build(deps): bump the npm_and_yarn group across 1 directory with 6 updates

[dependabot]

Bumps the npm_and_yarn group with 5 updates in the / directory:

Package	From	To
@octokit/endpoint	9.0.5	9.0.6
@octokit/plugin-paginate-rest	11.3.1	11.4.4-cjs.2
@octokit/request	8.4.0	8.4.1
handlebars	4.7.8	4.7.9
minimatch	3.1.2	3.1.5
minimatch	9.0.5	9.0.9

Updates @octokit/endpoint from 9.0.5 to 9.0.6

Release notes

Sourced from @​octokit/endpoint's releases.

v9.0.6

9.0.6 (2025-02-14)

Bug Fixes

• ReDos regex vulnerability, reported by @​DayShift (#515) (599ff4f)

Commits

• 599ff4f fix: ReDos regex vulnerability, reported by @​DayShift (#515)
• See full diff in compare view

Updates @octokit/plugin-paginate-rest from 11.3.1 to 11.4.4-cjs.2

Release notes

Sourced from @​octokit/plugin-paginate-rest's releases.

v11.4.4-cjs.2

11.4.4-cjs.2 (2025-02-26)

[!IMPORTANT] This is a special release to backport newer changes to CJS and address a ReDos vulnerability

Bug Fixes

• deps: update @octokit/plugin-rest-endpoint-methods (2c70eaf)

v11.4.4-cjs.1

11.4.4-cjs.1 (2025-02-26)

[!IMPORTANT] This is a special release to backport newer changes to CJS and address a ReDos vulnerability

Bug Fixes

• release: set prerelease flag for correct channel (ce534d9) See octokit/plugin-paginate-rest.js@v11.3.1...v11.4.4-cjs.1 for the full comparision

Reverts

• Revert "docs(README): update examples to use ESM (#611)" (1389b71)
• Revert "feat: package is now ESM (#596)" (64ba6f4)
• Revert "fix(pkg): add default fallback and types export (#612)" (27a8552)

v11.4.3

11.4.3 (2025-02-24)

Bug Fixes

• types: correct pagination return type for data which is an array (#662) (9a51aad), closes #661

v11.4.2

11.4.2 (2025-02-13)

Bug Fixes

• types: add back the pagination keys (#653) (8b8c500), closes #652

v11.4.1

... (truncated)

Commits

• 2c70eaf fix(deps): update @octokit/plugin-rest-endpoint-methods
• 1bf98ba test: fixup tests
• 57d0842 build: lockfile update
• edc1984 build: bump devDependencies
• 738e4b3 Merge branch 'main' into cjs
• ce534d9 fix(release): set prerelease flag for correct channel
• 1c297ca chore(deps): update dependency semantic-release-plugin-update-version-in-file...
• 60d26d9 chore(deps): update dependency prettier to v3.5.2 (#664)
• 9a51aad fix(types): correct pagination return type for data which is an array (#662)
• 8b8c500 fix(types): add back the pagination keys (#653)
• Additional commits viewable in compare view

Updates @octokit/request from 8.4.0 to 8.4.1

Release notes

Sourced from @​octokit/request's releases.

v8.4.1

8.4.1 (2025-02-15)

Bug Fixes

• ReDos regex vulnerability, reported by @​DayShift (#741) (356411e)

Commits

• 356411e fix: ReDos regex vulnerability, reported by @​DayShift (#741)
• See full diff in compare view

Updates @octokit/request-error from 5.1.0 to 5.1.1

Release notes

Sourced from @​octokit/request-error's releases.

v5.1.1

5.1.1 (2025-02-14)

Bug Fixes

• ReDos regex vulnerability, reported by @​dayshift (12a14f0)

Commits

• b51ed27 test: ReDos regex vulnerability, reported by @​dayshift
• 12a14f0 fix: ReDos regex vulnerability, reported by @​dayshift
• See full diff in compare view

Updates handlebars from 4.7.8 to 4.7.9

Release notes

Sourced from handlebars's releases.

v4.7.9

• fix: enable shell mode for spawn to resolve Windows EINVAL issue - e0137c2
• fix type "RuntimeOptions" also accepting string partials - eab1d14
• feat(types): set hash to be a Record<string, any> - de4414d
• fix non-contiguous program indices - 4512766
• refactor: rename i to startPartIndex - e497a35
• security: fix security issues - 68d8df5
  • GHSA-2w6w-674q-4c4q
  • GHSA-3mfm-83xf-c92r
  • GHSA-xhpv-hc6g-r9c6
  • GHSA-xjpj-3mr7-gcpf
  • GHSA-9cx6-37pm-9jff
  • GHSA-2qvq-rjwj-gvw9
  • GHSA-7rx3-28cr-v5wh
  • GHSA-442j-39wm-28r2

Commits

Changelog

Sourced from handlebars's changelog.

v4.7.9 - March 26th, 2026

• fix: enable shell mode for spawn to resolve Windows EINVAL issue - e0137c2
• fix type "RuntimeOptions" also accepting string partials - eab1d14
• feat(types): set hash to be a Record<string, any> - de4414d
• fix non-contiguous program indices - 4512766
• refactor: rename i to startPartIndex - e497a35
• security: fix security issues - 68d8df5

Commits

Commits

• dce542c v4.7.9
• 8a41389 Update release notes
• 68d8df5 Fix security issues
• b2a0831 Fix browser tests
• 9f98c16 Fix release script
• 45443b4 Revert "Improve partial indenting performance"
• 8841a5f Fix CI errors with linting
• e0137c2 fix: enable shell mode for spawn to resolve Windows EINVAL issue
• e914d60 Improve rendering performance
• 7de4b41 Upgrade GitHub Actions checkout and setup-node on 4.x branch
• Additional commits viewable in compare view

Updates minimatch from 3.1.2 to 3.1.5

Commits

• 7bba978 3.1.5
• bd25942 docs: add warning about ReDoS
• 1a9c27c fix partial matching of globstar patterns
• 1a2e084 3.1.4
• ae24656 update lockfile
• b100374 limit recursion for **, improve perf considerably
• 26ffeaa lockfile update
• 9eca892 lock node version to 14
• 00c323b 3.1.3
• 30486b2 update CI matrix and actions
• Additional commits viewable in compare view

Updates minimatch from 9.0.5 to 9.0.9

Commits

• 7bba978 3.1.5
• bd25942 docs: add warning about ReDoS
• 1a9c27c fix partial matching of globstar patterns
• 1a2e084 3.1.4
• ae24656 update lockfile
• b100374 limit recursion for **, improve perf considerably
• 26ffeaa lockfile update
• 9eca892 lock node version to 14
• 00c323b 3.1.3
• 30486b2 update CI matrix and actions
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

Note

Low Risk
Low risk dependency-only update; main impact is potential runtime behavior changes from patched @octokit/rest/Octokit internals and related tooling deps, but versions are minor/patch and include security fixes.

Overview
Updates runtime dependency @octokit/rest to ^20.1.2 and refreshes package-lock.json to pull in newer Octokit internals (@octokit/endpoint, @octokit/request, @octokit/request-error, @octokit/types/openapi-types).

Also bumps lockfile-only transitive deps including handlebars and minimatch (both direct and nested) to newer patch releases.

^{Reviewed by Cursor Bugbot for commit 5f511f4. Bugbot is set up for automated code reviews on this repo. Configure here.}