Bump the npm-all group across 1 directory with 4 updates by dependabot[bot] · Pull Request #345 · Azure-Samples/Durable-Task-Scheduler

dependabot · 2026-07-01T17:57:01Z

Bumps the npm-all group with 4 updates in the /samples/durable-functions/dotnet/AiAgentTravelPlanOrchestrator/Frontend directory: @azure/storage-blob, axios, @vitejs/plugin-react and vite.

Updates @azure/storage-blob from 12.31.0 to 12.33.0

Changelog

Sourced from @azure/storage-blob's changelog.

12.33.0 (2026-06-24)

Features Added

Includes all features released in 12.33.0-beta.1.

12.32.0 (2026-05-22)

Features Added

Includes all features released in 12.32.0-beta.1.

12.33.0-beta.1 (2026-04-29)

Features Added

Added support for service version 2026-06-06.

Added support for Blob Smart Tier.

Added support for Directory-level SAS and User Delegation SAS.

12.32.0-beta.1 (2026-03-05)

Features Added

Added support for service version 2026-04-06.

Added support for Content Validation via Structured Message.

Added support for Delete Blob Conditional Tier.

Added support for Server-side Encryption Rekeying.

Added cross-tenant support for Principal-Bound User Delegation SAS.

Added support for Dynamic User Delegation SAS.

Commits

5806568 Update swagger input-file to point to main-merged spec commit (#39061)
10cf325 [Storage] Updated STG102 Release Dates (#39042)
3181ad2 [EngSys] Bump min-version to node 22 (#38887) NO_CI
7097d6f [storage] use node:stream/consumers in samples and snippets (#38850)
f6ade9a [storage] releasing storage-common hotfix (#39031)
fbdff8a [storage] Merge STG102 features to main (#38949)
d740d83 Resolve interface comments (#38702)
ff9fc24 Update package version for stg101 (#38623)
603366d [storage] update streamToBuffer helpers to handle chunks correctly (#38465)
3de1abe Add imports field to all warp-built packages (#38391)
Additional commits viewable in compare view

Updates axios from 1.16.1 to 1.18.1

Release notes

Sourced from axios's releases.

v1.18.1 — June 21, 2026

This release focuses on Node HTTP adapter fixes, safer AxiosError serialisation, runtime/type correctness fixes, documentation updates, and dependency maintenance.

🐛 Bug Fixes

AxiosError Serialisation: Made AxiosError#cause non-enumerable to prevent circular JSON serialisation failures when errors include nested causes. (#10913)

Node HTTP Adapter: Guarded socket.setKeepAlive for proxy agent streams, accepted path-only URLs when socketPath is configured, deferred environment proxy handling to Node, and explicitly passed maxBodyLength through to follow-redirects. (#10917, #10930, #10942, #10993)

Runtime and Type Correctness: Fixed several runtime crashes, type definition mismatches, and incorrect error handling paths. (#10959, #11021)

AxiosURLSearchParams: Switched the encoder callback to an arrow function so encoder.call(this) receives the AxiosURLSearchParams instance correctly. (#11019)

🔧 Maintenance & Chores

Documentation: Documented sensitive headers and status transition behaviour, prepared cleaned-up docs, added Deno install instructions, and clarified that request data is request-specific (#11007, #11010, #11023, #11025)

Dependencies: Bumped vite, rollup, form-data, js-yaml, and multer across the root project, docs, smoke tests, and module test workspaces. (#11011, #11012, #11013, #11014, #11015, #11016, #11017, #11026)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

@webdevelopersrinu (#10913)

@sijie-Z (#10993)

@bartlomieju (#11023)

@JSap0914 (#11019)

Full Changelog

v1.18.0 — June 13, 2026

This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.

🔒 Security Fixes

Redirect Header Safety: Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (#10892)

URL And Request Hardening: Rejects malformed http: and https: URLs that omit // with ERR_INVALID_URL, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local NO_PROXY matching. (#11000)

🐛 Bug Fixes

Status Validation: Added transitional.validateStatusUndefinedResolves so applications can opt in to treating validateStatus: undefined like the option was omitted, while validateStatus: null remains the explicit way to accept every status. (#10899)

🔧 Maintenance & Chores

Documentation: Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the proxy request config as Node.js-only in the advanced docs. (#10984, #10988, #10992, #10995)

Dependencies: Bumped @babel/core, @babel/preset-env, @commitlint/cli, @commitlint/config-conventional, @rollup/plugin-babel, @rollup/plugin-commonjs, @vitest/browser, @vitest/browser-playwright, eslint, lint-staged, rollup, vitest, and actions/checkout. (#10989, #10996, #10997)

Release Metadata: Prepared the 1.18.0 release by updating package metadata and the runtime VERSION value. (#11003)

... (truncated)

Changelog

Sourced from axios's changelog.

Changelog

v1.18.0 — June 13, 2026

This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.

🔒 Security Fixes

Redirect Header Safety: Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (#10892)

URL And Request Hardening: Rejects malformed http: and https: URLs that omit // with ERR_INVALID_URL, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local NO_PROXY matching. (#11000)

🐛 Bug Fixes

Status Validation: Added transitional.validateStatusUndefinedResolves so applications can opt in to treating validateStatus: undefined like the option was omitted, while validateStatus: null remains the explicit way to accept every status. (#10899)

🔧 Maintenance & Chores

Documentation: Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the proxy request config as Node.js-only in the advanced docs. (#10984, #10988, #10992, #10995)

Dependencies: Bumped @babel/core, @babel/preset-env, @commitlint/cli, @commitlint/config-conventional, @rollup/plugin-babel, @rollup/plugin-commonjs, @vitest/browser, @vitest/browser-playwright, eslint, lint-staged, rollup, vitest, and actions/checkout. (#10989, #10996, #10997)

Release Metadata: Prepared the 1.18.0 release by updating package metadata and the runtime VERSION value. (#11003)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

@drori12 (#10984)

@eyupcanakman (#10899)

@Adi-Beker (#10995)

Full Changelog

v1.17.0 — June 1, 2026

This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.

🔒 Security Fixes

Config Hardening: Guarded socketPath, params, and paramsSerializer reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (#10901, #10922)

Release Publishing: Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (#10926)

🚀 New Features

HTTP Compression: Added Node HTTP adapter support for zstd response decompression, with transitional.advertiseZstdAcceptEncoding controlling whether zstd is advertised in Accept-Encoding. (#6792, #10920)

🐛 Bug Fixes

Authentication Handling: Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (#10929, #10896)

... (truncated)

Commits

a209bfb chore(release): prepare release 1.18.1 (#11027)
fa6a55e chore(deps-dev): bump multer from 2.1.1 to 2.2.0 (#11026)
40e7be8 docs: clarifies that request data is request-specific in axios (#11025)
a446b39 fix(AxiosURLSearchParams): use arrow function so encoder.call(this) receives ...
cf1306a docs: add Deno to install instructions (#11023)
b32880a fix: incorrect use of error (#11021)
1792eda fix: ensure maxBodyLength is explicitly passed to follow-redirects (#10993)
30499d6 fix: various runtime crashes and type definition mismatches (#10959)
20ce9c4 fix(http): defer env proxy handling to Node (#10942)
e64bcf9 chore(deps): merge branch 'v1.x' into tests/module/cjs (#11014)
Additional commits viewable in compare view

Updates @vitejs/plugin-react from 6.0.2 to 6.0.3

Changelog

Sourced from @vitejs/plugin-react's changelog.

6.0.3 (2026-06-23)

Commits

640fd35 release: plugin-react@6.0.3
889efb0 fix(deps): update all non-major dependencies (#1249)
6c57dd4 fix(plugin-react): use '/' base in bundledDev preamble to fix non-root base p...
3cc33a7 fix(deps): update react-related dependencies (#1245)
c0f7c7f docs: mention the Biome rule in the "Consistent components exports" section (...
cd80f0f fix(deps): update all non-major dependencies (#1241)
e38acca fix(deps): update all non-major dependencies (#1227)
9a9bb26 perf(react): improve react compiler preset so that slightly more modules are ...
See full diff in compare view

Updates vite from 8.0.16 to 8.1.2

Release notes

Sourced from vite's releases.

v8.1.2

Please refer to CHANGELOG.md for details.

v8.1.1

Please refer to CHANGELOG.md for details.

create-vite@8.1.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.1.0

Please refer to CHANGELOG.md for details.

v8.1.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.1.0-beta.0

Please refer to CHANGELOG.md for details.

v8.1.0-beta.0

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.1.2 (2026-06-30)

Bug Fixes

deps: revert es-module-lexer to 2.1.0 (#22827) (0d3bd7c)

restore, "fix: resolve pnpm .modules.yaml from workspace root instead of cwd (#22757)" (#22825) (efb98cc)

revert, "fix: escape ids with multiple null bytes (#22687)" (cccef55)

revert, "fix: resolve pnpm .modules.yaml from workspace root instead of cwd (#22757)" (cf97711)

8.1.1 (2026-06-30)

Features

update dynamic import warning to link to Vite docs (#22823) (62bd7af)

Bug Fixes

bundled-dev: avoid stack overflow on import.meta.hot.invalidate() (#22797) (709eb8e)

bundled-dev: serve assets emitted during HMR/lazy compile (#22745) (5876b2c)

bundledDev: skip plugin transform hooks for rolldown-lazy stub modules (#22778) (8f925e2)

css: preserve dollar signs in external @import urls with lightningcss (#22718) (9fa7ab4)

css: resolve tsconfig paths in CSS and Sass @import (#22775) (ef0b891)

deps: update all non-major dependencies (#22734) (e635f49)

deps: update all non-major dependencies (#22804) (8837400)

deps: update rolldown-related dependencies (#22591) (2ce6677)

escape ids with multiple null bytes (#22687) (833fc30)

hide console window when running 'net use' on Windows (#22698) (92b63f2)

ignore bundled config temp dir (#22800) (043a810)

invert esbuild.jsxSideEffects when converting to oxc.jsx.pure (#22809) (33895ba)

optimize-deps: ignore ERR_CLOSED_SERVER in scanner (#22784) (085a0ab)

optimizer: scanner should resolve input from root (#22769) (9722b07)

resolve pnpm .modules.yaml from workspace root instead of cwd (#22757) (2531ac7)

return sourcemap field from some plugins that were lacking (#22782) (7e18bf8)

server: handle malformed URI in indexHtmlMiddleware (#22781) (84f5ccc)

Miscellaneous Chores

improve dependency optimizer messages (#22549) (092cb3b)

Code Refactoring

css: remove lightningcss null byte bug workaround (#22822) (2dafd3b)

use pre-defined environments variable to avoid duplicate Object.values calls (#22790) (1113acf)

Tests

enable "manual chunk path" test and remove "worker.format error" test (#22824) (c088511)

8.1.0 (2026-06-23)

Features

extend server.fs.deny list with common files (#22707) (61ba8fd)

... (truncated)

Commits

ba31193 release: v8.1.2
0d3bd7c fix(deps): revert es-module-lexer to 2.1.0 (#22827)
efb98cc fix: restore, "fix: resolve pnpm .modules.yaml from workspace root instead of...
cf97711 fix: revert, "fix: resolve pnpm .modules.yaml from workspace root instead of ...
cccef55 fix: revert, "fix: escape ids with multiple null bytes (#22687)"
4ae9e14 release: v8.1.1
8f925e2 fix(bundledDev): skip plugin transform hooks for rolldown-lazy stub modules (...
c088511 test: enable "manual chunk path" test and remove "worker.format error" test (...
62bd7af feat: update dynamic import warning to link to Vite docs (#22823)
2dafd3b refactor(css): remove lightningcss null byte bug workaround (#22822)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the npm-all group with 4 updates in the /samples/durable-functions/dotnet/AiAgentTravelPlanOrchestrator/Frontend directory: [@azure/storage-blob](https://github.com/Azure/azure-sdk-for-js/tree/HEAD/sdk/storage/storage-blob), [axios](https://github.com/axios/axios), [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). Updates `@azure/storage-blob` from 12.31.0 to 12.33.0 - [Release notes](https://github.com/Azure/azure-sdk-for-js/releases) - [Changelog](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/storage/storage-blob/CHANGELOG.md) - [Commits](https://github.com/Azure/azure-sdk-for-js/commits/@azure/storage-blob_12.33.0/sdk/storage/storage-blob) Updates `axios` from 1.16.1 to 1.18.1 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.16.1...v1.18.1) Updates `@vitejs/plugin-react` from 6.0.2 to 6.0.3 - [Release notes](https://github.com/vitejs/vite-plugin-react/releases) - [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.0.3/packages/plugin-react) Updates `vite` from 8.0.16 to 8.1.2 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.1.2/packages/vite) --- updated-dependencies: - dependency-name: "@azure/storage-blob" dependency-version: 12.33.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-all - dependency-name: axios dependency-version: 1.18.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-all - dependency-name: "@vitejs/plugin-react" dependency-version: 6.0.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-all - dependency-name: vite dependency-version: 8.1.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-all ... Signed-off-by: dependabot[bot] <support@github.com>

torosent

Approving: real CI (all sample builds + CLA) passing. Only the disallowed auto-merge job fails; that workflow is being removed.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 1, 2026

torosent approved these changes Jul 2, 2026

View reviewed changes

torosent merged commit 8dd7cee into main Jul 2, 2026
7 of 8 checks passed

torosent deleted the dependabot/npm_and_yarn/samples/durable-functions/dotnet/AiAgentTravelPlanOrchestrator/Frontend/npm-all-f6dd0be83e branch July 2, 2026 16:49

torosent mentioned this pull request Jul 2, 2026

Bump form-data from 4.0.5 to 4.0.6 in /samples/durable-functions/dotnet/AiAgentTravelPlanOrchestrator/Frontend #336

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump the npm-all group across 1 directory with 4 updates#345

Bump the npm-all group across 1 directory with 4 updates#345
torosent merged 1 commit into
mainfrom
dependabot/npm_and_yarn/samples/durable-functions/dotnet/AiAgentTravelPlanOrchestrator/Frontend/npm-all-f6dd0be83e

dependabot Bot commented on behalf of github Jul 1, 2026

Uh oh!

torosent left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 1, 2026

12.33.0 (2026-06-24)

Features Added

12.32.0 (2026-05-22)

Features Added

12.33.0-beta.1 (2026-04-29)

Features Added

12.32.0-beta.1 (2026-03-05)

Features Added

v1.18.1 — June 21, 2026

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

v1.18.0 — June 13, 2026

🔒 Security Fixes

🐛 Bug Fixes

🔧 Maintenance & Chores

Changelog

v1.18.0 — June 13, 2026

🔒 Security Fixes

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

v1.17.0 — June 1, 2026

🔒 Security Fixes

🚀 New Features

🐛 Bug Fixes

6.0.3 (2026-06-23)

v8.1.2

v8.1.1

create-vite@8.1.0

plugin-legacy@8.1.0

v8.1.0

plugin-legacy@8.1.0-beta.0

v8.1.0-beta.0

8.1.2 (2026-06-30)

Bug Fixes

8.1.1 (2026-06-30)

Features

Bug Fixes

Miscellaneous Chores

Code Refactoring

Tests

8.1.0 (2026-06-23)

Features

Uh oh!

torosent left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant