Skip to content

Bump the npm_and_yarn group across 1 directory with 8 updates - #33

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-98730a93a0
Open

Bump the npm_and_yarn group across 1 directory with 8 updates#33
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-98730a93a0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 30, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 7 updates in the / directory:

Package From To
echarts 5.5.1 6.1.0
next 14.2.35 16.3.1
brace-expansion 1.1.12 1.1.18
flatted 3.3.1 3.4.4
js-yaml 4.1.1 4.3.1
picomatch 2.3.1 4.0.5
svelte 5.19.1 5.56.9

Updates echarts from 5.5.1 to 6.1.0

Release notes

Sourced from echarts's releases.

6.1.0

  • [Feature] [axis] Support dataMin and dataMax option for calculating a nice axis extent. #20838 (Justin-ZS, Ovilia)
  • [Feature] [axis] Comprehensively enable all types of axis (i.e., "value"/"time"/"category"/"log") to render series (typically "bar"/"pictorialBar"/"candlestick"/"boxplot") without overflow (including the case "category" axis with boundaryGap: false); provide containShape option; provide some corresponding clip option. dbfaf6a73 fe932a2aa 3973b21ee (100pah) #21511 (Akash Sonune)
  • [Feature] [axis] Automatically exclude non-positive series data values on "log" axis. dedc5dc18 (100pah)
  • [Feature] [axis] Enable axisLabel.formatter to receive its index for working with customValues. #21220 #21432 (Szymon Pachucki, Ovilia, plainheart)
  • [Feature] [line] Add triggerEvent option for more control over mouse event. #21001 (Steven Cobb, plainheart)
  • [Feature] [pie] Add tangential-noflip rotation mode to keep labels tangential without flipping. #21258 (春秋半夏, Ovilia)
  • [Feature] [gauge] progress.color supports 'auto'. #21224 (StNimmerlein, Ovilia)
  • [Feature] [radar] Add clockwise option. #21143 (Dai Xuezhou, Ovilia)
  • [Feature] [candlestick] [dataZoom] Add cursor option for candlestick series and add cursorGrab option & cursorGrabbing for 'inside' dataZoom. #21558 (zuming, Ovilia, 100pah)
  • [Feature] [scatter] [effectScatter] [geo] Enable clip option on "scatter"/"effectScatter" on geo. 417592289 (100pah)
  • [Feature] [visualMap] Add seriesTargets option for multiple series-dimension mappings. #20703 (Justin-ZS, plainheart)
  • [Feature] [matrix] Support matrix.x/y.length for conveniently creating a headless matrix without composing an array. #21191 (100pah, plainheart)
  • [Feature] [matrix] Add triggerEvent option to support triggering event on matrix cells. #21390 (Natsuo Kawai, 100pah)
  • [Feature] [i18n] add Latvian(LV) translation. #21546 (EPoikans)
  • [Fix] [axis] Change and clarify the rounding error and auto-precision utils and solutions. 479dcd454 (100pah)
  • [Fix] [axis] Fix chart does not work when using customValues with formatter in time axis (axis.type: 'time') label. #21352 (Srajan Sanjay Saxena, plainheart)
  • [Fix] [axis] Fix and clarify alignTick strategy, and fix LogScale precision. a6ab2458f ffcc636fb (100pah)
  • [Fix] [axis] Fix duplicate ticks when using time axis (axis.type: 'time') or customValues, which causes jitter of splitArea; fix the showMin/MaxLabel handling of a category axis (axis.type: 'category'); enable a uniform bandWidth calculation in numeric axis (axis.type: 'value' | 'time' | 'log'). 8de2b64fa 15af0db02 8ddaa5c69 (100pah)
  • [Fix] [axis] Fix time axis (axis.type: 'time') bug when value scale is in millisecond. 40b77b464 (100pah)
  • [Fix] [bar] Fix wrong label position when bar series has a 0 width/height. #21218 (Justin-ZS, Ovilia)
  • [Fix] [scatter] Fix jitter layout does not support progressive rendering and cause chart to be frozen and potential NPE. #21436 (plainheart)
  • [Fix] [lines] Fix effect symbol flip on unidirectional loop end when roundTrip is not enabled. #21320 (Mayank Mehta, plainheart)
  • [Fix] [candlestick] Fix candlestick render error with series.encode on horizontal layout. #21325 (Purbayan Pramanik, 100pah)
  • [Fix] [parallel] Fix incorrect axis extent when any subsequent series has a larger value than the first. #21387 (jackhickson, 100pah)
  • [Fix] [pie] Support axes extent union pie center automatically when pie is laid out on Cartesian (grid component). 18a23a875 (100pah)
  • [Fix] [treemap] Fix treemap can not be zoomed out after a zoom-in when scaleLimit is specified #21427 (TateLiu, 100pah)
  • [Fix] [lines] Fix potential tooltip XSS vulnerability in lines series (series.type: 'lines'). #21608 (plainheart)
  • [Fix] [map] [geo] Fix the failed synchronization and visual artifacts on geo roaming and animation. 417592289 (100pah)
  • [Fix] [tooltip] Fix tooltip content does not refresh when changing tooltip trigger from 'axis' to 'item'. #20710 (Justin-ZS, plainheart)
  • [Fix] [tooltip] valueFormatter callback param dataIndex should be rawDataIndex rather than dataZoom filtered dataIndex. #21479 (100pah, plainheart)
  • [Fix] [axisPointer] Fix axisPointer shadow and enable clipping - it is previously only applicable to "category" axis, but is buggy in numeric axis with "bar" series. 8de2b64fa (100pah)
  • [Fix] [axisPointer] Fix visual artifacts caused by failed axisPointer restoration. 56a32c0bb (100pah)
  • [Fix] [hoverLayer] Fix visual artifacts arisen on hover layer. zrender#1151 933585126 (100pah)
  • [Fix] [marker] Fix marker fails to render with dataset and encode. #21439 (plainheart, 100pah).
  • [Fix] [dataZoom] Fix wrong position of the dataZoom when the series has only one data point. #21196 (alesmit, Ovilia)
  • [Fix] [dataZoom] Fix dataZoom bug that data info disappears when dragging released; fix dataZoom dragging cursor style. 64305a4b8 (100pah)
  • [Fix] [dataZoom] Apply a better auto-precision method; fix unexpected behaviors when dataZoom controls axes with alignTicks: true. d168bf237 (100pah)
  • [Fix] [dataZoom] Fix AxisProxy can not be cleared when dataZoom option changed; fix related onZero behaviors. 52ceb924a 2e82d33c3 (100pah)
  • [Fix] [areaStyle] Fix areaStyle render error when dimension name is empty string. #21219 (Justin-ZS, Ovilia)
  • [Fix] [sunburst] Fix root node label may not be centered. #21306 (Akash Sonune, Ovilia)
  • [Fix] [matrix] Fix matrix label formatter does not work. #21410 (Justin-ZS, Ovilia)
  • [Fix] [toolbox] Fix emphasis color is the same as the default color. #21384 (Ovilia) b094f987d (100pah)
  • [Fix] [toolbox] Fix the dataView component does not fit the dark mode. #21176 (notthistrain, Ovilia)
  • [Fix] [progressive] Fix progressive rendering issues. 91a60fc76 (100pah)
  • [Fix] [labelLine] Fix labelLine.smooth can not be reset. #21425 (fanwww, plainheart)
  • [Fix] [graphic] Fix stroke corner gap due to not closing path in roundRect helper. zrender#1155 (plainheart)
  • [Fix] [svg] Enhance SVG encodeBase64 compatibility to make it available in more environments like Web Worker/NodeJS/Bun. zrender#1145 (plainheart)
  • [Fix] [core] Mark echarts instance object as raw in Vue. #21293 (plainheart)
  • [Fix] [chord] Add the missing export entry for chord chart. #21197 (plainheart, Ovilia)

... (truncated)

Commits
  • c5a48f5 Merge pull request #21612 from apache/release-dev
  • 77e5222 release 6.1.0-rc.2
  • 21f17be fixRegression(map,geo): Resolve circular dependencies introduced by this vers...
  • 830e8b6 chore: Supplement package.json (for module cjs declaration) to source release.
  • ed0e210 chore: Fix addHeader tool and add missing license headers.
  • cc78ada Merge pull request #21611 from apache/release-dev
  • 3f6e012 release: Build release.
  • d69405f chore: Add missing headers.
  • 6998ed0 release: Upgrade npm version.
  • 8cb374b fix(build): Fix build commands.
  • Additional commits viewable in compare view

Updates next from 14.2.35 to 16.3.1

Release notes

Sourced from next's releases.

v16.3.1

What's Changed

Full Changelog: vercel/next.js@v16.3.0...v16.3.1

v16.3.1-canary.21

Misc Changes

  • Anchor the async local storage instances to global symbols: #97255
  • test: deflake use-cache-size-zero warm reload: #97421
  • Scaffolding for concurrentRouterQueue flag: #97413
  • Reorganize client router modules: #97402

Credits

Huge thanks to @​unstubbable, @​gnoff, and @​acdlite for helping!

v16.3.1-canary.20

Misc Changes

  • Wait for back-before-hydration recoveries in the browser: #97321
  • Extract metadata resolution primitives: #97388
  • test: update React 18 redbox snapshot: #97415
  • Turbopack: retain conditions when replacing resolve request keys: #97372
  • Remove server route matcher stack: #94157

Credits

Huge thanks to @​gaearon, @​gnoff, @​timneutkens, and @​mischnic for helping!

... (truncated)

Commits
  • 3d32eb8 v16.3.1
  • 2b4b1ec [backport] Revert i18n localization change for dynamic Pages API routes (#949...
  • 228df5f [backport] Retain fewer stale cache versions and use a TTL, plus the mtime fa...
  • 16eab3a [backport] Fix: Optimistic routing bugs leading to repeated prefetch loops (#...
  • 75548c9 [backport] Fix Nav Inspector request loop on repeat captures (#97326)
  • f6bd714 [backport] [test] Compile the middleware redirect routes up front in dev (#97...
  • 43c1c60 [16.3] [ci] Use OIDC tokens to read private preview builds (#97258)
  • 9dbb357 [backport] Encode the cache item name built by unstable_cache (#97313)
  • 323a17c [backport] Discard only cache entries that predate a tag revalidation, and re...
  • 6d67f46 [backport] Keep the dev validation worker alive across HMR updates (#97315)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.


Updates postcss from 8.5.1 to 8.5.23

Release notes

Sourced from postcss's releases.

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

8.5.19

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

  • Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

  • Fixed Maximum call stack size exceeded error.
  • Fixed Prototype hijacking for postcss.fromJSON().
  • Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

8.5.15

  • Fixed declaration parsing performance (by @​homanp).

8.5.14

8.5.13

  • Fixed postcss-scss commend regression.

8.5.12

  • Fixed reading any file via user-generated CSS.
  • Added opts.unsafeMap to disable checks.

8.5.11

  • Fixed nested brackets parsing performance (by @​offset).

8.5.10

  • Fixed XSS via unescaped </style> in non-bundler cases (by @​TharVid).

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.


Updates brace-expansion from 1.1.12 to 1.1.18

Release notes

Sourced from brace-expansion's releases.

v1.1.15

  • Backport v5.0.6 change to v1 (#111) 0b09384

juliangruber/brace-expansion@v1.1.14...v1.1.15

Commits

Updates flatted from 3.3.1 to 3.4.4

Commits

Updates js-yaml from 4.1.1 to 4.3.1

Changelog

Sourced from js-yaml's changelog.

4.3.1 - 2026-07-31

Security

  • [backport] Remove quadratic complexity from !!omap duplicate key detection.

4.3.0 - 2026-06-27

Added

  • [backport] Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.

Fixed

  • Restore umd builds back to es5.

Removed

  • [backport] maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

[4.2.0] - 2026-06-01

Added

  • Added docs/safety.md with notes about processing untrusted YAML.
  • Added maxDepth (100) loader option. Not a problem, but gives a better exception instead of RangeError on stack overflow.
  • Added maxMergeSeqLength (20) loader option. Not a problem after merge fix, but an additional restriction for safety.
  • Added sourcemaps to dist/ builds.

Changed

  • Stop resolving numbers with underscores as numeric scalars, #627.
  • Switched dev toolchains to Vite / neostandard.
  • Updated demo.
  • Reorganized tests.
  • dist/ files are no longer kept in the repository.

Fixed

  • Fix parsing of properties on the first implicit block mapping key, #62.
  • Fix trailing whitespace handling when folding flow scalar lines, #307.
  • Reject top-level block scalars without content indentation, #280.
  • Ensure numbers survive round-trip, #737.
  • Fix test coverage for issue #221.
  • Fix flow scalar trailing whitespace folding, #307.
  • Fix digits in YAML named tag handles.

Security

  • Fix potential DoS via quadratic complexity in merge - deduplicate repeated elements (makes sense for malformed files > 10K).

[3.14.2] - 2025-11-15

Security

... (truncated)

Commits
  • 86e91b8 4.3.1 released
  • c3cc4b0 Backport quadratic complexity fix for !!omap
  • 33d05b5 4.3.0 released
  • 663bfab Drop demo publish, to not override new v5 one.
  • 1cb8c7b Add v4-legacy tag for publish
  • 02f27af Restore umd builds back to es5
  • 8be84ed Fix es5 compatibility
  • 59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
  • 6842ef6 doc polish
  • 590dbab 4.2.0 released
  • Additional commits viewable in compare view

Updates picomatch from 2.3.1 to 4.0.5

Release notes

Sourced from picomatch's releases.

4.0.5

What's Changed

New Contributors

Full Changelog: micromatch/picomatch@4.0.4...4.0.5

4.0.4

This is a security release fixing several security relevant issues.

What's Changed

Full Changelog: micromatch/picomatch@4.0.3...4.0.4

4.0.3

What's Changed

New Contributors

Full Changelog: micromatch/picomatch@4.0.2...4.0.3

3.0.2

This is a security release fixing several security relevant issues.

What's Changed

Full Changelog: micromatch/picomatch@3.0.1...3.0.2

2.3.2

This is a security release fixing several security relevant issues.

What's Changed

Full Changelog: micromatch/picomatch@2.3.1...2.3.2

Changelog

Sourced from picomatch's changelog.

Release history

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

  • Changelogs are for humans, not machines.
  • There should be an entry for every single version.
  • The same types of changes should be grouped.
  • Versions and sections should be linkable.
  • The latest version comes first.
  • The release date of each versions is displayed.
  • Mention whether you follow Semantic Versioning.

Changelog entries are classified using the following labels (from keep-a-changelog):

  • Added for new features.
  • Changed for changes in existing functionality.
  • Deprecated for soon-to-be removed features.
  • Removed for now removed features.
  • Fixed for any bug fixes.
  • Security in case of vulnerabilities.

4.0.0 (2024-02-07)

Fixes

Changed

3.0.1

Fixes

... (truncated)

Commits
  • 4f41a8e 4.0.5
  • 02cfc1b Update .verb.md and run verb to generate README documentation
  • cc52ff6 Only run the upload code coverage step for 1 matrix permutation
  • 6d426d7 Allow workflow to continue if the code coverage step to fails
  • a00b954 Merge branch 'codeql-coverage'
  • 9680381 Merge pull request #183 from MerlijnW70/fix/matchbase-windows-basename
  • 648b4f2 Merge pull request #182 from MerlijnW70/fix/repeated-extglob-drops-branches
  • 70e6485 Configure code coverage upload for CodeQL
  • ab8bc4d fix: honor the windows option when matching basenames
  • 6289307 fix: preserve all branches when rewriting risky repeated extglobs
  • Additional commits viewable in compare view

Updates svelte from 5.19.1 to 5.56.9

Release notes

Sourced from svelte's releases.

svelte@5.56.9

Patch Changes

  • fix: skip controlled each fast path while another batch is pending (#18625)

  • fix: better whitespace handling inside printer (#18638)

  • fix: don't duplicate comments in attributes (#18636)

  • fix: preserve CSS comments in the AST printer (#18637)

svelte@5.56.8

Patch Changes

  • fix: call onerror and provide a working reset when hydrating a failed boundary (#18556)

  • fix: preserve select selection when spread attributes omit value (#18561)

svelte@5.56.7

Patch Changes

  • chore: provide indent option for print (#18474)

svelte@5.56.6

Patch Changes

  • perf: skip unnecessary blocker analysis when compiling components without top-level await (#18548)

  • fix: rerun derived that had an abort controller on reconnection (#18551)

svelte@5.56.5

Patch Changes

  • chore: drop dead code that make TSGO fail (#18496)

  • fix: don't (re)connect deriveds when read inside branch/root effects (#18527)

  • fix: skip unnecessary derived effect in earlier batch (#18525)

  • fix: avoid declaration tag warning in event handlers (#18500)

  • fix: abort deriveds own AbortSignal when it disconnects (#18400)

  • fix: ensure $state.eager() is correctly transormed for SSR output (#18530)

  • fix: correctly transform declaration tags during SSR (#18492)

  • fix: transform computed keys in keyed {#each} destructuring patterns (#18521)

  • fix: chain preprocessor sourcemaps with an empty sources[0] instead of dropping them (#18518)

... (truncated)

Changelog

Sourced from svelte's changelog.

5.56.9

Patch Changes

  • fix: skip controlled each fast path while another batch is pending (#18625)

  • fix: better whitespace handling inside printer (#18638)

  • fix: don't duplicate comments in attributes (#18636)

  • fix: preserve CSS comments in the AST printer (#18637)

5.56.8

Patch Changes

  • fix: call onerror and provide a working reset when hydrating a failed boundary (#18556)

  • fix: preserve select selection when spread attributes omit value (#18561)

5.56.7

Patch Changes

  • chore: provide indent option for print (#18474)

5.56.6

Patch Changes

  • perf: skip unnecessary blocker analysis when compiling components without top-level await (#18548)

  • fix: rerun derived that had an abort controller on reconnection (#18551)

5.56.5

Patch Changes

  • chore: drop dead code that make TSGO fail (#18496)

  • fix: don't (re)connect deriveds when read inside branch/root effects (#18527)

  • fix: skip unnecessary derived effect in earlier batch (#18525)

  • fix: avoid declaration tag warning in event handlers (#18500)

  • fix: abort deriveds own AbortSignal when it disconnects (#18400)

  • fix: ensure $state.eager() is correctly transormed for SSR output (#18530)

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for svelte since your current version.


@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 30, 2026
@vercel

vercel Bot commented Jul 30, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
ai-analyst Error Error Aug 17, 2026 1:29pm

Request Review

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 30, 2026
@cla-bot cla-bot Bot added the cla-signed label Jul 30, 2026
Bumps the npm_and_yarn group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [echarts](https://github.com/apache/echarts) | `5.5.1` | `6.1.0` |
| [next](https://github.com/vercel/next.js) | `14.2.35` | `16.3.1` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.12` | `1.1.18` |
| [flatted](https://github.com/WebReflection/flatted) | `3.3.1` | `3.4.4` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.1` | `4.3.1` |
| [picomatch](https://github.com/micromatch/picomatch) | `2.3.1` | `4.0.5` |
| [svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte) | `5.19.1` | `5.56.9` |



Updates `echarts` from 5.5.1 to 6.1.0
- [Release notes](https://github.com/apache/echarts/releases)
- [Commits](apache/echarts@5.5.1...6.1.0)

Updates `next` from 14.2.35 to 16.3.1
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v14.2.35...v16.3.1)

Updates `postcss` from 8.5.1 to 8.5.23
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.1...8.5.23)

Updates `brace-expansion` from 1.1.12 to 1.1.18
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.18)

Updates `flatted` from 3.3.1 to 3.4.4
- [Commits](WebReflection/flatted@v3.3.1...v3.4.4)

Updates `js-yaml` from 4.1.1 to 4.3.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.1...4.3.1)

Updates `picomatch` from 2.3.1 to 4.0.5
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@2.3.1...4.0.5)

Updates `svelte` from 5.19.1 to 5.56.9
- [Release notes](https://github.com/sveltejs/svelte/releases)
- [Changelog](https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG.md)
- [Commits](https://github.com/sveltejs/svelte/commits/svelte@5.56.9/packages/svelte)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 1.1.17
  dependency-type: indirect
- dependency-name: echarts
  dependency-version: 6.1.0
  dependency-type: direct:production
- dependency-name: flatted
  dependency-version: 3.4.3
  dependency-type: indirect
- dependency-name: js-yaml
  dependency-version: 4.3.0
  dependency-type: indirect
- dependency-name: next
  dependency-version: 16.2.12
  dependency-type: direct:production
- dependency-name: picomatch
  dependency-version: 4.0.5
  dependency-type: indirect
- dependency-name: postcss
  dependency-version: 8.5.18
  dependency-type: direct:development
- dependency-name: svelte
  dependency-version: 5.56.8
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/npm_and_yarn-98730a93a0 branch from 2415517 to 84e1c08 Compare August 17, 2026 13:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

cla-signed dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants