Skip to content

chore(deps): bump pako and @types/pako - #137

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-6b9176e2f6
Closed

chore(deps): bump pako and @types/pako#137
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-6b9176e2f6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps pako and @types/pako. These dependencies needed to be updated together.
Updates pako from 2.2.0 to 3.0.2

Changelog

Sourced from pako's changelog.

3.0.2 - 2026-09-12

Fixed

  • Port missed upstream zlib fix for block type selection with Z_FIXED, avoiding fixed blocks when stored blocks would be smaller, #316.
  • Read gzip header time as an unsigned 32-bit value, fixing negative timestamps from 2038 onward, #311.

3.0.1 - 2026-07-06

Changed

  • Narrow Uint8Array type to ArrayBuffer only
  • Added Z_STREAM_ERROR check (reachable only via wrong options call)

[3.0.0] - 2026-06-26

Added

  • Generated type definitions.
  • Low-level zlib API exports.
  • .onStart() hooks for advanced stream setup.

Changed

  • Switched sources to TypeScript, and tests, examples and benchmarks to ESM.
  • Changed exports to named-only. Use import * as pako from 'pako' instead of default import if you need the whole API as an object.
  • Changed package files layout. See package.json for supported entry points.
  • legacyHash default is now false. Binary output is now compatible with nodejs by default.
  • dictionary option now accepts only Uint8Array / ArrayBuffer (no String anymore).
  • .onEnd() now only assembles output chunks into result, and no longer sets the err / msg fields.
  • Use native TextEncoder / TextDecoder for string conversion. Removed shims.
  • Replaced { to: 'string' }) with { toText: true }) for UTF-8 text output in high-level helpers (inflate, inflateRaw, ungzip).
  • Build dist/ on publish instead of keeping generated bundles in git.
  • Inflate.push() after stream end returns the decode result, not always false.

Removed

  • Default export. import pako from 'pako' is no longer supported.
  • { to: 'string' }) option from the streaming Inflate class. It now always emits byte chunks.

... (truncated)

Commits

Updates @types/pako from 2.0.4 to 3.0.0

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 11, 2026
@replicated-software-factory replicated-software-factory Bot mentioned this pull request Oct 12, 2026
Merged
@dependabot
chore(deps): bump pako and @types/pako
038ed98 
Bumps [pako](https://github.com/nodeca/pako) and [@types/pako](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/pako). These dependencies needed to be updated together.

Updates `pako` from 2.2.0 to 3.0.2
- [Changelog](https://github.com/nodeca/pako/blob/master/CHANGELOG.md)
- [Commits](nodeca/pako@2.2.0...3.0.2)

Updates `@types/pako` from 2.0.4 to 3.0.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/pako)

---
updated-dependencies:
- dependency-name: "@types/pako"
  dependency-version: 3.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
- dependency-name: pako
  dependency-version: 3.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-6b9176e2f6 branch from 6dac825 to 038ed98 Compare October 13, 2026 05:32
@replicated-software-factory replicated-software-factory Bot mentioned this pull request Oct 14, 2026
Merged
xavpaice pushed a commit that referenced this pull request Oct 15, 2026
@replicated-software-factory ElasticClaw Factory
chore(deps): update npm dependencies (#139)
2423353 
- In-range npm update: refresh 36 transitive packages in
  package-lock.json (prettier 3.9.9 -> 3.9.10, express 5.2.1 -> 5.3.0,
  pino 10.3.1 -> 10.4.0, follow-redirects 1.16.0 -> 1.16.1,
  ip-address 10.7.2 -> 10.7.4, @babel/* 7.29.10, browserslist data)
- Prod audit: 0 vulnerabilities. Remaining 20 findings are the known
  dev-only jest-25-era cluster with no forward fix (npm fixAvailable
  requires downgrades: jest 25 / ts-jest 27; sprintf-js has no fixed
  release)
- Majors intentionally not taken (owned by open dependabot PRs or out
  of scope for an unattended run): pako 3 (PR #137, breaking named-only
  exports), get-port 7 (PR #129), typescript 7

make test: 96/96 passed (two clean full-suite runs; intermittent Pact
"Server is not running" flake A/B-reproduces on the pre-update lockfile
- pre-existing, not from this update)

Co-authored-by: ElasticClaw Factory <factory@replicated.com>
@replicated-software-factory replicated-software-factory Bot mentioned this pull request Oct 16, 2026
Merged
xavpaice pushed a commit that referenced this pull request Oct 19, 2026
@replicated-software-factory ElasticClaw Factory
[deps] Dependency update: replicated-lib (#140)
07b2220 
* chore(deps): update npm dependencies

- In-range npm update: refresh 14 transitive packages in
  package-lock.json (graphql-tools 12.0.4 -> 12.1.0, mockttp
  4.6.3 -> 4.6.4, ts-jest 29.4.14 -> 29.4.15, qs 6.16.0 -> 6.16.1,
  undici 6.29.0 -> 6.29.1, browserslist data, react-is 19.3.1)
- Prod audit: 0 vulnerabilities. Remaining 20 findings are the known
  dev-only jest-25-era cluster with no forward fix (npm fixAvailable
  requires downgrades: jest 25 / ts-jest 27; sprintf-js has no fixed
  release)
- Majors intentionally not taken (owned by open dependabot PRs): pako 3
  (PR #137), get-port 7 (PR #129)

make test: 96/96 passed

* chore(deps): update npm dependencies

---------

Co-authored-by: ElasticClaw Factory <factory@replicated.com>
@replicated-software-factory replicated-software-factory Bot mentioned this pull request Oct 20, 2026
Merged
@dependabot @github

dependabot Bot commented on behalf of github Oct 23, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are no longer a dependency, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 23, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/multi-6b9176e2f6 branch October 23, 2026 03:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants