Bump the all-dependencies group with 6 updates by dependabot[bot] · Pull Request #65 · AegisJSProject/commands

dependabot · 2026-06-17T16:04:43Z

Bumps the all-dependencies group with 6 updates:

Package	From	To
@shgysk8zer0/eslint-config	`1.0.9`	`1.1.0`
@shgysk8zer0/http-server	`1.1.2`	`1.2.0`
@shgysk8zer0/importmap	`1.9.20`	`1.10.2`
@shgysk8zer0/polyfills	`0.6.3`	`0.8.6`
eslint	`10.4.1`	`10.5.0`
rollup	`4.61.1`	`4.62.0`

Updates @shgysk8zer0/eslint-config from 1.0.9 to 1.1.0

Release notes

Sourced from @shgysk8zer0/eslint-config's releases.

Release v1.1.0

See Changelog

Changelog

Sourced from @shgysk8zer0/eslint-config's changelog.

[v1.1.0] - 2026-06-14

Added

Add Security policy

Add npm config to harden installs

Changed

Update Workflows with permissions

Update contributiing guidelines

Commits

84786ad Merge pull request #173 from shgysk8zer0/feature/harden
f80cee0 Update README.md
1cf714a Hardening
cf99db2 Merge pull request #172 from shgysk8zer0/dependabot/npm_and_yarn/all-dependen...
98ebc19 Bump rollup from 4.61.0 to 4.61.1 in the all-dependencies group
6f05051 Merge pull request #171 from shgysk8zer0/dependabot/npm_and_yarn/all-dependen...
a20c7fc Bump the all-dependencies group with 2 updates
c0755a4 Merge pull request #170 from shgysk8zer0/dependabot/npm_and_yarn/all-dependen...
b3f5623 Bump the all-dependencies group with 2 updates
2a1e691 Merge pull request #169 from shgysk8zer0/dependabot/npm_and_yarn/brace-expans...
Additional commits viewable in compare view

Updates @shgysk8zer0/http-server from 1.1.2 to 1.2.0

Release notes

Sourced from @shgysk8zer0/http-server's releases.

Release v1.2.0

See Changelog

Changelog

Sourced from @shgysk8zer0/http-server's changelog.

[v1.2.0] - 2026-06-12

Changed

Upgrade to node 26.3.0 / npm 11.16.0

Min node version set to 22.12.0

Use npm stage publish

Allow expected scripts

Update various dependencies

Commits

08c9b54 Merge pull request #125 from shgysk8zer0/feature/harden
8adf75c Upgrade Node to 26.3.0; update deps & CI
ab6babd Merge pull request #124 from shgysk8zer0/dependabot/npm_and_yarn/all-dependen...
a91f833 chore(deps-dev): bump rollup in the all-dependencies group
582e819 Merge pull request #123 from shgysk8zer0/dependabot/npm_and_yarn/all-dependen...
876e755 chore(deps-dev): bump the all-dependencies group with 3 updates
4de1bb3 Merge pull request #122 from shgysk8zer0/dependabot/npm_and_yarn/all-dependen...
6085b33 chore(deps-dev): bump the all-dependencies group with 2 updates
6459351 Merge pull request #121 from shgysk8zer0/dependabot/npm_and_yarn/all-dependen...
7983be8 chore(deps-dev): bump @shgysk8zer0/importmap
Additional commits viewable in compare view

Updates @shgysk8zer0/importmap from 1.9.20 to 1.10.2

Release notes

Sourced from @shgysk8zer0/importmap's releases.

Release v1.10.2

See Changelog

Release v1.10.1

See Changelog

Release v1.10.0

See Changelog

Changelog

Sourced from @shgysk8zer0/importmap's changelog.

[v1.10.2] - 2026-06-15

Changed

Bulk updates in packages hardening CI security

[v1.10.1] - 2026-06-14

Added

Add Security policy

Add npm config to harden installs

Changed

Update Workflows with permissions

Update contributiing guidelines

Removed

Remove auto-update workflow

[v1.10.0] - 2026-06-11

Changed

Switch to using npm stage publish

[v1.9.21] - 2026-06-10

Changed

Update @aegisjsproject/hermes

Commits

e4c652d Merge pull request #384 from shgysk8zer0/patch/updates
de84529 Bulk updates in packages hardening CI security
db99352 Merge pull request #383 from shgysk8zer0/patch/version-bump
e3068ba Fix version
614b844 Merge pull request #382 from shgysk8zer0/feature/harden
680024e Fix markdown linting errors
bc2c69a Add security policy and CI/npm hardening
193ebca Merge pull request #381 from shgysk8zer0/feature/stage
1a4ae59 Bump version to v1.10.0 and update publish flow
f52f349 Merge pull request #380 from shgysk8zer0/patch/updates
Additional commits viewable in compare view

Updates @shgysk8zer0/polyfills from 0.6.3 to 0.8.6

Release notes

Sourced from @shgysk8zer0/polyfills's releases.

Release v0.8.6

See Changelog

Release v0.8.5

See Changelog

Release v0.8.4

See Changelog

Release v0.8.3

See Changelog

Release v0.8.2

See Changelog

Release v0.8.1

See Changelog

Release v0.7.1

See Changelog

Release v0.7.0

See Changelog

Changelog

Sourced from @shgysk8zer0/polyfills's changelog.

[v0.8.6] - 2026-06-15

Fixed

Fix permissions issue in GitHub Relase workflow

[v0.8.5] - 2026-06-15

Added

Implement security changes provided by SecurityStep

[v0.8.4] - 2026-06-12

Fixed

Fix location of SECURITY.md

[v0.8.3] - 2026-06-12

Added

Added SECURITY.md for reporting security issues

Changed

Update permissions in GitHub Actions

Update CONTRIBUTING.md

[v0.8.2] - 2026-06-12

Added

Add .npmrc to harden npm i & npm ci operations

[v0.8.1] - 2026-06-11

Fixed

Re-align versions between git, npm, & changelog

[v0.7.1] - 2026-06-11

Fixed

Fix publishing/staging command

[v0.7.0] - 2026-06-11

Changed

Update to node 26.3.0 / npm 11.16.0

Update from publish to publish stage

Allow fsevents postinstall script

Removed

Remove postinstall script

Commits

47ef348 Merge pull request #191 from shgysk8zer0/bug/action-permissions
bdbf147 Fix permissions issue in GitHub Release workflow
7bf1346 Merge pull request #190 from shgysk8zer0/patch/version-bump
e123718 Bump version to 0.8.5 and add local ESLint hook
f957969 Merge pull request #189 from step-security-bot/chore/GHA-151725-stepsecurity-...
e233cfa [StepSecurity] Apply security best practices
2be742f Merge pull request #188 from shgysk8zer0/patch/security
c301cba Fix location of SECURITY.md
68817a9 Merge pull request #187 from shgysk8zer0/patch/perms-and-docs
a0f7972 Fix md linting errors
Additional commits viewable in compare view

Updates eslint from 10.4.1 to 10.5.0

Release notes

Sourced from eslint's releases.

v10.5.0

Features

5ca8c52 feat: correct stack tracking in max-nested-callbacks (#20973) (Pixel998)

b565783 feat: report no-with violations at the with keyword (#20971) (Pixel998)

2ce032f feat: report max-lines-per-function violations at function head (#20966) (Pixel998)

732cb3e feat: report max-nested-callbacks violations at function head (#20967) (Pixel998)

f9c138a feat: report max-depth violations on keywords (#20943) (Pixel998)

bdb496c feat: correct max-depth handling for else-if chains (#20944) (Pixel998)

c296873 feat: update error loc in max-statements to function header (#20907) (Taejin Kim)

Documentation

8ae1b5b docs: Update README (GitHub Actions Bot)

ca7eb90 docs: update Node.js prerequisites to include ICU support (#20962) (Francesco Trotta)

f99b47a docs: Update README (GitHub Actions Bot)

acf03d4 docs: clarify precedence of parserOptions over languageOptions (#20926) (sethamus)

Chores

b18bf58 chore: update ecosystem plugins (#20959) (ESLint Bot)

c2d1444 refactor: replace areAllSegmentsUnreachable with !isAnySegmentReachable (#20951) (Taejin Kim)

243b8c5 chore: enhance config-rule to support oneOf, anyOf, and nested schemas (#20788) (kuldeep kumar)

217b2a9 test: add unit tests for ParserService (#20949) (Taejin Kim)

72003e7 test: add location information to error messages in max-statements (#20945) (lumir)

7797c26 refactor: deduplicate isAnySegmentReachable across rules (#20890) (Taejin Kim)

67c46fa chore: update ecosystem plugins (#20938) (ESLint Bot)

95d8c7a chore: update dependency @eslint/json to v2 (#20934) (renovate[bot])

cf9e496 chore: update @arethetypeswrong/cli to 0.18.3 (#20933) (Pixel998)

fb6d396 test: run type tests with TypeScript 7 (#20868) (sethamus)

Commits

de3b672 10.5.0
362a518 Build: changelog update for 10.5.0
5ca8c52 feat: correct stack tracking in max-nested-callbacks (#20973)
b565783 feat: report no-with violations at the with keyword (#20971)
2ce032f feat: report max-lines-per-function violations at function head (#20966)
732cb3e feat: report max-nested-callbacks violations at function head (#20967)
f9c138a feat: report max-depth violations on keywords (#20943)
8ae1b5b docs: Update README
ca7eb90 docs: update Node.js prerequisites to include ICU support (#20962)
b18bf58 chore: update ecosystem plugins (#20959)
Additional commits viewable in compare view

Updates rollup from 4.61.1 to 4.62.0

Release notes

Sourced from rollup's releases.

v4.62.0

4.62.0

2026-06-13

Features

Ensure that shared dependencies between manual chunks and entry points receive a serparate chunk (#6374)

Pull Requests

#6374: Extract the static dependencies imported by manual chunks into separate chunks (@TrickyPi, @lukastaegert)

#6405: fix(deps): update minor/patch updates (@renovate[bot])

#6406: chore(deps): pin dependency concurrently to v9 (@renovate[bot], @lukastaegert)

#6407: chore(deps): lock file maintenance minor/patch updates (@renovate[bot])

#6409: chore(deps): update minor/patch updates to v6.2.0 (@renovate[bot])

#6410: chore(deps): lock file maintenance minor/patch updates (@renovate[bot])

#6412: fix(deps): update minor/patch updates (@renovate[bot])

#6413: chore(deps): update dependency eslint-plugin-unicorn to v65 (@renovate[bot])

#6414: chore(deps): lock file maintenance minor/patch updates (@renovate[bot], @lukastaegert)

Changelog

Sourced from rollup's changelog.

4.62.0

2026-06-13

Features

Ensure that shared dependencies between manual chunks and entry points receive a serparate chunk (#6374)

Pull Requests

#6374: Extract the static dependencies imported by manual chunks into separate chunks (@TrickyPi, @lukastaegert)

#6405: fix(deps): update minor/patch updates (@renovate[bot])

#6406: chore(deps): pin dependency concurrently to v9 (@renovate[bot], @lukastaegert)

#6407: chore(deps): lock file maintenance minor/patch updates (@renovate[bot])

#6409: chore(deps): update minor/patch updates to v6.2.0 (@renovate[bot])

#6410: chore(deps): lock file maintenance minor/patch updates (@renovate[bot])

#6412: fix(deps): update minor/patch updates (@renovate[bot])

#6413: chore(deps): update dependency eslint-plugin-unicorn to v65 (@renovate[bot])

#6414: chore(deps): lock file maintenance minor/patch updates (@renovate[bot], @lukastaegert)

Commits

5e0066d 4.62.0
93e85fc chore(deps): update dependency eslint-plugin-unicorn to v65 (#6413)
5c9ef2e fix(deps): update minor/patch updates (#6412)
18654d8 chore(deps): lock file maintenance minor/patch updates (#6414)
d96ed95 Extract the static dependencies imported by manual chunks into separate chunk...
126e141 chore(deps): pin dependency concurrently to v9 (#6406)
f2f58c4 chore(deps): lock file maintenance minor/patch updates (#6410)
5a15062 chore(deps): update minor/patch updates to v6.2.0 (#6409)
d02f03a chore(deps): lock file maintenance minor/patch updates (#6407)
844671c fix(deps): update minor/patch updates (#6405)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the all-dependencies group with 6 updates: | Package | From | To | | --- | --- | --- | | [@shgysk8zer0/eslint-config](https://github.com/shgysk8zer0/eslint-config) | `1.0.9` | `1.1.0` | | [@shgysk8zer0/http-server](https://github.com/shgysk8zer0/http-server) | `1.1.2` | `1.2.0` | | [@shgysk8zer0/importmap](https://github.com/shgysk8zer0/importmap) | `1.9.20` | `1.10.2` | | [@shgysk8zer0/polyfills](https://github.com/shgysk8zer0/polyfills) | `0.6.3` | `0.8.6` | | [eslint](https://github.com/eslint/eslint) | `10.4.1` | `10.5.0` | | [rollup](https://github.com/rollup/rollup) | `4.61.1` | `4.62.0` | Updates `@shgysk8zer0/eslint-config` from 1.0.9 to 1.1.0 - [Release notes](https://github.com/shgysk8zer0/eslint-config/releases) - [Changelog](https://github.com/shgysk8zer0/eslint-config/blob/master/CHANGELOG.md) - [Commits](shgysk8zer0/eslint-config@v1.0.9...v1.1.0) Updates `@shgysk8zer0/http-server` from 1.1.2 to 1.2.0 - [Release notes](https://github.com/shgysk8zer0/http-server/releases) - [Changelog](https://github.com/shgysk8zer0/http-server/blob/master/CHANGELOG.md) - [Commits](shgysk8zer0/http-server@v1.1.2...v1.2.0) Updates `@shgysk8zer0/importmap` from 1.9.20 to 1.10.2 - [Release notes](https://github.com/shgysk8zer0/importmap/releases) - [Changelog](https://github.com/shgysk8zer0/importmap/blob/master/CHANGELOG.md) - [Commits](shgysk8zer0/importmap@v1.9.20...v1.10.2) Updates `@shgysk8zer0/polyfills` from 0.6.3 to 0.8.6 - [Release notes](https://github.com/shgysk8zer0/polyfills/releases) - [Changelog](https://github.com/shgysk8zer0/polyfills/blob/master/CHANGELOG.md) - [Commits](shgysk8zer0/polyfills@v0.6.3...v0.8.6) Updates `eslint` from 10.4.1 to 10.5.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.4.1...v10.5.0) Updates `rollup` from 4.61.1 to 4.62.0 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md) - [Commits](rollup/rollup@v4.61.1...v4.62.0) --- updated-dependencies: - dependency-name: "@shgysk8zer0/eslint-config" dependency-version: 1.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: "@shgysk8zer0/http-server" dependency-version: 1.2.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: "@shgysk8zer0/importmap" dependency-version: 1.10.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: "@shgysk8zer0/polyfills" dependency-version: 0.8.6 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: eslint dependency-version: 10.5.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: rollup dependency-version: 4.62.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-06-17T16:04:44Z

Labels

The following labels could not be found: dependencies, javascript. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

socket-security · 2026-06-17T16:05:10Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
@shgysk8zer0/eslint-config@1.0.9 ⏵ 1.1.0	⁺¹		^-2
@shgysk8zer0/importmap@1.9.20 ⏵ 1.10.2			⁺¹
@shgysk8zer0/http-server@1.1.2 ⏵ 1.2.0			⁺¹
@shgysk8zer0/polyfills@0.6.3 ⏵ 0.8.6	⁺⁸	⁺²	⁺⁶
eslint@10.4.1 ⏵ 10.5.0
rollup@4.61.1 ⏵ 4.62.0	⁺¹

View full report

socket-security · 2026-06-17T16:05:12Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `js-yaml` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → `npm/@shgysk8zer0/importmap@1.10.2` → `npm/js-yaml@4.2.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/js-yaml@4.2.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

dependabot Bot assigned shgysk8zer0 Jun 17, 2026

dependabot Bot requested a review from shgysk8zer0 as a code owner June 17, 2026 16:04

shgysk8zer0 approved these changes Jun 17, 2026

View reviewed changes

shgysk8zer0 merged commit acfc3e5 into master Jun 17, 2026
6 checks passed

shgysk8zer0 deleted the dependabot/npm_and_yarn/all-dependencies-f01d94a086 branch June 17, 2026 18:36

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Bump the all-dependencies group with 6 updates#65

Bump the all-dependencies group with 6 updates#65
shgysk8zer0 merged 1 commit into
masterfrom
dependabot/npm_and_yarn/all-dependencies-f01d94a086

dependabot Bot commented on behalf of github Jun 17, 2026

Uh oh!

dependabot Bot commented on behalf of github Jun 17, 2026

Uh oh!

socket-security Bot commented Jun 17, 2026

Uh oh!

socket-security Bot commented Jun 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jun 17, 2026

Release v1.1.0

[v1.1.0] - 2026-06-14

Added

Changed

Release v1.2.0

[v1.2.0] - 2026-06-12

Changed

Release v1.10.2

Release v1.10.1

Release v1.10.0

[v1.10.2] - 2026-06-15

Changed

[v1.10.1] - 2026-06-14

Added

Changed

Removed

[v1.10.0] - 2026-06-11

Changed

[v1.9.21] - 2026-06-10

Changed

Release v0.8.6

Release v0.8.5

Release v0.8.4

Release v0.8.3

Release v0.8.2

Release v0.8.1

Release v0.7.1

Release v0.7.0

[v0.8.6] - 2026-06-15

Fixed

[v0.8.5] - 2026-06-15

Added

[v0.8.4] - 2026-06-12

Fixed

[v0.8.3] - 2026-06-12

Added

Changed

[v0.8.2] - 2026-06-12

Added

[v0.8.1] - 2026-06-11

Fixed

[v0.7.1] - 2026-06-11

Fixed

[v0.7.0] - 2026-06-11

Changed

Removed

v10.5.0

Features

Documentation

Chores

v4.62.0

4.62.0

Features

Pull Requests

4.62.0

Features

Pull Requests

Uh oh!

dependabot Bot commented on behalf of github Jun 17, 2026

Labels

Uh oh!

socket-security Bot commented Jun 17, 2026

Uh oh!

socket-security Bot commented Jun 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant