fix(deps): update non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@types/node (source)	^20.19.40 → ^20.19.41
@typescript-eslint/eslint-plugin (source)	^8.59.2 → ^8.59.3
@typescript-eslint/parser (source)	^8.59.2 → ^8.59.3
axios (source)	^1.16.0 → ^1.16.1
commit-and-tag-version	^12.7.1 → ^12.7.3
fast-xml-parser	^5.7.3 → ^5.8.0
firebase-admin (source)	^13.9.0 → ^13.10.0
semver	^7.7.4 → ^7.8.0
turbo (source)	^2.9.10 → ^2.9.14
yaml (source)	^2.8.4 → ^2.9.0

---

Release Notes

typescript-eslint/typescript-eslint (@​typescript-eslint/eslint-plugin)

v8.59.3

Compare Source

This was a version bump only for eslint-plugin to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

typescript-eslint/typescript-eslint (@​typescript-eslint/parser)

v8.59.3

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

axios/axios (axios)

v1.16.1

Compare Source

absolute-version/commit-and-tag-version (commit-and-tag-version)

v12.7.3

Compare Source

Bug Fixes

• update release workflow for npm OIDC trusted publishing (#​281) (d0e3408)

NaturalIntelligence/fast-xml-parser (fast-xml-parser)

v5.8.0: update strnum, FXB. Use xml-naming for DOCTYPE

Compare Source

• integrate xml-naming to validate DOCTYPE entity name and notation name (using qname because of backward compatibility)
  • This will consider xml-version as well. '1.0' is default
• update strnum to 2.3.0
  • You can set octal and binary parsing which is by deault off
• update fast-xml-builder to 1.2.0
  • can sanitize tag names if found invalid
  • fix format output

firebase/firebase-admin-node (firebase-admin)

v13.10.0: Firebase Admin Node.js SDK v13.10.0

Compare Source

New Features

• feat(appcheck): Add support for minting limited-use tokens and custom JTI (#​3027)

Bug Fixes

• fix: Replace node-forge with native crypto for private key validation (#​3051)

Miscellaneous

• [chore] Release 13.10.0 (#​3146)
• add node prefix to crypto imports (#​3144)
• chore: remove uuid dependency (#​3130)
• build(deps): bump fast-xml-builder from 1.1.5 to 1.2.0 (#​3134)
• build(deps): bump protobufjs from 7.5.5 to 7.5.8 (#​3141)
• build(deps): bump fast-uri from 3.1.0 to 3.1.2 (#​3135)

npm/node-semver (semver)

v7.8.0

Compare Source

Features

• 0d0a0a2 #​855 Add truncate function (#​855) (@​pjohnmeyer, @​owlstronaut)

Bug Fixes

• 3905343 #​859 Warn when defaulting to --inc=patch in CLI (@​pjohnmeyer)

Documentation

• c368af6 #​853 fix typos in documentation (#​853) (@​ankitkumar572005)
• 37776c3 #​846 fix BNF grammar to distinguish prerelease from build identifiers (#​846) (@​abhu85, @​claude)

Chores

• 9542e09 #​860 template-oss-apply (@​owlstronaut)
• 937bc2c #​860 template-oss-apply@5.0.0 (@​owlstronaut)
• 6946fef #​852 bump @​npmcli/template-oss from 4.29.0 to 4.30.0 (#​852) (@​dependabot[bot], @​npm-cli-bot)

vercel/turborepo (turbo)

v2.9.14: Turborepo v2.9.14

Compare Source

[!NOTE]
This release contains important security fixes.

High:

• GHSA-5xc8-49mv-x4mm: Turborepo VSCode Extension command injection

Low:

• GHSA-hcf7-66rw-9f5r: Login callback CSRF/session fixation
• GHSA-3qcw-2rhx-2726: Unexpected local code execution during Yarn Berry detection

What's Changed

Changelog

• release(turborepo): 2.9.12 by @​github-actions[bot] in #​12774
• fix: Restore docs mobile menu by @​anthonyshew in #​12782
• ci: Use pull_request for PR title linting by @​anthonyshew in #​12787
• ci: Scope GitHub Actions caches by branch by @​anthonyshew in #​12788
• test: Validate lockfiles without dependency downloads by @​anthonyshew in #​12789
• Removed unneeded import form hash creation script in docs by @​dancrumb in #​12799
• fix: Validate auth callback state by @​anthonyshew in #​12802
• fix: Harden VS Code extension command execution by @​anthonyshew in #​12800
• fix: Avoid project-local Yarn during detection by @​anthonyshew in #​12801
• chore: Release 2.9.13 by @​anthonyshew in #​12803

New Contributors

• @​dancrumb made their first contribution in #​12799

Full Changelog: vercel/turborepo@v2.9.12...v2.9.14

eemeli/yaml (yaml)

v2.9.0

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.