Skip to content

deps(deps): bump the major group across 1 directory with 2 updates - #259

Merged
ralyodio merged 1 commit into
masterfrom
dependabot/npm_and_yarn/major-c28a26aef0
Oct 6, 2026
Merged

deps(deps): bump the major group across 1 directory with 2 updates#259
ralyodio merged 1 commit into
masterfrom
dependabot/npm_and_yarn/major-c28a26aef0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the major group with 2 updates in the / directory: @alpacahq/alpaca-trade-api and framer-motion.

Updates @alpacahq/alpaca-trade-api from 4.0.4 to 5.0.0

Release notes

Sourced from @​alpacahq/alpaca-trade-api's releases.

v5.0.0

Major Changes

  • #340 82f27d9 Thanks @​Azein! - Regenerate the SDK from the latest Trading and Market Data OpenAPI specifications.

    Breaking contract updates. Remove the upstream crypto perpetual-futures and index-value APIs and their ergonomic helpers. Replace generated order, option-contract, corporate-announcement, position-close response, activity-detail, and tokenization-issuer types with their current named schemas. Adopt corrected asset, option-contract, portfolio-history, and activity field types, including optional options-activity groupId values, the new REO reorganization code, the clarified REORG/WRM worthless-removal classification, and null-safe required primitive arrays.

    New APIs and streaming. Add Travel Rule VASP/update operations, tokenization-mint idempotencyKey support, and corporate-actions SSE. Replace broken buffered SSE array methods with typed, cancellable, resumable async streams, and add first-class trading.subscribeActivities and marketData.subscribeCorporateActions facade helpers with refreshable OAuth providers.

    Reliability and migration support. Bound asynchronous REST credential resolution and request preparation by the configured request timeout and caller cancellation. Ship a migration index plus a focused 4.x-to-5.0 codemod for safe generated-contract rewrites and manual-review diagnostics.

Changelog

Sourced from @​alpacahq/alpaca-trade-api's changelog.

5.0.0

Major Changes

  • #340 82f27d9 Thanks @​Azein! - Regenerate the SDK from the latest Trading and Market Data OpenAPI specifications.

    Breaking contract updates. Remove the upstream crypto perpetual-futures and index-value APIs and their ergonomic helpers. Replace generated order, option-contract, corporate-announcement, position-close response, activity-detail, and tokenization-issuer types with their current named schemas. Adopt corrected asset, option-contract, portfolio-history, and activity field types, including optional options-activity groupId values, the new REO reorganization code, the clarified REORG/WRM worthless-removal classification, and null-safe required primitive arrays.

    New APIs and streaming. Add Travel Rule VASP/update operations, tokenization-mint idempotencyKey support, and corporate-actions SSE. Replace broken buffered SSE array methods with typed, cancellable, resumable async streams, and add first-class trading.subscribeActivities and marketData.subscribeCorporateActions facade helpers with refreshable OAuth providers.

    Reliability and migration support. Bound asynchronous REST credential resolution and request preparation by the configured request timeout and caller cancellation. Ship a migration index plus a focused 4.x-to-5.0 codemod for safe generated-contract rewrites and manual-review diagnostics.

Commits

Updates framer-motion from 13.4.4 to 14.0.0

Changelog

Sourced from framer-motion's changelog.

[14.0.0] 2026-10-02

Changed

  • Removed internal APIs restored in 13.5.1 for compatibility with framer-motion 13.0–13.4. Future removed internal APIs won't cause cross-compatibility issues since pinning internal framer-motion, motion-dom and motion-utils dependencies.

[13.5.1] 2026-10-02

Changed

  • <motion>: Fall back to the attribute in readSVGValue when computed style is empty.
  • <motion>: Internal changes to animateChanges for size reductions.

Fixed

  • scroll: Temporarily reverted removal of internal observeTimeline API to fix compatibility with previous 13.x APIs. Moving to pinned dependencies before removing in 14.x.
  • styleEffect: Cleaning up an earlier value no longer removes a value that was bound to the same key after it.
  • svgEffect: No longer writes transforms and origins as attributes.
  • <motion>: inherit={false} now correctly not inheriting parent animations.
  • <motion>: Fix sortNodePosition throwing when a sibling hasn't mounted

[13.5.0] 2026-10-01

Added

  • spring: Now accepts negative bounce (0--1) to define overdamped springs.

Changed

  • <m>: 20% smaller.
  • useSpring: 10% smaller.
  • scroll/useScroll: Use main thread for all offset animations.

Fixed

  • Ensure warning and error messages are cleaned from production build.
  • Ensure values are never rendered before they've been resolved.

[13.4.7] 2026-09-30

Changed

  • scroll/useScroll: More offsets are now hardware accelerated via ViewTimeline.

Fixed

  • animate: Reduced size of Motion Studio introspection call.
  • useTransform: Accelerated values now correctly clamp.
  • scroll/useScroll: Ensure offsets work the same across the JS main thread and ViewTimeline.
  • scroll/useScroll: Remove ScrollTimeline/ViewTimeline observer in favour of main-thread scroll tracking.

... (truncated)

Commits
  • f5838ce v14.0.0
  • 351f7d0 Updating changelog
  • 5da7dcd Merge pull request #3889 from motiondivision/cursor/v14-remove-shims-4e79
  • 0897128 Remove 13.5.1 compatibility shims for framer-motion 13.0–13.4
  • d4638ea v13.5.1
  • 43cd77e Updating changelog
  • 7005965 Merge pull request #3888 from motiondivision/cursor/restore-observe-timeline-...
  • 7bf77e9 Merge pull request #3884 from motiondivision/cursor/sort-node-position-unmoun...
  • c0495b0 Merge pull request #3887 from motiondivision/cursor/exact-internal-deps-4e79
  • 9a16751 Honour deprecated rangeStart/rangeEnd in attachTimeline
  • Additional commits viewable in compare view

@dependabot @github

dependabot Bot commented on behalf of github Oct 5, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@socket-security

socket-security Bot commented Oct 5, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updated@​alpacahq/​alpaca-trade-api@​4.0.4 ⏵ 5.0.097 +310010093 +1100
Updatedframer-motion@​13.4.4 ⏵ 14.0.09910010098 +1100

View full report

@socket-security

socket-security Bot commented Oct 5, 2026 •
edited
Loading

Copy link
Copy Markdown

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

@dependabot
deps(deps): bump the major group across 1 directory with 2 updates
d9e5e52 
Bumps the major group with 2 updates in the / directory: [@alpacahq/alpaca-trade-api](https://github.com/alpacahq/alpaca-trade-api-js) and [framer-motion](https://github.com/motiondivision/motion).


Updates `@alpacahq/alpaca-trade-api` from 4.0.4 to 5.0.0
- [Release notes](https://github.com/alpacahq/alpaca-trade-api-js/releases)
- [Changelog](https://github.com/alpacahq/alpaca-trade-api-js/blob/master/CHANGELOG.md)
- [Commits](alpacahq/alpaca-trade-api-js@v4.0.4...v5.0.0)

Updates `framer-motion` from 13.4.4 to 14.0.0
- [Changelog](https://github.com/motiondivision/motion/blob/main/CHANGELOG.md)
- [Commits](motiondivision/motion@v13.4.4...v14.0.0)

---
updated-dependencies:
- dependency-name: "@alpacahq/alpaca-trade-api"
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: major
- dependency-name: framer-motion
  dependency-version: 14.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title deps(deps): bump the major group with 2 updates deps(deps): bump the major group across 1 directory with 2 updates Oct 6, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/major-c28a26aef0 branch from 7e2391b to d9e5e52 Compare October 6, 2026 00:22
ralyodio added a commit that referenced this pull request Oct 6, 2026
@ralyodio @claude
test(iptv): mint broken TLS certs locally instead of hitting badssl.com
7fffab2 
The expired and self-signed fetchUpstream cases reached
expired.badssl.com and self-signed.badssl.com. When the runner could not
reach them both failed with "fetch failed", which blocked Dependabot PR
#259 although nothing it bumped is involved.

They now run against HTTPS servers on 127.0.0.1 with certificates the
openssl CLI mints at run time (no committed private keys). The expired
cert comes from `openssl ca -selfsign` with past dates, which works on
OpenSSL 3.0. Each case also asserts the certificate-fallback warning, so
a 200 from the strict agent alone would fail; disabling the fallback
fails both.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@ralyodio ralyodio mentioned this pull request Oct 6, 2026
Merged
ralyodio added a commit that referenced this pull request Oct 6, 2026
@ralyodio @claude
test(iptv): mint broken TLS certs locally instead of hitting badssl.c…
07b764e 
…om (#260)

The expired and self-signed fetchUpstream cases reached
expired.badssl.com and self-signed.badssl.com. When the runner could not
reach them both failed with "fetch failed", which blocked Dependabot PR
#259 although nothing it bumped is involved.

They now run against HTTPS servers on 127.0.0.1 with certificates the
openssl CLI mints at run time (no committed private keys). The expired
cert comes from `openssl ca -selfsign` with past dates, which works on
OpenSSL 3.0. Each case also asserts the certificate-fallback warning, so
a 200 from the strict agent alone would fail; disabling the fallback
fails both.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
@ralyodio
ralyodio merged commit 3e7a0c1 into master Oct 6, 2026
12 of 14 checks passed
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/major-c28a26aef0 branch October 6, 2026 01:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ralyodio