Skip to content

chore(deps): bump the npm-sdk-deps group across 2 directories with 6 updates#3945

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/cmd/hatchet-cli/cli/templates/typescript/pnpm/npm-sdk-deps-4f845b020b
Closed

chore(deps): bump the npm-sdk-deps group across 2 directories with 6 updates#3945
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/cmd/hatchet-cli/cli/templates/typescript/pnpm/npm-sdk-deps-4f845b020b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github May 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm-sdk-deps group with 1 update in the /cmd/hatchet-cli/cli/templates/typescript/pnpm directory: @hatchet-dev/typescript-sdk.
Bumps the npm-sdk-deps group with 5 updates in the /sdks/typescript directory:

Package From To
@types/qs 6.15.0 6.15.1
axios 1.16.0 1.16.1
protobufjs 7.5.6 7.5.8
semver 7.7.4 7.8.0
yaml 2.8.4 2.9.0

Updates @hatchet-dev/typescript-sdk from 1.21.2 to 1.22.1

Commits

Updates @types/qs from 6.15.0 to 6.15.1

Commits

Updates axios from 1.16.0 to 1.16.1

Release notes

Sourced from axios's releases.

v1.16.1 — May 13, 2026

This release ships a defence-in-depth fix for prototype pollution in formDataToJSON, hardens proxy and CI workflows, restores Webpack 4 compatibility for the fetch adapter, and includes several small bug fixes and maintenance improvements.

🔒 Security Fixes

  • Prototype Pollution Defence-in-Depth: Hardened formDataToJSON against already-polluted Object.prototype by walking own properties only, so attacker-controlled keys inherited from a poisoned prototype cannot propagate through deserialization. (#7413)
  • Proxy Cleartext Leak: Fixed an issue where HTTPS request data could be transmitted in cleartext to an HTTP proxy under certain configurations. (#10858)
  • CI Cache Removal: Removed all GitHub Actions caches as a defence-in-depth measure against cache poisoning vectors in the build pipeline. (#10882)

🐛 Bug Fixes

  • Data URI Parsing: Updated the fromDataURI regex to match RFC 2397 more strictly, fixing edge cases in data: URL handling. (#10829)
  • Unicode Headers: Preserved Unicode header values when running through request interceptors, so non-ASCII header content is no longer corrupted before dispatch. (#10850)
  • XHR Upload Progress: Guarded against malformed ProgressEvent payloads emitted by some environments during XHR upload, preventing crashes when loaded / total are missing or invalid. (#10868)
  • Webpack 4 Fetch Adapter: Fixed an "unexpected token" error caused by syntax in the fetch adapter that Webpack 4 could not parse, restoring compatibility for legacy bundler users. (#10864)
  • Type Definitions: Made parseReviver context.source optional in the type definitions to align with the ES2023 specification. (#10837)
  • URL Object Support Reverted: Reverted the change that allowed passing a URL object as config.url (originally #10866) due to regressions; this support will be reintroduced in a later release once the underlying issues are addressed. (#10874)

🔧 Maintenance & Chores

  • Cycle Detection Refactor: Replaced the array-based cycle tracker in toJSONObject with a WeakSet, improving performance and memory behaviour on large nested structures. (#10832)
  • composeSignals Cleanup: Refactored composeSignals to use a clearer early-return structure, simplifying the cancellation/abort composition path. (#10844)
  • AI Readiness & Repo Docs: Added AGENTS.md and related contributor-guide updates for both human and AI agents, plus post-release documentation improvements. (#10835, #10841)
  • Docs Improvements: Clarified the GET request example, fixed the interceptor eject example to reference the correct instance, and corrected the Buzzoid sponsor description in the README. (#10836, #10853, #10856)
  • Sponsorship Tooling: Fixed empty sponsor arrays in the sponsor processing script, added the ability to inject additional sponsors, updated the sponsorship link, and added a Twicsy advertisement entry. (#10843, #10859, #10869)
  • Dependencies: Bumped @commitlint/cli from 20.5.0 to 20.5.2. (#10846)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

Full Changelog

Changelog

Sourced from axios's changelog.

Changelog

Commits
  • 1337d6b chore(release): prepare release 1.16.1 (#10877)
  • 858a790 fix: remove all caches (#10882)
  • 34adfd9 revert: "fix: support URL object as config.url input (#10866)" (#10874)
  • 847d89b fix: support URL object as config.url input (#10866)
  • 4094886 fix(progress): guard malformed XHR upload events (#10868)
  • 44f0c5b chore: change sponsorship link and add Twicsy advertisement (#10869)
  • 64e1095 chore: update PR and issue template to use h2 (#10865)
  • 3e6b4e1 fix: error unexpected token in fetch JS compatibility issue with Webpack 4 (#...
  • c4453ba fix: add the ability to add additional sponsors to the process sponsors scrip...
  • caa00a9 fix: https data in cleartext to proxy (#10858)
  • Additional commits viewable in compare view

Updates protobufjs from 7.5.6 to 7.5.8

Release notes

Sourced from protobufjs's releases.

protobufjs: v7.5.8

7.5.8 (2026-05-12)

Bug Fixes

protobufjs: v7.5.7

7.5.7 (2026-05-09)

Bug Fixes

Changelog

Sourced from protobufjs's changelog.

7.5.8 (2026-05-12)

Bug Fixes

7.5.7 (2026-05-09)

Bug Fixes

Commits

Updates semver from 7.7.4 to 7.8.0

Release notes

Sourced from semver's releases.

v7.8.0

7.8.0 (2026-05-08)

Features

Bug Fixes

Documentation

Chores

Changelog

Sourced from semver's changelog.

7.8.0 (2026-05-08)

Features

Bug Fixes

Documentation

Chores

Commits
  • efa4be6 chore: release 7.8.0 (#847)
  • 9542e09 chore: template-oss-apply
  • 937bc2c chore: template-oss-apply@5.0.0
  • 3905343 fix: Warn when defaulting to --inc=patch in CLI
  • 0d0a0a2 feat: Add truncate function (#855)
  • c368af6 docs: fix typos in documentation (#853)
  • 6946fef chore: bump @​npmcli/template-oss from 4.29.0 to 4.30.0 (#852)
  • 37776c3 docs: fix BNF grammar to distinguish prerelease from build identifiers (#846)
  • See full diff in compare view

Updates yaml from 2.8.4 to 2.9.0

Release notes

Sourced from yaml's releases.

v2.9.0

The changes here are really only patches, but I'm releasing this as a minor version to note a small change to the documentation of parseDocument() and parseAllDocuments(): I've removed the claim that they'll "never throw".

It remains the case that practically all non-malicious inputs will be handled without emitting an error, but there is a decent chance that code paths remain where e.g. a RangeError due to call stack exhaustion can be triggered by malicious inputs. Up to now, I've considered these as security vulnerabilities, and in fact it's the only category of error for which yaml CVEs have been issued so far.

Starting from this release, I'll be considering such errors as bugs, but not vulnerabilities. I do welcome people and/or LLMs looking for them, but please report them as normal issues rather than suspected security vulnerabilities. This also applies to previously undiscovered bugs in earlier releases.

  • fix: Avoid calling Array.prototype.push.apply() with large source array
  • fix(lexer): Avoid recursive calls that may exhaust the call stack
Commits
  • ddb21b0 2.9.0
  • 167365b docs: Clarify that not all errors can be avoided
  • 6eca2a7 fix: Avoid calling Array.prototype.push.apply() with large source array
  • 0543cd5 fix(lexer): Avoid recursive calls that may exhaust the call stack
  • See full diff in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 18, 2026
@vercel

vercel Bot commented May 18, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
hatchet-docs Ready Ready Preview, Comment May 18, 2026 5:44pm

Request Review

@dependabot
chore(deps): bump the npm-sdk-deps group across 2 directories with 6 …
e1b1692 
…updates

Bumps the npm-sdk-deps group with 1 update in the /cmd/hatchet-cli/cli/templates/typescript/pnpm directory: [@hatchet-dev/typescript-sdk](https://github.com/hatchet-dev/hatchet).
Bumps the npm-sdk-deps group with 5 updates in the /sdks/typescript directory:

| Package | From | To |
| --- | --- | --- |
| [@types/qs](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/qs) | `6.15.0` | `6.15.1` |
| [axios](https://github.com/axios/axios) | `1.16.0` | `1.16.1` |
| [protobufjs](https://github.com/protobufjs/protobuf.js) | `7.5.6` | `7.5.8` |
| [semver](https://github.com/npm/node-semver) | `7.7.4` | `7.8.0` |
| [yaml](https://github.com/eemeli/yaml) | `2.8.4` | `2.9.0` |



Updates `@hatchet-dev/typescript-sdk` from 1.21.2 to 1.22.1
- [Release notes](https://github.com/hatchet-dev/hatchet/releases)
- [Commits](https://github.com/hatchet-dev/hatchet/commits)

Updates `@types/qs` from 6.15.0 to 6.15.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/qs)

Updates `axios` from 1.16.0 to 1.16.1
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.16.0...v1.16.1)

Updates `protobufjs` from 7.5.6 to 7.5.8
- [Release notes](https://github.com/protobufjs/protobuf.js/releases)
- [Changelog](https://github.com/protobufjs/protobuf.js/blob/protobufjs-v7.5.8/CHANGELOG.md)
- [Commits](protobufjs/protobuf.js@protobufjs-v7.5.6...protobufjs-v7.5.8)

Updates `semver` from 7.7.4 to 7.8.0
- [Release notes](https://github.com/npm/node-semver/releases)
- [Changelog](https://github.com/npm/node-semver/blob/main/CHANGELOG.md)
- [Commits](npm/node-semver@v7.7.4...v7.8.0)

Updates `yaml` from 2.8.4 to 2.9.0
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.8.4...v2.9.0)

---
updated-dependencies:
- dependency-name: "@hatchet-dev/typescript-sdk"
  dependency-version: 1.22.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-sdk-deps
- dependency-name: "@types/qs"
  dependency-version: 6.15.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-sdk-deps
- dependency-name: axios
  dependency-version: 1.16.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-sdk-deps
- dependency-name: protobufjs
  dependency-version: 7.5.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-sdk-deps
- dependency-name: semver
  dependency-version: 7.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-sdk-deps
- dependency-name: yaml
  dependency-version: 2.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-sdk-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/cmd/hatchet-cli/cli/templates/typescript/pnpm/npm-sdk-deps-4f845b020b branch from 622439a to e1b1692 Compare May 18, 2026 17:41
@dependabot @github

dependabot Bot commented on behalf of github May 18, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this May 18, 2026
@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/cmd/hatchet-cli/cli/templates/typescript/pnpm/npm-sdk-deps-4f845b020b branch May 18, 2026 19:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants