Skip to content

deps(engine): bump the utilities group across 1 directory with 2 updates - #209

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/utilities-e8ddb605a3
Open

deps(engine): bump the utilities group across 1 directory with 2 updates#209
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/utilities-e8ddb605a3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 22, 2026

Copy link
Copy Markdown
Contributor

Bumps the utilities group with 2 updates in the / directory: shelljs and sitemap.

Updates shelljs from 0.8.5 to 0.10.0

Release notes

Sourced from shelljs's releases.

v0.10.0

What's Changed

New Contributors

Full Changelog: shelljs/shelljs@v0.9.2...v0.10.0

v0.9.2

What's Changed

Full Changelog: shelljs/shelljs@v0.9.1...v0.9.2

v0.9.1

What's Changed

Full Changelog: shelljs/shelljs@v0.9.0...v0.9.1

v0.9.0

What's Changed

... (truncated)

Changelog

Sourced from shelljs's changelog.

Change Log

Commits

Updates sitemap from 9.0.1 to 10.0.0

Release notes

Sourced from sitemap's releases.

10.0.0

[BREAKING CHANGES]

Dropped CommonJS build — the package is now ESM-only

  • require('sitemap') is no longer supported on Node versions without built-in require(esm). The dist/cjs build, the require export condition, and tsconfig.cjs.json are all gone; exports now resolves to dist/index.js for every consumer. Migrate to import { SitemapStream } from 'sitemap'.
  • Node.js >=22.22.1 now required (previously >=20.19.5). CommonJS consumers can still load this package through require(esm), which landed unflagged in 22.12; the floor is 22.22.1 to match the development toolchain.
  • Build output flattened from dist/esm/* and dist/cjs/* to dist/*. The bin entry is now dist/cli.js.

simpleSitemapAndIndex defaults to 45,000 URLs per sitemap

  • The default limit drops from 50,000 to 45,000, the same default SitemapAndIndexStream and the CLI already use (DEFAULT_SITEMAP_ITEM_LIMIT). The headroom keeps rich entries (images, video, news) under the 50MB uncompressed file-size limit. A 50,000-URL input now produces two sitemap files instead of one; pass limit: 50000 to keep the old output.

SitemapStream writes an empty sitemap instead of erroring

  • Ending a SitemapStream without writing any items now produces a well-formed empty <urlset> instead of failing with EmptySitemap (#394, #421). This matches SitemapIndexStream, which already wrote an empty <sitemapindex>. EmptySitemap is still exported but deprecated and no longer thrown. An empty <urlset> does not pass strict sitemap.xsd validation, which requires at least one <url>; search engines accept it.

One logger option across the library; xmlNS renamed to xmlns

  • SitemapStream, SitemapIndexStream, SitemapAndIndexStream and simpleSitemapAndIndex accept the same logger option the parsers already had (#348). Validation warnings that went straight to console.warn now go through it. Pass false to silence. The Logger type is now exported.
  • Invalid news and video attribute values now go through errorHandler (and so the logger) like every other validation error, instead of a hardcoded console.warn. The warning text is now the error's name and message, which starts with the item's URL. Under ErrorLevel.THROW a custom errorHandler receives these errors too, like every other validation error; the default handler still throws.
  • The SitemapStream property xmlNS is now xmlns, matching the option name (#300). xmlNS still works as a deprecated alias. SitemapStream.errorHandler is always set now; it defaults to a handler that warns through logger.

Both XML parsers share one error store and entry cap

... (truncated)

Changelog

Sourced from sitemap's changelog.

10.0.0 - 2026-10-19

[BREAKING CHANGES]

Dropped CommonJS build — the package is now ESM-only

  • require('sitemap') is no longer supported on Node versions without built-in require(esm). The dist/cjs build, the require export condition, and tsconfig.cjs.json are all gone; exports now resolves to dist/index.js for every consumer. Migrate to import { SitemapStream } from 'sitemap'.
  • Node.js >=22.22.1 now required (previously >=20.19.5). CommonJS consumers can still load this package through require(esm), which landed unflagged in 22.12; the floor is 22.22.1 to match the development toolchain.
  • Build output flattened from dist/esm/* and dist/cjs/* to dist/*. The bin entry is now dist/cli.js.

simpleSitemapAndIndex defaults to 45,000 URLs per sitemap

  • The default limit drops from 50,000 to 45,000, the same default SitemapAndIndexStream and the CLI already use (DEFAULT_SITEMAP_ITEM_LIMIT). The headroom keeps rich entries (images, video, news) under the 50MB uncompressed file-size limit. A 50,000-URL input now produces two sitemap files instead of one; pass limit: 50000 to keep the old output.

SitemapStream writes an empty sitemap instead of erroring

  • Ending a SitemapStream without writing any items now produces a well-formed empty <urlset> instead of failing with EmptySitemap (#394, #421). This matches SitemapIndexStream, which already wrote an empty <sitemapindex>. EmptySitemap is still exported but deprecated and no longer thrown. An empty <urlset> does not pass strict sitemap.xsd validation, which requires at least one <url>; search engines accept it.

One logger option across the library; xmlNS renamed to xmlns

  • SitemapStream, SitemapIndexStream, SitemapAndIndexStream and simpleSitemapAndIndex accept the same logger option the parsers already had (#348). Validation warnings that went straight to console.warn now go through it. Pass false to silence. The Logger type is now exported.
  • Invalid news and video attribute values now go through errorHandler (and so the logger) like every other validation error, instead of a hardcoded console.warn. The warning text is now the error's name and message, which starts with the item's URL. Under ErrorLevel.THROW a custom errorHandler receives these errors too, like every other validation error; the default handler still throws.
  • The SitemapStream property xmlNS is now xmlns, matching the option name (#300). xmlNS still works as a deprecated alias. SitemapStream.errorHandler is always set now; it defaults to a handler that warns through logger.

Both XML parsers share one error store and entry cap

... (truncated)

Commits
  • eaa8f14 Merge pull request #525 from ekalinin/claude/changelog-10-0-0
  • 7b3ae4f docs: date the 10.0.0 changelog entry
  • 45592c9 release 10.0.0
  • 54240eb Merge pull request #524 from ekalinin/claude/10-0-changelog-gaps-0113bc
  • b9f66f1 docs: fill 10.0 changelog gaps
  • 33a1144 Merge pull request #523 from ekalinin/claude/sitemap-issue-517-167468
  • bd041e1 test: cover invalid index items in SitemapAndIndexStream
  • 9c580d9 Merge pull request #522 from ekalinin/claude/update-outdated-dependencies-308dec
  • 40448e9 chore(deps): update dev dependencies, require Node >=22.22.1
  • 976ffa7 Merge pull request #521 from ekalinin/claude/issues-prs-triage-c03589
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
deps(engine): bump the utilities group across 1 directory with 2 updates
657d2f4 
Bumps the utilities group with 2 updates in the / directory: [shelljs](https://github.com/shelljs/shelljs) and [sitemap](https://github.com/ekalinin/sitemap.js).


Updates `shelljs` from 0.8.5 to 0.10.0
- [Release notes](https://github.com/shelljs/shelljs/releases)
- [Changelog](https://github.com/shelljs/shelljs/blob/main/CHANGELOG.md)
- [Commits](shelljs/shelljs@v0.8.5...v0.10.0)

Updates `sitemap` from 9.0.1 to 10.0.0
- [Release notes](https://github.com/ekalinin/sitemap.js/releases)
- [Changelog](https://github.com/ekalinin/sitemap.js/blob/master/CHANGELOG.md)
- [Commits](ekalinin/sitemap.js@9.0.1...10.0.0)

---
updated-dependencies:
- dependency-name: shelljs
  dependency-version: 0.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: utilities
- dependency-name: sitemap
  dependency-version: 10.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: utilities
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Oct 22, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies, engine. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@socket-security

socket-security Bot commented Oct 22, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedshelljs@​0.8.5 ⏵ 0.10.094 -5100100 +183100
Updatedsitemap@​9.0.1 ⏵ 10.0.099 +110010085 -5100

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants