Skip to content

chore(deps-dev): bump mocha from 11.8.0 to 12.0.0 - #295

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/mocha-12.0.0
Closed

chore(deps-dev): bump mocha from 11.8.0 to 12.0.0#295
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/mocha-12.0.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 14, 2026

Copy link
Copy Markdown
Contributor

Bumps mocha from 11.8.0 to 12.0.0.

Release notes

Sourced from mocha's releases.

v12.0.0

12.0.0 (2026-08-31)

🩹 Fixes

  • fixup parsing negative numbers and quoted strings (#6250) (2962875)
  • preserve FIFO descriptors when respawning (#6254) (3bb317d)

📚 Documentation

🧹 Chores

v12.0.0-rc.6

12.0.0-rc.6 (2026-08-09)

🩹 Fixes

  • deps: update dependency starlight-blog to ^0.28.0 (#6153) (6b79044)
  • docs: restore homepage logo (#6183) (06e81a8)
  • docs: restore spacing around footer links (#6185) (163d751)
  • use main instead of exports for the package entry point (#6193) (c32a696)

📚 Documentation

  • blog: add community contributions post (#6172) (5fcc0fe)
  • blog: update community-contributions to 2026-community-sponsorships (5462d84)
  • fix blog/2026-community-sponsorships description (#6177) (98c4746)
  • sync CLI docs with v12 options and defaults (#6140) (579fd15)

🧹 Chores

  • deps: update dependency @​playwright/test to v1.62.1 (#6197) (dcc539a)
  • deps: update dependency eslint to v10.8.0 (#6196) (deeeec6)
  • deps: update dependency globals to v17.9.0 (#6201) (c2c6d63)
  • deps: update dependency knip to v6.31.0 (#6166) (b7cd1bd)
  • deps: update dependency sinon to v22.1.0 (#6188) (284f0c2)
  • deps: update dependency webpack to v5.109.2 (#6194) (badf733)
  • extract stripLeadingDashes helper + cover CLI arg-parsing edge cases (#6171) (867e175)
  • fix esm-utils tests when run without coverage (#6160) (c54539f)

... (truncated)

Changelog

Sourced from mocha's changelog.

12.0.0 (2026-08-31)

🩹 Fixes

  • fixup parsing negative numbers and quoted strings (#6250) (2962875)
  • preserve FIFO descriptors when respawning (#6254) (3bb317d)

📚 Documentation

🧹 Chores

12.0.0-rc.6 (2026-08-09)

🩹 Fixes

  • deps: update dependency starlight-blog to ^0.28.0 (#6153) (6b79044)
  • docs: restore homepage logo (#6183) (06e81a8)
  • docs: restore spacing around footer links (#6185) (163d751)
  • use main instead of exports for the package entry point (#6193) (c32a696)

📚 Documentation

  • blog: add community contributions post (#6172) (5fcc0fe)
  • blog: update community-contributions to 2026-community-sponsorships (5462d84)
  • fix blog/2026-community-sponsorships description (#6177) (98c4746)
  • sync CLI docs with v12 options and defaults (#6140) (579fd15)

🧹 Chores

  • deps: update dependency @​playwright/test to v1.62.1 (#6197) (dcc539a)
  • deps: update dependency eslint to v10.8.0 (#6196) (deeeec6)
  • deps: update dependency globals to v17.9.0 (#6201) (c2c6d63)
  • deps: update dependency knip to v6.31.0 (#6166) (b7cd1bd)
  • deps: update dependency sinon to v22.1.0 (#6188) (284f0c2)
  • deps: update dependency webpack to v5.109.2 (#6194) (badf733)
  • extract stripLeadingDashes helper + cover CLI arg-parsing edge cases (#6171) (867e175)
  • fix esm-utils tests when run without coverage (#6160) (c54539f)
  • keep stderr out of the JSON parsed by the FIFO test (#6187) (ea6489e)
  • limit token perms in protect-manifest workflow (#6175) (8cf0030)

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
chore(deps-dev): bump mocha from 11.8.0 to 12.0.0
56da0f4 
Bumps [mocha](https://github.com/mochajs/mocha) from 11.8.0 to 12.0.0.
- [Release notes](https://github.com/mochajs/mocha/releases)
- [Changelog](https://github.com/mochajs/mocha/blob/main/CHANGELOG.md)
- [Commits](mochajs/mocha@v11.8.0...v12.0.0)

---
updated-dependencies:
- dependency-name: mocha
  dependency-version: 12.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@github-actions

github-actions Bot commented Sep 14, 2026

Copy link
Copy Markdown
Contributor

🛡️ Security Hardening Pipeline Results

Branch: dependabot/npm_and_yarn/mocha-12.0.0
Commit: 3a5f9e6

Workflow Run: 428
Branch: dependabot/npm_and_yarn/mocha-12.0.0
Commit: 3a5f9e6

Scan Status

Scanner Status
bandit ⏭️ skipped
checkov ⏭️ skipped
clamav ⏭️ skipped
codeql ✅ PASS
container ⏭️ skipped
dependency-review ✅ PASS
gitleaks ✅ PASS
grype ⏭️ skipped
lint ⏭️ skipped
opengrep ⏭️ skipped
osv ✅ PASS
sbom ⏭️ skipped
supply-chain ⏭️ skipped
trivy-container ⏭️ skipped
trivy-iac ⏭️ skipped
zap ⏭️ skipped

✅ All enabled scanners completed successfully.

Summaries Collected: 4

Scanner Results

🔬 CodeQL SAST (Javascript)

Status: Completed

Findings Summary

Critical High Medium Low Total
0 0 0 0 0

No security findings detected for Javascript.

Artifacts: CodeQL Reports (Javascript)

🔗 Dependency Review

Status: ✅ No issues found

No vulnerable or license-violating dependencies detected in this PR.
📋 View full report

🔑 Gitleaks (Secrets)

No 🔑 Gitleaks (Secrets) findings summary was produced.

📦 OSV (Dependencies)

No 📦 OSV (Dependencies) findings summary was produced.

Generated by Argus

Generated by Argus

@eFAILution

eFAILution commented Sep 15, 2026

Copy link
Copy Markdown
Owner

Superseded. beta is already on mocha@^12.0.0, landed in #267. It was opened against main, which is 17 commits behind beta; it'll reach main through the release PR (#271), not directly.

Dependabot is being pointed at beta so this stops recurring.

@eFAILution eFAILution closed this Sep 15, 2026
@eFAILution
eFAILution deleted the dependabot/npm_and_yarn/mocha-12.0.0 branch September 15, 2026 01:15
@dependabot @github

dependabot Bot commented on behalf of github Sep 15, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@eFAILution eFAILution mentioned this pull request Sep 15, 2026
Merged
13 tasks
eFAILution added a commit that referenced this pull request Sep 15, 2026
@eFAILution
chore(ci): point Dependabot at beta (#296)
8dda61e 
* chore(ci): point Dependabot at beta

Dependabot had no target-branch, so every ecosystem opened against the
default branch. main is the stable release line: a push there cuts a
stable GitHub release via release-it, so a routine dependency bump would
ship one out of band.

main also trails beta by everything not yet released, so bumps opened
against it re-proposed versions beta already carried (#291, #292, #295
all duplicated bumps merged weeks earlier) and conflicted on the lockfile
when retargeted.

Updates now reach main the way everything else does, through the
beta -> main release PR.

* docs(ci): correct the stale Argus workflow pin comment

The comment claimed the SHA was Argus v1.11.0. It has been wrong since
1.12.0: the pin is now 1.12.4 (cc7ef8e), and v1.11.0 is 295eea9.

A hand-written version next to a SHA drifts every time Dependabot bumps
the SHA and nobody edits the line above it, so the comment now explains
why the pin is a SHA and points at the PR title for the version instead
of restating one.

---------

Co-authored-by: eFAILution <eFAILution@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@eFAILution eFAILution

Labels

dependencies npm

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@eFAILution