Skip to content

build(deps-dev): bump the npm_and_yarn group across 1 directory with 8 updates - #26

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-4de29e46fc
Open

build(deps-dev): bump the npm_and_yarn group across 1 directory with 8 updates#26
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-4de29e46fc

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 14, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 8 updates in the / directory:

Package From To
brace-expansion 1.1.12 1.1.22
js-yaml 3.14.2 3.15.2
browserslist 4.28.1 4.29.5
flatted 3.3.3 3.4.4
form-data 4.0.5 4.0.6
handlebars 4.7.8 4.7.10
rollup 4.54.0 4.68.3
ws 8.18.3 8.23.0

Updates brace-expansion from 1.1.12 to 1.1.22

Release notes

Sourced from brace-expansion's releases.

v1.1.15

  • Backport v5.0.6 change to v1 (#111) 0b09384

juliangruber/brace-expansion@v1.1.14...v1.1.15

Commits

Updates js-yaml from 3.14.2 to 3.15.2

Changelog

Sourced from js-yaml's changelog.

3.15.2 - 2026-08-26

Changed

  • [backport] Hard-limit merge sequence size to 100.

Security

  • [backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

3.15.1 - 2026-07-31

Security

  • [backport] Remove quadratic complexity from !!omap duplicate key detection.

3.15.0 - 2026-06-27

Added

  • Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one safeLoad() / safeLoadAll() call.
Commits

Updates browserslist from 4.28.1 to 4.29.5

Release notes

Sourced from browserslist's releases.

4.29.5

4.29.4

  • Fixed joined version bounds in version ray and range queries (by @​ybai08).
  • Fixed whitespaces processing (by @​abhu85).

4.29.3

  • Updated Firefox ESR.

4.29.2

  • Fixed ignoring null usage in cover X in Y query (by @​wahidrizka).

4.29.1

4.29.0

  • Added query continuations across lines and array entries (by @​fzlzjerry).

4.28.9

4.28.8

  • Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

4.28.6

4.28.5

4.28.4

  • Fixed SyntaxError regression of 4.28.3.

4.28.3

  • Fixed baseline query case-insensitivity (by @​swwind).

4.28.2

Changelog

Sourced from browserslist's changelog.

4.29.5

4.29.4

  • Fixed joined version bounds in version ray and range queries (by @​ybai08).
  • Fixed whitespaces processing (by @​abhu85).

4.29.3

  • Updated Firefox ESR.

4.29.2

  • Fixed ignoring null usage in cover X in Y query (by @​wahidrizka).

4.29.1

4.29.0

  • Added query continuations across lines and array entries (by @​fzlzjerry).

4.28.9

4.28.8

  • Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

4.28.6

4.28.5

... (truncated)

Commits
  • 2e4b904 Release 4.29.5 version
  • 11a13ec Update dependencies
  • e80fabc Merge pull request #957 from nk-batman21/fix-coverage-custom-stats-versions
  • cac8029 Normalize custom statistics versions in coverage
  • f7a99b9 Release 4.29.4 version
  • 03fc702 Update dependencies
  • efe07e1 Merge pull request #956 from ybai08/fix-joined-range-bounds
  • ef50f5b Fix joined version bounds in version ray and range queries
  • 8219dd7 Merge pull request #954 from abhu85/fix-since-extends-whitespace
  • 893120b Allow arbitrary whitespaces in since, extends, config and not queries
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for browserslist since your current version.


Updates flatted from 3.3.3 to 3.4.4

Commits

Updates form-data from 4.0.5 to 4.0.6

Changelog

Sourced from form-data's changelog.

v4.0.6 - 2026-06-12

Commits

  • [Fix] escape CR, LF, and " in field names and filenames 8dff42c
  • [Dev Deps] update @ljharb/eslint-config, auto-changelog, tape f31d21e
  • [Deps] update hasown, mime-types 92ae0eb
  • [Dev Deps] update js-randomness-predictor 67b0f65
Commits
  • 64190db v4.0.6
  • 92ae0eb [Deps] update hasown, mime-types
  • f31d21e [Dev Deps] update @ljharb/eslint-config, auto-changelog, tape
  • 8dff42c [Fix] escape CR, LF, and " in field names and filenames
  • 67b0f65 [Dev Deps] update js-randomness-predictor
  • See full diff in compare view

Updates handlebars from 4.7.8 to 4.7.10

Release notes

Sourced from handlebars's releases.

v4.7.10

  • security: Sanitize the source map URL when minifying - f37c599
  • security: Iterate lazily in #each and strip whitespace in linear time - 812c226
  • security: Escape <!-- and <script in precompiled output - 609d1b1 GHSA-xw65-4hp5-5hc7
  • security: Don't trust special properties on context data - ceec388 GHSA-p8wg-vrv2-v86f
  • security: Only compile partials that are template strings - c28ee7a
  • security: Only dispatch known node types in the Compiler and Visitor - 7d501a5
  • security: Validate AST values in the compiler instead of the parser - 703fdcc GHSA-8r5x-fm3f-whwj
  • Clarify that --root does not restrict filesystem access - 0fcf25c
  • Bump minimist to ^1.2.8 - ea8ed82
  • Fix Ruby component publishing documentation - d069c1c
  • Fix Composer component definition - 6714e07

Compatibility notes:

  • {{#each}} iterates iterables such as Map, Set and generators lazily, like for...of, instead of copying them into an array first. Values added to the iterable while the block renders are now visited too.

Commits

v4.7.9

Commits

Changelog

Sourced from handlebars's changelog.

v4.7.10 - October 5th, 2026

  • security: Sanitize the source map URL when minifying - f37c599
  • security: Iterate lazily in #each and strip whitespace in linear time - 812c226
  • security: Escape <!-- and <script in precompiled output - 609d1b1 GHSA-xw65-4hp5-5hc7
  • security: Don't trust special properties on context data - ceec388 GHSA-p8wg-vrv2-v86f
  • security: Only compile partials that are template strings - c28ee7a
  • security: Only dispatch known node types in the Compiler and Visitor - 7d501a5
  • security: Validate AST values in the compiler instead of the parser - 703fdcc GHSA-8r5x-fm3f-whwj
  • Clarify that --root does not restrict filesystem access - 0fcf25c
  • Bump minimist to ^1.2.8 - ea8ed82
  • Fix Ruby component publishing documentation - d069c1c
  • Fix Composer component definition - 6714e07

Compatibility notes:

  • {{#each}} iterates iterables such as Map, Set and generators lazily, like for...of, instead of copying them into an array first. Values added to the iterable while the block renders are now visited too.

Commits

v4.7.9 - March 26th, 2026

  • fix: enable shell mode for spawn to resolve Windows EINVAL issue - e0137c2
  • fix type "RuntimeOptions" also accepting string partials - eab1d14
  • feat(types): set hash to be a Record<string, any> - de4414d
  • fix non-contiguous program indices - 4512766
  • refactor: rename i to startPartIndex - e497a35
  • security: fix security issues - 68d8df5

Commits

Commits
  • 45ce152 v4.7.10
  • e47b236 Update release notes
  • f37c599 Sanitize the source map URL when minifying
  • 812c226 Iterate lazily in #each and strip whitespace in linear time
  • 609d1b1 Escape <!-- and <script in precompiled output
  • ceec388 Don't trust special properties on context data
  • c28ee7a Only compile partials that are template strings
  • 7d501a5 Only dispatch known node types in the Compiler and Visitor
  • 703fdcc Validate AST values in the compiler instead of the parser
  • 0fcf25c Clarify that --root does not restrict filesystem access
  • Additional commits viewable in compare view

Updates rollup from 4.54.0 to 4.68.3

Release notes

Sourced from rollup's releases.

v4.68.3

4.68.3

2026-11-13

Bug Fixes

  • Fix generated code in non-ESM formats for assignments and exported declarations in loops and single-statement bodies (#6651)
  • Ensure rollup does not make assumptions about the contents of an array where the length has been reassigned (#6655)

Pull Requests

v4.68.2

4.68.2

2026-11-09

Bug Fixes

  • Fail if generated file names would write outside the target directory using Windows drive-relative paths (#6652)

Pull Requests

v4.68.1

4.68.1

2026-11-09

Bug Fixes

  • Improve namespace object generation in cyclic imports (#6644)
  • Warn about deleting or reassigning namespace members but make those operations catchable runtime errors (#6645)
  • Do not generate invalid code for non-esm output when exporting destructing declarations with defaults (#6648)

Pull Requests

... (truncated)

Changelog

Sourced from rollup's changelog.

4.68.3

2026-11-13

Bug Fixes

  • Fix generated code in non-ESM formats for assignments and exported declarations in loops and single-statement bodies (#6651)
  • Ensure rollup does not make assumptions about the contents of an array where the length has been reassigned (#6655)

Pull Requests

4.68.2

2026-11-09

Bug Fixes

  • Fail if generated file names would write outside the target directory using Windows drive-relative paths (#6652)

Pull Requests

4.68.1

2026-11-09

Bug Fixes

  • Improve namespace object generation in cyclic imports (#6644)
  • Warn about deleting or reassigning namespace members but make those operations catchable runtime errors (#6645)
  • Do not generate invalid code for non-esm output when exporting destructing declarations with defaults (#6648)

Pull Requests

... (truncated)

Commits

Updates ws from 8.18.3 to 8.23.0

Release notes

Sourced from ws's releases.

8.23.0

Features

  • Introduced the maxPendingAutoPongs option (ace7248f).

Bug fixes

  • Fixed a remote memory exhaustion DoS vulnerability (ace7248f).

A malicious peer can flood the other peer with Ping frames while stopping reads, forcing it to buffer Pong frames that are automatically sent in response until memory is exhausted, leading to process termination due to OOM.

import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(125);
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
ws.pause();
(function ping() {
  ws.ping(data, function (err) {
    if (err) return;
    ping();
  });
})();

});
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(client close - code: ${code} reason: ${reason.toString()});
});
});
wss.on('connection', function (ws) {
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(server close - code: ${code} reason: ${reason.toString()});
});
});

The vulnerability was responsibly disclosed by multiple reporters:

... (truncated)

Commits
  • d387219 [dist] 8.23.0
  • ace7248 [security] Limit automatically sent pending pongs
  • 73d283c [test] Ensure DuplexSockets automatically emit the 'close' event
  • 2582a67 [dist] 8.22.2
  • 3eec252 [perf] Do not retain the read buffer via the close reason (#2354)
  • 9757c69 [fix] Do not modify the url.URL object (#2353)
  • e23d55e [fix] Percent-decode the userinfo of the URL (#2352)
  • 335a610 [perf] Do not retain the read buffer via the frame mask (#2350)
  • f40ccff [doc] Adjust Node.js version requirement in README (#2348)
  • c18a80a [dist] 8.22.1
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
build(deps-dev): bump the npm_and_yarn group across 1 directory with …
982a64b 
…8 updates

Bumps the npm_and_yarn group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.12` | `1.1.22` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `3.14.2` | `3.15.2` |
| [browserslist](https://github.com/browserslist/browserslist) | `4.28.1` | `4.29.5` |
| [flatted](https://github.com/WebReflection/flatted) | `3.3.3` | `3.4.4` |
| [form-data](https://github.com/form-data/form-data) | `4.0.5` | `4.0.6` |
| [handlebars](https://github.com/handlebars-lang/handlebars.js) | `4.7.8` | `4.7.10` |
| [rollup](https://github.com/rollup/rollup) | `4.54.0` | `4.68.3` |
| [ws](https://github.com/websockets/ws) | `8.18.3` | `8.23.0` |



Updates `brace-expansion` from 1.1.12 to 1.1.22
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.22)

Updates `js-yaml` from 3.14.2 to 3.15.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/3.15.2/CHANGELOG.md)
- [Commits](nodeca/js-yaml@3.14.2...3.15.2)

Updates `browserslist` from 4.28.1 to 4.29.5
- [Release notes](https://github.com/browserslist/browserslist/releases)
- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md)
- [Commits](browserslist/browserslist@4.28.1...4.29.5)

Updates `flatted` from 3.3.3 to 3.4.4
- [Commits](WebReflection/flatted@v3.3.3...v3.4.4)

Updates `form-data` from 4.0.5 to 4.0.6
- [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md)
- [Commits](form-data/form-data@v4.0.5...v4.0.6)

Updates `handlebars` from 4.7.8 to 4.7.10
- [Release notes](https://github.com/handlebars-lang/handlebars.js/releases)
- [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/v4.7.10/release-notes.md)
- [Commits](handlebars-lang/handlebars.js@v4.7.8...v4.7.10)

Updates `rollup` from 4.54.0 to 4.68.3
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.54.0...v4.68.3)

Updates `ws` from 8.18.3 to 8.23.0
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.18.3...8.23.0)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 1.1.22
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 3.15.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: browserslist
  dependency-version: 4.29.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: flatted
  dependency-version: 3.4.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: form-data
  dependency-version: 4.0.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: handlebars
  dependency-version: 4.7.10
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: rollup
  dependency-version: 4.68.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-version: 8.23.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 14, 2026
This was referenced Nov 14, 2026
Open
Open
Open
Open
Open
@cursor

cursor Bot commented Nov 14, 2026

Copy link
Copy Markdown

Geprüft von Gardener 1 – lokal grün, CI wartet auf Runner

Grouped lockfile bump only. package.json ranges are unchanged, and no direct dependency version changed. The eight updates are transitive devDependencies:

  • brace-expansion 1.1.12 → 1.1.22
  • js-yaml 3.14.2 → 3.15.2 (security backports on the 3.x line)
  • browserslist 4.28.1 → 4.29.5
  • flatted 3.3.3 → 3.4.4
  • form-data 4.0.5 → 4.0.6
  • handlebars 4.7.8 → 4.7.10
  • rollup 4.54.0 → 4.68.3 (tsup's bundler)
  • ws 8.18.3 → 8.23.0

Local checks on Node 18.20.8, 20.20.2, and 22.23.4 all passed: npm ci, npm run lint, npm run typecheck, npm run test:ci, npm run build. There is no demo app in this repo.

Socket Security checks succeeded. Actions test (18) and test (20) are still queued because the self-hosted runner is offline. Not approved until those checks are green.

This PR does not supersede #11–#15. Those change direct dependency ranges (globals, typescript-eslint, eslint, typescript, jest-environment-jsdom); this one does not touch them.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants