Skip to content

build(deps): bump the npm-dependencies group across 1 directory with 13 updates#388

Closed
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm-dependencies-0d335e59ed
Closed

build(deps): bump the npm-dependencies group across 1 directory with 13 updates#388
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm-dependencies-0d335e59ed

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Feb 25, 2026 •
edited
Loading

Bumps the npm-dependencies group with 13 updates in the / directory:

Package From To
@cyclonedx/cyclonedx-library 6.13.1 9.4.1
fast-xml-parser 5.3.4 5.3.9
packageurl-js 1.0.2 2.0.1
yargs 17.7.2 18.0.0
@types/node 20.19.31 25.3.0
c8 10.1.3 11.0.0
chai 4.5.0 6.2.2
eslint 8.57.1 10.0.2
mocha 10.8.2 11.7.5
msw 2.12.7 2.12.10
sinon 15.2.0 21.0.1
sinon-chai 3.7.0 4.0.1
which 5.0.0 6.0.1

Updates @cyclonedx/cyclonedx-library from 6.13.1 to 9.4.1

Release notes

Sourced from @​cyclonedx/cyclonedx-library's releases.

9.4.1

Fixed

  • Type declarations for deprecated symbols support usage as types (#1350 via #1351)

Refactor

  • Deprecated symbols turned from re-exports into re-declares (via #1351)
    Note: this change adds runtime overhead for the sake of documentation.

#1350: CycloneDX/cyclonedx-javascript-library#1350 #1351: CycloneDX/cyclonedx-javascript-library#1351

What's Changed

Full Changelog: CycloneDX/cyclonedx-javascript-library@v9.4.0...v9.4.1

9.4.0

Added

  • New entry points for /Contrib and known submodules (via #1343)
    See package.json::exports for details.

Changes

  • Moved non‑standard implementations to Contrib area (#1344 via #1343)

Deprecated

  • Certain exports have been deprecated; downstream imports should be updated to the new locations (#1344 via #1343)
    Note: the symbols themselves remain supported. See documentation and the "Refactored" section below for details.

Refactor

  • The following symbols were moved. (#1344 via #1343)
    The symbols are still import-able through their old location.
    • OLD -> NEW
    • Builders.FromNodePackageJson -> Contrib.FromNodePackageJson.Builders
    • Factories.FromNodePackageJson -> Contrib.FromNodePackageJson.Factories
    • Factories.LicenseFactory -> Contrib.License.Factories.LicenseFactory
    • Factories.PackageUrlFactory -> Contrib.PackageUrl.Factories.PackageUrlFactory
    • Types.assertNodePackageJson -> Contrib.FromNodePackageJson.Types.assertNodePackageJson
    • Types.isNodePackageJson -> Contrib.FromNodePackageJson.Types.isNodePackageJson
    • Types.NodePackageJson -> Contrib.FromNodePackageJson.Types.NodePackageJson
    • Utils.BomUtility -> Contrib.Bom.Utils
    • Utils.LicenseUtility -> Contrib.License.Utils
    • Utils.NpmjsUtility -> Contrib.FromNodePackageJson.Utils

Style

  • Applied latest code style (via #1341)

Build

  • Use webpack v5.103.0 now, was v5.102.1 (via #1340)

#1340: CycloneDX/cyclonedx-javascript-library#1340 #1341: CycloneDX/cyclonedx-javascript-library#1341 #1343: CycloneDX/cyclonedx-javascript-library#1343

... (truncated)

Changelog

Sourced from @​cyclonedx/cyclonedx-library's changelog.

9.4.1 -- 2025-12-04

  • Fixed
    • Type declarations for deprecated symbols support usage as types (#1350 via #1351)
  • Refactor
    • Deprecated symbols turned from re-exports into re-declares (via #1351)
      Note: this change adds runtime overhead for the sake of documentation.

#1350: CycloneDX/cyclonedx-javascript-library#1350 #1351: CycloneDX/cyclonedx-javascript-library#1351

9.4.0 -- 2025-12-02

  • Added
    • New entry points for /Contrib and known submodules (via #1343)
      See package.json::exports for details.
  • Changes
    • Moved non‑standard implementations to Contrib area (#1344 via #1343)
  • Deprecated
    • Certain exports have been deprecated; downstream imports should be updated to the new locations (#1344 via #1343)
      Note: the symbols themselves remain supported. See documentation and the "Refactored" section below for details.
  • Refactor
    • The following symbols were moved. (#1344 via #1343)
      The symbols are still import-able through their old location.
      • OLD -> NEW
      • Builders.FromNodePackageJson -> Contrib.FromNodePackageJson.Builders
      • Factories.FromNodePackageJson -> Contrib.FromNodePackageJson.Factories
      • Factories.LicenseFactory -> Contrib.License.Factories.LicenseFactory
      • Factories.PackageUrlFactory -> Contrib.PackageUrl.Factories.PackageUrlFactory
      • Types.assertNodePackageJson -> Contrib.FromNodePackageJson.Types.assertNodePackageJson
      • Types.isNodePackageJson -> Contrib.FromNodePackageJson.Types.isNodePackageJson
      • Types.NodePackageJson -> Contrib.FromNodePackageJson.Types.NodePackageJson
      • Utils.BomUtility -> Contrib.Bom.Utils
      • Utils.LicenseUtility -> Contrib.License.Utils
      • Utils.NpmjsUtility -> Contrib.FromNodePackageJson.Utils
  • Style
    • Applied latest code style (via #1341)
  • Build
    • Use webpack v5.103.0 now, was v5.102.1 (via #1340)

#1340: CycloneDX/cyclonedx-javascript-library#1340 #1341: CycloneDX/cyclonedx-javascript-library#1341 #1343: CycloneDX/cyclonedx-javascript-library#1343 #1344: CycloneDX/cyclonedx-javascript-library#1344

9.2.0 -- 2025-10-22

... (truncated)

Commits

Updates fast-xml-parser from 5.3.4 to 5.3.9

Release notes

Sourced from fast-xml-parser's releases.

support strictReservedNames

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.3.9...v5.3.9

handle non-array input for XML builder && support maxNestedTags

CJS typing fix

What's Changed

New Contributors

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.3.6...v5.3.7

Entity security and performance

  • Improve security and performance of entity processing
    • new options maxEntitySize, maxExpansionDepth, maxTotalExpansions, maxExpandedLength, allowedTags,tagFilter
    • fast return when no edtity is present
    • improvement replacement logic to reduce number of calls

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.3.5...v5.3.6

v5.3.5

What's Changed

New Contributors

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.3.4...v5.3.5

Changelog

Sourced from fast-xml-parser's changelog.

5.3.9 5.3.9 / 2026-02-25

  • support strictReservedNames

5.3.8 5.3.8 / 2026-02-25

  • support maxNestedTags
  • handle non-array input for XML builder when preserveOrder is true (By Angelo Coetzee)
  • save use of js properies

5.3.7 5.3.7 / 2026-02-20

5.3.6 / 2026-02-14

  • Improve security and performance of entity processing
    • new options maxEntitySize, maxExpansionDepth, maxTotalExpansions, maxExpandedLength, allowedTags,tagFilter
    • fast return when no edtity is present
    • improvement replacement logic to reduce number of calls

5.3.5 / 2026-02-08

  • fix: Escape regex char in entity name
  • update strnum to 2.1.2
  • add missing exports in CJS typings

5.3.4 / 2026-01-30

  • fix: handle HTML numeric and hex entities when out of range

5.3.3 / 2025-12-12

  • fix #775: transformTagName with allowBooleanAttributes adds an unnecessary attribute

5.3.2 / 2025-11-14

  • fix for import statement for v6

5.3.1 / 2025-11-03

5.3.0 / 2025-10-03

  • Use Uint8Array in place of Buffer in Parser

5.2.5 / 2025-06-08

  • Inform user to use fxp-cli instead of in-built CLI feature
  • Export typings for direct use

5.2.4 / 2025-06-06

... (truncated)

Commits
  • 6f333a8 update release info
  • c3ffbab support strictReservedNames
  • c692040 update release info
  • 107e34c avoid {} to create an empty object
  • 60835a4 support maxNestedTags
  • f55657c avoid direct call to hasOwnProperty
  • c13a961 handle non-array input for XML builder when preserveOrder is true
  • fc97a55 update relese info
  • b9aef04 Unexport X2jOptions at declaration site (#787)
  • c20fbd6 remove unused code
  • Additional commits viewable in compare view

Updates packageurl-js from 1.0.2 to 2.0.1

Changelog

Sourced from packageurl-js's changelog.

2.0.1

Bug Fix

  • Fix decoding problems around the % character #75 (fix contributed by @​jdalton)

2.0.0

  • Significant refactor based on code from @​jdalton
  • Numerous bug fixes and improvements the community was asking for
    • See closed issues and PRs for details (too many to list here)

1.2.1

Bug Fixes

1.2.0

Features

  • Add pub parsing for Dart and Flutter packages (contributed by @​topaztee)

1.1.1

Bug Fix

  • publish errors

1.1.0

Features

Commits
  • cd1eb4b chore: bump to v2.0.1 (#77)
  • f7dccd6 fix: error on decode with meaningful message
  • 07b818b fix: only decode in parseString
  • c2f576f bump to v2.0.0 (#74)
  • b5660a5 Merge pull request #73 from package-url/jdalton/sync
  • 400de0c Merge pull request #72 from package-url/dependabot/npm_and_yarn/braces-3.0.3
  • b6c8ce8 fix: correct package-url.d.ts readonly type casing
  • 96822af fix: correct param name typos
  • f81a6be fix: use encodeQualifierValue for qualifierKey and qualifierValue
  • ff590d2 feat: encode qualifiers with URLSearchParams
  • Additional commits viewable in compare view

Updates yargs from 17.7.2 to 18.0.0

Changelog

Sourced from yargs's changelog.

18.0.0 (2025-05-26)

⚠ BREAKING CHANGES

  • command names are not derived from modules passed to command.
  • singleton usage of yargs yargs.foo, yargs().argv, has been removed.
  • minimum node.js versions now ^20.19.0 || ^22.12.0 || >=23.
  • yargs is now ESM first

Features

Bug Fixes

  • addDirectory do not support absolute command dir (#2465) (3a40a78)
  • allows ESM modules commands to be extensible using visit option (#2468) (200e1aa)
  • browser: fix shims so that yargs continues working in browser context (#2457) (4ae5f57)
  • build: address problems with typescript compilation (#2445) (8d72fb3)
  • coerce should play well with parser configuration (#2308) (8343c66)
  • deps: update dependency yargs-parser to v22 (#2470) (639130d)
  • exit after async handler done (#2313) (e326cde)
  • handle spaces in bash completion (#2452) (83b7788)
  • parser-configuration should work well with generated completion script (#2332) (888db19)
  • propagate Dictionary including undefined in value type (#2393) (2b2f7f5)
  • zsh: completion no longer requires double tab when using autoloaded (0dd8fe4)

Code Refactoring

  • command names are not derived from modules passed to command. (d90af45)
  • singleton usage of yargs yargs.foo, yargs().argv, has been removed. (d90af45)

Build System

  • minimum node.js versions now ^20.19.0 || ^22.12.0 || >=23. (d90af45)
Commits
  • 0bc7255 chore(main): release 18.0.0 (#2325)
  • 639130d fix(deps): update dependency yargs-parser to v22 (#2470)
  • 200e1aa fix: allows ESM modules commands to be extensible using visit option (#2468)
  • 888db19 fix: parser-configuration should work well with generated completion script (...
  • 3a40a78 fix: addDirectory do not support absolute command dir (#2465)
  • 90e9eca docs: remove to old slack channel (#2466)
  • 0dd8fe4 fix(zsh): completion no longer requires double tab when using autoloaded
  • 27eec18 feat: commandDir now works with ESM files (#2461)
  • f9c72a7 docs: update examples to run from examples folder (#2463)
  • e02c91b feat(zsh): Add default completion as fallback (#2331)
  • Additional commits viewable in compare view

Updates @types/node from 20.19.31 to 25.3.0

Commits

Updates c8 from 10.1.3 to 11.0.0

Release notes

Sourced from c8's releases.

v11.0.0

11.0.0 (2026-02-22)

⚠ BREAKING CHANGES

  • deps: transitive deps require 20 || >=22

Bug Fixes

Changelog

Sourced from c8's changelog.

11.0.0 (2026-02-22)

⚠ BREAKING CHANGES

  • deps: transitive deps require 20 || >=22

Bug Fixes

Commits

Updates chai from 4.5.0 to 6.2.2

Release notes

Sourced from chai's releases.

v6.2.2

What's Changed

New Contributors

Full Changelog: chaijs/chai@v6.2.1...v6.2.2

v6.2.1

What's Changed

New Contributors

Full Changelog: chaijs/chai@v6.2.0...v6.2.1

... (truncated)

Commits
  • 814172d chore(deps): update dependency esbuild to v0.27.2 (#1759)
  • b38c22b chore: add legal-comments=none option (#1756)
  • 180d4cc chore(deps): update dependencies to v9.39.2 (#1757)
  • 678cd00 chore(deps): update dependencies (#1755)
  • c8fb100 chore(deps): update dependency prettier to v3.7.3 (#1754)
  • d63c74e chore(deps): update dependency eslint-plugin-jsdoc to v61.4.1 (#1751)
  • 243bf86 fix: avoid BigInt literal in closeTo for runtime compat (#1748)
  • d8b0395 chore(deps): update actions/checkout action to v6 (#1749)
  • 7e1e247 build(deps): bump glob from 10.4.5 to 10.5.0 (#1747)
  • b25e5d8 chore(deps): update dependency eslint-plugin-jsdoc to v61.2.1 (#1746)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for chai since your current version.


Updates eslint from 8.57.1 to 10.0.2

Release notes

Sourced from eslint's releases.

v10.0.2

Bug Fixes

  • 2b72361 fix: update ajv to 6.14.0 to address security vulnerabilities (#20537) (루밀LuMir)

Documentation

  • 13eeedb docs: link rule type explanation to CLI option --fix-type (#20548) (Mike McCready)
  • 98cbf6b docs: update migration guide per Program range change (#20534) (Huáng Jùnliàng)
  • 61a2405 docs: add missing semicolon in vars-on-top rule example (#20533) (Abilash)

Chores

  • 951223b chore: update dependency @​eslint/eslintrc to ^3.3.4 (#20553) (renovate[bot])
  • 6aa1afe chore: update dependency eslint-plugin-jsdoc to ^62.7.0 (#20536) (Milos Djermanovic)

v10.0.1

Bug Fixes

  • c87d5bd fix: update eslint (#20531) (renovate[bot])
  • d841001 fix: update minimatch to 10.2.1 to address security vulnerabilities (#20519) (루밀LuMir)
  • 04c2147 fix: update error message for unused suppressions (#20496) (fnx)
  • 38b089c fix: update dependency @​eslint/config-array to ^0.23.1 (#20484) (renovate[bot])

Documentation

  • 5b3dbce docs: add AI acknowledgement section to templates (#20431) (루밀LuMir)
  • 6f23076 docs: toggle nav in no-JS mode (#20476) (Tanuj Kanti)
  • b69cfb3 docs: Update README (GitHub Actions Bot)

Chores

  • e5c281f chore: updates for v9.39.3 release (Jenkins)
  • 8c3832a chore: update @​typescript-eslint/parser to ^8.56.0 (#20514) (Milos Djermanovic)
  • 8330d23 test: add tests for config-api (#20493) (Milos Djermanovic)
  • 37d6e91 chore: remove eslint v10 prereleases from eslint-config-eslint deps (#20494) (Milos Djermanovic)
  • da7cd0e refactor: cleanup error message templates (#20479) (Francesco Trotta)
  • 84fb885 chore: package.json update for @​eslint/js release (Jenkins)
  • 1f66734 chore: add eslint to peerDependencies of @eslint/js (#20467) (Milos Djermanovic)

v10.0.0

Breaking Changes

  • f9e54f4 feat!: estimate rule-tester failure location (#20420) (ST-DDT)
  • a176319 feat!: replace chalk with styleText and add color to ResultsMeta (#20227) (루밀LuMir)
  • c7046e6 feat!: enable JSX reference tracking (#20152) (Pixel998)
  • fa31a60 feat!: add name to configs (#20015) (Kirk Waiblinger)
  • 3383e7e fix!: remove deprecated SourceCode methods (#20137) (Pixel998)
  • 501abd0 feat!: update dependency minimatch to v10 (#20246) (renovate[bot])
  • ca4d3b4 fix!: stricter rule tester assertions for valid test cases (#20125) (唯然)
  • 96512a6 fix!: Remove deprecated rule context methods (#20086) (Nicholas C. Zakas)
  • c69fdac feat!: remove eslintrc support (#20037) (Francesco Trotta)
  • 208b5cc feat!: Use ScopeManager#addGlobals() (#20132) (Milos Djermanovic)
  • a2ee188 fix!: add uniqueItems: true in no-invalid-regexp option (#20155) (Tanuj Kanti)
  • a89059d feat!: Program range span entire source text (#20133) (Pixel998)
  • 39a6424 fix!: assert 'text' is a string across all RuleFixer methods (#20082) (Pixel998)
  • f28fbf8 fix!: Deprecate "always" and "as-needed" options of the radix rule (#20223) (Milos Djermanovic)

... (truncated)

Commits
  • 55122d6 10.0.2
  • 80f1e29 Build: changelog update for 10.0.2
  • 951223b chore: update dependency @​eslint/eslintrc to ^3.3.4 (#20553)
  • 13eeedb docs: link rule type explanation to CLI option --fix-type (#20548)
  • 6aa1afe chore: update dependency eslint-plugin-jsdoc to ^62.7.0 (#20536)
  • 2b72361 fix: update ajv to 6.14.0 to address security vulnerabilities (#20537)
  • 98cbf6b docs: update migration guide per Program range change (#20534)
  • 61a2405 docs: add missing semicolon in vars-on-top rule example (#20533)
  • 0bd5497 10.0.1
  • ddb80ef Build: changelog update for 10.0.1
  • Additional commits viewable in compare view

Updates mocha from 10.8.2 to 11.7.5

Release notes

Sourced from mocha's releases.

v11.7.5

11.7.5 (2025-11-04)

🩹 Fixes

  • swallow more require errors from *ts files (#5498) (d89dbaf)

🧹 Chores

v11.7.4

11.7.4 (2025-10-01)

🩹 Fixes

📚 Documentation

  • migrate remaining legacy wiki pages to main documentation (#5465) (bff9166)

🧹 Chores

v11.7.3

11.7.3 (2025-09-30)

🩹 Fixes

  • use original require() error for TS files if ERR_UNKNOWN_FILE_EXTENSION (#5408) (ebdbc48)

📚 Documentation

🤖 Automation

... (truncated)

Changelog

Sourced from mocha's changelog.

11.7.5 (2025-11-04)

🩹 Fixes

  • swallow more require errors from *ts files (#5498) (d89dbaf)

🧹 Chores

11.7.4 (2025-10-01)

🩹 Fixes

📚 Documentation

  • migrate remaining legacy wiki pages to main documentation (#5465) (bff9166)

🧹 Chores

11.7.3 (...

Description has been truncated

@dependabot
build(deps): bump the npm-dependencies group across 1 directory with …
cf02521 
…13 updates

Bumps the npm-dependencies group with 13 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@cyclonedx/cyclonedx-library](https://github.com/CycloneDX/cyclonedx-javascript-library) | `6.13.1` | `9.4.1` |
| [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) | `5.3.4` | `5.3.9` |
| [packageurl-js](https://github.com/package-url/packageurl-js) | `1.0.2` | `2.0.1` |
| [yargs](https://github.com/yargs/yargs) | `17.7.2` | `18.0.0` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `20.19.31` | `25.3.0` |
| [c8](https://github.com/bcoe/c8) | `10.1.3` | `11.0.0` |
| [chai](https://github.com/chaijs/chai) | `4.5.0` | `6.2.2` |
| [eslint](https://github.com/eslint/eslint) | `8.57.1` | `10.0.2` |
| [mocha](https://github.com/mochajs/mocha) | `10.8.2` | `11.7.5` |
| [msw](https://github.com/mswjs/msw) | `2.12.7` | `2.12.10` |
| [sinon](https://github.com/sinonjs/sinon) | `15.2.0` | `21.0.1` |
| [sinon-chai](https://github.com/chaijs/sinon-chai) | `3.7.0` | `4.0.1` |
| [which](https://github.com/npm/node-which) | `5.0.0` | `6.0.1` |



Updates `@cyclonedx/cyclonedx-library` from 6.13.1 to 9.4.1
- [Release notes](https://github.com/CycloneDX/cyclonedx-javascript-library/releases)
- [Changelog](https://github.com/CycloneDX/cyclonedx-javascript-library/blob/main/HISTORY.md)
- [Commits](CycloneDX/cyclonedx-javascript-library@v6.13.1...v9.4.1)

Updates `fast-xml-parser` from 5.3.4 to 5.3.9
- [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases)
- [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md)
- [Commits](NaturalIntelligence/fast-xml-parser@v5.3.4...v5.3.9)

Updates `packageurl-js` from 1.0.2 to 2.0.1
- [Changelog](https://github.com/package-url/packageurl-js/blob/master/CHANGELOG.md)
- [Commits](package-url/packageurl-js@v1.0.2...v2.0.1)

Updates `yargs` from 17.7.2 to 18.0.0
- [Release notes](https://github.com/yargs/yargs/releases)
- [Changelog](https://github.com/yargs/yargs/blob/main/CHANGELOG.md)
- [Commits](yargs/yargs@v17.7.2...v18.0.0)

Updates `@types/node` from 20.19.31 to 25.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `c8` from 10.1.3 to 11.0.0
- [Release notes](https://github.com/bcoe/c8/releases)
- [Changelog](https://github.com/bcoe/c8/blob/main/CHANGELOG.md)
- [Commits](bcoe/c8@v10.1.3...v11.0.0)

Updates `chai` from 4.5.0 to 6.2.2
- [Release notes](https://github.com/chaijs/chai/releases)
- [Changelog](https://github.com/chaijs/chai/blob/main/History.md)
- [Commits](chaijs/chai@v4.5.0...v6.2.2)

Updates `eslint` from 8.57.1 to 10.0.2
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v8.57.1...v10.0.2)

Updates `mocha` from 10.8.2 to 11.7.5
- [Release notes](https://github.com/mochajs/mocha/releases)
- [Changelog](https://github.com/mochajs/mocha/blob/v11.7.5/CHANGELOG.md)
- [Commits](mochajs/mocha@v10.8.2...v11.7.5)

Updates `msw` from 2.12.7 to 2.12.10
- [Release notes](https://github.com/mswjs/msw/releases)
- [Changelog](https://github.com/mswjs/msw/blob/main/CHANGELOG.md)
- [Commits](mswjs/msw@v2.12.7...v2.12.10)

Updates `sinon` from 15.2.0 to 21.0.1
- [Release notes](https://github.com/sinonjs/sinon/releases)
- [Changelog](https://github.com/sinonjs/sinon/blob/main/docs/changelog.md)
- [Commits](sinonjs/sinon@v15.2.0...v21.0.1)

Updates `sinon-chai` from 3.7.0 to 4.0.1
- [Release notes](https://github.com/chaijs/sinon-chai/releases)
- [Changelog](https://github.com/chaijs/sinon-chai/blob/master/CHANGELOG.md)
- [Commits](chaijs/sinon-chai@3.7.0...4.0.1)

Updates `which` from 5.0.0 to 6.0.1
- [Release notes](https://github.com/npm/node-which/releases)
- [Changelog](https://github.com/npm/node-which/blob/main/CHANGELOG.md)
- [Commits](npm/node-which@v5.0.0...v6.0.1)

---
updated-dependencies:
- dependency-name: "@cyclonedx/cyclonedx-library"
  dependency-version: 9.4.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: fast-xml-parser
  dependency-version: 5.3.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: packageurl-js
  dependency-version: 2.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: yargs
  dependency-version: 18.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: "@types/node"
  dependency-version: 25.3.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: c8
  dependency-version: 11.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: chai
  dependency-version: 6.2.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: eslint
  dependency-version: 10.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: mocha
  dependency-version: 11.7.5
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: msw
  dependency-version: 2.12.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: sinon
  dependency-version: 21.0.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: sinon-chai
  dependency-version: 4.0.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: which
  dependency-version: 6.0.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Feb 25, 2026
@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Feb 27, 2026

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot bot closed this Feb 27, 2026
@dependabot dependabot bot deleted the dependabot/npm_and_yarn/npm-dependencies-0d335e59ed branch February 27, 2026 11:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants