Bump the production-dependencies group across 1 directory with 9 updates by dependabot[bot] · Pull Request #59 · advanced-security/github-sbom-toolkit

dependabot · 2026-10-05T21:55:45Z

Bumps the production-dependencies group with 9 updates in the / directory:

Package	From	To
@octokit/core	`7.0.7`	`7.0.8`
@octokit/graphql	`9.0.4`	`9.0.5`
@octokit/plugin-paginate-rest	`14.0.0`	`15.0.0`
@octokit/plugin-rest-endpoint-methods	`17.0.0`	`18.0.0`
chalk	`5.6.2`	`6.0.0`
inquirer	`14.0.2`	`14.2.2`
p-limit	`7.3.1`	`7.3.3`
yaml	`2.9.0`	`2.9.1`
yargs	`18.1.0`	`18.2.0`

Updates @octokit/core from 7.0.7 to 7.0.8

Release notes

Sourced from @octokit/core's releases.

v7.0.8

7.0.8 (2026-08-30)

Bug Fixes

deps: update dependency @octokit/types to v18 (#800) (9729779)

Commits

9729779 fix(deps): update dependency @octokit/types to v18 (#800)
d6abb6e ci(action): update actions/setup-node action to v7 (#788)
See full diff in compare view

Updates @octokit/graphql from 9.0.4 to 9.0.5

Release notes

Sourced from @octokit/graphql's releases.

v9.0.5

9.0.5 (2026-08-30)

Bug Fixes

deps: update dependency @octokit/types to v18 (#707) (50222c3)

Commits

50222c3 fix(deps): update dependency @octokit/types to v18 (#707)
See full diff in compare view

Updates @octokit/plugin-paginate-rest from 14.0.0 to 15.0.0

Release notes

Sourced from @octokit/plugin-paginate-rest's releases.

v15.0.0

15.0.0 (2026-08-01)

feat!: drop legacy project endpoints (#711) (c3202ca)

BREAKING CHANGES

Removed /orgs/{org}/projects

Removed /orgs/{org}/teams/{team_slug}/projects

Removed /orgs/{org}/teams/{team_slug}/projects/{project_id}

Removed /projects/columns/{column_id}

Removed /projects/columns/{column_id}/moves

Removed /projects/{project_id}

Removed /projects/{project_id}/collaborators

Removed /projects/{project_id}/collaborators/{username}

Removed /projects/{project_id}/collaborators/{username}/permission

Removed /repos/{owner}/{repo}/projects

Removed /teams/{team_id}/projects

Removed /teams/{team_id}/projects/{project_id}

Removed /user/projects

Removed /users/{username}/projects

Commits

c3202ca feat!: drop legacy project endpoints (#711)
be87ec4 ci(action): update actions/setup-node action to v7 (#732)
6c64a55 chore(deps): update dependency prettier to v3.9.6 (#710)
e7a8240 ci(action): update actions/checkout action to v7 (#730)
98fa264 build(deps-dev): bump postcss from 8.5.15 to 8.5.23 (#735)
b99246b build(deps-dev): bump shell-quote from 1.8.4 to 1.10.0 (#734)
2c9dc55 build(deps-dev): bump brace-expansion from 5.0.6 to 5.0.7 (#733)
3ab90e2 chore(deps): update dependency esbuild to ^0.28.0 [security] (#729)
ccf32ca build(deps): lock file maintenance (#728)
4f219b8 ci(release): add permissions for OIDC and npm provenance (#717)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @octokit/plugin-paginate-rest since your current version.

Updates @octokit/plugin-rest-endpoint-methods from 17.0.0 to 18.0.0

Release notes

Sourced from @octokit/plugin-rest-endpoint-methods's releases.

v18.0.0

18.0.0 (2026-08-01)

Features

drop projects-classic endpoints, add GitHub API endpoints: cache limits (retention & storage) for repos/orgs/enterprises, billing budgets & usage, artifacts deployment metadata, and projectsV2 drafts & fields (#842) (6b06331)

BREAKING CHANGES

Removed /orgs/{org}/projects

Removed /orgs/{org}/settings/billing/actions

Removed /orgs/{org}/settings/billing/packages

Removed /orgs/{org}/settings/billing/shared-storage

Removed /orgs/{org}/teams/{team_slug}/projects

Removed /orgs/{org}/teams/{team_slug}/projects/{project_id}

Removed /projects/columns/{column_id}

Removed /projects/columns/{column_id}/moves

Removed /projects/{project_id}

Removed /projects/{project_id}/collaborators

Removed /projects/{project_id}/collaborators/{username}

Removed /projects/{project_id}/collaborators/{username}/permission

Removed /repos/{owner}/{repo}/projects

Removed /teams/{team_id}/projects

Removed /teams/{team_id}/projects/{project_id}

Removed /user/projects

Removed /users/{username}/projects

Removed /users/{username}/settings/billing/actions

Removed /users/{username}/settings/billing/packages

Removed /users/{username}/settings/billing/shared-storage

Commits

6b06331 feat: drop projects-classic endpoints, add GitHub API endpoints: cache limits...
197d78d chore(deps): update dependency prettier to v3.7.4 (#841)
0f54295 chore(deps): update dependency camelcase to v9 (#834)
21a7ce2 chore(deps): replace glob with tinyglobby (#839)
c354dc9 build(deps): bump glob (#838)
b41f442 chore(deps): update dependency @types/node to v24 (#830)
1712586 chore(deps): update vitest monorepo to v4 (major) (#829)
See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @octokit/plugin-rest-endpoint-methods since your current version.

Updates chalk from 5.6.2 to 6.0.0

Release notes

Sourced from chalk's releases.

v6.0.0

Breaking

Require Node.js 22 8a94e0e

Improvements

Add underline styles and underline colors (#689) 4c304dd

Improve performance 5729845 fa5cff2

Fixes

Treat a numeric FORCE_COLOR as an exact level (#688) e912931

Downsample ansi256() and bgAnsi256() to 16 colors at level 1 (#687) ff549c5

chalk/chalk@v5.6.2...v6.0.0

Commits

661317e 6.0.0
5729845 Improve performance
4c304dd Add extended underline styles and underline colors (#689)
e912931 Fix: Treat a numeric FORCE_COLOR as an exact level (#688)
8a94e0e Require Node.js 22
fa5cff2 Optimize 2-argument calls (#670)
ff549c5 Fix: Downsample ansi256() and bgAnsi256() to 16 colors at level 1 (#687)
678e550 Tweaks
aa06bb5 Fix typos (#664)
See full diff in compare view

Updates inquirer from 14.0.2 to 14.2.2

Release notes

Sourced from inquirer's releases.

inquirer@14.2.2

The umbrella package, bundling @inquirer/prompts and @inquirer/core.

What's new

Fixed a race where keystrokes batched in the same tick as the key that settled a prompt could still reach keypress handlers after the prompt was done, cancelled, or aborted (@inquirer/core, #2255, closes #1816).

confirm() now trims surrounding whitespace from answers before matching yes/no keywords (@inquirer/confirm, #2254).

Included

@inquirer/core@^12.0.3

@inquirer/prompts@^8.7.2

inquirer@14.2.1

The umbrella package, bundling @inquirer/prompts and @inquirer/core.

What's new

Published manifests now pin @inquirer/type to an exact version. Since these type definitions leak into consumers' tsc runs, a semver range on the types-only dependency could break downstream TypeScript builds without any change to Inquirer.js itself (#2247, fixes #2244).

Included

@inquirer/core@^12.0.2

@inquirer/prompts@^8.7.1

@inquirer/type@4.1.1 (pinned exactly)

@inquirer/ansi@^2.0.8

inquirer@14.2.0

The umbrella package, bundling @inquirer/prompts and @inquirer/core.

What's new

Updated to @inquirer/prompts@^8.7.0 and @inquirer/core@^12.0.1.

Includes the new toggleMask option for password (ctrl+t to reveal), localized yes/no parsing for confirm, and prettified prompt/theme types for better IDE display.

Included

@inquirer/core@^12.0.1

@inquirer/prompts@^8.7.0

@inquirer/type@^4.1.0

@inquirer/ansi@^2.0.7

inquirer@14.1.0

The umbrella package, bundling @inquirer/prompts and @inquirer/core.

What's new

... (truncated)

Commits

cbdb34b chore: Publish new release
8340d2d fix(@inquirer/core): clear hook effects before settling prompts
2475e07 test(@inquirer/core): cover hook cleanup error semantics
15cd8d3 fix(confirm): ignore surrounding whitespace in answers
9cb0da6 chore(deps): Bump github/codeql-action/analyze from 4.37.7 to 4.37.9
1c750bc chore(deps-dev): Bump the build group with 3 updates (#2251)
81f1525 chore(deps-dev): Bump @types/node in the types group (#2252)
7c27f26 chore(deps-dev): Bump oxfmt in the formatting group (#2249)
6119088 chore(deps): Bump github/codeql-action/init from 4.37.7 to 4.37.9 (#2250)
0d167c0 chore(deps-dev): Bump the linting group with 4 updates (#2248)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for inquirer since your current version.

Updates p-limit from 7.3.1 to 7.3.3

Release notes

Sourced from p-limit's releases.

v7.3.3

Fix unhandled rejections in limit.map() when the iterable throws 9df0d27

sindresorhus/p-limit@v7.3.2...v7.3.3

v7.3.2

Fix limitFunction queue clearing (#109) f3e7f9b

sindresorhus/p-limit@v7.3.1...v7.3.2

Commits

4d4ec71 7.3.3
9df0d27 Fix unhandled rejections in limit.map() when the iterable throws
783068b 7.3.2
f3e7f9b Fix limitFunction queue clearing (#109)
See full diff in compare view

Updates yaml from 2.9.0 to 2.9.1

Release notes

Sourced from yaml's releases.

v2.9.1

Limit recursive merge aliases (#685, #713)

Simplify line unfolding during quoted string parsing (#714)

Commits

1440ecd 2.9.1
c699bc5 fix: Simplify line unfolding during quoted string parsing (#714)
d11ce77 fix: Limit recursive merge aliases (#713)
c5f49f4 chore: Update docs-slate
See full diff in compare view

Updates yargs from 18.1.0 to 18.2.0

Changelog

Sourced from yargs's changelog.

18.2.0 (2026-09-20)

Features

support creating completions for fish shell (#2568) (34d833a)

Bug Fixes

completion: remove spurious single-quote in zsh loadautofunc detection (#2548) (224e285)

Commits

e49b60a chore(main): release 18.2.0 (#2569)
3ed7095 Set up staged trusted publishing, and remove stale deno workflow (#2591)
224e285 fix(completion): remove spurious single-quote in zsh loadautofunc detection (...
fb9c055 Add SECURITY.md
2a4378b Add FUNDING.yml with funding sources
34d833a feat: support creating completions for fish shell (#2568)
3a49608 Remove copy-pasted email address (#2566)
See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for yargs since your current version.

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

Bumps the production-dependencies group with 9 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@octokit/core](https://github.com/octokit/core.js) | `7.0.7` | `7.0.8` | | [@octokit/graphql](https://github.com/octokit/graphql.js) | `9.0.4` | `9.0.5` | | [@octokit/plugin-paginate-rest](https://github.com/octokit/plugin-paginate-rest.js) | `14.0.0` | `15.0.0` | | [@octokit/plugin-rest-endpoint-methods](https://github.com/octokit/plugin-rest-endpoint-methods.js) | `17.0.0` | `18.0.0` | | [chalk](https://github.com/chalk/chalk) | `5.6.2` | `6.0.0` | | [inquirer](https://github.com/SBoudrias/Inquirer.js) | `14.0.2` | `14.2.2` | | [p-limit](https://github.com/sindresorhus/p-limit) | `7.3.1` | `7.3.3` | | [yaml](https://github.com/eemeli/yaml) | `2.9.0` | `2.9.1` | | [yargs](https://github.com/yargs/yargs) | `18.1.0` | `18.2.0` | Updates `@octokit/core` from 7.0.7 to 7.0.8 - [Release notes](https://github.com/octokit/core.js/releases) - [Commits](octokit/core.js@v7.0.7...v7.0.8) Updates `@octokit/graphql` from 9.0.4 to 9.0.5 - [Release notes](https://github.com/octokit/graphql.js/releases) - [Commits](octokit/graphql.js@v9.0.4...v9.0.5) Updates `@octokit/plugin-paginate-rest` from 14.0.0 to 15.0.0 - [Release notes](https://github.com/octokit/plugin-paginate-rest.js/releases) - [Commits](octokit/plugin-paginate-rest.js@v14.0.0...v15.0.0) Updates `@octokit/plugin-rest-endpoint-methods` from 17.0.0 to 18.0.0 - [Release notes](https://github.com/octokit/plugin-rest-endpoint-methods.js/releases) - [Commits](octokit/plugin-rest-endpoint-methods.js@v17.0.0...v18.0.0) Updates `chalk` from 5.6.2 to 6.0.0 - [Release notes](https://github.com/chalk/chalk/releases) - [Commits](chalk/chalk@v5.6.2...v6.0.0) Updates `inquirer` from 14.0.2 to 14.2.2 - [Release notes](https://github.com/SBoudrias/Inquirer.js/releases) - [Commits](https://github.com/SBoudrias/Inquirer.js/compare/inquirer@14.0.2...inquirer@14.2.2) Updates `p-limit` from 7.3.1 to 7.3.3 - [Release notes](https://github.com/sindresorhus/p-limit/releases) - [Commits](sindresorhus/p-limit@v7.3.1...v7.3.3) Updates `yaml` from 2.9.0 to 2.9.1 - [Release notes](https://github.com/eemeli/yaml/releases) - [Commits](eemeli/yaml@v2.9.0...v2.9.1) Updates `yargs` from 18.1.0 to 18.2.0 - [Release notes](https://github.com/yargs/yargs/releases) - [Changelog](https://github.com/yargs/yargs/blob/main/CHANGELOG.md) - [Commits](yargs/yargs@v18.1.0...v18.2.0) --- updated-dependencies: - dependency-name: "@octokit/core" dependency-version: 7.0.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: "@octokit/graphql" dependency-version: 9.0.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: "@octokit/plugin-paginate-rest" dependency-version: 15.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies - dependency-name: "@octokit/plugin-rest-endpoint-methods" dependency-version: 18.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies - dependency-name: chalk dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies - dependency-name: inquirer dependency-version: 14.2.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: p-limit dependency-version: 7.3.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: yaml dependency-version: 2.9.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: yargs dependency-version: 18.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-10-05T21:55:47Z

Assignees

The following users could not be added as assignees: aegilops. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Please fix the above issues or remove invalid values from dependabot.yml.

…ies-4689c4a3e3

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 5, 2026

dependabot Bot requested a review from a team as a code owner October 5, 2026 21:55

dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 5, 2026

dependabot Bot requested review from adrienpessu and felickz October 5, 2026 21:55

dependabot Bot added the javascript Pull requests that update javascript code label Oct 5, 2026

Merge branch 'main' into dependabot/npm_and_yarn/production-dependenc…

be97184

…ies-4689c4a3e3

gubraun merged commit 9eb1dc0 into main Nov 6, 2026
6 checks passed

dependabot Bot deleted the dependabot/npm_and_yarn/production-dependencies-4689c4a3e3 branch November 6, 2026 17:39

Navigation Menu

Repository navigation

Bump the production-dependencies group across 1 directory with 9 updates - #59

Bump the production-dependencies group across 1 directory with 9 updates#59
gubraun merged 2 commits into
mainfrom
dependabot/npm_and_yarn/production-dependencies-4689c4a3e3

dependabot Bot commented on behalf of github Oct 5, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Oct 5, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

dependabot Bot commented on behalf of github Oct 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v7.0.8

7.0.8 (2026-08-30)

Bug Fixes

v9.0.5

9.0.5 (2026-08-30)

Bug Fixes

v15.0.0

15.0.0 (2026-08-01)

BREAKING CHANGES

v18.0.0

18.0.0 (2026-08-01)

Features

BREAKING CHANGES

v6.0.0

Breaking

Improvements

Fixes

inquirer@14.2.2

What's new

Included

inquirer@14.2.1

What's new

Included

inquirer@14.2.0

What's new

Included

inquirer@14.1.0

What's new

v7.3.3

v7.3.2

v2.9.1

18.2.0 (2026-09-20)

Features

Bug Fixes

Uh oh!

dependabot Bot commented on behalf of github Oct 5, 2026

Assignees

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dependabot Bot commented on behalf of github Oct 5, 2026 •

edited

Loading