chore(deps-dev): bump the minor-and-patch group across 1 directory with 5 updates

[dependabot]

Bumps the minor-and-patch group with 5 updates in the / directory:

Package	From	To
@types/node	24.13.2	24.13.3
@yao-pkg/pkg	6.20.0	6.21.0
axios	1.18.0	1.18.1
csv-stringify	6.8.0	6.8.1
prettier	3.8.4	3.9.5

Updates @types/node from 24.13.2 to 24.13.3

Commits

• See full diff in compare view

Updates @yao-pkg/pkg from 6.20.0 to 6.21.0

Release notes

Sourced from @​yao-pkg/pkg's releases.

Release 6.21.0

6.21.0 (2026-06-30)

Features

• build hooks (preBuild, postBuild, per-file transform) (#273) (3667383), closes package.json#pkg
• bump fetch 3.6.3 with node 22.22.3, 24.15.0 and 26.2.0 (#277) (546bbf0)
• bump fetch 3.6.4 with nodejs 22.23.1, 24.18.0, 26.4.0 (#288) (3520d26)

Bug Fixes

• detector: pick up six more silent-drop shapes (re-exports, new URL, multi-arg path.join, path.resolve(__dirname,…), createRequire aliases, import.meta.resolve) (#272) (ea66111), closes #269
• sea: set process.pkg in worker threads (#270) (376e2a4)

Test added

• fetch-all: track supported node majors, drop node20 (#286) (1b0002f)
• split unit tests into node:test suite, add c8 coverage (#271) (26f10a3), closes #267 #267

Chores

• add worktrees to gitignore (d585e27)
• deps: bump esbuild to >=0.28.1 to fix security vuln (#282) (#284) (68f41d5)

Changelog

Sourced from @​yao-pkg/pkg's changelog.

6.21.0 (2026-06-30)

Features

• build hooks (preBuild, postBuild, per-file transform) (#273) (3667383), closes package.json#pkg
• bump fetch 3.6.3 with node 22.22.3, 24.15.0 and 26.2.0 (#277) (546bbf0)
• bump fetch 3.6.4 with nodejs 22.23.1, 24.18.0, 26.4.0 (#288) (3520d26)

Bug Fixes

• detector: pick up six more silent-drop shapes (re-exports, new URL, multi-arg path.join, path.resolve(__dirname,…), createRequire aliases, import.meta.resolve) (#272) (ea66111), closes #269
• sea: set process.pkg in worker threads (#270) (376e2a4)

Test added

• fetch-all: track supported node majors, drop node20 (#286) (1b0002f)
• split unit tests into node:test suite, add c8 coverage (#271) (26f10a3), closes #267 #267

Chores

• add worktrees to gitignore (d585e27)
• deps: bump esbuild to >=0.28.1 to fix security vuln (#282) (#284) (68f41d5)

6.19.0 (2026-04-24)

Features

• config: accept CLI-only build flags in pkg config (#263) (a8e91df)

Bug Fixes

• deps: update @​roberts_lando/vfs to version 0.3.3 (#266) (d155e24)
• detector: stop silent dependency drops in SEA mode (ESM parse, dynamic import, decorators) (#268) (81c6c88)
• sea: silence benign LIEF warnings during postject injection (#265) (974df53)

6.18.2 (2026-04-22)

Bug Fixes

• sea: match blob generator to target Node version (#247) (ad2a336), closes #236 #236 #236 #236 #236 #236 #236
• sea: strip trailing slashes in manifest key lookup (#261) (af0c086)

6.18.1 (2026-04-21)

Bug Fixes

• pkg: ship all .d.ts files in npm package (#258) (7e10ce2)

6.18.0 (2026-04-20)

... (truncated)

Commits

• See full diff in compare view

Updates axios from 1.18.0 to 1.18.1

Release notes

Sourced from axios's releases.

v1.18.1 — June 21, 2026

This release focuses on Node HTTP adapter fixes, safer AxiosError serialisation, runtime/type correctness fixes, documentation updates, and dependency maintenance.

🐛 Bug Fixes

• AxiosError Serialisation: Made AxiosError#cause non-enumerable to prevent circular JSON serialisation failures when errors include nested causes. (#10913)
• Node HTTP Adapter: Guarded socket.setKeepAlive for proxy agent streams, accepted path-only URLs when socketPath is configured, deferred environment proxy handling to Node, and explicitly passed maxBodyLength through to follow-redirects. (#10917, #10930, #10942, #10993)
• Runtime and Type Correctness: Fixed several runtime crashes, type definition mismatches, and incorrect error handling paths. (#10959, #11021)
• AxiosURLSearchParams: Switched the encoder callback to an arrow function so encoder.call(this) receives the AxiosURLSearchParams instance correctly. (#11019)

🔧 Maintenance & Chores

• Documentation: Documented sensitive headers and status transition behaviour, prepared cleaned-up docs, added Deno install instructions, and clarified that request data is request-specific (#11007, #11010, #11023, #11025)

• Dependencies: Bumped vite, rollup, form-data, js-yaml, and multer across the root project, docs, smoke tests, and module test workspaces. (#11011, #11012, #11013, #11014, #11015, #11016, #11017, #11026)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

• @​webdevelopersrinu (#10913)
• @​sijie-Z (#10993)
• @​bartlomieju (#11023)
• @​JSap0914 (#11019)

Full Changelog

Changelog

Sourced from axios's changelog.

Changelog

Commits

• a209bfb chore(release): prepare release 1.18.1 (#11027)
• fa6a55e chore(deps-dev): bump multer from 2.1.1 to 2.2.0 (#11026)
• 40e7be8 docs: clarifies that request data is request-specific in axios (#11025)
• a446b39 fix(AxiosURLSearchParams): use arrow function so encoder.call(this) receives ...
• cf1306a docs: add Deno to install instructions (#11023)
• b32880a fix: incorrect use of error (#11021)
• 1792eda fix: ensure maxBodyLength is explicitly passed to follow-redirects (#10993)
• 30499d6 fix: various runtime crashes and type definition mismatches (#10959)
• 20ce9c4 fix(http): defer env proxy handling to Node (#10942)
• e64bcf9 chore(deps): merge branch 'v1.x' into tests/module/cjs (#11014)
• Additional commits viewable in compare view

Updates csv-stringify from 6.8.0 to 6.8.1

Changelog

Sourced from csv-stringify's changelog.

6.8.1 (2026-07-02)

Bug Fixes

• csv-stringify: double regexp-metacharacter escape/quote literally (#494)
• csv-stringify: quote fields fusing with a multi-character separator

Commits

• 6e0d5a3 chore(release): publish
• db852d1 fix(csv-stringify): double regexp-metacharacter escape/quote literally (#494)
• abfe4de build: latest dependencies
• 46cab38 fix(csv-stringify): quote fields fusing with a multi-character separator
• See full diff in compare view

Updates prettier from 3.8.4 to 3.9.5

Release notes

Sourced from prettier's releases.

3.9.5

🔗 Changelog

3.9.4

• Angular: Format @content(name) -> @content (name) to align with other block syntax (#19499 by @​fisker)

🔗 Changelog

3.9.3

• Markdown: Fix unexpected removal of characters in liquid syntax (prettier/prettier#19489 by @​seiyab)
• TypeScript: Allow decorators to be used with declare on class fields (prettier/prettier#19492 by @​evoactivity)

🔗 Changelog

3.9.1

• CLI: Fix ignored file has been cached incorrectly (#19483 by @​kovsu)

🔗 Changelog

3.9.0

diff

🔗 Prettier 3.9: Major parser upgrades and Formatting improvements

3.8.5

• Fix Flow variance annotation print (#19022 by @​marcoww6)

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.5

diff

Markdown: Cap ordered list mark at 999,999,999 (#19351 by @​tats-u)

CommonMark parsers only support ordered list item numbers up to 999,999,999.

With this change, Prettier now caps the ordered list item number at 999,999,999 to ensure that the output is correctly parsed as an ordered list by CommonMark parsers. Numbers larger than 999,999,999 are not parsed as list item numbers and are left unchanged in the output:

<!-- Input -->
999999998. text
999999998. text
999999998. text
999999998. text
1234567890123456789012) text
<!-- Prettier 3.9.4 -->
999999998. text
999999999. text
1000000000. text
1000000001. text
1234567890123456789012) text
<!-- Prettier 3.9.5 -->
999999998. text
999999999. text
999999999. text
999999999. text
1234567890123456789012) text

Markdown: Avoid corrupting empty link with title (#19487 by @​andersk)

Do not remove <> from an inline link or image with an empty URL and a title, as this removal would change its interpretation.

<!-- Input -->
[link](https://github.com/prettier/prettier/blob/main/<> "title")
<!-- Prettier 3.9.4 -->
[link](https://github.com/prettier/prettier/blob/main/ "title")
<!-- Prettier 3.9.5 -->
</tr></table>

... (truncated)

Commits

• b6c7d18 Release 3.9.5
• cd54ccc Avoid corrupting empty Markdown link with title (#19487)
• 2bb67ce Preserving comments' placement property (#19567)
• 91bcac8 Add more tests for comment-only object type (#19587)
• cbee737 Remove space in empty object type (#19583)
• 6394c73 Align empty module declaration with TS (#19568)
• a4e6f7a Prevent the addition of space in type() with + (#19516)
• 3d063b5 Ignore dangling comments when checking type parameter comments (#19572)
• 908503e Handle dangling comments in SwitchStatement (#19581)
• 943a475 Angular: Support expression for exhaustive typechecking (#19571)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions