Skip to content

chore (deps): bump the patch-updates group across 1 directory with 6 updates - #2725

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/patch-updates-bc790404d7
Open

chore (deps): bump the patch-updates group across 1 directory with 6 updates#2725
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/patch-updates-bc790404d7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 14, 2026

Copy link
Copy Markdown
Contributor

Bumps the patch-updates group with 6 updates in the / directory:

Package From To
bson 7.3.1 7.3.2
highlight.js 11.11.1 11.11.2
kbpgp 2.1.17 2.1.18
protobufjs 8.7.1 8.7.2
@codemirror/view 6.43.7 6.43.8
postcss 8.5.25 8.5.26

Updates bson from 7.3.1 to 7.3.2

Release notes

Sourced from bson's releases.

v7.3.2

7.3.2 (2026-07-31)

The MongoDB Node.js team is pleased to announce version 7.3.2 of the bson package!

Release Notes

calculateObjectSize() now returns accurate byte counts for Int32 and BSONSymbol

Previously, each Int32 or BSONSymbol value caused a 12-byte overcount.

calculateObjectSize() now yields proper size calculations on ES Map's

This release of js-bson fixes an issue where we were incorrectly considering ES Map objects inside calculateObjectSize. This issue did not impact serialization, just size calculation.

Fixed incorrect date boundary in relaxed EJSON

This release of js-bson fixes an issue where the date boundary for relaxed EJSON was incorrectly set to a date 5 hours after the maximum limit of 10,000 AD.

Fixed an issue with ObjectId initialization in Cloudflare Workers

This release of js-bson fixes an issue where we were making crypto calls during module initialization, which is forbidden by Cloudflare Workers and other environments.

Memory optimization via smaller ObjectIds

ObjectId now stores its 12 bytes as four inline integers instead of a Uint8Array, cutting per-ObjectId memory by about 63% (and roughly 45 to 47% across large result sets) with no serialization slowdown. Deep equality and cloning are preserved (assert.deepStrictEqual, and lodash isEqual / cloneDeep).

Thanks to @​spokodev for contributing their fixes! (NODE-7631 (#901), NODE-7645 (#917), NODE-7646 (#910))

Bug Fixes

  • NODE-7631: count Int32 and BSONSymbol in calculateObjectSize (#901) (7f948a6)
  • NODE-7645: use the first instant of year 10000 as the relaxed EJSON date bound (#917) (9272c9a)
  • NODE-7646: count ES Map entries in calculateObjectSize (#910) (8d28b12)
  • NODE-7667: remove early initialization from ObjectId (#916) (665286f)

Performance Improvements

  • NODE-6246: store ObjectId bytes as four packed integers (#893) (a84229c)

Documentation

We invite you to try the bson library immediately, and report any issues to the NODE project.

Changelog

Sourced from bson's changelog.

7.3.2 (2026-07-31)

Bug Fixes

  • NODE-7631: count Int32 and BSONSymbol in calculateObjectSize (#901) (7f948a6)
  • NODE-7645: use the first instant of year 10000 as the relaxed EJSON date bound (#917) (9272c9a)
  • NODE-7646: count ES Map entries in calculateObjectSize (#910) (8d28b12)
  • NODE-7667: remove early initialization from ObjectId (#916) (665286f)

Performance Improvements

  • NODE-6246: store ObjectId bytes as four packed integers (#893) (a84229c)
Commits
  • 9cd2e68 chore(main): release 7.3.2 (#902)
  • 9272c9a fix(NODE-7645): use the first instant of year 10000 as the relaxed EJSON date...
  • 8d28b12 fix(NODE-7646): count ES Map entries in calculateObjectSize (#910)
  • 665286f fix(NODE-7667): remove early initialization from ObjectId (#916)
  • 1fc57e4 chore(NODE-7681): allow git fetch for npm12 (#914)
  • 57b5bf0 chore: use bundled version of NPM (#913)
  • a84229c perf(NODE-6246): store ObjectId bytes as four packed integers (#893)
  • 7f948a6 fix(NODE-7631): count Int32 and BSONSymbol in calculateObjectSize (#901)
  • See full diff in compare view

Updates highlight.js from 11.11.1 to 11.11.2

Release notes

Sourced from highlight.js's releases.

v11.11.2 - This Summer's Hottest Release

Happy belated Summer Solstice to all who celebrate. This is a maintenance release that includes all of the merged PRs through July 2025 (last year).

[!NOTE]

As you may have noticed, highlight.js has been inactive since last summer, through no one's fault; maintaining open source projects is time-consuming. I'll be doing my best to keep the lights on around here, but I'll need the community's help. If you are interested in helping review pull requests, contributing, or even becoming a maintainer, speak up in highlightjs/highlight.js#1678.

[!IMPORTANT]

The 11.11.2 Git tag was published on June 22, 2026, and the npm package was published on August 11, 2026. For any cautious onlookers, nothing malicious has happened. In December 2025, npm revoked all classic tokens for improved security. Since we haven't had a release since July 2025, I didn't notice that our release pipeline was broken because it uses a now-revoked token. Pull request #4427 was opened to fix our release pipeline, and it took some time to get things right. Version 11.11.2 was published to npm after the PR was merged and we had a successful run of the new release workflow.

If you see two 11.11.2 releases on your GitHub feed circa June 2026, this was an accident by a maintainer. A 11.11.2 tag was created prematurely on GitHub and caused a run failure during the release pipeline since all work to bump the release had not been completed. There was no version 11.11.2 that was accidentally published to npm or the CDNs; therefore, the Git tag has been recreated to point to f273f007f85e2096de41c42bf40b870dcb5a5a05.

Parser Engine:

  • fix illegal handling at end of input code [Josh Goebel][]

New Grammars:

  • added 3rd party Aiken grammar to SUPPORTED_LANGUAGES [Josh Marchand][]
  • added 3rd party VoltScript grammar to SUPPORTED_LANGUAGES [Chester Moses][]
  • added 3rd party Gleam grammar to SUPPORTED_LANGUAGES [Filip Hoffmann][]
  • added 3rd party Magik grammar to SUPPORTED_LANGUAGES [Sebastiaan Speck][]
  • added 3rd party Prisma grammar to SUPPORTED_LANGUAGES [SungHyun Kim][]
  • added 3rd party Bicep grammar to SUPPORTED_LANGUAGES [Anthony Martin][]
  • added 3rd party L4 grammar to SUPPORTED_LANGUAGES [Thomas Gorissen][]
  • added 3rd party Abc Notation grammar to SUPPORTED_LANGUAGES [NriotHrreion][]

Core Grammars:

  • fix(cpp) exclude keywords from function calls [Eisenwave][]
  • enh(csp) add missing directives / keywords from MDN (7 more) [Max Liashuk][]
  • enh(ada) add new parallel keyword, allow [] for Ada 2022 [Max Reznik][]
  • fix(javascript) correctly highlight 'for await' again [wolfgang42][]
  • fix(diff) fix unified diff hunk header regex to allow unpaired numbers [Chris Wilson][]
  • enh(php) support single line and hash comments in attributes, constructor and functions [Antoine Musso][]
  • fix(ex) adds support for ?' char literal and missing defguardp keyword [Kevin Bloch][]
  • enh(json) add json5 support [Kerry Shetline][]
  • fix(csharp) Support digit separators [te-ing][]
  • fix(css) unicode-range parsing, issue #4253 [Kerry Shetline][]

Documentation:

  • update link to Odin grammar to maintained version [Marian Pekár][]
  • fix type highlight deprecated message [Brandon Dong][]
  • fixed typo and incorrect git command [SungHyun Kim][]
  • fix CONTRIBUTING.md broken badge link [SungHyun Kim][]
  • alphabetized languages + upper-cased BASIC in SUPPORTED_LANGUAGES.md [Adam Lui][]

... (truncated)

Changelog

Sourced from highlight.js's changelog.

Version 11.11.2

Parser Engine:

  • fix illegal handling at end of input code Josh Goebel

New Grammars:

  • added 3rd party Aiken grammar to SUPPORTED_LANGUAGES [Josh Marchand][]
  • added 3rd party VoltScript grammar to SUPPORTED_LANGUAGES [Chester Moses][]
  • added 3rd party Gleam grammar to SUPPORTED_LANGUAGES [Filip Hoffmann][]
  • added 3rd party Magik grammar to SUPPORTED_LANGUAGES [Sebastiaan Speck][]
  • added 3rd party Prisma grammar to SUPPORTED_LANGUAGES [SungHyun Kim][]
  • added 3rd party Bicep grammar to SUPPORTED_LANGUAGES [Anthony Martin][]
  • added 3rd party L4 grammar to SUPPORTED_LANGUAGES [Thomas Gorissen][]
  • added 3rd party Abc Notation grammar to SUPPORTED_LANGUAGES [NriotHrreion][]

Core Grammars:

  • fix(cpp) exclude keywords from function calls Eisenwave
  • enh(csp) add missing directives / keywords from MDN (7 more) [Max Liashuk][]
  • enh(ada) add new parallel keyword, allow [] for Ada 2022 [Max Reznik][]
  • fix(javascript) correctly highlight 'for await' again [wolfgang42][]
  • fix(diff) fix unified diff hunk header regex to allow unpaired numbers [Chris Wilson][]
  • enh(php) support single line and hash comments in attributes, constructor and functions [Antoine Musso][]
  • fix(ex) adds support for ?' char literal and missing defguardp keyword [Kevin Bloch][]
  • enh(json) add json5 support [Kerry Shetline][]
  • fix(csharp) Support digit separators [te-ing][]
  • fix(css) unicode-range parsing, issue #4253 [Kerry Shetline][]

Documentation:

  • update link to Odin grammar to maintained version Marian Pekár
  • fix type highlight deprecated message Brandon Dong
  • fixed typo and incorrect git command [SungHyun Kim][]
  • fix CONTRIBUTING.md broken badge link [SungHyun Kim][]
  • alphabetized languages + upper-cased BASIC in SUPPORTED_LANGUAGES.md [Adam Lui][]
  • deduplicate JSON from SUPPORTED_LANGUAGES [Lukasz Czajczyk][]

Themes:

  • Fix: cybertopia themes render correctly in shadow DOM [hbgl][]
  • added "vs Dark " theme [Twineee1][]

CONTRIBUTORS

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for highlight.js since your current version.


Updates kbpgp from 2.1.17 to 2.1.18

Changelog

Sourced from kbpgp's changelog.

2.1.18 (2026-08-06)

  • Fix error path in bzip2 causing uncaught exceptions during Compressed packet processing.
Commits

Updates protobufjs from 8.7.1 to 8.7.2

Release notes

Sourced from protobufjs's releases.

protobufjs: v8.7.2

8.7.2 (2026-08-08)

Bug Fixes

  • Also use TextDecoder for loose UTF-8 decoding (#2408) (5851a3b)
  • Parse numeric defaults according to field type (#2402) (bb2d836)
  • Parse numeric descriptor defaults by field type (#2406) (09f24ec)
  • preserve first enum alias from JSON descriptors (#2389) (8304739)
  • Preserve negative zero in codegen formatters (#2403) (92ddc9b)
  • Preserve non-finite defaults in toObject (#2393) (a38b925)

Performance Improvements

  • Optimize writer allocs and packed varint reads (#2405) (64cc8f1)
Changelog

Sourced from protobufjs's changelog.

8.7.2 (2026-08-08)

Bug Fixes

  • Also use TextDecoder for loose UTF-8 decoding (#2408) (5851a3b)
  • Parse numeric defaults according to field type (#2402) (bb2d836)
  • Parse numeric descriptor defaults by field type (#2406) (09f24ec)
  • preserve first enum alias from JSON descriptors (#2389) (8304739)
  • Preserve negative zero in codegen formatters (#2403) (92ddc9b)
  • Preserve non-finite defaults in toObject (#2393) (a38b925)

Performance Improvements

  • Optimize writer allocs and packed varint reads (#2405) (64cc8f1)
Commits
  • 91cdef0 chore: release master (#2391)
  • c362fe3 chore(deps-dev): Bump shell-quote from 1.8.4 to 1.10.0 (#2399)
  • 7999776 chore(deps-dev): Bump browserify-sign from 4.2.1 to 4.2.6 (#2398)
  • 549aa7a chore(deps): Bump linkify-it from 5.0.1 to 5.0.2 in /cli (#2397)
  • 5851a3b fix: Also use TextDecoder for loose UTF-8 decoding (#2408)
  • aca5b83 docs: Clarify README
  • adce445 chore(deps): update dev dependencies (#2395)
  • a38b925 fix: Preserve non-finite defaults in toObject (#2393)
  • 09f24ec fix: Parse numeric descriptor defaults by field type (#2406)
  • 64cc8f1 perf: Optimize writer allocs and packed varint reads (#2405)
  • Additional commits viewable in compare view

Updates @codemirror/view from 6.43.7 to 6.43.8

Commits

Updates postcss from 8.5.25 to 8.5.26

Release notes

Sourced from postcss's releases.

8.5.26

  • Fixed list.split() regression (by @​lazerg).
  • Track symlinks in path protection in source map loading (by @​drengir1).
Changelog

Sourced from postcss's changelog.

8.5.26

  • Fixed list.split() regression (by @​lazerg).
  • Track symlinks in path protection in source map loading (by @​drengir1).
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore (deps): bump the patch-updates group across 1 directory with 6 …
dbb2823 
…updates

Bumps the patch-updates group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [bson](https://github.com/mongodb/js-bson) | `7.3.1` | `7.3.2` |
| [highlight.js](https://github.com/highlightjs/highlight.js) | `11.11.1` | `11.11.2` |
| [kbpgp](https://github.com/keybase/kbpgp) | `2.1.17` | `2.1.18` |
| [protobufjs](https://github.com/protobufjs/protobuf.js) | `8.7.1` | `8.7.2` |
| [@codemirror/view](https://github.com/codemirror/view) | `6.43.7` | `6.43.8` |
| [postcss](https://github.com/postcss/postcss) | `8.5.25` | `8.5.26` |



Updates `bson` from 7.3.1 to 7.3.2
- [Release notes](https://github.com/mongodb/js-bson/releases)
- [Changelog](https://github.com/mongodb/js-bson/blob/main/HISTORY.md)
- [Commits](mongodb/js-bson@v7.3.1...v7.3.2)

Updates `highlight.js` from 11.11.1 to 11.11.2
- [Release notes](https://github.com/highlightjs/highlight.js/releases)
- [Changelog](https://github.com/highlightjs/highlight.js/blob/main/CHANGES.md)
- [Commits](highlightjs/highlight.js@11.11.1...11.11.2)

Updates `kbpgp` from 2.1.17 to 2.1.18
- [Changelog](https://github.com/keybase/kbpgp/blob/master/CHANGELOG.md)
- [Commits](keybase/kbpgp@v2.1.17...v2.1.18)

Updates `protobufjs` from 8.7.1 to 8.7.2
- [Release notes](https://github.com/protobufjs/protobuf.js/releases)
- [Changelog](https://github.com/protobufjs/protobuf.js/blob/master/CHANGELOG.md)
- [Commits](protobufjs/protobuf.js@protobufjs-v8.7.1...protobufjs-v8.7.2)

Updates `@codemirror/view` from 6.43.7 to 6.43.8
- [Changelog](https://github.com/codemirror/view/blob/main/CHANGELOG.md)
- [Commits](https://github.com/codemirror/view/commits)

Updates `postcss` from 8.5.25 to 8.5.26
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.25...8.5.26)

---
updated-dependencies:
- dependency-name: bson
  dependency-version: 7.3.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: highlight.js
  dependency-version: 11.11.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: kbpgp
  dependency-version: 2.1.18
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: protobufjs
  dependency-version: 8.7.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: "@codemirror/view"
  dependency-version: 6.43.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: postcss
  dependency-version: 8.5.26
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: patch-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants