fix(deps): bump the production-dependencies group with 13 updates by dependabot[bot] · Pull Request #576 · iExecBlockchainComputing/iexec-sdk

dependabot · 2026-10-12T11:40:53Z

Bumps the production-dependencies group with 13 updates:

Package	From	To
@multiformats/multiaddr	`13.0.1`	`13.0.3`
bn.js	`5.2.3`	`5.2.5`
commander	`13.1.0`	`15.0.0`
fs-extra	`11.3.0`	`11.4.1`
graphql-request	`7.3.5`	`7.4.0`
inquirer	`13.1.0`	`14.2.3`
is-docker	`3.0.0`	`4.0.0`
jszip	`3.10.1`	`3.10.2`
kubo-rpc-client	`5.3.0`	`7.1.0`
multiformats	`13.4.2`	`14.0.5`
ora	`9.0.0`	`9.4.1`
semver	`7.7.3`	`7.8.5`
yup	`1.6.1`	`1.7.1`

Updates @multiformats/multiaddr from 13.0.1 to 13.0.3

Release notes

Sourced from @multiformats/multiaddr's releases.

v13.0.3

13.0.3 (2026-05-12)

Bug Fixes

export registry as interface instance (#437) (e80b489)

v13.0.2

13.0.2 (2026-05-12)

Trivial Changes

bump aegir from 47.2.0 to 48.0.4 (#435) (b9354d3)

Dependencies

bump multiformats from 13.4.2 to 14.0.0 (#432) (c21e208)

Changelog

Sourced from @multiformats/multiaddr's changelog.

13.0.3 (2026-05-12)

Bug Fixes

export registry as interface instance (#437) (e80b489)

13.0.2 (2026-05-12)

Trivial Changes

bump aegir from 47.2.0 to 48.0.4 (#435) (b9354d3)

Dependencies

bump multiformats from 13.4.2 to 14.0.0 (#432) (c21e208)

Commits

35cc0d9 chore(release): 13.0.3 [skip ci]
e80b489 fix: export registry as interface instance (#437)
cab9066 chore(release): 13.0.2 [skip ci]
c21e208 deps: bump multiformats from 13.4.2 to 14.0.0 (#432)
b9354d3 chore: bump aegir from 47.2.0 to 48.0.4 (#435)
See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @multiformats/multiaddr since your current version.

Updates bn.js from 5.2.3 to 5.2.5

Changelog

Sourced from bn.js's changelog.

5.2.5 / 2026-07-09

fix: correct divRound rounding for negative operands (#320)

fix: normalize sign when imuln multiplies by zero (#321)

5.2.4 / 2026-06-26

fix: clear surplus words in inotn so notn(width) stays below 2 ** width (#319)

Commits

eb2e57c 5.2.5
73fb9a4 fix: correct divRound rounding for negative operands (#320)
dd84df8 fix: normalize sign when imuln multiplies by zero (#321)
96f2f81 5.2.4
dc3429f fix: clear surplus words in inotn so notn(width) stays below 2 ** width (#319)
See full diff in compare view

Updates commander from 13.1.0 to 15.0.0

Release notes

Sourced from commander's releases.

v15.0.0

Commander 15 is ESM only. This is expected to be seamless for ESM consumers, but some CommonJS consumers may hit issues with tooling requiring configuration for ESM-only dependencies. See Migration Tips below.

The release of Commander 15 moves Commander 14 into maintenance. Commander 14 will get security updates for 12 months (to May 2027). For more info see Release Policy.

Added

show excess command-arguments in error message (#2384)

Fixed

Breaking: only lone --no-* option sets default option value to true, default not implicitly set when define both positive and negative option in either order (#2405)

update example to use compatible character for MINGW64 (#2475)

Changed

Breaking: migrated Commander implementation from CommonJS to ESM (#2464)

Breaking: Commander 15 requires Node.js v22.12.0 or higher (for require(esm)).

dev: switch tests from Jest to node:test test runner (#2463)

Deleted

Breaking: removed deprecated export of commander/esm.mjs (#2464)

Migration Tips

Commander 15 is ESM only, but this does not mean you need to migrate to ESM to use it. Importing ESM from CommonJS is supported by Node.js, and Bun, and Deno. Hopefully it Just Works for you! However, you may be using a different runtime or some other part of your setup that may not yet natively support importing ESM from CommonJS, such as your testing framework or bundler.

If you have problems using Commander 15 in your environment, one option is stay on Commander 14 for now. Commander 14 will get security updates until May 2027 and things will hopefully improve for your setup in the meantime.

v15.0.0-0

Commander 15 is ESM only. This is expected to be seamless for ESM consumers, but some CommonJS consumers may hit issues with tooling requiring configuration for ESM-only dependencies. See Migration Tips below.

The release of Commander 15 in May 2026 will move Commander 14 into maintenance. Commander 14 will get security updates for 12 months (to May 2027). For more info see Release Policy.

Added

show excess command-arguments in error message (#2384)

Fixed

Breaking: only lone --no-* option sets default option value to true, default not implicitly set when define both positive and negative option in either order (#2405)

update example to use compatible character for MINGW64 (#2475)

... (truncated)

Changelog

Sourced from commander's changelog.

[15.0.0] (2026-05-29)

Commander 15 is ESM only. This is expected to be seamless for ESM consumers, but some CommonJS consumers may hit issues with tooling requiring configuration for ESM-only dependencies. See Migration Tips below.

The release of Commander 15 moves Commander 14 into maintenance. Commander 14 will get security updates for 12 months (to May 2027). For more info see Release Policy.

Added

show excess command-arguments in error message (#2384)

Fixed

Breaking: only lone --no-* option sets default option value to true, default not implicitly set when define both positive and negative option in either order (#2405)

update example to use compatible character for MINGW64 (#2475)

Changed

Breaking: migrated Commander implementation from CommonJS to ESM (#2464)

Breaking: Commander 15 requires Node.js v22.12.0 or higher (for require(esm)).

dev: switch tests from Jest to node:test test runner (#2463)

Deleted

Breaking: removed deprecated export of commander/esm.mjs (#2464)

Migration Tips

Commander 15 is ESM only, but this does not mean you need to migrate to ESM to use it. Importing ESM from CommonJS is supported by Node.js, and Bun, and Deno. Hopefully it Just Works for you! However, you may be using a different runtime or some other part of your setup that may not yet natively support importing ESM from CommonJS, such as your testing framework or bundler.

If you have problems using Commander 15 in your environment, one option is stay on Commander 14 for now. Commander 14 will get security updates until May 2027 and things will hopefully improve for your setup in the meantime.

[15.0.0-0] (2026-02-22)

(Released as 15.0.0)

[14.0.3] (2026-01-31)

Added

Release Policy document (#2462)

Changes

old major versions now supported for 12 months instead of just previous major version, to give predictable end-of-life date (#2462)

clarify typing for deprecated callback parameter to .outputHelp() (#2427)

... (truncated)

Commits

ba6d13d Fix release dates in changelog (#2523)
a752ed9 Pin GitHub actions with hash (#2521)
74d5dfe Drop EOL node 20 from test matrix, and add node 26 (#2520)
6df9b68 Update details for 15.0.0 release (#2519)
01ce5d0 Remove jest esm examples (#2517)
d785d8b Update dependencies (#2518)
9098b48 Update dependencies (#2506)
373f660 Use node:util stripVTControlCharacters instead of own code (#2486)
987f289 Use simple match in test (to avoid warning about expensive regex) (#2485)
0ea3bb3 Update dependecies and lint (#2489)
Additional commits viewable in compare view

Updates fs-extra from 11.3.0 to 11.4.1

Changelog

Sourced from fs-extra's changelog.

11.4.1 / 2026-09-22

Properly handle read errors (e.g. due to permissions) in emptyDir*() (#1080)

Allow renaming with only Unicode normalization difference in the filename (APFS-specific) (#859, #1079)

11.4.0 / 2026-07-23

Proper EEXIST error when trying to create a symlink and the dest already exists as a broken symlink (#925, #1076)

11.3.6 / 2026-06-29

Fix handling of symlinked destination ancestors in copy/move methods (#1071, #1073)

Docs typo fixed (#1074)

11.3.5 / 2026-05-06

Fix ensureLink*/ensureSymlink* identical file detection on Windows (#1068)

Fix error handling in timestamp preservation code (#1065, #1069)

Fix potential file descriptor leak on error in synchronous timestamp preservation code (#1066)

11.3.4 / 2026-03-03

Fix bug where calling ensureSymlink/ensureSymlinkSync with a relative srcPath would fail if the symlink already existed (#1038, #1064)

11.3.3 / 2025-12-18

Fix copying symlink when destination is a symlink to the same target (#1019, #1060)

11.3.2 / 2025-09-15

Fix spurrious UnhandledPromiseRejectionWarning that could occur when calling .copy() in some cases (#1056, #1058)

11.3.1 / 2025-08-05

Fix case where move/moveSync could incorrectly think files are identical on Windows (#1050)

Commits

1e223d3 11.4.1
8cfd0a0 Remove obsolete docs note
de72292 Treat Unicode-normalization-only renames like case-only renames (#1079)
7e0ce7f Remove broken link (#1083)
00e858c Update GH Actions versions (#1082)
f829cc9 fix: propagate emptyDir directory read errors (#1080)
53a8d1a 11.4.0
9c2d3c9 Throw EEXIST when ensureSymlink dest is a broken symlink (#1076)
62a4e72 11.3.6
01c0ca6 Fix copy/move recursing into source through a symlinked dest ancestor (#1073)
Additional commits viewable in compare view

Updates graphql-request from 7.3.5 to 7.4.0

Commits

9b8714c 7.4.0
42eeab1 Include original response in client errors (#1476)
See full diff in compare view

Updates inquirer from 13.1.0 to 14.2.3

Release notes

Sourced from inquirer's releases.

inquirer@14.2.3

What's new

Rolled up the prompt fixes from this release: search() stale-choice submission (#2291), confirm() always accepting y/n (#2281), expand()/rawlist() whitespace handling (#2280).

All package READMEs now document the Deno install command (#2269).

Dependencies

@inquirer/prompts bumped to ^8.7.3

@inquirer/core bumped to ^12.0.4

inquirer@14.2.2

The umbrella package, bundling @inquirer/prompts and @inquirer/core.

What's new

Fixed a race where keystrokes batched in the same tick as the key that settled a prompt could still reach keypress handlers after the prompt was done, cancelled, or aborted (@inquirer/core, #2255, closes #1816).

confirm() now trims surrounding whitespace from answers before matching yes/no keywords (@inquirer/confirm, #2254).

Included

@inquirer/core@^12.0.3

@inquirer/prompts@^8.7.2

inquirer@14.2.1

The umbrella package, bundling @inquirer/prompts and @inquirer/core.

What's new

Published manifests now pin @inquirer/type to an exact version. Since these type definitions leak into consumers' tsc runs, a semver range on the types-only dependency could break downstream TypeScript builds without any change to Inquirer.js itself (#2247, fixes #2244).

Included

@inquirer/core@^12.0.2

@inquirer/prompts@^8.7.1

@inquirer/type@4.1.1 (pinned exactly)

@inquirer/ansi@^2.0.8

inquirer@14.2.0

The umbrella package, bundling @inquirer/prompts and @inquirer/core.

What's new

Updated to @inquirer/prompts@^8.7.0 and @inquirer/core@^12.0.1.

Includes the new toggleMask option for password (ctrl+t to reveal), localized yes/no parsing for confirm, and prettified prompt/theme types for better IDE display.

... (truncated)

Commits

a9436bd chore(release): bump @inquirer/type range to ^4.2.0
61be5df chore: Publish new release
7dc77e2 fix(search): prevent submissions while the prompt is loading
73b5eab docs: document Deno installation (#2269)
79a092a ci: add Deno compatibility test suite (#2271)
148a96a chore: enable vitest fsModuleCache to persist transforms across runs
e928543 chore: bump yarn to 4.18.1 via corepack
2348c7b fix(external-editor): use BSD/GNU-compatible truncate flag in test
3c1fdb3 fix(confirm): always accept y/n and reject unrecognized input (#2281)
eae8b3e fix(expand, rawlist): ignore surrounding whitespace in answers (#2280)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for inquirer since your current version.

Updates is-docker from 3.0.0 to 4.0.0

Release notes

Sourced from is-docker's releases.

v4.0.0

Breaking

Require Node.js 20 edcf97d

Improvements

Improve detection 9f43d97

sindresorhus/is-docker@v3.0.0...v4.0.0

Commits

59379f1 4.0.0
edcf97d Require Node.js 20
9f43d97 Improve detection
5099821 Meta tweaks
1cfd2b5 Meta tweaks
See full diff in compare view

Updates jszip from 3.10.1 to 3.10.2

Changelog

Sourced from jszip's changelog.

v3.10.2 2026-09-09

Fix cross-realm binary type detection in getTypeOf. Fixes #759 (see #578)

Add missing types for JSZip.defaults. Fixes #690 (see #927)

Fix Blob support in Node.js 18 and up. Fixes #941 (see #955)

Commits

020fa33 Release preparation for 3.10.2 (#974)
d38fda5 Fix cross-realm binary type detection in getTypeOf (#578)
e682f9a Fix grunt build rebundling existing dist via browser field (#971)
5adef36 Add missing types for JSZip.defaults (#927)
41a1342 Fix blob support in Node.js 18 and up (#955)
643714a Move all continuous integration to GitHub Actions (#942)
418c11f Upgrade Playwright to the latest version (#940)
2ceb998 Create FUNDING.yml
See full diff in compare view

Maintainer changes

This version was pushed to npm by jkoops, a new releaser for jszip since your current version.

Updates kubo-rpc-client from 5.3.0 to 7.1.0

Release notes

Sourced from kubo-rpc-client's releases.

v7.1.0

7.1.0 (2026-06-09)

Features

support ReadableStream argument to dag.import (#290) (8871405), closes #278

Trivial Changes

remove @ts-expect-error comments (#366) (2758b84)

v7.0.0

7.0.0 (2026-05-13)

⚠ BREAKING CHANGES

CID instances are now from the multiformats@14.x.x module

Bug Fixes

update to multiformats 14 (#364) (a7e837d)

v6.1.0

6.1.0 (2026-01-23)

Features

add provide.stat command (#359) (072dc44)

Trivial Changes

add or force update .github/workflows/stale.yml (#351) (d4100db)

v6.0.2

6.0.2 (2025-10-14)

Dependencies

update ipfsd-ctl (#350) (ca8be85)

v6.0.1

6.0.1 (2025-10-14)

Documentation

update readme (562b223)

update readme (81fbc09)

v6.0.0

6.0.0 (2025-10-14)

... (truncated)

Commits

1e22af0 chore(release): 7.1.0 [skip ci]
8871405 feat: support ReadableStream argument to dag.import (#290)
2758b84 chore: remove @ts-expect-error comments (#366)
cee56cf chore(release): 7.0.0 [skip ci]
a7e837d fix!: update to multiformats 14 (#364)
428300a chore(release): 6.1.0 [skip ci]
072dc44 feat: add provide.stat command (#359)
d4100db chore: add or force update .github/workflows/stale.yml (#351)
44b04d6 chore(release): 6.0.2 [skip ci]
ca8be85 deps: update ipfsd-ctl (#350)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for kubo-rpc-client since your current version.

Updates multiformats from 13.4.2 to 14.0.5

Release notes

Sourced from multiformats's releases.

v14.0.5

14.0.5 (2026-07-23)

Bug Fixes

reject non-minimally encoded varints (#343) (8ada774)

v14.0.4

14.0.4 (2026-07-03)

Bug Fixes

allow specifying ByteView backing type (#342) (646249f)

v14.0.3

14.0.3 (2026-06-30)

Bug Fixes

constrain identity bytes to single characters (#338) (cb4eb32), closes #122

v14.0.2

14.0.2 (2026-06-24)

Bug Fixes

verify CID hash before decoding in Block.create (#340) (6784d3e), closes #339

v14.0.1

14.0.1 (2026-06-24)

Bug Fixes

case-insensitive decode for base16/base32/base36 (multibase spec) (#341) (ad87caa)

v14.0.0

14.0.0 (2026-05-07)

⚠ BREAKING CHANGES

all Hashers are now MultihashHasher<Code>s

Returned Uint8Arrays are now Uint8Array<ArrayBuffer>

Features

loading via require is now supported (#337) (9b5b12b)

Bug Fixes

identity hash is SyncMultihashHasher<0> (#337) (9b5b12b)

... (truncated)

Changelog

Sourced from multiformats's changelog.

14.0.5 (2026-07-23)

Bug Fixes

reject non-minimally encoded varints (#343) (8ada774)

14.0.4 (2026-07-03)

Bug Fixes

allow specifying ByteView backing type (#342) (646249f)

14.0.3 (2026-06-30)

Bug Fixes

constrain identity bytes to single characters (#338) (cb4eb32), closes #122

14.0.2 (2026-06-24)

Bug Fixes

verify CID hash before decoding in Block.create (#340) (6784d3e), closes #339

14.0.1 (2026-06-24)

Bug Fixes

case-insensitive decode for base16/base32/base36 (multibase spec) (#341) (ad87caa)

14.0.0 (2026-05-07)

⚠ BREAKING CHANGES

all Hashers are now MultihashHasher<Code>s

Returned Uint8Arrays are now Uint8Array<ArrayBuffer>

Bug Fixes

identity hash is SyncMultihashHasher<0> (#337) (9b5b12b), closes #313 #314

specify type of backing buffer when Uint8Arrays are returned (#335) (bac2da5)

Commits

0dcd129 chore(release): 14.0.5 [skip ci]
8ada774 fix: reject non-minimally encoded varints (#343)
6a65b8b chore(release): 14.0.4 [skip ci]
646249f fix: allow specifying ByteView backing type (#342)
079e760 chore(release): 14.0.3 [skip ci]
cb4eb32 fix: constrain identity bytes to single characters (#338)
1fa7547 chore(release): 14.0.2 [skip ci]
6784d3e fix: verify CID hash before decoding in Block.create (#340)
96407e3 chore(release): 14.0.1 [skip ci]
ad87caa fix: case-insensitive decode for base16/base32/base36 (multibase spec) (#341)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for multiformats since your current version.

Updates ora from 9.0.0 to 9.4.1

Release notes

Sourced from ora's releases.

v9.4.1

Fix type definitions (#257) 431ebc4

Fix failText type to accept unknown instead of Error, matching the actual promise rejection value bc3a283

sindresorhus/ora@v9.4.0...v9.4.1

v9.4.0

Add successSymbol and failSymbol options to oraPromise 3d2e0a9

sindresorhus/ora@v9.3.0...v9.4.0

v9.3.0

Reduce flicker in rendering 2ab4f76

sindresorhus/ora@v9.2.0...v9.3.0

v9.2.0

Update stdin-discarder dependency (#251) 020eaba

sindresorhus/ora@v9.1.0...v9.2.0

v9.1.0

Support external writes to stream (console.log) while spinning d2b543a

Replace strip-ansi dependency with native stripVTControlCharacters (#249) 68d50e5

sindresorhus/ora@v9.0.0...v9.1.0

Commits

79cd8c1 9.4.1
bc3a283 Minor tweaks
431ebc4 Fix type definitions (#257)
46a6703 9.4.0
3d2e0a9 Add successSymbol and failSymbol options to oraPromise
f70f613 Test tweaks
7cf29a7 Validate some options better
4496362 9.3.0
2ab4f76 Reduce flicker in rendering
8d17b13 Add FAQ item
Additional commits viewable in compare view

Updates semver from 7.7.3 to 7.8.5

Release notes

Sourced from semver's releases.

v7.8.5

7.8.5 (2026-06-19)

Bug Fixes

9c8692a #878 include prereleases in tilde range lower bound with includePrerelease (#878) (@chatman-media)

v7.8.4

7.8.4 (2026-06-09)

Bug Fixes

e583226 #874 reject numeric segments after x-ranges (@pupuking723)

v7.8.3

7.8.3 (2026-06-08)

Bug Fixes

046da7f #872 align caret includePrerelease lower bounds (#872) (@wayyoungboy)

Chores

3485dda #866 bump @npmcli/eslint-config from 6.0.1 to 7.0.0 (#866) (@dependabot[bot])

v7.8.2

7.8.2 (2026-06-04)

Bug Fixes

bea6028 #870 increment dotted prerelease identifiers (#870) (@liuzemei, @SheldonNeo)

v7.8.1

7.8.1 (2026-05-21)

Bug Fixes

17aa702 #869 strip build metadata before comparator trimming (#869) (@owlstronaut)

5f3ca13 #867 handle prerelease bounds in subset (#867) (@puneetdixit200, Puneet Dixit)

v7.8.0

7.8.0 (2026-05-08)

Features

0d0a0a2 #855 Add truncate function (#855) (@pjohnmeyer, @owlstronaut)

Bug Fixes

3905343 #859 Warn when defaulting to --inc=patch in CLI (@pjohnmeyer)

Documentation

c368af6 #853 fix typos in documentation (#853) (@ankitkumar572005)

37776c3 #846 fix BNF grammar to distinguish prerelease from build identifiers (#846) (@abhu85, @claude)

Chores

9542e09 #860 template-oss-apply (@owlstronaut)

937bc2c #860 template-oss-apply@5.0.0 (@owlstronaut)

6946fef #852 bump @npmcli/template-oss from 4.29.0 to 4.30.0 (#852) (@dependabot[bot], @npm-cli-bot)

v7.7.4

7.7.4 (2026-01-16)

Bug Fixes

a29faa5 #835 cli: pass options to semver.valid() for loose version validation (#835) (@mldangelo)

Documentation

1d28d5e #836 fix typos and update -n CLI option documentation (#836) (@mldangelo)

Dependencies

120968b #840 @npmcli/template-oss@4.29.0 (#840)

... (truncated)

Changelog

Sourced from semver's changelog.

7.8.5 (2026-06-19)

Bug Fixes

9c8692a #878 include prereleases in tilde range lower bound with includePrerelease (#878) (@chatman-media)

7.8.4 (2026-06-09)

Bug Fixes

e583226 #874 reject numeric segments after x-ranges (@pupuking723)

7.8.3 (2026-06-08)

Bug Fixes

046da7f #872 align caret includePrerelease lower bounds (#872) (@wayyoungboy)

Chores

3485dda #866 bump @npmcli/eslint-config from 6.0.1 to 7.0.0 (#866) (@dependabot[bot])

7.8.2 (2026-06-04)

Bug Fixes

bea6028 #870 increment dotted prerelease identifiers (#870) (@liuzemei, @SheldonNeo)

7.8.1 (2026-05-21)

Bug Fixes

17aa702 #869 strip build metadata before comparator trimming (#869) (@owlstronaut)

5f3ca13 #867 handle prerelease bounds in subset (#867) (@puneetdixit200, Puneet Dixit)

7.8.0 (2026-05-08)

Features

0d0a0a2

Bumps the production-dependencies group with 13 updates: | Package | From | To | | --- | --- | --- | | [@multiformats/multiaddr](https://github.com/multiformats/js-multiaddr) | `13.0.1` | `13.0.3` | | [bn.js](https://github.com/indutny/bn.js) | `5.2.3` | `5.2.5` | | [commander](https://github.com/tj/commander.js) | `13.1.0` | `15.0.0` | | [fs-extra](https://github.com/jprichardson/node-fs-extra) | `11.3.0` | `11.4.1` | | [graphql-request](https://github.com/graffle-js/graffle) | `7.3.5` | `7.4.0` | | [inquirer](https://github.com/SBoudrias/Inquirer.js) | `13.1.0` | `14.2.3` | | [is-docker](https://github.com/sindresorhus/is-docker) | `3.0.0` | `4.0.0` | | [jszip](https://github.com/Stuk/jszip) | `3.10.1` | `3.10.2` | | [kubo-rpc-client](https://github.com/ipfs/js-kubo-rpc-client) | `5.3.0` | `7.1.0` | | [multiformats](https://github.com/multiformats/js-multiformats) | `13.4.2` | `14.0.5` | | [ora](https://github.com/sindresorhus/ora) | `9.0.0` | `9.4.1` | | [semver](https://github.com/npm/node-semver) | `7.7.3` | `7.8.5` | | [yup](https://github.com/jquense/yup) | `1.6.1` | `1.7.1` | Updates `@multiformats/multiaddr` from 13.0.1 to 13.0.3 - [Release notes](https://github.com/multiformats/js-multiaddr/releases) - [Changelog](https://github.com/multiformats/js-multiaddr/blob/main/CHANGELOG.md) - [Commits](multiformats/js-multiaddr@v13.0.1...v13.0.3) Updates `bn.js` from 5.2.3 to 5.2.5 - [Release notes](https://github.com/indutny/bn.js/releases) - [Changelog](https://github.com/indutny/bn.js/blob/master/CHANGELOG.md) - [Commits](indutny/bn.js@v5.2.3...v5.2.5) Updates `commander` from 13.1.0 to 15.0.0 - [Release notes](https://github.com/tj/commander.js/releases) - [Changelog](https://github.com/tj/commander.js/blob/master/CHANGELOG.md) - [Commits](tj/commander.js@v13.1.0...v15.0.0) Updates `fs-extra` from 11.3.0 to 11.4.1 - [Changelog](https://github.com/jprichardson/node-fs-extra/blob/master/CHANGELOG.md) - [Commits](jprichardson/node-fs-extra@11.3.0...11.4.1) Updates `graphql-request` from 7.3.5 to 7.4.0 - [Release notes](https://github.com/graffle-js/graffle/releases) - [Commits](graffle-js/graffle@v7.3.5...7.4.0) Updates `inquirer` from 13.1.0 to 14.2.3 - [Release notes](https://github.com/SBoudrias/Inquirer.js/releases) - [Commits](https://github.com/SBoudrias/Inquirer.js/compare/inquirer@13.1.0...inquirer@14.2.3) Updates `is-docker` from 3.0.0 to 4.0.0 - [Release notes](https://github.com/sindresorhus/is-docker/releases) - [Commits](sindresorhus/is-docker@v3.0.0...v4.0.0) Updates `jszip` from 3.10.1 to 3.10.2 - [Changelog](https://github.com/Stuk/jszip/blob/main/CHANGES.md) - [Commits](Stuk/jszip@v3.10.1...v3.10.2) Updates `kubo-rpc-client` from 5.3.0 to 7.1.0 - [Release notes](https://github.com/ipfs/js-kubo-rpc-client/releases) - [Commits](ipfs/js-kubo-rpc-client@v5.3.0...v7.1.0) Updates `multiformats` from 13.4.2 to 14.0.5 - [Release notes](https://github.com/multiformats/js-multiformats/releases) - [Changelog](https://github.com/multiformats/js-multiformats/blob/master/CHANGELOG.md) - [Commits](multiformats/js-multiformats@v13.4.2...v14.0.5) Updates `ora` from 9.0.0 to 9.4.1 - [Release notes](https://github.com/sindresorhus/ora/releases) - [Commits](sindresorhus/ora@v9.0.0...v9.4.1) Updates `semver` from 7.7.3 to 7.8.5 - [Release notes](https://github.com/npm/node-semver/releases) - [Changelog](https://github.com/npm/node-semver/blob/main/CHANGELOG.md) - [Commits](npm/node-semver@v7.7.3...v7.8.5) Updates `yup` from 1.6.1 to 1.7.1 - [Release notes](https://github.com/jquense/yup/releases) - [Changelog](https://github.com/jquense/yup/blob/master/CHANGELOG.md) - [Commits](https://github.com/jquense/yup/commits) --- updated-dependencies: - dependency-name: "@multiformats/multiaddr" dependency-version: 13.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: bn.js dependency-version: 5.2.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: commander dependency-version: 15.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies - dependency-name: fs-extra dependency-version: 11.4.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: graphql-request dependency-version: 7.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: inquirer dependency-version: 14.2.3 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies - dependency-name: is-docker dependency-version: 4.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies - dependency-name: jszip dependency-version: 3.10.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: kubo-rpc-client dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies - dependency-name: multiformats dependency-version: 14.0.5 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies - dependency-name: ora dependency-version: 9.4.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: semver dependency-version: 7.8.5 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: yup dependency-version: 1.7.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

socket-security · 2026-10-12T11:41:20Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
jszip@3.10.1 ⏵ 3.10.2
is-docker@3.0.0 ⏵ 4.0.0	⁺¹	⁺⁴
yup@1.6.1 ⏵ 1.7.1	⁺¹		^-1
ora@9.0.0 ⏵ 9.4.1	⁺¹	⁺¹
commander@13.1.0 ⏵ 15.0.0	⁺¹	⁺¹
bn.js@5.2.3 ⏵ 5.2.5	⁺¹
semver@7.7.3 ⏵ 7.8.5	⁺¹	⁺¹
@multiformats/multiaddr@13.0.1 ⏵ 13.0.3			⁺¹
graphql-request@7.3.5 ⏵ 7.4.0	⁺¹
fs-extra@11.3.0 ⏵ 11.4.1	⁺¹
kubo-rpc-client@5.3.0 ⏵ 7.1.0	^-2		⁺³
multiformats@12.1.3 ⏵ 14.0.5	⁺¹
inquirer@13.1.0 ⏵ 14.2.3			^-1

View full report

github-actions · 2026-10-12T11:42:00Z

🐳 Hadolint Dockerfile Lint Results

Click to expand detailed results

Dockerfile:12 DL3066 info: Non-numeric user-id may not be resolvable by host system
Dockerfile:17 DL3016 warning: Pin versions in npm. Instead of `npm install <package>` use `npm install <package>@<version>`

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 12, 2026

PierreJeanjacquot approved these changes Oct 12, 2026

View reviewed changes

PierreJeanjacquot merged commit 75c533a into master Oct 12, 2026
12 of 13 checks passed

PierreJeanjacquot deleted the dependabot/npm_and_yarn/production-dependencies-d0a294f693 branch October 12, 2026 12:30

iexec-release-please-app Bot mentioned this pull request Oct 12, 2026

chore(master): release 9.1.1 #577

Merged

Navigation Menu

Repository navigation

fix(deps): bump the production-dependencies group with 13 updates - #576

fix(deps): bump the production-dependencies group with 13 updates#576
PierreJeanjacquot merged 1 commit into
masterfrom
dependabot/npm_and_yarn/production-dependencies-d0a294f693

dependabot Bot commented on behalf of github Oct 12, 2026

Uh oh!

socket-security Bot commented Oct 12, 2026

Uh oh!

github-actions Bot commented Oct 12, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 12, 2026

v13.0.3

13.0.3 (2026-05-12)

Bug Fixes

v13.0.2

13.0.2 (2026-05-12)

Trivial Changes

Dependencies

13.0.3 (2026-05-12)

Bug Fixes

13.0.2 (2026-05-12)

Trivial Changes

Dependencies

5.2.5 / 2026-07-09

5.2.4 / 2026-06-26

v15.0.0

Added

Fixed

Changed

Deleted

Migration Tips

v15.0.0-0

Added

Fixed

[15.0.0] (2026-05-29)

Added

Fixed

Changed

Deleted

Migration Tips

[15.0.0-0] (2026-02-22)

[14.0.3] (2026-01-31)

Added

Changes

11.4.1 / 2026-09-22

11.4.0 / 2026-07-23

11.3.6 / 2026-06-29

11.3.5 / 2026-05-06

11.3.4 / 2026-03-03

11.3.3 / 2025-12-18

11.3.2 / 2025-09-15

11.3.1 / 2025-08-05

inquirer@14.2.3

What's new

Dependencies

inquirer@14.2.2

What's new

Included

inquirer@14.2.1

What's new

Included

inquirer@14.2.0

What's new

v4.0.0

Breaking

Improvements

v3.10.2 2026-09-09

v7.1.0

7.1.0 (2026-06-09)

Features

Trivial Changes

v7.0.0

7.0.0 (2026-05-13)

⚠ BREAKING CHANGES

Bug Fixes

v6.1.0

6.1.0 (2026-01-23)

Features

Trivial Changes

v6.0.2

6.0.2 (2025-10-14)

Dependencies

v6.0.1

6.0.1 (2025-10-14)

Documentation

v6.0.0

6.0.0 (2025-10-14)

v14.0.5

14.0.5 (2026-07-23)