dependabot[bot] opened a new pull request, #44: URL: https://github.com/apache/echarts-mcp/pull/44
Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) to 5.0.8 and updates ancestor dependencies [brace-expansion](https://github.com/juliangruber/brace-expansion), [@modelcontextprotocol/inspector](https://github.com/modelcontextprotocol/inspector) and [nodemon](https://github.com/remy/nodemon). These dependencies need to be updated together. Updates `brace-expansion` from 1.1.12 to 5.0.8 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/juliangruber/brace-expansion/releases";>brace-expansion's releases</a>.</em></p> <blockquote> <h2>v4.0.1</h2> <ul> <li>fmt 5a5cc17</li> <li>Fix potential ReDoS Vulnerability or Inefficient Regular Expression (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/65";>#65</a>) 0b6a978</li> </ul> <hr /> <p><a href="https://github.com/juliangruber/brace-expansion/compare/v4.0.0...v4.0.1";>https://github.com/juliangruber/brace-expansion/compare/v4.0.0...v4.0.1</a></p> <h2>v4.0.0</h2> <ul> <li>feat: use string replaces instead of splits (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/64";>#64</a>) 278132b</li> <li>fmt dd72a59</li> <li>add <code>tea.yaml</code> 70e4c1b</li> </ul> <p><a href="https://github.com/juliangruber/brace-expansion/compare/v3.0.0...v4.0.0";>https://github.com/juliangruber/brace-expansion/compare/v3.0.0...v4.0.0</a></p> <p>As a precaution to not risk breaking anything with 278132b, this is a new semver major release</p> <h2>v3.0.1</h2> <ul> <li>pkg: publish on tag 3.x 3059c07</li> <li>fmt 8229e6f</li> <li>Fix potential ReDoS Vulnerability or Inefficient Regular Expression (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/65";>#65</a>) 15f9b3c</li> </ul> <hr /> <p><a href="https://github.com/juliangruber/brace-expansion/compare/v3.0.0...v3.0.1";>https://github.com/juliangruber/brace-expansion/compare/v3.0.0...v3.0.1</a></p> <h2>v3.0.0</h2> <ul> <li>Switch to ES Modules and balanced-match 3.0.0 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/62";>#62</a>) c0360e8</li> <li>added jsdoc (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/55";>#55</a>) 68c0e37</li> <li>node 16 is EOL 9e781e9</li> <li>add standard 3494c4d</li> <li>use const and let (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/57";>#57</a>) dd5a4cb</li> <li>docs 6dad209</li> <li>remove <code>test</code> e3dd8ae</li> <li>ci: update node versions d23ede9</li> <li>docs: add <a href="https://github.com/lanodan";><code>@lanodan</code></a> to contributors 1eb3fa4</li> <li>docs 1e7c9cd</li> <li>switch from tape to test module (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/60";>#60</a>) 2520537</li> <li>Bump minimist from 1.2.5 to 1.2.6 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/59";>#59</a>) 61a94f1</li> <li>Bump path-parse from 1.0.6 to 1.0.7 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/51";>#51</a>) dc741cf</li> <li>docs: add back ci badge 8ee5626</li> <li>Add github actions, remove travis. Closes <a href="https://redirect.github.com/juliangruber/brace-expansion/issues/52";>#52</a> (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/53";>#53</a>) 5c8756a</li> <li>CI: Drop unused sudo: false Travis directive (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/50";>#50</a>) 05978a7</li> </ul> <p><a href="https://github.com/juliangruber/brace-expansion/compare/v2.0.1...v3.0.0";>https://github.com/juliangruber/brace-expansion/compare/v2.0.1...v3.0.0</a></p> <h2>v2.1.1</h2> <ul> <li>Backport v5.0.6 change to v2 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/109";>#109</a>) c3a817c</li> </ul> <hr /> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/juliangruber/brace-expansion/commit/96a63c0011c0288846ad41773c73e3fbd0906b59";><code>96a63c0</code></a> 5.0.8</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5";><code>a1bd339</code></a> Merge commit from fork</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/592a36fd18455c37f81e0848a642d84c63147fa7";><code>592a36f</code></a> Bump tar from 7.5.16 to 7.5.20 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/127";>#127</a>)</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/bd146909cd6c7bedde61a5d6428ba252860a0159";><code>bd14690</code></a> Bump brace-expansion from 2.0.2 to 2.1.2 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/126";>#126</a>)</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/e729ba647887042f16b531fdb3d8ac3d7762ccad";><code>e729ba6</code></a> Bump ws from 8.19.0 to 8.21.1 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/124";>#124</a>)</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/5bf809e2c6dbde64dd9ff7acec7335ea7d5f6d9e";><code>5bf809e</code></a> Remove Node.js 18 support (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/110";>#110</a>)</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/8cb5716bae73e98b63f18aae8e48b6f12522e759";><code>8cb5716</code></a> Bump markdown-it from 14.1.0 to 14.2.0 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/113";>#113</a>)</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/43122df5955511b8ec82718fa28903b6dbad0d26";><code>43122df</code></a> Bump sigstore from 4.1.0 to 4.1.1 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/119";>#119</a>)</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/69bd65a46e9361c992bb43b898c9df0d9720cc5c";><code>69bd65a</code></a> Bump <code>@sigstore/verify</code> from 3.1.0 to 3.1.1 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/118";>#118</a>)</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/b3bfbf06746fe92645ffd17d1f44e95f480cfe59";><code>b3bfbf0</code></a> Bump <code>@sigstore/core</code> from 3.1.0 to 3.2.1 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/117";>#117</a>)</li> <li>Additional commits viewable in <a href="https://github.com/juliangruber/brace-expansion/compare/v1.1.12...v5.0.8";>compare view</a></li> </ul> </details> <details> <summary>Install script changes</summary> <p>This version adds <code>prepare</code> script that runs during installation. Review the package contents before updating.</p> </details> <br /> Updates `@modelcontextprotocol/inspector` from 0.17.2 to 2.0.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/modelcontextprotocol/inspector/releases";>@modelcontextprotocol/inspector's releases</a>.</em></p> <blockquote> <h2>2.0.0</h2> <p>The v2 Inspector is now the default release.</p> <pre lang="bash"><code>npx @modelcontextprotocol/inspector # web UI npx @modelcontextprotocol/inspector --cli # CLI npx @modelcontextprotocol/inspector --tui # TUI </code></pre> <h2>What's new</h2> <p>v2 ships as a single package with three clients — a Vite + React + Mantine web UI, a scriptable CLI, and an Ink-based TUI — over a shared <code>@inspector/core</code> runtime, so all three behave identically.</p> <h2>Upgrading from v1</h2> <ul> <li><strong>Node >= 22.19.0</strong> is now required (was >= 22.7.5).</li> <li>CLI flags changed substantially. In particular <code>--config</code> now means a <strong>read-only session file</strong>; <code>--catalog</code> is the writable server list. See <a href="https://github.com/modelcontextprotocol/inspector/blob/main/docs/mcp-server-configuration.md";>MCP server configuration</a>.</li> <li>The v1 sub-packages (<code>inspector-client</code>, <code>inspector-server</code>, <code>inspector-cli</code>) are deprecated and not part of v2 — v2 publishes a single package.</li> </ul> <h2>v1</h2> <p>v1 is deprecated and receives security fixes only, published under the <code>v1-latest</code> tag:</p> <pre lang="bash"><code>npm i @modelcontextprotocol/inspector@v1-latest </code></pre> <h2>2.0.0-rc.3</h2> <p>Release candidate for 2.0.0.</p> <p>Adds the vite 8.1.5 bump on top of rc.2, closing three high-severity dev-server file-read advisories.</p> <p>Published under the <code>next</code> dist-tag — <code>latest</code> remains on 1.0.1.</p> <p>Install: <code>npx @modelcontextprotocol/inspector@next</code></p> <p>Prerelease for validating the publish pipeline (<a href="https://redirect.github.com/modelcontextprotocol/inspector/issues/1818";>#1818</a>). Not for general use.</p> <h2>2.0.0-rc.2</h2> <p>Release candidate for 2.0.0, with all runtime dependency vulnerabilities cleared.</p> <p>Published under the <code>next</code> dist-tag — <code>latest</code> remains on 1.0.1.</p> <p>Install: <code>npx @modelcontextprotocol/inspector@next</code></p> <p>Prerelease for validating the publish pipeline against the swept dependency tree (<a href="https://redirect.github.com/modelcontextprotocol/inspector/issues/1818";>#1818</a>). Not for general use.</p> <h2>2.0.0-rc.1</h2> <p>Release candidate for 2.0.0. Published under the <code>next</code> dist-tag — <code>latest</code> remains on 1.0.1.</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/modelcontextprotocol/inspector/commit/7aebf168e6277ea26b1f04a7987a1cd11328ec83";><code>7aebf16</code></a> chore: 2.0.0 (<a href="https://redirect.github.com/modelcontextprotocol/inspector/issues/1842";>#1842</a>)</li> <li><a href="https://github.com/modelcontextprotocol/inspector/commit/73fe059072ab0c7fdfe32d44aacc85728e771773";><code>73fe059</code></a> fix(deps): raise vite to 8.1.5 to close three dev-server file-read advisories...</li> <li><a href="https://github.com/modelcontextprotocol/inspector/commit/d5e35b52ee70a99942aba21226f4c18d3d8e44ff";><code>d5e35b5</code></a> chore: clear all runtime dependency vulnerabilities; 2.0.0-rc.2 (<a href="https://redirect.github.com/modelcontextprotocol/inspector/issues/1837";>#1837</a>)</li> <li><a href="https://github.com/modelcontextprotocol/inspector/commit/954f9e83f66f5a22a2e84fe50dce4d2ed92c7721";><code>954f9e8</code></a> fix(ci): publish via OIDC trusted publishing, not a non-existent NPM_TOKEN (#...</li> <li><a href="https://github.com/modelcontextprotocol/inspector/commit/75e3116b10c8b21c65553109de910c781b9885fc";><code>75e3116</code></a> chore: 2.0.0-rc.1 (<a href="https://redirect.github.com/modelcontextprotocol/inspector/issues/1835";>#1835</a>)</li> <li><a href="https://github.com/modelcontextprotocol/inspector/commit/145002925f4aa634146d1165e8855c2418212c3d";><code>1450029</code></a> ci: derive the npm dist-tag from the version instead of defaulting to latest ...</li> <li><a href="https://github.com/modelcontextprotocol/inspector/commit/844567585dc946acd6353fde358c6f006bf7533a";><code>8445675</code></a> chore(deps): upgrade <code>@hono/node-server</code> to 2.0.12 (<a href="https://redirect.github.com/modelcontextprotocol/inspector/issues/1832";>#1832</a>)</li> <li><a href="https://github.com/modelcontextprotocol/inspector/commit/809b9fdf5c1f78ddb759a033c0388c49074eb5de";><code>809b9fd</code></a> ci: set a least-privilege default GITHUB_TOKEN scope (<a href="https://redirect.github.com/modelcontextprotocol/inspector/issues/1831";>#1831</a>)</li> <li><a href="https://github.com/modelcontextprotocol/inspector/commit/25106dcce481b3c839f93f95d8ae2e4cfef97930";><code>25106dc</code></a> Merge pull request <a href="https://redirect.github.com/modelcontextprotocol/inspector/issues/1830";>#1830</a> from modelcontextprotocol/chore/v2-golive</li> <li><a href="https://github.com/modelcontextprotocol/inspector/commit/ec5d8e139eb3cb2f1bcd42ab40a116f0897c3130";><code>ec5d8e1</code></a> chore: replace main's tree with v2</li> <li>Additional commits viewable in <a href="https://github.com/modelcontextprotocol/inspector/compare/0.17.2...2.0.0";>compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions";>GitHub Actions</a>, a new releaser for <code>@modelcontextprotocol/inspector</code> since your current version.</p> </details> <details> <summary>Install script changes</summary> <p>This version adds <code>postinstall</code> script that runs during installation. Review the package contents before updating.</p> </details> <br /> Updates `nodemon` from 3.1.11 to 3.1.14 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/remy/nodemon/releases";>nodemon's releases</a>.</em></p> <blockquote> <h2>v3.1.14</h2> <h2><a href="https://github.com/remy/nodemon/compare/v3.1.13...v3.1.14";>3.1.14</a> (2026-02-20)</h2> <h3>Bug Fixes</h3> <ul> <li>get watch working on windows (<a href="https://github.com/remy/nodemon/commit/cfebe2feb2054a13fa6b9c493c1cd826ffccf167";>cfebe2f</a>), closes <a href="https://redirect.github.com/remy/nodemon/issues/2270";>#2270</a></li> </ul> <h2>v3.1.13</h2> <h2><a href="https://github.com/remy/nodemon/compare/v3.1.12...v3.1.13";>3.1.13</a> (2026-02-19)</h2> <h3>Bug Fixes</h3> <ul> <li>TypeScript definition for 'restart' args (<a href="https://github.com/remy/nodemon/commit/5c0371583925dc2c153ca6f23d886f3e7b109d41";>5c03715</a>), closes <a href="https://redirect.github.com/remy/nodemon/issues/2265";>#2265</a></li> </ul> <h2>v3.1.12</h2> <h2><a href="https://github.com/remy/nodemon/compare/v3.1.11...v3.1.12";>3.1.12</a> (2026-02-19)</h2> <h3>Bug Fixes</h3> <ul> <li>bump minimatch (<a href="https://github.com/remy/nodemon/commit/9376af3f24e3341ed031d88f230b09f0261c5521";>9376af3</a>), closes <a href="https://redirect.github.com/remy/nodemon/issues/2267";>#2267</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/remy/nodemon/commit/cfebe2feb2054a13fa6b9c493c1cd826ffccf167";><code>cfebe2f</code></a> fix: get watch working on windows</li> <li><a href="https://github.com/remy/nodemon/commit/f34bfa93296864ec2449ca615a539c96521a87cd";><code>f34bfa9</code></a> chore: fix release to run <em>after</em> tests</li> <li><a href="https://github.com/remy/nodemon/commit/5c0371583925dc2c153ca6f23d886f3e7b109d41";><code>5c03715</code></a> fix: TypeScript definition for 'restart' args</li> <li><a href="https://github.com/remy/nodemon/commit/28de4b7c5499fba6ce595021fccfcf6b5c043e5a";><code>28de4b7</code></a> chore: semver-release wanted 22-24 🤦</li> <li><a href="https://github.com/remy/nodemon/commit/6217164991b854005250794caa8deff5fbbf057b";><code>6217164</code></a> chore: move release workflow to node 20</li> <li><a href="https://github.com/remy/nodemon/commit/2c458de9b5d5600e18afb4f11fad6077a384a4d1";><code>2c458de</code></a> chore: bump semver-release + update workflow</li> <li><a href="https://github.com/remy/nodemon/commit/9376af3f24e3341ed031d88f230b09f0261c5521";><code>9376af3</code></a> fix: bump minimatch</li> <li><a href="https://github.com/remy/nodemon/commit/e045423401baa9c539fdb3750fc3fb73ca8efc4c";><code>e045423</code></a> chore: website</li> <li><a href="https://github.com/remy/nodemon/commit/f7a4edd37eba6dbf889aec2c62910f2cb972ed79";><code>f7a4edd</code></a> chore: website</li> <li><a href="https://github.com/remy/nodemon/commit/f26223f9af2e5c21b0360ab05608eb65ea3d88b7";><code>f26223f</code></a> chore: website</li> <li>Additional commits viewable in <a href="https://github.com/remy/nodemon/compare/v3.1.11...v3.1.14";>compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions";>GitHub Actions</a>, a new releaser for nodemon since your current version.</p> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apache/echarts-mcp/network/alerts). </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
