build(deps): bump the major group across 1 directory with 7 updates by dependabot[bot] · Pull Request #5466 · kestra-io/docs

dependabot · 2026-09-02T06:04:08Z

Bumps the major group with 6 updates in the / directory:

Package	From	To
@cloudflare/workers-types	`4.20260621.1`	`5.20260830.1`
@usal/vue	`1.3.1`	`2.0.0`
eventsource-parser	`3.1.0`	`4.1.0`
expressive-code-collapsible	`0.1.0`	`1.0.0`
marked	`14.1.4`	`18.0.11`
typescript	`6.0.3`	`7.0.2`

Updates @cloudflare/workers-types from 4.20260621.1 to 5.20260830.1

Commits

See full diff in compare view

Updates @usal/vue from 1.3.1 to 2.0.0

Release notes

Sourced from @usal/vue's releases.

v2.0.0

⚠️ Breaking Changes

ESM-only: USAL is now an ES module package. Removed CommonJS (require), UMD/IIFE and <script> (non-module) builds.

Node.js require('usal') no longer works — use import.

CDN must be loaded with <script type="module">. The new CDN endpoint is https://cdn.usal.dev/v2/latest (served via esm.sh); the legacy https://cdn.usal.dev/latest keeps pointing at v1.3.1 for backward compatibility.

package.json exports is now import + types only (main/module/browser/require fields removed). The minified CDN bundle (usal.min.js) is now ESM.

Build target raised to es2022 (drops legacy browser support; requires native ESM support).

Added

Callable ESM default export: import usal from 'usal'; usal({...}) now works as a shorthand for usal.config({...}), fixing direct ESM imports in Vite and modern bundlers. (#7)

The default export is now a callable function that also exposes .config(), .destroy(), .restart(), .initialized() and .version.

globalThis.USAL: the instance is now exposed on globalThis (works in browsers, Node and workers) in addition to window.USAL, so globalThis.USAL.config(...) is available after import 'usal' or <script type="module">.

SSR-safe callable stub: import usal from 'usal'; usal({...}) is a safe no-op on the server (no window), preventing crashes in Next.js/Nuxt SSR.

Baseline badge: documentation now ships a self-hosted Baseline icon (docs/assets/baseline-widely-icon-dark.svg) instead of an external hotlink.

Playground improvements: new Replay button (and Ctrl/Cmd+Enter shortcut) to re-trigger animations, toast feedback, and a more robust update queue.

Fixed

Playground editor feedback loop: fixed the cursor jump / double-setValue bug where programmatic updates re-triggered the editor listener. The guard is now synchronous and the editor no longer fights user input.

Playground count-[...] / line-[...] parsing: values containing spaces (e.g. count-[21 000 000.00], timelines with |) were split across tokens and never parsed. Added a bracket-aware tokenizer that keeps spans intact.

Playground split syntax: the generated data-usal now uses the canonical form (split-item zoomin) instead of the non-canonical split-item split-zoomin, matching the library parser and presets.

Playground multi-element editing: data-usal and style are now read/written on the first element that carries data-usal, instead of migrating to the first tag in the HTML. Style merging no longer reads an unrelated tag's style.

Share/copy fallback: clipboard actions now fall back to a hidden <textarea> + execCommand('copy') when the async Clipboard API is unavailable, and always reflect the URL in the address bar.

Changed

Documentation: README, docs/index.html, docs/API.md and docs/llms.txt now document the ESM import (import usal from 'usal') and the new v2/latest CDN path.

CDN debug tool (dev/debug.js): all USAL builds (local source and CDN) are loaded as modules via dynamic import(); the legacy jsDelivr fallback handles IIFE v1 builds that only set window.USAL as a side effect.

Commits

See full diff in compare view

Updates eventsource-parser from 3.1.0 to 4.1.0

Release notes

Sourced from eventsource-parser's releases.

v4.1.0

Minor Changes

#39 0482048 Thanks @rexxars! - Added an onId callback that reports ID fields when an event block ends, including blocks without data.

v4.0.0

Major Changes

#33 39cf365 Thanks @rexxars! - Require Node.js 22.12 or higher, drop the CommonJS build, and discard invalid lines instead of buffering them

Breaking changes

Node.js 18 and 20 are no longer supported. engines now requires >=22.12, and the browserslist target moved from node >= 18 to node >= 22.12. Older versions may keep working, but they are no longer tested or guaranteed.

The CommonJS build has been removed. The main field and the require export conditions are gone, so the package resolves to ./dist/index.js and ./dist/stream.js only. Node 22.12 and above supports require(esm) transparently, so require('eventsource-parser') continues to work there.

The root stream.js file has been removed. It re-exported ./dist/stream.cjs for React Native and other bundlers without package exports support. Import eventsource-parser/stream instead, and make sure your bundler resolves the exports field.

Invalid lines are now discarded as soon as the parser can tell they cannot become a valid SSE field, rather than being buffered until the line terminator arrives. onError is not called for these, and no line, field, or value is retained. Only lines that are complete when found to be invalid still produce a ParseError with type: 'unknown-field'. This also means reset({consume: true}) no longer reports pending data that was already discarded.

Partial comment lines (starting with :) are only buffered when an onComment callback is configured. Without one, they are discarded like any other line the parser has no use for.

Other changes

A leading byte order mark is now stripped whether it arrives as a decoded U+FEFF (for example from a TextDecoder created with ignoreBOM) or as the raw three byte 0xEF 0xBB 0xBF sequence. Previously only the raw form was handled.

The README documented an invalid-field error type that the parser never emitted. The ErrorType union is unchanged; the documentation now correctly refers to unknown-field.

v3.1.1

3.1.1 (2026-08-10)

Bug Fixes

id: line containing a NULL character wiping the buffered event id (#34) (48d24f8)

Changelog

Sourced from eventsource-parser's changelog.

4.1.0

Minor Changes

#39 0482048 Thanks @rexxars! - Added an onId callback that reports ID fields when an event block ends, including blocks without data.

4.0.0

Major Changes

#33 39cf365 Thanks @rexxars! - Require Node.js 22.12 or higher, drop the CommonJS build, and discard invalid lines instead of buffering them

Breaking changes

Node.js 18 and 20 are no longer supported. engines now requires >=22.12, and the browserslist target moved from node >= 18 to node >= 22.12. Older versions may keep working, but they are no longer tested or guaranteed.

The CommonJS build has been removed. The main field and the require export conditions are gone, so the package resolves to ./dist/index.js and ./dist/stream.js only. Node 22.12 and above supports require(esm) transparently, so require('eventsource-parser') continues to work there.

The root stream.js file has been removed. It re-exported ./dist/stream.cjs for React Native and other bundlers without package exports support. Import eventsource-parser/stream instead, and make sure your bundler resolves the exports field.

Invalid lines are now discarded as soon as the parser can tell they cannot become a valid SSE field, rather than being buffered until the line terminator arrives. onError is not called for these, and no line, field, or value is retained. Only lines that are complete when found to be invalid still produce a ParseError with type: 'unknown-field'. This also means reset({consume: true}) no longer reports pending data that was already discarded.

Partial comment lines (starting with :) are only buffered when an onComment callback is configured. Without one, they are discarded like any other line the parser has no use for.

Other changes

A leading byte order mark is now stripped whether it arrives as a decoded U+FEFF (for example from a TextDecoder created with ignoreBOM) or as the raw three byte 0xEF 0xBB 0xBF sequence. Previously only the raw form was handled.

The README documented an invalid-field error type that the parser never emitted. The ErrorType union is unchanged; the documentation now correctly refers to unknown-field.

3.1.1 (2026-08-10)

Bug Fixes

id: line containing a NULL character wiping the buffered event id (#34) (48d24f8)

Commits

6519a0f chore: version packages (#40)
f54bf65 docs: clarify eventsource being cross-runtime, not node.js exclusive
0482048 feat: add an onId callback (#39)
202c19e chore: version packages (#36)
fde4ca2 ci: use a conventional commit subject for the version pull request (#38)
f32fda2 ci: generate changesets from conventional commit PR titles (#37)
c8cd582 chore: add changeset for #33
39cf365 feat!: require node 22.12 or higher, drop commonjs, reduce memory usage (#33)
0e767c4 docs: prepare CHANGELOG.md for changesets
f56f2d2 ci: replace semantic-release with changesets (#35)
Additional commits viewable in compare view

Updates expressive-code-collapsible from 0.1.0 to 1.0.0

Release notes

Sourced from expressive-code-collapsible's releases.

expressive-code-collapsible@1.0.0

Major Changes

17a5359: Drop Node 18 support and upgrade to Expressive Code 0.44, Astro v7, and Starlight 0.41

Changelog

Sourced from expressive-code-collapsible's changelog.

1.0.0

Major Changes

17a5359: Drop Node 18 support and upgrade to Expressive Code 0.44, Astro v7, and Starlight 0.41

Commits

9bf8305 [ci] release
17a5359 Drop Node 18 support and upgrade to Expressive Code 0.44, Astro v7, and Starl...
See full diff in compare view

Updates marked from 14.1.4 to 18.0.11

Release notes

Sourced from marked's releases.

v18.0.11

18.0.11 (2026-08-24)

Bug Fixes

do not nest a link inside a link (#4051) (e250e31)

inlineTokens rebuilds the reflink-mask preamble per call (#4040) (0653c24)

keep emphasis in the text of a rejected reference link (#4059) (b699db3)

v18.0.10

18.0.10 (2026-08-18)

Bug Fixes

keep the em/strong mask the same length as the source (#4044) (681373c)

parse EOF backtick fences after paragraphs (#4039) (81bd750)

place task checkboxes after list loose is finalized (#4046) (b8cf7dc), closes #4045

v18.0.9

18.0.9 (2026-08-04)

Bug Fixes

an unmatched strong run before emphasis stays literal (#4008) (e8544e6)

Fix spurious deeper nesting in a blockquote continuation (#4030) (452f1ed)

pedantic foo: and "word" emphasis parsing (#3999) (823093f)

v18.0.8

18.0.8 (2026-08-04)

Bug Fixes

fall back to default checkbox renderer when extension returns false (#4023) (e1b6139)

v18.0.7

18.0.7 (2026-07-21)

Bug Fixes

Avoid O(n^2) backtracking in HTML block close and tilde interrupt regexes (#4014) (f945fc5), closes #3991

Avoid O(n^2) masked source rebuild in inline tokenizer (#4017) (9154f8f)

keep empty list after blockquote as a sibling block (#4004) (3f144a0)

preserve code spans adjacent to tildes (#4012) (0de7188)

Recognize setext headings whose first line starts with # (#4015) (f056437), closes #1

treat a line of only tabs as a blank line between paragraphs (#4007) (bc2f121)

... (truncated)

Commits

53cb13f chore(release): 18.0.11 [skip ci]
0c6b2a6 docs: add adaptable bullet point (#4058)
c430a64 chore(deps-dev): bump eslint from 10.8.1 to 10.9.0 (#4069)
b699db3 fix: keep emphasis in the text of a rejected reference link (#4059)
0653c24 fix: inlineTokens rebuilds the reflink-mask preamble per call (#4040)
e250e31 fix: do not nest a link inside a link (#4051)
8698d35 chore(release): 18.0.10 [skip ci]
58367a5 chore(deps-dev): bump eslint from 10.8.0 to 10.8.1 (#4055)
a426c4d chore(deps-dev): bump esbuild from 0.28.1 to 0.28.2 (#4056)
a5cf277 chore(deps-dev): bump highlight.js from 11.11.1 to 11.12.0 (#4057)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for marked since your current version.

Updates typescript from 6.0.3 to 7.0.2

Release notes

Sourced from typescript's releases.

TypeScript 7.0.2

https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/

This tag was originally released at: https://github.com/microsoft/typescript-go/releases/tag/typescript%2Fv7.0.2

Commits

1e4744d Merge branch 'main' into ts7-release
a5a219cmicrosoft/typescript-go#4558
ecfe30d Update status localization
5de25b5 Hide executable name in TypeScript status
d7ce74a Show bundled TypeScript version for packaged servers
29be66a Correct TS 7 release version to 7.0.2
ed2bd1b Merge branch 'main' into ts7-release
8873075 Bump the github-actions group across 1 directory with 3 updates (microsoft/ty...
9427131 Set up stable / nightly extension split, other prep (microsoft/typescript-go#...
d4eaca5microsoft/typescript-go#4549
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

Updates wrangler from 4.103.0 to 4.127.1

Release notes

Sourced from wrangler's releases.

wrangler@4.127.1

Patch Changes

#15383 eb01850 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

@cloudflare/workers-types ^5.20260826.1 ^5.20260827.1

workerd 1.20260826.1 1.20260827.1

#15393 e1df91a Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

@cloudflare/workers-types ^5.20260827.1 ^5.20260828.1

workerd 1.20260827.1 1.20260828.1

Updated dependencies [eb01850, e1df91a, b23de74, 015550a, 015550a, 015550a, 3650d29, b23de74]:

miniflare@5.20260828.0-alpha

wrangler@4.127.0

Minor Changes
#15356 fe265f8 Thanks @rubuy-74! - Add support for configuring a per-workflow max concurrency limit via workflows[].concurrency.limit in your Wrangler config.

The limit is the maximum number of Workflow instances that can run concurrently. It is validated as a positive integer and persisted on deploy; the ceiling is enforced server-side. Concurrency is ignored in local development.
{
  "workflows": [
    {
      "binding": "MY_WORKFLOW",
      "name": "my-workflow",
      "class_name": "MyWorkflow",
      "concurrency": { "limit": 10 }
    }
  ]
}
Patch Changes

#15367 412c79e Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

... (truncated)

Commits

f808554 Version Packages (#15385)
b903a09 Pin @netlify/build-info to 10.5.1 and update pnpm patch (#14808)
3650d29 Rename Worker target fields from workerName to worker (#15373)
a831498 Version Packages (#15372)
fe265f8 [wrangler] Add per-workflow concurrency limit config (#15356)
92874f6 WC-5857 [wrangler] Upload preview deployments as multipart form data (#15375)
e9df120 Support multiple named Workers in the build output (#15371)
5377aae Version Packages (#15354)
e56d2e6 Revert "Version Packages" (#15355)
d765e10 Version Packages (#15291)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the major group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@cloudflare/workers-types](https://github.com/cloudflare/workerd) | `4.20260621.1` | `5.20260830.1` | | [@usal/vue](https://github.com/usaljs/usal/tree/HEAD/packages/vue) | `1.3.1` | `2.0.0` | | [eventsource-parser](https://github.com/rexxars/eventsource-parser) | `3.1.0` | `4.1.0` | | [expressive-code-collapsible](https://github.com/frostybee/expressive-code-collapsible/tree/HEAD/packages/expressive-code-collapsible) | `0.1.0` | `1.0.0` | | [marked](https://github.com/markedjs/marked) | `14.1.4` | `18.0.11` | | [typescript](https://github.com/microsoft/TypeScript) | `6.0.3` | `7.0.2` | Updates `@cloudflare/workers-types` from 4.20260621.1 to 5.20260830.1 - [Release notes](https://github.com/cloudflare/workerd/releases) - [Changelog](https://github.com/cloudflare/workerd/blob/main/RELEASE.md) - [Commits](https://github.com/cloudflare/workerd/commits) Updates `@usal/vue` from 1.3.1 to 2.0.0 - [Release notes](https://github.com/usaljs/usal/releases) - [Commits](https://github.com/usaljs/usal/commits/v2.0.0/packages/vue) Updates `eventsource-parser` from 3.1.0 to 4.1.0 - [Release notes](https://github.com/rexxars/eventsource-parser/releases) - [Changelog](https://github.com/rexxars/eventsource-parser/blob/main/CHANGELOG.md) - [Commits](rexxars/eventsource-parser@v3.1.0...v4.1.0) Updates `expressive-code-collapsible` from 0.1.0 to 1.0.0 - [Release notes](https://github.com/frostybee/expressive-code-collapsible/releases) - [Changelog](https://github.com/frostybee/expressive-code-collapsible/blob/main/packages/expressive-code-collapsible/CHANGELOG.md) - [Commits](https://github.com/frostybee/expressive-code-collapsible/commits/expressive-code-collapsible@1.0.0/packages/expressive-code-collapsible) Updates `marked` from 14.1.4 to 18.0.11 - [Release notes](https://github.com/markedjs/marked/releases) - [Commits](markedjs/marked@v14.1.4...v18.0.11) Updates `typescript` from 6.0.3 to 7.0.2 - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](microsoft/TypeScript@v6.0.3...v7.0.2) Updates `wrangler` from 4.103.0 to 4.127.1 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.127.1/packages/wrangler) --- updated-dependencies: - dependency-name: "@cloudflare/workers-types" dependency-version: 5.20260830.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: major - dependency-name: "@usal/vue" dependency-version: 2.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: major - dependency-name: eventsource-parser dependency-version: 4.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: major - dependency-name: expressive-code-collapsible dependency-version: 1.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: major - dependency-name: marked dependency-version: 18.0.11 dependency-type: direct:production update-type: version-update:semver-major dependency-group: major - dependency-name: typescript dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: major - dependency-name: wrangler dependency-version: 4.127.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: major ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added area/frontend Needs frontend code changes dependency-upgrade Dependency upgrade is needed labels Sep 2, 2026

dependabot Bot had a problem deploying to Preview September 2, 2026 06:04 Failure

kestrabot Bot added this to Pull Requests Sep 2, 2026

github-project-automation Bot moved this to To review in Pull Requests Sep 2, 2026

Navigation Menu

Uh oh!

build(deps): bump the major group across 1 directory with 7 updates - #5466

build(deps): bump the major group across 1 directory with 7 updates#5466
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/major-c226ea479a

dependabot Bot commented on behalf of github Sep 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Dependency	From	To
`@cloudflare/workers-types`	^5.20260826.1	^5.20260827.1
workerd	1.20260826.1	1.20260827.1

Dependency	From	To
`@cloudflare/workers-types`	^5.20260827.1	^5.20260828.1
workerd	1.20260827.1	1.20260828.1

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 2, 2026

v2.0.0

⚠️ Breaking Changes

Added

Fixed

Changed

v4.1.0

Minor Changes

v4.0.0

Major Changes

v3.1.1

3.1.1 (2026-08-10)

Bug Fixes

4.1.0

Minor Changes

4.0.0

Major Changes

3.1.1 (2026-08-10)

Bug Fixes

expressive-code-collapsible@1.0.0

Major Changes

1.0.0

Major Changes

v18.0.11

18.0.11 (2026-08-24)

Bug Fixes

v18.0.10

18.0.10 (2026-08-18)

Bug Fixes

v18.0.9

18.0.9 (2026-08-04)

Bug Fixes

v18.0.8

18.0.8 (2026-08-04)

Bug Fixes

v18.0.7

18.0.7 (2026-07-21)

Bug Fixes

TypeScript 7.0.2

wrangler@4.127.1

Patch Changes

wrangler@4.127.0

Minor Changes

Patch Changes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants