fix(deps): update npm minor/patch (e2e) by renovate[bot] · Pull Request #563 · CodesWhat/drydock

renovate · 2026-07-20T09:59:55Z

This PR contains the following updates:

Package	Change	Age	Confidence
@cucumber/cucumber	`12.7.0` → `12.9.0`
@dotenvx/dotenvx	`1.57.1` → `1.75.1`
@opentelemetry/core (source)	`2.8.0` → `2.9.0`
artillery	`2.0.32` → `2.0.33`
brace-expansion	`5.0.6` → `5.0.7`
fast-xml-parser	`5.7.3` → `5.10.1`
joi	`18.2.1` → `18.2.3`
minimatch	`10.2.4` → `10.2.5`
picomatch	`4.0.4` → `4.0.5`
postcss (source)	`8.5.10` → `8.5.19`
protobufjs	`7.6.3` → `7.6.5`
socket.io-parser (source)	`4.2.6` → `4.2.7`
uuid	`14.0.0` → `14.0.1`
ws	`8.21.0` → `8.21.1`
yaml (source)	`2.8.3` → `2.9.0`

Release Notes

cucumber/cucumber-js (@cucumber/cucumber)

`v12.9.0`

Compare Source

Added

Emit new publish:url event for plugins (#2808)

`v12.8.3`

Compare Source

Fixed

Handle thrown strings correctly (#2708)
Include assertion info in stack trace (#2803)

`v12.8.2`

Compare Source

Changed

Various dependency updates

`v12.8.1`

Compare Source

Fixed

Resolve dependency issue with junit-xml-formatter and query (junit-xml-formatter#143)

`v12.8.0`

Compare Source

Added

Support custom externalising option (#2780)

dotenvx/dotenvx (@dotenvx/dotenvx)

`v1.75.1`

Compare Source

Changed

Publish as named binaries (#851)

Removed

Remove references to dotenvx-vlt (now dotenvx-armor) (#849)

`v1.75.0`

Compare Source

Changed

Swap in @dotenvx/primitives (#848)
ext commands become first-class(#847)

`v1.74.3`

Compare Source

Changed

Bundle dotenvx with @dotenvx/next-env for user convenience (#845)

`v1.74.2`

Compare Source

Changed

Fix provenance for @dotenvx/next-env (#844)

`v1.74.1`

Compare Source

Added

Add README for @dotenvx/next-env (#843)

`v1.73.1`

Compare Source

Changed

Give update available notification only for armor commands (#840)

`v1.73.0`

Compare Source

Added

Add dotenvx armor commands directly inside dotenvx (#839)

dotenvx remains local-first: armor commands are optional under professional security section

`v1.72.0`

Compare Source

Added

Move armor login command to first class dotenvx login command. (#836)
dotenvx remains local-first: login is optional and only needed when you want Armor features like moving keys off-device, team sharing, and audit access.
Patch 2 high severity dependencies (#837)

`v1.71.3`

Compare Source

Changed

Forward command to Dotenvx Armor Key Guard approvals (#835)

`v1.71.2`

Compare Source

Changed

touch up get, set, and decrypt when armor installed (#834)

`v1.71.1`

Compare Source

Changed

stderr changed to inherit for dotenvx-armor integration (#833)

`v1.71.0`

Compare Source

Added

Add optional automation --token support for Armor ⛨ users (#831)

`v1.70.0`

Compare Source

Changed

Dotenvx Ops/Vlt is now Dotenvx Armor ⛨ (#830)

`v1.69.2`

Compare Source

Changed

Minor messaging improvements, especially if using armored keys (#825)

`v1.69.1`

Compare Source

Changed

Internally rename ops to vlt (#823)

`v1.69.0`

Compare Source

Changed

Remove fully-deprecated opsOff option in favor of noOps (#822)

`v1.68.1`

Compare Source

Changed

Pass -f to ops (#821)

`v1.68.0`

Compare Source

Changed

Support ignore option on parse (#820)

`v1.67.0`

Compare Source

Added

Add prompt for local storage vs armored storage (#819)

`v1.66.0`

Compare Source

Added

Add dotenvx doctor (#815)

`v1.65.3`

Compare Source

Changed

Improve spinner message blinking with simpler --no-spinner flag passed to ops (#814)

`v1.65.2`

Compare Source

Changed

Improve spinner message coordination between dotenvx and dotenvx-ops (#813)

`v1.65.1`

Compare Source

Changed

Prompts from ops should bubble up (#812)

`v1.65.0`

Compare Source

Added

Add support for replaceing duplicate keys with different values (#806)

`v1.64.0`

Compare Source

Added

Add optional dotenvx armor command.
- armor up armor private key
- armor down dearmor private key
- armor push push armored key (from .env.keys)
- armor pull pull armored key (into .env.keys)

Move private keys off device and under access control with Dotenvx Ops ⛨. Learn more

`v1.63.0`

Compare Source

Added

Add support for encrypted values passed to --env flag (#804)
Add support for --format=colon in order to support cloudflare's wrangler --var flag format (#804)

`v1.62.0`

Compare Source

Added

Add support for config({ envs }). unlocks simpler cloudflare worker integration (#803)

$ dotenvx encrypt -f .env.txt

// src/index.js
import envSrc from '../.env.txt'
import dotenvx from '@&#8203;dotenvx/dotenvx'

const config = dotenvx.config({ envs: [{ type: 'env', value: envSrc, privateKeyName: 'DOTENV_PRIVATE_KEY' }] })
const envx = config.parsed

export default {
  async fetch(request, env, ctx) {
    return new Response(`Hello ${envx.HELLO}`)
  }
}

"scripts": {
  "deploy": "wrangler deploy",
  "dev": "wrangler dev --var $(dotenvx keypair -f .env.txt --format=colon)",
  "start": "wrangler dev --var $(dotenvx keypair -f .env.txt --format=colon)",
  "test": "vitest"
},

`v1.61.6`

Compare Source

Changed

Guard against command substitution following encrypted: (#802)

`v1.61.5`

Compare Source

Changed

Support --hostname flag to dotenvx-ops.login (#801)

`v1.61.4`

Compare Source

Changed

Respect SIGINT handler completion (#798)

`v1.61.3`

Compare Source

Changed

Tighten up ext precommit --install message (#797)

`v1.61.2`

Compare Source

Changed

For Ops ⛨ users surface stderr (#796)

`v1.61.1`

Compare Source

Changed

Faster coldstarts! (#781)
Patch dotenvx precommit|prebuild shorthand (#793)

`v1.61.0`

Compare Source

Added

Add login and logout method that proxy to dotenvx-ops login/logout (#780)
Note: dotenvx continues to make zero outgoing HTTP requests and includes no telemetry. Outgoing requests occur only if you explicitly install the dotenvx-ops SDK or CLI.

`v1.60.2`

Compare Source

Changed

Communicate local key and armored key (for Ops stored keys) (#778)

`v1.60.1`

Compare Source

Added

Added missing + key ⛨ for Ops stored keys (#777)

`v1.60.0`

Compare Source

Added

Add spinner with loading messages
- injecting (run)
- encrypting (encrypt, set)
- decrypting (decrypt, get)
- rotating (rotate)
- retrieving (keypair)

`v1.59.1`

Compare Source

Added

add HELLO key to the kit sample to match most of our examples in the README

`v1.59.0`

Compare Source

Changed

encrypt and set now create a .env file if one does not exist (#771)
pass --no-create to prevent file creation

`v1.58.0`

Compare Source

Changed

Changed runtime injection message to format ⟐ injecting env (N) from FILE · dotenvx@VERSION (#770)

`v1.57.5`

Compare Source

Changes

Improve already installed message (#768)

`v1.57.4`

Compare Source

Changes

Use curl example for install dotenvx.com/ops (#767)

`v1.57.3`

Compare Source

Changes

Simplify installed success message (#766)

`v1.57.2`

Compare Source

Changes

Ran npm audit to update package-lock.json (#763)

open-telemetry/opentelemetry-js (@opentelemetry/core)

`v2.9.0`

Compare Source

💥 Breaking Changes

docs(shim-opentracing): Notice: The @opentelemetry/shim-opentracing package will be removed in SDK 3.x, planned for approximately September 2026.
- The OpenCensus and OpenTracing compatibility requirements in the OpenTelemetry specification have been deprecated.

🚀 Features

feat(sdk-metrics): add maxExportBatchSize option to PeriodicExportingMetricReader #6655 @psx95
- Optimized PeriodicExportingMetricReader.forceFlush to prevent redundant concurrent export cycles. Concurrent calls to forceFlush will now await any ongoing export and reuse a fresh export cycle if one is started concurrently by another caller. This ensures the latest metrics are always exported efficiently without triggering duplicate collection and export cycles.
feat(sdk-trace): implement span processor metrics #6504 @anuraaga
feat(sdk-trace): add a new "sdk-trace" package to hold the Trace SDK, without environment variable configuration handling that belongs elsewhere #6775 @trentm
- "sdk-trace" will eventually replace all of "sdk-trace-base", "sdk-trace-node", and "sdk-trace-web".
- The BatchSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new BatchSpanProcessor(exporter, { maxQueueSize: 1000 }), after new BatchSpanProcessor({ exporter, maxQueueSize: 1000 }). #6817
- The SimpleSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new SimpleSpanProcessor(exporter), after new SimpleSpanProcessor({ exporter, selfObsMeterProvider: ... }). #6504
feat(sdk-trace): add AlwaysRecordSampler #6188 @majanjua-amzn

🐛 Bug Fixes

fix(propagator-jaeger): do not throw on malformed percent-encoded uber-trace-id / uberctx-* headers during extract @pichlermarc

🏠 Internal

perf(sdk-metrics): defer allocation of HrTime to accumulation creation #6839 @legendecas
chore(*): migrate use of sdk-trace-base and sdk-trace-node to sdk-trace #6851 @trentm
perf(sdk-metrics): optionally capture active context for sync instruments #6848 @legendecas

artilleryio/artillery (artillery)

`v2.0.33`: Artillery v2.0.33

Compare Source

What's changed

Upgrade to Playwright v1.61.0 (#3746)
Replace Falso with Faker.js in fake-data plugin (#3745)

juliangruber/brace-expansion (brace-expansion)

`v5.0.7`

Compare Source

NaturalIntelligence/fast-xml-parser (fast-xml-parser)

`v5.10.1`

Compare Source

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.10.0...v5.10.1

`v5.10.0`

Compare Source

What's Changed

Bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in #849
Bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7 by @dependabot[bot] in #848

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.9.3...v5.10.0

`v5.9.3`

Compare Source

What's Changed

Harden GitHub Actions workflows by @martincostello in #841
GitHub Actions workflow fixes by @martincostello in #844

New Contributors

@martincostello made their first contribution in #841

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.9.2...v5.9.3

update strnum to 2.3.0
- you can set hex, binary, enotation, infinity, unicode
validate unsafe HTML or XML data in doctype entities unsing 'is-unsafe' library. User can override rules by overriding EntityDecoder.

`v5.8.0`: update strnum, FXB. Use xml-naming for DOCTYPE

Compare Source

integrate xml-naming to validate DOCTYPE entity name and notation name (using qname because of backward compatibility)
- This will consider xml-version as well. '1.0' is default
update strnum to 2.3.0
- You can set octal and binary parsing which is by deault off
update fast-xml-builder to 1.2.0
- can sanitize tag names if found invalid
- fix format output

hapijs/joi (joi)

`v18.2.3`

Compare Source

`v18.2.2`

Compare Source

isaacs/minimatch (minimatch)

`v10.2.5`

Compare Source

micromatch/picomatch (picomatch)

`v4.0.5`

Compare Source

postcss/postcss (postcss)

`v8.5.19`

Compare Source

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

`v8.5.18`

Compare Source

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

`v8.5.17`

Compare Source

Fixed Maximum call stack size exceeded error.
Fixed Prototype hijacking for postcss.fromJSON().
Fixed Input#origin() for unmapped end position (by @chatman-media).

`v8.5.16`

Compare Source

Fixed Input#origin() position (by @mizdra).
Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).
Fixed putting parent-less node in nodes of new node (by @MahinAnowar).
Fixed computing offset in positionBy() (by @greymoth-jp).
Fixed rangeBy() on index: 0 (by @sarathfrancis90).

`v8.5.15`

Compare Source

Fixed declaration parsing performance (by @homanp).

`v8.5.14`

Compare Source

Fixed custom syntax regression (by @43081j).

`v8.5.13`

Compare Source

Fixed postcss-scss commend regression.

`v8.5.12`

Compare Source

Fixed reading any file via user-generated CSS.
Added opts.unsafeMap to disable checks.

`v8.5.11`

Compare Source

Fixed nested brackets parsing performance (by @offset).

protobufjs/protobuf.js (protobufjs)

`v7.6.5`: protobufjs: v7.6.5

Compare Source

Bug Fixes

handle EOF during options parsing (#2352) (#2356) (10fba6d)

`v7.6.4`: protobufjs: v7.6.4

Compare Source

Bug Fixes

Reconfigure and speed up CI (#2329) (574f761)
Remove inquire submodule (#2327) (06ddd07)

socketio/socket.io (socket.io-parser)

`v4.2.7`

Compare Source

Bug Fixes

honor toJSON() when deconstructing a binary packet (#5518) (57f1114)
reject binary packets with zero attachments (7c6ef57)

New Contributors

@spokodev made their first contribution in #5518

uuidjs/uuid (uuid)

`v14.0.1`

Compare Source

Bug Fixes

add types condition to node export for moduleResolution bundler (#961) (27ffae5)

websockets/ws (ws)

`v8.21.1`

Compare Source

Bug fixes

Empty fragments are now counted toward the limit (a2f4e7c).
The default values of the maxBufferedChunks and maxFragments options have
been reduced (f197ac6).

eemeli/yaml (yaml)

`v2.9.0`

Compare Source

The changes here are really only patches, but I'm releasing this as a minor version to note a small change to the documentation of parseDocument() and parseAllDocuments(): I've removed the claim that they'll "never throw".

It remains the case that practically all non-malicious inputs will be handled without emitting an error, but there is a decent chance that code paths remain where e.g. a RangeError due to call stack exhaustion can be triggered by malicious inputs. Up to now, I've considered these as security vulnerabilities, and in fact it's the only category of error for which yaml CVEs have been issued so far.

Starting from this release, I'll be considering such errors as bugs, but not vulnerabilities. I do welcome people and/or LLMs looking for them, but please report them as normal issues rather than suspected security vulnerabilities. This also applies to previously undiscovered bugs in earlier releases.

fix: Avoid calling Array.prototype.push.apply() with large source array
fix(lexer): Avoid recursive calls that may exhaust the call stack

`v2.8.4`

Compare Source

Disable alias resolution with maxAliasCount:0 (#677)
Handle invalid unicode escapes (e1a1a77)
Apply minFractionDigits only to decimal strings (#676)

Configuration

📅 Schedule: (in timezone America/New_York)

Branch creation
- "before 6am on monday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

vercel · 2026-07-20T10:00:00Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
drydock-website	Ready	Preview, Comment	Jul 20, 2026 10:04am
drydockdemo-website	Ready	Preview, Comment	Jul 20, 2026 10:04am

fix(deps): update npm minor/patch (e2e)

c1b44b4

renovate Bot requested a review from scttbnsn as a code owner July 20, 2026 09:59

renovate Bot added the dependencies Pull requests that update a dependency file label Jul 20, 2026

renovate Bot requested review from ALARGECOMPANY and biggest-littlest as code owners July 20, 2026 09:59

renovate Bot added the dependencies Pull requests that update a dependency file label Jul 20, 2026

vercel Bot deployed to Preview – drydockdemo-website July 20, 2026 10:02 View deployment

vercel Bot deployed to Preview – drydock-website July 20, 2026 10:04 View deployment

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(deps): update npm minor/patch (e2e)#563

fix(deps): update npm minor/patch (e2e)#563
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-minor-patch-e2e

renovate Bot commented Jul 20, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Jul 20, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Uh oh!

Conversation

renovate Bot commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Added

Fixed

Changed

Fixed

Added

Changed

Removed

Changed

Changed

Changed

Added

Changed

Added

Added

Changed

Changed

Changed

Added

Changed

Changed

Changed

Changed

Changed

Changed

Added

Added

Changed

Changed

Changed

Added

Added

Added

Added

Changed

Changed

Changed

Changed

Changed

Changed

Added

Changed

Added

Added

Added

Changed

Changed

Changes

Changes

Changes

Changes

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

🏠 Internal

v2.0.33: Artillery v2.0.33

What's changed

What's Changed

What's Changed

New Contributors

v5.9.0: update strnum, use is-unsafe

v5.8.0: update strnum, FXB. Use xml-naming for DOCTYPE

v7.6.5: protobufjs: v7.6.5

Bug Fixes

v7.6.4: protobufjs: v7.6.4

Bug Fixes

Bug Fixes

New Contributors

renovate Bot commented Jul 20, 2026 •

edited

Loading

`v2.0.33`: Artillery v2.0.33

`v5.9.0`: update strnum, use is-unsafe

`v5.8.0`: update strnum, FXB. Use xml-naming for DOCTYPE

`v7.6.5`: protobufjs: v7.6.5

`v7.6.4`: protobufjs: v7.6.4