Skip to content

Bump the npm_and_yarn group across 8 directories with 11 updates - #1501

Merged
afscrome merged 2 commits into
mainfrom
dependabot/npm_and_yarn/examples/dbgate/CommunityToolkit.Aspire.Hosting.DbGate.AppHost.TypeScript/npm_and_yarn-35745cd8f6
Aug 1, 2026
Merged

Bump the npm_and_yarn group across 8 directories with 11 updates#1501
afscrome merged 2 commits into
mainfrom
dependabot/npm_and_yarn/examples/dbgate/CommunityToolkit.Aspire.Hosting.DbGate.AppHost.TypeScript/npm_and_yarn-35745cd8f6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 2 updates in the /examples/dbgate/CommunityToolkit.Aspire.Hosting.DbGate.AppHost.TypeScript directory: brace-expansion and esbuild.
Bumps the npm_and_yarn group with 4 updates in the /examples/javascript-ext/nx-demo directory: react-router-dom, nx, fast-uri and svgo.
Bumps the npm_and_yarn group with 1 update in the /examples/javascript-ext/turborepo-demo directory: next.
Bumps the npm_and_yarn group with 1 update in the /examples/seaweedfs/SeaweedFS.AppHost.TypeScript directory: brace-expansion.
Bumps the npm_and_yarn group with 1 update in the /examples/squad/CommunityToolkit.Aspire.Hosting.Squad.AppHost.TypeScript directory: brace-expansion.
Bumps the npm_and_yarn group with 2 updates in the /examples/umami/umami-vite-app directory: esbuild and postcss.
Bumps the npm_and_yarn group with 1 update in the /playground/polyglot/TypeScript/CommunityToolkit.Aspire.Hosting.PowerShell/ValidationAppHost directory: brace-expansion.
Bumps the npm_and_yarn group with 1 update in the /playground/polyglot/TypeScript/CommunityToolkit.Aspire.Hosting.RavenDB/ValidationAppHost directory: brace-expansion.

Updates brace-expansion from 5.0.5 to 5.0.9

Commits

Updates esbuild from 0.27.4 to 0.28.1

Release notes

Sourced from esbuild's releases.

v0.28.1

  • Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

    This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

    Thanks to @​dellalibera for reporting this issue.

  • Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

    The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

    Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

    Thanks to @​sondt99 for reporting this issue.

  • Avoid inlining using and await using declarations (#4482)

    Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

    // Original code
{
  using x = new Resource()
  x.activate()
}
// Old output (with --minify)
new Resource().activate();
// New output (with --minify)
{using e=new Resource;e.activate()}

  • Fix module evaluation when an error is thrown (#4461, #4467)

    If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

  • Fix some edge cases around the new operator (#4477)

    Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

    // Original code
new (foo()`bar`)()
new (foo()?.bar)()
// Old output
new foo()bar();
new (foo())?.bar();

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.1

  • Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

    This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

    Thanks to @​dellalibera for reporting this issue.

  • Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

    The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

    Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

    Thanks to @​sondt99 for reporting this issue.

  • Avoid inlining using and await using declarations (#4482)

    Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

    // Original code
{
  using x = new Resource()
  x.activate()
}
// Old output (with --minify)
new Resource().activate();
// New output (with --minify)
{using e=new Resource;e.activate()}

  • Fix module evaluation when an error is thrown (#4461, #4467)

    If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

  • Fix some edge cases around the new operator (#4477)

    Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

    // Original code
new (foo()`bar`)()
new (foo()?.bar)()
// Old output
new foo()bar();
new (foo())?.bar();

... (truncated)

Commits

Updates react-router-dom from 6.30.3 to 7.0.0

Changelog

Sourced from react-router-dom's changelog.

7.0.0

Major Changes

  • Remove the original defer implementation in favor of using raw promises via single fetch and turbo-stream. This removes these exports from React Router: (#11744)

    • defer
    • AbortedDeferredError
    • type TypedDeferredData
    • UNSAFE_DeferredData
    • UNSAFE_DEFERRED_SYMBOL,

  • Use createRemixRouter/RouterProvider in entry.client instead of RemixBrowser (#11469)

  • Remove single_fetch future flag. (#11522)

  • Remove future.v7_startTransition flag (#11696)

  • Remove future.v7_normalizeFormMethod future flag (#11697)

  • Allow returning undefined from actions and loaders (#11680)

  • update minimum node version to 18 (#11690)

  • Remove future.v7_prependBasename from the ionternalized @remix-run/router package (#11726)

  • Remove future.v7_throwAbortReason from internalized @remix-run/router package (#11728)

  • Add exports field to all packages (#11675)

  • node package no longer re-exports from react-router (#11702)

  • updates the minimum React version to 18 (#11689)

    • Remove the future.v7_partialHydration flag (#11725)
      • This also removes the <RouterProvider fallbackElement> prop
        • To migrate, move the fallbackElement to a hydrateFallbackElement/HydrateFallback on your root route
      • Also worth nothing there is a related breaking changer with this future flag:
        • Without future.v7_partialHydration (when using fallbackElement), state.navigation was populated during the initial load
        • With future.v7_partialHydration, state.navigation remains in an "idle" state during the initial load

  • Remove future.v7_fetcherPersist flag (#11731)

Minor Changes

  • Add prefetching support to Link/NavLink when using Remix SSR (#11402)
  • Enhance ScrollRestoration so it can restore properly on an SSR'd document load (#11401)
  • Add built-in Remix-style hydration support to RouterProvider. When running from a Remix-SSR'd HTML payload with the proper window variables (__remixContext, __remixManifest, __remixRouteModules), you don't need to pass a router prop and RouterProvider will create the router for you internally. (#11396) (#11400)

Patch Changes

... (truncated)

Commits
Attestation changes

This version has no provenance attestation, while the previous version (6.30.3) was attested. Review the package versions before updating.


Updates nx from 21.4.1 to 23.1.1

Release notes

Sourced from nx's releases.

23.1.1 (2026-07-30)

🚀 Features

  • core: derive stable repo key from normalized remote and relative path (#36439)
  • repo: add react + vite + vitest + playwright example (#35921)

🩹 Fixes

  • angular-rspack: speed up builds and align behavior with the esbuild application builder (#36268, #34936)
  • bundling: support TypeScript esbuildConfig files in the esbuild executor (#36352, #36349)
  • bundling: acknowledge @​swc/core build scripts when configuring rollup (#36412)
  • core: speed up npm lockfile parsing (#36216)
  • core: speed up lockfile parsing and catalog resolution (#36223)
  • core: show performance report recommendations only when actionable (#36344)
  • core: close daemon log descriptors after spawn to avoid Node 26 crash (#36280)
  • core: prevent shell injection in nx import (#36348)
  • core: correct the 22.6.0 gitignore and analytics migration wiring (#36356)
  • core: support npm 12 and pnpm in the package provenance check (#36354, #36338)
  • core: honor pnpm minimumReleaseAge config on pnpm 11 (#36335, #36330)
  • core: support pnpm 11 patched dependency hashes (#36360)
  • core: resolve name refs copied into pattern-matched target arrays (#36359)
  • core: resolve source-loaded plugin transitive workspace imports (#36296)
  • core: unbreak pnpm 11 installs by acknowledging build-script deps from generators (#36302)
  • core: include continuous and default-config dependencies in show target (#36374)
  • core: make unit tests pass locally regardless of invoking package manager (#35994)
  • core: respect --aiAgents none to skip AI agent file generation (#34944, #34692)
  • core: use --config.frozen-lockfile=false for pnpm add during migrate (#36337)
  • core: run selected projects with --exclude-task-dependencies (#35562)
  • core: stop passing git revisions through a shell in affected commands (#36379)
  • core: collect trickling watcher bursts fully on daemon force-flush (#36391)
  • core: report tasks running in another Nx process in the inline TUI (#36341)
  • core: stop ratatui cursor queries from racing the TUI event stream (#36318)
  • core: render critical-path tasks as a nested list in the job summary (#36394)
  • core: keep pnpm-workspace.yaml comments and read package.json as jsonc (#36411)
  • core: support multiple brace groups in workspace glob matching (#36395)
  • core: handle CRLF line endings in pnpm multi-document lockfiles (#36419, #35828, #35840)
  • core: correct glob pattern expansion for ZeroOrOne groups (#31857)
  • core: stop re-querying confirmed cache misses in task orchestrator (#36301, #35632)
  • core: sample project graph perf span telemetry per session at 10% (#36420)
  • core: strip terminal query sequences when replaying task output (#36432)
  • core: preserve FORCE_COLOR=0 intent for forked child tasks (#35293)
  • core: handle colons in target name when resolving inputs to generate graph (#36429, #33710)
  • core: merge default plugins through the source-map-aware merge path (#36257)
  • core: keep nx migrate on the requested version when release-age gates interfere (#36444)
  • core: avoid bogus duplicate project name errors when generating nested apps (#36458)
  • core: pin typescript in preset dependencies so npm cannot hoist typescript 7 (#36497)
  • core: bump pinned axios and brace-expansion past vulnerable versions (#36507, #36474)
  • core: parse pnpm lockfiles that omit the packages block (#36512)
  • core: keep real dependencies when omitting peers from npm temp installs (#36518)

... (truncated)

Commits
  • 8841f1c fix(core): keep real dependencies when omitting peers from npm temp installs ...
  • 86dbded fix(core): parse pnpm lockfiles that omit the packages block (#36512)
  • cff77e2 fix(core): bump pinned axios and brace-expansion past vulnerable versions (#3...
  • a2e6ac4 chore(repo): stop eslint linting json files with no applicable rules (#36454)
  • dd97e9c fix(core): avoid bogus duplicate project name errors when generating nested a...
  • 50f61ef feat(core): derive stable repo key from normalized remote and relative path (...
  • 9d51f0a fix(core): keep nx migrate on the requested version when release-age gates in...
  • 36208e9 fix(core): merge default plugins through the source-map-aware merge path (#36...
  • 49a9afe fix(misc): prevent crash when opening browser in Podman+WSL container (#34639)
  • a92116d fix(core): handle colons in target name when resolving inputs to generate gra...
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nx since your current version.

Install script changes

This version modifies postinstall script that runs during installation. Review the package contents before updating.


Updates axios from 1.16.0 to 1.16.1

Release notes

Sourced from axios's releases.

v1.16.1 — May 13, 2026

This release ships a defence-in-depth fix for prototype pollution in formDataToJSON, hardens proxy and CI workflows, restores Webpack 4 compatibility for the fetch adapter, and includes several small bug fixes and maintenance improvements.

🔒 Security Fixes

  • Prototype Pollution Defence-in-Depth: Hardened formDataToJSON against already-polluted Object.prototype by walking own properties only, so attacker-controlled keys inherited from a poisoned prototype cannot propagate through deserialization. (#7413)
  • Proxy Cleartext Leak: Fixed an issue where HTTPS request data could be transmitted in cleartext to an HTTP proxy under certain configurations. (#10858)
  • CI Cache Removal: Removed all GitHub Actions caches as a defence-in-depth measure against cache poisoning vectors in the build pipeline. (#10882)

🐛 Bug Fixes

  • Data URI Parsing: Updated the fromDataURI regex to match RFC 2397 more strictly, fixing edge cases in data: URL handling. (#10829)
  • Unicode Headers: Preserved Unicode header values when running through request interceptors, so non-ASCII header content is no longer corrupted before dispatch. (#10850)
  • XHR Upload Progress: Guarded against malformed ProgressEvent payloads emitted by some environments during XHR upload, preventing crashes when loaded / total are missing or invalid. (#10868)
  • Webpack 4 Fetch Adapter: Fixed an "unexpected token" error caused by syntax in the fetch adapter that Webpack 4 could not parse, restoring compatibility for legacy bundler users. (#10864)
  • Type Definitions: Made parseReviver context.source optional in the type definitions to align with the ES2023 specification. (#10837)
  • URL Object Support Reverted: Reverted the change that allowed passing a URL object as config.url (originally #10866) due to regressions; this support will be reintroduced in a later release once the underlying issues are addressed. (#10874)

🔧 Maintenance & Chores

  • Cycle Detection Refactor: Replaced the array-based cycle tracker in toJSONObject with a WeakSet, improving performance and memory behaviour on large nested structures. (#10832)
  • composeSignals Cleanup: Refactored composeSignals to use a clearer early-return structure, simplifying the cancellation/abort composition path. (#10844)
  • AI Readiness & Repo Docs: Added AGENTS.md and related contributor-guide updates for both human and AI agents, plus post-release documentation improvements. (#10835, #10841)
  • Docs Improvements: Clarified the GET request example, fixed the interceptor eject example to reference the correct instance, and corrected the Buzzoid sponsor description in the README. (#10836, #10853, #10856)
  • Sponsorship Tooling: Fixed empty sponsor arrays in the sponsor processing script, added the ability to inject additional sponsors, updated the sponsorship link, and added a Twicsy advertisement entry. (#10843, #10859, #10869)
  • Dependencies: Bumped @commitlint/cli from 20.5.0 to 20.5.2. (#10846)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

Full Changelog

Changelog

Sourced from axios's changelog.

v1.16.1 — May 13, 2026

This release ships a defence-in-depth fix for prototype pollution in formDataToJSON, hardens proxy and CI workflows, restores Webpack 4 compatibility for the fetch adapter, and includes several small bug fixes and maintenance improvements.

🔒 Security Fixes

  • Prototype Pollution Defence-in-Depth: Hardened formDataToJSON against already-polluted Object.prototype by walking own properties only, so attacker-controlled keys inherited from a poisoned prototype cannot propagate through deserialization. (#7413)
  • Proxy Cleartext Leak: Fixed an issue where HTTPS request data could be transmitted in cleartext to an HTTP proxy under certain configurations. (#10858)
  • CI Cache Removal: Removed all GitHub Actions caches as a defence-in-depth measure against cache poisoning vectors in the build pipeline. (#10882)

🐛 Bug Fixes

  • Data URI Parsing: Updated the fromDataURI regex to match RFC 2397 more strictly, fixing edge cases in data: URL handling. (#10829)
  • Unicode Headers: Preserved Unicode header values when running through request interceptors, so non-ASCII header content is no longer corrupted before dispatch. (#10850)
  • XHR Upload Progress: Guarded against malformed ProgressEvent payloads emitted by some environments during XHR upload, preventing crashes when loaded / total are missing or invalid. (#10868)
  • Webpack 4 Fetch Adapter: Fixed an "unexpected token" error caused by syntax in the fetch adapter that Webpack 4 could not parse, restoring compatibility for legacy bundler users. (#10864)
  • Type Definitions: Made parseReviver context.source optional in the type definitions to align with the ES2023 specification. (#10837)
  • URL Object Support Reverted: Reverted the change that allowed passing a URL object as config.url (originally #10866) due to regressions; this support will be reintroduced in a later release once the underlying issues are addressed. (#10874)

🔧 Maintenance & Chores

  • Cycle Detection Refactor: Replaced the array-based cycle tracker in toJSONObject with a WeakSet, improving performance and memory behaviour on large nested structures. (#10832)
  • composeSignals Cleanup: Refactored composeSignals to use a clearer early-return structure, simplifying the cancellation/abort composition path. (#10844)
  • AI Readiness & Repo Docs: Added AGENTS.md and related contributor-guide updates for both human and AI agents, plus post-release documentation improvements. (#10835, #10841)
  • Docs Improvements: Clarified the GET request example, fixed the interceptor eject example to reference the correct instance, and corrected the Buzzoid sponsor description in the README. (#10836, #10853, #10856)
  • Sponsorship Tooling: Fixed empty sponsor arrays in the sponsor processing script, added the ability to inject additional sponsors, updated the sponsorship link, and added a Twicsy advertisement entry. (#10843, #10859, #10869)
  • Dependencies: Bumped @commitlint/cli from 20.5.0 to 20.5.2. (#10846)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

Full Changelog

Commits
  • 1337d6b chore(release): prepare release 1.16.1 (#10877)
  • 858a790 fix: remove all caches (#10882)
  • 34adfd9 revert: "fix: support URL object as config.url input (#10866)" (#10874)
  • 847d89b fix: support URL object as config.url input (#10866)
  • 4094886 fix(progress): guard malformed XHR upload events (#10868)
  • 44f0c5b chore: change sponsorship link and add Twicsy advertisement (#10869)
  • 64e1095 chore: update PR and issue template to use h2 (#10865)
  • 3e6b4e1 fix: error unexpected token in fetch JS compatibility issue with Webpack 4 (#...
  • c4453ba fix: add the ability to add additional sponsors to the process sponsors scrip...
  • caa00a9 fix: https data in cleartext to proxy (#10858)
  • Additional commits viewable in compare view

Updates js-yaml from 3.14.2 to 3.15.1

Changelog

Sourced from js-yaml's changelog.

3.15.1 - 2026-07-31

Security

  • [backport] Remove quadratic complexity from !!omap duplicate key detection.

3.15.0 - 2026-06-27

Added

  • Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one safeLoad() / safeLoadAll() call.
Commits

Updates fast-uri from 3.1.2 to 3.1.5

Release notes

Sourced from fast-uri's releases.

v3.1.5

⚠️ Security Warning

Fix for GHSA-7p8r-x3mc-p8w7

Full Changelog: fastify/fast-uri@v3.1.4...v3.1.5

v3.1.4

⚠️ Security Release

Fix for GHSA-v2hh-gcrm-f6hx

Full Changelog: fastify/fast-uri@v3.1.3...v3.1.4

v3.1.3

⚠️ Security Release

Full Changelog: fastify/fast-uri@v3.1.2...v3.1.3

Commits

Updates react-router from 6.30.3 to 7.0.0

Release notes

Sourced from react-router's releases.

v7.0.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v700

v6.30.4

See the changelog for release notes: https://github.com/remix-run/react-router/blob/v6/CHANGELOG.md#v6304

Changelog

Sourced from react-router's changelog.

7.0.0

Major Changes

  • Remove the original defer implementation in favor of using raw promises via single fetch and turbo-stream. This removes these exports from React Router: (#11744)

    • defer
    • AbortedDeferredError
    • type TypedDeferredData
    • UNSAFE_DeferredData
    • UNSAFE_DEFERRED_SYMBOL,
    • Collapse @remix-run/router into react-router (#11505)
    • Collapse react-router-dom into react-router
    • Collapse @remix-run/server-runtime into react-router
    • Collapse @remix-run/testing into react-router

  • Remove single fetch future flag. (#11522)

  • Drop support for Node 16, React Router SSR now requires Node 18 or higher (#11391)

  • Remove future.v7_startTransition flag (#11696)

    • Expose the underlying router promises from the following APIs for compsition in React 19 APIs: (#11521)
      • useNavigate()
      • useSubmit
      • useFetcher().load
      • useFetcher().submit
      • useRevalidator.revalidate

  • Remove future.v7_normalizeFormMethod future flag (#11697)

  • For Remix consumers migrating to React Router, the crypto global from the Web Crypto API is now required when using cookie and session APIs. This means that the following APIs are provided from react-router rather than platform-specific packages: (#11837)

    • createCookie
    • createCookieSessionStorage
    • createMemorySessionStorage
    • createSessionStorage

    For consumers running older versions of Node, the installGlobals function from @remix-run/node has been updated to define globalThis.crypto, using Node's require('node:crypto').webcrypto implementation.

    Since platform-specific packages no longer need to implement this API, the following low-level APIs have been removed:

    • createCookieFactory
    • createSessionStorageFactory
    • createCookieSessionStorageFactory
    • createMemorySessionStorageFactory

  • Imports/Exports cleanup (#11840)

    • Removed the following exports that were previously public API from @remix-run/router
      • types
        • AgnosticDataIndexRouteObject
        • AgnosticDataNonIndexRouteObject

... (truncated)

Commits
Attestation changes

This version has no provenance attestation, while the previous version (6.30.3) was attested. Review the package versions before updating.


Updates svgo from 3.3.3 to 3.3.4

Commits

Updates next from 16.2.6 to 16.2.12

Release notes

Sourced from next's releases.

v16.2.12

What's Changed

Full Changelog: vercel/next.js@v16.2.11...v16.2.12

v16.2.11

This release contains security fixes for the following advisories:

High:

<...

Description has been truncated

@dependabot
Bump the npm_and_yarn group across 8 directories with 11 updates
d9019f0 
Bumps the npm_and_yarn group with 2 updates in the /examples/dbgate/CommunityToolkit.Aspire.Hosting.DbGate.AppHost.TypeScript directory: [brace-expansion](https://github.com/juliangruber/brace-expansion) and [esbuild](https://github.com/evanw/esbuild).
Bumps the npm_and_yarn group with 4 updates in the /examples/javascript-ext/nx-demo directory: [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom), [nx](https://github.com/nrwl/nx/tree/HEAD/packages/nx), [fast-uri](https://github.com/fastify/fast-uri) and [svgo](https://github.com/svg/svgo).
Bumps the npm_and_yarn group with 1 update in the /examples/javascript-ext/turborepo-demo directory: [next](https://github.com/vercel/next.js).
Bumps the npm_and_yarn group with 1 update in the /examples/seaweedfs/SeaweedFS.AppHost.TypeScript directory: [brace-expansion](https://github.com/juliangruber/brace-expansion).
Bumps the npm_and_yarn group with 1 update in the /examples/squad/CommunityToolkit.Aspire.Hosting.Squad.AppHost.TypeScript directory: [brace-expansion](https://github.com/juliangruber/brace-expansion).
Bumps the npm_and_yarn group with 2 updates in the /examples/umami/umami-vite-app directory: [esbuild](https://github.com/evanw/esbuild) and [postcss](https://github.com/postcss/postcss).
Bumps the npm_and_yarn group with 1 update in the /playground/polyglot/TypeScript/CommunityToolkit.Aspire.Hosting.PowerShell/ValidationAppHost directory: [brace-expansion](https://github.com/juliangruber/brace-expansion).
Bumps the npm_and_yarn group with 1 update in the /playground/polyglot/TypeScript/CommunityToolkit.Aspire.Hosting.RavenDB/ValidationAppHost directory: [brace-expansion](https://github.com/juliangruber/brace-expansion).


Updates `brace-expansion` from 5.0.5 to 5.0.9
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v5.0.5...v5.0.9)

Updates `esbuild` from 0.27.4 to 0.28.1
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md)
- [Commits](evanw/esbuild@v0.27.4...v0.28.1)

Updates `react-router-dom` from 6.30.3 to 7.0.0
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/react-router-dom@7.0.0/packages/react-router-dom/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/react-router-dom@7.0.0/packages/react-router-dom)

Updates `nx` from 21.4.1 to 23.1.1
- [Release notes](https://github.com/nrwl/nx/releases)
- [Commits](https://github.com/nrwl/nx/commits/23.1.1/packages/nx)

Updates `axios` from 1.16.0 to 1.16.1
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.16.0...v1.16.1)

Updates `js-yaml` from 3.14.2 to 3.15.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/3.15.1/CHANGELOG.md)
- [Commits](nodeca/js-yaml@3.14.2...3.15.1)

Updates `fast-uri` from 3.1.2 to 3.1.5
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.2...v3.1.5)

Updates `react-router` from 6.30.3 to 7.0.0
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/react-router@7.0.0/packages/react-router)

Updates `svgo` from 3.3.3 to 3.3.4
- [Commits](https://github.com/svg/svgo/commits)

Updates `next` from 16.2.6 to 16.2.12
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.2.6...v16.2.12)

Updates `brace-expansion` from 5.0.6 to 5.0.9
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v5.0.5...v5.0.9)

Updates `brace-expansion` from 5.0.6 to 5.0.9
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v5.0.5...v5.0.9)

Updates `esbuild` from 0.27.7 to 0.28.1
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md)
- [Commits](evanw/esbuild@v0.27.4...v0.28.1)

Updates `postcss` from 8.5.15 to 8.5.25
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.15...8.5.25)

Updates `brace-expansion` from 5.0.7 to 5.0.9
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v5.0.5...v5.0.9)

Updates `brace-expansion` from 5.0.7 to 5.0.9
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v5.0.5...v5.0.9)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 5.0.9
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: esbuild
  dependency-version: 0.28.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: react-router-dom
  dependency-version: 7.0.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: nx
  dependency-version: 23.1.1
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: axios
  dependency-version: 1.16.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 3.15.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fast-uri
  dependency-version: 3.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: react-router
  dependency-version: 7.0.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: svgo
  dependency-version: 3.3.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: next
  dependency-version: 16.2.12
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 5.0.9
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 5.0.9
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: esbuild
  dependency-version: 0.28.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: postcss
  dependency-version: 8.5.25
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 5.0.9
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 5.0.9
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Aug 1, 2026
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Aug 1, 2026
@github-actions

github-actions Bot commented Aug 1, 2026

Copy link
Copy Markdown
Contributor

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/CommunityToolkit/Aspire/main/eng/scripts/dogfood-pr.sh | bash -s -- 1501

Or

  • Run remotely in PowerShell:
iex "& { $(irm https://raw.githubusercontent.com/CommunityToolkit/Aspire/main/eng/scripts/dogfood-pr.ps1) } 1501"

@afscrome

afscrome commented Aug 1, 2026

Copy link
Copy Markdown
Contributor

Failing due to NPM conflicts

fail: CommunityToolkit.Aspire.Hosting.JavaScript.Extensions.AppHost.Resources.nx-demo-installer[0]
      2: 2026-08-01T21:25:17.2360000Z npm error code ERESOLVE
fail: CommunityToolkit.Aspire.Hosting.JavaScript.Extensions.AppHost.Resources.nx-demo-installer[0]
      3: 2026-08-01T21:25:17.2360000Z npm error ERESOLVE unable to resolve dependency tree
fail: CommunityToolkit.Aspire.Hosting.JavaScript.Extensions.AppHost.Resources.nx-demo-installer[0]
      4: 2026-08-01T21:25:17.2360000Z npm error
fail: CommunityToolkit.Aspire.Hosting.JavaScript.Extensions.AppHost.Resources.nx-demo-installer[0]
      5: 2026-08-01T21:25:17.2380000Z npm error While resolving: @blog-monorepo/source@0.0.0
fail: CommunityToolkit.Aspire.Hosting.JavaScript.Extensions.AppHost.Resources.nx-demo-installer[0]
      6: 2026-08-01T21:25:17.2380000Z npm error Found: @swc/core@1.5.29
fail: CommunityToolkit.Aspire.Hosting.JavaScript.Extensions.AppHost.Resources.nx-demo-installer[0]
      7: 2026-08-01T21:25:17.2380000Z npm error node_modules/@swc/core
fail: CommunityToolkit.Aspire.Hosting.JavaScript.Extensions.AppHost.Resources.nx-demo-installer[0]
      8: 2026-08-01T21:25:17.2380000Z npm error   dev @swc/core@"~1.5.7" from the root project
fail: CommunityToolkit.Aspire.Hosting.JavaScript.Extensions.AppHost.Resources.nx-demo-installer[0]
      9: 2026-08-01T21:25:17.2380000Z npm error   peer @swc/core@">= 1.4.13" from @swc-node/register@1.9.2
fail: CommunityToolkit.Aspire.Hosting.JavaScript.Extensions.AppHost.Resources.nx-demo-installer[0]
      10: 2026-08-01T21:25:17.2380000Z npm error   node_modules/@swc-node/register
fail: CommunityToolkit.Aspire.Hosting.JavaScript.Extensions.AppHost.Resources.nx-demo-installer[0]
      11: 2026-08-01T21:25:17.2380000Z npm error     dev @swc-node/register@"~1.9.1" from the root project
fail: CommunityToolkit.Aspire.Hosting.JavaScript.Extensions.AppHost.Resources.nx-demo-installer[0]
      12: 2026-08-01T21:25:17.2380000Z npm error
fail: CommunityToolkit.Aspire.Hosting.JavaScript.Extensions.AppHost.Resources.nx-demo-installer[0]
      13: 2026-08-01T21:25:17.2380000Z npm error Could not resolve dependency:
fail: CommunityToolkit.Aspire.Hosting.JavaScript.Extensions.AppHost.Resources.nx-demo-installer[0]
      14: 2026-08-01T21:25:17.2380000Z npm error peerOptional @swc/core@"^1.15.8" from nx@23.1.1
fail: CommunityToolkit.Aspire.Hosting.JavaScript.Extensions.AppHost.Resources.nx-demo-installer[0]
      15: 2026-08-01T21:25:17.2380000Z npm error node_modules/nx
fail: CommunityToolkit.Aspire.Hosting.JavaScript.Extensions.AppHost.Resources.nx-demo-installer[0]
      16: 2026-08-01T21:25:17.2380000Z npm error   dev nx@"23.1.1" from the root project
fail: CommunityToolkit.Aspire.Hosting.JavaScript.Extensions.AppHost.Resources.nx-demo-installer[0]
      17: 2026-08-01T21:25:17.2380000Z npm error
fail: CommunityToolkit.Aspire.Hosting.JavaScript.Extensions.AppHost.Resources.nx-demo-installer[0]
      18: 2026-08-01T21:25:17.2380000Z npm error Fix the upstream dependency conflict, or retry this command with --force or --legacy-peer-deps to accept an incorrect (and potentially broken) dependency resolution.
fail: CommunityToolkit.Aspire.Hosting.JavaScript.Extensions.AppHost.Resources.nx-demo-installer[0]
      19: 2026-08-01T21:25:17.2390000Z npm error
fail: CommunityToolkit.Aspire.Hosting.JavaScript.Extensions.AppHost.Resources.nx-demo-installer[0]
      20: 2026-08-01T21:25:17.2390000Z npm error

@afscrome

afscrome commented Aug 1, 2026

Copy link
Copy Markdown
Contributor

@copilot Can you fix the conflict.

@afscrome
Fix npm dependency conflict in nx-demo: align @nx/* packages and upda…
93da9e4 
…te @swc/core for nx 23.x

Co-authored-by: afscrome <289860+afscrome@users.noreply.github.com>

Copilot AI commented Aug 1, 2026

Copy link
Copy Markdown
Contributor

@copilot Can you fix the conflict.

Fixed in commit. The root cause was that nx was bumped to 23.1.1 but several @nx/* packages were left at 21.x, and nx@23.1.1 has peer dependency requirements for @swc/core@^1.15.8 and @swc-node/register@^1.11.1 that weren't met.

Changes made to examples/javascript-ext/nx-demo/package.json:

  • Updated all @nx/* packages to 23.1.1 to be consistent with nx@23.1.1
  • Updated @swc/core from ~1.5.7 to ~1.15.8 (peer dep required by nx@23.1.1)
  • Updated @swc-node/register from ~1.9.1 to ~1.11.1 (peer dep required by nx@23.1.1)
  • Regenerated package-lock.json

Copilot AI requested a review from afscrome August 1, 2026 21:46
@github-actions

github-actions Bot commented Aug 1, 2026

Copy link
Copy Markdown
Contributor

Code Coverage

Package Line Rate Branch Rate Complexity Health
CommunityToolkit.Aspire.Hosting.DbGate 96% 62% 12 ✔
CommunityToolkit.Aspire.Hosting.JavaScript.Extensions 92% 83% 190 ✔
CommunityToolkit.Aspire.Hosting.MongoDB.Extensions 41% 50% 18 ❌
CommunityToolkit.Aspire.Hosting.MySql.Extensions 25% 21% 44 ❌
CommunityToolkit.Aspire.Hosting.PostgreSQL.Extensions 24% 26% 54 ❌
CommunityToolkit.Aspire.Hosting.Redis.Extensions 41% 32% 22 ❌
CommunityToolkit.Aspire.Hosting.SeaweedFS 88% 80% 49 ✔
CommunityToolkit.Aspire.Hosting.SqlServer.Extensions 23% 18% 48 ❌
CommunityToolkit.Aspire.Hosting.Squad 92% 79% 95 ✔
CommunityToolkit.Aspire.Hosting.Umami 98% 75% 9 ✔
CommunityToolkit.Aspire.SeaweedFS.Client 88% 58% 93 ✔
SeaweedFS.ApiService 100% 100% 15 ✔
Summary 76% (1146 / 1516) 63% (352 / 558) 649 ➖

Copilot AI temporarily deployed to azure-artifacts August 1, 2026 22:24 Inactive
@afscrome
afscrome merged commit c8b006c into main Aug 1, 2026
23 checks passed
@afscrome
afscrome deleted the dependabot/npm_and_yarn/examples/dbgate/CommunityToolkit.Aspire.Hosting.DbGate.AppHost.TypeScript/npm_and_yarn-35745cd8f6 branch August 1, 2026 22:50

This branch was previously deployed

1 inactive deployment
azure-artifacts — 93da9e4c Deployed Aug 1, 2026 by Copilot via publish-azure-artifacts #3518
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@afscrome afscrome afscrome approved these changes
@tamirdresher tamirdresher Awaiting requested review from tamirdresher tamirdresher is a code owner
@Alirexaa Alirexaa Awaiting requested review from Alirexaa Alirexaa is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@afscrome