Skip to content

deps(engine): bump the utilities group across 1 directory with 4 updates - #214

Merged
underpostnet merged 1 commit into
masterfrom
dependabot/npm_and_yarn/utilities-e58eafe94d
Oct 27, 2026
Merged

deps(engine): bump the utilities group across 1 directory with 4 updates#214
underpostnet merged 1 commit into
masterfrom
dependabot/npm_and_yarn/utilities-e58eafe94d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 26, 2026

Copy link
Copy Markdown
Contributor

Bumps the utilities group with 4 updates in the / directory: dotenv, nodemailer, shelljs and sitemap.

Updates dotenv from 18.0.8 to 18.0.9

Changelog

Sourced from dotenv's changelog.

18.0.9 (2026-10-14)

Changed

  • Permit DOTENV_PATH being empty string with the CLI (#1076)
Commits
  • 8d1ab85 18.0.9
  • 59a40ce changelog
  • 88228bd Merge pull request #1076 from Enesuygurs/fix/cli-empty-dotenv-path
  • bc6ef94 fix(cli): load the default .env when DOTENV_PATH is empty
  • 6d6e6c5 Merge pull request #1075 from kory-kaai/test/fast-parser-branch-coverage
  • 10218f1 test(parse-fast): cover the size-dependent and export-prefix branches
  • See full diff in compare view

Updates nodemailer from 10.1.7 to 10.2.1

Release notes

Sourced from nodemailer's releases.

v10.2.1

10.2.1 (2026-10-22)

Bug Fixes

  • drop the comments of a Content-Type or Content-Disposition value with the stripComments option (b3052b7)

v10.2.0

10.2.0 (2026-10-21)

Features

  • add info.serverMessageId from the final 250 reply (108dddd)
  • add pendingCount() to the SMTP pool (6cffb70)
  • make header value encoding public with MimeNode encodeHeaderValue() (3b048c7)
  • mark SMTP errors as permanent or transient with err.permanent (6a20e2a)

Bug Fixes

  • label an ASCII message/rfc822 attachment 7bit instead of 8bit (ad66fa1)
  • report the recipients an LMTP server refuses after DATA in rejectedErrors (dd64eb3)
Changelog

Sourced from nodemailer's changelog.

10.2.1 (2026-10-22)

Bug Fixes

  • drop the comments of a Content-Type or Content-Disposition value with the stripComments option (b3052b7)

10.2.0 (2026-10-21)

Features

  • add info.serverMessageId from the final 250 reply (108dddd)
  • add pendingCount() to the SMTP pool (6cffb70)
  • make header value encoding public with MimeNode encodeHeaderValue() (3b048c7)
  • mark SMTP errors as permanent or transient with err.permanent (6a20e2a)

Bug Fixes

  • label an ASCII message/rfc822 attachment 7bit instead of 8bit (ad66fa1)
  • report the recipients an LMTP server refuses after DATA in rejectedErrors (dd64eb3)
Commits
  • 8dbff1d Merge pull request #1902 from nodemailer/release-please--branches--master--co...
  • 6fe37ea test: import mailauth only on a Node.js it supports
  • 9f02395 chore(master): release 10.2.1
  • 5c80d84 chore: update dependencies
  • b3052b7 fix: drop the comments of a Content-Type or Content-Disposition value with th...
  • f656674 Merge pull request #1901 from nodemailer/release-please--branches--master--co...
  • 7931774 chore(master): release 10.2.0
  • ad66fa1 fix: label an ASCII message/rfc822 attachment 7bit instead of 8bit
  • 108dddd feat: add info.serverMessageId from the final 250 reply
  • 6a20e2a feat: mark SMTP errors as permanent or transient with err.permanent
  • Additional commits viewable in compare view

Updates shelljs from 0.8.5 to 0.10.0

Release notes

Sourced from shelljs's releases.

v0.10.0

What's Changed

New Contributors

Full Changelog: shelljs/shelljs@v0.9.2...v0.10.0

v0.9.2

What's Changed

Full Changelog: shelljs/shelljs@v0.9.1...v0.9.2

v0.9.1

What's Changed

Full Changelog: shelljs/shelljs@v0.9.0...v0.9.1

v0.9.0

What's Changed

... (truncated)

Changelog

Sourced from shelljs's changelog.

Change Log

Commits

Updates sitemap from 9.0.1 to 10.0.0

Release notes

Sourced from sitemap's releases.

10.0.0

[BREAKING CHANGES]

Dropped CommonJS build — the package is now ESM-only

  • require('sitemap') is no longer supported on Node versions without built-in require(esm). The dist/cjs build, the require export condition, and tsconfig.cjs.json are all gone; exports now resolves to dist/index.js for every consumer. Migrate to import { SitemapStream } from 'sitemap'.
  • Node.js >=22.22.1 now required (previously >=20.19.5). CommonJS consumers can still load this package through require(esm), which landed unflagged in 22.12; the floor is 22.22.1 to match the development toolchain.
  • Build output flattened from dist/esm/* and dist/cjs/* to dist/*. The bin entry is now dist/cli.js.

simpleSitemapAndIndex defaults to 45,000 URLs per sitemap

  • The default limit drops from 50,000 to 45,000, the same default SitemapAndIndexStream and the CLI already use (DEFAULT_SITEMAP_ITEM_LIMIT). The headroom keeps rich entries (images, video, news) under the 50MB uncompressed file-size limit. A 50,000-URL input now produces two sitemap files instead of one; pass limit: 50000 to keep the old output.

SitemapStream writes an empty sitemap instead of erroring

  • Ending a SitemapStream without writing any items now produces a well-formed empty <urlset> instead of failing with EmptySitemap (#394, #421). This matches SitemapIndexStream, which already wrote an empty <sitemapindex>. EmptySitemap is still exported but deprecated and no longer thrown. An empty <urlset> does not pass strict sitemap.xsd validation, which requires at least one <url>; search engines accept it.

One logger option across the library; xmlNS renamed to xmlns

  • SitemapStream, SitemapIndexStream, SitemapAndIndexStream and simpleSitemapAndIndex accept the same logger option the parsers already had (#348). Validation warnings that went straight to console.warn now go through it. Pass false to silence. The Logger type is now exported.
  • Invalid news and video attribute values now go through errorHandler (and so the logger) like every other validation error, instead of a hardcoded console.warn. The warning text is now the error's name and message, which starts with the item's URL. Under ErrorLevel.THROW a custom errorHandler receives these errors too, like every other validation error; the default handler still throws.
  • The SitemapStream property xmlNS is now xmlns, matching the option name (#300). xmlNS still works as a deprecated alias. SitemapStream.errorHandler is always set now; it defaults to a handler that warns through logger.

Both XML parsers share one error store and entry cap

... (truncated)

Changelog

Sourced from sitemap's changelog.

10.0.0 - 2026-10-19

[BREAKING CHANGES]

Dropped CommonJS build — the package is now ESM-only

  • require('sitemap') is no longer supported on Node versions without built-in require(esm). The dist/cjs build, the require export condition, and tsconfig.cjs.json are all gone; exports now resolves to dist/index.js for every consumer. Migrate to import { SitemapStream } from 'sitemap'.
  • Node.js >=22.22.1 now required (previously >=20.19.5). CommonJS consumers can still load this package through require(esm), which landed unflagged in 22.12; the floor is 22.22.1 to match the development toolchain.
  • Build output flattened from dist/esm/* and dist/cjs/* to dist/*. The bin entry is now dist/cli.js.

simpleSitemapAndIndex defaults to 45,000 URLs per sitemap

  • The default limit drops from 50,000 to 45,000, the same default SitemapAndIndexStream and the CLI already use (DEFAULT_SITEMAP_ITEM_LIMIT). The headroom keeps rich entries (images, video, news) under the 50MB uncompressed file-size limit. A 50,000-URL input now produces two sitemap files instead of one; pass limit: 50000 to keep the old output.

SitemapStream writes an empty sitemap instead of erroring

  • Ending a SitemapStream without writing any items now produces a well-formed empty <urlset> instead of failing with EmptySitemap (#394, #421). This matches SitemapIndexStream, which already wrote an empty <sitemapindex>. EmptySitemap is still exported but deprecated and no longer thrown. An empty <urlset> does not pass strict sitemap.xsd validation, which requires at least one <url>; search engines accept it.

One logger option across the library; xmlNS renamed to xmlns

  • SitemapStream, SitemapIndexStream, SitemapAndIndexStream and simpleSitemapAndIndex accept the same logger option the parsers already had (#348). Validation warnings that went straight to console.warn now go through it. Pass false to silence. The Logger type is now exported.
  • Invalid news and video attribute values now go through errorHandler (and so the logger) like every other validation error, instead of a hardcoded console.warn. The warning text is now the error's name and message, which starts with the item's URL. Under ErrorLevel.THROW a custom errorHandler receives these errors too, like every other validation error; the default handler still throws.
  • The SitemapStream property xmlNS is now xmlns, matching the option name (#300). xmlNS still works as a deprecated alias. SitemapStream.errorHandler is always set now; it defaults to a handler that warns through logger.

Both XML parsers share one error store and entry cap

... (truncated)

Commits
  • eaa8f14 Merge pull request #525 from ekalinin/claude/changelog-10-0-0
  • 7b3ae4f docs: date the 10.0.0 changelog entry
  • 45592c9 release 10.0.0
  • 54240eb Merge pull request #524 from ekalinin/claude/10-0-changelog-gaps-0113bc
  • b9f66f1 docs: fill 10.0 changelog gaps
  • 33a1144 Merge pull request #523 from ekalinin/claude/sitemap-issue-517-167468
  • bd041e1 test: cover invalid index items in SitemapAndIndexStream
  • 9c580d9 Merge pull request #522 from ekalinin/claude/update-outdated-dependencies-308dec
  • 40448e9 chore(deps): update dev dependencies, require Node >=22.22.1
  • 976ffa7 Merge pull request #521 from ekalinin/claude/issues-prs-triage-c03589
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
deps(engine): bump the utilities group across 1 directory with 4 updates
a3edad3 
Bumps the utilities group with 4 updates in the / directory: [dotenv](https://github.com/motdotla/dotenv), [nodemailer](https://github.com/nodemailer/nodemailer), [shelljs](https://github.com/shelljs/shelljs) and [sitemap](https://github.com/ekalinin/sitemap.js).


Updates `dotenv` from 18.0.8 to 18.0.9
- [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md)
- [Commits](motdotla/dotenv@v18.0.8...v18.0.9)

Updates `nodemailer` from 10.1.7 to 10.2.1
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](nodemailer/nodemailer@v10.1.7...v10.2.1)

Updates `shelljs` from 0.8.5 to 0.10.0
- [Release notes](https://github.com/shelljs/shelljs/releases)
- [Changelog](https://github.com/shelljs/shelljs/blob/main/CHANGELOG.md)
- [Commits](shelljs/shelljs@v0.8.5...v0.10.0)

Updates `sitemap` from 9.0.1 to 10.0.0
- [Release notes](https://github.com/ekalinin/sitemap.js/releases)
- [Changelog](https://github.com/ekalinin/sitemap.js/blob/master/CHANGELOG.md)
- [Commits](ekalinin/sitemap.js@9.0.1...10.0.0)

---
updated-dependencies:
- dependency-name: dotenv
  dependency-version: 18.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: utilities
- dependency-name: nodemailer
  dependency-version: 10.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: utilities
- dependency-name: shelljs
  dependency-version: 0.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: utilities
- dependency-name: sitemap
  dependency-version: 10.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: utilities
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Oct 26, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies, engine. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@socket-security

socket-security Bot commented Oct 26, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedshelljs@​0.8.5 ⏵ 0.10.094 -5100100 +183100
Updatedsitemap@​9.0.1 ⏵ 10.0.099 +110010085 -5100
Addeddotenv@​18.0.99910010095100
Updatednodemailer@​10.1.7 ⏵ 10.2.19810098 +196 +1100

View full report

@underpostnet
underpostnet merged commit 9ae0fca into master Oct 27, 2026
14 checks passed
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/utilities-e58eafe94d branch October 27, 2026 18:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@underpostnet