chore(deps): Bump the npm-minor-and-patch group across 1 directory with 7 updates

[dependabot]

Bumps the npm-minor-and-patch group with 7 updates in the / directory:

Package	From	To
@noble/hashes	2.2.0	2.3.0
@run402/sdk	4.8.0	4.31.0
jose	6.2.3	6.2.10
pg	8.22.0	8.23.0
@types/pg	8.20.0	8.23.1
esbuild	0.28.1	0.28.2
tsx	4.23.1	4.23.12

Updates @noble/hashes from 2.2.0 to 2.3.0

Release notes

Sourced from @​noble/hashes's releases.

2.3.0

Improve speed:

• +10-45% 32b inputs across all hashes
• +40% SHA-3 / SHAKE, +50% 1mb KT128 / KT256 / TurboSHAKE, +20% kmac
• 2.2x argon
• +20% pbkdf2 and hkdf

Other changes:

• Better error messages and stricter type checks everywhere
• Bugfix: HMAC _cloneInto now preserves canXOF (#134, ChALkeR); Argon2d typo rename (#135).
• blake2.compress renamed to _compress (marked internal).
• Reduce on-disk unpacked size 869kb → 665kb (-204kb) by disabling source maps (they became less relevant).

Full Changelog: paulmillr/noble-hashes@2.2.0...2.3.0

Changelog

Sourced from @​noble/hashes's changelog.

2.3.0 (2026-08-06)

Performance

• Improved 32-byte input performance across all hashes by 10–45%.
• Improved SHA-3 and SHAKE by 40%, one-megabyte KangarooTwelve, MarsupilamiFourteen, and TurboSHAKE by 50%, and KMAC by 20%.
• Improved Argon2 performance by 2.2×.
• Improved PBKDF2 and HKDF performance by 20%.

Other changes

• Added better error messages and stricter type checks throughout the package.
• Fixed HMAC._cloneInto so it preserves canXOF in issue #134, reported by @​ChALkeR, and corrected an Argon2d typo in issue #135.
• Renamed blake2.compress to the internal _compress method.
• Reduced unpacked on-disk size from 869 KB to 665 KB by disabling less-relevant source maps.

Commits

• 8060cc8 Release 2.3.0.
• 16f8af9 Update workflow and benchmarks
• 734220f Update jsbt to 0.6.5
• fd3d3c3 Minor improvements
• 3654405 test: use new syntax
• e222e2d utils: minor fixes
• ef7ae52 Improve speed. Reduce bundle size. Reduce mem usage.
• 26b194a Rename npm action
• e89d6fa Bump jsbt to v0.6
• de8098a Move benchmarks top-level
• Additional commits viewable in compare view

Updates @run402/sdk from 4.8.0 to 4.31.0

Release notes

Sourced from @​run402/sdk's releases.

v4.31.0

Full Changelog: kychee-com/run402@v4.30.0...v4.31.0

v4.30.0

Full Changelog: kychee-com/run402@v4.29.0...v4.30.0

v4.29.0

Full Changelog: kychee-com/run402@v4.28.0...v4.29.0

v4.28.0

Full Changelog: kychee-com/run402@v4.27.0...v4.28.0

v4.27.0

A current organization for the CLI

A wallet has a current wallet. A project has a current project. The organization — which owns your projects, holds your memberships, and scopes rooms, escalations, members, grants, and audit — had no current at all. Every way to name one required a flag, an environment variable, or a deployed project.

That made one case awkward and one case impossible. Awkward: passing --org on every call. Impossible-in-practice: an org that owns no project — two agents coordinating in one repo while hosting nothing on run402 — could only be reached by pasting a UUID into RUN402_ROOM in every shell.

run402 org use

run402 org use <org_id>     # select it for this wallet profile
run402 org current          # what resolves, and which source supplied it
run402 org clear            # drop the selection

The selection is stored per wallet profile, not globally. The chain is wallet → principal → memberships, so a global selection would survive wallets use other and then either 403 or, worse, silently resolve to a valid-but-wrong org when both principals are members. run402 projects use now also stamps that project's org as current, since a project determines its org unambiguously.

.run402.json binds a checkout

The directory binding that already carried wallet now carries org and room:

{ "org": "…", "room": "my-repo" }

Every key is independently optional and resolves at the nearest file carrying it, walking up. Commit it and every agent in that checkout lands in the same room with no flags and no environment variables. (An org id is an identifier, not a credential — authorization stays server-side. .run402.local.json remains the gitignored override.)

One chain, four intent classes

Every org-scoped command now resolves the same way:

flag → environment → binding → profile state

and inside each class, an organization named directly outranks one derived from a project named in that same class. That last rule is what makes run402 rooms who --project X behave: naming a project is naming its organization, so a stale selection must not outrank it.

• RUN402_ORG disagreeing with a binding file is a hard AMBIGUOUS_ORG error naming both and their sources, resolved by --org — the same rule the wallet tier has had. A binding beats the profile selection silently, because that is what declaring a binding means.
• Nothing infers your org from having exactly one membership. Membership is server state that changes without you acting; a heuristic that is right today changes meaning the day you are invited elsewhere.
• Missing entirely is a typed ORG_REQUIRED listing every way to supply one — not the PROJECT_REQUIRED it used to borrow, which named the wrong thing for a caller who has no project by design.

... (truncated)

Commits

• bac1125 chore: bump version to v4.31.0
• 74dcdc8 chore: bump version to v4.30.0
• 2fce748 feat(cli,mcp,sdk)!: rename the developer-feedback channel to feedback
• e288e6d chore: bump version to v4.29.0
• b8203dc gitvault(sdk): follow the rev-41 fold in the five file-header protocol citations
• b846cfe gitvault: protocol rev 41 — the real keystore path, and the vendored vector s...
• 4fff1be gitvault: pin the §6.5 wire contract itself, not just the lane over it
• 0d3dac8 gitvault: drop an unused runtime import from the apply lane
• 343d9dc gitvault: supply the deploy lane, and verify correspondence instead of isolat...
• 060ea5f chore: bump version to v4.28.0
• Additional commits viewable in compare view

Updates jose from 6.2.3 to 6.2.10

Release notes

Sourced from jose's releases.

v6.2.10

Fixes

• jose: consume serialization members once (9bee285)
• jose: reject empty protected and JWE AAD members (8da4145)
• jose: validate serialized header values (b711d8f)
• jwe: conceal invalid decrypted CEK lengths (41fafe0)
• jwe: enforce AES-GCM tag boundaries (9a5b744)
• jwe: validate explicit encryption parameters (7a02697)
• jwk: accept empty octet-sequence keys (3f871e7)
• jwk: normalize key resolution inputs (f54ee7b)
• jwks: enforce verification key metadata (f9ba510)
• jwks: order overlapping remote reloads (9a1a913)
• jwks: reject invalid remote duration values (7bdb9e5)
• jwk: validate ext and key_ops parameters (4d91c37)
• jws: reject mixed payload encoding modes (dc69713)
• jws: validate unencoded payload strings (541f282)
• jwt: enforce explicit verification policies (b347182)
• jwt: prevent replacing protected headers (ae07d09)
• jwt: reject invalid duration inputs (282f9aa)
• jwt: validate builder claim values (ea03f83)
• jwt: validate unsecured protected headers (230c14e)
• key: validate generation and import options (15d880e)
• reject mixed b64 modes for empty General JWS payloads (61a2ef7)
• x509: reject DER truncated past its outer length (d8db9f6)

Documentation

• jwks: correct cache timestamp units (01a44d9)

Refactor

• jose: share binary input validation (eedb124)
• jose: share compact token processing internals (85e30ed)
• jwe: consolidate CBC decryption failures (1ee6f61)
• jwe: specialize compact processing (a998927)
• jwe: streamline single-recipient encryption (290aaa6)
• jwks: compact JWK Set shape validation (930c7df), references Array#every
• jwks: compact local key selection (4cb5ae5)
• jwks: compact remote resolver state (ef5eaf4)
• jws: specialize compact processing (021abf4)
• jwt: compact claim validation helpers (f390683)
• jwt: consolidate replicated claim checks (7dd5591)
• jwt: share producer claim state (52ba159)
• key: compact JWK algorithm selection (a6b29da)
• key: compact secret length parsing (cc03be8)

v6.2.9

Fixes

... (truncated)

Changelog

Sourced from jose's changelog.

6.2.10 (2026-08-21)

Fixes

• jose: consume serialization members once (9bee285)
• jose: reject empty protected and JWE AAD members (8da4145)
• jose: validate serialized header values (b711d8f)
• jwe: conceal invalid decrypted CEK lengths (41fafe0)
• jwe: enforce AES-GCM tag boundaries (9a5b744)
• jwe: validate explicit encryption parameters (7a02697)
• jwk: accept empty octet-sequence keys (3f871e7)
• jwk: normalize key resolution inputs (f54ee7b)
• jwks: enforce verification key metadata (f9ba510)
• jwks: order overlapping remote reloads (9a1a913)
• jwks: reject invalid remote duration values (7bdb9e5)
• jwk: validate ext and key_ops parameters (4d91c37)
• jws: reject mixed payload encoding modes (dc69713)
• jws: validate unencoded payload strings (541f282)
• jwt: enforce explicit verification policies (b347182)
• jwt: prevent replacing protected headers (ae07d09)
• jwt: reject invalid duration inputs (282f9aa)
• jwt: validate builder claim values (ea03f83)
• jwt: validate unsecured protected headers (230c14e)
• key: validate generation and import options (15d880e)
• reject mixed b64 modes for empty General JWS payloads (61a2ef7)
• x509: reject DER truncated past its outer length (d8db9f6)

Documentation

• jwks: correct cache timestamp units (01a44d9)

Refactor

• jose: share binary input validation (eedb124)
• jose: share compact token processing internals (85e30ed)
• jwe: consolidate CBC decryption failures (1ee6f61)
• jwe: specialize compact processing (a998927)
• jwe: streamline single-recipient encryption (290aaa6)
• jwks: compact JWK Set shape validation (930c7df), references Array#every
• jwks: compact local key selection (4cb5ae5)
• jwks: compact remote resolver state (ef5eaf4)
• jws: specialize compact processing (021abf4)
• jwt: compact claim validation helpers (f390683)
• jwt: consolidate replicated claim checks (7dd5591)
• jwt: share producer claim state (52ba159)
• key: compact JWK algorithm selection (a6b29da)
• key: compact secret length parsing (cc03be8)

6.2.9 (2026-08-15)

... (truncated)

Commits

• 3eab152 chore(release): 6.2.10
• 021abf4 refactor(jws): specialize compact processing
• a998927 refactor(jwe): specialize compact processing
• eedb124 refactor(jose): share binary input validation
• 52ba159 refactor(jwt): share producer claim state
• 85e30ed refactor(jose): share compact token processing internals
• 0bd81d2 test(jose): cover hidden critical-header options
• 9cf7876 test(jose): reject callable object impostors
• f23cafd test(jose): preserve resolved key data properties
• 1ee6f61 refactor(jwe): consolidate CBC decryption failures
• Additional commits viewable in compare view

Updates pg from 8.22.0 to 8.23.0

Changelog

Sourced from pg's changelog.

pg@8.23.0

• Add support for query pipelineing.

Commits

• df274d1 Publish
• eb19d0f Add opt-in query pipelining (#3652)
• See full diff in compare view

Updates @types/pg from 8.20.0 to 8.23.1

Commits

• See full diff in compare view

Updates @types/pg from 8.20.0 to 8.23.1

Commits

• See full diff in compare view

Updates esbuild from 0.28.1 to 0.28.2

Release notes

Sourced from esbuild's releases.

v0.28.2

• Fix tree shaking bug due to TypeScript import alias (#4507)

  This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

  import Base from './dep.js';
  import Alias = Base.SomeType;

• Fix CSS minification bug involving & (#4497)

  This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

  /* Original code */
  .a .b {
    & .b:not(& .c) {
      color: red;
    }
  }
  /* Old output (with --minify) */
  .a .b{.b:not(& .c){color:red}}
  /* New output (with --minify) */
  .a .b{& .b:not(& .c){color:red}}

  This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

• Avoid overwriting input files without --allow-overwrite (#4484)

  For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

  This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

• Fix incorrect code generated when using top-level await (#4498)

  Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

• Fix a minification bug with lowered logical assignment operators (#4508)

  This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

  // Original code
  function foo() {
    let x
    bar(x ||= {})

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.2

• Fix tree shaking bug due to TypeScript import alias (#4507)

  This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

  import Base from './dep.js';
  import Alias = Base.SomeType;

• Fix CSS minification bug involving & (#4497)

  This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

  /* Original code */
  .a .b {
    & .b:not(& .c) {
      color: red;
    }
  }
  /* Old output (with --minify) */
  .a .b{.b:not(& .c){color:red}}
  /* New output (with --minify) */
  .a .b{& .b:not(& .c){color:red}}

  This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

• Avoid overwriting input files without --allow-overwrite (#4484)

  For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

  This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

• Fix incorrect code generated when using top-level await (#4498)

  Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

• Fix a minification bug with lowered logical assignment operators (#4508)

  This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

  // Original code
  function foo() {
    let x

... (truncated)

Commits

• 609683d publish 0.28.2 to npm
• 11b1fe4 add to release notes
• ab50d91 css: fix green/blue channel swap in oklch gamut mapping (#4488)
• 04627b6 fix #4498: async TLA checks need a worklist
• 5c15177 disable gopls in the go folder
• fc2ee9b css: adjust parser to allow --foo: {...}
• 209db54 release notes for css nesting bugfix
• c625d31 fix #4497: preserve nested ampersands during minification (#4500)
• 34474e2 better isolation of current part in js parser
• 07f6e8c fix #4507: import assignment tree-shaking bug
• Additional commits viewable in compare view

Updates tsx from 4.23.1 to 4.23.12

Release notes

Sourced from tsx's releases.

v4.23.12

4.23.12 (2026-08-10)

Bug Fixes

• shim import.meta when tokens are split by comments or newlines (#829) (ed9d330), closes #828

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.11

4.23.11 (2026-08-07)

Bug Fixes

• preserve async ESM require fallback (55cbece)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.10

4.23.10 (2026-08-07)

Bug Fixes

• support nyc coverage discovery (#710) (ec1bcd5)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.9

4.23.9 (2026-08-06)

Bug Fixes

• map Node test locations (2f55884)
• support data URLs in tsImport (b94f46f)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.8

... (truncated)

Commits

• ed9d330 fix: shim import.meta when tokens are split by comments or newlines (#829)
• 651f5be test: cover CommonJS TypeScript import.meta paths
• bd3bc64 test: cover CommonJS loader source fallback
• 55cbece fix: preserve async ESM require fallback
• 6c5ba85 docs: document CommonJS default interop
• ec1bcd5 fix: support nyc coverage discovery (#710)
• b6e5b48 docs: clarify CommonJS default imports
• 2f55884 fix: map Node test locations
• de935d5 docs: document Node source-map stack formatting
• b94f46f fix: support data URLs in tsImport
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions