Skip to content

build(deps): bump the npm-dependencies group across 1 directory with 15 updates#451

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm-dependencies-9c38c54105
Open

build(deps): bump the npm-dependencies group across 1 directory with 15 updates#451
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm-dependencies-9c38c54105

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Apr 7, 2026 •
edited
Loading

Bumps the npm-dependencies group with 15 updates in the / directory:

Package From To
@cyclonedx/cyclonedx-library 6.13.1 10.0.0
fast-xml-parser 5.3.4 5.5.10
https-proxy-agent 7.0.6 9.0.0
p-limit 4.0.0 7.3.0
packageurl-js 1.0.2 2.0.1
smol-toml 1.6.0 1.6.1
@types/node 20.19.31 25.5.2
chai 4.5.0 6.2.2
eslint 8.57.1 10.2.0
mocha 10.8.2 11.7.5
msw 2.12.7 2.13.0
sinon 15.2.0 21.0.3
sinon-chai 3.7.0 4.0.1
typescript 5.9.3 6.0.2
which 5.0.0 6.0.1

Updates @cyclonedx/cyclonedx-library from 6.13.1 to 10.0.0

Release notes

Sourced from @​cyclonedx/cyclonedx-library's releases.

10.0.0

BREAKING changes

  • Removed deprecated symbols
  • Removed PackageUrl factories
  • No longer use external standards' implementations directly

Removed

  • Entrypoint Builders (via #1377)
  • Entrypoint Factories (via #1377)
  • Entrypoint Utils (via #1377)
  • Entrypoint Contrib/PackageUrl (via #1378)
  • Deprecated symbol Builders (#1346 via #1377)
  • Deprecated symbol Builders.FromNodePackageJson (#1346 via #1377)
  • Deprecated symbol Builders.FromNodePackageJson.ToolBuilder (#1346 via #1377)
    Use Contrib.FromNodePackageJson.Builders.ToolBuilder instead.
  • Deprecated symbol Builders.FromNodePackageJson.ComponentBuilder (#1346 via #1377)
    Use Contrib.FromNodePackageJson.Builders.ComponentBuilder instead.
  • Deprecated symbol Factories (#1346 via #1377)
  • Deprecated symbol Factories.FromNodePackageJson (#1346 via #1377)
  • Deprecated symbol Factories.FromNodePackageJson.ExternalReferenceFactory (#1346 via #1377)
    Use Contrib.FromNodePackageJson.Factories.ExternalReferenceFactory instead.
  • Deprecated symbol Factories.FromNodePackageJson.PackageUrlFactory (#1346 via #1377)
    Use packageurl-js downstream.
  • Deprecated symbol Factories.LicenseFactory (#1346, #1348 via #1377, #1378)
    Use Contrib.License.Factories.LicenseFactory instead.
  • Deprecated symbol Factories.PackageUrlFactory (#1346 via #1377)
    Use packageurl-js downstream.
  • Deprecated symbol Types.NodePackageJson (#1346, #1348 via #1377, #1378)
    Use Contrib.FromNodePackageJson.Types.NodePackageJson instead.
  • Deprecated symbol Types.assertNodePackageJson (#1346 via #1377)
    Use Contrib.FromNodePackageJson.Types.assertNodePackageJson instead.
  • Deprecated symbol Types.isNodePackageJson (#1346 via #1377)
    Use Contrib.FromNodePackageJson.Types.isNodePackageJson instead.
  • Deprecated symbol Utils (#1346 via #1377)
  • Deprecated symbol Utils.BomUtility (#1346 via #1377)
  • Deprecated symbol Utils.BomUtility.randomSerialNumber (#1346 via #1377)
    Use Contrib.Bom.Utils.randomSerialNumber instead.
  • Deprecated symbol Utils.LicenseUtility (#1346 via #1377)
  • Deprecated symbol Utils.LicenseUtility.FsUtils (#1346 via #1377)
    Use Contrib.License.Utils.FsUtils instead.
  • Deprecated symbol Utils.LicenseUtility.PathUtils (#1346 via #1377)
  • Use Contrib.License.Utils.PathUtils instead.
  • Deprecated symbol Utils.LicenseUtility.FileAttachment (#1346 via #1377)
    Use Contrib.License.Utils.FileAttachment instead.
  • Deprecated symbol Utils.LicenseUtility.ErrorReporter (#1346 via #1377)
    Use Contrib.License.Utils.ErrorReporter instead.
  • Deprecated symbol Utils.LicenseUtility.LicenseEvidenceGatherer (#1346 via #1377)
    Use Contrib.License.Utils.LicenseEvidenceGatherer instead.
  • Deprecated symbol Utils.NpmjsUtility (#1346 via #1377)
  • Deprecated symbol Utils.NpmjsUtility.parsePackageIntegrity (#1346 via #1377)
    Use Contrib.FromNodePackageJson.Utils.parsePackageIntegrity instead.

... (truncated)

Changelog

Sourced from @​cyclonedx/cyclonedx-library's changelog.

10.0.0 -- 2026-03-03

  • BREAKING changes
    • Removed deprecated symbols
    • Removed PackageUrl factories
    • No longer use external standards' implementations directly
  • Removed
    • Entrypoint Builders (via #1377)
    • Entrypoint Factories (via #1377)
    • Entrypoint Utils (via #1377)
    • Entrypoint Contrib/PackageUrl (via #1378)
    • Deprecated symbol Builders (#1346 via #1377)
    • Deprecated symbol Builders.FromNodePackageJson (#1346 via #1377)
    • Deprecated symbol Builders.FromNodePackageJson.ToolBuilder (#1346 via #1377)
      Use Contrib.FromNodePackageJson.Builders.ToolBuilder instead.
    • Deprecated symbol Builders.FromNodePackageJson.ComponentBuilder (#1346 via #1377)
      Use Contrib.FromNodePackageJson.Builders.ComponentBuilder instead.
    • Deprecated symbol Factories (#1346 via #1377)
    • Deprecated symbol Factories.FromNodePackageJson (#1346 via #1377)
    • Deprecated symbol Factories.FromNodePackageJson.ExternalReferenceFactory (#1346 via #1377)
      Use Contrib.FromNodePackageJson.Factories.ExternalReferenceFactory instead.
    • Deprecated symbol Factories.FromNodePackageJson.PackageUrlFactory (#1346 via #1377)
      Use packageurl-js downstream.
    • Deprecated symbol Factories.LicenseFactory (#1346, #1348 via #1377, #1378)
      Use Contrib.License.Factories.LicenseFactory instead.
    • Deprecated symbol Factories.PackageUrlFactory (#1346 via #1377)
      Use packageurl-js downstream.
    • Deprecated symbol Types.NodePackageJson (#1346, #1348 via #1377, #1378)
      Use Contrib.FromNodePackageJson.Types.NodePackageJson instead.
    • Deprecated symbol Types.assertNodePackageJson (#1346 via #1377)
      Use Contrib.FromNodePackageJson.Types.assertNodePackageJson instead.
    • Deprecated symbol Types.isNodePackageJson (#1346 via #1377)
      Use Contrib.FromNodePackageJson.Types.isNodePackageJson instead.
    • Deprecated symbol Utils (#1346 via #1377)
    • Deprecated symbol Utils.BomUtility (#1346 via #1377)
    • Deprecated symbol Utils.BomUtility.randomSerialNumber (#1346 via #1377)
      Use Contrib.Bom.Utils.randomSerialNumber instead.
    • Deprecated symbol Utils.LicenseUtility (#1346 via #1377)
    • Deprecated symbol Utils.LicenseUtility.FsUtils (#1346 via #1377)
      Use Contrib.License.Utils.FsUtils instead.
    • Deprecated symbol Utils.LicenseUtility.PathUtils (#1346 via #1377)
    • Use Contrib.License.Utils.PathUtils instead.
    • Deprecated symbol Utils.LicenseUtility.FileAttachment (#1346 via #1377)
      Use Contrib.License.Utils.FileAttachment instead.
    • Deprecated symbol Utils.LicenseUtility.ErrorReporter (#1346 via #1377)
      Use Contrib.License.Utils.ErrorReporter instead.
    • Deprecated symbol Utils.LicenseUtility.LicenseEvidenceGatherer (#1346 via #1377)
      Use Contrib.License.Utils.LicenseEvidenceGatherer instead.
    • Deprecated symbol Utils.NpmjsUtility (#1346 via #1377)
    • Deprecated symbol Utils.NpmjsUtility.parsePackageIntegrity (#1346 via #1377)

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @​cyclonedx/cyclonedx-library since your current version.


Updates fast-xml-parser from 5.3.4 to 5.5.10

Release notes

Sourced from fast-xml-parser's releases.

performance improvment, increase entity expansion default limit

  • increase default entity explansion limit as many projects demand for that
maxEntitySize: 10000,
maxExpansionDepth: 10000,
maxTotalExpansions: Infinity,
maxExpandedLength: 100000,
maxEntityCount: 1000,
  • performance improvement
    • reduce calls to toString
    • early return when entities are not present
    • prepare rawAttrsForMatcher only if user sets jPath: false

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.5.9...v5.5.10

fix typins and matcher instance in callbacks

combine typings file to avoid configuration changes pass readonly instance of matcher to the call backs to avoid accidental push/pop call

fix bugs of entity parsing and value parsing

fix: entity expansion limits update strnum package to 2.2.0

fix entity expansion and incorrect replacement and performance

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.5.5...v5.5.6

support onDangerousProperty

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.5.3...v5.5.5

update dependecies to fix typings

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.5.1...v5.5.2

integrate path-expression-matcher

  • support path-expression-matcher
  • fix: stopNode should not be parsed
  • performance improvement for stopNode checking

Separate Builder

XML Builder was the part of fast-xml-parser for years. But considering that any bug in builder may false-alarm the users who are only using parser and vice-versa, we have decided to split it into a separate package.

Migration

To migrate to fast-xml-builder;

From

import { XMLBuilder } from "fast-xml-parser";

... (truncated)

Changelog

Sourced from fast-xml-parser's changelog.

Note: If you find missing information about particular minor version, that version must have been changed without any functional change in this library.

Note: Due to some last quick changes on v4, detail of v4.5.3 & v4.5.4 are not updated here. v4.5.4x is the last tag of v4 in github repository. I'm extremely sorry for the confusion

5.5.10 / 2026-04-03

  • increase default entity explansion limit as many projects demand for that
  • performance improvement
    • reduce calls to toString
    • early return when entities are not present
    • prepare rawAttrsForMatcher only if user sets jPath: false

5.5.9 / 2026-03-23

  • combine typing files

4.5.5 / 2026-03-22

apply fixes from v5 (legacy maintenance branch v4-maintenance)

  • support maxEntityCount
  • support onDangerousProperty
  • support maxNestedTags
  • handle prototype pollution
  • fix incorrect entity name replacement
  • fix incorrect condition for entity expansion

5.5.8 / 2026-03-20

  • pass read only matcher in callback

5.5.7 / 2026-03-19

  • fix: entity expansion limits
  • update strnum package to 2.2.0

5.5.6 / 2026-03-16

  • update builder dependency
  • fix incorrect regex to replace . in entity name
  • fix check for entitiy expansion for lastEntities and html entities too

5.5.5 / 2026-03-13

  • sanitize dangerous tag or attribute name
  • error on critical property name
  • support onDangerousProperty option

5.5.4 / 2026-03-13

  • declare Matcher & Expression as unknown so user is not forced to install path-expression-matcher

5.5.3 / 2026-03-11

... (truncated)

Commits

Updates https-proxy-agent from 7.0.6 to 9.0.0

Release notes

Sourced from https-proxy-agent's releases.

https-proxy-agent@9.0.0

Major Changes

  • 7d12b51: Set minimum Node.js version to 20

Patch Changes

  • 7ca27d0: Simplify package.json exports to remove unnecessary imports restriction
  • Updated dependencies [ca12148]
  • Updated dependencies [7d12b51]
  • Updated dependencies [7ca27d0]
    • agent-base@9.0.0

https-proxy-agent@8.0.0

Major Changes

  • 9c92c09: Convert to ESM. All packages now use "type": "module" and compile to ESM output instead of CommonJS.

Patch Changes

  • Updated dependencies [9c92c09]
    • agent-base@8.0.0
Changelog

Sourced from https-proxy-agent's changelog.

9.0.0

Major Changes

  • 7d12b51: Set minimum Node.js version to 20

Patch Changes

  • 7ca27d0: Simplify package.json exports to remove unnecessary imports restriction
  • Updated dependencies [ca12148]
  • Updated dependencies [7d12b51]
  • Updated dependencies [7ca27d0]
    • agent-base@9.0.0

8.0.0

Major Changes

  • 9c92c09: Convert to ESM. All packages now use "type": "module" and compile to ESM output instead of CommonJS.

Patch Changes

  • Updated dependencies [9c92c09]
    • agent-base@8.0.0
Commits
  • af317e0 Version Packages (#397)
  • 7ca27d0 Simplify package.json exports to remove unnecessary imports restriction (#408)
  • 7d12b51 Set minimum Node.js version to 20 and add Node 24.x to CI matrix
  • 8dcdac8 Version Packages (#395)
  • 5d3f71a Use pnpm catalog: for shared dependencies
  • 77da068 Use workspace:* for inter-repo dependencies
  • f70a9dc Fix CI failures: update Node.js matrix and test configuration
  • 9c92c09 Convert all packages to ESM with type: module
  • 0b77ac7 Migrate from Jest to Vitest
  • ed00d30 Re-generate self-signed cert for tests
  • See full diff in compare view
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for https-proxy-agent since your current version.


Updates p-limit from 4.0.0 to 7.3.0

Release notes

Sourced from p-limit's releases.

v7.3.0

  • Add rejectOnClear option 8907801
  • Support options object in pLimit() 870db0f

sindresorhus/p-limit@v7.2.0...v7.3.0

v7.2.0

  • Make .map() method accept an iterable, not just array (#98) d76231b

sindresorhus/p-limit@v7.1.1...v7.2.0

v7.1.1

  • Fix limitFunction type ccb80b2

sindresorhus/p-limit@v7.1.0...v7.1.1

v7.1.0

  • Add index parameter to map() method 2aeffd4

sindresorhus/p-limit@v7.0.0...v7.1.0

v7.0.0

Breaking

  • Require Node.js 20 78b81a5
  • activeCount now increments when tasks actually start running (more intuitive) rather than when queued. This means:
    • activeCount reflects truly active/running promises
    • pendingCount more accurately represents waiting

Improvements

  • Add .map convenience method 86a5d73
  • Improve performance (#93) be1965b

sindresorhus/p-limit@v6.2.0...v7.0.0

v6.2.0

sindresorhus/p-limit@v6.1.0...v6.2.0

... (truncated)

Commits
  • 886bda5 7.3.0
  • 8907801 Add rejectOnClear option
  • ce9d71c Add test for shared context provider pattern
  • 24503f9 Document recursive limiter deadlocks
  • 9bce97a Add recipes documentation
  • 870db0f Support options object in pLimit()
  • 1fb1407 Fix benchmarks
  • 7bdd25c 7.2.0
  • d76231b Make .map() method accept an iterable, not just array (#98)
  • 9da5934 Use native Node.js timers instead of delay package in tests
  • Additional commits viewable in compare view

Updates packageurl-js from 1.0.2 to 2.0.1

Changelog

Sourced from packageurl-js's changelog.

2.0.1

Bug Fix

  • Fix decoding problems around the % character #75 (fix contributed by @​jdalton)

2.0.0

  • Significant refactor based on code from @​jdalton
  • Numerous bug fixes and improvements the community was asking for
    • See closed issues and PRs for details (too many to list here)

1.2.1

Bug Fixes

1.2.0

Features

  • Add pub parsing for Dart and Flutter packages (contributed by @​topaztee)

1.1.1

Bug Fix

  • publish errors

1.1.0

Features

Commits
  • cd1eb4b chore: bump to v2.0.1 (#77)
  • f7dccd6 fix: error on decode with meaningful message
  • 07b818b fix: only decode in parseString
  • c2f576f bump to v2.0.0 (#74)
  • b5660a5 Merge pull request #73 from package-url/jdalton/sync
  • 400de0c Merge pull request #72 from package-url/dependabot/npm_and_yarn/braces-3.0.3
  • b6c8ce8 fix: correct package-url.d.ts readonly type casing
  • 96822af fix: correct param name typos
  • f81a6be fix: use encodeQualifierValue for qualifierKey and qualifierValue
  • ff590d2 feat: encode qualifiers with URLSearchParams
  • Additional commits viewable in compare view

Updates smol-toml from 1.6.0 to 1.6.1

Release notes

Sourced from smol-toml's releases.

v1.6.1

This release addresses a minor security vulnerability where an attacker-controlled TOML document can exploit an unrestricted recustion and cause a stack overflow error with a document that contains thousands of sucessive commented lines. Security advisory: GHSA-v3rj-xjv7-4jmq

Commits

Updates @types/node from 20.19.31 to 25.5.2

Commits

Updates chai from 4.5.0 to 6.2.2

Release notes

Sourced from chai's releases.

v6.2.2

What's Changed

New Contributors

Full Changelog: chaijs/chai@v6.2.1...v6.2.2

v6.2.1

What's Changed

New Contributors

Full Changelog: chaijs/chai@v6.2.0...v6.2.1

... (truncated)

Commits
  • 814172d chore(deps): update dependency esbuild to v0.27.2 (#1759)
  • b38c22b chore: add legal-comments=none option (#1756)
  • 180d4cc chore(deps): update dependencies to v9.39.2 (#1757)
  • 678cd00 chore(deps): update dependencies (#1755)
  • c8fb100 chore(deps): update dependency prettier to v3.7.3 (#1754)
  • d63c74e chore(deps): update dependency eslint-plugin-jsdoc to v61.4.1 (#1751)
  • 243bf86 fix: avoid BigInt literal in closeTo for runtime compat (#1748)
  • d8b0395 chore(deps): update actions/checkout action to v6 (#1749)
  • 7e1e247 build(deps): bump glob from 10.4.5 to 10.5.0 (#1747)
  • b25e5d8 chore(deps): update dependency eslint-plugin-jsdoc to v61.2.1 (#1746)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for chai since your current version.


Updates eslint from 8.57.1 to 10.2.0

Release notes

Sourced from eslint's releases.

v10.2.0

Features

  • 586ec2f feat: Add meta.languages support to rules (#20571) (Copilot)
  • 14207de feat: add Temporal to no-obj-calls (#20675) (Pixel998)
  • bbb2c93 feat: add Temporal to ES2026 globals (#20672) (Pixel998)

Bug Fixes

  • 542cb3e fix: update first-party dependencies (#20714) (Francesco Trotta)

Documentation

  • a2af743 docs: add language to configuration objects (#20712) (Francesco Trotta)
  • 845f23f docs: Update README (GitHub Actions Bot)
  • 5fbcf59 docs: remove sourceType from ts playground link (#20477) (Tanuj Kanti)
  • 8702a47 docs: Update README (GitHub Actions Bot)
  • ddeaded docs: Update README (GitHub Actions Bot)
  • 2b44966 docs: add Major Releases section to Manage Releases (#20269) (Milos Djermanovic)
  • eab65c7 docs: update eslint versions in examples (#20664) (루밀LuMir)
  • 3e4a299 docs: update ESM Dependencies policies with note for own-usage packages (#20660) (Milos Djermanovic)

Chores

  • 8120e30 refactor: extract no unmodified loop condition (#20679) (kuldeep kumar)
  • 46e8469 chore: update dependency markdownlint-cli2 to ^0.22.0 (#20697) (renovate[bot])
  • 01ed3aa test: add unit tests for unicode utilities (#20622) (Manish chaudhary)
  • 811f493 ci: remove --legacy-peer-deps from types integration tests (#20667) (Milos Djermanovic)
  • 6b86fcf chore: update dependency npm-run-all2 to v8 (#20663) (renovate[bot])
  • 632c4f8 chore: add prettier update commit to .git-blame-ignore-revs (#20662) (루밀LuMir)
  • b0b0f21 chore: update dependency eslint-plugin-regexp to ^3.1.0 (#20659) (Milos Djermanovic)
  • 228a2dd chore: update dependency eslint-plugin-eslint-plugin to ^7.3.2 (#20661) (Milos Djermanovic)
  • 3ab4d7e test: Add tests for eslintrc-style keys (#20645) (kuldeep kumar)

v10.1.0

Features

  • ff4382b feat: apply fix for no-var in TSModuleBlock (#20638) (Tanuj Kanti)
  • 0916995 feat: Implement api support for bulk-suppressions (#20565) (Blake Sager)

Bug Fixes

  • 2b8824e fix: Prevent no-var autofix when a variable is used before declaration (#20464) (Amaresh S M)
  • e58b4bf fix: update eslint (#20597) (renovate[bot])

Documentation

  • b7b57fe docs: use correct JSDoc link in require-jsdoc.md (#20641) (mkemna-clb)
  • 58e4cfc docs: add deprecation notice partial (#20639) (Milos Djermanovic)
  • 7143dbf docs: update v9 migration guide for @eslint/js usage (#20540) (fnx)
  • 035fc4f docs: note that globalReturn applies only with sourceType: "script" (#20630) (Milos Djermanovic)
  • e972c88 docs: merge ESLint option descriptions into type definitions (#20608) (Francesco Trotta)
  • 7f10d84 docs: Update README (GitHub Actions Bot)
  • aeed007 docs: open playground link in new tab (#20602) (Tanuj Kanti)
  • a0d1a37 docs: Add AI Usage Policy (#20510) (Nicholas C. Zakas)

Chores

... (truncated)

Commits

@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 7, 2026
@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/npm-dependencies-9c38c54105 branch 3 times, most recently from 4659267 to 4bf48ea Compare April 9, 2026 13:51
@dependabot
build(deps): bump the npm-dependencies group across 1 directory with …
ccc02b3 
…15 updates

Bumps the npm-dependencies group with 15 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@cyclonedx/cyclonedx-library](https://github.com/CycloneDX/cyclonedx-javascript-library) | `6.13.1` | `10.0.0` |
| [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) | `5.3.4` | `5.5.10` |
| [https-proxy-agent](https://github.com/TooTallNate/proxy-agents/tree/HEAD/packages/https-proxy-agent) | `7.0.6` | `9.0.0` |
| [p-limit](https://github.com/sindresorhus/p-limit) | `4.0.0` | `7.3.0` |
| [packageurl-js](https://github.com/package-url/packageurl-js) | `1.0.2` | `2.0.1` |
| [smol-toml](https://github.com/squirrelchat/smol-toml) | `1.6.0` | `1.6.1` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `20.19.31` | `25.5.2` |
| [chai](https://github.com/chaijs/chai) | `4.5.0` | `6.2.2` |
| [eslint](https://github.com/eslint/eslint) | `8.57.1` | `10.2.0` |
| [mocha](https://github.com/mochajs/mocha) | `10.8.2` | `11.7.5` |
| [msw](https://github.com/mswjs/msw) | `2.12.7` | `2.13.0` |
| [sinon](https://github.com/sinonjs/sinon) | `15.2.0` | `21.0.3` |
| [sinon-chai](https://github.com/chaijs/sinon-chai) | `3.7.0` | `4.0.1` |
| [typescript](https://github.com/microsoft/TypeScript) | `5.9.3` | `6.0.2` |
| [which](https://github.com/npm/node-which) | `5.0.0` | `6.0.1` |



Updates `@cyclonedx/cyclonedx-library` from 6.13.1 to 10.0.0
- [Release notes](https://github.com/CycloneDX/cyclonedx-javascript-library/releases)
- [Changelog](https://github.com/CycloneDX/cyclonedx-javascript-library/blob/main/HISTORY.md)
- [Commits](CycloneDX/cyclonedx-javascript-library@v6.13.1...v10.0.0)

Updates `fast-xml-parser` from 5.3.4 to 5.5.10
- [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases)
- [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md)
- [Commits](NaturalIntelligence/fast-xml-parser@v5.3.4...v5.5.10)

Updates `https-proxy-agent` from 7.0.6 to 9.0.0
- [Release notes](https://github.com/TooTallNate/proxy-agents/releases)
- [Changelog](https://github.com/TooTallNate/proxy-agents/blob/main/packages/https-proxy-agent/CHANGELOG.md)
- [Commits](https://github.com/TooTallNate/proxy-agents/commits/https-proxy-agent@9.0.0/packages/https-proxy-agent)

Updates `p-limit` from 4.0.0 to 7.3.0
- [Release notes](https://github.com/sindresorhus/p-limit/releases)
- [Commits](sindresorhus/p-limit@v4.0.0...v7.3.0)

Updates `packageurl-js` from 1.0.2 to 2.0.1
- [Changelog](https://github.com/package-url/packageurl-js/blob/master/CHANGELOG.md)
- [Commits](package-url/packageurl-js@v1.0.2...v2.0.1)

Updates `smol-toml` from 1.6.0 to 1.6.1
- [Release notes](https://github.com/squirrelchat/smol-toml/releases)
- [Commits](squirrelchat/smol-toml@v1.6.0...v1.6.1)

Updates `@types/node` from 20.19.31 to 25.5.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `chai` from 4.5.0 to 6.2.2
- [Release notes](https://github.com/chaijs/chai/releases)
- [Changelog](https://github.com/chaijs/chai/blob/main/History.md)
- [Commits](chaijs/chai@v4.5.0...v6.2.2)

Updates `eslint` from 8.57.1 to 10.2.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v8.57.1...v10.2.0)

Updates `mocha` from 10.8.2 to 11.7.5
- [Release notes](https://github.com/mochajs/mocha/releases)
- [Changelog](https://github.com/mochajs/mocha/blob/v11.7.5/CHANGELOG.md)
- [Commits](mochajs/mocha@v10.8.2...v11.7.5)

Updates `msw` from 2.12.7 to 2.13.0
- [Release notes](https://github.com/mswjs/msw/releases)
- [Changelog](https://github.com/mswjs/msw/blob/main/CHANGELOG.md)
- [Commits](mswjs/msw@v2.12.7...v2.13.0)

Updates `sinon` from 15.2.0 to 21.0.3
- [Release notes](https://github.com/sinonjs/sinon/releases)
- [Changelog](https://github.com/sinonjs/sinon/blob/main/docs/changelog.md)
- [Commits](sinonjs/sinon@v15.2.0...v21.0.3)

Updates `sinon-chai` from 3.7.0 to 4.0.1
- [Release notes](https://github.com/chaijs/sinon-chai/releases)
- [Changelog](https://github.com/chaijs/sinon-chai/blob/master/CHANGELOG.md)
- [Commits](chaijs/sinon-chai@3.7.0...4.0.1)

Updates `typescript` from 5.9.3 to 6.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](microsoft/TypeScript@v5.9.3...v6.0.2)

Updates `which` from 5.0.0 to 6.0.1
- [Release notes](https://github.com/npm/node-which/releases)
- [Changelog](https://github.com/npm/node-which/blob/main/CHANGELOG.md)
- [Commits](npm/node-which@v5.0.0...v6.0.1)

---
updated-dependencies:
- dependency-name: "@cyclonedx/cyclonedx-library"
  dependency-version: 10.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: fast-xml-parser
  dependency-version: 5.5.10
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: https-proxy-agent
  dependency-version: 9.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: p-limit
  dependency-version: 7.3.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: packageurl-js
  dependency-version: 2.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: smol-toml
  dependency-version: 1.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: "@types/node"
  dependency-version: 25.5.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: chai
  dependency-version: 6.2.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: eslint
  dependency-version: 10.2.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: mocha
  dependency-version: 11.7.5
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: msw
  dependency-version: 2.13.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: sinon
  dependency-version: 21.0.3
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: sinon-chai
  dependency-version: 4.0.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: typescript
  dependency-version: 6.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: which
  dependency-version: 6.0.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/npm-dependencies-9c38c54105 branch from 4bf48ea to ccc02b3 Compare April 13, 2026 06:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants