chore(deps): bump @appium/support from 7.0.6 to 7.2.8

[dependabot]

Bumps @appium/support from 7.0.6 to 7.2.8.

Release notes

Sourced from @​appium/support's releases.

@​appium/support@​7.2.8

7.2.8 (2026-09-24)

Bug Fixes

• support: avoid TOCTOU race in getLockFileGuard() acquisition (#22807) (7df378f)
• support: do not delete a path when fs.mv destination is the source or inside it (#22806) (4dd2e2d)
• support: do not set file-sized Content-Length on default multipart uploads (#22766) (9a70a44)
• support: extract zip entries whose names start with dots (#22772) (dc16d69)

Changelog

Sourced from @​appium/support's changelog.

7.2.8 (2026-09-24)

Bug Fixes

• support: avoid TOCTOU race in getLockFileGuard() acquisition (#22807) (7df378f)
• support: do not delete a path when fs.mv destination is the source or inside it (#22806) (4dd2e2d)
• support: do not set file-sized Content-Length on default multipart uploads (#22766) (9a70a44)
• support: extract zip entries whose names start with dots (#22772) (dc16d69)

7.2.7 (2026-08-24)

Bug Fixes

• support: do not treat a sibling folder as a subpath of the root (#22586) (3a80498)

7.2.6 (2026-07-25)

Bug Fixes

• support: Prevent extraction of external symlinks (#22436) (d9eb36f)
• Typescript references (#22458) (fd70da7)

7.2.5 (2026-06-18)

Bug Fixes

• support: uploadFile overload (#22400) (779a3a0)

7.2.4 (2026-06-18)

Note: Version bump only for package @​appium/support

7.2.3 (2026-05-31)

Note: Version bump only for package @​appium/support

... (truncated)

Commits

• eb5ce47 chore: publish
• 7df378f fix(support): avoid TOCTOU race in getLockFileGuard() acquisition (#22807)
• 4dd2e2d fix(support): do not delete a path when fs.mv destination is the source or in...
• 3f38f5c chore(types): update dependency type-fest to v5.10.0 (#22798)
• dc16d69 fix(support): extract zip entries whose names start with dots (#22772)
• 9a70a44 fix(support): do not set file-sized Content-Length on default multipart uploa...
• 8ccb436 chore(deps): bump ESLint and bplist-related dependencies (#22748)
• 1ada93c chore(types): update dependency type-fest to v5.9.0 (#22713)
• 6e989bd chore(support): update dependency axios to v1.20.0 (#22692)
• 70a01da chore(support): update dependency asyncbox to v6.4.3 (#22688)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

Semver Impact of This PR

⚪ None (no version bump detected)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).

---

• chore(deps): bump @appium/support from 7.0.6 to 7.2.8 by dependabot[bot] in #6897

• ci(e2e): Remove app metrics job and performance-tests by antonis in #6896

---

_{🤖 This preview updates automatically when you update the PR.}

[socket-security]

Warning

Socket is a tool Sentry Security team deployed to defend against supply chain attack. Please provide any feedback you have in #discuss-security slack channel ❤️

Priority	Alert  (click "▶" to expand/collapse)	Action
	Critical CVE: npm shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` token CVE: GHSA-pqg4-j6r4-53mv shell-quote: quote() command injection via a line terminator in a token after a { comment } token (CRITICAL) Affected versions: >= 1.8.4 < 1.11.0 Patched version: 1.11.0 From: ? → npm/shell-quote@1.10.0 ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/shell-quote@1.10.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report