chore(deps): bump the dependencies group across 1 directory with 8 updates by dependabot[bot] · Pull Request #810 · NodeSecure/cli

dependabot · 2026-09-07T05:55:42Z

Bumps the dependencies group with 8 updates in the / directory:

Package	From	To
highlight.js	`11.11.1`	`11.12.0`
markdown-it	`15.0.0`	`15.0.1`
pretty-bytes	`7.1.1`	`7.1.2`
vis-network	`10.1.1`	`10.1.2`
filenamify	`7.0.2`	`7.0.3`
@openally/httpie	`1.1.3`	`2.0.0`
find-my-way	`9.8.0`	`9.9.0`
open	`11.0.1`	`11.0.2`

Updates highlight.js from 11.11.1 to 11.12.0

Release notes

Sourced from highlight.js's releases.

v11.12.0 - Summer, hot and rainy.

Parser Engine:

fix(parser) count named capture groups when rewriting backreferences [spokodev][]

New Grammars:

add FreeDesktop config file (.desktop / systemd) grammar [gg582][]

added 3rd party Cedar grammar to SUPPORTED_LANGUAGES [Dhruv Maniya][]

added 3rd party DAX and M (Power Query) grammars to SUPPORTED_LANGUAGES [jiaopengzi][]

added 3rd party Djot grammar to SUPPORTED_LANGUAGES [Mark Scherer][]

added 3rd party Igor Pro grammar to SUPPORTED_LANGUAGES [Ryne Andal][]

added 3rd party Jaiva grammar to SUPPORTED_LANGUAGES [Lehlogonolo Poole][]

added 3rd party Liquidsoap grammar to SUPPORTED_LANGUAGES [Romain Beauxis][]

added 3rd party MoonBit grammar to SUPPORTED_LANGUAGES [Kaida-Amethyst][]

added 3rd party Pkl grammar to SUPPORTED_LANGUAGES [Dan Chao][]

added 3rd party RAScript grammar to SUPPORTED_LANGUAGES [Joshua Raphael][]

added 3rd party Veryl grammar to SUPPORTED_LANGUAGES [Naoya Hatta][]

added 3rd party Why3 grammar to SUPPORTED_LANGUAGES [JGalego][]

added 3rd party Xojo grammar to SUPPORTED_LANGUAGES [patricksalo][]

referenced existing 3rd party ES|QL grammar in SUPPORTED_LANGUAGES [Styx0x6][]

Core Grammars:

fix(c) only match real atomic_* type names, not C11 atomic functions, issue #3837 [Mark Xian][]

fix(c, cpp) bound the run of type tokens in front of a function name (ReDoS), issue #4362 [Jayesh Bhade][]

fix(c, cpp) scope angle-bracket header string to #include, issue #3505 [Pablo][]

fix(c, cpp) stop a raw string's closing delimiter from swallowing quotes, issue #3585 [David Pavlovschii][]

enh(cmake) add block and endblock keywords [Anonymous Maarten][]

fix(cmake) only highlight standalone numbers, not digits that begin an identifier (e.g. 3rdparty), issue #4170 [Mark Xian][]

fix(cpp) require a word boundary before numeric literals so digits inside identifiers aren't highlighted as numbers, issue #4231 [Mark Xian][]

fix(crystal) stop treating integer division // as a regex literal [Zain Asif][]

enh(csharp) support digit separators in binary literals and numeric type suffixes, and stop highlighting the leading _ of an identifier, issue #4258 [Sarath Francis][]

enh(css) add corner-shape properties [Hama Tanveer][]

enh(css) support six-digit unicode-range values [Konstantin Baltsat][]

enh(dart) add highlighting for class and function names [guuido][]

enh(dns) highlight registered CAA property tags, issue #4475 [Joey Huang][]

enh(dns) improve grammar: character strings, TXT, classes, escapes, addresses [Checconio][]

enh(dos) add batch as an alias, issue #4395 [Hashim Khan][]

enh(gherkin) update keyword list [Hirse][]

enh(gherkin) variables can't contain whitespace [Hirse][]

enh(gherkin) docstrings can use backticks [Hirse][]

enh(go) recognize binary integer literals [spokodev][]

enh(groovy) support underscores in numeric literals [greymoth][]

fix(haskell) highlight where in GADT and closed type-family declarations, issue #3753 [Konstantin Baltsat][]

enh(java) improve detection of types, including generic and array types [Hannes Wallnoefer][]

enh(javascript) add self to built-in variables [Dsaquel][]

enh(kotlin) add ktm and ktx aliases [DarkMatter-999][]

fix(leaf) fix bug in Leaf keyword highlighting [Francesco Paolo Severino][]

fix(lisp) preserve highlighting after quoted multiplication expressions [arturict][]

... (truncated)

Changelog

Sourced from highlight.js's changelog.

Version 11.12.0

Parser Engine:

fix(parser) count named capture groups when rewriting backreferences [spokodev][]

New Grammars:

add FreeDesktop config file (.desktop / systemd) grammar [gg582][]

added 3rd party Cedar grammar to SUPPORTED_LANGUAGES [Dhruv Maniya][]

added 3rd party DAX and M (Power Query) grammars to SUPPORTED_LANGUAGES [jiaopengzi][]

added 3rd party Djot grammar to SUPPORTED_LANGUAGES [Mark Scherer][]

added 3rd party Igor Pro grammar to SUPPORTED_LANGUAGES [Ryne Andal][]

added 3rd party Jaiva grammar to SUPPORTED_LANGUAGES [Lehlogonolo Poole][]

added 3rd party Liquidsoap grammar to SUPPORTED_LANGUAGES [Romain Beauxis][]

added 3rd party MoonBit grammar to SUPPORTED_LANGUAGES [Kaida-Amethyst][]

added 3rd party Pkl grammar to SUPPORTED_LANGUAGES [Dan Chao][]

added 3rd party RAScript grammar to SUPPORTED_LANGUAGES [Joshua Raphael][]

added 3rd party Veryl grammar to SUPPORTED_LANGUAGES [Naoya Hatta][]

added 3rd party Why3 grammar to SUPPORTED_LANGUAGES [JGalego][]

added 3rd party Xojo grammar to SUPPORTED_LANGUAGES [patricksalo][]

referenced existing 3rd party ES|QL grammar in SUPPORTED_LANGUAGES [Styx0x6][]

Core Grammars:

fix(c) only match real atomic_* type names, not C11 atomic functions, issue #3837 [Mark Xian][]

fix(c) do not highlight C++ std types as built-ins, issue #4103 [Arron Zou][]

fix(c, cpp) bound the run of type tokens in front of a function name (ReDoS), issue #4362 [Jayesh Bhade][]

fix(c, cpp) scope angle-bracket header string to #include, issue #3505 [Pablo][]

fix(c, cpp) stop a raw string's closing delimiter from swallowing quotes, issue #3585 [David Pavlovschii][]

enh(cmake) add block and endblock keywords [Anonymous Maarten][]

fix(cmake) only highlight standalone numbers, not digits that begin an identifier (e.g. 3rdparty), issue #4170 [Mark Xian][]

fix(cpp) require a word boundary before numeric literals so digits inside identifiers aren't highlighted as numbers, issue #4231 [Mark Xian][]

fix(crystal) stop treating integer division // as a regex literal [Zain Asif][]

enh(csharp) support digit separators in binary literals and numeric type suffixes, and stop highlighting the leading _ of an identifier, issue #4258 [Sarath Francis][]

enh(css) add corner-shape properties [Hama Tanveer][]

enh(css) support six-digit unicode-range values [Konstantin Baltsat][]

enh(dart) add highlighting for class and function names [guuido][]

enh(dns) highlight registered CAA property tags, issue #4475 [Joey Huang][]

enh(dns) improve grammar: character strings, TXT, classes, escapes, addresses [Checconio][]

enh(dos) add batch as an alias, issue #4395 [Hashim Khan][]

enh(gherkin) update keyword list [Hirse][]

enh(gherkin) variables can't contain whitespace [Hirse][]

enh(gherkin) docstrings can use backticks [Hirse][]

enh(go) recognize binary integer literals [spokodev][]

enh(groovy) support underscores in numeric literals [greymoth][]

fix(haml) recognize implicit div tag lines starting with .class or #id, issue #3783 [pikammmmm][]

fix(haskell) highlight where in GADT and closed type-family declarations, issue #3753 [Konstantin Baltsat][]

enh(java) improve detection of types, including generic and array types [Hannes Wallnoefer][]

enh(javascript) add self to built-in variables [Dsaquel][]

... (truncated)

Commits

f7f7d38 (release) release v11.12.0
c4c4728 (docs) FreeDesktop + Kotlin aliases; note extra language override
9142292 bump version to 11.12.0
03d1e7e (chore) rebuild CHANGES.md for 11.12.0
ca6bb8e enh(sqf) update to A3 v2.22 (#4460)
1414c96 fix: use Trusted Publishers in publishing pipeline (#4427)
2a9ad7d fix(markdown) don't treat a thematic break as the start of bold text (#4485)
375f3f4 build(deps-dev): bump @rollup/plugin-commonjs from 28.0.1 to 29.0.3 (#4481)
2ce1706 build(deps-dev): bump del from 8.0.0 to 8.0.1 (#4484)
72084b5 fix(ruby): don't treat scope resolution :: as symbols (#4463)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for highlight.js since your current version.

Updates markdown-it from 15.0.0 to 15.0.1

Changelog

Sourced from markdown-it's changelog.

[15.0.1] - 2026-08-27

Changed

doc: replace oxide theme with custom one.

Fixed

Fixed code span parsing after lookaheads for unclosed link and image labels, #1201.

Preserve spaces in code spans whose content consists only of spaces, #1180.

Preserve brackets around IPv6 address literals when normalizing links, #1204.

Security

Fixed quadratic complexity when replacing fuzzy links.

Fixed quadratic complexity in scheme backscan (inline linkify rule).

Commits

924b203 15.0.1 released
25c3895 Changelog update
aaadcfa Fix quadratic complexity in scheme backscan (inline linkify rule)
09fa071 Fix quadratic complexity when replacing fuzzy links
988c82b fix: don't strip spaces from all-space code spans
26b9a7b Polish previous commit
e8c6688 fix: preserve IPv6 brackets in normalizeLink (#1204)
5e9b1cc Rework backticks cache to remove side effects, close #1201
7b9a6a3 doc: fix source link style for methods
1e8ab89 doc: add changelog to menu
Additional commits viewable in compare view

Updates pretty-bytes from 7.1.1 to 7.1.2

Release notes

Sourced from pretty-bytes's releases.

v7.1.2

Fix rounding across unit boundaries 059c979

sindresorhus/pretty-bytes@v7.1.1...v7.1.2

Commits

deb9a2c 7.1.2
059c979 Fix rounding across unit boundaries
See full diff in compare view

Updates vis-network from 10.1.1 to 10.1.2

Release notes

Sourced from vis-network's releases.

v10.1.2

10.1.2 (2026-08-19)

Bug Fixes

types: add .d.ts files for CSS (#2518) (f2584c8), closes #2517

Commits

f2584c8 fix(types): add .d.ts files for CSS (#2518)
See full diff in compare view

Updates filenamify from 7.0.2 to 7.0.3

Release notes

Sourced from filenamify's releases.

v7.0.3

Fix Windows reserved device name handling 4eb7d0c

sindresorhus/filenamify@v7.0.2...v7.0.3

Commits

2036ef0 7.0.3
4eb7d0c Fix Windows reserved device name handling
d7d5049 Meta tweaks
See full diff in compare view

Updates @openally/httpie from 1.1.3 to 2.0.0

Release notes

Sourced from @openally/httpie's releases.

v2.0.0

What's Changed

Improve implementation by @fraxken in OpenAlly/httpie#12

Full Changelog: OpenAlly/httpie@v1.1.4...v2.0.0

v1.1.4

What's Changed

chore: update undici by @PierreDemailly in OpenAlly/httpie#11

Full Changelog: OpenAlly/httpie@v1.1.3...v1.1.4

Commits

328ca48 2.0.0
969ebac Merge pull request #12 from OpenAlly/improve-implementation
cf9de75 refactor(response): replace HttpieResponseHandler with internal functions
14dcf3c chore: update dependencies
f4db16a refactor: use custom and minimal LRU-cache implementation
b054d2b refactor(typescript): migrate to esm-ts-next
5bf5edf refactor: revamp folders and tests architecture
8a332c6 refactor(errors): brand httpie errors with a registered symbol
6b1392d refactor(utils): tighten getEncodingCharset
4a9fe0c refactor(request): use node's STATUS_CODES and fix the getData contract
Additional commits viewable in compare view

Updates find-my-way from 9.8.0 to 9.9.0

Release notes

Sourced from find-my-way's releases.

v9.9.0

What's Changed

chore: migrate to ESLint 9 and neostandard by @mcollina in delvedor/find-my-way#450

fix: parse absolute-form request targets safely by @mcollina in delvedor/find-my-way#451

Full Changelog: delvedor/find-my-way@v9.8.0...v9.9.0

Commits

31aa3ae Bumped v9.9.0
b8f9502 fix: parse absolute-form request targets safely (#451)
a0429ea chore: migrate to ESLint 9 and neostandard (#450)
See full diff in compare view

Updates open from 11.0.1 to 11.0.2

Release notes

Sourced from open's releases.

v11.0.2

Update dependencies 6f006ad

sindresorhus/open@v11.0.1...v11.0.2

Commits

ccf1fd6 11.0.2
52d2d62 Use hasOwn (#372)
6f006ad Update dependencies
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…dates Bumps the dependencies group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [highlight.js](https://github.com/highlightjs/highlight.js) | `11.11.1` | `11.12.0` | | [markdown-it](https://github.com/markdown-it/markdown-it) | `15.0.0` | `15.0.1` | | [pretty-bytes](https://github.com/sindresorhus/pretty-bytes) | `7.1.1` | `7.1.2` | | [vis-network](https://github.com/visjs/vis-network) | `10.1.1` | `10.1.2` | | [filenamify](https://github.com/sindresorhus/filenamify) | `7.0.2` | `7.0.3` | | [@openally/httpie](https://github.com/OpenAlly/httpie) | `1.1.3` | `2.0.0` | | [find-my-way](https://github.com/delvedor/find-my-way) | `9.8.0` | `9.9.0` | | [open](https://github.com/sindresorhus/open) | `11.0.1` | `11.0.2` | Updates `highlight.js` from 11.11.1 to 11.12.0 - [Release notes](https://github.com/highlightjs/highlight.js/releases) - [Changelog](https://github.com/highlightjs/highlight.js/blob/main/CHANGES.md) - [Commits](highlightjs/highlight.js@11.11.1...11.12.0) Updates `markdown-it` from 15.0.0 to 15.0.1 - [Changelog](https://github.com/markdown-it/markdown-it/blob/master/CHANGELOG.md) - [Commits](markdown-it/markdown-it@15.0.0...15.0.1) Updates `pretty-bytes` from 7.1.1 to 7.1.2 - [Release notes](https://github.com/sindresorhus/pretty-bytes/releases) - [Commits](sindresorhus/pretty-bytes@v7.1.1...v7.1.2) Updates `vis-network` from 10.1.1 to 10.1.2 - [Release notes](https://github.com/visjs/vis-network/releases) - [Changelog](https://github.com/visjs/vis-network/blob/master/HISTORY.md) - [Commits](visjs/vis-network@v10.1.1...v10.1.2) Updates `filenamify` from 7.0.2 to 7.0.3 - [Release notes](https://github.com/sindresorhus/filenamify/releases) - [Commits](sindresorhus/filenamify@v7.0.2...v7.0.3) Updates `@openally/httpie` from 1.1.3 to 2.0.0 - [Release notes](https://github.com/OpenAlly/httpie/releases) - [Commits](OpenAlly/httpie@v1.1.3...v2.0.0) Updates `find-my-way` from 9.8.0 to 9.9.0 - [Release notes](https://github.com/delvedor/find-my-way/releases) - [Commits](delvedor/find-my-way@v9.8.0...v9.9.0) Updates `open` from 11.0.1 to 11.0.2 - [Release notes](https://github.com/sindresorhus/open/releases) - [Commits](sindresorhus/open@v11.0.1...v11.0.2) --- updated-dependencies: - dependency-name: highlight.js dependency-version: 11.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: markdown-it dependency-version: 15.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: pretty-bytes dependency-version: 7.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: vis-network dependency-version: 10.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: filenamify dependency-version: 7.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: "@openally/httpie" dependency-version: 2.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: dependencies - dependency-name: find-my-way dependency-version: 9.9.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: open dependency-version: 11.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

changeset-bot · 2026-09-07T05:55:46Z

⚠️ No Changeset found

Latest commit: 0f625b1

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

socket-security · 2026-09-07T05:56:26Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
npm/@openally/httpie@1.1.3 ⏵ 2.0.0	⁺²	⁺¹	⁺³
npm/pretty-bytes@7.1.1 ⏵ 7.1.2		⁺¹
npm/markdown-it@15.0.0 ⏵ 15.0.1		⁺¹	⁺²
npm/open@11.0.1 ⏵ 11.0.2	⁺¹	⁺¹	⁺⁴
npm/highlight.js@11.11.1 ⏵ 11.12.0	⁺¹
npm/find-my-way@9.8.0 ⏵ 9.9.0
npm/vis-network@10.1.1 ⏵ 10.1.2			⁺²

View full report

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Sep 7, 2026

Navigation Menu

Uh oh!

chore(deps): bump the dependencies group across 1 directory with 8 updates - #810

chore(deps): bump the dependencies group across 1 directory with 8 updates#810
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/dependencies-1171bb210c

dependabot Bot commented on behalf of github Sep 7, 2026

Uh oh!

changeset-bot Bot commented Sep 7, 2026

Uh oh!

socket-security Bot commented Sep 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 7, 2026

v11.12.0 - Summer, hot and rainy.

Version 11.12.0

[15.0.1] - 2026-08-27

Changed

Fixed

Security

v7.1.2

v10.1.2

10.1.2 (2026-08-19)

Bug Fixes

v7.0.3

v2.0.0

What's Changed

v1.1.4

What's Changed

v9.9.0

What's Changed

v11.0.2

Uh oh!

changeset-bot Bot commented Sep 7, 2026

⚠️ No Changeset found

Uh oh!

socket-security Bot commented Sep 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants