Bump the npm_and_yarn group across 1 directory with 6 updates

[dependabot]

Bumps the npm_and_yarn group with 6 updates in the / directory:

Package	From	To
@humanfs/node	0.16.6	0.16.8
brace-expansion	1.1.11	1.1.21
linkify-it	5.0.0	5.0.2
markdown-it	14.1.0	14.3.2
minimatch	3.1.2	3.1.5
smol-toml	1.5.2	1.7.2

Updates @humanfs/node from 0.16.6 to 0.16.8

Release notes

Sourced from @​humanfs/node's releases.

node: v0.16.8

0.16.8 (2026-04-17)

Bug Fixes

• Include type dependencies at runtime (956ce7a), closes #145

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​humanfs/core bumped from ^0.19.1 to ^0.19.2

node: v0.16.7

0.16.7 (2024-11-27)

Bug Fixes

• Add directory to package.json (f691b60)

Changelog

Sourced from @​humanfs/node's changelog.

0.16.8 (2026-04-17)

Bug Fixes

• Ensure symlinks are copied as symlinks in copy() and copyAll() (22bbaa44)
• Include type dependencies at runtime (956ce7a), closes #145

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​humanfs/core bumped from ^0.19.1 to ^0.19.2

0.16.7 (2024-11-27)

Bug Fixes

• Add directory to package.json (f691b60)

Commits

• e96070e chore: release main (#146)
• 22bbaa4 Merge commit from fork
• 956ce7a fix: Include type dependencies at runtime
• 257b7b5 chore: release main (#142)
• f691b60 fix: Add directory to package.json
• 7b81d9a chore(deps): Upgrading retry dependency in node package. (#140)
• See full diff in compare view

Updates brace-expansion from 1.1.11 to 1.1.21

Release notes

Sourced from brace-expansion's releases.

v1.1.15

• Backport v5.0.6 change to v1 (#111) 0b09384

---

juliangruber/brace-expansion@v1.1.14...v1.1.15

v1.1.12

• pkg: publish on tag 1.x c460dbd
• fmt ccb8ac6
• Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) c3c73c8

---

juliangruber/brace-expansion@v1.1.11...v1.1.12

Commits

• 8e81e18 1.1.21
• ffdfa3e Merge commit from fork
• c6513ad 1.1.20
• 1efee7c Merge commit from fork
• a34340a 1.1.19
• 0bcbfc0 Merge commit from fork
• 758fcd6 1.1.18
• 27fbeed Merge commit from fork
• 5c57cc2 1.1.17
• d757f1d npm ignore .claude
• Additional commits viewable in compare view

Updates linkify-it from 5.0.0 to 5.0.2

Changelog

Sourced from linkify-it's changelog.

5.0.2 / 2026-07-02

• Fixed DoS in mailto: links (restrict user name to 64 chars).
• Restricted user/pass part length in links.

5.0.1 / 2026-05-23

• Fixed DoS in fuzzy links/emails search.
• Reworked search logic - check each pattern separate, use g regexes instead of slice.
• Removed internal cache - useless overcomplication.

Commits

• 50a0c91 5.0.2 released
• de3b885 Update package hooks
• 13effaa Add package lock
• 39d748d Bump c8
• 00ce877 Drop tlds deps
• ecde823 Update benchmark to mitata
• 23c62cd Refactor demo / doc build and publish
• fd63f3b CI config update
• f4ea5af demo: update bootstrap & layout
• 1454fb6 lint: dim warnings
• Additional commits viewable in compare view

Updates markdown-it from 14.1.0 to 14.3.2

Changelog

Sourced from markdown-it's changelog.

[14.3.2] - 2026-09-12

Security

• Backported 15.0.2 fixes.

[14.3.1] - 2026-08-27

Security

• Backported 15.0.1 fixes.

[14.3.0] - 2026-07-02

Changed

• Reworked build pipeline & tools.
• Added source maps.
• Bumped linkify-it to 5.0.2.

Fixed

• Preserve backslash-space hard line breaks, matching CommonMark 6.7, #1185.

[14.2.0] - 2026-05-24

Added

• isPunctCharCode to utilities.

Fixed

• Don't end HTML comment blocks on a blank line, #1155.
• Properly recognize astral chars (surrogates) in delimiter scans for emphasis-like markers, #1072. Big thanks to @​tats-u for his global efforts with improving CJK support.
• Preserve unicode whitespaces when trimm headings/paragraphs, #1074.
• More strict entities decode to avoid false positives ;, #1096.
• Restore block parser state on fail in lheading rule, #1131.

Security

• Fixed poor smartquotes perfomance on > 70k quotes in single block
• Bumped linkify-it to 5.0.1 with fixed potential perfomance issues.

[14.1.1] - 2026-01-11

Security

• Fixed regression from v13 in linkify inline rule. Specific patterns could cause high CPU use. Thanks to @​ltduc147 for report.

Commits

• efb9993 14.3.2 released
• daf5a3c Backported 15.0.2 fixes
• a855f10 14.3.1 released
• ad70f6b Backported 15.0.1 fixes
• b407f3b Ignore generated API docs in lint
• bf025ad Prepare package.json for v14 backports
• 2d9bbea fix: recognize lowercase declarations as HTML blocks (CommonMark 4.6) (#1189)
• a311cfb fix: keep literal backslash before space in link destination (CommonMark 6.3)...
• ff0ee08 14.3.0 released
• 52e2749 Bump linkify-it / vite deps
• Additional commits viewable in compare view

Updates minimatch from 3.1.2 to 3.1.5

Commits

• 7bba978 3.1.5
• bd25942 docs: add warning about ReDoS
• 1a9c27c fix partial matching of globstar patterns
• 1a2e084 3.1.4
• ae24656 update lockfile
• b100374 limit recursion for **, improve perf considerably
• 26ffeaa lockfile update
• 9eca892 lock node version to 14
• 00c323b 3.1.3
• 30486b2 update CI matrix and actions
• Additional commits viewable in compare view

Updates smol-toml from 1.5.2 to 1.7.2

Release notes

Sourced from smol-toml's releases.

v1.7.2

What's Changed

• refactor: improve performance of the parser by @​cyyynthia
• chore: revert sourcemap publishing by @​cyyynthia

Full Changelog: squirrelchat/smol-toml@v1.7.1...v1.7.2

v1.7.1

This release includes flagging internal functions as @internal to strip them from the emitted type declarations.

⚠️ Includes a fix for GHSA-7w5x-hrqm-74c2

Full Changelog: squirrelchat/smol-toml@v1.7.0...v1.7.1

v1.7.0

This version slightly changes the behaviour of stringify: integers beyond the safe range are always emitted as float numbers.

String decode logic has been rewritten, it is a bit faster now and uses a single-pass approach instead of a dual-pass approach as it did previously. The code should be a bit smaller too, though I didn't actually measure that.

The package is now published with source-maps, declaration-maps, and a copy of the original TypeScript source files. This will improve your DX if you're like me and like Ctrl+Click'ing things a lot. ;)

What's Changed

• improve performance of the string decode logic by @​cyyynthia
• fix(stringify): emit integer-valued numbers beyond the safe-integer range as floats by @​spokodev in squirrelchat/smol-toml#56
• publish source-maps, declaration-maps, and original source files by @​cyyynthia
• miscellaneous repository maintenance tasks by @​cyyynthia

New Contributors

• @​spokodev made their first contribution in squirrelchat/smol-toml#56

Full Changelog: squirrelchat/smol-toml@v1.6.1...v1.7.0

v1.6.1

This release addresses a minor security vulnerability where an attacker-controlled TOML document can exploit an unrestricted recustion and cause a stack overflow error with a document that contains thousands of sucessive commented lines. Security advisory: GHSA-v3rj-xjv7-4jmq

v1.6.0

As of this version, smol-toml now supports the newly released TOML 1.1.0 specification!

Highlights

Multiline inline tables

TOML 1.1.0 now allows inline tables to have newlines, as well as trailing commas.

database = {
  driver = "postgresql",
  server = {
    host = "127.0.0.1",
    port = 3307,
  },
}
</tr></table> 

... (truncated)

Commits

• 19239d0 chore: bump version
• 5f55c3a chore: revert sourcemap publishing
• 5c26f1b chore: update benchmarks
• 92832d2 refactor: better logic orchestration in structs
• 2fb9ab8 refactor: ctx object instead of pointer arg + tuple returns
• e6017c4 ci: use staged publish
• 3e978a9 chore: bump versions
• 30f5c36 chore: add some @internal annotations
• f0e0399 chore(README.md): npmx, use star import
• a62f06f revert: keep using vite 7
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.