chore(deps): bump the production-dependencies group across 1 directory with 8 updates

[dependabot]

Bumps the production-dependencies group with 8 updates in the / directory:

Package	From	To
@reddb-io/toon	0.13.2	0.28.2
graphql	17.0.1	17.0.2
jose	6.2.3	6.2.9
js-yaml	4.3.1	5.3.0
tsx	4.22.4	4.23.12
typescript	6.0.3	7.0.2
ws	8.21.0	8.21.3
marked	18.0.5	18.0.9

Updates @reddb-io/toon from 0.13.2 to 0.28.2

Release notes

Sourced from @​reddb-io/toon's releases.

tq v0.28.2

What's in 0.28.1-next.280

🐛 Bug fixes

• #363 Issue #363

📚 Documentation

• close CLI option parity ledger (Refs #363)
• define the toon binary contract (Refs #363)
• distinguish tq from the toon drop-in (Refs #363)
• announce the toon drop-in bins (Refs #363)

🧪 Tests

• pin zero CLI option divergences (Refs #363)

Full Changelog: reddb-io/toon@v0.28.1...v0.28.1-next.280

---

TOON v4.1 checkpoint

This release closes the repository's v4.1 frontier at the official TOON v4.1.1 checkpoint: revision and reference implementation revision . The TypeScript package, Rust crate, , and editor grammar share that baseline and are validated against the vendored official corpus.

API cutovers

• TypeScript callers should use , , , , and . and are deprecated aliases for the canonical codec; old path-expanding behavior lives at .
• Rust callers should use the suffix-free and functions and canonical model methods. Compatibility entry points are explicitly named .

Extension policy

Nested field groups and keyed tabular form are official v4.1 and are selected automatically. TOONL, primitive-array columns, object-array columns, cyclic discriminated arrays, depth guards, and truncation reports remain RedDB userland features. Wire extensions are opt-in on encode and preserve a lossless canonical

... (truncated)

Commits

• d3bf74e chore: release 0.28.2
• 6aaaaf8 fixup! docs: define the toon binary contract (Refs #363)
• d6797b9 docs: define the toon binary contract (Refs #363)
• 1e3ed98 test: pin zero CLI option divergences (Refs #363)
• af3073a chore: release 0.28.1
• 1523d07 build: refresh generated version declaration (Refs #362)
• 06c62f4 docs: describe upstream CLI compatibility ratchet (Refs #362)
• 078758b chore: release 0.28.0
• 31c0f37 test: #361 drive the shared CLI corpus through the TypeScript bin
• ac97d46 chore: release 0.27.0
• Additional commits viewable in compare view

Updates graphql from 17.0.1 to 17.0.2

Release notes

Sourced from graphql's releases.

v17.0.2 (2026-07-03)

Bug Fix 🐞

• #4832 fix: detect default-value changes on input object fields (@​spokodev)

Polish 💅

• #4829 fix(mapSchemaConfig): fix context for schema argument mapper (@​yaacovCR)

Committers: 2

• null(@​spokodev)
• Yaacov Rydzinski (@​yaacovCR)

Commits

• 71606d7 chore(release): v17.0.2
• 101de34 fix: detect default-value changes on input object fields (#4832)
• 82da713 fix(mapSchemaConfig): fix context for schema argument mapper (#4829)
• See full diff in compare view

Updates jose from 6.2.3 to 6.2.9

Release notes

Sourced from jose's releases.

v6.2.9

Fixes

• reject a JWE whose generated Key Management Parameters collide (6ed19a6)
• types: undeprecate PBES2 p2c parameter (33bf832)

v6.2.8

Fixes

• enforce a single recipient when decrypting dir and ECDH-ES (505c383)
• reject a non-string "alg" in EmbeddedJWK (714f870)

Refactor

• index the JWS and JWE registries without a wrapper (925f3bb)
• name the "alg" source in unsupported algorithm failures (1500459)

v6.2.7

Fixes

• require own JOSE properties for presence checks (90ab09c)

Refactor

• reduce bundle size (767d7f1)

v6.2.6

Fixes

• types: accept host CryptoKey declarations (b48a15b)

v6.2.5

Fixes

• compare claim values for falsy validation options (eb86956)
• forward key management parameters for a single JWE recipient (2d4f801)
• handle a zero-length JWE additional authenticated data (16ca398)
• reject a generateKeyPair crv option the algorithm does not imply (76364e9)
• reject an unencoded payload in the JWS Compact Serialization (01d053f)
• reject characters outside the Base64URL alphabet (0ebb971), references #879
• reject duplicate "crit" values when producing (31d60e1)
• reject invalid UTF-8 in JOSE Headers and JWT Claims Sets (5df3fed)
• reject truncated ASN.1 key data (7a16c66)
• surface non-ASCII token segments as JOSE errors (194fe11)
• types: correct JWK and CryptoKey types (62a196d)
• types: correct key resolver and JWT header types (e95f8c4)
• validate the clockTolerance and currentDate options are finite (ab2f18d)

Documentation

... (truncated)

Changelog

Sourced from jose's changelog.

6.2.9 (2026-08-15)

Fixes

• reject a JWE whose generated Key Management Parameters collide (6ed19a6)
• types: undeprecate PBES2 p2c parameter (33bf832)

6.2.8 (2026-08-03)

Fixes

• enforce a single recipient when decrypting dir and ECDH-ES (505c383)
• reject a non-string "alg" in EmbeddedJWK (714f870)

Refactor

• index the JWS and JWE registries without a wrapper (925f3bb)
• name the "alg" source in unsupported algorithm failures (1500459)

6.2.7 (2026-08-01)

Fixes

• require own JOSE properties for presence checks (90ab09c)

Refactor

• reduce bundle size (767d7f1)

6.2.6 (2026-07-31)

Fixes

• types: accept host CryptoKey declarations (b48a15b)

6.2.5 (2026-07-29)

Fixes

• compare claim values for falsy validation options (eb86956)
• forward key management parameters for a single JWE recipient (2d4f801)
• handle a zero-length JWE additional authenticated data (16ca398)
• reject a generateKeyPair crv option the algorithm does not imply (76364e9)
• reject an unencoded payload in the JWS Compact Serialization (01d053f)
• reject characters outside the Base64URL alphabet (0ebb971), references #879
• reject duplicate "crit" values when producing (31d60e1)
• reject invalid UTF-8 in JOSE Headers and JWT Claims Sets (5df3fed)
• reject truncated ASN.1 key data (7a16c66)
• surface non-ASCII token segments as JOSE errors (194fe11)
• types: correct JWK and CryptoKey types (62a196d)

... (truncated)

Commits

• f3a3c78 chore(release): 6.2.9
• 33bf832 fix(types): undeprecate PBES2 p2c parameter
• 6ed19a6 fix: reject a JWE whose generated Key Management Parameters collide
• 944840d ci: use shared release workflows
• 05bccf2 chore: bump packages
• f7392d1 test: account for workerd nodejs_compat flag default changes
• 4e944be ci: drop the wait-for-npm machinery
• 4285b6f chore(deps-dev): bump undici
• cb114ec chore: cleanup after release
• 8b768eb chore(release): 6.2.8
• Additional commits viewable in compare view

Updates js-yaml from 4.3.1 to 5.3.0

Changelog

Sourced from js-yaml's changelog.

[5.3.0] - 2026-08-14

This release focuses on reworking the documentation and making small architectural improvements before moving forward.

Added

• Added completely new documentation.
• Exported DUMP_SCHEMA, the default schema used by the dumper.
• Added YAMLException.throwAt() for throwing an error at a source position.

Changed

• Changed flat constant exports to grouped exports: EVENT_ID, SCALAR_STYLE, COLLECTION_STYLE, and CHOMPING_MODE, along with their value types. The old exports are still preserved, but deprecated.
• Made identify mandatory for custom tag definitions. Use identify: () => false for load-only tags.

Deprecated

• Deprecated flat constant exports. Use grouped ones instead.

Removed

• Removed the MERGE_KEY export (not used anymore after last fixes).

Fixed

• Validate << sequence items at merge time, so aliased merge sources are checked too.
• Resolve << outside of a mapping key as the plain string '<<', matching v4, instead of leaking an internal symbol into the result.

[5.2.3] - 2026-08-01

Fixed

• Prevent prototype fallback when resolving tags and mapping entries, #782.
• Resolve !!timestamp years 0000-0099 correctly, #775.
• Preserve implicit null mapping values before document markers and reject unpaired mapping event streams, #784.
• Preserve folded scalar values with tab-indented lines when round-tripping a parsed AST through present(); dump() and loading are unaffected, #780.

[5.2.2] - 2026-07-24

Fixed

• Quote flow scalars where a colon precedes a flow indicator, #773.

Security

• Avoid exponential parsing time for nested flow sequence pairs.

... (truncated)

Commits

• 04db458 5.3.0 released
• 22ce0a0 Changelog update
• fae37b8 fix: << outside a mapping key no longer leaks the internal merge symbol
• b62ef83 fix: validate << sequence items at merge time, so aliased sources are check...
• cc665ec docs: review and update annotations
• 2aa24a6 Changelog update
• eec6902 Restore deprecated parser constant exports
• 03397ac Move throwErrorAt to YAMLException as throwAt
• d9dd2c7 docs: new condensed theme
• 0f898e6 docs: annotation tweaks
• Additional commits viewable in compare view

Updates tsx from 4.22.4 to 4.23.12

Release notes

Sourced from tsx's releases.

v4.23.12

4.23.12 (2026-08-10)

Bug Fixes

• shim import.meta when tokens are split by comments or newlines (#829) (ed9d330), closes #828

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.11

4.23.11 (2026-08-07)

Bug Fixes

• preserve async ESM require fallback (55cbece)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.10

4.23.10 (2026-08-07)

Bug Fixes

• support nyc coverage discovery (#710) (ec1bcd5)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.9

4.23.9 (2026-08-06)

Bug Fixes

• map Node test locations (2f55884)
• support data URLs in tsImport (b94f46f)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.8

... (truncated)

Commits

• ed9d330 fix: shim import.meta when tokens are split by comments or newlines (#829)
• 651f5be test: cover CommonJS TypeScript import.meta paths
• bd3bc64 test: cover CommonJS loader source fallback
• 55cbece fix: preserve async ESM require fallback
• 6c5ba85 docs: document CommonJS default interop
• ec1bcd5 fix: support nyc coverage discovery (#710)
• b6e5b48 docs: clarify CommonJS default imports
• 2f55884 fix: map Node test locations
• de935d5 docs: document Node source-map stack formatting
• b94f46f fix: support data URLs in tsImport
• Additional commits viewable in compare view

Updates typescript from 6.0.3 to 7.0.2

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

Updates ws from 8.21.0 to 8.21.3

Release notes

Sourced from ws's releases.

8.21.3

Bug fixes

• The server now correctly rejects permessage-deflate offers if the incoming client_max_window_bits parameter value is smaller than its configured clientMaxWindowBits (e97a20ea).

8.21.2

Bug fixes

• Fixed a test for CITGM (2eb3be0b).

8.21.1

Bug fixes

• Empty fragments are now counted toward the limit (a2f4e7c0).
• The default values of the maxBufferedChunks and maxFragments options have been reduced (f197ac65).

Commits

• c791e70 [dist] 8.21.3
• e97a20e [fix] Reject offers with client_max_window_bits below config
• 787ebf2 [dist] 8.21.2
• b4d62eb Revert "[ci] Trust Coveralls Homebrew tap"
• e4bb883 [security] Use GitHub PVR as main reporting channel
• 2eb3be0 [test] Skip test on Node.js versions where it does not apply
• ae1de54 [dist] 8.21.1
• 8e9511b [ci] Trust Coveralls Homebrew tap
• f197ac6 [fix] Lower default values of maxBufferedChunks and maxFragments
• 8df8265 [ci] Update actions/checkout action to v7
• Additional commits viewable in compare view

Updates marked from 18.0.5 to 18.0.9

Release notes

Sourced from marked's releases.

v18.0.9

18.0.9 (2026-08-04)

Bug Fixes

• an unmatched strong run before emphasis stays literal (#4008) (e8544e6)
• Fix spurious deeper nesting in a blockquote continuation (#4030) (452f1ed)
• pedantic foo: and "word" emphasis parsing (#3999) (823093f)

v18.0.8

18.0.8 (2026-08-04)

Bug Fixes

• fall back to default checkbox renderer when extension returns false (#4023) (e1b6139)

v18.0.7

18.0.7 (2026-07-21)

Bug Fixes

• Avoid O(n^2) backtracking in HTML block close and tilde interrupt regexes (#4014) (f945fc5), closes #3991
• Avoid O(n^2) masked source rebuild in inline tokenizer (#4017) (9154f8f)
• keep empty list after blockquote as a sibling block (#4004) (3f144a0)
• preserve code spans adjacent to tildes (#4012) (0de7188)
• Recognize setext headings whose first line starts with # (#4015) (f056437), closes #1
• treat a line of only tabs as a blank line between paragraphs (#4007) (bc2f121)

v18.0.6

18.0.6 (2026-07-09)

Bug Fixes

• Avoid O(n^2) backtracking in inline link href regex (#4013) (a009808)
• Fix ordered lists after blockquotes (#4003) (33928d0)
• keep trailing text on HTML block close line for PI, declarations, and CDATA (#3991) (bbb84c8)

Commits

• 8e858a4 chore(release): 18.0.9 [skip ci]
• 641e5df docs: explain partial extensions in use (#4033)
• 452f1ed fix: Fix spurious deeper nesting in a blockquote continuation (#4030)
• e8544e6 fix: an unmatched strong run before emphasis stays literal (#4008)
• 823093f fix: pedantic foo: and "word" emphasis parsing (#3999)
• 12a84a8 chore(release): 18.0.8 [skip ci]
• 3a1a706 chore(deps-dev): bump undici from 6.24.0 to 6.27.0 (#4042)
• 58ed4af chore(deps-dev): bump eslint from 10.7.0 to 10.8.0 (#4032)
• 01539fb chore(deps-dev): bump @​semantic-release/git from 10.0.1 to 11.0.1 (#4031)
• e1b6139 fix: fall back to default checkbox renderer when extension returns false (#4023)
• Additional commits viewable in compare view