chore(deps): bump the homepage-config-generator group across 1 directory with 4 updates

[dependabot]

Bumps the homepage-config-generator group with 4 updates in the /apps/homepage/config-generator directory: npm, yaml, @types/node and typescript.

Updates npm from 11.13.0 to 12.0.1

Release notes

Sourced from npm's releases.

v12.0.1

12.0.1 (2026-07-10)

Bug Fixes

• ecb02a8 #9745 view: avoid wrapping array results (#9745) (@​reggi, @​martinrrm, @​Copilot)
• 47fc8b1 #9740 correct bundled sigstore from dev dependency conflict (#9740) (@​james-pre)

Dependencies

• workspace: @npmcli/arborist@10.0.1
• workspace: libnpmdiff@9.0.1
• workspace: libnpmexec@11.0.1
• workspace: libnpmfund@8.0.1
• workspace: libnpmpack@10.0.1

libnpmpublish: v12.0.0

12.0.0 (2026-07-08)

⚠️ BREAKING CHANGES

• npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0
• opts.access now defaults to null instead of 'public'. With null, libnpmpublish no longer sets an explicit access level in the publish payload, so new scoped packages are created as restricted (registry default) and republishes preserve the existing access level. Callers that want to force public access must now pass access: 'public' explicitly.

Features

• 5b83698 #9737 trigger release process (#9737) (@​reggi)

v12.0.0

12.0.0 (2026-07-08)

⚠️ BREAKING CHANGES

• npm view --json now always returns an array.
• npm sbom --sbom-format=cyclonedx now reports the name field from each package's package.json instead of the on-disk directory name. The name, bom-ref, and purl of the root component and of aliased dependencies may change.
• npm no longer registers man pages with the system when installed globally. man npm-install will no longer work, but npm help install is unaffected.
• The npm pkg output is no longer forced to json. This means you can get single values without having to worry about wrapping of the values. It also outputs non-json content more similarly to npm view.
• npm shrinkwrap is removed, the shrinkwrap config alias is removed, and npm-shrinkwrap.json is no longer loaded or honored at the project root or from inside dependency tarballs. Rename project-root npm-shrinkwrap.json to package-lock.json; use bundleDependencies if you need to ship a locked dependency tree.
• The Twitter and Freenode profile fields have been removed from the npm registry. This means that users will no longer be able to set or view these fields in their npm profiles.
• npm will no longer attempt to resolve the path to node via whichnode. process.execPath is already set by Node to the resolved real path of the node binary, so the lookup was redundant. Scripts that expected npm to override process.execPath with a PATH-resolved (potentially symlinked) node path may be affected.
• the --json output of npm pack and npm publish have changed. They are now always consistent, and in the same format.
• the star, stars and unstar commands have been removed
• The npm adduser command has been removed. Create and manage user accounts on the npm website, and use npm login to authenticate on the command line.
• Preserve https protocol when working with git (#8703)
• The default license for npm init has been changed from "ISC" to an empty string. If not set, the license field will be omitted from new packages.
• npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0
• allow-git and allow-remote now default to "none"; set them to "all" (or "root") to install git or user-supplied tarball-URL dependencies.
• root `preinstall` now runs before dependencies are installed.
• unknown configs in .npmrc, unknown CLI flags, abbreviated flags, and single-hyphen multi-char shorthands now throw instead of warning.

Chores

• b77b532 #9735 remove pre-release mode from npm 12 and workspaces (#9735) (@​reggi, @​Copilot)

Dependencies

• workspace: @npmcli/arborist@10.0.0
• workspace: @npmcli/config@11.0.0

... (truncated)

Changelog

Sourced from npm's changelog.

12.0.1 (2026-07-10)

Bug Fixes

• ecb02a8 #9745 view: avoid wrapping array results (#9745) (@​reggi, @​martinrrm, @​Copilot)
• 47fc8b1 #9740 correct bundled sigstore from dev dependency conflict (#9740) (@​james-pre)

Dependencies

• workspace: @npmcli/arborist@10.0.1
• workspace: libnpmdiff@9.0.1
• workspace: libnpmexec@11.0.1
• workspace: libnpmfund@8.0.1
• workspace: libnpmpack@10.0.1

12.0.0 (2026-07-08)

⚠️ BREAKING CHANGES

• npm view --json now always returns an array.
• npm sbom --sbom-format=cyclonedx now reports the name field from each package's package.json instead of the on-disk directory name. The name, bom-ref, and purl of the root component and of aliased dependencies may change.
• npm no longer registers man pages with the system when installed globally. man npm-install will no longer work, but npm help install is unaffected.
• The npm pkg output is no longer forced to json. This means you can get single values without having to worry about wrapping of the values. It also outputs non-json content more similarly to npm view.
• npm shrinkwrap is removed, the shrinkwrap config alias is removed, and npm-shrinkwrap.json is no longer loaded or honored at the project root or from inside dependency tarballs. Rename project-root npm-shrinkwrap.json to package-lock.json; use bundleDependencies if you need to ship a locked dependency tree.
• The Twitter and Freenode profile fields have been removed from the npm registry. This means that users will no longer be able to set or view these fields in their npm profiles.
• npm will no longer attempt to resolve the path to node via whichnode. process.execPath is already set by Node to the resolved real path of the node binary, so the lookup was redundant. Scripts that expected npm to override process.execPath with a PATH-resolved (potentially symlinked) node path may be affected.
• the --json output of npm pack and npm publish have changed. They are now always consistent, and in the same format.
• the star, stars and unstar commands have been removed
• The npm adduser command has been removed. Create and manage user accounts on the npm website, and use npm login to authenticate on the command line.
• Preserve https protocol when working with git (#8703)
• The default license for npm init has been changed from "ISC" to an empty string. If not set, the license field will be omitted from new packages.
• npm now supports node ^22.22.2 || ^24.15.0 || >=26.0.0
• allow-git and allow-remote now default to "none"; set them to "all" (or "root") to install git or user-supplied tarball-URL dependencies.
• root `preinstall` now runs before dependencies are installed.
• unknown configs in .npmrc, unknown CLI flags, abbreviated flags, and single-hyphen multi-char shorthands now throw instead of warning.

Chores

• b77b532 #9735 remove pre-release mode from npm 12 and workspaces (#9735) (@​reggi, @​Copilot)

Dependencies

• workspace: @npmcli/arborist@10.0.0
• workspace: @npmcli/config@11.0.0
• workspace: libnpmaccess@11.0.0
• workspace: libnpmdiff@9.0.0
• workspace: libnpmexec@11.0.0
• workspace: libnpmfund@8.0.0
• workspace: libnpmorg@9.0.0
• workspace: libnpmpack@10.0.0
• workspace: libnpmpublish@12.0.0
• workspace: libnpmsearch@10.0.0
• workspace: libnpmteam@9.0.0
• workspace: libnpmversion@9.0.0

... (truncated)

Commits

• 72a6088 chore: release 12.0.1
• ecb02a8 fix(view): avoid wrapping array results (#9745)
• 47fc8b1 fix: correct bundled sigstore from dev dependency conflict (#9740)
• 4403f05 chore: release 12.0.0
• 5b83698 feat: trigger release process (#9737)
• b77b532 chore: remove pre-release mode from npm 12 and workspaces (#9735)
• 230e221 chore: release 12.0.0-pre.3
• 6fefd0e chore: clarify unknown-config breaking change note in changelog (#9733)
• fd75880 feat: warn instead of error on unknown .npmrc configs (#9729)
• 42b12c2 feat(install-scripts): use install-scripts as the warning log title
• Additional commits viewable in compare view

Updates yaml from 2.8.3 to 2.9.0

Release notes

Sourced from yaml's releases.

v2.9.0

The changes here are really only patches, but I'm releasing this as a minor version to note a small change to the documentation of parseDocument() and parseAllDocuments(): I've removed the claim that they'll "never throw".

It remains the case that practically all non-malicious inputs will be handled without emitting an error, but there is a decent chance that code paths remain where e.g. a RangeError due to call stack exhaustion can be triggered by malicious inputs. Up to now, I've considered these as security vulnerabilities, and in fact it's the only category of error for which yaml CVEs have been issued so far.

Starting from this release, I'll be considering such errors as bugs, but not vulnerabilities. I do welcome people and/or LLMs looking for them, but please report them as normal issues rather than suspected security vulnerabilities. This also applies to previously undiscovered bugs in earlier releases.

• fix: Avoid calling Array.prototype.push.apply() with large source array
• fix(lexer): Avoid recursive calls that may exhaust the call stack

v2.8.4

• Disable alias resolution with maxAliasCount:0 (#677)
• Handle invalid unicode escapes (e1a1a77)
• Apply minFractionDigits only to decimal strings (#676)

Commits

• ddb21b0 2.9.0
• 167365b docs: Clarify that not all errors can be avoided
• 6eca2a7 fix: Avoid calling Array.prototype.push.apply() with large source array
• 0543cd5 fix(lexer): Avoid recursive calls that may exhaust the call stack
• ccdf743 2.8.4
• f625789 fix: Disable alias resolution with maxAliasCount:0 (#677)
• e1a1a77 fix: Handle invalid unicode escapes
• a163ea0 style: Satify Prettier
• b2a5a6c fix: Apply minFractionDigits only to decimal strings (#676)
• 93c951b chore: Bump JSR version to v2.8.3 (#673)
• Additional commits viewable in compare view

Updates @types/node from 22.19.17 to 26.1.1

Commits

• See full diff in compare view

Updates typescript from 6.0.3 to 7.0.2

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[cloudflare-workers-and-pages]

Deploying my-own-suite-pages with    Cloudflare Pages

Latest commit:	7f8b60b
Status:	✅  Deploy successful!
Preview URL:	https://a71f59ed.my-own-suite-pages.pages.dev
Branch Preview URL:	https://dependabot-npm-and-yarn-apps-c7hq.my-own-suite-pages.pages.dev

View logs