Bumps the all-dependencies group with 5 updates:

Package
From
To

@microsoft/1ds-core-js
4.4.4
4.4.5

@microsoft/1ds-post-js
4.4.4
4.4.5

@microsoft/api-extractor
7.59.3
7.59.4

memfs
4.79.0
4.80.0

shell-quote
1.11.0
1.12.0

Updates @microsoft/1ds-core-js from 4.4.4 to 4.4.5

Changelog

Sourced from @​microsoft/1ds-core-js's changelog.

Releases

Note: ES3/IE8 compatibility will be removed in the future v3.x.x releases (scheduled for mid-late 2022), so if you need to retain ES3 compatibility you will need to remain on the 2.x.x versions of the SDK or your runtime will need install polyfill's to your ES3 environment before loading / initializing the SDK.

<!-- raw HTML omitted -->

3.4.5 (October 5th, 2026)

This release enables internal SDK network statistics and routes them to a dedicated SDK Stats ingestion endpoint. The @microsoft/1ds-post-js channel is numbered 4.4.5 and requires v3.4.5.

Significant Changes (since 3.4.4)

• 
  Internal SDK Stats: The full SDK now records request successes, failures, retries, throttling, and request duration. Counters are persisted in session storage by customer instrumentation key and endpoint, with a default collection interval of one hour (stats.shrtInt, in seconds).


• 
  Dedicated Ingestion and Dynamic Configuration: Internal SDK Stats use a separate core and sender, rather than the customer's telemetry pipeline. Sending requires stats.cfgUrl, stats.iKey, and an enabled remote configuration that supplies the destination host. EU customer endpoints use the EU-prefixed configuration host. Configuration and sampling can be updated at runtime, and counters are retained while remote configuration is unavailable.


• 
  Feature Throttling: Added ThrottleMgr.useFeature() and string-keyed throttleMgrCfg entries for feature operations. Internal SDK Stats have a dedicated daily throttle, separate from internal diagnostic messages. Throttle sampling now honors a zero rate, interval rules are evaluated per configuration, and long-lived instances can send again on the next eligible UTC day.


• 
  Sender Unload Reliability: Late network responses no longer access the cleared core configuration when looking up internal SDK Stats after unload.

Potential behavioral changes

The internal SDK Stats manager is enabled by default, but it does not send statistics until the required local or CDN-delivered configuration is available and the remote configuration enables sending. Disable this feature with featureOptIn: { sdkStats: { mode: FeatureOptInMode.disable } }. The lowercase sdkStats feature is separate from the existing customer-facing SdkStats feature and its sdkStats.int collection interval.

Internal SDK Stats bypass customer telemetry initializers and plugins. Applications that use those hooks to inspect, modify, or filter customer telemetry should use the internal SDK Stats feature flag to opt out instead.

Changelog

• 
  #2741 Enable SDK Stats and route to the SDK Stats ingestion endpoint

Full Changelog: https://github.com/microsoft/ApplicationInsights-JS/compare/3.4.4...3.4.5

3.4.4 (September 8th, 2026)

This is a maintenance release for the 3.4.x version line containing runtime reliability and bundler compatibility fixes, build tooling and dependency security hardening, documentation corrections, and a test reliability fix. There are no SDK API changes. The @microsoft/1ds-post-js channel is numbered 4.4.4 and requires v3.4.4.

Significant Changes (since 3.4.3)

• 
  ESM XHR Instrumentation: Fixed tree shaking of the XHR capability check so automatic XHR instrumentation is preserved in ESM bundles.


• 
  Vite 8 and Rolldown Compatibility: Normalized generated PURE annotations by expression so invalid annotations on primitive literals no longer produce warnings, while valid call and new expression annotations remain tree-shakable.


• 
  OpenTelemetry Async Error Propagation: Fixed startActiveSpan() so promise rejections from asynchronous callbacks propagate to callers instead of being swallowed.


• 
  Dependency Security Hardening: Resolved the repository's npm audit and Component Governance findings by updating vulnerable transitive build dependencies and replacing Puppeteer's vulnerable extract-zip dependency with a maintained compatible package. Rush was upgraded to 5.178.1 and pnpm to 10.34.5, while API Extractor remains on the latest Node.js 18-compatible release. These are build/tooling changes and do not affect the published runtime code.


• 
  GitHub Actions Supply-Chain Hardening: Pinned third-party GitHub Actions to full-length commit SHAs and added grouped weekly Dependabot updates with a seven-day cooldown.

Changelog

• 
  #2768 Fix ESM XHR instrumentation tree shaking


• 
  #2767 docs: fix Offline Channel setup example


• 
  #2766 fix: normalize PURE annotations for Vite 8 and Rolldown


• 
  #2761 fix(deps): remediate Component Governance vulnerabilities


• 
  #2758 Pin GitHub Actions to full-length commit SHAs


• 
  #2757 fix(otel): propagate promise rejection from startActiveSpan async callback


• 
  #2754 fix(test): stabilize flaky SpanLifeCycle custom endTime test

<!-- raw HTML omitted -->

... (truncated)

Commits

• See full diff in compare view
  

Updates @microsoft/1ds-post-js from 4.4.4 to 4.4.5

Changelog

Sourced from @​microsoft/1ds-post-js's changelog.

Releases

Note: ES3/IE8 compatibility will be removed in the future v3.x.x releases (scheduled for mid-late 2022), so if you need to retain ES3 compatibility you will need to remain on the 2.x.x versions of the SDK or your runtime will need install polyfill's to your ES3 environment before loading / initializing the SDK.

<!-- raw HTML omitted -->

3.4.5 (October 5th, 2026)

This release enables internal SDK network statistics and routes them to a dedicated SDK Stats ingestion endpoint. The @microsoft/1ds-post-js channel is numbered 4.4.5 and requires v3.4.5.

Significant Changes (since 3.4.4)

• 
  Internal SDK Stats: The full SDK now records request successes, failures, retries, throttling, and request duration. Counters are persisted in session storage by customer instrumentation key and endpoint, with a default collection interval of one hour (stats.shrtInt, in seconds).


• 
  Dedicated Ingestion and Dynamic Configuration: Internal SDK Stats use a separate core and sender, rather than the customer's telemetry pipeline. Sending requires stats.cfgUrl, stats.iKey, and an enabled remote configuration that supplies the destination host. EU customer endpoints use the EU-prefixed configuration host. Configuration and sampling can be updated at runtime, and counters are retained while remote configuration is unavailable.


• 
  Feature Throttling: Added ThrottleMgr.useFeature() and string-keyed throttleMgrCfg entries for feature operations. Internal SDK Stats have a dedicated daily throttle, separate from internal diagnostic messages. Throttle sampling now honors a zero rate, interval rules are evaluated per configuration, and long-lived instances can send again on the next eligible UTC day.


• 
  Sender Unload Reliability: Late network responses no longer access the cleared core configuration when looking up internal SDK Stats after unload.

Potential behavioral changes

The internal SDK Stats manager is enabled by default, but it does not send statistics until the required local or CDN-delivered configuration is available and the remote configuration enables sending. Disable this feature with featureOptIn: { sdkStats: { mode: FeatureOptInMode.disable } }. The lowercase sdkStats feature is separate from the existing customer-facing SdkStats feature and its sdkStats.int collection interval.

Internal SDK Stats bypass customer telemetry initializers and plugins. Applications that use those hooks to inspect, modify, or filter customer telemetry should use the internal SDK Stats feature flag to opt out instead.

Changelog

• 
  #2741 Enable SDK Stats and route to the SDK Stats ingestion endpoint

Full Changelog: https://github.com/microsoft/ApplicationInsights-JS/compare/3.4.4...3.4.5

3.4.4 (September 8th, 2026)

This is a maintenance release for the 3.4.x version line containing runtime reliability and bundler compatibility fixes, build tooling and dependency security hardening, documentation corrections, and a test reliability fix. There are no SDK API changes. The @microsoft/1ds-post-js channel is numbered 4.4.4 and requires v3.4.4.

Significant Changes (since 3.4.3)

• 
  ESM XHR Instrumentation: Fixed tree shaking of the XHR capability check so automatic XHR instrumentation is preserved in ESM bundles.


• 
  Vite 8 and Rolldown Compatibility: Normalized generated PURE annotations by expression so invalid annotations on primitive literals no longer produce warnings, while valid call and new expression annotations remain tree-shakable.


• 
  OpenTelemetry Async Error Propagation: Fixed startActiveSpan() so promise rejections from asynchronous callbacks propagate to callers instead of being swallowed.


• 
  Dependency Security Hardening: Resolved the repository's npm audit and Component Governance findings by updating vulnerable transitive build dependencies and replacing Puppeteer's vulnerable extract-zip dependency with a maintained compatible package. Rush was upgraded to 5.178.1 and pnpm to 10.34.5, while API Extractor remains on the latest Node.js 18-compatible release. These are build/tooling changes and do not affect the published runtime code.


• 
  GitHub Actions Supply-Chain Hardening: Pinned third-party GitHub Actions to full-length commit SHAs and added grouped weekly Dependabot updates with a seven-day cooldown.

Changelog

• 
  #2768 Fix ESM XHR instrumentation tree shaking


• 
  #2767 docs: fix Offline Channel setup example


• 
  #2766 fix: normalize PURE annotations for Vite 8 and Rolldown


• 
  #2761 fix(deps): remediate Component Governance vulnerabilities


• 
  #2758 Pin GitHub Actions to full-length commit SHAs


• 
  #2757 fix(otel): propagate promise rejection from startActiveSpan async callback


• 
  #2754 fix(test): stabilize flaky SpanLifeCycle custom endTime test

<!-- raw HTML omitted -->

... (truncated)

Commits

• See full diff in compare view
  

Updates @microsoft/api-extractor from 7.59.3 to 7.59.4

Changelog

Sourced from @​microsoft/api-extractor's changelog.

7.59.4

Tue, 06 Oct 2026 00:04:37 GMT

Version update only

Commits

• See full diff in compare view
  

Updates memfs from 4.79.0 to 4.80.0

Release notes

Sourced from memfs's releases.

Release v4.80.0

What's Changed

• feat: allow configuring the synchronous FSA worker timeout by @​Firatakti in streamich/memfs#1298
  

New Contributors

• 
  @​Firatakti made their first contribution in streamich/memfs#1298
  

Full Changelog: https://github.com/streamich/memfs/compare/v4.79.0...v4.80.0

Commits

• 
  adae41a chore: release v4.80.0


• 
  d9cfa18 Merge pull request #1298 from Firatakti/codex/fsa-sync-timeout


• 
  fe75fbc feat: allow configuring the synchronous FSA worker timeout


• See full diff in compare view
  

Updates shell-quote from 1.11.0 to 1.12.0

Changelog

Sourced from shell-quote's changelog.

v1.12.0 - 2026-10-02

Fixed

• [New] parse: support here-documents (<<) #31
  

Commits

• [New] parse: support tab-stripping here-documents (<<-) dbfac37
  


• [New] parse: support output process substitution (>() 2053315
  


• [New] parse: support the case test-next terminator (;;&) 7d688b9
  


• [New] parse: support the case fall-through terminator (;&) f27010e
  


• [New] parse: support redirecting output despite noclobber (>|) b78d19c
  


• [New] parse: support opening a file for reading and writing (<>) 21cc333
  


• [New] parse: support redirecting stdout and stderr (&>) 6ad6cd2
  


• [New] parse: support appending stdout and stderr (&>>) 90cde9c
  


• [Dev Deps] update @ljharb/eslint-config 3a7b4ae
  

Commits

• 
  6ecb8aa v1.12.0


• 
  3a7b4ae [Dev Deps] update @ljharb/eslint-config
  


• 
  7d688b9 [New] parse: support the case test-next terminator (;;&)


• 
  f27010e [New] parse: support the case fall-through terminator (;&)


• 
  90cde9c [New] parse: support appending stdout and stderr (&>>)


• 
  6ad6cd2 [New] parse: support redirecting stdout and stderr (&>)


• 
  2053315 [New] parse: support output process substitution (>()


• 
  b78d19c [New] parse: support redirecting output despite noclobber (>|)


• 
  21cc333 [New] parse: support opening a file for reading and writing (<>)


• 
  dbfac37 [New] parse: support tab-stripping here-documents (<<-)


• Additional commits viewable in compare view
  

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions

###### Microsoft Reviewers: Open in CodeFlow