Bump the npm_and_yarn group across 1 directory with 10 updates by dependabot[bot] · Pull Request #34 · ZoneCog/zone.bolt

dependabot · 2026-06-17T13:44:06Z

Bumps the npm_and_yarn group with 6 updates in the / directory:

Package	From	To
diff	`5.2.0`	`5.2.2`
js-cookie	`3.0.5`	`3.0.7`
pnpm	`9.15.0`	`10.28.2`
vite	`5.4.11`	`6.4.3`
vitest	`2.1.8`	`3.2.6`
wrangler	`3.91.0`	`3.114.17`

Updates diff from 5.2.0 to 5.2.2

Changelog

Sourced from diff's changelog.

v5.2.2 - January 2026

Only change from 5.2.0 is a backport of the fix to GHSA-73rr-hh4g-fpgx.

v5.2.1 (deprecated)

Accidental release - do not use.

Commits

b7b6339 v5.2.2
b5377ab Update package version to 5.2.1
7801789 Backport kpdecker/jsdiff#649
042a837 Backport kpdecker/jsdiff#647
See full diff in compare view

Updates js-cookie from 3.0.5 to 3.0.7

Release notes

Sourced from js-cookie's releases.

v3.0.7

Prevent cookie attribute injection: CVE-2026-46625 (eb3c40e)

Add Partitioned attribute to readme (b994768)

Publish to npm registry via trusted publisher exclusively (4dc71be)

Ensure consistent behaviour for get('name') + get() (1953d30)

Commits

17bacba Craft v3.0.7 release
adb823c Fix release workflow halting at git tag
5f9e759 May remove Git user config from release workflow
6ac9211 Fix release workflow not able to push commit + tag
2278bc5 Fix missing package version bump
eb3c40e Prevent cookie attribute injection
f6f157f Bump globals from 17.5.0 to 17.6.0
f409d02 Bump eslint from 10.2.0 to 10.3.0
a686883 Bump protobufjs in the npm_and_yarn group across 1 directory
c6112d2 Bump @protobufjs/utf8 in the npm_and_yarn group across 1 directory
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for js-cookie since your current version.

Updates pnpm from 9.15.0 to 10.28.2

Release notes

Sourced from pnpm's releases.

pnpm 10.28.2

Patch Changes

Security fix: prevent path traversal in directories.bin field.

When pnpm installs a file: or git: dependency, it now validates that symlinks point within the package directory. Symlinks to paths outside the package root are skipped to prevent local data from being leaked into node_modules.

This fixes a security issue where a malicious package could create symlinks to sensitive files (e.g., /etc/passwd, ~/.ssh/id_rsa) and have their contents copied when the package is installed.

Note: This only affects file: and git: dependencies. Registry packages (npm) have symlinks stripped during publish and are not affected.

Fixed optional dependencies to request full metadata from the registry to get the libc field, which is required for proper platform compatibility checks #9950.

Platinum Sponsors

Gold Sponsors

... (truncated)

Changelog

Sourced from pnpm's changelog.

10.28.2

Patch Changes

Security fix: prevent path traversal in directories.bin field.

When pnpm installs a file: or git: dependency, it now validates that symlinks point within the package directory. Symlinks to paths outside the package root are skipped to prevent local data from being leaked into node_modules.

This fixes a security issue where a malicious package could create symlinks to sensitive files (e.g., /etc/passwd, ~/.ssh/id_rsa) and have their contents copied when the package is installed.

Note: This only affects file: and git: dependencies. Registry packages (npm) have symlinks stripped during publish and are not affected.

Fixed optional dependencies to request full metadata from the registry to get the libc field, which is required for proper platform compatibility checks #9950.

10.28.1

Patch Changes

Fixed installation of config dependencies from private registries.

Added support for object type in configDependencies when the tarball URL returned from package metadata differs from the computed URL #10431.

Fix path traversal vulnerability in binary fetcher ZIP extraction

Validate ZIP entry paths before extraction to prevent writing files outside target directory

Validate BinaryResolution.prefix (basename) to prevent directory escape via crafted prefix

Both attack vectors now throw ERR_PNPM_PATH_TRAVERSAL error

Support plain http:// and https:// URLs ending with .git as git repository dependencies.

Previously, URLs like https://gitea.example.org/user/repo.git#commit were not recognized as git repositories because they lacked the git+ prefix (e.g., git+https://). This caused issues when installing dependencies from self-hosted git servers like Gitea or Forgejo that don't provide tarball downloads.

Changes:

The git resolver now runs before the tarball resolver, ensuring git URLs are handled by the correct resolver

The git resolver now recognizes plain http:// and https:// URLs ending in .git as git repositories

Removed the isRepository check from the tarball resolver since it's no longer needed with the new resolver order

Fixes #10468

pnpm run -r and pnpm run --filter now fail with a non-zero exit code when no packages have the specified script. Previously, this only failed when all packages were selected. Use --if-present to suppress this error #6844.

Fixed a path traversal vulnerability in tarball extraction on Windows. The path normalization was only checking for ./ but not .\. Since backslashes are directory separators on Windows, malicious packages could use paths like foo\..\..\.npmrc to write files outside the package directory.

When running "pnpm exec" from a subdirectory of a project, don't change the current working directory to the root of the project #5759.

Fixed a path traversal vulnerability in pnpm's bin linking. Bin names starting with @ bypassed validation, and after scope normalization, path traversal sequences like ../../ remained intact.

Revert Try to avoid making network calls with preferOffline #10334.

Fix --save-peer to write valid semver ranges to peerDependencies for protocol-based installs (e.g. jsr:) by deriving from resolved versions when available and falling back to * if none is available #10417.

Do not exclude the root workspace project, when it is explicitly selected via a filter #10465.

10.28.0

Minor Changes

... (truncated)

Commits

89a2c4e chore(release): 10.28.2
a484cea fix(npm-resolver): request full metadata for optional dependencies (#10455)
c908370 test: fix
0b5a56a chore(release): 10.28.1
916b26b fix: prevent implicit root exclusion when user filters are provided (#10465)
9cbba28 fix(exec): preserve user execution cwd (#10445)
91a241e chore(release): 10.28.0
a9784fb revert: "chore: upgrade qs to 6.14.1 (#10389)"
787ed46 chore: upgrade qs to 6.14.1 (#10389)
6bdba72 chore(release): 10.27.0
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for pnpm since your current version.

Updates vite from 5.4.11 to 6.4.3

Release notes

Sourced from vite's releases.

v6.4.3

Please refer to CHANGELOG.md for details.

v6.4.2

Please refer to CHANGELOG.md for details.

v6.4.1

Please refer to CHANGELOG.md for details.

v6.4.0

Please refer to CHANGELOG.md for details.

v6.3.7

Please refer to CHANGELOG.md for details.

v6.3.6

Please refer to CHANGELOG.md for details.

v5.4.21

Please refer to CHANGELOG.md for details.

v5.4.20

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

6.4.3 (2026-06-01)

fix: backport #22572, reject windows alternate paths (#22576) (96b0c10), closes #22572 #22576

fix(deps): backport #22571, reject UNC paths for launch-editor-middleware (#22575) (8fed5cf), closes #22571 #22575

6.4.2 (2026-04-06)

fix: apply server.fs check to env transport (#22159) (#22163) (fe28e47), closes #22159 #22163

fix: avoid path traversal with optimize deps sourcemap handler (#22161) (ca4da5d), closes #22161

6.4.1 (2025-10-20)

fix(dev): trim trailing slash before server.fs.deny check (#20968) (#20969) (1114b5d), closes #20968 #20969

6.4.0 (2025-10-15)

feat: allow passing down resolved config to vite's createServer (#20932) (ca6455e), closes #20932

6.3.7 (2025-10-14)

fix(esbuild): inject esbuild helpers correctly for esbuild 0.25.9+ (#20940) (c59a222), closes #20940

6.3.6 (2025-09-08)

fix: apply fs.strict check to HTML files (#20736) (0ab19ea), closes #20736

fix: upgrade sirv to 3.0.2 (#20735) (e11d240), closes #20735

test: detect ts support via process.features (#20544) (7d99229), closes #20544

6.3.5 (2025-05-05)

fix(ssr): handle uninitialized export access as undefined (#19959) (fd38d07), closes #19959

6.3.4 (2025-04-30)

fix: check static serve file inside sirv (#19965) (c22c43d), closes #19965

fix(optimizer): return plain object when using require to import externals in optimized dependenci (efc5eab), closes #19940

... (truncated)

Commits

6c2c881 release: v6.4.3
96b0c10 fix: backport #22572, reject windows alternate paths (#22576)
8fed5cf fix(deps): backport #22571, reject UNC paths for launch-editor-middleware (#2...
6b3fad0 release: v6.4.2
ca4da5d fix: avoid path traversal with optimize deps sourcemap handler (#22161)
fe28e47 fix: apply server.fs check to env transport (#22159) (#22163)
5487f4f release: v6.4.1
1114b5d fix(dev): trim trailing slash before server.fs.deny check (#20968) (#20969)
f12697c release: v6.4.0
ca6455e feat: allow passing down resolved config to vite's createServer (#20932)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for vite since your current version.

Updates vitest from 2.1.8 to 3.2.6

Release notes

Sourced from vitest's releases.

v3.2.6

   🐞 Bug Fixes

Pin last supported vite-node version - by @sheremet-va (16f12)

    View changes on GitHub

v3.2.5

   🚀 Features

api: Add allowWrite and allowExec options to api [backport to v3] - by @hi-ogawa and Codex in vitest-dev/vitest#10445 (af88b)

   🐞 Bug Fixes

browser: Disable client cdp API when allowWrite/allowExec: false [backport to v3] - by @hi-ogawa and Codex in vitest-dev/vitest#10456 (385a1)

    View changes on GitHub

v3.2.4

   🐞 Bug Fixes

Use correct path for optimisation of strip-literal - by @mrginglymus in vitest-dev/vitest#8139 (44940)

Print uint and buffer as a simple string - by @sheremet-va in vitest-dev/vitest#8141 (b86bf)

browser:

Show a helpful error when spying on an export - by @sheremet-va in vitest-dev/vitest#8178 (56007)

cli:

vitest run --watch should be watch-mode - by @AriPerkkio in vitest-dev/vitest#8128 (657e8)

Use absolute path environment on Windows - by @colinaaa in vitest-dev/vitest#8105 (85dc0)

Throw error when --shard x/<count> exceeds count of test files - by @AriPerkkio in vitest-dev/vitest#8112 (8a18c)

coverage:

Ignore SCSS in browser mode - by @sheremet-va in vitest-dev/vitest#8161 (0c3be)

deps:

Update all non-major dependencies - in vitest-dev/vitest#8123 (93f32)

expect:

Handle async errors in expect.soft - by @lzl0304 in vitest-dev/vitest#8145 (68699)

pool:

Auto-adjust minWorkers when only maxWorkers specified - by @AriPerkkio in vitest-dev/vitest#8110 (14dc0)

reporter:

task.meta should be available in custom reporter's errors - by @AriPerkkio in vitest-dev/vitest#8115 (27df6)

runner:

Preserve handler wrapping on extend - by @pengooseDev in vitest-dev/vitest#8153 (a9281)

ui:

Ensure ui config option works correctly - by @lzl0304 in vitest-dev/vitest#8147 (42eeb)

    View changes on GitHub

v3.2.3

   🚀 Features

browser: Use base url instead of vitest - by @sheremet-va in vitest-dev/vitest#8126 (1d8eb)

... (truncated)

Commits

b6d56f8 chore: release v3.2.6
16f120d fix: pin last supported vite-node version
2cbad0a chore: release v3.2.5
385a1ae fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
af88b1f feat(api): add allowWrite and allowExec options to api [backport to v3]...
c666d14 chore: release v3.2.4
8a18c8e fix(cli): throw error when --shard x/\<count> exceeds count of test files (#...
8abd7cc chore(deps): update tinypool (#8174)
93f3200 fix(deps): update all non-major dependencies (#8123)
0c3be6f fix(coverage): ignore SCSS in browser mode (#8161)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for vitest since your current version.

Updates wrangler from 3.91.0 to 3.114.17

Changelog

Sourced from wrangler's changelog.

3.114.17

Patch Changes

#11891 6d5557b Thanks @emily-shen! - Use argument array when executing git commands with wrangler pages deploy

Pass user provided values from --commit-hash safely to underlying git command.

3.114.16

Patch Changes

#11689 9bab0a0 Thanks @ascorbic! - Display a warning when authentication errors occur and the account_id in your Wrangler configuration does not match any of your authenticated accounts. This helps identify configuration issues where you may have the wrong account ID set in your wrangler.toml or wrangler.jsonc file.

#10737 c41a078 Thanks @workers-devprod! - Allow WRANGLER_SEND_ERROR_REPORTS env var to override whether to report Wrangler crashes to Sentry

#11134 bd39455 Thanks @petebacondarwin! - Reduce the amount of arguments being passed in metrics capture.

Now the argument values that are captured come from an allow list, and can be marked as ALLOW (capture the real value) or REDACT (capture as "").

#11020 9cb702e Thanks @dario-piotrowicz! - Fix observability.logs.persist being flagged as an unexpected field during the wrangler config file validation

#11147 cf4993b Thanks @FlorentCollin! - Improve the formatting of the D1 execute command to always show the duration in milliseconds with two decimal places.

#11650 cc29ead Thanks @ascorbic! - fix: respect TypeScript path aliases when resolving non-JS modules with module rules

When importing non-JavaScript files (like .graphql, .txt, etc.) using TypeScript path aliases defined in tsconfig.json, Wrangler's module-collection plugin now correctly resolves these imports. Previously, path aliases were only respected for JavaScript/TypeScript files, causing imports like import schema from '~lib/schema.graphql' to fail when using module rules.

#11179 7f779e9 Thanks @ascorbic! - Log a more helpful error when attempting to "r2 object put" a non-existent file

#11501 c78d942 Thanks @edmundhung! - fix: prevent reporting SQLite error from wrangler d1 execute to Sentry

#11262 b2683f7 Thanks @workers-devprod! - Avoid using object lookup for OAuth Error classes

#11107 d8037d3 Thanks @workers-devprod! - Fixed conflict between --env and --expires flags in wrangler r2 object put.

--e now aliases --env only, and NOT --expires.

#10961 02d2ea9 Thanks @devin-ai-integration! - Acquire Cloudflare Access tokens for additional requests made during a wrangler dev --remote session

#11108 892ec4f Thanks @emily-shen! - Fixed self-bindings (service bindings to the same worker) showing as [not connected] in wrangler dev. Self-bindings now correctly show as [connected] since a worker is always available to itself.

#11138 3db872a Thanks @devin-ai-integration! - Implement tail-based logging for wrangler dev remote mode, behind the --x-tail-tags flag. This will become the default in the future.

#10889 204616c Thanks @workers-devprod! - Clarify that wrangler check startup generates a local CPU profile

#11491 ed8aaef Thanks @edmundhung! - Explicitly close FileHandle in wrangler d1 execute to support Node 25

#10962 203e599 Thanks @devin-ai-integration! - Fixed duplicate warning messages appearing during wrangler dev when configuration changes or state transitions occur

... (truncated)

Commits

f21ee75 Version Packages (#11895)
6d5557b fix: execute git commands in pages deploy safely (#11889) (#11891)
0e19ae9 Version Packages (#10906)
3db872a [v3 backport] Backport tail-based logging from #11135 and #11346 (#11138)
02d2ea9 Fix remote dev with Access (#10961)
9bab0a0 fix(wrangler): add warning when account_id mismatch detected on auth error (v...
4b18c6f Introduce internal isWorkerNotFoundError utility and avoid worker-not-found...
ed8aaef fix(wrangler): close FileHandle in to support Node 25 (#11491)
c78d942 V3 backport of #11467: prevent SQLite users error from being reported to Sent...
cc29ead fix: respect TypeScript path aliases when resolving non-JS modules with modul...
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for wrangler since your current version.

Updates defu from 6.1.4 to 6.1.7

Release notes

Sourced from defu's releases.

v6.1.7

compare changes

📦 Build

Correct the types export entry (#160)

Export Defu types (#157)

❤️ Contributors

Jakub Michálek (@J-Michalek)

Kricsleo (@kricsleo)

v6.1.6

compare changes

📦 Build

Fix mixed types (407b516)

v6.1.5

compare changes

🩹 Fixes

Prevent prototype pollution via __proto__ in defaults (#156)

Ignore inherited enumerable properties (11ba022)

✅ Tests

Add more tests for plain objects (b65f603)

❤️ Contributors

Pooya Parsa (@pi0)

Kricsleo (@kricsleo)

Changelog

Sourced from defu's changelog.

v6.1.7

compare changes

🩹 Fixes

defu.d.cts: Export Defu types (#157)

📦 Build

Correct the types export entry (#160)

❤️ Contributors

Jakub Michálek (@J-Michalek)

Kricsleo (@kricsleo)

v6.1.6

compare changes

📦 Build

Fix mixed types (407b516)

❤️ Contributors

Pooya Parsa (@pi0)

v6.1.5

compare changes

🩹 Fixes

Prevent prototype pollution via __proto__ in defaults (#156)

Ignore inherited enumerable properties (11ba022)

🏡 Chore

Add tea.yaml (70cffe5)

Update repo (23cc432)

Fix typecheck (89df6bb)

✅ Tests

Add more tests for plain objects (b65f603)

🤖 CI

... (truncated)

Commits

80c0146 chore(release): v6.1.7
40d7ef4 fix(defu.d.cts): export Defu types (#157)
3d3a7c8 build: correct the types export entry (#160)
001c290 chore(release): v6.1.6
407b516 build: fix mixed types
23e59e6 chore(release): v6.1.5
11ba022 fix: ignore inherited enumerable properties
3942bfb fix: prevent prototype pollution via __proto__ in defaults (#156)
d3ef16d chore(deps): update actions/checkout action to v6 (#151)
869a053 chore(deps): update actions/setup-node action to v6 (#149)
Additional commits viewable in compare view

Updates react-router from 6.28.0 to 6.30.4

Release notes

Sourced from react-router's releases.

v6.30.4

See the changelog for release notes: https://github.com/remix-run/react-router/blob/v6/CHANGELOG.md#v6304

v6.30.3

See the changelog for release notes: https://github.com/remix-run/react-router/blob/v6/CHANGELOG.md#v6303

v6.30.2

See the changelog for release notes: https://github.com/remix-run/react-router/blob/v6/CHANGELOG.md#v6302

v6.30.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v6301

v6.30.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v6300

v6.29.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v6290

v6.28.2

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v6282

v6.28.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v6281

Changelog

Sourced from react-router's changelog.

v6.30.4

Patch Changes

Updated dependencies:

@remix-run/router@1.23.3

6.30.3

Patch Changes

Updated dependencies:

@remix-run/router@1.23.2

6.30.2

Patch Changes

Updated dependencies:

@remix-run/router@1.23.1

6.30.1

Patch Changes

Partially revert optimization added in 6.29.0 to reduce calls to matchRoutes because it surfaced other issues (#13623)

Stop logging invalid warning when v7_relativeSplatPath is set to false (#13502)

6.30.0

Minor Changes

Add fetcherKey as a parameter to patchRoutesOnNavigation (#13109)

Patch Changes

Updated dependencies:

@remix-run/router@1.23.0

6.29.0

Minor Changes

Provide the request signal as a parameter to patchRoutesOnNavigation (#12900)

This can be used to abort any manifest fetches if the in-flight navigation/fetcher is aborted

Patch Changes

Do not log v7 deprecation warnings in production builds (#12794)

... (truncated)

Commits

651211c Release v6.30.4 (#15120)
f82a6f9 Bring new release process into v6 branch (#15115)
c662ca3 chore: Update version for release (#14713)
98ad691 chore: Update version for release (pre-v6) (#14710)
26b5d45 chore: Update version for release (#14541)
919f8a8 chore: Update version for release (pre-v6) (#14540)
69bf705 Normalize double slashes in resolvePath (#14537)
3f2400e chore: Update version for release (#13647)
25a264d chore: Update version for release (pre-v6) (#13638)
b5705a0 Remove matchRoutes optimization from render pass (#13623)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react-router since your current version.

Updates rollup from 4.28.0 to 4.62.0

Release notes

Sourced from rollup's releases.

v4.62.0

4.62.0

2026-06-13

Features

Ensure that shared dependencies between manual chunks and entry points receive a serparate chunk (#6374)

Pull Requests

#6374: Extract the static dependencies imported by manual chunks into separate chunks (@TrickyPi, @lukastaegert)

#6405: fix(deps): update minor/patch updates (@renovate[bot])

#6406: chore(deps): pin dependency concurrently to v9 (@renovate[bot], @lukastaegert)

#6407: chore(deps): lock file maintenance minor/patch updates (@renovate[bot])

#6409: chore(deps): update minor/patch updates to v6.2.0 (@renovate[bot])

#6410: chore(deps): lock file maintenance minor/patch updates (@renovate[bot])

#6412: fix(deps): update minor/patch updates (@renovate[bot])

#6413: chore(deps): update dependency eslint-plugin-unicorn to v65 (@renovate[bot])

#6414: chore(deps): lock file maintenance minor/patch updates (@renovate[bot], @lukastaegert)

v4.61.1

4.61.1

2026-06-04

Bug Fixes

Avoid extraneous newlines when adding headers via plugins (#6403)

Fix a rare issue where starting Rollup would hang on Windows (#6404)

Pull Requests

#6402: Improve documentation for manualPureFunctions (@lukastaegert)

#6403: Does not add an extra leading line feed for addons (@TrickyPi)

#6404: fix: set report.excludeNetwork=true before getReport() to avoid blocking PTR lookups (@jdz321, @lukastaegert)

v4.61.0

4.61.0

2026-06-01

Features

Sort entry modules to make chunk hashes deterministic (#6391)

Pull Requests

#6376: Eliminate AWS credential exposure on fork PRs in REPL artefact workflow (@lukastaegert)

#6378: fix(deps): update minor/patch updates (@renovate[bot])

... (truncated)

Changelog

Sourced from rollup's changelog.

4.62.0

2026-06-13

Features

Ensure that shared dependencies between manual chunks and entry points receive a serparate chunk (#6374)

Pull Requests

#6374: Extract the static dependencies imported by manual chunks into separate chunks (@TrickyPi, @lukastaegert)

#6405: fix(deps): update minor/patch updates (@renovate[bot])

#6406: chore(deps): pin dependency concurrently to v9 (@renovate[bot], @lukastaegert)

#6407: chore(deps): lock file maintenance minor/patch updates (@renovate[bot])

#6409: chore(deps): update minor/patch updates to v6.2.0 (@renovate[bot])

#6410: chore(deps): lock file maintenance minor/patch updates (Cursor Bugbot for commit 28679ed. Bugbot is set up for automated code reviews on this repo. Configure here.

Bumps the npm_and_yarn group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [diff](https://github.com/kpdecker/jsdiff) | `5.2.0` | `5.2.2` | | [js-cookie](https://github.com/js-cookie/js-cookie) | `3.0.5` | `3.0.7` | | [pnpm](https://github.com/pnpm/pnpm/tree/HEAD/pnpm) | `9.15.0` | `10.28.2` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `5.4.11` | `6.4.3` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `2.1.8` | `3.2.6` | | [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `3.91.0` | `3.114.17` | Updates `diff` from 5.2.0 to 5.2.2 - [Changelog](https://github.com/kpdecker/jsdiff/blob/master/release-notes.md) - [Commits](kpdecker/jsdiff@v5.2.0...v5.2.2) Updates `js-cookie` from 3.0.5 to 3.0.7 - [Release notes](https://github.com/js-cookie/js-cookie/releases) - [Commits](js-cookie/js-cookie@v3.0.5...v3.0.7) Updates `pnpm` from 9.15.0 to 10.28.2 - [Release notes](https://github.com/pnpm/pnpm/releases) - [Changelog](https://github.com/pnpm/pnpm/blob/v10.28.2/pnpm/CHANGELOG.md) - [Commits](https://github.com/pnpm/pnpm/commits/v10.28.2/pnpm) Updates `vite` from 5.4.11 to 6.4.3 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v6.4.3/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v6.4.3/packages/vite) Updates `vitest` from 2.1.8 to 3.2.6 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v3.2.6/packages/vitest) Updates `wrangler` from 3.91.0 to 3.114.17 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Changelog](https://github.com/cloudflare/workers-sdk/blob/wrangler@3.114.17/packages/wrangler/CHANGELOG.md) - [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@3.114.17/packages/wrangler) Updates `defu` from 6.1.4 to 6.1.7 - [Release notes](https://github.com/unjs/defu/releases) - [Changelog](https://github.com/unjs/defu/blob/main/CHANGELOG.md) - [Commits](unjs/defu@v6.1.4...v6.1.7) Updates `react-router` from 6.28.0 to 6.30.4 - [Release notes](https://github.com/remix-run/react-router/releases) - [Changelog](https://github.com/remix-run/react-router/blob/react-router@6.30.4/packages/react-router/CHANGELOG.md) - [Commits](https://github.com/remix-run/react-router/commits/react-router@6.30.4/packages/react-router) Updates `rollup` from 4.28.0 to 4.62.0 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md) - [Commits](rollup/rollup@v4.28.0...v4.62.0) Updates `undici` from 5.28.4 to 5.29.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v5.28.4...v5.29.0) --- updated-dependencies: - dependency-name: diff dependency-version: 5.2.2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: js-cookie dependency-version: 3.0.7 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: pnpm dependency-version: 10.28.2 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 6.4.3 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: vitest dependency-version: 3.2.6 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: wrangler dependency-version: 3.114.17 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: defu dependency-version: 6.1.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: react-router dependency-version: 6.30.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: rollup dependency-version: 4.62.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 5.29.0 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

cloudflare-workers-and-pages · 2026-06-17T13:44:08Z

Deploying zone-bolt with Cloudflare Pages

Latest commit:	`28679ed`
Status:	🚫 Build failed.

View logs

codesandbox · 2026-06-17T13:44:10Z

Review or Edit in CodeSandbox

Open the branch in Web Editor • VS Code • Insiders

Open Preview

cursor

Cursor Bugbot has reviewed your changes using default effort and found 3 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 28679ed. Configure here.}

cursor · 2026-06-17T13:45:35Z

    "@xterm/addon-web-links": "^0.11.0",
    "@xterm/xterm": "^5.5.0",
-    "ai": "^3.4.33",
+    "ai": "^6.0.207",


AI v6 breaks chat stack

High Severity

Bumping ai to ^6.0.207 without upgrading @ai-sdk/* packages or migrating the chat code leaves the app on AI SDK 3.x APIs (useChat from ai/react, convertToCoreMessages, toAIStream, legacy provider models) that are incompatible with v6, so chat streaming and model calls are likely to fail at build or when users send messages.

^{Reviewed by Cursor Bugbot for commit 28679ed. Configure here.}

cursor · 2026-06-17T13:45:36Z

    "is-ci": "^3.0.1",
    "node-fetch": "^3.3.2",
-    "pnpm": "^9.15.0",
+    "pnpm": "^10.28.2",


pnpm versions disagree

Medium Severity

The devDependency pnpm is raised to ^10.28.2 but packageManager still pins pnpm@9.4.0, so Corepack, Docker (corepack enable pnpm), and local installs use 9.4.0 while the repo advertises 10.28.2, which can cause inconsistent lockfile handling and failed or divergent installs in CI versus dependabot.

Additional Locations (1)

package.json#L133-L134

^{Reviewed by Cursor Bugbot for commit 28679ed. Configure here.}

cursor · 2026-06-17T13:45:36Z

    "@remix-run/cloudflare": "^2.15.0",
    "@remix-run/cloudflare-pages": "^2.15.0",
-    "@remix-run/react": "^2.15.0",
+    "@remix-run/react": "^2.17.5",


Remix React skew

Low Severity

@remix-run/react is bumped to ^2.17.5 while @remix-run/cloudflare and @remix-run/cloudflare-pages stay on ^2.15.0 and @remix-run/dev remains ^2.15.0, mixing Remix minor releases in one app and increasing risk of router or runtime mismatches during build and deploy.

Additional Locations (1)

package.json#L64-L66

^{Reviewed by Cursor Bugbot for commit 28679ed. Configure here.}

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jun 17, 2026

cursor Bot reviewed Jun 17, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the npm_and_yarn group across 1 directory with 10 updates#34

Bump the npm_and_yarn group across 1 directory with 10 updates#34
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-a385906d7a

dependabot Bot commented on behalf of github Jun 17, 2026 •

edited by cursor Bot

Loading

Uh oh!

cloudflare-workers-and-pages Bot commented Jun 17, 2026 •

edited

Loading

Uh oh!

codesandbox Bot commented Jun 17, 2026

Uh oh!

cursor Bot left a comment

Uh oh!

cursor Bot Jun 17, 2026

Uh oh!

cursor Bot Jun 17, 2026

Uh oh!

cursor Bot Jun 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Jun 17, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v5.2.2 - January 2026

v5.2.1 (deprecated)

v3.0.7

pnpm 10.28.2

Patch Changes

Platinum Sponsors

Gold Sponsors

10.28.2

Patch Changes

10.28.1

Patch Changes

10.28.0

Minor Changes

v6.4.3

v6.4.2

v6.4.1

v6.4.0

v6.3.7

v6.3.6

v5.4.21

v5.4.20

6.4.3 (2026-06-01)

6.4.2 (2026-04-06)

6.4.1 (2025-10-20)

6.4.0 (2025-10-15)

6.3.7 (2025-10-14)

6.3.6 (2025-09-08)

6.3.5 (2025-05-05)

6.3.4 (2025-04-30)

v3.2.6

🐞 Bug Fixes

View changes on GitHub

v3.2.5

🚀 Features

🐞 Bug Fixes

View changes on GitHub

v3.2.4

🐞 Bug Fixes

View changes on GitHub

v3.2.3

🚀 Features

3.114.17

Patch Changes

3.114.16

Patch Changes

v6.1.7

📦 Build

❤️ Contributors

v6.1.6

📦 Build

v6.1.5

🩹 Fixes

✅ Tests

❤️ Contributors

v6.1.7

🩹 Fixes

📦 Build

❤️ Contributors

v6.1.6

📦 Build

❤️ Contributors

v6.1.5

🩹 Fixes

🏡 Chore

✅ Tests

🤖 CI

v6.30.4

v6.30.3

v6.30.2

v6.30.1

v6.30.0

v6.29.0

v6.28.2

v6.28.1

v6.30.4

Patch Changes

6.30.3

dependabot Bot commented on behalf of github Jun 17, 2026 •

edited by cursor Bot

Loading

cloudflare-workers-and-pages Bot commented Jun 17, 2026 •

edited

Loading