Skip to content

chore(deps): bump the production-dependencies group across 1 directory with 5 updates - #63

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/app/production-dependencies-dd66b47088
Open

chore(deps): bump the production-dependencies group across 1 directory with 5 updates#63
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/app/production-dependencies-dd66b47088

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 7, 2026

Copy link
Copy Markdown

Bumps the production-dependencies group with 5 updates in the /app directory:

Package From To
better-sqlite3 13.0.1 13.0.3
jose 5.10.0 6.2.10
node-llama-cpp 3.19.1 3.20.0
tesseract.js 5.1.1 7.0.0
undici 8.10.0 8.10.1

Updates better-sqlite3 from 13.0.1 to 13.0.3

Release notes

Sourced from better-sqlite3's releases.

v13.0.3

What's Changed

Full Changelog: WiseLibs/better-sqlite3@v13.0.2...v13.0.3

v13.0.2

What's Changed

New Contributors

Full Changelog: WiseLibs/better-sqlite3@v13.0.1...v13.0.2

Commits

Updates jose from 5.10.0 to 6.2.10

Release notes

Sourced from jose's releases.

v6.2.10

Fixes

  • jose: consume serialization members once (9bee285)
  • jose: reject empty protected and JWE AAD members (8da4145)
  • jose: validate serialized header values (b711d8f)
  • jwe: conceal invalid decrypted CEK lengths (41fafe0)
  • jwe: enforce AES-GCM tag boundaries (9a5b744)
  • jwe: validate explicit encryption parameters (7a02697)
  • jwk: accept empty octet-sequence keys (3f871e7)
  • jwk: normalize key resolution inputs (f54ee7b)
  • jwks: enforce verification key metadata (f9ba510)
  • jwks: order overlapping remote reloads (9a1a913)
  • jwks: reject invalid remote duration values (7bdb9e5)
  • jwk: validate ext and key_ops parameters (4d91c37)
  • jws: reject mixed payload encoding modes (dc69713)
  • jws: validate unencoded payload strings (541f282)
  • jwt: enforce explicit verification policies (b347182)
  • jwt: prevent replacing protected headers (ae07d09)
  • jwt: reject invalid duration inputs (282f9aa)
  • jwt: validate builder claim values (ea03f83)
  • jwt: validate unsecured protected headers (230c14e)
  • key: validate generation and import options (15d880e)
  • reject mixed b64 modes for empty General JWS payloads (61a2ef7)
  • x509: reject DER truncated past its outer length (d8db9f6)

Documentation

  • jwks: correct cache timestamp units (01a44d9)

Refactor

  • jose: share binary input validation (eedb124)
  • jose: share compact token processing internals (85e30ed)
  • jwe: consolidate CBC decryption failures (1ee6f61)
  • jwe: specialize compact processing (a998927)
  • jwe: streamline single-recipient encryption (290aaa6)
  • jwks: compact JWK Set shape validation (930c7df), references Array#every
  • jwks: compact local key selection (4cb5ae5)
  • jwks: compact remote resolver state (ef5eaf4)
  • jws: specialize compact processing (021abf4)
  • jwt: compact claim validation helpers (f390683)
  • jwt: consolidate replicated claim checks (7dd5591)
  • jwt: share producer claim state (52ba159)
  • key: compact JWK algorithm selection (a6b29da)
  • key: compact secret length parsing (cc03be8)

v6.2.9

Fixes

... (truncated)

Changelog

Sourced from jose's changelog.

6.2.10 (2026-08-21)

Fixes

  • jose: consume serialization members once (9bee285)
  • jose: reject empty protected and JWE AAD members (8da4145)
  • jose: validate serialized header values (b711d8f)
  • jwe: conceal invalid decrypted CEK lengths (41fafe0)
  • jwe: enforce AES-GCM tag boundaries (9a5b744)
  • jwe: validate explicit encryption parameters (7a02697)
  • jwk: accept empty octet-sequence keys (3f871e7)
  • jwk: normalize key resolution inputs (f54ee7b)
  • jwks: enforce verification key metadata (f9ba510)
  • jwks: order overlapping remote reloads (9a1a913)
  • jwks: reject invalid remote duration values (7bdb9e5)
  • jwk: validate ext and key_ops parameters (4d91c37)
  • jws: reject mixed payload encoding modes (dc69713)
  • jws: validate unencoded payload strings (541f282)
  • jwt: enforce explicit verification policies (b347182)
  • jwt: prevent replacing protected headers (ae07d09)
  • jwt: reject invalid duration inputs (282f9aa)
  • jwt: validate builder claim values (ea03f83)
  • jwt: validate unsecured protected headers (230c14e)
  • key: validate generation and import options (15d880e)
  • reject mixed b64 modes for empty General JWS payloads (61a2ef7)
  • x509: reject DER truncated past its outer length (d8db9f6)

Documentation

  • jwks: correct cache timestamp units (01a44d9)

Refactor

  • jose: share binary input validation (eedb124)
  • jose: share compact token processing internals (85e30ed)
  • jwe: consolidate CBC decryption failures (1ee6f61)
  • jwe: specialize compact processing (a998927)
  • jwe: streamline single-recipient encryption (290aaa6)
  • jwks: compact JWK Set shape validation (930c7df), references Array#every
  • jwks: compact local key selection (4cb5ae5)
  • jwks: compact remote resolver state (ef5eaf4)
  • jws: specialize compact processing (021abf4)
  • jwt: compact claim validation helpers (f390683)
  • jwt: consolidate replicated claim checks (7dd5591)
  • jwt: share producer claim state (52ba159)
  • key: compact JWK algorithm selection (a6b29da)
  • key: compact secret length parsing (cc03be8)

6.2.9 (2026-08-15)

... (truncated)

Commits
  • 3eab152 chore(release): 6.2.10
  • 021abf4 refactor(jws): specialize compact processing
  • a998927 refactor(jwe): specialize compact processing
  • eedb124 refactor(jose): share binary input validation
  • 52ba159 refactor(jwt): share producer claim state
  • 85e30ed refactor(jose): share compact token processing internals
  • 0bd81d2 test(jose): cover hidden critical-header options
  • 9cf7876 test(jose): reject callable object impostors
  • f23cafd test(jose): preserve resolved key data properties
  • 1ee6f61 refactor(jwe): consolidate CBC decryption failures
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for jose since your current version.


Updates node-llama-cpp from 3.19.1 to 3.20.0

Release notes

Sourced from node-llama-cpp's releases.

v3.20.0

3.20.0 (2026-08-11)

Features

  • Muse Glimmer support (#639) (adb92f2)
  • improve thought segments syntax extraction (#636) (3f686d7)
  • expose download speed and ETA for a model downloader (#636) (3f686d7)
  • expose the model's architecture directly on the model instance (#636) (3f686d7)
  • inspect gpu command: print model parameters count (#639) (adb92f2)

Bug Fixes

  • adapt to breaking llama.cpp changes (#636) (3f686d7)
  • LlamaContextSequence: make .dispose() return a promise (#636) (3f686d7)
  • Qwen chat wrapper auto thought segment opening (#636) (3f686d7)
  • optimize checkpoints with auto opening thought segments (#636) (3f686d7)
  • simulator model dispose while in use race conditions (#636) (3f686d7)
  • Vulkan device memory readings (#636) (3f686d7)
  • topP config when using temperature (#639) (adb92f2)
  • support more quant labels (#639) (adb92f2)

Shipped with llama.cpp release b10361

To use the latest llama.cpp release available, run npx -n node-llama-cpp source download --release latest. (learn more)

Commits

Updates tesseract.js from 5.1.1 to 7.0.0

Release notes

Sourced from tesseract.js's releases.

v7.0.0

What's Changed

  • Significant improvements to recognition speed (by @​fanchenkong1 in naptha/tesseract.js#1039)
    • A new relaxedsimd build takes advantage of the latest WASM and hardware capabilities.
    • Upgrading from v6 to v7 reduces runtimes by ~15-35% (depending on device and use-case). The highest uplifts are currently seen on the latest Intel processors.
  • Dropped support for Node.js v14.
  • Various minor changes

New Contributors

Full Changelog: naptha/tesseract.js@v6.0.1...v7.0.0

v6.0.1

What's Changed

  • Switched from using node-fetch to using built-in fetch implementation for Node.js v18 and newer.
    • This resolves a nuisance dependency-related warning message reported in #876
  • Various minor updates

Full Changelog: naptha/tesseract.js@v6.0.0...v6.0.1

v6.0.0

What's Changed

  • Fixed memory leaks (#977)
    • This version fixed a long-standing issue where memory would rise over time, eventually leading to a crash.
  • Reduced runtime and memory usage for most users by updating default formats (#916).
  • Fixed compatibility with Electron main process (#925)
  • Fixed bug where user-provided parameters were overwritten by defaults (#975).

Breaking Changes

  1. All outputs formats other than text are now disabled by default.
    • To re-enable the hocr output (for example), set the following: worker.recognize(image, {}, { hocr: true })
      • See here for a list of possible output formats.
  2. The JavaScript object output format (blocks) was tweaked.
    • Only the array of blocks (blocks) is returned.
      • Previous versions would automatically generate lists of every unit of text (words, symbols, etc.).
        • If needed, these should now be generated by the user.
    • Only text-based blocks are reported.
      • Previous versions reported non-text blocks when detected by Tesseract (e.g. line segments).
    • The shape of some objects were changed.
      • See the type declarations for reference on properties.
      • The main properties--text and bbox--are unchanged.
  3. Various functions and options marked as depreciated previously have been removed.
    1. This includes worker.initialize and worker.loadLanguage, along with several depreciated options from v2.

See #993 for additional discussion about this release.

New Contributors

... (truncated)

Commits

Updates undici from 8.10.0 to 8.10.1

Release notes

Sourced from undici's releases.

v8.10.1

What's Changed

New Contributors

Full Changelog: nodejs/undici@v8.10.0...v8.10.1

Commits
  • ede2a74 Bumped v8.10.1 (#5743)
  • d0389ca test: skip HTTP/2 churn test on Node.js 26 (#5742)
  • 8b00542 fix(agent): preserve pools with pending GOAWAY replays (#5740)
  • c32ea13 fix(h2): forward 1xx informational responses to onInfo (#5712)
  • f474548 test: restore /xhr to the WPT filter (#5723)
  • 3e622dc fix(cache): evict entries when a key holds a single entry (#5737)
  • fc3450d fix(socks5-proxy-agent): destroy socket when negotiation times out (#5709)
  • efc4f09 build(deps): bump brace-expansion (#5719)
  • 8726edc build(deps-dev): bump @​fastify/busboy from 3.2.1 to 3.2.2 (#5718)
  • 5033aa1 fix(env-http-proxy-agent): ignore trailing dots when matching no_proxy (#5637)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the production-dependencies group across 1 director…
4655e09 
…y with 5 updates

Bumps the production-dependencies group with 5 updates in the /app directory:

| Package | From | To |
| --- | --- | --- |
| [better-sqlite3](https://github.com/WiseLibs/better-sqlite3) | `13.0.1` | `13.0.3` |
| [jose](https://github.com/panva/jose) | `5.10.0` | `6.2.10` |
| [node-llama-cpp](https://github.com/withcatai/node-llama-cpp) | `3.19.1` | `3.20.0` |
| [tesseract.js](https://github.com/naptha/tesseract.js) | `5.1.1` | `7.0.0` |
| [undici](https://github.com/nodejs/undici) | `8.10.0` | `8.10.1` |



Updates `better-sqlite3` from 13.0.1 to 13.0.3
- [Release notes](https://github.com/WiseLibs/better-sqlite3/releases)
- [Commits](WiseLibs/better-sqlite3@v13.0.1...v13.0.3)

Updates `jose` from 5.10.0 to 6.2.10
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](panva/jose@v5.10.0...v6.2.10)

Updates `node-llama-cpp` from 3.19.1 to 3.20.0
- [Release notes](https://github.com/withcatai/node-llama-cpp/releases)
- [Commits](withcatai/node-llama-cpp@v3.19.1...v3.20.0)

Updates `tesseract.js` from 5.1.1 to 7.0.0
- [Release notes](https://github.com/naptha/tesseract.js/releases)
- [Commits](naptha/tesseract.js@v5.1.1...v7.0.0)

Updates `undici` from 8.10.0 to 8.10.1
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v8.10.0...v8.10.1)

---
updated-dependencies:
- dependency-name: better-sqlite3
  dependency-version: 13.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: jose
  dependency-version: 6.2.10
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: node-llama-cpp
  dependency-version: 3.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: tesseract.js
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: undici
  dependency-version: 8.10.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 7, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants