollup-bundled dist/es5 (main) output.

CI / Tooling

  • Dropped Node.js 16 from CI matrix: Node.js 16 is End-of-Life and several dependencies (e.g. puppeteer, @pnpm/error) now require Node.js 18 or later. The CI pipeline no longer runs against Node.js 16.
  • Added Node.js 22 and 24 to CI matrix: The CI pipeline now tests against Node.js 18, 20, 22, and 24.
  • Migrated from npm to pnpm: Dependency management now uses pnpm.

Changelog

  • #2733 fix: Migrate from npm to pnpm and resolve all dependency vulnerabilities
  • #2742 fix(ci): repair Node.js CI (Chrome install, bundle-size limits, ts-async offline-channel hang)
  • #2737 fix: remove invalid PURE literal annotations and add bundle validation tests
  • #2736 fix: canonicalize PURE annotations in dist-es5 (module) output to fix Rolldown/Vite 8 [INVALID_ANNOTATION] warnings
  • #2735 fix: prevent prototype pollution in extend() and objExtend() via unsafe key filtering
  • #2734 fix(offline-channel): Add missing return after reject() to prevent null provider dereference
  • #2732 fix(OsPlugin): use correct CS 4.0 field names ext.os.name and ext.os.ver
  • #2731 Drop Node.js 16 from CI matrix; add Node.js 22 and 24
  • #2729 Potential fix for code scanning alert no. 2273: Workflow does not contain permissions
  • #2728 Potential fix for code scanning alert no. 5940: Unused variable, import, function or class
  • #2727 Potential fix for code scanning alert no. 5402: Semicolon insertion
  • #2726 Potential fix for code scanning alert no. 5401: Unused variable, import, function or class
  • #2725 Potential fix for code scanning alert no. 4240: Semicolon insertion
  • #2724 fix: RequestEnvelopeCreator sends "RequestData" as envelope name instead of "Microsoft.ApplicationInsights.{ikey}.Request"
  • #2722 Update Components
  • #2721 Add CfgSync documentation

Full Changelog: microsoft/ApplicationInsights-JS@3.4.1...3.4.2

... (truncated)

Commits

Updates @microsoft/1ds-post-js from 4.4.1 to 4.4.2

Changelog

Sourced from @​microsoft/1ds-post-js's changelog.

Releases

Note: ES3/IE8 compatibility will be removed in the future v3.x.x releases (scheduled for mid-late 2022), so if you need to retain ES3 compatibility you will need to remain on the 2.x.x versions of the SDK or your runtime will need install polyfill's to your ES3 environment before loading / initializing the SDK.

3.4.2 (June 18th, 2026)

This is a maintenance release for the 3.4.x version line containing security hardening, bug fixes, build tooling improvements, and CI updates. The @microsoft/1ds-post-js channel is numbered 4.4.2 and requires v3.4.2.

Significant Changes (since 3.4.1)

  • Prototype Pollution Hardening: The extend() and objExtend() helpers now filter unsafe keys (__proto__, constructor, prototype) to prevent prototype pollution when merging untrusted objects.

  • Dependency Vulnerability Resolution: Migrated the repository from npm to pnpm for dependency management and resolved all known dependency vulnerabilities. This is a build/tooling change and does not affect the published runtime packages.

  • OsPlugin Field Name Correction: The OsPlugin now emits the correct Common Schema 4.0 field names (ext.os.name and ext.os.ver). Telemetry consumers relying on the previously emitted (incorrect) field names should update to the corrected names.

  • RequestEnvelopeCreator Envelope Name Fix: Fixed RequestEnvelopeCreator so request telemetry is sent with the correct envelope name (Microsoft.ApplicationInsights.{ikey}.Request) instead of RequestData.

  • Offline Channel Reliability: Fixed a missing return after reject() in the offline channel that could lead to a null provider dereference.

  • Fixed [INVALID_ANNOTATION] warnings in Rolldown / Vite 8 consumers (#2736): The per-module dist-es5 output (the package module entry that modern bundlers import) emitted parenthesized PURE tree-shaking annotations with whitespace after the opening parenthesis (e.g. ( /*#__PURE__*/"http.")), which stricter bundlers such as Rolldown (Vite 8) rejected. The build now canonicalizes these annotations to the flush form ((/*#__PURE__*/"http.")) in the dist-es5 output, accepted by all bundlers while preserving the wrapping parentheses required for older Rollup / Webpack / Terser to tree-shake the constants. This complements #2737, which only normalized the rollup-bundled dist/es5 (main) output.

CI / Tooling

  • Dropped Node.js 16 from CI matrix: Node.js 16 is End-of-Life and several dependencies (e.g. puppeteer, @pnpm/error) now require Node.js 18 or later. The CI pipeline no longer runs against Node.js 16.
  • Added Node.js 22 and 24 to CI matrix: The CI pipeline now tests against Node.js 18, 20, 22, and 24.
  • Migrated from npm to pnpm: Dependency management now uses pnpm.

Changelog

  • #2733 fix: Migrate from npm to pnpm and resolve all dependency vulnerabilities
  • #2742 fix(ci): repair Node.js CI (Chrome install, bundle-size limits, ts-async offline-channel hang)
  • #2737 fix: remove invalid PURE literal annotations and add bundle validation tests
  • #2736 fix: canonicalize PURE annotations in dist-es5 (module) output to fix Rolldown/Vite 8 [INVALID_ANNOTATION] warnings
  • #2735 fix: prevent prototype pollution in extend() and objExtend() via unsafe key filtering
  • #2734 fix(offline-channel): Add missing return after reject() to prevent null provider dereference
  • #2732 fix(OsPlugin): use correct CS 4.0 field names ext.os.name and ext.os.ver
  • #2731 Drop Node.js 16 from CI matrix; add Node.js 22 and 24
  • #2729 Potential fix for code scanning alert no. 2273: Workflow does not contain permissions
  • #2728 Potential fix for code scanning alert no. 5940: Unused variable, import, function or class
  • #2727 Potential fix for code scanning alert no. 5402: Semicolon insertion
  • #2726 Potential fix for code scanning alert no. 5401: Unused variable, import, function or class
  • #2725 Potential fix for code scanning alert no. 4240: Semicolon insertion
  • #2724 fix: RequestEnvelopeCreator sends "RequestData" as envelope name instead of "Microsoft.ApplicationInsights.{ikey}.Request"
  • #2722 Update Components
  • #2721 Add CfgSync documentation

Full Changelog: microsoft/ApplicationInsights-JS@3.4.1...3.4.2

... (truncated)

Commits

Updates @microsoft/api-extractor from 7.58.7 to 7.58.9

Changelog

Sourced from @​microsoft/api-extractor's changelog.

7.58.9

Sat, 13 Jun 2026 00:16:18 GMT

Version update only

7.58.8

Mon, 08 Jun 2026 15:15:49 GMT

Patches

  • Add support for new d.ts extension format when using TS moduleResolution 'bundler' or 'nodenext'.
Commits
  • b6a0df8 Bump versions [skip ci]
  • 8c28c0d Update changelogs [skip ci]
  • 2a07c93 chore: bump decoupled local dependencies (#5825)
  • 89cbc56 Bump versions [skip ci]
  • 4a6de47 Update changelogs [skip ci]
  • 0310914 [api-extractor] Add support for new TS declaration format when using module r...
  • fde6ed5 Fix: syntax error in resulting d.ts file (#5799)
  • 2b7c453 chore: bump decoupled local dependencies (#5790)
  • See full diff in compare view

Updates memfs from 4.57.6 to 4.57.8

Release notes

Sourced from memfs's releases.

Release v4.57.8

What's Changed

New Contributors

Full Changelog: streamich/memfs@v4.57.7...v4.57.8

Release v4.57.7

What's Changed

Full Changelog: streamich/memfs@v4.57.6...v4.57.7

Commits
  • 29b912b chore: release v4.57.8
  • b5c6c62 Merge pull request #1261 from chatman-media/fix/truncate-negative-length-memo...
  • f2be1ce fix: 🐛 clamp negative truncate length to zero
  • bbcc695 chore: release v4.57.7
  • c67f51e Merge pull request #1260 from streamich/snapshot-fix
  • d20c3e9 fix: 🐛 do not allow relative paths in snapshot restoration
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
###### Microsoft Reviewers: [Open in CodeFlow](https://microsoft.github.io/open-pr/?codeflow=https://github.com//pull/16277)

@dependabot
📦 Bump the all-dependencies group across 1 directory with 7 updates
9bf662d 
Bumps the all-dependencies group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [lage](https://github.com/microsoft/lage) | `2.15.12` | `2.15.13` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.16` | `19.2.17` |
| [semver](https://github.com/npm/node-semver) | `7.8.2` | `7.8.5` |
| [@microsoft/1ds-core-js](https://github.com/microsoft/ApplicationInsights-JS) | `4.4.1` | `4.4.2` |
| [@microsoft/1ds-post-js](https://github.com/microsoft/ApplicationInsights-JS) | `4.4.1` | `4.4.2` |
| [@microsoft/api-extractor](https://github.com/microsoft/rushstack/tree/HEAD/apps/api-extractor) | `7.58.7` | `7.58.9` |
| [memfs](https://github.com/streamich/memfs) | `4.57.6` | `4.57.8` |



Updates `lage` from 2.15.12 to 2.15.13
- [Commits](microsoft/lage@lage_v2.15.12...lage_v2.15.13)

Updates `@types/react` from 19.2.16 to 19.2.17
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `semver` from 7.8.2 to 7.8.5
- [Release notes](https://github.com/npm/node-semver/releases)
- [Changelog](https://github.com/npm/node-semver/blob/main/CHANGELOG.md)
- [Commits](npm/node-semver@v7.8.2...v7.8.5)

Updates `@microsoft/1ds-core-js` from 4.4.1 to 4.4.2
- [Release notes](https://github.com/microsoft/ApplicationInsights-JS/releases)
- [Changelog](https://github.com/microsoft/ApplicationInsights-JS/blob/main/RELEASES.md)
- [Commits](https://github.com/microsoft/ApplicationInsights-JS/commits)

Updates `@microsoft/1ds-post-js` from 4.4.1 to 4.4.2
- [Release notes](https://github.com/microsoft/ApplicationInsights-JS/releases)
- [Changelog](https://github.com/microsoft/ApplicationInsights-JS/blob/main/RELEASES.md)
- [Commits](https://github.com/microsoft/ApplicationInsights-JS/commits)

Updates `@microsoft/api-extractor` from 7.58.7 to 7.58.9
- [Changelog](https://github.com/microsoft/rushstack/blob/main/apps/api-extractor/CHANGELOG.md)
- [Commits](https://github.com/microsoft/rushstack/commits/@microsoft/api-extractor_v7.58.9/apps/api-extractor)

Updates `memfs` from 4.57.6 to 4.57.8
- [Release notes](https://github.com/streamich/memfs/releases)
- [Changelog](https://github.com/streamich/memfs/blob/master/CHANGELOG.md)
- [Commits](streamich/memfs@v4.57.6...v4.57.8)

---
updated-dependencies:
- dependency-name: lage
  dependency-version: 2.15.13
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: "@types/react"
  dependency-version: 19.2.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: semver
  dependency-version: 7.8.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: "@microsoft/1ds-core-js"
  dependency-version: 4.4.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: "@microsoft/1ds-post-js"
  dependency-version: 4.4.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: "@microsoft/api-extractor"
  dependency-version: 7.58.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: memfs
  dependency-version: 4.57.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Jun 22, 2026
@dependabot dependabot Bot requested a review from a team as a code owner June 22, 2026 12:26
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Jun 22, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants