chore(deps): bump the production-dependencies group across 1 directory with 3 updates

[dependabot]

Bumps the production-dependencies group with 3 updates in the / directory: @fozikio/reflex, better-sqlite3 and yaml.

Updates @fozikio/reflex from 0.2.0 to 0.2.1

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​fozikio/reflex since your current version.

Updates better-sqlite3 from 11.10.0 to 13.0.3

Release notes

Sourced from better-sqlite3's releases.

v13.0.3

What's Changed

• use Ubuntu 22.04-arm by @​neoxpert in WiseLibs/better-sqlite3#1510

Full Changelog: WiseLibs/better-sqlite3@v13.0.2...v13.0.3

v13.0.2

What's Changed

• add gypfile option to package.json by @​neoxpert in WiseLibs/better-sqlite3#1505
• Update SQLite to version 3.53.4 by @​JoshuaWise in WiseLibs/better-sqlite3#1506
• validate the parameters of table properly by @​theosotr in WiseLibs/better-sqlite3#1504
• fix: this dependabot configuration does not set a co... in... by @​anupamme in WiseLibs/better-sqlite3#1508
• fixed process aborting from terminating worker threads (WiseLibs/better-sqlite3#1507)

New Contributors

• @​theosotr made their first contribution in WiseLibs/better-sqlite3#1504
• @​anupamme made their first contribution in WiseLibs/better-sqlite3#1508

Full Changelog: WiseLibs/better-sqlite3@v13.0.1...v13.0.2

v13.0.1

Full Changelog: WiseLibs/better-sqlite3@v13.0.0...v13.0.1

Fixed a regression in parameter binding where it would be overly strict and reject plain objects from other realms (e.g., in jest tests).

v13.0.0

Version 13.0.0 marks a major milestone, as it's the first version of better-sqlite3 to run on the N-API. This means prebuilt binaries should theoretically work across different versions of Node.js and Electron, and perhaps even other runtimes like Bun. As a result, we've removed the deprecated prebuild-install dependency, and now prebuilt binaries are published directly with the better-sqlite3 code itself. If your platform/architecture doesn't have a prebuilt binary, it should compile during install as before.

What's Changed

• Refactored codebase to use node-addon-api by @​JoshuaWise in WiseLibs/better-sqlite3#1498
• Added a new db.explain() method, for running EXPLAIN queries without needing to supply bound parameters.
• Added a new preparedStatement.toString() method, for getting the expanded SQL of a prepared statement.
• Fix SqliteError cross-realm and Error.isError compatibility by @​dennismutuku2005 in WiseLibs/better-sqlite3#1473

New Contributors

• @​dennismutuku2005 made their first contribution in WiseLibs/better-sqlite3#1473

Full Changelog: WiseLibs/better-sqlite3@v12.12.0...v13.0.0

v12.12.0

What's Changed

[!WARNING]

BREAKING: Starting with Electron v43, binary assets will require glibc 2.41 or higher on Linux hosts.

• Update SQLite to version 3.53.3 by @​JoshuaWise in WiseLibs/better-sqlite3#1492
• Utilize node:20-trixie for Electron v43 and onwards by @​neoxpert in WiseLibs/better-sqlite3#1495

... (truncated)

Commits

• dbc2ea1 13.0.3
• b872585 use Ubuntu 22.04-arm (#1510)
• 569e85a 13.0.2
• df1324b fix: this dependabot configuration does not set a co... in... (#1508)
• b9fbe5f fixed segfault from making calls while worker thread is terminating
• 71707c4 validate the parameters of table properly (#1504)
• 6478c99 Update SQLite to version 3.53.4 (#1506)
• 6d24034 add gypfile option to package.json (#1505)
• ab6232e fixed typo in docs
• 57d751c updated readme
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for better-sqlite3 since your current version.

Updates yaml from 2.8.3 to 2.9.0

Release notes

Sourced from yaml's releases.

v2.9.0

The changes here are really only patches, but I'm releasing this as a minor version to note a small change to the documentation of parseDocument() and parseAllDocuments(): I've removed the claim that they'll "never throw".

It remains the case that practically all non-malicious inputs will be handled without emitting an error, but there is a decent chance that code paths remain where e.g. a RangeError due to call stack exhaustion can be triggered by malicious inputs. Up to now, I've considered these as security vulnerabilities, and in fact it's the only category of error for which yaml CVEs have been issued so far.

Starting from this release, I'll be considering such errors as bugs, but not vulnerabilities. I do welcome people and/or LLMs looking for them, but please report them as normal issues rather than suspected security vulnerabilities. This also applies to previously undiscovered bugs in earlier releases.

• fix: Avoid calling Array.prototype.push.apply() with large source array
• fix(lexer): Avoid recursive calls that may exhaust the call stack

v2.8.4

• Disable alias resolution with maxAliasCount:0 (#677)
• Handle invalid unicode escapes (e1a1a77)
• Apply minFractionDigits only to decimal strings (#676)

Commits

• ddb21b0 2.9.0
• 167365b docs: Clarify that not all errors can be avoided
• 6eca2a7 fix: Avoid calling Array.prototype.push.apply() with large source array
• 0543cd5 fix(lexer): Avoid recursive calls that may exhaust the call stack
• ccdf743 2.8.4
• f625789 fix: Disable alias resolution with maxAliasCount:0 (#677)
• e1a1a77 fix: Handle invalid unicode escapes
• a163ea0 style: Satify Prettier
• b2a5a6c fix: Apply minFractionDigits only to decimal strings (#676)
• 93c951b chore: Bump JSR version to v2.8.3 (#673)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions