chore(deps-dev): bump the minor-and-patch group across 1 directory with 4 updates

[dependabot]

Bumps the minor-and-patch group with 4 updates in the / directory: @yao-pkg/pkg, axios, csv-stringify and prettier.

Updates @yao-pkg/pkg from 6.20.0 to 6.21.0

Release notes

Sourced from @​yao-pkg/pkg's releases.

Release 6.21.0

6.21.0 (2026-06-30)

Features

• build hooks (preBuild, postBuild, per-file transform) (#273) (3667383), closes package.json#pkg
• bump fetch 3.6.3 with node 22.22.3, 24.15.0 and 26.2.0 (#277) (546bbf0)
• bump fetch 3.6.4 with nodejs 22.23.1, 24.18.0, 26.4.0 (#288) (3520d26)

Bug Fixes

• detector: pick up six more silent-drop shapes (re-exports, new URL, multi-arg path.join, path.resolve(__dirname,…), createRequire aliases, import.meta.resolve) (#272) (ea66111), closes #269
• sea: set process.pkg in worker threads (#270) (376e2a4)

Test added

• fetch-all: track supported node majors, drop node20 (#286) (1b0002f)
• split unit tests into node:test suite, add c8 coverage (#271) (26f10a3), closes #267 #267

Chores

• add worktrees to gitignore (d585e27)
• deps: bump esbuild to >=0.28.1 to fix security vuln (#282) (#284) (68f41d5)

Changelog

Sourced from @​yao-pkg/pkg's changelog.

6.21.0 (2026-06-30)

Features

• build hooks (preBuild, postBuild, per-file transform) (#273) (3667383), closes package.json#pkg
• bump fetch 3.6.3 with node 22.22.3, 24.15.0 and 26.2.0 (#277) (546bbf0)
• bump fetch 3.6.4 with nodejs 22.23.1, 24.18.0, 26.4.0 (#288) (3520d26)

Bug Fixes

• detector: pick up six more silent-drop shapes (re-exports, new URL, multi-arg path.join, path.resolve(__dirname,…), createRequire aliases, import.meta.resolve) (#272) (ea66111), closes #269
• sea: set process.pkg in worker threads (#270) (376e2a4)

Test added

• fetch-all: track supported node majors, drop node20 (#286) (1b0002f)
• split unit tests into node:test suite, add c8 coverage (#271) (26f10a3), closes #267 #267

Chores

• add worktrees to gitignore (d585e27)
• deps: bump esbuild to >=0.28.1 to fix security vuln (#282) (#284) (68f41d5)

6.19.0 (2026-04-24)

Features

• config: accept CLI-only build flags in pkg config (#263) (a8e91df)

Bug Fixes

• deps: update @​roberts_lando/vfs to version 0.3.3 (#266) (d155e24)
• detector: stop silent dependency drops in SEA mode (ESM parse, dynamic import, decorators) (#268) (81c6c88)
• sea: silence benign LIEF warnings during postject injection (#265) (974df53)

6.18.2 (2026-04-22)

Bug Fixes

• sea: match blob generator to target Node version (#247) (ad2a336), closes #236 #236 #236 #236 #236 #236 #236
• sea: strip trailing slashes in manifest key lookup (#261) (af0c086)

6.18.1 (2026-04-21)

Bug Fixes

• pkg: ship all .d.ts files in npm package (#258) (7e10ce2)

6.18.0 (2026-04-20)

... (truncated)

Commits

• See full diff in compare view

Updates axios from 1.18.0 to 1.18.1

Release notes

Sourced from axios's releases.

v1.18.1 — June 21, 2026

This release focuses on Node HTTP adapter fixes, safer AxiosError serialisation, runtime/type correctness fixes, documentation updates, and dependency maintenance.

🐛 Bug Fixes

• AxiosError Serialisation: Made AxiosError#cause non-enumerable to prevent circular JSON serialisation failures when errors include nested causes. (#10913)
• Node HTTP Adapter: Guarded socket.setKeepAlive for proxy agent streams, accepted path-only URLs when socketPath is configured, deferred environment proxy handling to Node, and explicitly passed maxBodyLength through to follow-redirects. (#10917, #10930, #10942, #10993)
• Runtime and Type Correctness: Fixed several runtime crashes, type definition mismatches, and incorrect error handling paths. (#10959, #11021)
• AxiosURLSearchParams: Switched the encoder callback to an arrow function so encoder.call(this) receives the AxiosURLSearchParams instance correctly. (#11019)

🔧 Maintenance & Chores

• Documentation: Documented sensitive headers and status transition behaviour, prepared cleaned-up docs, added Deno install instructions, and clarified that request data is request-specific (#11007, #11010, #11023, #11025)

• Dependencies: Bumped vite, rollup, form-data, js-yaml, and multer across the root project, docs, smoke tests, and module test workspaces. (#11011, #11012, #11013, #11014, #11015, #11016, #11017, #11026)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

• @​webdevelopersrinu (#10913)
• @​sijie-Z (#10993)
• @​bartlomieju (#11023)
• @​JSap0914 (#11019)

Full Changelog

Changelog

Sourced from axios's changelog.

Changelog

Commits

• a209bfb chore(release): prepare release 1.18.1 (#11027)
• fa6a55e chore(deps-dev): bump multer from 2.1.1 to 2.2.0 (#11026)
• 40e7be8 docs: clarifies that request data is request-specific in axios (#11025)
• a446b39 fix(AxiosURLSearchParams): use arrow function so encoder.call(this) receives ...
• cf1306a docs: add Deno to install instructions (#11023)
• b32880a fix: incorrect use of error (#11021)
• 1792eda fix: ensure maxBodyLength is explicitly passed to follow-redirects (#10993)
• 30499d6 fix: various runtime crashes and type definition mismatches (#10959)
• 20ce9c4 fix(http): defer env proxy handling to Node (#10942)
• e64bcf9 chore(deps): merge branch 'v1.x' into tests/module/cjs (#11014)
• Additional commits viewable in compare view

Updates csv-stringify from 6.8.0 to 6.8.1

Changelog

Sourced from csv-stringify's changelog.

6.8.1 (2026-07-02)

Bug Fixes

• csv-stringify: double regexp-metacharacter escape/quote literally (#494)
• csv-stringify: quote fields fusing with a multi-character separator

Commits

• 6e0d5a3 chore(release): publish
• db852d1 fix(csv-stringify): double regexp-metacharacter escape/quote literally (#494)
• abfe4de build: latest dependencies
• 46cab38 fix(csv-stringify): quote fields fusing with a multi-character separator
• See full diff in compare view

Updates prettier from 3.8.4 to 3.9.4

Release notes

Sourced from prettier's releases.

3.9.4

• Angular: Format @content(name) -> @content (name) to align with other block syntax (#19499 by @​fisker)

🔗 Changelog

3.9.3

• Markdown: Fix unexpected removal of characters in liquid syntax (prettier/prettier#19489 by @​seiyab)
• TypeScript: Allow decorators to be used with declare on class fields (prettier/prettier#19492 by @​evoactivity)

🔗 Changelog

3.9.1

• CLI: Fix ignored file has been cached incorrectly (#19483 by @​kovsu)

🔗 Changelog

3.9.0

diff

🔗 Prettier 3.9: Major parser upgrades and Formatting improvements

3.8.5

• Fix Flow variance annotation print (#19022 by @​marcoww6)

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.4

diff

Angular: Format @content(name) -> @content (name) to align with other block syntax (#19499 by @​fisker)

<!-- Input -->
<FancyButton [label]="title">
  @content (icon) {
    <span>Icon!</span>
  }
  @content (description) {
    <span>Description text</span>
  }
  <span>Other children</span>
</FancyButton>
<!-- Prettier 3.9.3 -->
<FancyButton [label]="title">
@​content(icon) {
<span>Icon!</span>
}
@​content(description) {
<span>Description text</span>
}
<span>Other children</span>
</FancyButton>
<!-- Prettier 3.9.4 -->
<FancyButton [label]="title">
@​content (icon) {
<span>Icon!</span>
}
@​content (description) {
<span>Description text</span>
}
<span>Other children</span>
</FancyButton>

3.9.3

diff

Markdown: Fix unexpected removal of characters in liquid syntax (#19489 by @​seiyab)

</tr></table> 

... (truncated)

Commits

• b693cb2 Release 3.9.4
• 2e92ac0 Angular: Format @content(name) -> @content (name) to align with other blo...
• abed2c2 Bump Prettier dependency to 3.9.3
• 6cfbc00 Clean changelog_unreleased
• 3732e1d Release 3.9.3
• a74a7b0 Allow decorators to be used with declare on class fields (#19492)
• bd9e11a Correct text identification in liquid syntax (#19489)
• 269eee3 Bump Prettier dependency to 3.9.1
• ec7ccd1 Clean changelog_unreleased
• c47654c Release 3.9.1
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.