chore(deps): bump the minor group with 18 updates

[dependabot]

Bumps the minor group with 18 updates:

Package	From	To
mint	4.2.782	4.2.802
@mintlify/cli	4.0.1385	4.0.1405
@mintlify/common	1.0.1076	1.0.1091
next-mdx-remote-client	2.1.11	2.1.12
@mintlify/link-rot	3.0.1273	3.0.1291
@mintlify/models	0.0.346	0.0.348
@mintlify/prebuild	1.0.1227	1.0.1244
@mintlify/previewing	4.0.1297	4.0.1315
@mintlify/scraping	4.0.943	4.0.959
@mintlify/validation	0.1.821	0.1.828
adm-zip	0.5.16	0.6.0
axios	1.16.1	1.18.0
bare-url	2.5.1	2.5.2
fast-xml-builder	1.3.0	1.3.1
oauth4webapi	3.8.6	3.8.7
postcss	8.5.14	8.5.23
strnum	2.4.1	2.4.2
tar	7.5.15	7.5.21

Updates mint from 4.2.782 to 4.2.802

Commits

• See full diff in compare view

Updates @mintlify/cli from 4.0.1385 to 4.0.1405

Commits

• See full diff in compare view

Updates @mintlify/common from 1.0.1076 to 1.0.1091

Commits

• See full diff in compare view

Updates next-mdx-remote-client from 2.1.11 to 2.1.12

Commits

• b26d913 v2.1.12
• 984a8b1 Update dependencies
• 36a3563 Update github action main.yml for fix about installing npm@latest in node 20
• b6b668b Add a new sponsorship into README
• 7a77d57 Remove unncessary esModuleInterop from tsconfig
• ef066ab Update @​types/mdx
• a0411a0 Add a comment for skipLibCheck in tsconfig
• 88945ad Add @​types/jest to fix a type error related with @​testing-library/jest-dom/vi...
• 368bce9 Fix a type error about augmentations for the global scope can only be directl...
• ffcd516 Change moduleResolution to bundler from node in tsconfig to fix some library ...
• See full diff in compare view

Updates @mintlify/link-rot from 3.0.1273 to 3.0.1291

Commits

• See full diff in compare view

Updates @mintlify/models from 0.0.346 to 0.0.348

Commits

• See full diff in compare view

Updates @mintlify/prebuild from 1.0.1227 to 1.0.1244

Commits

• See full diff in compare view

Updates @mintlify/previewing from 4.0.1297 to 4.0.1315

Commits

• See full diff in compare view

Updates @mintlify/scraping from 4.0.943 to 4.0.959

Commits

• See full diff in compare view

Updates @mintlify/validation from 0.1.821 to 0.1.828

Commits

• See full diff in compare view

Updates adm-zip from 0.5.16 to 0.6.0

Changelog

Sourced from adm-zip's changelog.

0.6.0 / 2026-07-10

Security

• Fixed CVE-2026-39244: a crafted archive declaring a huge uncompressed size could force an unbounded Buffer.alloc (memory exhaustion / DoS) before any validation. Allocation is now bounded by the data actually present — STORED output is sized from the real bytes, DEFLATED output is grown by the inflater and capped at the declared size (#568)
• Hardened the internal entry-name lookup table against object injection: entry names come from untrusted archives, and a name such as __proto__ previously resolved to Object.prototype, crashing addFile and hiding the entry from getEntry/readFile. The table is now prototype-less

Bug fixes

• Fixed a regression (0.5.15) that rejected valid archives using a data descriptor (general-purpose bit 3). The payload is now validated against the authoritative central-directory CRC instead of requiring/parsing the trailing descriptor (#548, #533, #554)
• Fixed extractAllTo/extractAllToAsync not restoring directory permissions with keepOriginalPermission; directory modes are applied after their contents are written, deepest path first, and no longer lock the extractor out of a restrictive directory (#530)
• Fixed infinite recursion in addLocalFolder when a folder contains a symlink pointing back to an ancestor (e.g. workspace node_modules); the walk now tracks resolved real paths and skips already-visited directories (#541)
• Fixed an uncaught exception (ERR_INVALID_ARG_TYPE) that crashed the process when writeFileToAsync could not open the target file (bad permissions, invalid filename, exhausted file descriptors); write failures are now reported through the callback and write errors are no longer silently swallowed (#470, #459, #402)
• Fixed directory entries reporting an empty name (e.g. a/b/c/ now returns c) (#466)
• Fixed extractEntryTo flattening subdirectories when maintainEntryPath is false; the structure below the extracted directory is now preserved instead of collapsing (and overwriting) files by basename (#306)
• Fixed a failed utimes aborting extraction; setting the modification time is now best-effort and never fails extraction of already-written content (#379)
• Fixed test() always returning false for any archive containing a file (it indexed the entries array with an entry object instead of reading the entry); it now correctly verifies each entry's CRC

Performance

• Faster entry sorting when writing archives with many entries: names are decoded once instead of on every comparison (about 6× faster sort for large archives)

Added

• Bundled TypeScript type definitions (types.d.ts), so @types/adm-zip is no longer required

Notes

• Behavior change: extractEntryTo(dir, target, /* maintainEntryPath */ false) now preserves subdirectories beneath the extracted directory rather than flattening them
• Behavior change: extraction no longer fails when the modification time cannot be set

0.5.4 / 2021-03-08

• Fixed relative paths
• Added zipcrypto encryption
• Lower verMade for macOS when generating zip file

0.5.3 / 2021-02-07

• Fixed filemode when unzipping

0.5.2 / 2021-01-27

• Fixed path traversal issue (GHSL-2020-198)

0.5.1 / 2020-11-27

• Incremented version (cthackers)
• Fixed outFileName (cthackers)

0.5.0 / 2020-11-19

• Added extra parameter to extractEntryTo so target filename can be renamed (cthackers)

... (truncated)

Commits

• 2b4d840 updated minimum node engine version to >= 14
• dc57f0f Hardened entry-name lookup, fixed test(), and sped up entry sorting
• f81806a Made utimes best-effort so it can't abort extraction (#379)
• ab04324 Fixed extractEntryTo flattening subdirectories (#306)
• 8a5d9ba Fixed empty name for directory entries (#466)
• 3e72790 Fixed uncaught crash in writeFileToAsync on write failure (#470, #459, #402)
• 651ae4c Added typescript types
• e72021d Fixed infinite recursion on symlink loops in addLocalFolder (#541)
• 8f3176b Fixed directory permissions on linux
• 4d2c8f9 Fixed error introduced with zip descriptor checks
• Additional commits viewable in compare view

Updates axios from 1.16.1 to 1.18.0

Changelog

Sourced from axios's changelog.

v1.18.0 — June 13, 2026

This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.

🔒 Security Fixes

• Redirect Header Safety: Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (#10892)

• URL And Request Hardening: Rejects malformed http: and https: URLs that omit // with ERR_INVALID_URL, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local NO_PROXY matching. (#11000)

🐛 Bug Fixes

• Status Validation: Added transitional.validateStatusUndefinedResolves so applications can opt in to treating validateStatus: undefined like the option was omitted, while validateStatus: null remains the explicit way to accept every status. (#10899)

🔧 Maintenance & Chores

• Documentation: Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the proxy request config as Node.js-only in the advanced docs. (#10984, #10988, #10992, #10995)

• Dependencies: Bumped @babel/core, @babel/preset-env, @commitlint/cli, @commitlint/config-conventional, @rollup/plugin-babel, @rollup/plugin-commonjs, @vitest/browser, @vitest/browser-playwright, eslint, lint-staged, rollup, vitest, and actions/checkout. (#10989, #10996, #10997)

• Release Metadata: Prepared the 1.18.0 release by updating package metadata and the runtime VERSION value. (#11003)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

• @​drori12 (#10984)
• @​eyupcanakman (#10899)
• @​Adi-Beker (#10995)

Full Changelog

v1.17.0 — June 1, 2026

This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.

🔒 Security Fixes

• Config Hardening: Guarded socketPath, params, and paramsSerializer reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (#10901, #10922)
• Release Publishing: Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (#10926)

🚀 New Features

• HTTP Compression: Added Node HTTP adapter support for zstd response decompression, with transitional.advertiseZstdAcceptEncoding controlling whether zstd is advertised in Accept-Encoding. (#6792, #10920)

🐛 Bug Fixes

• Authentication Handling: Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (#10929, #10896)
• Proxy TLS: Preserved user httpsAgent TLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (#10957)
• React Native FormData: Cleared default Content-Type for React Native FormData so multipart boundaries can be generated correctly. (#10898)

... (truncated)

Commits

• 2d06f96 chore(release): prepare release 1.18.0 (#11003)
• 32fc489 fix: malformed http urls (#11000)
• b40ce49 chore(deps-dev): bump the development_dependencies group with 10 updates (#10...
• fe964f9 docs: mark proxy config as Node.js only (#10995)
• 5f229d2 chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions ...
• fae9d4e docs: clarify package update PR policy (#10992)
• 28ab2ce chore(deps-dev): bump the development_dependencies group with 2 updates (#10989)
• a8e4f13 fix(core): keep default validateStatus when request passes undefined (#10899)
• 614f455 docs: publish v1.17.0 release notes (#10988)
• 6bb12c1 fix: custom auth headers not stripped on cross-origin redirects (#10892)
• Additional commits viewable in compare view

Updates bare-url from 2.5.1 to 2.5.2

Commits

• b8543f7 2.5.2
• 6c7cfcb Improve overall performance (#34)
• 494f686 Keep URLs up to 1K on the stack (#33)
• 8c69434 Lazily initialize _params (#32)
• d552076 2.5.1 (#31)
• See full diff in compare view

Updates fast-xml-builder from 1.3.0 to 1.3.1

Changelog

Sourced from fast-xml-builder's changelog.

1.3.1 (2026-08-14)

• fix: preserve negative sign for zero (By rajanpanth)

1.3.0 (2026-07-11)

• upgrade:
  • xml-naming v0.3.0: cache support
  • PEM v1.6.2: sibling bug fix

1.2.1 (2026-07-03)

• fix: escape quotes in stopNode attribute values (By greymoth)
• fix: neutralize double hyphen in multi-key comment object (By spokodev)

1.2.0 (2026-05-08)

• Add support for sanitizeName option
• Support xml-naming for validating and sanitizing tag and attribute names

1.1.9 (2026-05-06)

• fix: format output for preserve order when indent by is set to empty string

1.1.8 (2026-05-05)

• fix: skip text property for PI tags
• improve typings

1.1.7 (2026--05-04)

• fix security issues when attribute value contains quotes

1.1.6 (2026--05-04)

• fix security issues related to comment
• skip comment with null value

1.1.5 (2026-04-17)

• fix security issues related to comment and cdata

1.1.4 (2026-03-16)

• support maxNestedTags option

1.1.3 (2026-03-13)

• declare Matcher & Expression as unknown so user is not forced to install path-expression-matcher

1.1.2 (2026-03-11)

• fix typings

1.1.1 (2026-03-11)

• upgrade path-expression-matcher to 1.1.3

1.1.0 (2026-03-10)

... (truncated)

Commits

• d7d1d7b 1.3.1
• c776d83 update for release
• e9e8db6 Merge pull request #22 from rajanpanth/fix/negative-zero-stringify
• 4db0657 fix: preserve negative zero sign when stringifying values
• a27584b npm publish github actions
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for fast-xml-builder since your current version.

Updates oauth4webapi from 3.8.6 to 3.8.7

Changelog

Sourced from oauth4webapi's changelog.

3.8.7 (2026-08-11)

Fixes

• types: expose custom fetch duplex option (0dcd746)
• types: make CryptoKey declarations portable (1c85396)
• types: make JWK declarations interoperable (ff804a8)

Documentation

• improve API index tables (2c4b025)

Commits

• 07f8ea3 chore(release): 3.8.7
• 10f7db8 chore: bump packages
• 0dcd746 fix(types): expose custom fetch duplex option
• ff804a8 fix(types): make JWK declarations interoperable
• 2878847 ci: validate package types and artifacts
• 2c4b025 docs: improve API index tables
• 1c85396 fix(types): make CryptoKey declarations portable
• 61f6679 ci: use shared release workflows
• 6499303 chore: bump packages
• ca67640 ci: use prebuilt conformance suite images
• Additional commits viewable in compare view

Updates postcss from 8.5.14 to 8.5.23

Changelog

Sourced from postcss's changelog.

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @​MahinAnowar).
• Fixed computing offset in positionBy() (by @​greymoth-jp).
• Fixed rangeBy() on index: 0 (by @​sarathfrancis90).

8.5.15

• Fixed declaration parsing performance (by @​homanp).

Commits

• eb9e1fe Release 8.5.23 version
• 9d19c78 Update dependencies
• 7beca13 Does no load source map file without opts.from
• decea51 Typo
• c18e30d Update EM banner
• 98a39ad Update EM banner
• a3e48c4 Release 8.5.22 version
• f49d691 Fix custom property losing its semicolon before a comment (#2117)
• 28e0daf Release 8.5.21 version
• 3d2b4e4 Update dependencies
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates strnum from 2.4.1 to 2.4.2

Changelog

Sourced from strnum's changelog.

2.4.2 / 2026-08-14

• fix: trimZeros to avoid quadratic complexity

2.4.1 / 2026-06-18

• deps: update anynum to 1.0.1

2.4.0 / 2026-06-09

• support unicode numerals using 'anynum'

2.3.0 / 2026-05-07

• support octal and binary, test with @​byspec/numbers
• test with @​byspec/numbers

2.2.3 / 2026-04-07

• remove unnecessary files from npm package

2.2.2 / 2026-03-23

• fix for space string

2.2.1 / 2026-03-19

• fix false positive for eNotation when no leading zeros

2.2.0 / 2026-02-28

• support infinity

2.1.0 / 2025-05-01

• fix e-notation
  • to return string when invalid enotation is found. Eg E24
  • to return valid number when only leading zero before e char is present

2.0.5 / 2025-02-27

• changes done in 1.1.2

1.1.2 / 2025-02-27

• fix skiplike for 0

1.1.1 / 2025-02-21

• All recent fixes of version 2

2.0.4 / 2025-02-20

• remove console log

2.0.3 / 2025-02-20

• fix for string which are falsly identified as e-notation

2.0.1 / 2025-02-20

• fix: handle only zeros

... (truncated)

Commits

• f7828f5 2.4.2
• 2b9249a trimZeros without regex
• 1c55a01 npm publish github action
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for strnum since your current version.

Updates tar from 7.5.15 to 7.5.21

Commits

• 0cd9cc3 7.5.21
• 631ae59 list: prevent unbounded recursion
• ebbb720 7.5.20
• 2f27196 fix: fully disable and dispose of unzip when aborting parser
• be440da 7.5.19
• 2812e93 add maxDecompressionRatio guard against explosive decompression
• 9ecd4d2 7.5.18
• 9e78bf0 refuse to let header size be less than 0
• e02a4e9 pax: parse values according to known types
• 9cbdb31 7.5.17
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions