build(deps): update root and docs starter dependencies by dependabot[bot] · Pull Request #56 · AojdevStudio/agentic-utilities

dependabot · 2026-09-11T02:12:56Z

The final branch also corrects root lockfile metadata, raises the generated docs starter's Node minimum to 22.19 to match locked Undici, and refreshes vulnerable transitive dependencies within their existing parent ranges (devalue 5.9.4, fast-uri 3.1.8, smol-toml 1.9.0).

Gitleaks installation now uses the job-local temporary directory to avoid a shared fixed-filename collision; scan configuration and history scope are unchanged. Both final-head push and PR secret scans pass.

Validation at 77e9e203eb9d95f019dd1581962fbf6c9942af97: pinned Bun 1.3.7 root check; pack dry run; extension startup; redacted gitleaks; generated starter install, Astro check/build and npm audit (0 vulnerabilities); generator engine regression reproduced before the fix and passes afterward; independent exact-head review with its one finding closed.

Bumps the npm_and_yarn group with 3 updates in the / directory: shell-quote, ip-address and undici.
Bumps the npm_and_yarn group with 6 updates in the /skills/diataxis-docs-site/assets/aoj-starlight directory:

Package	From	To
astro	`7.0.9`	`7.3.2`
fast-uri	`3.1.3`	`3.1.7`
js-yaml	`4.3.0`	`4.3.2`
nanoid	`3.3.16`	`3.3.19`
postcss	`8.5.19`	`8.5.28`
svgo	`4.0.2`	`4.1.0`

Updates shell-quote from 1.8.4 to 1.9.0

Changelog

Sourced from shell-quote's changelog.

v1.9.0 - 2026-06-24

Commits

[New] add types dca6e21

[Dev Deps] update eslint 9aa9e8f

[Fix] parse: finalize tokens in linear time (GHSA-395f-4hp3-45gv) 7ff5488

[actions] update workflows 75e8497

[actions] Windows + node 4/6/7: pin eslint to 9 before install, since npm 2/3 cannot stage eslint 10@types/esrecurse 3fb739d

[actions] retry npm install on Windows to survive npm 2/3 staging-rename flake abe0163

[actions] Windows + node 5/7: install deps with a modern node b4bafa2

[Fix] quote: escape leading ~ to prevent shell tilde-expansion 7a76c1a

[Dev Deps] update auto-changelog, tape 7184b44

[Dev Deps] apparently jackspeak is no longer in the graph 9ba368a

Commits

db09fc7 v1.9.0
7ff5488 [Fix] parse: finalize tokens in linear time (GHSA-395f-4hp3-45gv)
b4bafa2 [actions] Windows + node 5/7: install deps with a modern node
3fb739d [actions] Windows + node 4/6/7: pin eslint to 9 before install, since npm 2/3...
abe0163 [actions] retry npm install on Windows to survive npm 2/3 staging-rename flake
7a76c1a [Fix] quote: escape leading ~ to prevent shell tilde-expansion
75e8497 [actions] update workflows
dca6e21 [New] add types
9aa9e8f [Dev Deps] update eslint
9ba368a [Dev Deps] apparently jackspeak is no longer in the graph
Additional commits viewable in compare view

Updates ip-address from 10.2.0 to 10.7.0

Release notes

Sourced from ip-address's releases.

v10.7.0

What's Changed

Add offset() and nextNetwork(), accept prefix-length ip6.arpa names, correct the IPv6 end-address docs by @beaugunderson in beaugunderson/ip-address#225

Full Changelog: beaugunderson/ip-address@v10.6.0...v10.7.0

v10.6.0

What's Changed

Add isGlobal() and pin the classifiers to the IANA special-purpose registries by @beaugunderson in beaugunderson/ip-address#224

Full Changelog: beaugunderson/ip-address@v10.5.1...v10.6.0

v10.5.1

Full Changelog: beaugunderson/ip-address@v10.5.0...v10.5.1

v10.5.0

What's Changed

Honor the fromURL graceful-failure contract for non-IPv6 hosts by @beaugunderson in beaugunderson/ip-address#218

Correct the documentation where it disagreed with the library by @beaugunderson in beaugunderson/ip-address#219

Full Changelog: beaugunderson/ip-address@v10.4.0...v10.5.0

v10.4.0

What's Changed

Add GitHub Actions CI by @beaugunderson in beaugunderson/ip-address#213

Keep the package loadable on node 12, and enforce it by @beaugunderson in beaugunderson/ip-address#216

Validate the byte arrays Address6 is given by @beaugunderson in beaugunderson/ip-address#217

Full Changelog: beaugunderson/ip-address@v10.3.1...v10.4.0

v10.3.1

Full Changelog: beaugunderson/ip-address@v10.3.0...v10.3.1

v10.3.0

Full Changelog: beaugunderson/ip-address@v10.2.2...v10.3.0

v10.2.2

Full Changelog: beaugunderson/ip-address@v10.2.1...v10.2.2

v10.2.1

Full Changelog: beaugunderson/ip-address@v10.2.0...v10.2.1

Commits

2b7cab5 10.7.0
87fae23 Add offset() and nextNetwork(), accept prefix-length ip6.arpa names, correct ...
42c1f8b 10.6.0
fb12583 Add isGlobal() and pin the classifiers to the IANA special-purpose registries...
38b02d7 10.5.1
d03e960 Merge commit from fork
ab3dc88 Merge commit from fork
ef98e0a 10.5.0
9fd1110 Correct the documentation where it disagreed with the library (#219)
d478737 Honor the fromURL graceful-failure contract for non-IPv6 hosts (#218)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for ip-address since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates undici from 7.28.0 to 7.29.1

Release notes

Sourced from undici's releases.

v7.29.1

⚠️ Security fixes

High severity

GHSA-w293-vg96-wgc3: BalancedPool could drop function-valued connection options while cloning its configuration, including custom TLS certificate validation callbacks. Undici now preserves connect and legacy tls options when creating upstreams. Fixed by f690157d.

GHSA-rfgv-xxqx-mfg5: a WebSocket server could select a subprotocol when none was requested, causing an uncaught TypeError that could terminate the process. Undici now rejects the handshake with protocol error 1002. Fixed by 6615e017.

Medium severity

GHSA-3wwx-pv8p-q78v: a malformed permessage-deflate payload exceeding the configured decompression limit could emit an unhandled zlib error and terminate the process. Undici now destroys the inflater after reaching the limit. Fixed by 63cf698b.

GHSA-rx4f-c7p8-82vq: an unclean WebSocketStream close could create an unobserved rejected promise when its writable stream was locked, potentially terminating the process. Undici now propagates the failure through the retained writable stream controller. Fixed by 1858656e.

GHSA-2jfj-6hjv-fm6j: shared caches could store and replay responses containing Set-Cookie, disclosing one user's cookies to another caller. Undici now excludes these responses from shared caches, including existing entries and revalidation paths. Fixed by b6c5a002.

GHSA-3xpg-4rpp-hhhm: the decompression interceptor did not bound decoded output, allowing compressed responses to consume excessive memory. Undici now limits every decompression stage to 64 MiB by default and supports a configurable maxSize. Fixed by 2c7d7e12.

GHSA-pmjh-fq2x-6v4x: a terminal retry failure after response headers were exposed could orphan the original response body, causing consumers to hang indefinitely. Undici now propagates the terminal error to the exposed body. Fixed by 3c672659.

Low severity

GHSA-8436-99hf-9mmv: cache interceptors could store and replay responses to unsafe HTTP methods such as POST or DELETE. Undici now restricts cache reads and writes to safe methods while preserving invalidation by successful unsafe requests. Fixed by b61d9432.

GHSA-2gqq-gqf2-x968: the dump interceptor could treat an oversized chunked response as successfully truncated when no Content-Length was present. Undici now enforces maxSize against received bytes and aborts oversized responses. Fixed by 21693f40.

GHSA-r53p-7pc4-xj5r: the retry interceptor could concatenate a resumed response with inconsistent framing into downstream output, enabling response splitting or corruption. Undici now validates Content-Range against the original response framing before resuming. Fixed by cd8af90b.

What's Changed

[v7.x] drop: remove Node.js 26 from shared-builtin CI build by @mcollina in nodejs/undici#5592

fix(h2): honour headersTimeout by @mcollina in nodejs/undici#5604

fix(h2): keep the connection ref'd while requests are outstanding by @mcollina in nodejs/undici#5605

ci: increase Windows workflow timeout on v7.x by @mcollina in nodejs/undici#5621

fix(h2): retire the request that completed, not the head of the queue by @mcollina in nodejs/undici#5618

fix(h2): settle a request whose stream is cancelled by @mcollina in nodejs/undici#5607

perf: reduce EventSourceStream parser allocations (#5032) by @mcollina in nodejs/undici#5646

fix(h2): handle GOAWAY for CONNECT streams by @mcollina in nodejs/undici#5640

[v7.x] perf(h1): drop idle-socket timer floor with a ref'd setImmediate (#5707) by @mcollina in nodejs/undici#5769

Full Changelog: nodejs/undici@v7.29.0...v7.29.1

v7.29.0

⚠️ Security fixes

High severity

GHSA-4cwx-7wf7-3272: malformed qualified private Cache-Control directives could cause cross-user information disclosure in shared caches or a parse-time crash. The cache parser now treats empty qualified directives conservatively and safely handles mixed qualified and unqualified directives. Fixed by 9f10f1e9, with regression coverage in 466e99d1.

Medium severity

GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 33928bc2.

GHSA-jr45-8vmc-qm54: optional whitespace around = in qualified no-cache and private directives could bypass shared-cache restrictions and disclose authenticated data across users. Cache-Control parsing now normalizes these forms and applies conservative cache decisions. Fixed by 98011a86.

GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by 1b5a5312, with corrected fixtures in 4a9dafb1.

GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by 3bf91ddb.

... (truncated)

Commits

d39a83e Bumped v7.29.1 (#5772)
0d88464 fix(test): remove unused EventEmitter import
f57411b perf(h1): drop idle-socket timer floor with a ref'd setImmediate (#5707) (#5769)
3c67265 fix(retry): settle exposed body on terminal failure
cd8af90 fix(retry): validate resumed response framing
6615e01 fix(websocket): reject unrequested subprotocols
2c7d7e1 fix(decompress): limit decompressed response size
b6c5a00 fix(cache): do not cache Set-Cookie in shared caches
21693f4 fix(interceptor/dump): abort oversized chunked responses
f690157 fix: preserve BalancedPool connection options
Additional commits viewable in compare view

Updates astro from 7.0.9 to 7.3.2

Release notes

Sourced from astro's releases.

astro@7.3.2

Patch Changes

#17896 a548223 Thanks @matthewp! - Fixes <script>/<style> rendering in MDX so that only literal content (including content injected by remark/rehype plugins) is treated as trusted markup. A dynamic value passed as a <script>/<style> child (e.g. <script>{value}</script>) is now escaped like any other element's content instead of being rendered raw. Use set:html to explicitly opt a dynamic value back into raw rendering.

#17931 c1a6a89 Thanks @astro-factory! - Fixes the dev toolbar returning a 504 "Outdated Optimize Dep" error when a workspace-linked package imports a dependency that Vite's initial scan did not discover

#17908 42e9188 Thanks @astro-factory! - Fixes i18n fallback routing replacing the first substring match instead of the actual locale segment, which mangled paths like /energy/en/about into /esergy/en/about

#17936 4b92ddc Thanks @astro-factory! - Fixes sessions breaking in dev mode with the Cloudflare adapter when middleware is present

Updated dependencies [a548223]:

@astrojs/markdown-satteri@0.4.1

astro@7.3.1

Patch Changes

#17899 0389640 Thanks @ematipico! - Fixes an error that prevented projects using astro:assets from starting or building

astro@7.3.0

Minor Changes
#17767 ce7c91f Thanks @astro-factory! - Adds --ignore-lock flag to astro preview, allowing multiple preview servers to run simultaneously on different ports. This is useful for E2E testing workflows (e.g., Playwright) that need to run several preview servers at once.
#17818 c0b6581 Thanks @florian-lefebvre! - Adds a logger parameter to image services hooks

Custom image services now receive Astro's runtime logger as an extra argument. Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:
import type { LocalImageService } from 'astro';
const service: LocalImageService = {
// ...
async transform(inputBuffer, transform, imageConfig, logger) {
logger.warn(Could not optimize &quot;${transform.src}&quot;. Passing it through unchanged.);
return { data: inputBuffer, format: 'png' };
},
};
Astro's built-in Sharp service now uses this logger for the warnings it emits when it encounters an unexpected or unsupported source format.
#17818 c0b6581 Thanks @florian-lefebvre! - Adds logger to the context object passed to cache providers

Custom cache providers now receive Astro's runtime logger on the context passed to onRequest(). Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:
import type { CacheProvider } from 'astro';
const provider: CacheProvider = {

... (truncated)

Changelog

Sourced from astro's changelog.

7.3.2

Patch Changes

#17896 a548223 Thanks @matthewp! - Fixes <script>/<style> rendering in MDX so that only literal content (including content injected by remark/rehype plugins) is treated as trusted markup. A dynamic value passed as a <script>/<style> child (e.g. <script>{value}</script>) is now escaped like any other element's content instead of being rendered raw. Use set:html to explicitly opt a dynamic value back into raw rendering.

#17931 c1a6a89 Thanks @astro-factory! - Fixes the dev toolbar returning a 504 "Outdated Optimize Dep" error when a workspace-linked package imports a dependency that Vite's initial scan did not discover

#17908 42e9188 Thanks @astro-factory! - Fixes i18n fallback routing replacing the first substring match instead of the actual locale segment, which mangled paths like /energy/en/about into /esergy/en/about

#17936 4b92ddc Thanks @astro-factory! - Fixes sessions breaking in dev mode with the Cloudflare adapter when middleware is present

Updated dependencies [a548223]:

@astrojs/markdown-satteri@0.4.1

7.3.1

Patch Changes

#17899 0389640 Thanks @ematipico! - Fixes an error that prevented projects using astro:assets from starting or building

7.3.0

Minor Changes
#17767 ce7c91f Thanks @astro-factory! - Adds --ignore-lock flag to astro preview, allowing multiple preview servers to run simultaneously on different ports. This is useful for E2E testing workflows (e.g., Playwright) that need to run several preview servers at once.
#17818 c0b6581 Thanks @florian-lefebvre! - Adds a logger parameter to image services hooks

Custom image services now receive Astro's runtime logger as an extra argument. Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:
import type { LocalImageService } from 'astro';
const service: LocalImageService = {
// ...
async transform(inputBuffer, transform, imageConfig, logger) {
logger.warn(Could not optimize &quot;${transform.src}&quot;. Passing it through unchanged.);
return { data: inputBuffer, format: 'png' };
},
};
Astro's built-in Sharp service now uses this logger for the warnings it emits when it encounters an unexpected or unsupported source format.
#17818 c0b6581 Thanks @florian-lefebvre! - Adds logger to the context object passed to cache providers

Custom cache providers now receive Astro's runtime logger on the context passed to onRequest(). Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

... (truncated)

Commits

aa4949e [ci] release (#17915)
42e9188 fix(i18n): replace locale segment by index in fallback routing (#17907) (#17908)
4b92ddc Guard setFetchHandler call in non-runnable dev entrypoint to fix sessions + m...
c1a6a89 fix: include .astro files in client optimizeDeps entries to prevent 504 on la...
a548223 Only treat literal script/style content as raw in MDX rendering (#17896)
92f23cc [ci] release (#17900)
0389640 fix: dont use internal paths (#17899)
f800de1 [ci] release (#17881)
1e0b7e6 [ci] format
4671a5c chore(deps): update react to v19 in 0-css fixture (#17888)
Additional commits viewable in compare view

Updates fast-uri from 3.1.3 to 3.1.7

Release notes

Sourced from fast-uri's releases.

v3.1.7

⚠️ Security Warning

This is a security release that fixes the following high-severity security advisories:

GHSA-qw65-cvwx-89v3 — authority injection via an unvalidated port in serialize()

GHSA-58mr-gqgx-xq4g — host confusion via unbalanced or misplaced IP-literal brackets

Users of the v3.x release line should upgrade to v3.1.7.

Full Changelog: fastify/fast-uri@v3.1.6...v3.1.7

v3.1.6

⚠️ Security Warning

This release addresses the following high-severity security advisories:

GHSA-5jgf-p345-68v8 — host confusion via skipped IDN canonicalization on scheme-relative references

GHSA-fph4-wmhf-6fwf — server-side request forgery via repeated hostname percent-decoding

GHSA-f65p-4m7j-42xc — server-side request forgery via malformed IPv6 normalization

GHSA-jqff-g426-hqxp — host confusion via percent-encoded scheme normalization

Users of the v3.x release line should upgrade to v3.1.6.

Full Changelog: fastify/fast-uri@v3.1.5...v3.1.6

v3.1.5

⚠️ Security Warning

Fix for GHSA-7p8r-x3mc-p8w7

Full Changelog: fastify/fast-uri@v3.1.4...v3.1.5

v3.1.4

⚠️ Security Release

Fix for GHSA-v2hh-gcrm-f6hx

Full Changelog: fastify/fast-uri@v3.1.3...v3.1.4

Commits

412e40a Bumped v3.1.7
9f4c943 fix: backport port and IP-literal validation to v3.x (#216)
1eb3ce4 fix: treat unterminated bracket hosts as reg-names again (#214)
6f970b2 Bumped v3.1.6
d941579 fix: never run IDN canonicalization on bracketed IP literals
c0f0279 test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)
37f3417 Merge commit from fork
607bfbe Merge commit from fork
ae92a4c Merge commit from fork
444ecda Merge commit from fork
Additional commits viewable in compare view

Updates js-yaml from 4.3.0 to 4.3.2

Changelog

Sourced from js-yaml's changelog.

4.3.2 - 2026-08-26

Changed

[backport] Hard-limit merge sequence size to 100.

Security

[backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

4.3.1 - 2026-07-31

Security

[backport] Remove quadratic complexity from !!omap duplicate key detection.

Commits

79ca68d 4.3.2 released
d90b661 Backport merge limits from v5.4.1
86e91b8 4.3.1 released
c3cc4b0 Backport quadratic complexity fix for !!omap
See full diff in compare view

Updates nanoid from 3.3.16 to 3.3.19

Release notes

Sourced from nanoid's releases.

3.3.19

Fixed killing the app by setting huge user ID.

3.3.18

Fixed infinite loop on async for React Native (by @OvergrowthBeards-JB).

3.3.17

Fixed infinite loop on zero size.

Changelog

Sourced from nanoid's changelog.

3.3.19

Fixed killing the app by setting huge user ID (by @geoffrey-diederichs).

3.3.18

Fixed infinite loop on async for React Native (by @OvergrowthBeards-JB).

3.3.17

Fixed infinite loop on zero size.

Commits

eb63bd6 Release 3.3.19 version
9067e03 Sync CJS and ESM
9ad9805 Release 3.3.18 version
55e50a0 Update CI action
e10f8d4 Update index.native.js (#606)
73d6716 Release 3.3.17 version
f9d13f1 Sync 0 size behaviour with PostCSS 5
See full diff in compare view

Updates postcss from 8.5.19 to 8.5.28

Release notes

Sourced from postcss's releases.

8.5.28

Fixes types regression.

8.5.27

Fixed removing any comments starting with /*# (by @dylanpulver).

Fixed * hack before a comment in Custom Properties (by @Jaybhade).

Fixed empty values in the middle of list.comma() (by @MahinAnowar).

Fixed whitespace-only values in list.space() (by @MahinAnowar).

Fixed rule’s end position on space before semicolon (by @maximilliangrand).

Fixed types (by @romainmenke).

Fixed Chinese text in deprecation warning (by @Jesse205).

8.5.26

Fixed list.split() regression (by @lazerg).

Track symlinks in path protection in source map loading (by @drengir1).

8.5.25

Fixed 8.5.17 visitor regression.

Fixed list.split() for non-string values (by @amir-rezaei).

8.5.24

Preserve the BOM after the processing (by @hdimer).

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

Changelog

Sourced from postcss's changelog.

8.5.28

Fixes types regression.

8.5.27

Fixed removing any comments starting with /*# (by @dylanpulver).

Fixed * hack before a comment in Custom Properties (by @Jaybhade).

Fixed empty values in the middle of list.comma() (by @MahinAnowar).

Fixed whitespace-only values in list.space() (by @MahinAnowar).

Fixed rule’s end position on space before semicolon (by @maximilliangrand).

Fixed types (by @romainmenke).

Fixed Chinese text in deprecation warning (by @Jesse205).

8.5.26

Fixed list.split() regression (by @lazerg).

Track symlinks in path protection in source map loading (by @drengir1).

8.5.25

Fixed 8.5.17 visitor regression.

Fixed list.split() for non-string values (by @amir-rezaei).

8.5.24

Preserve the BOM after the processing (by @hdimer).

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

Commits

e544bff Release 8.5.28 version
f8fc252 Typo
5039fd7 Add missed release notes
ae40ca4 Release 8.5.27 version
62b1626 Fix linter
1dba938 Update dependencies
3e82edc Keep non-annotation comments when the processor has no plugins (#2150)
6d23bc3 Fix link
508e997 Add GitHub Sponsors link
e993739 Add CodeRabbit sponsor (#2145)
Additional commits viewable in compare view

Updates sharp from 0.35.3 to 0.35.4

Release notes

Sourced from sharp's releases.

v0.35.4

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.3

Bound resize dimensions to coordinate limit.

Bound composite left and top to coordinate limit. #4564 @metsw24-max

Round palette bit depth up for png and gif colours. #4569 @metsw24-max

Ensure tiff.subifd input option is used. #4572 @metsw24-max

Ensure info.pages is correct when limiting input page range. #4578 @metsw24-max

Improve support for input Streams finishing before output is requested. #4584 @Jaybhade

v0.35.4-rc.0

Upgrade to libvips v8.18.6 for upstream bug fixes.

Bound resize dimensions to coordinate limit.

Bound composite left and top to coordinate limit. #4564 @metsw24-max

Round palette bit depth up for png and gif colours. #4569 @metsw24-max

Ensure tiff.subifd input option is used. #4572 @metsw24-max

Ensure info.pages is correct when limiting input page range. #4578 @metsw24-max

Improve support for input Streams finishing before output is requested. #4584 @Jaybhade

Commits

7f1a0a2 Release v0.35.4
f927818 Upgrade to sharp-libvips v1.3.3
e802092 Prerelease v0.35.4-rc.0
e13eb2f CI: Fix wasm32 build (#4589)
a82a0b3 Upgrade to libvips v8.18.6
8044fe4 Bound resize dimensions to coordinate limit
147f859 Docs: changelog entries for #4578 #4584
ee5bfb8 Tests: use yauzl directly rather than via extract-zip wrapper
7a77889 Bump uraimo/run-on-arch-action from 3.1.0 to 3.2.0 (#4588)
ea5bef2 Improve support for input Streams finishing before output is requested (#4584)
Additional commits viewable in compare view

Updates svgo from 4.0.2 to 4.1.0

Release notes

Sourced from svgo's releases.

v4.1.0

This minor release upgrades the SAX parser and introduces stricter XML validation. It also includes important security hardening for removeScripts, dependency updates, and improvements to the test and regression infrastructure.

Support SVGO

If SVGO is valuable to you or your organization, please consider supporting the project on OpenCollective. Your sponsorship helps fund ongoing maintenance and security work.

Stricter XML validation

SVGO now uses sax 1.6.1, upgraded from 1.5.0 (#2257).

The new parser version validates numeric character references against the ranges permitted by XML. Invalid references are now rejected in both text and attributes, including:

disallowed control characters such as &[#1](https://github.com/svg/svgo/issues/1);, , and ;

UTF-16 surrogate code points such as &#xD800;;

invalid XML code points such as .

Valid boundary values—including U+0020, U+D7FF, U+E000, U+FFFD, and characters through U+10FFFF—remain supported.

Parser failures are consistently exposed as SvgoParserError errors with an Invalid character entity reason.

This is an intentional behavior change: malformed SVGs that were previously accepted may now produce a parser error, while valid XML documents are unaffected.

Security

The removeScripts plugin has been hardened against several script-execution bypasses:

Filters executable data: URLs containing HTML, XHTML, or SVG documents while preserving inert data such as PNG images, and filters legacy vbscript: URLs (#2263).

Sanitizes content inside SVG <foreignObject> elements by removing HTML event-handler attributes, srcdoc, and executable URLs from action, data, formaction, href, and src, while preserving non-executable HTML and visual content (#2264).

Recognizes namespace-prefixed SVG <a> elements and removes ASCII tabs and newlines before checking URL schemes, preventing values such as java&[#9](https://github.com/svg/svgo/issues/9);script: from bypassing detection while preserving elements in unrelated custom namespaces (#2268).

These changes address:

GHSA-4vpr-x523-8j87

GHSA-w27v-7q3p-w38r

Dependencies

Upgraded css-select to v6 and css-what to v7, and updated SVGO's custom selector adapter for css-select v6 (#2244).

Project maintenance

@TrySound is back as an active SVGO maintainer.

Many thanks to @KTibow, @SethFalco, and @XhmikosR for maintaining and improving SVGO over the past several years.

Full Changelog: svg/svgo@v4.0.2...v4.1.0

Commits

5765cbe chore: prepare v4.1.0 release (#2275)
3db3ef3 fix(removeScripts): handle anchor URL bypasses (#2268)
4e9b9ae chore: cache regression screenshots (#2267)
d55270c chore(regression): migrate comparison workers to Tinypool (#2266)
fd51e47 fix(removeScripts): sanitize foreignObject content (#2264)
dcaf957 chore: optimize fixtures in a bounded worker pool (#2265)
a354293 fix(removeScripts): filter executable data URLs (#2263)
4e0d2ac ci...
Description has been truncated

… updates Bumps the npm_and_yarn group with 3 updates in the / directory: [shell-quote](https://github.com/ljharb/shell-quote), [ip-address](https://github.com/beaugunderson/ip-address) and [undici](https://github.com/nodejs/undici). Bumps the npm_and_yarn group with 6 updates in the /skills/diataxis-docs-site/assets/aoj-starlight directory: | Package | From | To | | --- | --- | --- | | [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `7.0.9` | `7.3.2` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.1.3` | `3.1.7` | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.3.0` | `4.3.2` | | [nanoid](https://github.com/ai/nanoid) | `3.3.16` | `3.3.19` | | [postcss](https://github.com/postcss/postcss) | `8.5.19` | `8.5.28` | | [svgo](https://github.com/svg/svgo) | `4.0.2` | `4.1.0` | Updates `shell-quote` from 1.8.4 to 1.9.0 - [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md) - [Commits](ljharb/shell-quote@v1.8.4...v1.9.0) Updates `ip-address` from 10.2.0 to 10.7.0 - [Release notes](https://github.com/beaugunderson/ip-address/releases) - [Commits](beaugunderson/ip-address@v10.2.0...v10.7.0) Updates `undici` from 7.28.0 to 7.29.1 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.28.0...v7.29.1) Updates `astro` from 7.0.9 to 7.3.2 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/astro@7.3.2/packages/astro) Updates `fast-uri` from 3.1.3 to 3.1.7 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.3...v3.1.7) Updates `js-yaml` from 4.3.0 to 4.3.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.0...4.3.2) Updates `nanoid` from 3.3.16 to 3.3.19 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](ai/nanoid@3.3.16...3.3.19) Updates `postcss` from 8.5.19 to 8.5.28 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.19...8.5.28) Updates `sharp` from 0.35.3 to 0.35.4 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](lovell/sharp@v0.35.3...v0.35.4) Updates `svgo` from 4.0.2 to 4.1.0 - [Release notes](https://github.com/svg/svgo/releases) - [Commits](svg/svgo@v4.0.2...v4.1.0) --- updated-dependencies: - dependency-name: shell-quote dependency-version: 1.9.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: ip-address dependency-version: 10.7.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 7.29.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: astro dependency-version: 7.3.2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: nanoid dependency-version: 3.3.19 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.28 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: sharp dependency-version: 0.35.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: svgo dependency-version: 4.1.0 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

coderabbitai · 2026-09-11T02:13:24Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: AojdevStudio/agentic-utilities/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 32549478-a13b-46c0-a827-18bb73c4d1d8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

coldtea-pr-lens · 2026-10-01T02:29:30Z

◈ PR Lens

Note

dependabot[bot] opened this pull request, so PR Lens left it undrawn. Comment @pr-lens draw to draw it

_{github.comment.notice: false in .github/pr-lens.yml turns this note off}

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 11, 2026

AojdevStudio added 2 commits September 30, 2026 21:11

fix(deps): synchronize root lockfile dependency specs

17970f0

fix(docs): align starter engines and secure transitive dependencies

36cce83

AojdevStudio changed the title ~~build(deps): bump the npm_and_yarn group across 2 directories with 10 updates~~ build(deps): update root and docs starter dependencies Oct 1, 2026

fix(ci): isolate gitleaks installer temporary files

77e9e20

Navigation Menu

build(deps): update root and docs starter dependencies - #56

build(deps): update root and docs starter dependencies#56
dependabot[bot] wants to merge 4 commits into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-24c198a14e

dependabot Bot commented on behalf of github Sep 11, 2026 •

edited by AojdevStudio

Loading

Uh oh!

coderabbitai Bot commented Sep 11, 2026 •

edited

Loading

Review skipped

Uh oh!

coldtea-pr-lens Bot commented Oct 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Sep 11, 2026 • edited by AojdevStudio Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v1.9.0 - 2026-06-24

Commits

v10.7.0

What's Changed

v10.6.0

What's Changed

v10.5.1

v10.5.0

What's Changed

v10.4.0

What's Changed

v10.3.1

v10.3.0

v10.2.2

v10.2.1

v7.29.1

⚠️ Security fixes

High severity

Medium severity

Low severity

What's Changed

v7.29.0

⚠️ Security fixes

High severity

Medium severity

astro@7.3.2

Patch Changes

astro@7.3.1

Patch Changes

astro@7.3.0

Minor Changes

7.3.2

Patch Changes

7.3.1

Patch Changes

7.3.0

Minor Changes

v3.1.7

⚠️ Security Warning

v3.1.6

⚠️ Security Warning

v3.1.5

⚠️ Security Warning

v3.1.4

⚠️ Security Release

4.3.2 - 2026-08-26

Changed

Security

4.3.1 - 2026-07-31

Security

3.3.19

3.3.18

3.3.17

3.3.19

3.3.18

3.3.17

8.5.28

8.5.27

8.5.26

8.5.25

8.5.24

8.5.23

8.5.22

8.5.21

8.5.20

8.5.28

8.5.27

8.5.26

8.5.25

8.5.24

8.5.23

8.5.22

8.5.21

8.5.20

v0.35.4

v0.35.4-rc.0

v4.1.0

dependabot Bot commented on behalf of github Sep 11, 2026 •

edited by AojdevStudio

Loading

coderabbitai Bot commented Sep 11, 2026 •

edited

Loading