chore(deps): bump the production-dependencies group across 1 directory with 11 updates

[dependabot]

Bumps the production-dependencies group with 11 updates in the / directory:

Package	From	To
@diplodoc/transform	4.77.1	4.77.2
@gravity-ui/uikit-themer	1.7.0	1.8.1
@inquirer/prompts	8.3.2	8.5.2
execa	9.6.0	9.6.1
js-yaml	4.1.0	4.3.0
katex	0.16.9	0.18.1
lodash	4.17.21	4.18.1
postcss	8.5.15	8.5.21
tapable	2.2.1	2.3.3
ts-dedent	2.2.0	2.3.0
yaml	2.8.1	2.9.0

Updates @diplodoc/transform from 4.77.1 to 4.77.2

Release notes

Sourced from @​diplodoc/transform's releases.

v4.77.2

4.77.2 (2026-07-20)

Bug Fixes

• enable styles for warp buttons with wrap class (47c974f)

Changelog

Sourced from @​diplodoc/transform's changelog.

4.77.2 (2026-07-20)

Bug Fixes

• enable styles for warp buttons with wrap class (47c974f)

Commits

• 8c71700 chore(master): release 4.77.2
• 47c974f fix: enable styles for warp buttons with wrap class
• See full diff in compare view

Updates @gravity-ui/uikit-themer from 1.7.0 to 1.8.1

Release notes

Sourced from @​gravity-ui/uikit-themer's releases.

v1.8.1

1.8.1 (2026-07-16)

Bug Fixes

• DEFAULT_THEME: fix differences from the default theme in uikit (5e73bff)

v1.8.0

1.8.0 (2026-04-21)

Features

• add illustrations colors (fcd1607)
• add utility color refs support for illustration colors and illustration internal refs utils (36ac79d)
• integrate illustration colors into theme generation and parsing (8c431ab)

Bug Fixes

• json parser internal references (020074d)

Changelog

Sourced from @​gravity-ui/uikit-themer's changelog.

1.8.1 (2026-07-16)

Bug Fixes

• DEFAULT_THEME: fix differences from the default theme in uikit (5e73bff)

1.8.0 (2026-04-21)

Features

• add illustrations colors (fcd1607)
• add utility color refs support for illustration colors and illustration internal refs utils (36ac79d)
• integrate illustration colors into theme generation and parsing (8c431ab)

Bug Fixes

• json parser internal references (020074d)

Commits

• 0cfba78 Merge pull request #25 from gravity-ui/release-please--branches--main--compon...
• 9927f33 chore(main): release 1.8.1
• 220ab3b Merge pull request #24 from gravity-ui/fix-uikit-color-diff
• 5e73bff fix(DEFAULT_THEME): fix differences from the default theme in uikit
• 3c2c46d Merge pull request #21 from gravity-ui/release-please--branches--main--compon...
• 4998941 chore(main): release 1.8.0
• 13afb3d Merge pull request #19 from gravity-ui/feat/illustrations-colors
• 36ac79d feat: add utility color refs support for illustration colors and illustration...
• 020074d fix: json parser internal references
• bacc683 Merge pull request #20 from gravity-ui/feat/some-suggestions-to-illustration-...
• Additional commits viewable in compare view

Updates @inquirer/prompts from 8.3.2 to 8.5.2

Release notes

Sourced from @​inquirer/prompts's releases.

@​inquirer/prompts@​8.5.2

• Fix security warnings in external-editor

@​inquirer/prompts@​8.5.1

• Rolled back mute-stream dependency from v4 to v3 to undo breaking compatible engines.
• Added tooling to prevent regression of the above in the future. This surfaced our min engines already enforced a higher limit, so adjusted the explicit limits to match the current state.

@​inquirer/prompts@​8.5.0

• Feat: Read env variable INQUIRER_KEYBINDINGS to enable vim or emacs keybindings; making this a user preference instead of a library author preference. One caveat is doing so disable the search feature in the select prompt. Syntax: INQUIRER_KEYBINDINGS=vim,emacs.
• Fix: Line wraps would sometime cause the cursor to be mispositioned relative to the input.
• Chore: Bump dependencies.

@​inquirer/prompts@​8.4.3

• Fix: Windows rendering bug
• Fix: Preserve exact literal types in choices array (Typescript only)
• Fix: Allow input default value to be of type undefined (Typescript only)
• Bump dependencies

@​inquirer/prompts@​8.4.2

• Fix: some Windows terminals would freeze and not react to keypresses.

@​inquirer/prompts@​8.4.1

• Improve expand prompt type inferrence.

@​inquirer/prompts@​8.4.0

• Feat: Added a loading message while validating editor prompt input.
• Type improvement: Better type inference with checkbox, search and expand prompts.
• Fix: editor prompt not always properly handling editor path on windows.

Commits

• bfd8710 chore: Publish new release
• 55cc5f3 feat: add reusable package lint CLI
• 3af9ed0 test(inquirer): capture prompt runner output
• 4381857 fix(@​inquirer/input): remove stale lint suppression
• 45df331 fix(@​inquirer/external-editor): harden editor temp files
• adef323 chore: limit CI token permissions
• b43359d chore: Publish new release
• 24ecae2 chore: fix yarn.lock
• b078d97 fix: validate package engine compatibility
• 3a49f9f chore(deps-dev): Bump oxfmt in the formatting group (#2143)
• Additional commits viewable in compare view

Updates execa from 9.6.0 to 9.6.1

Release notes

Sourced from execa's releases.

v9.6.1

• Fix VerboseOption type not being properly exported (#1215) 7891c39

---

sindresorhus/execa@v9.6.0...v9.6.1

Commits

• 84e1f36 9.6.1
• 7891c39 Fix VerboseOption type not being properly exported (#1215)
• 103095f Meta tweaks
• 23ec6f0 Fix CI tests related to .kill(0) (#1212)
• 9a2cb79 Meta tweaks
• e7cafeb [docs] TTY control is lost only on the FD that uses mixed inherit. (#1209)
• 5587ae1 Fix CI tests (#1207)
• 3e8fa32 [docs] A process is not a TTY usually, just connected to one. (#1208)
• c468672 [docs] Transforms: Summary: Fix example command and output. (#1206)
• See full diff in compare view

Updates js-yaml from 4.1.0 to 4.3.0

Changelog

Sourced from js-yaml's changelog.

4.3.0, 3.15.0 - 2026-06-27

Security

• Backported maxTotalMergeKeys option.

[5.2.0] - 2026-06-26

Added

• Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.
• Added maxAliases (-1) loader option to limit the number of YAML aliases per document.

Removed

• maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

Fixed

• Round-trip of integers with exponential form (>= 1e21)

[5.1.0] - 2026-06-23

Added

• Collection tags can finalize an incrementally populated carrier into a different result value.

Changed

• [breaking] quoteStyle now selects the preferred quote style; use the restored forceQuotes option to force quoting non-key strings.

[5.0.0] - 2026-06-20

Added

• Added named exports for schemas, tags, parser events and AST utilities.
• Reworked JSON_SCHEMA and CORE_SCHEMA with spec-compliant scalar resolution rules, and added YAML11_SCHEMA.
• Added realMapTag for lossless mappings with non-string and complex keys. Object-based mappings now reject complex keys instead of stringifying them.
• Added dump() transform option for changing the generated AST before rendering.
• Added dump() options seqInlineFirst, flowBracketPadding, flowSkipCommaSpace, flowSkipColonSpace, quoteFlowKeys, quoteStyle and tagBeforeAnchor.
• Added formal data layers (events and AST) for modular data pipelines.
  • Added low-level parser (to events), presenter and visitor APIs.
• Added the YAML Test Suite to the test set.

Changed

• See the migration guide for upgrade notes.
• Rewritten in TypeScript and reorganized the public API around flat named exports.

... (truncated)

Commits

• 33d05b5 4.3.0 released
• 663bfab Drop demo publish, to not override new v5 one.
• 1cb8c7b Add v4-legacy tag for publish
• 02f27af Restore umd builds back to es5
• 8be84ed Fix es5 compatibility
• 59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
• 6842ef6 doc polish
• 590dbab 4.2.0 released
• f944dc5 Add package.json funding field
• f692719 Changelog update
• Additional commits viewable in compare view

Updates katex from 0.16.9 to 0.18.1

Release notes

Sourced from katex's releases.

v0.18.1

0.18.1 (2026-07-19)

Bug Fixes

• htmlData: allow escaped commas in \htmlData (#4236) (87a2b30), closes #4204 #4218

v0.18.0

0.18.0 (2026-07-17)

Features

• prefix css classes (#4229) (6f5c44f)

BREAKING CHANGES

• users who apply custom styles or have allowlists targeting KaTeX's internal classes must update their selectors.

v0.17.0

0.17.0 (2026-05-22)

Performance Improvements

• simplify defineFunction to avoid destructuring, improve typing (#4222) (fb604e6)

BREAKING CHANGES

• The internal API for __defineFunction changed: you should no longer wrap properties in props.

v0.16.47

0.16.47 (2026-05-16)

Bug Fixes

• correct size of [ big delimiter (#4217) (7ba0027), closes #4215

v0.16.46

0.16.46 (2026-05-13)

Bug Fixes

• preserve math font in some styling commands (#4214) (e9ee046), closes #4213

... (truncated)

Changelog

Sourced from katex's changelog.

0.18.1 (2026-07-19)

Bug Fixes

• htmlData: allow escaped commas in \htmlData (#4236) (87a2b30), closes #4204 #4218

0.18.0 (2026-07-17)

Features

• prefix css classes (#4229) (6f5c44f)

BREAKING CHANGES

• users who apply custom styles or have allowlists targeting KaTeX's internal classes must update their selectors.

0.17.0 (2026-05-22)

Performance Improvements

• simplify defineFunction to avoid destructuring, improve typing (#4222) (fb604e6)

BREAKING CHANGES

• The internal API for __defineFunction changed: you should no longer wrap properties in props.

0.16.47 (2026-05-16)

Bug Fixes

• correct size of [ big delimiter (#4217) (7ba0027), closes #4215

0.16.46 (2026-05-13)

Bug Fixes

• preserve math font in some styling commands (#4214) (e9ee046), closes #4213

0.16.45 (2026-04-05)

Bug Fixes

... (truncated)

Commits

• cdf479f chore(release): 0.18.1 [ci skip]
• 87a2b30 fix(htmlData): allow escaped commas in \htmlData (#4236)
• 2318066 chore(deps): bump codecov/codecov-action from 6 to 7 (#4227)
• 3b5b6a0 chore(deps): bump actions/checkout from 6 to 7 (#4232)
• 4e9d31a chore(deps): update dependency js-yaml to v4.2.0 [security] (#4244)
• b7ca8f0 chore(deps): update dependency webpack-dev-server to v5.2.5 [security] (#4242)
• bf1a59f chore: use pixel diff as fallback for byte-to-byte (#4245)
• 4d9d0ae chore(release): 0.18.0 [ci skip]
• 6f5c44f feat: prefix css classes (#4229)
• 2c6143a refactor: remove direct hasOwnProperty call (#4230)
• Additional commits viewable in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates lodash from 4.17.21 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

• lodash: lodash/lodash@4.18.0-npm...4.18.1-npm
• lodash-es: lodash/lodash@4.18.0-es...4.18.1-es
• lodash-amd: lodash/lodash@4.18.0-amd...4.18.1-amd
• lodash.templatelodash/lodash@4.18.0-npm-packages...4.18.1-npm-packages

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

• Add security notice for _.template in threat model and API docs (#6099)
• Document lower > upper behavior in _.random (#6115)
• Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

• lodash.orderby
• lodash.tonumber
• lodash.trim
• lodash.trimend
• lodash.sortedindexby
• lodash.zipobjectdeep
• lodash.unset
• lodash.omit
• lodash.template

Commits

• cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
• 75535f5 chore: prune stale advisory refs (#6170)
• 62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
• 59be2de release(minor): bump to 4.18.0 (#6161)
• af63457 fix: broken tests for _.template 879aaa9
• 1073a76 fix: linting issues
• 879aaa9 fix: validate imports keys in _.template
• fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
• 18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
• b819080 ci: add dist sync validation workflow (#6137)
• Additional commits viewable in compare view

Updates postcss from 8.5.15 to 8.5.21

Release notes

Sourced from postcss's releases.

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @​MahinAnowar).
• Fixed computing offset in positionBy() (by @​greymoth-jp).
• Fixed rangeBy() on index: 0 (by @​sarathfrancis90).

Changelog

Sourced from postcss's changelog.

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @​MahinAnowar).
• Fixed computing offset in positionBy() (by @​greymoth-jp).
• Fixed rangeBy() on index: 0 (by @​sarathfrancis90).

Commits

• 28e0daf Release 8.5.21 version
• 3d2b4e4 Update dependencies
• d197327 Fix childless at-rule losing its semicolon before a comment (#2115)
• 0e360b7 Fix mismatched JSDoc comments on Position (#2114)
• c4ac725 Release 8.5.20 version
• c30586d Fix missing space when AtRule#params is set after parsing (#2113)
• 5bfc3b9 Update dependencies
• 24733fd Move back to latest 11 pnpm
• 728127c Update pnpm to check that CI is fixed
• 806fe21 Rebuild nodes from another PostCSS copy in Warning (#2112)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates tapable from 2.2.1 to 2.3.3

Release notes

Sourced from tapable's releases.

v2.3.3

Patch Changes

• Improved performance in many places. (by @​alexander-akait in #217)

v2.3.2

Patch Changes

• Revert ignore invalid before values. (by @​alexander-akait in #211)

v2.3.1

Patch Changes

• Ignore invalid before values. (by @​alexander-akait in #208)

• Trim the name option when options is an object. (by @​alexander-akait in #208)

v2.3.0

Features

• [TYPES] Added TypedHookMap type.

v2.2.3

Fixes

• Async hook catch an error when reject a falsy value
• [typescript] Support to pass return type for waterfall hooks

v2.2.2

Developer Experience

• add interceptors type to hook class

Changelog

Sourced from tapable's changelog.

2.3.3

Patch Changes

• Improved performance in many places. (by @​alexander-akait in #217)

2.3.2

Patch Changes

• Revert ignore invalid before values. (by @​alexander-akait in #211)

2.3.1

Patch Changes

• Ignore invalid before values. (by @​alexander-akait in #208)

• Trim the name option when options is an object. (by @​alexander-akait in #208)

Commits

• 4296012 chore(release): new release (#222)
• 780b3c0 fix: preserve custom tap options dropped by _tap fast path (#227)
• 5da5021 chore: test refactor + change changelog entry (#226)
• 2ba184c fix(perf): more perf
• 9e9ae4d fix(perf): improve (#224)
• 4e24645 test: improve code coverage with additional test cases
• 2a304ae test: add tinybench benchmarks and CodSpeed CI (#217)
• 0ec6d24 docs: expand API reference to address issue #49 (#221)
• edb1d12 docs: describe each hook class in the README and add small examples
• a2b0d37 chore(deps-dev): bump prettier in the dependencies group (#219)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for tapable since your current version.

Updates ts-dedent from 2.2.0 to 2.3.0

Release notes

Sourced from ts-dedent's releases.

v2.3.0

• Documented the dedent algorithm in the readme with a step-by-step "How it works" section (closes #39)
• Added an automated release workflow: npm publish with provenance via OIDC trusted publishing, GitHub release creation, and automatic version/HISTORY maintenance
• CI now verifies the packaged tarball (CommonJS require, ESM import, and TypeScript type resolution) on every maintained Node version (22/24/26) across Linux, macOS, and Windows
• Fixed package exports to use per-condition types so TypeScript resolves the correct declarations for both ESM (import) and CommonJS (require) consumers
• Declared the ESM build as type: module explicitly and removed the redundant .npmignore
• Updated the CI matrix to currently-maintained Node and OS versions (dropped EOL entries)

v2.3.0-beta.3

• Added an automated release workflow: npm publish with provenance via OIDC trusted publishing, GitHub release creation, and automatic version/HISTORY maintenance
• CI now verifies the packaged tarball (CommonJS require, ESM import, and TypeScript type resolution) on every maintained Node version (22/24/26) across Linux, macOS, and Windows
• Fixed package exports to use per-condition types so TypeScript resolves the correct declarations for both ESM (import) and CommonJS (require) consumers
• Declared the ESM build as type: module explicitly and removed the redundant .npmignore
• Updated the CI matrix to currently-maintained Node and OS versions (dropped EOL entries)

Changelog

Sourced from ts-dedent's changelog.

v2.3.0

• Documented the dedent algorithm in the readme with a step-by-step "How it works" section (closes #39)
• Added an automated release workflow: npm publish with provenance via OIDC trusted publishing, GitHub release creation, and automatic version/HISTORY maintenance
• CI now verifies the packaged tarball (CommonJS require, ESM import, and TypeScript type resolution) on every maintained Node version (22/24/26) across Linux, macOS, and Windows
• Fixed package exports to use per-condition types so TypeScript resolves the correct declarations for both ESM (import) and CommonJS (require) consumers
• Declared the ESM build as type: module explicitly and removed the redundant .npmignore
• Updated the CI matrix to currently-maintained Node and OS versions (dropped EOL entries)

v2.2.1

• Fixed typo in readme
• Updated build tools
• Bumped CI test versions

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for ts-dedent since your current version.

Updates yaml from 2.8.1 to 2.9.0

Release notes

Sourced from yaml's releases.

v2.9.0

The changes here are really only patches, but I'm releasing this as a minor version to note a small change to the documentation of parseDocument() and parseAllDocuments(): I've removed the claim that they'll "never throw".

It remains the case that practically all non-malicious inputs will be handled without emitting an error, but there is a decent chance that code paths remain where e.g. a RangeError due to call stack exhaustion can be triggered by malicious inputs. Up to now, I've considered these as security vulnerabilities, and in fact it's the only category of error for which yaml CVEs have been issued so far.

Starting from this release, I'll be considering such errors as bugs, but not vulnerabilities. I do welcome people and/or LLMs looking for them, but please report them as normal issues rather than suspected security vulnerabilities. This also applies to previously undiscovered bugs in earlier releases.

• fix: Avoid calling Array.prototype.push.apply() with large source array
• fix(lexer): Avoid recursive calls that may exhaust the call stack

v2.8.4

• Disable alias resolution with maxAliasCount:0 (#677)
• Handle invalid unicode escapes (e1a1a77)
• Apply minFractionDigits only to decimal strings (#676)

v2.8.3

• Add trailingComma ToString option for multiline flow formatting (#670)
• Catch stack overflow during node composition (1e84ebb)

v2.8.2

• Serialize -0 as -0 (#638)
• Do not double newlines for empty map values (#642)

Commits

• ddb21b0 2.9.0
• 167365b docs: Clarify that not all errors can be avoided
• 6eca2a7 fix: Avoid calling Array.prototype.push.apply() with large source array
• 0543cd5 fix(lexer): Avoid recursive calls that may exhaust the call stack
• ccdf743 2.8.4
• f625789 fix: Disable alias resolution with maxAliasCount:0 (#677)
• e1a1a77 fix: Handle invalid unicode escapes
• a163ea0 style: Satify Prettier
• b2a5a6c fix: Apply minFractionDigits only to decimal strings (#676)
• 93c951b chore: Bump JSR version to v2.8.3 (#673)
• Additional commits viewable in compare view

[dependabot]

Labels

The following labels could not be found: dependabot. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.