Bump mocha from 11.8.0 to 12.0.3

[dependabot]

Bumps mocha from 11.8.0 to 12.0.3.

Release notes

Sourced from mocha's releases.

v12.0.3

12.0.3 (2026-10-01)

🩹 Fixes

• keep watching when the last test file is removed (#6355) (921c161)
• show require() error on unsupported directory import (#6354) (a68344f)
• support --X one-char aliases (#6391) (1227939)

📚 Documentation

• refresh help output, fix stale links (#6357) (bb2e69a)

🧹 Chores

• add --import=tsx integration test (#6356) (3382fdd)
• touch a new file without stamping it afterwards (#6349) (d59467a)

v12.0.2

12.0.2 (2026-09-17)

🩹 Fixes

• fail nested tests on beforeEach failure (#6292) (a75b43b)
• give CLI reporter-option precedence over config file (#6331) (571110f)
• propagate spec file path on parallel worker death (#6268) (55a544a)
• use find-up-simple to workaround ERR_PACKAGE_PATH_NOT_EXPORTED (#6342) (a652ff5)
• watch existing dirs so first run starts armed (#6263) (f5c8aca)

📚 Documentation

• add remaining external services (#6316) (bfe0b5d)
• update copyright year, holder, and URLs (#6303) (288c075)

🧹 Chores

• add "stale branch" workflow (#6315) (ad17f9f)
• add dependency conflict detection workflow (#6246) (ef0ae32)
• add folder for reproducing issues (#6330) (6728030)
• add stale triage reminder for unreviewed issues (#6314) (ee35133)
• auto-remove "waiting for author" label on author activity (#6213) (dbd4322)
• convert file-unloader to ESM (#6294) (dc73f4c)
• deps: update dependency @​playwright/test to v1.63.0 (#6299) (931baa5)
• deps: update dependency eslint to v10.10.0 (#6296) (3cb22d1)

... (truncated)

Changelog

Sourced from mocha's changelog.

12.0.3 (2026-10-01)

🩹 Fixes

• keep watching when the last test file is removed (#6355) (921c161)
• show require() error on unsupported directory import (#6354) (a68344f)
• support --X one-char aliases (#6391) (1227939)

📚 Documentation

• refresh help output, fix stale links (#6357) (bb2e69a)

🧹 Chores

• add --import=tsx integration test (#6356) (3382fdd)
• touch a new file without stamping it afterwards (#6349) (d59467a)

12.0.2 (2026-09-17)

🩹 Fixes

• fail nested tests on beforeEach failure (#6292) (a75b43b)
• give CLI reporter-option precedence over config file (#6331) (571110f)
• propagate spec file path on parallel worker death (#6268) (55a544a)
• use find-up-simple to workaround ERR_PACKAGE_PATH_NOT_EXPORTED (#6342) (a652ff5)
• watch existing dirs so first run starts armed (#6263) (f5c8aca)

📚 Documentation

• add remaining external services (#6316) (bfe0b5d)
• update copyright year, holder, and URLs (#6303) (288c075)

🧹 Chores

• add "stale branch" workflow (#6315) (ad17f9f)
• add dependency conflict detection workflow (#6246) (ef0ae32)
• add folder for reproducing issues (#6330) (6728030)
• add stale triage reminder for unreviewed issues (#6314) (ee35133)
• auto-remove "waiting for author" label on author activity (#6213) (dbd4322)
• convert file-unloader to ESM (#6294) (dc73f4c)
• deps: update dependency @​playwright/test to v1.63.0 (#6299) (931baa5)
• deps: update dependency eslint to v10.10.0 (#6296) (3cb22d1)
• deps: update dependency knip to v6.35.0 (#6324) (a2416af)
• deps: update octoguide/bot action to v0.23.0 (#6304) (bbe5a27)

... (truncated)

Commits

• 51a0cc5 chore(main): release 12.0.3 (#6353)
• 1227939 fix: support --X one-char aliases (#6391)
• bb2e69a docs: refresh help output, fix stale links (#6357)
• 921c161 fix: keep watching when the last test file is removed (#6355)
• 3382fdd test: add --import=tsx integration test (#6356)
• a68344f fix: show require() error on unsupported directory import (#6354)
• d59467a test: touch a new file without stamping it afterwards (#6349)
• 70db1c7 chore(main): release 12.0.2 (#6300)
• 571110f fix: give CLI reporter-option precedence over config file (#6331)
• a652ff5 fix: use find-up-simple to workaround ERR_PACKAGE_PATH_NOT_EXPORTED (#6342)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​mocha@​11.8.0 ⏵ 12.0.3

View full report

[rom1504]

Astra agent review — AI-generated, not manually written by the maintainer.

Reviewed head 370a2f01134a (open, unmerged).

Suitable for maintainer merge review as a routine dependency update. I checked the candidate manifest, test entry points and workflow: Node 24 runs the existing vector suite and tsd declaration checks. The current GitHub CI job records 52 passing; the submitted diff does not change production code or test selection.

Skills used: prismarine-review and its repository testing gate to check dependency scope, actual runner/discovery, existing discussion and the CI log; prismarine-architecture-review to distinguish development-tool compatibility from the published runtime contract. Validation here is source and existing GitHub CI inspection, not a newly executed local suite.