build(deps): Bump the production-minor-patch group with 5 updates by dependabot[bot] · Pull Request #157 · doublegate/CyberChef-MCP

dependabot · 2026-10-11T06:14:52Z

Bumps the production-minor-patch group with 5 updates:

Package	From	To
cbor2	`2.3.0`	`2.4.0`
js-yaml	`5.4.2`	`5.4.3`
moment-timezone	`0.6.4`	`0.6.5`
pino	`10.3.1`	`10.4.0`
xpath	`0.0.34`	`0.0.35`

Updates cbor2 from 2.3.0 to 2.4.0

Release notes

Sourced from cbor2's releases.

v2.4.0

What's Changed

Update dev dependencies by @hildjj in hildjj/cbor2#107

Update dependencies. Fix new lints. Skip firefox testing for the moment due to playwright issues with ignoreHTTPSerrors by @hildjj in hildjj/cbor2#109

Increase performance of decoding larger bigints by @hildjj in hildjj/cbor2#110

Use new native Uint8Array's fromHex and toHex when available by @Zwyx in hildjj/cbor2#108

Use native fromBase64 if possible, instead of atob. by @hildjj in hildjj/cbor2#111

FEATURE: maxBigIntBytes by @v0xyc0n, finished in hildjj/cbor2#112

New Contributors

@Zwyx made their first contribution in hildjj/cbor2#108

Full Changelog: hildjj/cbor2@v2.3.0...v2.4.0

Commits

c846bed 2.4.0
2aef705 Merge pull request #112 from hildjj/test-coverage
3c735be lint
f4d51f0 Move maxBigIntBytes checking to initialization time.
572e625 Add test coverage for maxBigIntBytes
99c36e5 Merge commit from fork
8cea8c4 Merge branch 'main' into main
6873a81 Merge pull request #111 from hildjj/native-base64
26a82f6 Use native fromBase64 if possible, instead of atob.
b25d827 Merge pull request #108 from Zwyx/use-native-u8-from-to-hex
Additional commits viewable in compare view

Updates js-yaml from 5.4.2 to 5.4.3

Changelog

Sourced from js-yaml's changelog.

[5.4.3] - 2026-10-06

Fixed

Fixed loading a whitespace-only block scalar followed by a less indented line, #802.

Commits

7832624 5.4.3 released
0cbb471 Fix whitespace-only block scalar followed by a less indented line, close #802
30108cc Parse the first block mapping key once (#800)
See full diff in compare view

Updates moment-timezone from 0.6.4 to 0.6.5

Release notes

Sourced from moment-timezone's releases.

Release 0.6.5

Updated data to IANA TZDB 2026e. #1165

Changelog

Sourced from moment-timezone's changelog.

0.6.5 2026-10-02

Updated data to IANA TZDB 2026e. #1165

Commits

fe4e852 Bump version and build moment-timezone 0.6.5
b48d24a build(deps): bump package-lock moment from 2.29.4 to 2.31.0 (#1166)
88edd54 build(deps): bump brace-expansion (#1164)
a973518 data: Add 2026e (#1165)
See full diff in compare view

Updates pino from 10.3.1 to 10.4.0

Release notes

Sourced from pino's releases.

v10.4.0

What's Changed

Add warning on incompatible formatters.level with multi-target transports by @lraveri in pinojs/pino#2381

chore: use TSTyche for type testing by @mrazauskas in pinojs/pino#2376

Add Sentry Native Integration Docs by @KyleTryon in pinojs/pino#2394

docs: add flush limitation warning for pino-pretty, fix #1015 by @mcollina in pinojs/pino#2402

feat(browser): add redaction support by @abhu85 in pinojs/pino#2396

chore: lint the type declaration file by @mrazauskas in pinojs/pino#2408

chore: remove TSTyche config file by @mrazauskas in pinojs/pino#2409

docs: clarify multi-target formatter limitation by @mcollina in pinojs/pino#2410

No bots allowed by @mcollina in pinojs/pino#2412

build(deps): bump real-require from 0.2.0 to 1.0.0 by @dependabot[bot] in pinojs/pino#2414

build(deps-dev): bump neostandard from 0.12.2 to 0.13.0 by @dependabot[bot] in pinojs/pino#2418

fix: use util.getCallSites when able to allow frozen intrinsics by @CarlOlson in pinojs/pino#2294

Update AWS Lambda reference in asynchronous docs by @urbanautomaton in pinojs/pino#2413

chore: update license by @Tony133 in pinojs/pino#2375

fix: add named default export by @mrazauskas in pinojs/pino#2421

Update contrib doc by @jsumners in pinojs/pino#2424

docs: use @hono/structured-logger for Pino with Hono by @brunorodmoreira in pinojs/pino#2425

chore(deps): remove pre-commit by @kshitijanurag in pinojs/pino#2423

build(deps): bump actions/github-script from 8 to 9 by @dependabot[bot] in pinojs/pino#2427

build(deps-dev): bump eslint-plugin-promise from 6.6.0 to 7.3.0 by @dependabot[bot] in pinojs/pino#2428

build(deps-dev): bump tstyche from 6.2.0 to 7.1.0 by @dependabot[bot] in pinojs/pino#2429

test: fix flaky transport config test by @mcollina in pinojs/pino#2434

chore: upgrade typescript to v6.0.2 by @Tony133 in pinojs/pino#2419

docs: fix typo "compatability" → "compatibility" in README by @premsreelathasugeendran in pinojs/pino#2435

docs: warn against untrusted top-level log keys by @mcollina in pinojs/pino#2450

test(transport): keep event loop alive while awaiting async flush by @YBJ0000 in pinojs/pino#2470

docs: clarify Node.js version support policy in LTS doc by @youdie006 in pinojs/pino#2472

fix: honor per-target level filter on single-element targets array by @mcollina in pinojs/pino#2432

fix(multistream): resolve string level labels in write() by @xianjianlf2 in pinojs/pino#2474

fix: escape child binding keys by @mcollina in pinojs/pino#2452

docs: clarify stringification limits by @mcollina in pinojs/pino#2475

fix: add setBindings to the browser logger by @ankit1324 in pinojs/pino#2471

build(deps): bump actions/setup-node from 6 to 7 by @dependabot[bot] in pinojs/pino#2486

build(deps-dev): bump through2 from 4.0.2 to 5.0.10 by @dependabot[bot] in pinojs/pino#2488

build(deps-dev): bump bole from 5.0.29 to 6.0.7 by @dependabot[bot] in pinojs/pino#2489

build(deps-dev): bump eslint-plugin-n from 17.23.2 to 18.2.2 by @dependabot[bot] in pinojs/pino#2492

build(deps): bump actions/checkout from 6.0.2 to 7.0.1 by @dependabot[bot] in pinojs/pino#2485

fix: log objects with an own proto key instead of crashing by @spokodev in pinojs/pino#2457

fix: build the redaction shape without Object.prototype by @luantaraschi in pinojs/pino#2495

ci: add Node.js 26 to test matrix by @aquie00t in pinojs/pino#2480

fix(multistream): fix clone add crash and missing end/remove methods by @spellsaif in pinojs/pino#2493

ci: check pull requests target main by @marktran0710 in pinojs/pino#2500

build(deps-dev): bump docsify-cli from 4.4.4 to 5.0.0 by @dependabot[bot] in pinojs/pino#2513

build(deps-dev): bump eslint-plugin-n from 18.2.2 to 18.3.0 by @dependabot[bot] in pinojs/pino#2515

Delete .github/dependabot.yml by @jsumners in pinojs/pino#2517

docs: document the APIs that are unavailable in the browser by @kavish-19 in pinojs/pino#2521

ci: pin lock-threads to upstream v6.0.2 to fix token validation failure by @simpleqt in pinojs/pino#2525

Add bindings() method to browser logger by @RT1811 in pinojs/pino#2504

... (truncated)

Commits

b29dbe9 Bumped v10.4.0
6ba157b docs: fix the pino-pretty flush explanation after thread-stream#198 (#2524)
6429c14 docs: Note that serializers run on child bindings at creation time (#2518)
6c71bc9 Add bindings method to browser logger (#2504)
b557f72 ci: pin lock-threads to upstream v6.0.2 to fix token validation failure (#2525)
1de1212 docs: document the APIs that are unavailable in the browser (#2521)
af2fe10 Delete .github/dependabot.yml (#2517)
5aa6230 build(deps-dev): bump eslint-plugin-n from 18.2.2 to 18.3.0 (#2515)
6f5af07 build(deps-dev): bump docsify-cli from 4.4.4 to 5.0.0 (#2513)
2ffe576 ci: check pull requests target main (#2500)
Additional commits viewable in compare view

Updates xpath from 0.0.34 to 0.0.35

Commits

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the production-minor-patch group with 5 updates: | Package | From | To | | --- | --- | --- | | [cbor2](https://github.com/hildjj/cbor2) | `2.3.0` | `2.4.0` | | [js-yaml](https://github.com/nodeca/js-yaml) | `5.4.2` | `5.4.3` | | [moment-timezone](https://github.com/moment/moment-timezone) | `0.6.4` | `0.6.5` | | [pino](https://github.com/pinojs/pino) | `10.3.1` | `10.4.0` | | [xpath](https://github.com/goto100/xpath) | `0.0.34` | `0.0.35` | Updates `cbor2` from 2.3.0 to 2.4.0 - [Release notes](https://github.com/hildjj/cbor2/releases) - [Commits](hildjj/cbor2@v2.3.0...v2.4.0) Updates `js-yaml` from 5.4.2 to 5.4.3 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@5.4.2...5.4.3) Updates `moment-timezone` from 0.6.4 to 0.6.5 - [Release notes](https://github.com/moment/moment-timezone/releases) - [Changelog](https://github.com/moment/moment-timezone/blob/develop/changelog.md) - [Commits](moment/moment-timezone@0.6.4...0.6.5) Updates `pino` from 10.3.1 to 10.4.0 - [Release notes](https://github.com/pinojs/pino/releases) - [Commits](pinojs/pino@v10.3.1...v10.4.0) Updates `xpath` from 0.0.34 to 0.0.35 - [Commits](https://github.com/goto100/xpath/commits) --- updated-dependencies: - dependency-name: cbor2 dependency-version: 2.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-patch - dependency-name: js-yaml dependency-version: 5.4.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch - dependency-name: moment-timezone dependency-version: 0.6.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch - dependency-name: pino dependency-version: 10.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-patch - dependency-name: xpath dependency-version: 0.0.35 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-10-11T06:14:56Z

Labels

The following labels could not be found: npm. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

socket-security · 2026-10-11T06:15:19Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
js-yaml@5.4.2 ⏵ 5.4.3		⁺¹	^-2
xpath@0.0.34 ⏵ 0.0.35	⁺¹	⁺¹
cbor2@2.3.0 ⏵ 2.4.0	⁺¹		⁺⁶
moment-timezone@0.6.4 ⏵ 0.6.5			^-2
pino@10.3.1 ⏵ 10.4.0	⁺¹

View full report

coderabbitai · 2026-10-11T06:15:21Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: doublegate/CyberChef-MCP/.coderabbit.yaml
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 8779644a-8055-47e3-9ff2-0443d8c8867f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-10-11T06:17:16Z

Antigravity review (Gemini via Ultra)

Updates five production dependencies (cbor2, js-yaml, moment-timezone, pino, xpath) to their latest minor and patch versions.

Blocking issues

None found.

Suggestions

This is a trivial dependency bump. I verified that the new cbor2@2.4.0 engines.node requirement of >=22 is safely satisfied by our >=26 project floor.

Nitpicks

None.

_{Automated first-pass review by agy on a self-hosted runner -- not a human review.}

dependabot · 2026-10-11T06:28:44Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 11, 2026

dependabot Bot closed this Oct 11, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/production-minor-patch-38ae7f1a57 branch October 11, 2026 06:28

Navigation Menu

Repository navigation

build(deps): Bump the production-minor-patch group with 5 updates - #157

build(deps): Bump the production-minor-patch group with 5 updates#157
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/production-minor-patch-38ae7f1a57

dependabot Bot commented on behalf of github Oct 11, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Oct 11, 2026

Uh oh!

socket-security Bot commented Oct 11, 2026

Uh oh!

coderabbitai Bot commented Oct 11, 2026

Review skipped

Uh oh!

github-actions Bot commented Oct 11, 2026

Uh oh!

dependabot Bot commented on behalf of github Oct 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v2.4.0

What's Changed

New Contributors

[5.4.3] - 2026-10-06

Fixed

Release 0.6.5

0.6.5 2026-10-02

v10.4.0

What's Changed

Uh oh!

dependabot Bot commented on behalf of github Oct 11, 2026

Labels

Uh oh!

socket-security Bot commented Oct 11, 2026

Uh oh!

coderabbitai Bot commented Oct 11, 2026

Review skipped

Uh oh!

github-actions Bot commented Oct 11, 2026

Antigravity review (Gemini via Ultra)

Blocking issues

Suggestions

Nitpicks

Uh oh!

dependabot Bot commented on behalf of github Oct 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Oct 11, 2026 •

edited

Loading

`0.6.5` 2026-10-02