Skip to content

chore(deps): bump the pnpm-minor group across 1 directory with 7 updates - #625

Open
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/develop/pnpm-minor-1cffc1dd89
Open

chore(deps): bump the pnpm-minor group across 1 directory with 7 updates#625
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/develop/pnpm-minor-1cffc1dd89

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the pnpm-minor group with 7 updates in the / directory:

Package From To
@aws-sdk/client-s3 3.1075.0 3.1121.0
@aws-sdk/lib-storage 3.1075.0 3.1121.0
axios 1.18.1 1.20.0
mermaid 11.16.1 11.17.2
playwright 1.61.1 1.62.1
cspell 10.0.1 10.2.0
vocs 2.6.2 2.8.5

Updates @aws-sdk/client-s3 from 3.1075.0 to 3.1121.0

Release notes

Sourced from @​aws-sdk/client-s3's releases.

v3.1121.0

3.1121.0(2026-08-28)

New Features
  • client-ecs: Amazon Elastic Container Service - This release adds support for early success criteria on ECS rolling deployments, letting deployment complete once a configurable percentage of tasks are healthy, with configurable BLOCKING (required) or DEFERRED (asynchronous) cleanup of previous service revisions. (ef22d750)
  • client-healthlake: New HealthLake API, RestoreFHIRDatastore, providing the capability to restore active datastores to a point in time within the last 30 days or recover a deleted datastore from the delete snapshot. (62491742)
  • client-bedrock-agentcore: AgentCore Memory now supports direct ingestion into long-term memory via IngestData API (20d652de)
  • client-partnercentral-selling: Releasing PARC, new APN Program that lets sellers add solftware revenue details to aws opportunity summary (2b6350f0)
  • client-cognito-identity-provider: Adds two new operations - GetClientToken which allows M2M auth through the SDK, and DescribeTermsByClient to find which Terms are associated with a user-pool client without knowing the Terms resource id. (86dffd28)
  • client-bedrock-agent: Adds an optional syncSchedule field to CreateDataSource and UpdateDataSource for Managed Knowledge Bases data source connectors, so a data source can sync automatically on a daily, weekly, or monthly schedule. (a8d3714a)

For list of updated packages, view updated-packages.md in assets-3.1121.0.zip

v3.1120.0

3.1120.0(2026-08-27)

Documentation Changes
  • client-opensearch: Updating SDK and CLI documentation for AttachDataSource API. (d696fe76)
New Features
  • client-lambda-microvms: Added InsufficientCapacityException to RunMicrovm for capacity-related failures. Added lifecycle status field (AVAILABLE, DEPRECATED) to ListManagedMicrovmImageVersions. Added ConflictException to CreateMicrovmAuthToken and CreateMicrovmShellAuthToken for unregistered MicroVMs. (72a8ff80)
  • client-codedeploy: Added a deploymentMode parameter to CreateDeployment. Set it to RESTART to restart an EC2 and on-premises fleet, using the last successful revision, honoring Deployment Configuration. (78d4f964)
  • client-cloudwatch-logs: Added resultCount to QueryStatistics in GetQueryResults. This field returns the total number of output rows in the final result set, helping customers programmatically determine whether a query produced results after all operations including post-aggregation filters. (0e4d242b)
  • client-datazone: Add cascadeDelete to DeleteDomain. When specified, DataZone recursively deletes all projects, environments, subscriptions, and their underlying AWS resources before removing the domain. Deletion progress is reported via deleteProgress and resource failures via failureReasons on GetDomain. (3a74dc4b)
  • client-rds: Adding support for the full snapshot size, in bytes, of DB instance snapshots. (ab2f66f5)
  • client-ec2: EC2 allows AMI owners to define compatible instance types on their AMIs, blocking RunInstances calls automatically for launches on non-permitted instance types. (311b3b26)
  • client-cognito-identity-provider: Adds the AdminDeleteSoftwareToken API operation, enabling administrators to remove a user's registered TOTP (software token) MFA configuration from a user pool. (f661bebc)

For list of updated packages, view updated-packages.md in assets-3.1120.0.zip

v3.1119.0

3.1119.0(2026-08-26)

Chores
  • codegen: smithy-aws-typescript-codegen 0.53.0 (#8276) (dffb383b)
New Features
  • client-sagemaker: Amazon SageMaker AI now supports ml.g7 instances for model optimization. You can now run model optimization jobs on ml.g7 instances, in supported AWS Regions. (6d5e1066)
  • client-devops-agent: AWS DevOps Agent now supports trigger filter groups for Release Readiness Review, letting you control when the capability auto-triggers based on webhook events and target branches. (bc3d53d5)

... (truncated)

Changelog

Sourced from @​aws-sdk/client-s3's changelog.

3.1121.0 (2026-08-28)

Note: Version bump only for package @​aws-sdk/client-s3

3.1120.0 (2026-08-27)

Note: Version bump only for package @​aws-sdk/client-s3

3.1119.0 (2026-08-26)

Note: Version bump only for package @​aws-sdk/client-s3

3.1118.0 (2026-08-25)

Note: Version bump only for package @​aws-sdk/client-s3

3.1117.0 (2026-08-24)

Note: Version bump only for package @​aws-sdk/client-s3

3.1116.0 (2026-08-21)

Note: Version bump only for package @​aws-sdk/client-s3

3.1115.0 (2026-08-20)

... (truncated)

Commits

Updates @aws-sdk/lib-storage from 3.1075.0 to 3.1121.0

Release notes

Sourced from @​aws-sdk/lib-storage's releases.

v3.1121.0

3.1121.0(2026-08-28)

New Features
  • client-ecs: Amazon Elastic Container Service - This release adds support for early success criteria on ECS rolling deployments, letting deployment complete once a configurable percentage of tasks are healthy, with configurable BLOCKING (required) or DEFERRED (asynchronous) cleanup of previous service revisions. (ef22d750)
  • client-healthlake: New HealthLake API, RestoreFHIRDatastore, providing the capability to restore active datastores to a point in time within the last 30 days or recover a deleted datastore from the delete snapshot. (62491742)
  • client-bedrock-agentcore: AgentCore Memory now supports direct ingestion into long-term memory via IngestData API (20d652de)
  • client-partnercentral-selling: Releasing PARC, new APN Program that lets sellers add solftware revenue details to aws opportunity summary (2b6350f0)
  • client-cognito-identity-provider: Adds two new operations - GetClientToken which allows M2M auth through the SDK, and DescribeTermsByClient to find which Terms are associated with a user-pool client without knowing the Terms resource id. (86dffd28)
  • client-bedrock-agent: Adds an optional syncSchedule field to CreateDataSource and UpdateDataSource for Managed Knowledge Bases data source connectors, so a data source can sync automatically on a daily, weekly, or monthly schedule. (a8d3714a)

For list of updated packages, view updated-packages.md in assets-3.1121.0.zip

v3.1120.0

3.1120.0(2026-08-27)

Documentation Changes
  • client-opensearch: Updating SDK and CLI documentation for AttachDataSource API. (d696fe76)
New Features
  • client-lambda-microvms: Added InsufficientCapacityException to RunMicrovm for capacity-related failures. Added lifecycle status field (AVAILABLE, DEPRECATED) to ListManagedMicrovmImageVersions. Added ConflictException to CreateMicrovmAuthToken and CreateMicrovmShellAuthToken for unregistered MicroVMs. (72a8ff80)
  • client-codedeploy: Added a deploymentMode parameter to CreateDeployment. Set it to RESTART to restart an EC2 and on-premises fleet, using the last successful revision, honoring Deployment Configuration. (78d4f964)
  • client-cloudwatch-logs: Added resultCount to QueryStatistics in GetQueryResults. This field returns the total number of output rows in the final result set, helping customers programmatically determine whether a query produced results after all operations including post-aggregation filters. (0e4d242b)
  • client-datazone: Add cascadeDelete to DeleteDomain. When specified, DataZone recursively deletes all projects, environments, subscriptions, and their underlying AWS resources before removing the domain. Deletion progress is reported via deleteProgress and resource failures via failureReasons on GetDomain. (3a74dc4b)
  • client-rds: Adding support for the full snapshot size, in bytes, of DB instance snapshots. (ab2f66f5)
  • client-ec2: EC2 allows AMI owners to define compatible instance types on their AMIs, blocking RunInstances calls automatically for launches on non-permitted instance types. (311b3b26)
  • client-cognito-identity-provider: Adds the AdminDeleteSoftwareToken API operation, enabling administrators to remove a user's registered TOTP (software token) MFA configuration from a user pool. (f661bebc)

For list of updated packages, view updated-packages.md in assets-3.1120.0.zip

v3.1119.0

3.1119.0(2026-08-26)

Chores
  • codegen: smithy-aws-typescript-codegen 0.53.0 (#8276) (dffb383b)
New Features
  • client-sagemaker: Amazon SageMaker AI now supports ml.g7 instances for model optimization. You can now run model optimization jobs on ml.g7 instances, in supported AWS Regions. (6d5e1066)
  • client-devops-agent: AWS DevOps Agent now supports trigger filter groups for Release Readiness Review, letting you control when the capability auto-triggers based on webhook events and target branches. (bc3d53d5)

... (truncated)

Changelog

Sourced from @​aws-sdk/lib-storage's changelog.

3.1121.0 (2026-08-28)

Note: Version bump only for package @​aws-sdk/lib-storage

3.1120.0 (2026-08-27)

Note: Version bump only for package @​aws-sdk/lib-storage

3.1119.0 (2026-08-26)

Note: Version bump only for package @​aws-sdk/lib-storage

3.1118.0 (2026-08-25)

Note: Version bump only for package @​aws-sdk/lib-storage

3.1117.0 (2026-08-24)

Note: Version bump only for package @​aws-sdk/lib-storage

3.1116.0 (2026-08-21)

Note: Version bump only for package @​aws-sdk/lib-storage

3.1115.0 (2026-08-20)

... (truncated)

Commits

Updates axios from 1.18.1 to 1.20.0

Release notes

Sourced from axios's releases.

v1.20.0 — August 19, 2026

This release hardens runtime option handling, adds RFC 9110 status-code aliases, fixes Node.js and XHR reliability issues, and refreshes project tooling and documentation.

⚠️ Breaking Changes & Deprecations

  • HTTP Status Naming: Added ContentTooLarge (413) and UnprocessableContent (422), while retaining PayloadTooLarge and UnprocessableEntity as backward-compatible deprecated aliases. (#11082)

🔒 Security Fixes

  • Runtime Option Handling: Hardened behavioral configuration reads against shared and foreign prototype pollution and normalized unsafe interceptor replacement objects. This also clarifies Fetch redirect and custom implementation behavior, HTTP/2 DNS and proxy handling, CIDR-based NO_PROXY matching, and malformed data URI rejection; see the PR for documented compatibility effects. (#11141)

🐛 Bug Fixes

  • Interceptor Lifecycle: Prevented unbounded handler-array growth by trimming trailing ejected interceptors without changing iteration semantics, and kept interceptor operations safe when the public handlers field is nullish. (#11087, #11118)
  • Request Error Preservation: Prevented custom Error.prepareStackTrace implementations that return non-string values from replacing the original request failure with an unrelated TypeError. (#11109)
  • XHR Reliability: Navigation-canceled requests now reject with ECONNABORTED instead of resolving with status 0, while successful downloads flush their final progress callback during the live loadend dispatch. (#11094, #11121)
  • Node.js Socket Memory: Removed request-context retention from per-socket error listeners, preventing completed response data from being pinned for the lifetime of pooled keep-alive sockets. (#11091)
  • Core Methods and HTTP Errors: Prevented structural method-header buckets from leaking into outgoing headers, standardized invalid DNS lookup and httpVersion failures as AxiosError.ERR_BAD_OPTION_VALUE, and corrected the timeoutErrorMessage merge strategy. (#11096)

🔧 Maintenance & Chores

  • Dependencies: Updated fast-uri, postcss, js-yaml, mocha, development-tooling groups, and GitHub Actions dependencies. (#11092, #11098, #11099, #11106, #11107, #11122, #11123, #11126, #11127, #11133, #11140, #11143, #11144)
  • Documentation: Applied the v1.19.0 documentation updates, added the missing fs import to the README stream example, introduced localized global search, and repaired the interceptor test link. (#11101, #11113, #11097, #11119)
  • Sponsorship: Updated sponsorship links and data and added ScrapingBee as a sponsor. (#11124, #11136, #11137)
  • CI and Release: Switched ESM smoke tests to locked dependencies and synchronized package and runtime version metadata for v1.20.0. (#11128, #11152)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

Full Changelog (axios/axios@v1.19.0...v1.20.0)

v1.19.0 - July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

  • Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

... (truncated)

Changelog

Sourced from axios's changelog.

Changelog

v1.19.0 — July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

  • Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

🚀 New Features

  • Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers. (#11043, #11081)
  • Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)
  • HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)

🐛 Bug Fixes

  • Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)

  • Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)

  • Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)

  • Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)

  • URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11008, #11038)

  • Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)

  • Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (#11044, #11059)

  • Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (#11061)

  • Synchronous Interceptors: Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (#11071)

🔧 Maintenance & Chores

  • Dependencies: Updated development and test tooling, the docs fixture's Axios version, and GitHub Actions integrations including Checkout, Setup Node, Setup Deno, and Zizmor. (#11031, #11055, #11056, #11058, #11079, #11080, #11088, #11089, #11090)
  • Build Outputs: Limited sourcemap generation to published minified bundles, removing broken map references from non-minified builds. (#11054)
  • Form Data Internals: Centralized FormData header handling and made the Node.js adapter tolerate getHeaders() returning undefined under the content-only policy. (#11062)
  • Developer Experience: Ignored common local AI-tooling directories and fixed a constant-reassignment crash when the development sandbox serves its root path. (#11032, #11073)
  • Documentation: Updated sponsor information, clarified that baseURL is not a path-security boundary, scoped provenance claims to attested releases, and corrected the configuration-defaults documentation. (#11041, #11068, #11076, #11078)
  • Publishing: Simplified v1 publishing to use the npm version bundled with Node.js 26 and updated package metadata for the 1.19.0 release. (#11083, #11095)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve Axios:

... (truncated)

Commits
  • 84a9f3b chore(release): prepare release 1.20.0 (#11152)
  • e6824ee fix: core methodList, HTTP adapter errors, and add tests (#11096)
  • d8a919f fix(xhr): flush final progress during the live loadend dispatch (#11121)
  • 2d2a21a fix(interceptors): tolerate nullish handlers in syncHandlerEntries (#11118)
  • d19040b fix: harden runtime option handling (#11141)
  • e0a02dd chore(deps): bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 in the github-...
  • d10cb3a chore(deps-dev): bump the development_dependencies group with 4 updates (#11143)
  • 2c94646 chore(deps): bump js-yaml and mocha in /tests/smoke/cjs (#11133)
  • 76c12bc chore(deps-dev): bump js-yaml from 4.3.0 to 4.3.1 (#11140)
  • ba98559 docs: add ScrapingBee sponsor (#11137)
  • Additional commits viewable in compare view

Updates mermaid from 11.16.1 to 11.17.2

Release notes

Sourced from mermaid's releases.

mermaid@11.17.2

Patch Changes

  • #8125 178d7c7 Thanks @​knsv-bot! - fix: restore the edgePaths class on the edge group in rendered SVG, and point the flowchart, block and user journey stylesheets at it

mermaid@11.17.1

Patch Changes

  • #8092 31ce60a Thanks @​pbrolin47! - fix(c4): wrap element labels to c4.width again

    C4 element labels (System, Container, Component, Person and their _Ext variants) stopped wrapping in 11.17.0, so long descriptions rendered on one unbroken line and the shape grew sideways well past the configured c4.width. The unified-shapes label helper gated wrapping on the root-level wrap option, which has no schema default and is therefore undefined; it now gates on c4.wrap (default true), which is what the legacy renderer used.

  • #8088 c66200b Thanks @​ashishjain0512! - fix: neo-look arrowheads and crow's-foot markers no longer fall back to default theme colours/stroke widths on the first render with layout: elk. State diagram arrowheads stayed dark on dark themes, and ER / requirement markers were drawn at the default stroke width, because markers were created from the layout package's own bundled copy of mermaid, whose config had not been initialized yet.

  • #8079 281cd7b Thanks @​ashishjain0512! - fix(class): class diagram relation markers (composition, aggregation, extension, dependency, lollipop) no longer scale with the edge stroke width, so they stay outside the class box boundary in themes that set strokeWidth: 2 (redux, redux-dark, redux-color, redux-dark-color, neo, neo-dark) with the default classic look.

mermaid@11.17.0

Minor Changes

Patch Changes

  • #7847 215fe89 Thanks @​filipsajdak! - fix(c4): named attributes such as $tags, $link and $sprite are no longer clobbered to undefined when they arrive in an earlier positional slot of Person/System/Container/Component/Boundary/Rel statements.

  • #7871 8d874c4 Thanks @​knsv-bot! - fix(flowchart): stop dagre layout from spamming warn-level logs on every node/edge/cluster

  • #8071 b3d1f63 Thanks @​pbrolin47! - fix(block): sibling blocks overlapping in block diagrams when one has a label wider than 200px

  • #7870 71b8843 Thanks @​knsv-bot! - fix: a RangeError: Invalid array length crash when rendering certain edges.

  • #7924 9cbef5d Thanks @​nightt5879! - fix(treeView): icons disappearing after strict security sanitization.

... (truncated)

Commits

Updates playwright from 1.61.1 to 1.62.1

Release notes

Sourced from playwright's releases.

v1.62.1

Bug Fixes

  • #41989 [Regression]: tsconfig "extends" bare specifier isn't resolved via node_modules walk-up like tsc (fatal since 1.62)
  • #41998 [Regression]: directory-form tsconfig project references ("path": "../pkg") fail to resolve (fatal since 1.62)
  • #41985 Accessibility snapshot drops button name when text is nested inside spans with aria-hidden SVG
  • #42000 [Regression]: page.evaluate() arg of a branded primitive type (string & { brand }) no longer type-checks since 1.62
  • #42013 [BUG]Image-type actionable elements are not presented in the snapshot.

v1.62.0

🧱 New component testing model

Component testing moves to a stories and galleries model. A story wraps your component in one specific scenario — hard-coded props, mock data, providers — and a gallery page that you serve renders stories on demand. The new fixtures.mount() fixture navigates to the gallery, mounts a story by id, and returns a Locator scoped to the story's root element:

test('click should expand', async ({ mount }) => {
  const component = await mount('components/Expandable/Stateful');
  await component.getByRole('button').click();
  await expect(component.getByTestId('expanded')).toHaveValue('true');
});

Pass a story type as a template argument to type-check its props, and use update(props) / unmount() on the returned locator to re-render or tear down within a test.

🛑 Cancel operations with AbortSignal

Most operations and web-first assertions now accept a signal option that takes an AbortSignal, letting you cancel long-running actions, navigations, waits, and assertions:

const controller = new AbortController();
setTimeout(() => controller.abort(), 1000);
await page.getByRole('button', { name: 'Submit' }).click({ signal: controller.signal });
await expect(page.getByText('Done')).toBeVisible({ signal: controller.signal });

Providing a signal does not disable the default timeout; pass timeout: 0 to disable it.

🖼️ WebP screenshots

expect(page).toHaveScreenshot() and expect(locator).toHaveScreenshot() can now store snapshots in the WebP format — just give the snapshot a .webp name:

// Visual comparisons store the golden snapshot as lossless WebP.
await expect(page).toHaveScreenshot('homepage.webp');
// Standalone screenshots can trade quality for size with lossy WebP.
await page.screenshot({ path: 'homepage.webp', quality: 50 });
</tr></table>

... (truncated)

Commits
  • 26a9e47 cherry-pick(#42043): docs: release notes for v1.62 Python, Java, and .NET (#4...
  • 0a81d5d cherry-pick(#42040): docs(release-notes): mention the isolated headless clipb...
  • 8376826 cherry-pick(#42034): fix(aria): keep icon-only clickable elements in ai snaps...
  • 66c5cc9 chore: mark v1.62.1 (#42020)
  • 9672bc3 cherry-pick(#42009): fix(types): support branded primitives in evaluate argum...
  • 4325804 cherry-pick(#41988): fix(aria): preserve names from collapsed text contributors
  • 9632f8e cherry-pick(#42005): fix(tsconfig): do not throw when "extends"/"references" ...
  • e3950d9 chore: mark v1.62.0 (#41981)
  • f07e0f7 cherry-pick(#41940): docs: release notes for v1.62 (#41967)
  • 05a306c cherry-pick(#41964): Revert "feat(routeFromHar): add interceptAPIRequests opt...
  • Additional commits viewable in compare view

Updates cspell from 10.0.1 to 10.2.0

Release notes

Sourced from cspell's releases.

v10.2.0

Features

feat: Support languages without word breaks (Part 2) (#9133)

This pull request introduces support for locale-sensitive word segmentation, enabling better spell checking for languages such as Japanese, Chinese, Thai, Lao, Khmer, and Myanmar. The main changes add a new configuration option, useIntlWordSegmentation, to the schema and internal types, implement the corresponding text transformation logic, and update the document validation pipeline to use this feature. Additional test fixtures and tests are included to ensure correct behavior.

Support for locale-sensitive word segmentation:

  • Added a new boolean configuration option, useIntlWordSegmentation, to the JSON schema (cspell.schema.json) and internal TypeScript types (BaseSetting), allowing users to enable locale-aware text segmentation for supported languages. [1] [2] [3] [4]
  • Implemented the IntlSegmentTextTransformer and a factory function, createIntlSegmentTextTransformer, to perform locale-sensitive segmentation using the specified language.
  • Introduced a new utility, chainTransformers, and an IdentityTextTransformer to allow chaining multiple text transformers in the validation pipeline.
  • Updated the document validation logic (docValidator.ts and related files) to use the new transformer when useIntlWordSegmentation is enabled, ensuring correct segmentation for complex scripts. [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14]

Testing and fixtures:

  • Added new test fixtures and a test document containing Thai text, as well as a corresponding dictionary file and configuration to verify correct segmentation and spell checking. [1] [2] [3]
  • Extended the document validator tests to cover the new segmentation feature.

These changes collectively improve support for non-space-delimited languages and provide a more robust spell-checking experience for a wider range of languages.

feat: Support languages without word breaks (Part 1) (#9131)

This pull request introduces a new IntlSegmentTextTransformer for locale-aware text segmentation, refactors text transformation infrastructure for better composability, and improves locale normalization to BCP 47 standards. It also adds comprehensive tests for these new features and refactors existing transformers for consistency.

Locale normalization improvements

  • Improved the normalizeLocaleIntl function in LanguageSettings.ts to support BCP 47 language tag normalization, including script and region subtags, and added tests for these cases. [1] [2]

New locale-aware text transformer

  • Added the IntlSegmentTextTransformer class for locale-aware word segmentation using Intl.Segmenter, along with tests covering multiple locales (including Thai). [1] [2]

Transformer infrastructure and API improvements

  • Introduced a generic TextTransformer interface and the Edit type in Transformer.ts to standardize text transformation operations.
  • Added utility functions applyEditsToMappedText and applyEditsToText in TextMapEdit.ts for applying edits and maintaining source maps, used by all transformers.

Refactoring and consistency

  • Refactored SubstitutionTransformer to implement the new TextTransformer interface and use the new edit application utilities, simplifying and unifying its implementation. [1] [2] [3]

These changes collectively improve the flexibility, correctness, and internationalization support of the text transformation pipeline.

... (truncated)

Changelog

Sourced from cspell's changelog.

v10.2.0 (2026-08-31)

Features

feat: Support languages without word breaks (Part 2) (

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 7, 2026
@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Sep 7, 2026 •
edited
Loading

Copy link
Copy Markdown

Deploying frameworks with  Cloudflare Pages  Cloudflare Pages

Latest commit: a636324
Status:🚫  Build failed.

View logs

@socket-security

socket-security Bot commented Sep 7, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedplaywright@​1.61.1 ⏵ 1.62.1100 +1100100 +19980
Updated@​aws-sdk/​lib-storage@​3.1075.0 ⏵ 3.1121.0991008598 +1100
Updatedvocs@​2.6.2 ⏵ 2.8.59010088 +196 +1100
Updatedaxios@​1.18.1 ⏵ 1.20.098 +110010092100
Updatedcspell@​10.0.1 ⏵ 10.2.09810010095 +6100
Updated@​aws-sdk/​client-s3@​3.1075.0 ⏵ 3.1121.0100 +110010098 +1100
Updatedmermaid@​11.16.1 ⏵ 11.17.298 +1100100 +198100

View full report

@dependabot dependabot Bot changed the title chore(deps): bump the pnpm-minor group with 7 updates chore(deps): bump the pnpm-minor group across 1 directory with 7 updates Sep 14, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/develop/pnpm-minor-1cffc1dd89 branch from e4eaff1 to 366eba2 Compare September 14, 2026 09:20
@scode2277

scode2277 commented Sep 14, 2026

Copy link
Copy Markdown
Collaborator

Holding this open as I will update manually vocs and waku in a separate PR and when that one will be merged, this PR will update itself to have all the bumps actually needed without breaking the build

@dependabot
chore(deps): bump the pnpm-minor group across 1 directory with 7 updates
a636324 
Bumps the pnpm-minor group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1075.0` | `3.1121.0` |
| [@aws-sdk/lib-storage](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/lib/lib-storage) | `3.1075.0` | `3.1121.0` |
| [axios](https://github.com/axios/axios) | `1.18.1` | `1.20.0` |
| [mermaid](https://github.com/mermaid-js/mermaid) | `11.16.1` | `11.17.2` |
| [playwright](https://github.com/microsoft/playwright) | `1.61.1` | `1.62.1` |
| [cspell](https://github.com/streetsidesoftware/cspell/tree/HEAD/packages/cspell) | `10.0.1` | `10.2.0` |
| [vocs](https://github.com/wevm/vocs) | `2.6.2` | `2.8.5` |



Updates `@aws-sdk/client-s3` from 3.1075.0 to 3.1121.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1121.0/clients/client-s3)

Updates `@aws-sdk/lib-storage` from 3.1075.0 to 3.1121.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/lib/lib-storage/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1121.0/lib/lib-storage)

Updates `axios` from 1.18.1 to 1.20.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.18.1...v1.20.0)

Updates `mermaid` from 11.16.1 to 11.17.2
- [Release notes](https://github.com/mermaid-js/mermaid/releases)
- [Commits](https://github.com/mermaid-js/mermaid/compare/mermaid@11.16.1...mermaid@11.17.2)

Updates `playwright` from 1.61.1 to 1.62.1
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.61.1...v1.62.1)

Updates `cspell` from 10.0.1 to 10.2.0
- [Release notes](https://github.com/streetsidesoftware/cspell/releases)
- [Changelog](https://github.com/streetsidesoftware/cspell/blob/main/packages/cspell/CHANGELOG.md)
- [Commits](https://github.com/streetsidesoftware/cspell/commits/v10.2.0/packages/cspell)

Updates `vocs` from 2.6.2 to 2.8.5
- [Release notes](https://github.com/wevm/vocs/releases)
- [Changelog](https://github.com/wevm/vocs/blob/main/CHANGELOG.md)
- [Commits](https://github.com/wevm/vocs/compare/vocs@2.6.2...vocs@2.8.5)

---
updated-dependencies:
- dependency-name: "@aws-sdk/client-s3"
  dependency-version: 3.1116.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pnpm-minor
- dependency-name: "@aws-sdk/lib-storage"
  dependency-version: 3.1116.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pnpm-minor
- dependency-name: axios
  dependency-version: 1.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pnpm-minor
- dependency-name: cspell
  dependency-version: 10.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: pnpm-minor
- dependency-name: mermaid
  dependency-version: 11.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pnpm-minor
- dependency-name: playwright
  dependency-version: 1.62.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pnpm-minor
- dependency-name: vocs
  dependency-version: 2.8.5
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: pnpm-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/develop/pnpm-minor-1cffc1dd89 branch from 366eba2 to a636324 Compare September 14, 2026 17:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@scode2277