Skip to content

📦 [0.84]: Bump the all-dependencies group across 1 directory with 6 updates#16281

Open
dependabot[bot] wants to merge 1 commit into
0.84-stablefrom
dependabot/npm_and_yarn/0.84-stable/all-dependencies-83246163f3
Open

📦 [0.84]: Bump the all-dependencies group across 1 directory with 6 updates#16281
dependabot[bot] wants to merge 1 commit into
0.84-stablefrom
dependabot/npm_and_yarn/0.84-stable/all-dependencies-83246163f3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 24, 2026 •
edited by microsoft-github-policy-service Bot
Loading

Copy link
Copy Markdown
Contributor

Bumps the all-dependencies group with 6 updates in the / directory:

Package From To
lage 2.15.12 2.15.13
@types/react 19.2.15 19.2.17
semver 7.8.1 7.8.5
tinyglobby 0.2.16 0.2.17
@microsoft/1ds-core-js 4.4.1 4.4.2
@microsoft/1ds-post-js 4.4.1 4.4.2

Updates lage from 2.15.12 to 2.15.13

Commits

Updates @types/react from 19.2.15 to 19.2.17

Commits

Updates semver from 7.8.1 to 7.8.5

Release notes

Sourced from semver's releases.

v7.8.5

7.8.5 (2026-06-19)

Bug Fixes

v7.8.4

7.8.4 (2026-06-09)

Bug Fixes

v7.8.3

7.8.3 (2026-06-08)

Bug Fixes

Chores

v7.8.2

7.8.2 (2026-06-04)

Bug Fixes

Changelog

Sourced from semver's changelog.

7.8.5 (2026-06-19)

Bug Fixes

7.8.4 (2026-06-09)

Bug Fixes

7.8.3 (2026-06-08)

Bug Fixes

Chores

7.8.2 (2026-06-04)

Bug Fixes

Commits

Updates tinyglobby from 0.2.16 to 0.2.17

Release notes

Sourced from tinyglobby's releases.

0.2.17

Changed

  • Enabled staged publishing for stronger supply-chain security

Fixed

  • Defaults when undefined is passed to any of the options by @​chloeelim
  • Drive-relative paths on Windows by @​Andrej730
  • FileSystemAdapter is now exported again

Consider sponsoring if you'd like to support the development of this project and the goal of reaching a lighter and faster ecosystem

Changelog

Sourced from tinyglobby's changelog.

0.2.17

Changed

  • Enabled staged publishing for stronger supply-chain security

Fixed

  • Defaults when undefined is passed to any of the options by chloeelim
  • Drive-relative paths on Windows by Andrej730
  • FileSystemAdapter is now exported again
Commits

Updates @microsoft/1ds-core-js from 4.4.1 to 4.4.2

Changelog

Sourced from @​microsoft/1ds-core-js's changelog.

Releases

Note: ES3/IE8 compatibility will be removed in the future v3.x.x releases (scheduled for mid-late 2022), so if you need to retain ES3 compatibility you will need to remain on the 2.x.x versions of the SDK or your runtime will need install polyfill's to your ES3 environment before loading / initializing the SDK.

3.4.2 (June 18th, 2026)

This is a maintenance release for the 3.4.x version line containing security hardening, bug fixes, build tooling improvements, and CI updates. The @microsoft/1ds-post-js channel is numbered 4.4.2 and requires v3.4.2.

Significant Changes (since 3.4.1)

  • Prototype Pollution Hardening: The extend() and objExtend() helpers now filter unsafe keys (__proto__, constructor, prototype) to prevent prototype pollution when merging untrusted objects.

  • Dependency Vulnerability Resolution: Migrated the repository from npm to pnpm for dependency management and resolved all known dependency vulnerabilities. This is a build/tooling change and does not affect the published runtime packages.

  • OsPlugin Field Name Correction: The OsPlugin now emits the correct Common Schema 4.0 field names (ext.os.name and ext.os.ver). Telemetry consumers relying on the previously emitted (incorrect) field names should update to the corrected names.

  • RequestEnvelopeCreator Envelope Name Fix: Fixed RequestEnvelopeCreator so request telemetry is sent with the correct envelope name (Microsoft.ApplicationInsights.{ikey}.Request) instead of RequestData.

  • Offline Channel Reliability: Fixed a missing return after reject() in the offline channel that could lead to a null provider dereference.

  • Fixed [INVALID_ANNOTATION] warnings in Rolldown / Vite 8 consumers (#2736): The per-module dist-es5 output (the package module entry that modern bundlers import) emitted parenthesized PURE tree-shaking annotations with whitespace after the opening parenthesis (e.g. ( /*#__PURE__*/"http.")), which stricter bundlers such as Rolldown (Vite 8) rejected. The build now canonicalizes these annotations to the flush form ((/*#__PURE__*/"http.")) in the dist-es5 output, accepted by all bundlers while preserving the wrapping parentheses required for older Rollup / Webpack / Terser to tree-shake the constants. This complements #2737, which only normalized the rollup-bundled dist/es5 (main) output.

CI / Tooling

  • Dropped Node.js 16 from CI matrix: Node.js 16 is End-of-Life and several dependencies (e.g. puppeteer, @pnpm/error) now require Node.js 18 or later. The CI pipeline no longer runs against Node.js 16.
  • Added Node.js 22 and 24 to CI matrix: The CI pipeline now tests against Node.js 18, 20, 22, and 24.
  • Migrated from npm to pnpm: Dependency management now uses pnpm.

Changelog

  • #2733 fix: Migrate from npm to pnpm and resolve all dependency vulnerabilities
  • #2742 fix(ci): repair Node.js CI (Chrome install, bundle-size limits, ts-async offline-channel hang)
  • #2737 fix: remove invalid PURE literal annotations and add bundle validation tests
  • #2736 fix: canonicalize PURE annotations in dist-es5 (module) output to fix Rolldown/Vite 8 [INVALID_ANNOTATION] warnings
  • #2735 fix: prevent prototype pollution in extend() and objExtend() via unsafe key filtering
  • #2734 fix(offline-channel): Add missing return after reject() to prevent null provider dereference
  • #2732 fix(OsPlugin): use correct CS 4.0 field names ext.os.name and ext.os.ver
  • #2731 Drop Node.js 16 from CI matrix; add Node.js 22 and 24
  • #2729 Potential fix for code scanning alert no. 2273: Workflow does not contain permissions
  • #2728 Potential fix for code scanning alert no. 5940: Unused variable, import, function or class
  • #2727 Potential fix for code scanning alert no. 5402: Semicolon insertion
  • #2726 Potential fix for code scanning alert no. 5401: Unused variable, import, function or class
  • #2725 Potential fix for code scanning alert no. 4240: Semicolon insertion
  • #2724 fix: RequestEnvelopeCreator sends "RequestData" as envelope name instead of "Microsoft.ApplicationInsights.{ikey}.Request"
  • #2722 Update Components
  • #2721 Add CfgSync documentation

Full Changelog: microsoft/ApplicationInsights-JS@3.4.1...3.4.2

... (truncated)

Commits

Updates @microsoft/1ds-post-js from 4.4.1 to 4.4.2

Changelog

Sourced from @​microsoft/1ds-post-js's changelog.

Releases

Note: ES3/IE8 compatibility will be removed in the future v3.x.x releases (scheduled for mid-late 2022), so if you need to retain ES3 compatibility you will need to remain on the 2.x.x versions of the SDK or your runtime will need install polyfill's to your ES3 environment before loading / initializing the SDK.

3.4.2 (June 18th, 2026)

This is a maintenance release for the 3.4.x version line containing security hardening, bug fixes, build tooling improvements, and CI updates. The @microsoft/1ds-post-js channel is numbered 4.4.2 and requires v3.4.2.

Significant Changes (since 3.4.1)

  • Prototype Pollution Hardening: The extend() and objExtend() helpers now filter unsafe keys (__proto__, constructor, prototype) to prevent prototype pollution when merging untrusted objects.

  • Dependency Vulnerability Resolution: Migrated the repository from npm to pnpm for dependency management and resolved all known dependency vulnerabilities. This is a build/tooling change and does not affect the published runtime packages.

  • OsPlugin Field Name Correction: The OsPlugin now emits the correct Common Schema 4.0 field names (ext.os.name and ext.os.ver). Telemetry consumers relying on the previously emitted (incorrect) field names should update to the corrected names.

  • RequestEnvelopeCreator Envelope Name Fix: Fixed RequestEnvelopeCreator so request telemetry is sent with the correct envelope name (Microsoft.ApplicationInsights.{ikey}.Request) instead of RequestData.

  • Offline Channel Reliability: Fixed a missing return after reject() in the offline channel that could lead to a null provider dereference.

  • Fixed [INVALID_ANNOTATION] warnings in Rolldown / Vite 8 consumers (#2736): The per-module dist-es5 output (the package module entry that modern bundlers import) emitted parenthesized PURE tree-shaking annotations with whitespace after the opening parenthesis (e.g. ( /*#__PURE__*/"http.")), which stricter bundlers such as Rolldown (Vite 8) rejected. The build now canonicalizes these annotations to the flush form ((/*#__PURE__*/"http.")) in the dist-es5 output, accepted by all bundlers while preserving the wrapping parentheses required for older Rollup / Webpack / Terser to tree-shake the constants. This complements #2737, which only normalized the rollup-bundled dist/es5 (main) output.

CI / Tooling

  • Dropped Node.js 16 from CI matrix: Node.js 16 is End-of-Life and several dependencies (e.g. puppeteer, @pnpm/error) now require Node.js 18 or later. The CI pipeline no longer runs against Node.js 16.
  • Added Node.js 22 and 24 to CI matrix: The CI pipeline now tests against Node.js 18, 20, 22, and 24.
  • Migrated from npm to pnpm: Dependency management now uses pnpm.

Changelog

  • #2733 fix: Migrate from npm to pnpm and resolve all dependency vulnerabilities
  • #2742 fix(ci): repair Node.js CI (Chrome install, bundle-size limits, ts-async offline-channel hang)
  • #2737 fix: remove invalid PURE literal annotations and add bundle validation tests
  • #2736 fix: canonicalize PURE annotations in dist-es5 (module) output to fix Rolldown/Vite 8 [INVALID_ANNOTATION] warnings
  • #2735 fix: prevent prototype pollution in extend() and objExtend() via unsafe key filtering
  • #2734 fix(offline-channel): Add missing return after reject() to prevent null provider dereference
  • #2732 fix(OsPlugin): use correct CS 4.0 field names ext.os.name and ext.os.ver
  • #2731 Drop Node.js 16 from CI matrix; add Node.js 22 and 24
  • #2729 Potential fix for code scanning alert no. 2273: Workflow does not contain permissions
  • #2728 Potential fix for code scanning alert no. 5940: Unused variable, import, function or class
  • #2727 Potential fix for code scanning alert no. 5402: Semicolon insertion
  • #2726 Potential fix for code scanning alert no. 5401: Unused variable, import, function or class
  • #2725 Potential fix for code scanning alert no. 4240: Semicolon insertion
  • #2724 fix: RequestEnvelopeCreator sends "RequestData" as envelope name instead of "Microsoft.ApplicationInsights.{ikey}.Request"
  • #2722 Update Components
  • #2721 Add CfgSync documentation

Full Changelog: microsoft/ApplicationInsights-JS@3.4.1...3.4.2

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
###### Microsoft Reviewers: [Open in CodeFlow](https://microsoft.github.io/open-pr/?codeflow=https://github.com//pull/16281)

@dependabot
📦 [0.84]: Bump the all-dependencies group across 1 directory with 6 u…
4b90c98 
…pdates

Bumps the all-dependencies group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [lage](https://github.com/microsoft/lage) | `2.15.12` | `2.15.13` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.15` | `19.2.17` |
| [semver](https://github.com/npm/node-semver) | `7.8.1` | `7.8.5` |
| [tinyglobby](https://github.com/SuperchupuDev/tinyglobby) | `0.2.16` | `0.2.17` |
| [@microsoft/1ds-core-js](https://github.com/microsoft/ApplicationInsights-JS) | `4.4.1` | `4.4.2` |
| [@microsoft/1ds-post-js](https://github.com/microsoft/ApplicationInsights-JS) | `4.4.1` | `4.4.2` |



Updates `lage` from 2.15.12 to 2.15.13
- [Commits](microsoft/lage@lage_v2.15.12...lage_v2.15.13)

Updates `@types/react` from 19.2.15 to 19.2.17
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `semver` from 7.8.1 to 7.8.5
- [Release notes](https://github.com/npm/node-semver/releases)
- [Changelog](https://github.com/npm/node-semver/blob/main/CHANGELOG.md)
- [Commits](npm/node-semver@v7.8.1...v7.8.5)

Updates `tinyglobby` from 0.2.16 to 0.2.17
- [Release notes](https://github.com/SuperchupuDev/tinyglobby/releases)
- [Changelog](https://github.com/SuperchupuDev/tinyglobby/blob/main/CHANGELOG.md)
- [Commits](SuperchupuDev/tinyglobby@0.2.16...0.2.17)

Updates `@microsoft/1ds-core-js` from 4.4.1 to 4.4.2
- [Release notes](https://github.com/microsoft/ApplicationInsights-JS/releases)
- [Changelog](https://github.com/microsoft/ApplicationInsights-JS/blob/main/RELEASES.md)
- [Commits](https://github.com/microsoft/ApplicationInsights-JS/commits)

Updates `@microsoft/1ds-post-js` from 4.4.1 to 4.4.2
- [Release notes](https://github.com/microsoft/ApplicationInsights-JS/releases)
- [Changelog](https://github.com/microsoft/ApplicationInsights-JS/blob/main/RELEASES.md)
- [Commits](https://github.com/microsoft/ApplicationInsights-JS/commits)

---
updated-dependencies:
- dependency-name: lage
  dependency-version: 2.15.13
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: "@types/react"
  dependency-version: 19.2.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: semver
  dependency-version: 7.8.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: tinyglobby
  dependency-version: 0.2.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: "@microsoft/1ds-core-js"
  dependency-version: 4.4.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: "@microsoft/1ds-post-js"
  dependency-version: 4.4.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Jun 24, 2026
@dependabot dependabot Bot requested a review from a team as a code owner June 24, 2026 12:20
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Jun 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants