Bumps the all-dependencies group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| beachball | 2.65.6 | 2.66.0 |
| @types/react | 19.2.18 | 19.3.0 |
| @types/async | 3.2.25 | 3.2.26 |
| @types/react-test-renderer | 19.1.0 | 19.3.0 |
| @microsoft/1ds-core-js | 4.4.3 | 4.4.4 |
| @microsoft/1ds-post-js | 4.4.3 | 4.4.4 |
| @microsoft/api-extractor | 7.59.0 | 7.59.1 |
| memfs | 4.69.1 | 4.72.2 |

Updates beachball from 2.65.6 to 2.66.0

Changelog

Sourced from beachball's changelog.

2.66.0

Wed, 09 Sep 2026 03:05:57 GMT

Minor changes

• Support dotted names in config get ([email protected])

Commits

• 
  5ca6675 applying package updates


• 
  a104259 [v2] Support dotted names in config get (#1407)


• See full diff in compare view
  

Updates @types/react from 19.2.18 to 19.3.0

Commits

• See full diff in compare view
  

Updates @types/async from 3.2.25 to 3.2.26

Commits

• See full diff in compare view
  

Updates @types/react-test-renderer from 19.1.0 to 19.3.0

Commits

• See full diff in compare view
  

Updates @microsoft/1ds-core-js from 4.4.3 to 4.4.4

Changelog

Sourced from @​microsoft/1ds-core-js's changelog.

Releases

Note: ES3/IE8 compatibility will be removed in the future v3.x.x releases (scheduled for mid-late 2022), so if you need to retain ES3 compatibility you will need to remain on the 2.x.x versions of the SDK or your runtime will need install polyfill's to your ES3 environment before loading / initializing the SDK.

<!-- raw HTML omitted -->

3.4.4 (September 8th, 2026)

This is a maintenance release for the 3.4.x version line containing runtime reliability and bundler compatibility fixes, build tooling and dependency security hardening, documentation corrections, and a test reliability fix. There are no SDK API changes. The @microsoft/1ds-post-js channel is numbered 4.4.4 and requires v3.4.4.

Significant Changes (since 3.4.3)

• 
  ESM XHR Instrumentation: Fixed tree shaking of the XHR capability check so automatic XHR instrumentation is preserved in ESM bundles.


• 
  Vite 8 and Rolldown Compatibility: Normalized generated PURE annotations by expression so invalid annotations on primitive literals no longer produce warnings, while valid call and new expression annotations remain tree-shakable.


• 
  OpenTelemetry Async Error Propagation: Fixed startActiveSpan() so promise rejections from asynchronous callbacks propagate to callers instead of being swallowed.


• 
  Dependency Security Hardening: Resolved the repository's npm audit and Component Governance findings by updating vulnerable transitive build dependencies and replacing Puppeteer's vulnerable extract-zip dependency with a maintained compatible package. Rush was upgraded to 5.178.1 and pnpm to 10.34.5, while API Extractor remains on the latest Node.js 18-compatible release. These are build/tooling changes and do not affect the published runtime code.


• 
  GitHub Actions Supply-Chain Hardening: Pinned third-party GitHub Actions to full-length commit SHAs and added grouped weekly Dependabot updates with a seven-day cooldown.

Changelog

• 
  #2768 Fix ESM XHR instrumentation tree shaking


• 
  #2767 docs: fix Offline Channel setup example


• 
  #2766 fix: normalize PURE annotations for Vite 8 and Rolldown


• 
  #2761 fix(deps): remediate Component Governance vulnerabilities


• 
  #2758 Pin GitHub Actions to full-length commit SHAs


• 
  #2757 fix(otel): propagate promise rejection from startActiveSpan async callback


• 
  #2754 fix(test): stabilize flaky SpanLifeCycle custom endTime test


• 
  #2753 fix(deps): remediate npm audit vulnerabilities and add local Puppeteer Edge fallback

Full Changelog: https://github.com/microsoft/ApplicationInsights-JS/compare/3.4.3...3.4.4

3.4.3 (July 2nd, 2026)

This is a maintenance release for the 3.4.x version line adding a new SDK statistics feature, a PostChannel reliability fix, and dependency security hardening. The @microsoft/1ds-post-js channel is numbered 4.4.3 and requires v3.4.3.

Significant Changes (since 3.4.2)

• 
  

  Customer SDK Stats: Added a new SdkStats feature that periodically collects internal SDK usage/health statistics. It is enabled by default and can be disabled (or explicitly configured) via the featureOptIn configuration (e.g. featureOptIn: { SdkStats: { mode: FeatureOptInMode.disable } }); the collection interval defaults to 15 minutes (sdkStats.int).

  
  


• 
  

  PostChannel Auto-Flush Stall Fix: Fixed a permanent stall in @microsoft/1ds-post-js where, under sustained intermittent send failures (e.g. a load balancer returning occasional 503s), auto flush could wedge behind the flush() wait-for-idle timer and permanently stop draining the in-memory queue — causing telemetry to be silently dropped as QueueFull until the process was restarted. Auto flush is now fire-and-forget and no longer parks the scheduler waiting for the manager to become completely idle.

  
  


• 
  

  Dependency Security Hardening: Pinned tar to >=7.5.16 to remediate CVE-2026-53655 and resolved the remaining npm audit findings in build tooling via dependency overrides (js-yaml, yaml, markdown-it, linkify-it). These are build/tooling changes and do not affect the published runtime packages.

  
  

Changelog

• 
  #2746 Fix PostChannel auto-flush permanent stall under sustained intermittent send failures


• 
  #2745 fix(security): pin tar >=7.5.16 to remediate CVE-2026-53655


• 
  #2707 Enable Customer SDK Stats


• Resolve remaining npm audit findings via dependency overrides (js-yaml, yaml, markdown-it, linkify-it)

<!-- raw HTML omitted -->

... (truncated)

Commits

• See full diff in compare view
  

Updates @microsoft/1ds-post-js from 4.4.3 to 4.4.4

Changelog

Sourced from @​microsoft/1ds-post-js's changelog.

Releases

Note: ES3/IE8 compatibility will be removed in the future v3.x.x releases (scheduled for mid-late 2022), so if you need to retain ES3 compatibility you will need to remain on the 2.x.x versions of the SDK or your runtime will need install polyfill's to your ES3 environment before loading / initializing the SDK.

<!-- raw HTML omitted -->

3.4.4 (September 8th, 2026)

This is a maintenance release for the 3.4.x version line containing runtime reliability and bundler compatibility fixes, build tooling and dependency security hardening, documentation corrections, and a test reliability fix. There are no SDK API changes. The @microsoft/1ds-post-js channel is numbered 4.4.4 and requires v3.4.4.

Significant Changes (since 3.4.3)

• 
  ESM XHR Instrumentation: Fixed tree shaking of the XHR capability check so automatic XHR instrumentation is preserved in ESM bundles.


• 
  Vite 8 and Rolldown Compatibility: Normalized generated PURE annotations by expression so invalid annotations on primitive literals no longer produce warnings, while valid call and new expression annotations remain tree-shakable.


• 
  OpenTelemetry Async Error Propagation: Fixed startActiveSpan() so promise rejections from asynchronous callbacks propagate to callers instead of being swallowed.


• 
  Dependency Security Hardening: Resolved the repository's npm audit and Component Governance findings by updating vulnerable transitive build dependencies and replacing Puppeteer's vulnerable extract-zip dependency with a maintained compatible package. Rush was upgraded to 5.178.1 and pnpm to 10.34.5, while API Extractor remains on the latest Node.js 18-compatible release. These are build/tooling changes and do not affect the published runtime code.


• 
  GitHub Actions Supply-Chain Hardening: Pinned third-party GitHub Actions to full-length commit SHAs and added grouped weekly Dependabot updates with a seven-day cooldown.

Changelog

• 
  #2768 Fix ESM XHR instrumentation tree shaking


• 
  #2767 docs: fix Offline Channel setup example


• 
  #2766 fix: normalize PURE annotations for Vite 8 and Rolldown


• 
  #2761 fix(deps): remediate Component Governance vulnerabilities


• 
  #2758 Pin GitHub Actions to full-length commit SHAs


• 
  #2757 fix(otel): propagate promise rejection from startActiveSpan async callback


• 
  #2754 fix(test): stabilize flaky SpanLifeCycle custom endTime test


• 
  #2753 fix(deps): remediate npm audit vulnerabilities and add local Puppeteer Edge fallback

Full Changelog: https://github.com/microsoft/ApplicationInsights-JS/compare/3.4.3...3.4.4

3.4.3 (July 2nd, 2026)

This is a maintenance release for the 3.4.x version line adding a new SDK statistics feature, a PostChannel reliability fix, and dependency security hardening. The @microsoft/1ds-post-js channel is numbered 4.4.3 and requires v3.4.3.

Significant Changes (since 3.4.2)

• 
  

  Customer SDK Stats: Added a new SdkStats feature that periodically collects internal SDK usage/health statistics. It is enabled by default and can be disabled (or explicitly configured) via the featureOptIn configuration (e.g. featureOptIn: { SdkStats: { mode: FeatureOptInMode.disable } }); the collection interval defaults to 15 minutes (sdkStats.int).

  
  


• 
  

  PostChannel Auto-Flush Stall Fix: Fixed a permanent stall in @microsoft/1ds-post-js where, under sustained intermittent send failures (e.g. a load balancer returning occasional 503s), auto flush could wedge behind the flush() wait-for-idle timer and permanently stop draining the in-memory queue — causing telemetry to be silently dropped as QueueFull until the process was restarted. Auto flush is now fire-and-forget and no longer parks the scheduler waiting for the manager to become completely idle.

  
  


• 
  

  Dependency Security Hardening: Pinned tar to >=7.5.16 to remediate CVE-2026-53655 and resolved the remaining npm audit findings in build tooling via dependency overrides (js-yaml, yaml, markdown-it, linkify-it). These are build/tooling changes and do not affect the published runtime packages.

  
  

Changelog

• 
  #2746 Fix PostChannel auto-flush permanent stall under sustained intermittent send failures


• 
  #2745 fix(security): pin tar >=7.5.16 to remediate CVE-2026-53655


• 
  #2707 Enable Customer SDK Stats


• Resolve remaining npm audit findings via dependency overrides (js-yaml, yaml, markdown-it, linkify-it)

<!-- raw HTML omitted -->

... (truncated)

Commits

• See full diff in compare view
  

Updates @microsoft/api-extractor from 7.59.0 to 7.59.1

Changelog

Sourced from @​microsoft/api-extractor's changelog.

7.59.1

Sat, 05 Sep 2026 00:15:08 GMT

Version update only

Commits

• See full diff in compare view
  

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for @​microsoft/api-extractor since your current version.

Updates memfs from 4.69.1 to 4.72.2

Release notes

Sourced from memfs's releases.

Release v4.72.2

What's Changed

• fix(memfs): resolve relative streams from virtual cwd by @​xianjianlf2 in streamich/memfs#1271
  

Full Changelog: https://github.com/streamich/memfs/compare/v4.72.1...v4.72.2

Release v4.72.1

What's Changed

• fix(fs-node): finish BYOB file stream reads at EOF by @​xianjianlf2 in streamich/memfs#1285
  

Full Changelog: https://github.com/streamich/memfs/compare/v4.72.0...v4.72.1

Release v4.72.0

What's Changed

• feat: 🎸 improve path validation errors by @​streamich in streamich/memfs#1288
  

Full Changelog: https://github.com/streamich/memfs/compare/v4.71.1...v4.72.0

Release v4.71.1

What's Changed

• fix(fs-node): match Node directory iteration lifecycle by @​xianjianlf2 in streamich/memfs#1284
  

Full Changelog: https://github.com/streamich/memfs/compare/v4.71.0...v4.71.1

Release v4.71.0

What's Changed

• feat: 🎸 improve error normalization, make them more Node.js-like by @​streamich in streamich/memfs#1283
  

Full Changelog: https://github.com/streamich/memfs/compare/v4.70.0...v4.71.0

Release v4.70.0

What's Changed

• feat: 🎸 add 40 bound on symlink resolution and improve the algorithm, apply it to all .open() calls by @​streamich in streamich/memfs#1282
  

Full Changelog: https://github.com/streamich/memfs/compare/v4.69.1...v4.70.0

Commits

• 
  9ab28df chore: release v4.72.2


• 
  34ae22b Merge pull request #1271 from xianjianlf2/fix/create-write-stream-relative-900


• 
  13acb0d fix: preserve custom process when importing with an explicit cwd


• 
  a6eec7a chore: release v4.72.1


• 
  f728a36 Merge pull request #1285 from xianjianlf2/fix/filehandle-web-stream-byob


• 
  ab2338a chore: release v4.72.0


• 
  3235596 Merge pull request #1288 from streamich/fix/path-url-validation


• 
  d6e6d40 chore: release v4.71.1


• 
  8423b12 Merge pull request #1284 from xianjianlf2/fix/dir-iteration-lifecycle


• 
  22a2cb1 style: 💄 remove comment


• Additional commits viewable in compare view
  

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions

###### Microsoft Reviewers: Open in CodeFlow