build(deps): bump the npm_and_yarn group across 21 directories with 14 updates

[dependabot]

Bumps the npm_and_yarn group with 8 updates in the /app directory:

Package	From	To
i18next-fs-backend	2.3.1	2.6.4
brace-expansion	1.1.12	5.0.6
minimatch	3.1.2	10.2.5
@xmldom/xmldom	0.8.11	0.8.13
fast-uri	3.1.0	3.1.2
ip-address	10.1.0	10.2.0
langsmith	0.5.13	0.7.1
picomatch	2.3.1	4.0.4

Bumps the npm_and_yarn group with 3 updates in the /eslint-config directory: brace-expansion, picomatch and yaml.
Bumps the npm_and_yarn group with 5 updates in the /frontend directory:

Package	From	To
brace-expansion	1.1.12	5.0.6
fast-uri	3.0.1	3.1.2
flatted	3.3.1	3.4.2
picomatch	2.3.1	2.3.2
picomatch	4.0.2	4.0.4
yaml	1.10.2	1.10.3

Bumps the npm_and_yarn group with 7 updates in the /plugins/examples/activity directory:

Package	From	To
brace-expansion	1.1.11	1.1.14
brace-expansion	2.0.1	2.1.0
minimatch	3.1.2	3.1.5
minimatch	9.0.5	9.0.9
fast-uri	3.0.6	3.1.2
picomatch	2.3.1	2.3.2
picomatch	4.0.2	4.0.4
rollup	4.41.0	4.60.4
yaml	1.10.2	1.10.3
storybook	8.6.15	8.6.18

Bumps the npm_and_yarn group with 8 updates in the /plugins/examples/app-menus directory:

Package	From	To
brace-expansion	1.1.12	1.1.14
brace-expansion	2.0.2	2.1.0
minimatch	3.1.2	3.1.5
minimatch	9.0.5	9.0.9
fast-uri	3.1.0	3.1.2
picomatch	2.3.1	2.3.2
picomatch	4.0.3	4.0.4
rollup	4.50.1	4.60.4
yaml	1.10.2	1.10.3
yaml	2.8.1	2.9.0
storybook	9.1.17	9.1.20
serialize-javascript	6.0.2	removed

Bumps the npm_and_yarn group with 8 updates in the /plugins/examples/change-logo directory:

Package	From	To
brace-expansion	1.1.12	1.1.14
brace-expansion	2.0.2	2.1.0
minimatch	3.1.2	3.1.5
minimatch	9.0.5	9.0.9
fast-uri	3.1.0	3.1.2
picomatch	2.3.1	2.3.2
picomatch	4.0.3	4.0.4
rollup	4.50.1	4.60.4
yaml	1.10.2	1.10.3
yaml	2.8.1	2.9.0
storybook	9.1.17	9.1.20
serialize-javascript	6.0.2	removed

Bumps the npm_and_yarn group with 8 updates in the /plugins/examples/cluster-chooser directory:

Package	From	To
brace-expansion	1.1.12	1.1.14
brace-expansion	2.0.2	2.1.0
minimatch	3.1.2	3.1.5
minimatch	9.0.5	9.0.9
fast-uri	3.1.0	3.1.2
picomatch	2.3.1	2.3.2
picomatch	4.0.3	4.0.4
rollup	4.50.1	4.60.4
yaml	1.10.2	1.10.3
yaml	2.8.1	2.9.0
storybook	9.1.17	9.1.20
serialize-javascript	6.0.2	removed

Bumps the npm_and_yarn group with 8 updates in the /plugins/examples/custom-theme directory:

Package	From	To
brace-expansion	1.1.12	1.1.14
brace-expansion	2.0.2	2.1.0
minimatch	3.1.2	3.1.5
minimatch	9.0.5	9.0.9
fast-uri	3.1.0	3.1.2
picomatch	2.3.1	2.3.2
picomatch	4.0.3	4.0.4
rollup	4.50.1	4.60.4
yaml	1.10.2	1.10.3
yaml	2.8.1	2.9.0
storybook	9.1.17	9.1.20
serialize-javascript	6.0.2	removed

Bumps the npm_and_yarn group with 8 updates in the /plugins/examples/customizing-map directory:

Package	From	To
brace-expansion	1.1.12	1.1.14
brace-expansion	2.0.2	2.1.0
minimatch	3.1.2	3.1.5
minimatch	9.0.5	9.0.9
fast-uri	3.1.0	3.1.2
picomatch	2.3.1	2.3.2
picomatch	4.0.3	4.0.4
rollup	4.50.1	4.60.4
yaml	1.10.2	1.10.3
yaml	2.8.1	2.9.0
storybook	9.1.17	9.1.20
serialize-javascript	6.0.2	removed

Bumps the npm_and_yarn group with 8 updates in the /plugins/examples/details-view directory:

Package	From	To
brace-expansion	1.1.12	1.1.14
brace-expansion	2.0.2	2.1.0
minimatch	3.1.2	3.1.5
minimatch	9.0.5	9.0.9
fast-uri	3.1.0	3.1.2
picomatch	2.3.1	2.3.2
picomatch	4.0.3	4.0.4
rollup	4.50.2	4.60.4
yaml	1.10.2	1.10.3
yaml	2.8.1	2.9.0
storybook	9.1.17	9.1.20
serialize-javascript	6.0.2	removed

Bumps the npm_and_yarn group with 7 updates in the /plugins/examples/dynamic-clusters directory:

Package	From	To
brace-expansion	1.1.11	1.1.14
brace-expansion	2.0.1	2.1.0
brace-expansion	1.1.12	1.1.14
minimatch	3.1.2	3.1.5
minimatch	9.0.5	9.0.9
fast-uri	3.0.6	3.1.2
picomatch	2.3.1	2.3.2
picomatch	4.0.3	4.0.4
rollup	4.41.0	4.60.4
yaml	1.10.2	1.10.3
yaml	2.8.0	2.9.0
serialize-javascript	6.0.2	removed

Bumps the npm_and_yarn group with 8 updates in the /plugins/examples/headlamp-events directory:

Package	From	To
brace-expansion	1.1.12	1.1.14
brace-expansion	2.0.2	2.1.0
minimatch	3.1.2	3.1.5
minimatch	9.0.5	9.0.9
fast-uri	3.1.0	3.1.2
picomatch	2.3.1	2.3.2
picomatch	4.0.3	4.0.4
rollup	4.50.1	4.60.4
yaml	1.10.2	1.10.3
yaml	2.8.1	2.9.0
storybook	9.1.17	9.1.20
serialize-javascript	6.0.2	removed

Bumps the npm_and_yarn group with 7 updates in the /plugins/examples/pod-counter directory:

Package	From	To
brace-expansion	1.1.12	1.1.14
brace-expansion	2.0.2	2.1.0
minimatch	3.1.2	3.1.5
minimatch	9.0.5	9.0.9
fast-uri	3.1.0	3.1.2
picomatch	2.3.1	2.3.2
picomatch	4.0.3	4.0.4
rollup	4.50.1	4.60.4
yaml	1.10.2	1.10.3
yaml	2.8.1	2.9.0
storybook	9.1.17	9.1.20

Bumps the npm_and_yarn group with 1 update in the /plugins/examples/projects directory: brace-expansion.
Bumps the npm_and_yarn group with 2 updates in the /plugins/examples/resource-charts directory: brace-expansion and serialize-javascript.
Bumps the npm_and_yarn group with 8 updates in the /plugins/examples/sidebar directory:

Package	From	To
brace-expansion	1.1.12	1.1.14
brace-expansion	2.0.2	2.1.0
minimatch	3.1.2	3.1.5
minimatch	9.0.5	9.0.9
fast-uri	3.1.0	3.1.2
picomatch	2.3.1	2.3.2
picomatch	4.0.3	4.0.4
rollup	4.50.1	4.60.4
yaml	1.10.2	1.10.3
yaml	2.8.1	2.9.0
storybook	9.1.17	9.1.20
serialize-javascript	6.0.2	removed

Bumps the npm_and_yarn group with 8 updates in the /plugins/examples/tables directory:

Package	From	To
brace-expansion	1.1.12	1.1.14
brace-expansion	2.0.2	2.1.0
minimatch	3.1.2	3.1.5
minimatch	9.0.5	9.0.9
fast-uri	3.1.0	3.1.2
picomatch	2.3.1	2.3.2
picomatch	4.0.3	4.0.4
rollup	4.50.1	4.60.4
yaml	1.10.2	1.10.3
yaml	2.8.1	2.9.0
storybook	9.1.17	9.1.20
serialize-javascript	6.0.2	removed

Bumps the npm_and_yarn group with 8 updates in the /plugins/examples/ui-panels directory:

Package	From	To
brace-expansion	1.1.12	1.1.14
brace-expansion	2.0.2	2.1.0
minimatch	3.1.2	3.1.5
minimatch	9.0.5	9.0.9
fast-uri	3.1.0	3.1.2
picomatch	2.3.1	2.3.2
picomatch	4.0.3	4.0.4
rollup	4.50.1	4.60.4
yaml	1.10.2	1.10.3
yaml	2.8.1	2.9.0
storybook	9.1.17	9.1.20
serialize-javascript	6.0.2	removed

Bumps the npm_and_yarn group with 1 update in the /plugins/headlamp-plugin directory: brace-expansion.
Bumps the npm_and_yarn group with 1 update in the /plugins/pluginctl directory: brace-expansion.
Bumps the npm_and_yarn group with 4 updates in the /tools/i18n directory: brace-expansion, minimatch, picomatch and handlebars.

Updates i18next-fs-backend from 2.3.1 to 2.6.4

Changelog

Sourced from i18next-fs-backend's changelog.

2.6.4

Security release — all issues found via an internal audit. See published advisory GHSA-8847-338w-5hcj.

• security: refuse to build filesystem paths when lng or ns values contain .., path separators (/, \), control characters, prototype keys (__proto__ / constructor / prototype), or exceed 128 chars. Prevents arbitrary filesystem read / write via attacker-controlled language-code values. Any legitimate i18next language-code shape (BCP-47-like, underscores, hyphens, dots, +-joined multi-language requests) is still accepted (GHSA-8847-338w-5hcj)
• docs: new "Security considerations" README section — documents the filesystem-path sanitiser and clarifies the trust model around .js/.ts locale files (their content is eval-ed, so they must be treated as code). The eval behaviour itself is retained: dynamic expressions in .js/.ts locale files are an intentional feature, and safe replacements like import() are async-only and not viable for this sync-capable code path.
• chore: ignore .env* and *.pem/*.key files in .gitignore.

2.6.3

• use own interpolation function instead of relying on i18next's interpolator

2.6.1

• Bump js-yaml from 4.1.0 to 4.1.1 (#64)

2.6.0

• support initImmediate -> initAsync renaming of i18next v24

2.5.0

• fix for Deno 2 and removal of unnecessary .cjs file
• for esm build environments not supporting top-level await, you should import the i18next-fs-backend/cjs export or stay at v2.4.0

Commits

• 7f62307 2.6.4
• adf8a30 security: hardening for 2.6.4
• 3bd0132 update deps
• fd1616f Bump fastify from 5.3.2 to 5.8.5 in /example/fastify (#67)
• 8b6a5ba 2.6.3
• 957635d use own interpolation function
• 2771083 2.6.2
• 2cd2c20 use own interpolation function
• b1e42e4 2.6.1
• 87d032b build
• Additional commits viewable in compare view

Updates brace-expansion from 1.1.12 to 5.0.6

Release notes

Sourced from brace-expansion's releases.

v4.0.1

• fmt 5a5cc17
• Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) 0b6a978

---

juliangruber/brace-expansion@v4.0.0...v4.0.1

v4.0.0

• feat: use string replaces instead of splits (#64) 278132b
• fmt dd72a59
• add tea.yaml 70e4c1b

juliangruber/brace-expansion@v3.0.0...v4.0.0

As a precaution to not risk breaking anything with 278132b, this is a new semver major release

v3.0.1

• pkg: publish on tag 3.x 3059c07
• fmt 8229e6f
• Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) 15f9b3c

---

juliangruber/brace-expansion@v3.0.0...v3.0.1

v3.0.0

• Switch to ES Modules and balanced-match 3.0.0 (#62) c0360e8
• added jsdoc (#55) 68c0e37
• node 16 is EOL 9e781e9
• add standard 3494c4d
• use const and let (#57) dd5a4cb
• docs 6dad209
• remove test e3dd8ae
• ci: update node versions d23ede9
• docs: add @​lanodan to contributors 1eb3fa4
• docs 1e7c9cd
• switch from tape to test module (#60) 2520537
• Bump minimist from 1.2.5 to 1.2.6 (#59) 61a94f1
• Bump path-parse from 1.0.6 to 1.0.7 (#51) dc741cf
• docs: add back ci badge 8ee5626
• Add github actions, remove travis. Closes #52 (#53) 5c8756a
• CI: Drop unused sudo: false Travis directive (#50) 05978a7

juliangruber/brace-expansion@v2.0.1...v3.0.0

v2.0.2

• pkg: publish on tag 2.x 14f1d91
• fmt ed7780a
• Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) 36603d5

... (truncated)

Commits

• 46317b5 5.0.6
• c0b095b Merge commit from fork
• ec56020 Bump picomatch from 4.0.3 to 4.0.4 (#93)
• 8793901 5.0.5
• 9a02af5 Merge commit from fork
• daa71bc Bump tar from 7.5.10 to 7.5.11 (#92)
• 799e5f7 Bump tar from 7.5.9 to 7.5.10 (#90)
• 012c230 5.0.4
• 243c491 Fix handling of brackets. Closes #87
• 609f858 Correct incorrect brace-expansion import (#89)
• Additional commits viewable in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates minimatch from 3.1.2 to 10.2.5

Changelog

Sourced from minimatch's changelog.

change log

10.2

• Add braceExpandMax option

10.1

• Add magicalBraces option for escape
• Fix makeRe when partial: true is set.
• Fix makeRe when pattern ends in a final ** path part.

10.0

• Require node 20 or 22 and higher

9.0

• No default export, only named exports.

8.0

• Recursive descent parser for extglob, allowing correct support for arbitrarily nested extglob expressions
• Bump required Node.js version

7.4

• Add escape() method
• Add unescape() method
• Add Minimatch.hasMagic() method

7.3

• Add support for posix character classes in a unicode-aware way.

7.2

• Add windowsNoMagicRoot option

7.1

• Add optimizationLevel configuration option, and revert the default back to the 6.2 style minimal optimizations, making the advanced transforms introduced in 7.0 opt-in. Also, process provided file paths in the same way in optimizationLevel:2 mode, so most things that matched with optimizationLevel 1 or 0 should match with level 2 as well. However, level 1 is the default, out of an abundance of caution.

... (truncated)

Commits

• 693c823 10.2.5
• 7953af1 do not allow .. to consume drive letter on Windows
• 1caf918 lint and format
• 7783ed6 ignore docs
• 6d9b356 update deps etc
• c36addb 10.2.4
• 26b9002 docs: add warning about ReDoS
• 3a0d83b fix partial matching of globstar patterns
• ea94840 10.2.3
• 0873fba update deps
• Additional commits viewable in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates @xmldom/xmldom from 0.8.11 to 0.8.13

Release notes

Sourced from @​xmldom/xmldom's releases.

0.8.13

Commits

Fixed

• Security: XMLSerializer.serializeToString() (and Node.toString(), NodeList.toString()) now accept a requireWellFormed option (fourth argument, after isHtml and nodeFilter). When { requireWellFormed: true } is passed, the serializer throws InvalidStateError for injection-prone node content, preventing XML injection via attacker-controlled node data. GHSA-j759-j44w-7fr8 GHSA-x6wf-f3px-wcqx GHSA-f6ww-3ggp-fr8h
  • Comment: throws when data contains -->
  • ProcessingInstruction: throws when data contains ?>
  • DocumentType: throws when publicId fails PubidLiteral, systemId fails SystemLiteral, or internalSubset contains ]>
• Security: DOM traversal operations (XMLSerializer.serializeToString(), Node.prototype.normalize(), Node.prototype.cloneNode(true), Document.prototype.importNode(node, true), node.textContent getter, getElementsByTagName() / getElementsByTagNameNS() / getElementsByClassName() / getElementById()) are now iterative. Previously, deeply nested DOM trees would exhaust the JavaScript call stack and throw an unrecoverable RangeError. GHSA-2v35-w6hq-6mfw

Thank you, @​Jvr2022, @​praveen-kv, @​TharVid, @​decsecre583, @​tlsbollei, @​KarimTantawey, for your contributions

0.8.12

Commits

Fixed

• preserve trailing whitespace in ProcessingInstruction data [#962](https://github.com/xmldom/xmldom/issues/962) / [#42](https://github.com/xmldom/xmldom/issues/42)
• Security: createCDATASection now throws InvalidCharacterError when data contains "]]>", as required by the WHATWG DOM spec. GHSA-wh4c-j3r5-mjhp
• Security: XMLSerializer now splits CDATASection nodes whose data contains "]]>" into adjacent CDATA sections at serialization time, preventing XML injection via mutation methods (appendData, replaceData, .data =, .textContent =). GHSA-wh4c-j3r5-mjhp

Code that passes a string containing "]]>" to createCDATASection and relied on the previously unsafe behavior will now receive InvalidCharacterError. Use a mutation method such as appendData if you intentionally need "]]>" in a CDATASection node's data.

Thank you, @​thesmartshadow, @​stevenobiajulu, for your contributions

xmldom/xmldom#357

Changelog

Sourced from @​xmldom/xmldom's changelog.

0.8.13

Fixed

• Security: XMLSerializer.serializeToString() (and Node.toString(), NodeList.toString()) now accept a requireWellFormed option (fourth argument, after isHtml and nodeFilter). When { requireWellFormed: true } is passed, the serializer throws InvalidStateError for injection-prone node content, preventing XML injection via attacker-controlled node data. GHSA-j759-j44w-7fr8 GHSA-x6wf-f3px-wcqx GHSA-f6ww-3ggp-fr8h
  • Comment: throws when data contains -->
  • ProcessingInstruction: throws when data contains ?>
  • DocumentType: throws when publicId fails PubidLiteral, systemId fails SystemLiteral, or internalSubset contains ]>
• Security: DOM traversal operations (XMLSerializer.serializeToString(), Node.prototype.normalize(), Node.prototype.cloneNode(true), Document.prototype.importNode(node, true), node.textContent getter, getElementsByTagName() / getElementsByTagNameNS() / getElementsByClassName() / getElementById()) are now iterative. Previously, deeply nested DOM trees would exhaust the JavaScript call stack and throw an unrecoverable RangeError. GHSA-2v35-w6hq-6mfw

Thank you, @​Jvr2022, @​praveen-kv, @​TharVid, @​decsecre583, @​tlsbollei, @​KarimTantawey, for your contributions

0.9.9

Added

• implement ParentNode.children getter [#960](https://github.com/xmldom/xmldom/issues/960) / [#410](https://github.com/xmldom/xmldom/issues/410)

Fixed

• Security: createCDATASection now throws InvalidCharacterError when data contains "]]>", as required by the WHATWG DOM spec. GHSA-wh4c-j3r5-mjhp
• Security: XMLSerializer now splits CDATASection nodes whose data contains "]]>" into adjacent CDATA sections at serialization time, preventing XML injection via mutation methods (appendData, replaceData, .data =, .textContent =). GHSA-wh4c-j3r5-mjhp
• correctly traverse ancestor chain in Node.contains [#931](https://github.com/xmldom/xmldom/issues/931)

Code that passes a string containing "]]>" to createCDATASection and relied on the previously unsafe behavior will now receive InvalidCharacterError. Use a mutation method such as appendData if you intentionally need "]]>" in a CDATASection node's data.

Chore

• updated dependencies

Thank you, @​stevenobiajulu, @​yoshi389111, @​thesmartshadow, for your contributions

0.8.12

Fixed

• preserve trailing whitespace in ProcessingInstruction data [#962](https://github.com/xmldom/xmldom/issues/962) / [#42](https://github.com/xmldom/xmldom/issues/42)

... (truncated)

Commits

• e5c1480 0.8.13
• 9611e20 style: drop unused import in test file
• dc4dff3 docs: add 0.8.13 changelog entry
• 842fa38 fix: prevent stack overflow in normalize (GHSA-2v35-w6hq-6mfw)
• aeff69f test: add normalize behavioral coverage to node.test.js
• cbdb0d7 fix: make walkDOM iterative to prevent stack overflow (GHSA-2v35-w6hq-6mfw)
• 0b543d3 test: assert namespace declarations are isolated between siblings in serializ...
• c007c51 refactor: migrate serializeToString to walkDOM
• 2bb3899 test: add serializeToString coverage for uncovered branches
• e69f38d refactor: migrate importNode to walkDOM
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by karfau, a new releaser for @​xmldom/xmldom since your current version.

Updates fast-uri from 3.1.0 to 3.1.2

Release notes

Sourced from fast-uri's releases.

v3.1.2

⚠️ Security Release

• Fix for GHSA-v39h-62p7-jpjc

What's Changed

• Handle malformed fragment decoding as a parse error by @​mcollina in fastify/fast-uri#171

Full Changelog: fastify/fast-uri@v3.1.1...v3.1.2

v3.1.1

⚠️ Security Release

• Fix for GHSA-q3j6-qgpj-74h6

What's Changed

• build(deps-dev): bump tsd from 0.32.0 to 0.33.0 by @​dependabot[bot] in fastify/fast-uri#148
• build(deps): bump actions/checkout from 4 to 5 by @​dependabot[bot] in fastify/fast-uri#149
• chore(.npmrc): ignore scripts by @​Fdawgs in fastify/fast-uri#150
• build(deps-dev): remove @​fastify/pre-commit by @​Fdawgs in fastify/fast-uri#151
• build(deps): bump actions/setup-node from 4 to 5 by @​dependabot[bot] in fastify/fast-uri#152
• ci(ci): add concurrency config by @​Fdawgs in fastify/fast-uri#153
• build(deps): bump actions/setup-node from 5 to 6 by @​dependabot[bot] in fastify/fast-uri#154
• build(deps): bump actions/checkout from 5 to 6 by @​dependabot[bot] in fastify/fast-uri#156
• chore(license): standardise license notice by @​Fdawgs in fastify/fast-uri#159
• style: remove trailing whitespace by @​Fdawgs in fastify/fast-uri#161
• ci: remove unused github files by @​Tony133 in fastify/fast-uri#162
• chore: update readme by @​Tony133 in fastify/fast-uri#164
• build(deps): bump fastify/workflows/.github/workflows/plugins-ci-package-manager.yml from 5 to 6 by @​dependabot[bot] in fastify/fast-uri#165
• build(deps): bump fastify/workflows/.github/workflows/plugins-ci.yml from 5 to 6 by @​dependabot[bot] in fastify/fast-uri#166
• build(deps-dev): bump neostandard from 0.12.2 to 0.13.0 by @​dependabot[bot] in fastify/fast-uri#167
• ci: add lock-threads workflow by @​Fdawgs in fastify/fast-uri#169

New Contributors

• @​Tony133 made their first contribution in fastify/fast-uri#162

Full Changelog: fastify/fast-uri@v3.1.0...v3.1.1

Commits

• 919dd8e Bumped v3.1.2
• c65ba57 fixup: linting
• 6c86c17 Merge commit from fork
• a95158a Handle malformed fragment decoding without throwing (#171)
• cea547c Bumped v3.1.1
• 876ce79 Merge commit from fork
• dcdf690 ci: add lock-threads workflow (#169)
• c860e65 build(deps-dev): bump neostandard from 0.12.2 to 0.13.0 (#167)
• 9b4c6dc build(deps): bump fastify/workflows/.github/workflows/plugins-ci.yml (#166)
• 85d09a9 build(deps): bump fastify/workflows/.github/workflows/plugins-ci-package-mana...
• Additional commits viewable in compare view

Updates ip-address from 10.1.0 to 10.2.0

Commits

• See full diff in compare view

Updates langsmith from 0.5.13 to 0.7.1

Release notes

Sourced from langsmith's releases.

v0.7.1

What's Changed

• release(js): 0.5.0 by @​jacoblee93 in langchain-ai/langsmith-sdk#2381
• fix(ci): Convert JS release workflow to use OIDC by @​jacoblee93 in langchain-ai/langsmith-sdk#2383
• feat(js): run evaluations as examples complete by @​bees in langchain-ai/langsmith-sdk#2349
• fix(js): Restore default concurrency behavior for JS eval runner by @​jacoblee93 in langchain-ai/langsmith-sdk#2385
• fix(js,py): Adds backcompat for old prompt cache API by @​jacoblee93 in langchain-ai/langsmith-sdk#2386
• fix(js): Add system message visibility to Anthropic wrapper traces by @​veeceey in langchain-ai/langsmith-sdk#2375
• release(py): 0.7.1 by @​jacoblee93 in langchain-ai/langsmith-sdk#2388

New Contributors

• @​veeceey made their first contribution in langchain-ai/langsmith-sdk#2375

Full Changelog: langchain-ai/langsmith-sdk@v0.7.0...v0.7.1

v0.7.0

What's Changed

• chore(deps): bump form-data from 4.0.3 to 4.0.5 in /js by @​dependabot[bot] in langchain-ai/langsmith-sdk#2282
• chore(deps-dev): bump langchain from 0.3.29 to 0.3.37 in /js by @​dependabot[bot] in langchain-ai/langsmith-sdk#2283
• chore(deps): bump vite from 6.3.5 to 6.4.1 in /js by @​dependabot[bot] in langchain-ai/langsmith-sdk#2284
• chore:deps by @​jkennedyvz in langchain-ai/langsmith-sdk#2356
• chore(deps): bump python-multipart from 0.0.21 to 0.0.22 in /python by @​dependabot[bot] in langchain-ai/langsmith-sdk#2351
• chore(deps): bump protobuf from 6.33.2 to 6.33.5 in /python by @​dependabot[bot] in langchain-ai/langsmith-sdk#2352
• chore(deps): bump pyasn1 from 0.6.1 to 0.6.2 in /python by @​dependabot[bot] in langchain-ai/langsmith-sdk#2353
• chore(deps-dev): bump esbuild from 0.20.2 to 0.25.0 in /js/internal/environment_tests/test-exports-esbuild in the npm_and_yarn group across 1 directory by @​dependabot[bot] in langchain-ai/langsmith-sdk#2354
• chore(deps): bump jws from 4.0.0 to 4.0.1 in /js by @​dependabot[bot] in langchain-ai/langsmith-sdk#2355
• chore(deps): bump actions/setup-node from 3 to 6 by @​dependabot[bot] in langchain-ai/langsmith-sdk#2357
• chore(deps): bump actions/github-script from 6 to 8 by @​dependabot[bot] in langchain-ai/langsmith-sdk#2358
• chore(deps): bump actions/checkout from 2 to 6 by @​dependabot[bot] in langchain-ai/langsmith-sdk#2359
• chore(deps): bump astral-sh/setup-uv from 6 to 7 by @​dependabot[bot] in langchain-ai/langsmith-sdk#2360
• chore(deps): bump actions/cache from 4 to 5 by @​dependabot[bot] in langchain-ai/langsmith-sdk#2361
• chore(deps-dev): bump ty from 0.0.10 to 0.0.15 in /python in the py-minor-and-patch group by @​dependabot[bot] in langchain-ai/langsmith-sdk#2362
• chore(deps): update httpx requirement from <0.28.0,>=0.23.0 to >=0.23.0,<0.29.0 in /python by @​dependabot[bot] in langchain-ai/langsmith-sdk#2363
• chore(deps-dev): bump eslint-plugin-prettier from 4.2.1 to 4.2.5 in /js by @​dependabot[bot] in langchain-ai/langsmith-sdk#2366
• chore(deps-dev): bump babel-jest from 29.7.0 to 30.2.0 in /js by @​dependabot[bot] in langchain-ai/langsmith-sdk#2365
• chore: adding workflow perms by @​jkennedyvz in langchain-ai/langsmith-sdk#2367
• fix: esbuild CVE dependabot 78 by @​jkennedyvz in langchain-ai/langsmith-sdk#2369
• fix(deps): resolve glob CLI command injection (CVE-2025-64756) by @​jkennedyvz in langchain-ai/langsmith-sdk#2368
• fix(deps): resolve js-yaml prototype pollution vulnerability by @​jkennedyvz in langchain-ai/langsmith-sdk#2370
• chore(deps): bump the js-minor-and-patch group in /js with 20 updates by @​dependabot[bot] in langchain-ai/langsmith-sdk#2364
• chore: rm unused fn by @​hinthornw in langchain-ai/langsmith-sdk#2346
• feat(py,js): Use global singleton for prompt cache, enable by default by @​jacoblee93 in langchain-ai/langsmith-sdk#2371
• chore: Support jwt auth in replicas by @​hinthornw in langchain-ai/langsmith-sdk#2293
• release(py): 0.7.0 by @​jacoblee93 in langchain-ai/langsmith-sdk#2382

New Contributors

• @​jkennedyvz made their first contribution in langchain-ai/langsmith-sdk#2356

Full Changelog: langchain-ai/langsmith-sdk@v0.6.9...v0.7.0

... (truncated)

Commits

• See full diff in compare view

Install script changes

This version modifies prepublish script that runs during installation. Review the package contents before updating.

Updates picomatch from 2.3.1 to 4.0.4

Release notes

Sourced from picomatch's releases.

4.0.4

This is a security release fixing several security relevant issues.

What's Changed

• Fix for CVE-2026-33671
• Fix for CVE-2026-33672

Full Changelog: micromatch/picomatch@4.0.3...4.0.4

4.0.3

What's Changed

• fix: exception when glob pattern contains constructor by @​Jason3S in micromatch/picomatch#144

New Contributors

• @​Jason3S made their first contribution in micromatch/picomatch#144

Full Changelog: micromatch/picomatch@4.0.2...4.0.3

3.0.2

This is a security release fixing several security relevant issues.

What's Changed

• fix: exception when glob pattern contains constructor by @​Jason3S in micromatch/picomatch#144
• Fix for CVE-2026-33671
• Fix for CVE-2026-33672

Full Changelog: micromatch/picomatch@3.0.1...3.0.2

2.3.2

This is a security release fixing several security relevant issues.

What's Changed

• fix: exception when glob pattern contains constructor by @​Jason3S in micromatch/picomatch#144
• Fix for CVE-2026-33671
• Fix for CVE-2026-33672

Full Changelog: micromatch/picomatch@2.3.1...2.3.2

Changelog

Sourced from picomatch's changelog.

Release history

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

• Changelogs are for humans, not machines.
• There should be an entry for every single version.
• The same types of changes should be grouped.
• Versions and sections should be linkable.
• The latest version comes first.
• The release date of each versions is displayed.
• Mention whether you follow Semantic Versioning.

Changelog entries are classified using the following labels (from keep-a-changelog):

• Added for new features.
• Changed for changes in existing functionality.
• Deprecated for soon-to-be removed features.
• Removed for now removed features.
• Fixed for any bug fixes.
• Security in case of vulnerabilities.

4.0.0 (2024-02-07)

Fixes

• Fix bad text values in parse #126, thanks to @​connor4312

Changed

• Remove process global to work outside of node #129, thanks to @​styfle
• Add side...

  Description has been truncated