📦 [0.74]: Bump the all-dependencies group across 1 directory with 33 updates

[dependabot]

Bumps the all-dependencies group with 30 updates in the / directory:

Package	From	To
beachball	2.63.1	2.65.5
fast-glob	3.3.2	3.3.3
lage	2.11.6	2.15.13
lodash	4.17.21	4.18.1
ts-jest	29.1.2	29.4.11
@react-native-picker/picker	2.6.1	2.11.4
@types/react	18.2.67	18.2.79
@rnx-kit/jest-preset	0.1.16	0.1.18
sanitize-filename	1.6.3	1.6.4
async	3.2.5	3.2.6
fp-ts	2.16.4	2.16.11
io-ts	2.2.21	2.2.22
simple-git	3.23.0	3.36.0
@types/async	3.2.24	3.2.25
@types/lodash	4.17.0	4.17.24
@types/node-fetch	2.6.11	2.6.13
@types/npm-registry-fetch	8.0.7	8.0.9
metro-runtime	0.80.7	0.80.12
metro-source-map	0.80.7	0.80.12
react-refresh	0.14.0	0.14.2
stacktrace-parser	0.1.10	0.1.11
envinfo	7.11.1	7.21.0
@types/mustache	4.2.5	4.2.6
@types/shelljs	0.8.15	0.8.17
get-monorepo-packages	1.2.0	1.3.0
@types/envinfo	7.8.3	7.8.4
lookpath	1.2.2	1.2.3
eslint-plugin-jsx-a11y	6.8.0	6.10.2
resolve	1.22.8	1.22.12
screenshot-desktop	1.15.0	1.15.4

Updates beachball from 2.63.1 to 2.65.5

Changelog

Sourced from beachball's changelog.

2.65.5

Thu, 21 May 2026 00:59:31 GMT

Patches

• Fetch with --no-tags (elcraig@microsoft.com)
• Add link to change type help (elcraig@microsoft.com)
• Change default packStyle to 'layer' and write versions.json for layer-style packing (198982749+Copilot@users.noreply.github.com)

2.65.4

Sat, 02 May 2026 01:47:50 GMT

Patches

• Fix npm auth environment variables with yarn 4 (elcraig@microsoft.com)
• Fully fix iterative deepening for latest git (elcraig@microsoft.com)

2.65.3

Wed, 29 Apr 2026 22:36:53 GMT

Patches

• Update readme with link to large repos performance info (elcraig@microsoft.com)
• Include dependent bumps for workspace: and catalog: dependencies in the changelog (elcraig@microsoft.com)
• Include catalog dependency changes when checking for changed packages (elcraig@microsoft.com)
• Refactor internals for getting changed packages (elcraig@microsoft.com)
• Fix deepening of shallow clones in latest git by being more specific about the comparison ref being fetched. Also reduce git operations for the case where the branch ref doesn't exist locally. (elcraig@microsoft.com)

2.65.1

Wed, 22 Apr 2026 23:20:37 GMT

Patches

• Prefer --token/-n over process.env.NPM_TOKEN (elcraig@microsoft.com)

2.65.0

Wed, 22 Apr 2026 04:13:00 GMT

Minor changes

• Add support for providing npm token via NPM_TOKEN environment variable, and internally pass token to npm using an environment variable (elcraig@microsoft.com)

Patches

• Update workspace-tools to 0.41.4 (elcraig@microsoft.com)

... (truncated)

Commits

• 635c24d applying package updates
• 2729111 (v2) Fetch with --no-tags (#1273)
• 788abde (v2) Add link to change type help (#1271)
• 28a44ff (v2) Change packStyle default to 'layer' (#1254)
• 647adaf applying package updates
• 725bbb9 Fix npm auth environment variables with yarn 4 (v2) (#1230)
• 2eafde0 Fully fix iterative deepening for latest git (v2) (#1231)
• 4b290c0 applying package updates
• 3fb67d8 Add docs about optimizing performance in large monorepos (#1222)
• 0f767eb Include catalog dependency changes when checking for changed packages (#1220)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for beachball since your current version.

Updates fast-glob from 3.3.2 to 3.3.3

Release notes

Sourced from fast-glob's releases.

3.3.3

Full Changelog: mrmlnc/fast-glob@3.3.2...3.3.3

💬 Common

• Refer to micromatch@4.0.8 to avoid annoying npm audit spam (#443, #444, #454, #456, #457, #461)

🐛 Bug fixes

• Apply absolute negative patterns to full path instead of file path (#441, thanks @​webpro)

Commits

• 4868789 3.3.3
• 73be367 Merge pull request #464 from mrmlnc/3.3.3
• 55c7b33 perf: optimizing the patterns set matching by exiting early
• ea113fd docs: add information about enumerable properties for the fs option
• 41e4730 fix: apply absolute negative patterns to full path instead of file path
• 54ad12d build: fix watch command
• 7410547 chore: refer to micromatch@4.0.8 to avoid annoying npm audit spam
• ca61085 build: freeze fdir dependency to avoid tsc issues
• See full diff in compare view

Updates lage from 2.11.6 to 2.15.13

Commits

• 780ca2f applying package updates
• ce44a8e Expose the --output-format option on the affected command (#1148)
• c7dddd7 Update dependency js-yaml to v4.2.0 (#1143)
• 7d240db Bump tmp from 0.2.5 to 0.2.7 (#1144)
• a896a49 Update GitHub Actions (official) (#1142)
• be570ac Update devDependency beachball to v2.65.5 (#1139)
• eaf70c6 Update dependency shell-quote to v1.8.4 (#1140)
• de630ad Lock file maintenance (#1088)
• f159e33 Update github/codeql-action digest to 7211b7c (#1138)
• 14d49f0 Bump @​tootallnate/once from 2.0.0 to 2.0.1 (#1137)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for lage since your current version.

Updates lodash from 4.17.21 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

• lodash: lodash/lodash@4.18.0-npm...4.18.1-npm
• lodash-es: lodash/lodash@4.18.0-es...4.18.1-es
• lodash-amd: lodash/lodash@4.18.0-amd...4.18.1-amd
• lodash.templatelodash/lodash@4.18.0-npm-packages...4.18.1-npm-packages

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

• Add security notice for _.template in threat model and API docs (#6099)
• Document lower > upper behavior in _.random (#6115)
• Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

• lodash.orderby
• lodash.tonumber
• lodash.trim
• lodash.trimend
• lodash.sortedindexby
• lodash.zipobjectdeep
• lodash.unset
• lodash.omit
• lodash.template

Commits

• cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
• 75535f5 chore: prune stale advisory refs (#6170)
• 62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
• 59be2de release(minor): bump to 4.18.0 (#6161)
• af63457 fix: broken tests for _.template 879aaa9
• 1073a76 fix: linting issues
• 879aaa9 fix: validate imports keys in _.template
• fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
• 18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
• b819080 ci: add dist sync validation workflow (#6137)
• Additional commits viewable in compare view

Updates ts-jest from 29.1.2 to 29.4.11

Release notes

Sourced from ts-jest's releases.

v29.4.11

Please refer to CHANGELOG.md for details.

v29.4.10

Please refer to CHANGELOG.md for details.

v29.4.9

Please refer to CHANGELOG.md for details.

v29.4.8

No release notes provided.

v29.4.7

Please refer to CHANGELOG.md for details.

v29.4.6

Please refer to CHANGELOG.md for details.

v29.4.5

Please refer to CHANGELOG.md for details.

v29.4.4

Please refer to CHANGELOG.md for details.

v29.4.3

Please refer to CHANGELOG.md for details.

v29.4.2

Please refer to CHANGELOG.md for details.

v29.4.1

Please refer to CHANGELOG.md for details.

v29.4.0

Please refer to CHANGELOG.md for details.

v29.3.4

Please refer to CHANGELOG.md for details.

v29.3.3

Please refer to CHANGELOG.md for details.

v29.3.2

Please refer to CHANGELOG.md for details.

v29.3.1

Please refer to CHANGELOG.md for details.

v29.3.0

Please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from ts-jest's changelog.

29.4.11 (2026-05-21)

Bug Fixes

• preserve Bundler on the CJS path under TypeScript >= 6 (3941818), closes #4198

29.4.10 (2026-05-18)

Bug Fixes

• pass resolutionMode to ts.resolveModuleName for hybrid module support (b557a85)
• rebuild Program when consecutive compiles need different module kinds (a82a2b3), closes #4774
• respect tsconfig moduleResolution instead of forcing Node10 (1bffffc)
• transformer: transpile mjs files from node_modules for CJS mode (96d025d)
• transformer: use a consistent comparator in hoist-jest sortStatements (8a8fd2f)

29.4.9 (2026-04-01)

Bug Fixes

• use correct registry for npm OIDC trusted publishing (f8a9cc9)

29.4.8 (2026-04-01)

Bug Fixes

• wrong published assets

29.4.7 (2026-04-01)

Features

• support TypeScript v6 (eda517d)

29.4.6 (2025-12-01)

... (truncated)

Commits

• bff2d64 chore(release): 29.4.11
• 3941818 fix: preserve Bundler on the CJS path under TypeScript >= 6
• efb3c2f build(deps): bump webpack-dev-server from 5.2.2 to 5.2.4 in /website
• 4e46fad ci: refactor release workflow
• 96b3ac0 chore(release): 29.4.10
• e98ec64 build(deps): update github/codeql-action digest to 458d36d
• 21ac58f build(deps): update jest packages
• 0fdc96d build(deps): update dependency semver to ^7.8.0
• 4b95551 build(deps): update dependency jest-environment-jsdom to ^30.4.1 (#5311)
• 7b88447 build(deps): update eslint packages to ^8.59.3 (#5310)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for ts-jest since your current version.

Updates @react-native-picker/picker from 2.6.1 to 2.11.4

Release notes

Sourced from @​react-native-picker/picker's releases.

v2.11.4

2.11.4 (2025-10-15)

Bug Fixes

• ios: Set delegate properly in new architecture to resolve question marks display issue (#640) (0096a16)

v2.11.3

2.11.3 (2025-10-14)

Bug Fixes

• android crash on React Native 0.81 & new arch (#648) (5b27f9d)

v2.11.2

2.11.2 (2025-09-10)

Bug Fixes

• bump cipher-base from 1.0.4 to 1.0.6 (#643) (18ed316)

v2.11.1

2.11.1 (2025-06-20)

Bug Fixes

• ios: question marks rendered unexpectedly (RN >= 0.77) (e42ef2e)

v2.11.0

2.11.0 (2025-01-07)

Features

• support RN 0.77 (#609) (3acab8c)

v2.10.3

2.10.3 (2025-01-07)

Bug Fixes

• flow error (#610) (9491e29)

v2.10.2

2.10.2 (2024-12-03)

... (truncated)

Commits

• faefb12 chore(release): 2.11.4 [skip ci]
• 0096a16 fix(ios): Set delegate properly in new architecture to resolve question marks...
• b7efb65 chore(release): 2.11.3 [skip ci]
• 5b27f9d fix: android crash on React Native 0.81 & new arch (#648)
• cef1e2e chore(release): 2.11.2 [skip ci]
• 18ed316 fix: bump cipher-base from 1.0.4 to 1.0.6 (#643)
• 4aae25a build(deps): bump form-data from 3.0.1 to 3.0.4 (#641)
• 401d4dd Do not use deprecated ContextContainer::Shared (#645)
• 11cade1 chore(release): 2.11.1 [skip ci]
• 34bf0f4 chore: update publish workflow (#633)
• Additional commits viewable in compare view

Updates @types/react from 18.2.67 to 18.2.79

Commits

• See full diff in compare view

Updates @rnx-kit/jest-preset from 0.1.16 to 0.1.18

Changelog

Sourced from @​rnx-kit/jest-preset's changelog.

0.1.18

Patch Changes

• 44e8dab: Look for @react-native/babel-preset before falling back to metro-react-native-babel-preset

0.1.17

Patch Changes

• 5115f16: Support new loadConfig signature from @react-native-community/cli-config

Commits

• 06ca765 RELEASING: Releasing 3 package(s) (#3341)
• 905c62a test(jest-preset): update tests to look for @react-native/babel-preset (#3340)
• 44e8dab fix(jest-preset): look for @react-native/babel-preset (#3338)
• 70f5fdd chore: bump react-native to 0.75 (#3303)
• d21adb8 chore: bump react-native to 0.74 (#3290)
• f9ba3d3 RELEASING: Releasing 1 package(s) (#3214)
• 5115f16 fix(jest-preset): fix loadConfig parameters (#3213)
• 728d9c6 chore(metro-config): don't output unused .d.ts files (#3142)
• b962503 ci: bump Node to v20 to satisfy Yarn (#3007)
• 98c2408 chore: bump Yarn to 4.1.1 (#3004)
• Additional commits viewable in compare view

Updates sanitize-filename from 1.6.3 to 1.6.4

Commits

• 6e51552 1.6.4
• 9848644 Do not use vulnerable regex
• 209c39b Bump brace-expansion from 1.1.6 to 1.1.11 (#54)
• See full diff in compare view

Updates async from 3.2.5 to 3.2.6

Commits

• 85fb18f Version 3.2.6
• 8c0c941 Update built files
• 5f756b4 Fix ReDoS (#1980)
• 39cdc9b build(deps-dev): bump karma from 6.4.3 to 6.4.4 (#1985)
• 7b8ddeb build(deps-dev): bump @​babel/core from 7.24.7 to 7.25.2 (#1981)
• 4634a9d build(deps-dev): bump rollup from 4.18.0 to 4.19.2 (#1982)
• afb176c build(deps-dev): bump chai from 4.4.1 to 4.5.0 (#1983)
• 3568a74 build(deps-dev): bump @​babel/eslint-parser from 7.24.7 to 7.25.1 (#1984)
• 9e885fd build(deps-dev): bump babel-plugin-istanbul from 6.1.1 to 7.0.0 (#1986)
• f9c7f2a build(deps-dev): bump semver from 7.6.2 to 7.6.3 (#1987)
• Additional commits viewable in compare view

Updates fp-ts from 2.16.4 to 2.16.11

Release notes

Sourced from fp-ts's releases.

2.16.9

Polish

Support strictBuiltinIteratorReturn, #1949

2.16.5

Polish

Resolved a RangeError where the maximum call stack size was exceeded when invoking chainWithIndex, #1931

Changelog

Sourced from fp-ts's changelog.

2.16.11

Bug Fix

Fix Option.getOrd definition, #1963

2.16.10

Polish

Add apFirstW and apSecondW to ReaderTask, #1958

2.16.9

Polish

Support strictBuiltinIteratorReturn, #1949

2.16.8

Polish

Remove useless pure comment, closes #1937

2.16.7

Polish

Add tap for Identity #1943

2.16.6

Polish

Allow dependencies to be widen when using orLeft #1938

2.16.5

Polish

Resolved a RangeError where the maximum call stack size was exceeded when invoking chainWithIndex, #1931

Commits

• See full diff in compare view

Updates io-ts from 2.2.21 to 2.2.22

Release notes

Sourced from io-ts's releases.

2.2.22

• Bug Fix
  • Test for readonly type when optimizing tagged unions, #719

Changelog

Sourced from io-ts's changelog.

2.2.22

• Bug Fix
  • Test for readonly type when optimizing tagged unions, #719

Commits

• See full diff in compare view

Updates semver from 7.6.0 to 7.8.4

Release notes

Sourced from semver's releases.

v7.8.4

7.8.4 (2026-06-09)

Bug Fixes

• e583226 #874 reject numeric segments after x-ranges (@​pupuking723)

v7.8.3

7.8.3 (2026-06-08)

Bug Fixes

• 046da7f #872 align caret includePrerelease lower bounds (#872) (@​wayyoungboy)

Chores

• 3485dda #866 bump @​npmcli/eslint-config from 6.0.1 to 7.0.0 (#866) (@​dependabot[bot])

v7.8.2

7.8.2 (2026-06-04)

Bug Fixes

• bea6028 #870 increment dotted prerelease identifiers (#870) (@​liuzemei, @​SheldonNeo)

v7.8.1

7.8.1 (2026-05-21)

Bug Fixes

• 17aa702 #869 strip build metadata before comparator trimming (#869) (@​owlstronaut)
• 5f3ca13 #867 handle prerelease bounds in subset (#867) (@​puneetdixit200, Puneet Dixit)

v7.8.0

7.8.0 (2026-05-08)

Features

• 0d0a0a2 #855 Add truncate function (#855) (@​pjohnmeyer, @​owlstronaut)

Bug Fixes

• 3905343 #859 Warn when defaulting to --inc=patch in CLI (@​pjohnmeyer)

Documentation

• c368af6 #853 fix typos in documentation (#853) (@​ankitkumar572005)
• 37776c3 #846 fix BNF grammar to distinguish prerelease from build identifiers (#846) (@​abhu85, @​claude)

Chores

• 9542e09 #860 template-oss-apply (@​owlstronaut)
• 937bc2c #860 template-oss-apply@5.0.0 (@​owlstronaut)
• 6946fef #852 bump @​npmcli/template-oss from 4.29.0 to 4.30.0 (#852) (@​dependabot[bot], @​npm-cli-bot)

v7.7.4

7.7.4 (2026-01-16)

Bug Fixes

• a29faa5 #835 cli: pass options to semver.valid() for loose version validation (#835) (@​mldangelo)

Documentation

• 1d28d5e #836 fix typos and update -n CLI option documentation (#836) (@​mldangelo)

Dependencies

• 120968b #840 @npmcli/template-oss@4.29.0 (#840)

Chores

• 44d7130 #824 bump @​npmcli/eslint-config from 5.1.0 to 6.0.0 (#824) (@​dependabot[bot])
• 7073576 #820 reorder parameters in invalid-versions.js test (#820) (@​reggi)
• 5816d4c #829 bump @​npmcli/template-oss from 4.28.0 to 4.28.1 (#829) (@​dependabot[bot], @​npm-cli-bot)

... (truncated)

Changelog

Sourced from semver's changelog.

7.8.4 (2026-06-09)

Bug Fixes

• e583226 #874 reject numeric segments after x-ranges (@​pupuking723)

7.8.3 (2026-06-08)

Bug Fixes

• 046da7f #872 align caret includePrerelease lower bounds (#872) (@​wayyoungboy)

Chores

• 3485dda #866 bump @​npmcli/eslint-config from 6.0.1 to 7.0.0 (#866) (@​dependabot[bot])

7.8.2 (2026-06-04)

Bug Fixes

• bea6028 #870 increment dotted prerelease identifiers (#870) (@​liuzemei, @​SheldonNeo)

7.8.1 (2026-05-21)

Bug Fixes

• 17aa702 #869 strip build metadata before comparator trimming (#869) (@​owlstronaut)
• 5f3ca13 #867 handle prerelease bounds in subset (#867) (@​puneetdixit200, Puneet Dixit)

7.8.0 (2026-05-08)

Features

• 0d0a0a2 #855 Add truncate function (#855) (@​pjohnmeyer, @​owlstronaut)

Bug Fixes

• 3905343 #859 Warn when defaulting to --inc=patch in CLI (@​pjohnmeyer)

Documentation

• c368af6 #853 fix typos in documentation (#853) (@​ankitkumar572005)
• 37776c3 #846 fix BNF grammar to distinguish prerelease from build identifiers (#846) (@​abhu85, @​claude)

Chores

• 9542e09 #860 template-oss-apply (@​owlstronaut)
• 937bc2c #860 template-oss-apply@5.0.0 (@​owlstronaut)
• 6946fef #852 bump @​npmcli/template-oss from 4.29.0 to 4.30.0 (#852) (@​dependabot[bot], @​npm-cli-bot)

7.7.4 (2026-01-16)

Bug Fixes

• a29faa5 #835 cli: pass options to semver.valid() for loose version validation (#835) (@​mldangelo)

Documentation

• 1d28d5e #836 fix typos and update -n CLI option documentation (#836) (@​mldangelo)

Dependencies

• 120968b #840 @npmcli/template-oss@4.29.0 (#840)

Chores

• 44d7130 #824 bump @​npmcli/eslint-config from 5.1.0 to 6.0.0 (#824) (@​dependabot[bot])
• 7073576 #820 reorder parameters in invalid-versions.js test (#820) (@​reggi)
• 5816d4c #829 bump @​npmcli/template-oss from 4.28.0 to 4.28.1 (#829) (@​dependabot[bot], @​npm-cli-bot)

7.7.3 (2025-10-06)

Bug Fixes

• e37e0ca #813 faster paths for compare (#813) (@​H4ad)
• 2471d75 #811 x-range build metadata support (i529015)

Chores

• 8f05c87 #807 bump @​npmcli/template-oss from 4.25.0 to 4.25.1 (#807) (@​dependabot[bot], @​owlstronaut)

... (truncated)

Commits

• 8640bd6 chore: release 7.8.4 (#875)
• e583226 fix: reject numeric segments after x-ranges
• 6b77aa8 chore: release 7.8.3 (#873)
• 3485dda chore: bump Description has been truncated