chore (deps): bump the patch-updates group across 1 directory with 9 updates

[dependabot]

Bumps the patch-updates group with 9 updates in the / directory:

Package	From	To
bignumber.js	11.1.4	11.1.5
bson	7.3.0	7.3.1
@codemirror/language	6.12.3	6.12.4
@codemirror/state	6.7.0	6.7.1
@codemirror/view	6.43.2	6.43.6
@puppeteer/browsers	3.0.5	3.0.6
autoprefixer	10.5.1	10.5.2
postcss	8.5.15	8.5.16
webpack-dev-server	5.2.5	5.2.6

Updates bignumber.js from 11.1.4 to 11.1.5

Changelog

Sourced from bignumber.js's changelog.

11.1.5

• 05/07/26
• #409 toFraction returning a sub-optimal rational approximation.

Commits

• 275cd85 v11.1.5
• 9202071 Merge pull request #409 from chatman-media/fix/tofraction-suboptimal-approxim...
• See full diff in compare view

Updates bson from 7.3.0 to 7.3.1

Release notes

Sourced from bson's releases.

v7.3.1

7.3.1 (2026-06-23)

The MongoDB Node.js team is pleased to announce version 7.3.1 of the bson package!

Release Notes

ObjectId initialization now tolerates partial process polyfills

Adds optional chaining to Node.js startup snapshot API calls in ObjectId so that environments with a stubbed or partial process global no longer throw a TypeError at startup.

Bug Fixes

• NODE-7630: make startup snapshot calls more defensive (#899) (99433cd)

Documentation

• API
• Changelog

We invite you to try the bson library immediately, and report any issues to the NODE project.

Changelog

Sourced from bson's changelog.

7.3.1 (2026-06-23)

Bug Fixes

• NODE-7630: make startup snapshot calls more defensive (#899) (99433cd)

Commits

• 31bed5d chore(main): release 7.3.1 (#900)
• 99433cd fix(NODE-7630): make startup snapshot calls more defensive (#899)
• ef8995b chore(NODE-7522): update dependencies (#889)
• See full diff in compare view

Updates @codemirror/language from 6.12.3 to 6.12.4

Commits

• See full diff in compare view

Updates @codemirror/state from 6.7.0 to 6.7.1

Commits

• See full diff in compare view

Updates @codemirror/view from 6.43.2 to 6.43.6

Commits

• See full diff in compare view

Updates @puppeteer/browsers from 3.0.5 to 3.0.6

Release notes

Sourced from @​puppeteer/browsers's releases.

browsers: v3.0.6

3.0.6 (2026-07-01)

📄 Documentation

• fix the typos on documentation (#15167) (ab74e6a)

🏗️ Refactor

• extract zip archives with yauzl instead of CLI tools (#15085) (04a9587)

Changelog

Sourced from @​puppeteer/browsers's changelog.

Changelog

Combined changelog for puppeteer and puppeteer-core.

25.3.0 (2026-07-01)

♻️ Chores

• puppeteer: Synchronize puppeteer versions

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​puppeteer/browsers bumped from 3.0.5 to 3.0.6

🎉 Features

• support installing extensions for browser contexts (#15164) (118d84d)

🛠️ Fixes

• handle swaps without a timer (#15198) (2356a15)
• normalize duplicate set-cookie headers using newline (#15173) (55787d5)
• roll to Firefox 152.0.3 (#15158) (2d64852)
• roll to Firefox 152.0.4 (#15195) (d382a21)

📄 Documentation

• fix the typos on documentation (#15167) (ab74e6a)

25.2.1 (2026-06-24)

♻️ Chores

• puppeteer: Synchronize puppeteer versions

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • puppeteer-core bumped from 25.2.0 to 25.2.1

... (truncated)

Commits

• 58d9b02 chore: release main (#15165)
• d382a21 fix: roll to Firefox 152.0.4 (#15195)
• 2356a15 fix: handle swaps without a timer (#15198)
• 537232e chore(webmcp): Clean unnecessary Protocol interfaces (#15199)
• ab74e6a docs: fix the typos on documentation (#15167)
• 9560bcf chore(deps-dev): bump the dev-dependencies group across 1 directory with 20 u...
• 04a9587 refactor: extract zip archives with yauzl instead of CLI tools (#15085)
• 54143a6 chore: fix the typos on the code test and API documentation (#15169)
• 55787d5 fix: normalize duplicate set-cookie headers using newline (#15173)
• 118d84d feat: support installing extensions for browser contexts (#15164)
• Additional commits viewable in compare view

Updates autoprefixer from 10.5.1 to 10.5.2

Release notes

Sourced from autoprefixer's releases.

10.5.2

• Moved -webkit-fill-available before -moz-available, so Firefox will use -webkit- version which is closer to stretch.

Changelog

Sourced from autoprefixer's changelog.

10.5.2

• Moved -webkit-fill-available before -moz-available, so Firefox will use -webkit- version which is closer to stretch.

Commits

• e99e381 Release 10.5.2 version
• 98de3f5 Move -webkit-fill-available before -moz-available to get a closer to spec res...
• See full diff in compare view

Updates postcss from 8.5.15 to 8.5.16

Release notes

Sourced from postcss's releases.

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @​MahinAnowar).
• Fixed computing offset in positionBy() (by @​greymoth-jp).
• Fixed rangeBy() on index: 0 (by @​sarathfrancis90).

Changelog

Sourced from postcss's changelog.

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @​MahinAnowar).
• Fixed computing offset in positionBy() (by @​greymoth-jp).
• Fixed rangeBy() on index: 0 (by @​sarathfrancis90).

Commits

• 92ccc93 Release 8.5.16 version
• 818bdd6 Update formatting
• 46e4510 Fix Input#origin() returning incorrect position (#2036)
• 34942ce Fix tests
• d4feed6 Don't clone root-less child nodes in container constructor (#2097)
• da323fc Revert version update to fix old Node.js on CI
• 8863369 Update dependencies
• 3828982 Preserve node raws when rehydrating a JSON AST (#2100)
• d1e80b8 Fix Node#rangeBy() ignoring index 0 (#2091)
• b91e4a6 Fix Node.js 26 tests
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates webpack-dev-server from 5.2.5 to 5.2.6

Release notes

Sourced from webpack-dev-server's releases.

v5.2.6

Patch Changes

• fix: allow undefined as the Server constructor options argument again (by @​bjohansebas in #5695)

  Restores accepting undefined (defaulting it to {}) for the options argument, so passing a webpack config's optional devServer field type-checks and works as before.

• Protect the built-in state-changing routes (/webpack-dev-server/invalidate and /webpack-dev-server/open-editor) against cross-site request forgery. Requests are now checked with Sec-Fetch-Site (falling back to an Origin/Host comparison when it is absent), so a cross-site page can no longer trigger a rebuild or open a file in the editor. Same-origin requests, user-initiated navigations, and non-browser clients (e.g. curl) are unaffected. (by @​bjohansebas in #5698)

• Handle malformed Host and Origin header values gracefully when validating requests. (by @​bjohansebas in #5699)

Changelog

Sourced from webpack-dev-server's changelog.

5.2.6

Patch Changes

• fix: allow undefined as the Server constructor options argument again (by @​bjohansebas in #5695)

  Restores accepting undefined (defaulting it to {}) for the options argument, so passing a webpack config's optional devServer field type-checks and works as before.

• Protect the built-in state-changing routes (/webpack-dev-server/invalidate and /webpack-dev-server/open-editor) against cross-site request forgery. Requests are now checked with Sec-Fetch-Site (falling back to an Origin/Host comparison when it is absent), so a cross-site page can no longer trigger a rebuild or open a file in the editor. Same-origin requests, user-initiated navigations, and non-browser clients (e.g. curl) are unaffected. (by @​bjohansebas in #5698)

• Handle malformed Host and Origin header values gracefully when validating requests. (by @​bjohansebas in #5699)

Commits

• 8a37b0e chore(release): new release (#5697)
• f21ed0f fix: handle malformed Host and Origin headers (#5699)
• 80cd9ee fix: reject cross-site requests to open-editor and invalidate endpoints (#5698)
• 308e853 fix: handle undefined options in Server constructor (#5695)
• 8b2b915 chore: update branch references from v4 to v5 in workflow configuration
• 870ed22 chore: add v5 branch to release workflow triggers
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions