Skip to content

build(deps): bump tar, @hey-api/openapi-ts and npm-check-updates in /frontend#2644

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/frontend/multi-66600b107a
Open

build(deps): bump tar, @hey-api/openapi-ts and npm-check-updates in /frontend#2644
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/frontend/multi-66600b107a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 15, 2026

Copy link
Copy Markdown
Contributor

Removes tar. It's no longer used after updating ancestor dependencies tar, @hey-api/openapi-ts and npm-check-updates. These dependencies need to be updated together.

Removes tar

Updates @hey-api/openapi-ts from 0.55.2 to 0.98.2

Release notes

Sourced from @​hey-api/openapi-ts's releases.

@​hey-api/openapi-ts@​0.95.0

Minor Changes

Validator request schemas

Valibot plugin no longer exports composite request Data schemas. Instead, each layer is exported as a separate schema. If you're using validators with SDKs, you can preserve the composite schema with shouldExtract:

export default {
  input: "hey-api/backend", // sign up at app.heyapi.dev
  output: "src/client",
  plugins: [
    // ...other plugins
    {
      name: "sdk",
      validator: "valibot",
    },
    {
      name: "valibot",
      requests: {
        shouldExtract: true,
      },
    },
  ],
};

Removed plugin.getSymbol() function

This function has been removed. You can use plugin.querySymbol() instead. It accepts the same arguments and returns the same result.

Validator request schemas

Zod plugin no longer exports composite request Data schemas. Instead, each layer is exported as a separate schema. If you're using validators with SDKs, you can preserve the composite schema with shouldExtract:

export default {
  input: "hey-api/backend", // sign up at app.heyapi.dev
  output: "src/client",
  plugins: [
    // ...other plugins
    {
      name: "sdk",
      validator: "zod",
</tr></table>

... (truncated)

Changelog

Sourced from @​hey-api/openapi-ts's changelog.

@​hey-api/openapi-ts 0.98.2

Plugins

@​hey-api/client-angular

  • reassign the result of HttpHeaders.delete() back to opts.headers (#3988)
  • export augmentable ClientMeta interface (#3996)

@​hey-api/client-axios

  • export augmentable ClientMeta interface (#3996)

@​hey-api/client-fetch

  • export augmentable ClientMeta interface (#3996)

@​hey-api/client-ky

  • export augmentable ClientMeta interface (#3996)

@​hey-api/client-next

  • export augmentable ClientMeta interface (#3996)

@​hey-api/client-nuxt

  • export augmentable ClientMeta interface (#3996)

@​hey-api/client-ofetch

  • export augmentable ClientMeta interface (#3996)

@​hey-api/sdk

  • don't expose SSE errors as iterator return types (#3989)
  • support type-safe meta option via augmentable ClientMeta interface (#3996)

@​hey-api/codegen-core 0.9.0

Updates

  • symbol: add event listeners (#3998)
  • types: rename ProjectRenderMeta to ProjectMeta and key it by language (#3984)
  • utils: expose Version class (#3991)

... (truncated)

Commits
  • 873d05f Merge pull request #3985 from hey-api/changeset-release/main
  • c7c82b4 ci: release
  • 30a6bca Merge pull request #4021 from hey-api/renovate/semver-7.x
  • 07150d5 Merge pull request #4022 from hey-api/chore/yaml-deps
  • ce508be chore: clean up yaml dependencies
  • 0ca7962 Merge pull request #4020 from hey-api/renovate/js-yaml-4.x
  • da019f0 fix(deps): update dependency semver to v7.8.2
  • 6e268eb fix(deps): update dependency js-yaml to v4.2.0
  • 402f5ea Merge pull request #3988 from joshkaplinsky/fix/angular-http-headers-immutable
  • 92358e7 Update orange-symbols-reply.md
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​hey-api/openapi-ts since your current version.


Updates npm-check-updates from 16.14.20 to 22.2.3

Release notes

Sourced from npm-check-updates's releases.

v22.2.3

What's Changed

Full Changelog: raineorshine/npm-check-updates@v22.2.2...v22.2.3

v22.2.2

What's Changed

Full Changelog: raineorshine/npm-check-updates@v22.2.1...v22.2.2

v22.2.1

What's Changed

Full Changelog: raineorshine/npm-check-updates@v22.2.0...v22.2.1

... (truncated)

Commits
  • 5814d25 22.2.3
  • 9f71155 docs(cooldown): document package manager cooldown configs
  • f076b61 Fall back to pnpm global config for minimumReleaseAge cooldown (#1777)
  • a0c4e64 fix: handle registries missing 'time' metadata during version resolution (#1763)
  • 4a83d68 build(deps-dev): bump tsx from 4.22.3 to 4.22.4 (#1778)
  • b745800 build(deps-dev): bump eslint-import-resolver-typescript (#1779)
  • e1f401a build(deps-dev): bump unplugin-dts from 1.0.1 to 1.0.2 (#1780)
  • 298c6f9 build(deps-dev): bump js-yaml from 4.1.1 to 4.2.0 (#1781)
  • 51c1870 build(deps-dev): bump semver from 7.8.0 to 7.8.1 (#1760)
  • 290d62b 22.2.2
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
build(deps): bump tar, @hey-api/openapi-ts and npm-check-updates
ee3afb4 
Removes [tar](https://github.com/isaacs/node-tar). It's no longer used after updating ancestor dependencies [tar](https://github.com/isaacs/node-tar), [@hey-api/openapi-ts](https://github.com/hey-api/openapi-ts) and [npm-check-updates](https://github.com/raineorshine/npm-check-updates). These dependencies need to be updated together.


Removes `tar`

Updates `@hey-api/openapi-ts` from 0.55.2 to 0.98.2
- [Release notes](https://github.com/hey-api/openapi-ts/releases)
- [Changelog](https://github.com/hey-api/openapi-ts/blob/main/CHANGELOG.md)
- [Commits](https://github.com/hey-api/openapi-ts/compare/@hey-api/openapi-ts@0.55.2...@hey-api/openapi-ts@0.98.2)

Updates `npm-check-updates` from 16.14.20 to 22.2.3
- [Release notes](https://github.com/raineorshine/npm-check-updates/releases)
- [Changelog](https://github.com/raineorshine/npm-check-updates/blob/main/CHANGELOG.md)
- [Commits](raineorshine/npm-check-updates@v16.14.20...v22.2.3)

---
updated-dependencies:
- dependency-name: tar
  dependency-version:
  dependency-type: indirect
- dependency-name: "@hey-api/openapi-ts"
  dependency-version: 0.98.2
  dependency-type: direct:development
- dependency-name: npm-check-updates
  dependency-version: 22.2.3
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jun 15, 2026
@dependabot dependabot Bot mentioned this pull request Jun 15, 2026
Closed
@github-actions github-actions Bot enabled auto-merge (squash) June 15, 2026 18:48
@github-actions

github-actions Bot commented Jun 15, 2026

Copy link
Copy Markdown

⚠️ NPM Dependency Update - Manual Review Required

This Dependabot PR updates npm dependencies. Due to recent npm supply chain attacks, this PR requires manual security review before merging.

Security Checklist:

  • Review the changed packages for known vulnerabilities
  • Check for suspicious postinstall scripts
  • Verify package authenticity and maintainer reputation
  • Run ./utils/scan-npm-compromise.sh locally
  • Review npm audit output

Do not enable auto-merge for this PR.

@github-actions github-actions Bot disabled auto-merge June 15, 2026 18:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants