chore(deps): bump the production-dependencies group across 1 directory with 6 updates by dependabot[bot] · Pull Request #79 · voidstackloop/modelforge

dependabot · 2026-10-05T15:08:52Z

Bumps the production-dependencies group with 6 updates in the /app directory:

Package	From	To
@modelcontextprotocol/sdk	`1.30.0`	`1.30.1`
better-sqlite3	`13.0.1`	`13.0.3`
jose	`5.10.0`	`6.2.12`
node-llama-cpp	`3.19.1`	`3.22.1`
tesseract.js	`5.1.1`	`7.0.0`
undici	`8.10.0`	`8.11.2`

Updates @modelcontextprotocol/sdk from 1.30.0 to 1.30.1

Release notes

Sourced from @modelcontextprotocol/sdk's releases.

1.30.1

What's Changed

[v1.x] fix(server): read HTTP request bodies with a size limit and bound JSON-RPC batch length by @maxisbey in modelcontextprotocol/typescript-sdk#2717

fix(auth): preserve resource URI without trailing slash (#1968) by @MukundaKatta in modelcontextprotocol/typescript-sdk#1972

chore: bump version to 1.30.1 by @claude[bot] in modelcontextprotocol/typescript-sdk#2848

New Contributors

@MukundaKatta made their first contribution in modelcontextprotocol/typescript-sdk#1972

Full Changelog: modelcontextprotocol/typescript-sdk@1.30.0...1.30.1

Commits

289ac2c chore: bump version to 1.30.1 (#2848)
12b4256 fix(auth): preserve resource URI without trailing slash (#1968) (#1972)
a9f6eb7 [v1.x] fix(server): read HTTP request bodies with a size limit and bound JSON...
See full diff in compare view

Updates better-sqlite3 from 13.0.1 to 13.0.3

Release notes

Sourced from better-sqlite3's releases.

v13.0.3

What's Changed

use Ubuntu 22.04-arm by @neoxpert in WiseLibs/better-sqlite3#1510

Full Changelog: WiseLibs/better-sqlite3@v13.0.2...v13.0.3

v13.0.2

What's Changed

add gypfile option to package.json by @neoxpert in WiseLibs/better-sqlite3#1505

Update SQLite to version 3.53.4 by @JoshuaWise in WiseLibs/better-sqlite3#1506

validate the parameters of table properly by @theosotr in WiseLibs/better-sqlite3#1504

fix: this dependabot configuration does not set a co... in... by @anupamme in WiseLibs/better-sqlite3#1508

fixed process aborting from terminating worker threads (WiseLibs/better-sqlite3#1507)

New Contributors

@theosotr made their first contribution in WiseLibs/better-sqlite3#1504

@anupamme made their first contribution in WiseLibs/better-sqlite3#1508

Full Changelog: WiseLibs/better-sqlite3@v13.0.1...v13.0.2

Commits

dbc2ea1 13.0.3
b872585 use Ubuntu 22.04-arm (#1510)
569e85a 13.0.2
df1324b fix: this dependabot configuration does not set a co... in... (#1508)
b9fbe5f fixed segfault from making calls while worker thread is terminating
71707c4 validate the parameters of table properly (#1504)
6478c99 Update SQLite to version 3.53.4 (#1506)
6d24034 add gypfile option to package.json (#1505)
ab6232e fixed typo in docs
57d751c updated readme
See full diff in compare view

Updates jose from 5.10.0 to 6.2.12

Release notes

Sourced from jose's releases.

v6.2.12

Documentation

clarify and shorten public API guidance (be62530)

Refactor

simplify JWS and JWE operation cores (92e9640)

Performance

avoid copying AES-GCM output (6925d43)

deduplicate pending jwks key imports (bf5138b)

encode single-signature JWS input once (7bc9a33)

normalize General JWE shared headers once (78637bd)

normalize jwks selection metadata once (fd3ae3f)

use native encoding for larger ASCII strings (b23a6f3)

v6.2.11

Documentation

render subpath indexes as tables (94589ee)

shorten API index descriptions (681482f)

Refactor

model JWE key management modes (e01dda6)

types: reduce declaration repetition (55b970f)

v6.2.10

Fixes

jose: consume serialization members once (9bee285)

jose: reject empty protected and JWE AAD members (8da4145)

jose: validate serialized header values (b711d8f)

jwe: conceal invalid decrypted CEK lengths (41fafe0)

jwe: enforce AES-GCM tag boundaries (9a5b744)

jwe: validate explicit encryption parameters (7a02697)

jwk: accept empty octet-sequence keys (3f871e7)

jwk: normalize key resolution inputs (f54ee7b)

jwks: enforce verification key metadata (f9ba510)

jwks: order overlapping remote reloads (9a1a913)

jwks: reject invalid remote duration values (7bdb9e5)

jwk: validate ext and key_ops parameters (4d91c37)

jws: reject mixed payload encoding modes (dc69713)

jws: validate unencoded payload strings (541f282)

jwt: enforce explicit verification policies (b347182)

jwt: prevent replacing protected headers (ae07d09)

jwt: reject invalid duration inputs (282f9aa)

jwt: validate builder claim values (ea03f83)

... (truncated)

Changelog

Sourced from jose's changelog.

6.2.12 (2026-09-05)

Documentation

clarify and shorten public API guidance (be62530)

Refactor

simplify JWS and JWE operation cores (92e9640)

Performance

avoid copying AES-GCM output (6925d43)

deduplicate pending jwks key imports (bf5138b)

encode single-signature JWS input once (7bc9a33)

normalize General JWE shared headers once (78637bd)

normalize jwks selection metadata once (fd3ae3f)

use native encoding for larger ASCII strings (b23a6f3)

6.2.11 (2026-09-04)

Documentation

render subpath indexes as tables (94589ee)

shorten API index descriptions (681482f)

Refactor

model JWE key management modes (e01dda6)

types: reduce declaration repetition (55b970f)

6.2.10 (2026-08-21)

Fixes

jose: consume serialization members once (9bee285)

jose: reject empty protected and JWE AAD members (8da4145)

jose: validate serialized header values (b711d8f)

jwe: conceal invalid decrypted CEK lengths (41fafe0)

jwe: enforce AES-GCM tag boundaries (9a5b744)

jwe: validate explicit encryption parameters (7a02697)

jwk: accept empty octet-sequence keys (3f871e7)

jwk: normalize key resolution inputs (f54ee7b)

jwks: enforce verification key metadata (f9ba510)

jwks: order overlapping remote reloads (9a1a913)

jwks: reject invalid remote duration values (7bdb9e5)

jwk: validate ext and key_ops parameters (4d91c37)

jws: reject mixed payload encoding modes (dc69713)

jws: validate unencoded payload strings (541f282)

jwt: enforce explicit verification policies (b347182)

... (truncated)

Commits

505a55b chore(release): 6.2.12
7bc9a33 perf: encode single-signature JWS input once
78637bd perf: normalize General JWE shared headers once
bf5138b perf: deduplicate pending jwks key imports
b23a6f3 perf: use native encoding for larger ASCII strings
fd3ae3f perf: normalize jwks selection metadata once
6925d43 perf: avoid copying AES-GCM output
be62530 docs: clarify and shorten public API guidance
1b41312 build: preserve README when generation fails
0b51829 build: check tree-shaking for every public binding
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for jose since your current version.

Updates node-llama-cpp from 3.19.1 to 3.22.1

Release notes

Sourced from node-llama-cpp's releases.

v3.22.1

✨ New: Jev-like structured decisions with any model

3.22.1 (2026-09-28)

Bug Fixes

binary-split gguf URL name extraction (#662) (df534ff)

make score decision more precise (#664) (0ad4a86)

Shipped with llama.cpp release v0.5.0

To use the latest llama.cpp release available, run npx -n node-llama-cpp source download --release latest. (learn more)

v3.22.0

✨ New: Jev-like structured decisions with any model

3.22.0 (2026-09-27)

Features

structured decisions with any model (#654) (35a01d0) (documentation: Using Structured Decisions)

controlledEvaluate: raw logits support (#654) (35a01d0)

Bug Fixes

arm64 windows build optimizations (#657) (0555c0d)

reasoning segments edge cases (#654) (35a01d0)

stop promoting new line as a special token (#654) (35a01d0)

Shipped with llama.cpp release v0.5.0

To use the latest llama.cpp release available, run npx -n node-llama-cpp source download --release latest. (learn more)

v3.21.1

3.21.1 (2026-09-12)

Bug Fixes

... (truncated)

Commits

0ad4a86 fix: score decision (#664)
df534ff fix: binary-split gguf URL name extraction (#662)
ac5f707 build: fix Windows build (#661)
6b492d9 build: reduce CI memory usage (#660)
a4673e8 fix: build issues on Windows (#659)
4df8618 fix: broken pending PR patch on Windows (#658)
0555c0d fix: arm64 windows build optimizations (#657)
a65b5e6 chore: update modules (#656)
190761e feat(LlamaChatSession): provide an optional document in decide (#655)
35a01d0 feat: structured decisions with any model (#654)
Additional commits viewable in compare view

Updates tesseract.js from 5.1.1 to 7.0.0

Release notes

Sourced from tesseract.js's releases.

v7.0.0

What's Changed

Significant improvements to recognition speed (by @fanchenkong1 in naptha/tesseract.js#1039)

A new relaxedsimd build takes advantage of the latest WASM and hardware capabilities.

Upgrading from v6 to v7 reduces runtimes by ~15-35% (depending on device and use-case). The highest uplifts are currently seen on the latest Intel processors.

Dropped support for Node.js v14.

Various minor changes

New Contributors

@hata6502 made their first contribution in naptha/tesseract.js#1035

@fanchenkong1 made their first contribution in naptha/tesseract.js#1039

Full Changelog: naptha/tesseract.js@v6.0.1...v7.0.0

v6.0.1

What's Changed

Switched from using node-fetch to using built-in fetch implementation for Node.js v18 and newer.

This resolves a nuisance dependency-related warning message reported in #876

Various minor updates

Full Changelog: naptha/tesseract.js@v6.0.0...v6.0.1

v6.0.0

What's Changed

Fixed memory leaks (#977)

This version fixed a long-standing issue where memory would rise over time, eventually leading to a crash.

Reduced runtime and memory usage for most users by updating default formats (#916).

Fixed compatibility with Electron main process (#925)

Fixed bug where user-provided parameters were overwritten by defaults (#975).

Breaking Changes

All outputs formats other than text are now disabled by default.

To re-enable the hocr output (for example), set the following: worker.recognize(image, {}, { hocr: true })

See here for a list of possible output formats.

The JavaScript object output format (blocks) was tweaked.

Only the array of blocks (blocks) is returned.

Previous versions would automatically generate lists of every unit of text (words, symbols, etc.).

If needed, these should now be generated by the user.

Only text-based blocks are reported.

Previous versions reported non-text blocks when detected by Tesseract (e.g. line segments).

The shape of some objects were changed.

See the type declarations for reference on properties.

The main properties--text and bbox--are unchanged.

Various functions and options marked as depreciated previously have been removed.

This includes worker.initialize and worker.loadLanguage, along with several depreciated options from v2.

See #993 for additional discussion about this release.

New Contributors

... (truncated)

Commits

42eae66 7.0.0
1b0faec Enable WASM relaxed SIMD in tesseract.js (#1039)
4144941 Dropped Node.js v14 support (#1041)
50a3fd2 Added Node.js v24 to Actions (#1021)
a20d9ff Bump form-data from 4.0.2 to 4.0.4 (#1026)
0676b78 Bump tmp from 0.2.3 to 0.2.4 (#1029)
9c6fc3c Fixed types per #1033 (#1036)
fb2bd4d Add GIF format to documentation (#1035)
d82eb05 Fixed type error per #1031 (#1032)
f9dac07 Update api.md
Additional commits viewable in compare view

Updates undici from 8.10.0 to 8.11.2

Release notes

Sourced from undici's releases.

v8.11.2

What's Changed

fix: close rejected HTTP/2 WebSocket handshake streams by @mcollina in nodejs/undici#5873

fix: avoid reconnecting aborted requests by @Junaid-PK in nodejs/undici#5846

New Contributors

@Junaid-PK made their first contribution in nodejs/undici#5846

Full Changelog: nodejs/undici@v8.11.1...v8.11.2

v8.11.1

What's Changed

deslopify websocket test by @KhafraDev in nodejs/undici#5851

Revert "fix: preserve HTTP/2 for legacy fetch consumers" by @mcollina in nodejs/undici#5860

fix websocketstream bugs by @KhafraDev in nodejs/undici#5863

fix hang on 3xx response with large body by @KhafraDev in nodejs/undici#5850

docs: warn about buffering response bodies by @mcollina in nodejs/undici#5872

test: cover native fetch gzip decoding through the legacy bridge by @mcollina in nodejs/undici#5874

Full Changelog: nodejs/undici@v8.11.0...v8.11.1

v8.11.0

What's Changed

fix: complete upgrade diagnostics lifecycle by @BridgeAR in nodejs/undici#5761

build(deps): bump step-security/harden-runner from 2.19.4 to 2.21.0 by @dependabot[bot] in nodejs/undici#5753

fix(decompress): join a repeated content-encoding header by @luantaraschi in nodejs/undici#5664

fix(cookies): keep a cookie named proto in getCookies by @luantaraschi in nodejs/undici#5663

build(deps-dev): bump jest from 30.5.0 to 30.5.1 by @dependabot[bot] in nodejs/undici#5784

build(deps): bump got from 15.1.0 to 16.0.0 in /benchmarks by @dependabot[bot] in nodejs/undici#5785

fix: selectively re-enable SIMD for ppc64 by @richardlau in nodejs/undici#5776

use private fields for brand checks by @KhafraDev in nodejs/undici#5792

fix(h2): do not unref a session with open streams by @kjsik11 in nodejs/undici#5782

fix(h2): avoid pool fan-out during ALPN negotiation by @mcollina in nodejs/undici#5799

fix issue #5715 by @KhafraDev in nodejs/undici#5805

ci: extend macOS Node.js workflow timeout by @mcollina in nodejs/undici#5775

fix(env-http-proxy-agent): NO_PROXY wildcard semantics by @mcollina in nodejs/undici#5777

fix(h2): do not replay a request whose response already started after GOAWAY by @kjsik11 in nodejs/undici#5788

test: skip HTTP/2 churn test on Node.js 25 on all platforms by @kjsik11 in nodejs/undici#5790

fix(proxy-agent): preserve repeated iterable headers by @GiHoon1123 in nodejs/undici#5779

docs(errors): document ProxyConnectionError (UND_ERR_PRX_CONN) by @kilisamemarisaaa in nodejs/undici#5781

dataurl parsing improvements + update WPT by @KhafraDev in nodejs/undici#5812

fix(decompress): treat inherited Object.prototype names as unsupported encodings by @NgoQuocViet2001 in nodejs/undici#5807

test(h2): stabilize http2-connection by @ViniciusDev26 in nodejs/undici#5801

fix: preserve HTTP/2 for non-upgrade legacy requests by @mcollina in nodejs/undici#5811

fix: skip drain dispatch for clientTtl-evicted clients in PoolBase by @vwong in nodejs/undici#5677

chore: update tests blocking release by @vwong in nodejs/undici#5828

build(deps): bump uWebSockets.js from v20.68.0 to v20.70.0 in /benchmarks by @dependabot[bot] in nodejs/undici#5824

fix(deduplicate): settle requests when composed with retry by @mcollina in nodejs/undici#5817

fix(cache): do not report aborted on successful cache hits by @Yahiro025 in nodejs/undici#5819

... (truncated)

Commits

7e016ad Bumped v8.11.2 (#5886)
fcdd5a6 fix: skip reconnecting for aborted requests (#5846)
dd28c5c fix: close rejected HTTP/2 WebSocket handshake streams (#5873)
5e0a2f8 Bumped v8.11.1 (#5871)
2b72898 test: cover native fetch gzip decoding through the legacy bridge (#5874)
636bf51 docs: warn about buffering response bodies (#5872)
8145595 fix hang on 3xx response with large body (#5850)
f3cbe48 fix websocketstream bugs (#5863)
1d4ea0a Revert "fix: preserve HTTP/2 for legacy fetch consumers" (#5860)
77d7b3f deslopify websocket test (#5851)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…y with 6 updates Bumps the production-dependencies group with 6 updates in the /app directory: | Package | From | To | | --- | --- | --- | | [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.30.0` | `1.30.1` | | [better-sqlite3](https://github.com/WiseLibs/better-sqlite3) | `13.0.1` | `13.0.3` | | [jose](https://github.com/panva/jose) | `5.10.0` | `6.2.12` | | [node-llama-cpp](https://github.com/withcatai/node-llama-cpp) | `3.19.1` | `3.22.1` | | [tesseract.js](https://github.com/naptha/tesseract.js) | `5.1.1` | `7.0.0` | | [undici](https://github.com/nodejs/undici) | `8.10.0` | `8.11.2` | Updates `@modelcontextprotocol/sdk` from 1.30.0 to 1.30.1 - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases) - [Commits](modelcontextprotocol/typescript-sdk@1.30.0...1.30.1) Updates `better-sqlite3` from 13.0.1 to 13.0.3 - [Release notes](https://github.com/WiseLibs/better-sqlite3/releases) - [Commits](WiseLibs/better-sqlite3@v13.0.1...v13.0.3) Updates `jose` from 5.10.0 to 6.2.12 - [Release notes](https://github.com/panva/jose/releases) - [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md) - [Commits](panva/jose@v5.10.0...v6.2.12) Updates `node-llama-cpp` from 3.19.1 to 3.22.1 - [Release notes](https://github.com/withcatai/node-llama-cpp/releases) - [Commits](withcatai/node-llama-cpp@v3.19.1...v3.22.1) Updates `tesseract.js` from 5.1.1 to 7.0.0 - [Release notes](https://github.com/naptha/tesseract.js/releases) - [Commits](naptha/tesseract.js@v5.1.1...v7.0.0) Updates `undici` from 8.10.0 to 8.11.2 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v8.10.0...v8.11.2) --- updated-dependencies: - dependency-name: "@modelcontextprotocol/sdk" dependency-version: 1.30.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: better-sqlite3 dependency-version: 13.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: jose dependency-version: 6.2.12 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies - dependency-name: node-llama-cpp dependency-version: 3.22.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: tesseract.js dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies - dependency-name: undici dependency-version: 8.11.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 5, 2026

Navigation Menu

chore(deps): bump the production-dependencies group across 1 directory with 6 updates - #79

chore(deps): bump the production-dependencies group across 1 directory with 6 updates#79
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/app/production-dependencies-7f30c6cae0

dependabot Bot commented on behalf of github Oct 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 5, 2026

1.30.1

What's Changed

New Contributors

v13.0.3

What's Changed

v13.0.2

What's Changed

New Contributors

v6.2.12

Documentation

Refactor

Performance

v6.2.11

Documentation

Refactor

v6.2.10

Fixes

6.2.12 (2026-09-05)

Documentation

Refactor

Performance

6.2.11 (2026-09-04)

Documentation

Refactor

6.2.10 (2026-08-21)

Fixes

v3.22.1

3.22.1 (2026-09-28)

Bug Fixes

v3.22.0

3.22.0 (2026-09-27)

Features

Bug Fixes

v3.21.1

3.21.1 (2026-09-12)

Bug Fixes

v7.0.0

What's Changed

New Contributors

v6.0.1

What's Changed

v6.0.0

What's Changed

Breaking Changes

New Contributors

v8.11.2

What's Changed

New Contributors

v8.11.1

What's Changed

v8.11.0

What's Changed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants