Bump the root-npm-minor-patch group across 1 directory with 3 updates

[dependabot]

Bumps the root-npm-minor-patch group with 3 updates in the / directory: cheerio, yaml and tsx.

Updates cheerio from 1.0.0 to 1.2.0

Release notes

Sourced from cheerio's releases.

v1.2.0

What's Changed

• .val() now supports button values by @​kaioduarte in cheeriojs/cheerio#4175
• .find() now properly scopes :scope selectors by @​T0nd0Tara in cheeriojs/cheerio#4967
• The isHtml utility now runtime-validates input types by @​Mallikarjun-0 in cheeriojs/cheerio#4523

New Contributors

• @​noritaka1166 made their first contribution in cheeriojs/cheerio#4740
• @​kaioduarte made their first contribution in cheeriojs/cheerio#4175
• @​Mallikarjun-0 made their first contribution in cheeriojs/cheerio#4523
• @​T0nd0Tara made their first contribution in cheeriojs/cheerio#4967

Full Changelog: cheeriojs/cheerio@v1.1.2...v1.2.0

v1.1.2

What's Changed

• Fix fromURL baseURI issues by @​fb55 in cheeriojs/cheerio#4696

Full Changelog: cheeriojs/cheerio@v1.1.1...v1.1.2

v1.1.1

• Fix Undici issues (#4689) 91a2b3d7

---

cheeriojs/cheerio@v1.1.0...v1.1.1

v1.1.0

What's Changed

• fix(attributes): support .prop on document nodes by @​fb55 in cheeriojs/cheerio#4320
• fix(types): fix ExtractedValue type by @​ben-tilden in cheeriojs/cheerio#4334
• Add a field browser to package.json root by @​UNIDY2002 in cheeriojs/cheerio#4033
• Upgraded dependencies

Doc Improvements

• docs(blog): fix loading documents url by @​TonyRL in cheeriojs/cheerio#4002
• docs: fix function load() link by @​ya-luotao in cheeriojs/cheerio#4013
• docs: correct loadBuffer() name in example by @​arichardsmith in cheeriojs/cheerio#4270
• Update attr setter jsdoc by @​thyming in cheeriojs/cheerio#4469
• docs: use code block for install, mention yarn and bun by @​Electroid in cheeriojs/cheerio#4454
• docs: Replace .html with .prop for outerHTML by @​fb55 in cheeriojs/cheerio#4321

New Contributors

• @​TonyRL made their first contribution in cheeriojs/cheerio#4002
• @​ya-luotao made their first contribution in cheeriojs/cheerio#4013
• @​arichardsmith made their first contribution in cheeriojs/cheerio#4270
• @​UNIDY2002 made their first contribution in cheeriojs/cheerio#4033
• @​AzeemSup made their first contribution in cheeriojs/cheerio#4189

... (truncated)

Commits

• e3c7aaf 1.2.0
• 96bfd3e chore(package): Exclude tests from published bundle
• 08d396c docs(readme): Update Sponsors (#5014)
• bd9d3dd build(deps-dev): bump eslint-plugin-jsdoc from 62.3.0 to 62.3.1 (#5022)
• f4c8a58 build(deps): bump unist-util-visit from 5.0.0 to 5.1.0 in /website (#5027)
• 8fa46d5 build(deps): bump astro from 5.16.12 to 5.16.14 in /website (#5026)
• 8e132a6 build(deps-dev): bump @​vitest/coverage-v8 from 4.0.17 to 4.0.18 (#5023)
• 6d31bfc build(deps-dev): bump globals from 17.0.0 to 17.1.0 (#5025)
• 65aa6c8 build(deps): bump @​docsearch/css from 4.5.0 to 4.5.3 in /website (#5020)
• 5567e65 build(deps): bump astro from 5.16.11 to 5.16.12 in /website (#5021)
• Additional commits viewable in compare view

Updates yaml from 2.8.3 to 2.9.0

Release notes

Sourced from yaml's releases.

v2.9.0

The changes here are really only patches, but I'm releasing this as a minor version to note a small change to the documentation of parseDocument() and parseAllDocuments(): I've removed the claim that they'll "never throw".

It remains the case that practically all non-malicious inputs will be handled without emitting an error, but there is a decent chance that code paths remain where e.g. a RangeError due to call stack exhaustion can be triggered by malicious inputs. Up to now, I've considered these as security vulnerabilities, and in fact it's the only category of error for which yaml CVEs have been issued so far.

Starting from this release, I'll be considering such errors as bugs, but not vulnerabilities. I do welcome people and/or LLMs looking for them, but please report them as normal issues rather than suspected security vulnerabilities. This also applies to previously undiscovered bugs in earlier releases.

• fix: Avoid calling Array.prototype.push.apply() with large source array
• fix(lexer): Avoid recursive calls that may exhaust the call stack

v2.8.4

• Disable alias resolution with maxAliasCount:0 (#677)
• Handle invalid unicode escapes (e1a1a77)
• Apply minFractionDigits only to decimal strings (#676)

Commits

• ddb21b0 2.9.0
• 167365b docs: Clarify that not all errors can be avoided
• 6eca2a7 fix: Avoid calling Array.prototype.push.apply() with large source array
• 0543cd5 fix(lexer): Avoid recursive calls that may exhaust the call stack
• ccdf743 2.8.4
• f625789 fix: Disable alias resolution with maxAliasCount:0 (#677)
• e1a1a77 fix: Handle invalid unicode escapes
• a163ea0 style: Satify Prettier
• b2a5a6c fix: Apply minFractionDigits only to decimal strings (#676)
• 93c951b chore: Bump JSR version to v2.8.3 (#673)
• Additional commits viewable in compare view

Updates tsx from 4.23.0 to 4.23.12

Release notes

Sourced from tsx's releases.

v4.23.12

4.23.12 (2026-08-10)

Bug Fixes

• shim import.meta when tokens are split by comments or newlines (#829) (ed9d330), closes #828

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.11

4.23.11 (2026-08-07)

Bug Fixes

• preserve async ESM require fallback (55cbece)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.10

4.23.10 (2026-08-07)

Bug Fixes

• support nyc coverage discovery (#710) (ec1bcd5)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.9

4.23.9 (2026-08-06)

Bug Fixes

• map Node test locations (2f55884)
• support data URLs in tsImport (b94f46f)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.8

... (truncated)

Commits

• ed9d330 fix: shim import.meta when tokens are split by comments or newlines (#829)
• 651f5be test: cover CommonJS TypeScript import.meta paths
• bd3bc64 test: cover CommonJS loader source fallback
• 55cbece fix: preserve async ESM require fallback
• 6c5ba85 docs: document CommonJS default interop
• ec1bcd5 fix: support nyc coverage discovery (#710)
• b6e5b48 docs: clarify CommonJS default imports
• 2f55884 fix: map Node test locations
• de935d5 docs: document Node source-map stack formatting
• b94f46f fix: support data URLs in tsImport
• Additional commits viewable in compare view

[lhy0718]

@dependabot rebase

[lhy0718]

@dependabot rebase

[dependabot]

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.