Skip to content

Bump the global group across 1 directory with 3 updates - #127

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/global-613f47b011
Open

Bump the global group across 1 directory with 3 updates#127
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/global-613f47b011

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 14, 2026 •
edited by cursor Bot
Loading

Copy link
Copy Markdown
Contributor

Bumps the global group with 3 updates in the / directory: axios, chia-wallet-sdk and dotenv.

Updates axios from 1.18.1 to 1.21.0

Release notes

Sourced from axios's releases.

v1.21.0 — October 21, 2026

This release adds response timing and opt-in UTF-8 Basic authentication, improves request handling across runtimes, and changes how header defaults are recognized.

⚠️ Breaking Changes & Deprecations

  • Header Defaults: Only plain objects, null-prototype maps, and compatible AxiosHeaders instances are treated as common or method-specific defaults; literal headers such as Link are now preserved. Applications using custom class instances as defaults must convert them to plain maps, for example { post: { ...customDefaults } }, or compatible AxiosHeaders. Otherwise, those instances become literal header values, including on requests using other methods. (#11156)

🚀 New Features

  • Response Timing: Added response.duration, in milliseconds, including on error.response when present. Timing measures adapter execution and excludes interceptors and transforms; streamed responses stop timing when the stream becomes available. Axios replaces any existing duration value supplied by a custom adapter. (#11214)
  • UTF-8 Basic Authentication: Added transitional.encodeBasicAuthUsername: true to support Unicode usernames in XHR and Fetch requests. The option defaults to false, preserving existing authentication behavior; applications opting in should supply the original Unicode username and remove manual pre-encoding workarounds. (#11159)

🐛 Bug Fixes

  • Fetch Compatibility: Restored requests in runtimes such as Cloudflare Workers that reject the implicit cache: 'default', while preserving explicit caller settings. Response-size failures now retain their original ERR_BAD_RESPONSE and request context when runtime wrappers replace the underlying stream error. (#11194, #11179)
  • Runtime Consistency: Aligned encoded-byte size accounting, multipart uploads, proxy routing, same-origin resolution, parameter merging, and form serialization across adapters. Circular parameters now reject with ERR_BAD_OPTION_VALUE, and sparse or non-index numeric form fields serialize as keyed objects. With proxy: false, native proxyEnv agents using unsupported pool-management or TLS-session lifecycle overrides now reject with ERR_BAD_OPTION_VALUE; construct those agents without proxyEnv. (#11242)
  • Header Handling: Preserved headers named __proto__ using safe casing without changing the AxiosHeaders instance prototype. Function matchers in has(), delete(), and clear() now receive the headers instance as this, matching their declared contract. (#11134, #11216)
  • URL and Data URL Parsing: Accepted case-insensitive supported URL schemes and Base64 markers, and corrected decoding of percent-encoded Base64 data URLs. Node data URL allocation estimates remain aligned with decoding so configured size limits apply before allocation. (#11138, #11163, #11294)
  • Error Diagnostics: Preserved short reconstructed request stacks and appended wrapped error stacks under Caused by: so tooling that reads only error.stack retains the original failure context. (#11132, #11142)
  • Interceptor Removal: Restored removal through canonical numeric-string interceptor IDs, including after registry compaction. (#11139)
  • Proxy TLS: HTTPS CONNECT tunnels now apply current origin TLS options from an explicit httpsAgent, or from https.globalAgent when no explicit agent is supplied. This preserves process-wide custom CA settings through proxy tunnels. (#11178)
  • XHR Lifecycle: Used asynchronous Cookie Store reads for XSRF tokens where supported, preserving cookie fallback, timeout accounting, and cancellation. Upload and download progress listeners are now removed on completion, failure, timeout, and cancellation. (#11166, #11225)
  • HTTP/2 Sessions: Stopped reusing sessions immediately after GOAWAY and prevented draining sessions from scheduling idle timers that could delay process exit. (#11210)
  • TypeScript Declarations: Exposed the response-default marker as a public type to resolve TS2527 when consumers emit declarations involving unresolved response generics, covering both ESM and CommonJS. (#11125)

🔧 Maintenance & Chores

  • Configuration Performance: Reduced request configuration merge overhead, particularly for requests with many headers, while preserving merge semantics and prototype-pollution guards. (#11208)
  • Same-Origin Checks: Removed obsolete Internet Explorer detection without changing origin decisions in supported environments. (#11174)
  • Dependencies: Updated follow-redirects to 1.16.1 and refreshed development, documentation, test, and GitHub Actions dependencies. Removed unused dayjs from the docs package, root chalk, and chai from CJS module tests. (#11169, #11188, #11189, #11195, #11212, #11213, #11218, #11220, #11221, #11230, #11234, #11244, #11245, #11266, #11267, #11268, #11269, #11270, #11271, #11272, #11298, #11302, #11303, #11304, #11305, #11306, #11313, #11321, #11322, #11323, #11342)
  • Documentation: Fixed interceptor test links, updated README CDN examples to the published 1.20.0 bundle, and corrected guidance on interceptor options and request lifecycle ordering. (#11228, #11149, #11335)
  • Contributor Workflow: Consolidated agent instructions in AGENTS.md, standardized PR labels, required prerelease notes and validation evidence, and clarified that npm test requires installed Playwright browsers. (#11238, #11273, #11223, #11284)
  • Sponsors and Support: Added HeroDevs, Code for Japan, and Sweepico sponsor listings, refreshed sponsor data, and documented extended security support for Axios v0. (#11222, #11249, #11252, #11341)
  • Proxy Regression Coverage: Added a long dotted request-hostname test for NO_PROXY handling, extending coverage of an existing denial-of-service fix. (#11235)
  • Release Preparation: Updated package version metadata for 1.21.0. (#11346)

🌟 New Contributors

Welcome to our 24 new contributors. Thank you for helping improve Axios:

... (truncated)

Changelog

Sourced from axios's changelog.

v1.21.0 — October 21, 2026

This release adds response timing and opt-in UTF-8 Basic authentication, improves request handling across runtimes, and changes how header defaults are recognized.

⚠️ Breaking Changes & Deprecations

  • Header Defaults: Only plain objects, null-prototype maps, and compatible AxiosHeaders instances are treated as common or method-specific defaults; literal headers such as Link are now preserved. Applications using custom class instances as defaults must convert them to plain maps, for example { post: { ...customDefaults } }, or compatible AxiosHeaders. Otherwise, those instances become literal header values, including on requests using other methods. (#11156)

🚀 New Features

  • Response Timing: Added response.duration, in milliseconds, including on error.response when present. Timing measures adapter execution and excludes interceptors and transforms; streamed responses stop timing when the stream becomes available. Axios replaces any existing duration value supplied by a custom adapter. (#11214)
  • UTF-8 Basic Authentication: Added transitional.encodeBasicAuthUsername: true to support Unicode usernames in XHR and Fetch requests. The option defaults to false, preserving existing authentication behavior; applications opting in should supply the original Unicode username and remove manual pre-encoding workarounds. (#11159)

🐛 Bug Fixes

  • Fetch Compatibility: Restored requests in runtimes such as Cloudflare Workers that reject the implicit cache: 'default', while preserving explicit caller settings. Response-size failures now retain their original ERR_BAD_RESPONSE and request context when runtime wrappers replace the underlying stream error. (#11194, #11179)
  • Runtime Consistency: Aligned encoded-byte size accounting, multipart uploads, proxy routing, same-origin resolution, parameter merging, and form serialization across adapters. Circular parameters now reject with ERR_BAD_OPTION_VALUE, and sparse or non-index numeric form fields serialize as keyed objects. With proxy: false, native proxyEnv agents using unsupported pool-management or TLS-session lifecycle overrides now reject with ERR_BAD_OPTION_VALUE; construct those agents without proxyEnv. (#11242)
  • Header Handling: Preserved headers named __proto__ using safe casing without changing the AxiosHeaders instance prototype. Function matchers in has(), delete(), and clear() now receive the headers instance as this, matching their declared contract. (#11134, #11216)
  • URL and Data URL Parsing: Accepted case-insensitive supported URL schemes and Base64 markers, and corrected decoding of percent-encoded Base64 data URLs. Node data URL allocation estimates remain aligned with decoding so configured size limits apply before allocation. (#11138, #11163, #11294)
  • Error Diagnostics: Preserved short reconstructed request stacks and appended wrapped error stacks under Caused by: so tooling that reads only error.stack retains the original failure context. (#11132, #11142)
  • Interceptor Removal: Restored removal through canonical numeric-string interceptor IDs, including after registry compaction. (#11139)
  • Proxy TLS: HTTPS CONNECT tunnels now apply current origin TLS options from an explicit httpsAgent, or from https.globalAgent when no explicit agent is supplied. This preserves process-wide custom CA settings through proxy tunnels. (#11178)
  • XHR Lifecycle: Used asynchronous Cookie Store reads for XSRF tokens where supported, preserving cookie fallback, timeout accounting, and cancellation. Upload and download progress listeners are now removed on completion, failure, timeout, and cancellation. (#11166, #11225)
  • HTTP/2 Sessions: Stopped reusing sessions immediately after GOAWAY and prevented draining sessions from scheduling idle timers that could delay process exit. (#11210)
  • TypeScript Declarations: Exposed the response-default marker as a public type to resolve TS2527 when consumers emit declarations involving unresolved response generics, covering both ESM and CommonJS. (#11125)

🔧 Maintenance & Chores

  • Configuration Performance: Reduced request configuration merge overhead, particularly for requests with many headers, while preserving merge semantics and prototype-pollution guards. (#11208)
  • Same-Origin Checks: Removed obsolete Internet Explorer detection without changing origin decisions in supported environments. (#11174)
  • Dependencies: Updated follow-redirects to 1.16.1 and refreshed development, documentation, test, and GitHub Actions dependencies. Removed unused dayjs from the docs package, root chalk, and chai from CJS module tests. (#11169, #11188, #11189, #11195, #11212, #11213, #11218, #11220, #11221, #11230, #11234, #11244, #11245, #11266, #11267, #11268, #11269, #11270, #11271, #11272, #11298, #11302, #11303, #11304, #11305, #11306, #11313, #11321, #11322, #11323, #11342)
  • Documentation: Fixed interceptor test links, updated README CDN examples to the published 1.20.0 bundle, and corrected guidance on interceptor options and request lifecycle ordering. (#11228, #11149, #11335)
  • Contributor Workflow: Consolidated agent instructions in AGENTS.md, standardized PR labels, required prerelease notes and validation evidence, and clarified that npm test requires installed Playwright browsers. (#11238, #11273, #11223, #11284)
  • Sponsors and Support: Added HeroDevs, Code for Japan, and Sweepico sponsor listings, refreshed sponsor data, and documented extended security support for Axios v0. (#11222, #11249, #11252, #11341)
  • Proxy Regression Coverage: Added a long dotted request-hostname test for NO_PROXY handling, extending coverage of an existing denial-of-service fix. (#11235)
  • Release Preparation: Updated package version metadata for 1.21.0. (#11346)

🌟 New Contributors

Welcome to our 24 new contributors. Thank you for helping improve Axios:

... (truncated)

Commits
  • aa54a5e docs: remove cancelled sponsors from README (#11369)
  • e6b79d9 chore(release): prepare release 1.21.0 (#11346)
  • fceeb10 chore(deps-dev): bump the development_dependencies group with 4 updates (#11342)
  • 7d15df3 docs: refresh sponsor data (#11341)
  • 8d8e844 docs: correct interceptor options and request lifecycle guide (#11335)
  • 326843a test(no-proxy): cover the request-hostname path with a long dotted host (#11235)
  • e5195ec feat(core): expose request duration on the response (#11214)
  • 8d415e6 fix(headers): bind matcher callbacks to the headers instance (#11216)
  • b16dd77 fix(xhr): remove progress event listeners on request completion (#11225)
  • 790b2ca chore(deps): bump the github-actions group with 3 updates (#11323)
  • Additional commits viewable in compare view

Updates chia-wallet-sdk from 0.23.0 to 0.37.1

Release notes

Sourced from chia-wallet-sdk's releases.

0.37.1

What's Changed

Full Changelog: xch-dev/chia-wallet-sdk@0.37.0...0.37.1

0.37.0

What's Changed

... (truncated)

Commits
  • f1bce9e Bump to 0.37.1 (#502)
  • 604e90b Revert Did::parse_child hint verification to fix clawback DIDs (#498)
  • 7d977ba Refresh README (#497)
  • ca3922f Bump to 0.37.0 (#496)
  • 7253545 Bump the actions-deps group with 5 updates (#491)
  • f7e31dc Update chia, clvmr, chialisp, and rue dependencies (#495)
  • ed584e3 Construct P2ConditionsOrSingleton from the fixed conditions hash (#493)
  • 9f8a3bc Reject old settlement offers and add offer inspection bindings (#482)
  • 6b032a0 Fix napi BigInt word order, catch panics, and range-check numbers in bindings...
  • 85cf6b3 Reject merging revocable and normal CATs in offered coins (#489)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for chia-wallet-sdk since your current version.


Updates dotenv from 16.4.7 to 18.0.9

Changelog

Sourced from dotenv's changelog.

18.0.9 (2026-10-14)

Changed

  • Permit DOTENV_PATH being empty string with the CLI (#1076)

18.0.8 (2026-10-14)

Changed

  • Fast parser should strip appended extra quotes (#1073)
  • Type detail improvement (#1074)

18.0.7 (2026-10-09)

Changed

  • Treat undefined settings like quiet: true as null rather than falsey (#1070)
  • CLI should honor DOTENV_QUIET setting in .env file (#1071)

18.0.6 (2026-10-06)

Changed

  • Use smarter parseBoolean not Boolean() to fix override (#1069)

18.0.5 (2026-09-30)

Changed

  • Fix missing typescript module declaration (#1068)
  • Improve performance for large .env files (#1066)

18.0.4 (2026-09-25)

Changed

  • import dotenv/config should default quiet: true (#1063)

18.0.3 (2026-09-22)

Changed

  • Patch DOTENV_QUIET setting when inside .env file (#1059)

18.0.2 (2026-09-21)

Changed

  • Patch additional edge cases for the fast parser (#1056)

... (truncated)

Commits
  • 8d1ab85 18.0.9
  • 59a40ce changelog
  • 88228bd Merge pull request #1076 from Enesuygurs/fix/cli-empty-dotenv-path
  • bc6ef94 fix(cli): load the default .env when DOTENV_PATH is empty
  • 6d6e6c5 Merge pull request #1075 from kory-kaai/test/fast-parser-branch-coverage
  • 10218f1 test(parse-fast): cover the size-dependent and export-prefix branches
  • e2fe95e 18.0.8
  • 7aa712a type detail improvement
  • 53405b0 Merge pull request #1074 from himanshu748/codex/fix-dotenv-populate-undefined...
  • 0b4843a changelog
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Note

Medium Risk
Large chia-wallet-sdk semver jump and axios header-default breaking change can affect wallet/signing and HTTP calls; no application code changes in the diff.

Overview
Bumps three runtime dependencies in package.json and refreshes pnpm-lock.yaml to match.

axios moves from ^1.18.1 to ^1.21.0 (lockfile also picks up follow-redirects 1.16.3). Worth noting if anything relies on custom header-default objects: v1.21.0 only treats plain objects, null-prototype maps, and compatible AxiosHeaders as defaults.

chia-wallet-sdk jumps from ^0.23.0 to ^0.37.1, including updated platform-specific optional packages in the lockfile. The example app still imports the same surface (Mnemonic, SecretKey, SpendBundle, encodeOffer, etc.) in index.js; behavior changes would come from the SDK itself, not from this repo.

dotenv is upgraded from ^16.4.7 to ^18.0.9 (major). Usage here is a standard dotenv.config() after require("dotenv").

Reviewed by Cursor Bugbot for commit 775b242. Bugbot is set up for automated code reviews on this repo. Configure here.

@dependabot
Bump the global group across 1 directory with 3 updates
775b242 
Bumps the global group with 3 updates in the / directory: [axios](https://github.com/axios/axios), [chia-wallet-sdk](https://github.com/xch-dev/chia-wallet-sdk) and [dotenv](https://github.com/motdotla/dotenv).


Updates `axios` from 1.18.1 to 1.21.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.18.1...v1.21.0)

Updates `chia-wallet-sdk` from 0.23.0 to 0.37.1
- [Release notes](https://github.com/xch-dev/chia-wallet-sdk/releases)
- [Commits](xch-dev/chia-wallet-sdk@0.23.0...0.37.1)

Updates `dotenv` from 16.4.7 to 18.0.9
- [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md)
- [Commits](motdotla/dotenv@v16.4.7...v18.0.9)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 1.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: global
- dependency-name: chia-wallet-sdk
  dependency-version: 0.37.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: global
- dependency-name: dotenv
  dependency-version: 18.0.9
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: global
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Nov 14, 2026
@dependabot @github

dependabot Bot commented on behalf of github Nov 14, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: Changed, javascript. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

This was referenced Nov 14, 2026
Closed
Closed
Closed
@socket-security

socket-security Bot commented Nov 14, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatednpm/​chia-wallet-sdk@​0.23.0 ⏵ 0.37.174 -210072 +591 -2100
Updatednpm/​axios@​1.18.1 ⏵ 1.21.098 +1100 +7010095100
Updatednpm/​dotenv@​16.4.7 ⏵ 18.0.99910010097100

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants