Bump the security group across 1 directory with 11 updates#2865
Open
dependabot[bot] wants to merge 1 commit into
Open
Bump the security group across 1 directory with 11 updates#2865dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2b5ae215a0
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| "jest-canvas-mock": "2.5.2", | ||
| "jest-environment-jsdom": "29.7.0", | ||
| "js-yaml": "4.2.0", | ||
| "js-yaml": "5.0.0", |
There was a problem hiding this comment.
As of June 22, 2026, npm reports js-yaml@5.0.0 was published less than 7 days ago, but this repo enforces npmMinimalAgeGate: 7d in .yarnrc.yml. A clean yarn install --immutable in CI or a fresh checkout will therefore refuse this lockfile until the package ages out, unless it is explicitly preapproved; wait for the age gate or add an approved exception before merging.
Useful? React with 👍 / 👎.
Bumps the security group with 11 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@hono/node-server](https://github.com/honojs/node-server) | `1.19.9` | `1.19.14` | | [@tootallnate/once](https://github.com/TooTallNate/once) | `2.0.0` | `2.0.1` | | [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) | `8.2.1` | `8.5.2` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.1.0` | `3.1.2` | | [flatted](https://github.com/WebReflection/flatted) | `3.3.3` | `3.4.2` | | [form-data](https://github.com/form-data/form-data) | `4.0.5` | `4.0.6` | | [http-proxy-middleware](https://github.com/chimurai/http-proxy-middleware) | `2.0.9` | `2.0.10` | | [ip-address](https://github.com/beaugunderson/ip-address) | `10.0.1` | `10.2.0` | | [lodash-es](https://github.com/lodash/lodash) | `4.17.21` | `4.18.1` | | [picomatch](https://github.com/micromatch/picomatch) | `2.3.1` | `2.3.2` | | [ws](https://github.com/websockets/ws) | `7.5.10` | `7.5.11` | Updates `@hono/node-server` from 1.19.9 to 1.19.14 - [Release notes](https://github.com/honojs/node-server/releases) - [Commits](honojs/node-server@v1.19.9...v1.19.14) Updates `@tootallnate/once` from 2.0.0 to 2.0.1 - [Release notes](https://github.com/TooTallNate/once/releases) - [Changelog](https://github.com/TooTallNate/once/blob/v2.0.1/CHANGELOG.md) - [Commits](TooTallNate/once@2.0.0...v2.0.1) Updates `express-rate-limit` from 8.2.1 to 8.5.2 - [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases) - [Commits](express-rate-limit/express-rate-limit@v8.2.1...v8.5.2) Updates `fast-uri` from 3.1.0 to 3.1.2 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.0...v3.1.2) Updates `flatted` from 3.3.3 to 3.4.2 - [Commits](WebReflection/flatted@v3.3.3...v3.4.2) Updates `form-data` from 4.0.5 to 4.0.6 - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v4.0.5...v4.0.6) Updates `http-proxy-middleware` from 2.0.9 to 2.0.10 - [Release notes](https://github.com/chimurai/http-proxy-middleware/releases) - [Changelog](https://github.com/chimurai/http-proxy-middleware/blob/v2.0.10/CHANGELOG.md) - [Commits](chimurai/http-proxy-middleware@v2.0.9...v2.0.10) Updates `ip-address` from 10.0.1 to 10.2.0 - [Commits](beaugunderson/ip-address@v10.0.1...v10.2.0) Updates `lodash-es` from 4.17.21 to 4.18.1 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.18.1) Updates `picomatch` from 2.3.1 to 2.3.2 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@2.3.1...2.3.2) Updates `ws` from 7.5.10 to 7.5.11 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@7.5.10...7.5.11) --- updated-dependencies: - dependency-name: "@hono/node-server" dependency-version: 1.19.14 dependency-type: indirect dependency-group: security - dependency-name: "@tootallnate/once" dependency-version: 2.0.1 dependency-type: indirect dependency-group: security - dependency-name: express-rate-limit dependency-version: 8.5.2 dependency-type: indirect dependency-group: security - dependency-name: fast-uri dependency-version: 3.1.2 dependency-type: indirect dependency-group: security - dependency-name: flatted dependency-version: 3.4.2 dependency-type: indirect dependency-group: security - dependency-name: form-data dependency-version: 4.0.6 dependency-type: indirect dependency-group: security - dependency-name: http-proxy-middleware dependency-version: 2.0.10 dependency-type: indirect dependency-group: security - dependency-name: ip-address dependency-version: 10.2.0 dependency-type: indirect dependency-group: security - dependency-name: lodash-es dependency-version: 4.18.1 dependency-type: indirect dependency-group: security - dependency-name: picomatch dependency-version: 2.3.2 dependency-type: indirect dependency-group: security - dependency-name: ws dependency-version: 7.5.11 dependency-type: indirect dependency-group: security ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/security-77ab3b3062
branch
from
2b5ae21 to
c5ecc9a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the security group with 11 updates in the / directory:
1.19.91.19.142.0.02.0.18.2.18.5.23.1.03.1.23.3.33.4.24.0.54.0.62.0.92.0.1010.0.110.2.04.17.214.18.12.3.12.3.27.5.107.5.11Updates
@hono/node-serverfrom 1.19.9 to 1.19.14Release notes
Sourced from @hono/node-server's releases.
Commits
b5e63a31.19.14c02d777fix: add custom inspect to lightweight Request/Response to prevent TypeError ...fd64e651.19.13025c30fMerge commit from fork6cdb5a71.19.1270250f7fix: request draining for early 413 responses (#329)cfc08b3chore: ignore claude setting (#314)ecd4d6b1.19.11c944899fix: do not overwrite Content-Length in the fast path pattern if Content-Leng...2f8ca361.19.10Updates
@tootallnate/oncefrom 2.0.0 to 2.0.1Release notes
Sourced from @tootallnate/once's releases.
Changelog
Sourced from @tootallnate/once's changelog.
Commits
bcbb21dci: fix OIDC publishing — Node 24, npm latest, provenancedc24387Version Packages (2.x) (#12)b8a6f80CI: test all Node versions on Linux onlydabcc0fci: drop EOL Node.js 14.x/16.x, add 22.xb464efcUpdate CI: modern Node versions, fix macOS ARM64 compata1e5e2dFix promise hang when AbortSignal is abortedMaintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for
@tootallnate/oncesince your current version.Updates
express-rate-limitfrom 8.2.1 to 8.5.2Release notes
Sourced from express-rate-limit's releases.
Commits
97746938.5.20e94cc0v8.5.2 changelog9a583c5feat: simplify IPv6 key generation (#633)4f4b3fbchore(deps-dev): bump lint-staged from 16.4.0 to 17.0.4 (#632)3c1d6c5chore(deps-dev): bump the development-dependencies group with 7 updates (#631)18884b6chore(deps): bump basic-ftp from 5.2.0 to 5.3.1 (#630)dacc980chore(deps): bump handlebars from 4.7.8 to 4.7.9 (#629)486d0c6chore(deps): bump follow-redirects from 1.15.11 to 1.16.0 (#627)50cc3f68.5.192c8e3echore: bump ip-address library to latest (#626)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for express-rate-limit since your current version.
Updates
fast-urifrom 3.1.0 to 3.1.2Release notes
Sourced from fast-uri's releases.
Commits
919dd8eBumped v3.1.2c65ba57fixup: linting6c86c17Merge commit from forka95158aHandle malformed fragment decoding without throwing (#171)cea547cBumped v3.1.1876ce79Merge commit from forkdcdf690ci: add lock-threads workflow (#169)c860e65build(deps-dev): bump neostandard from 0.12.2 to 0.13.0 (#167)9b4c6dcbuild(deps): bump fastify/workflows/.github/workflows/plugins-ci.yml (#166)85d09a9build(deps): bump fastify/workflows/.github/workflows/plugins-ci-package-mana...Updates
flattedfrom 3.3.3 to 3.4.2Commits
3bf09093.4.2885ddccfix CWE-13210bdba70added flatted-view to the benchmark2a02dce3.4.1fba4e8fMerge pull request #89 from WebReflection/python-fix5fe8648added "when in Rome" also a test for PHP53517adsome minor improvementb3e2a0cFixing recursion issue in Python tooc4b46dbAdd SECURITY.md for security policy and reportingf86d071Create dependabot.yml for version updatesUpdates
form-datafrom 4.0.5 to 4.0.6Changelog
Sourced from form-data's changelog.
Commits
64190dbv4.0.692ae0eb[Deps] updatehasown,mime-typesf31d21e[Dev Deps] update@ljharb/eslint-config,auto-changelog,tape8dff42c[Fix] escape CR, LF, and"in field names and filenames67b0f65[Dev Deps] updatejs-randomness-predictorUpdates
http-proxy-middlewarefrom 2.0.9 to 2.0.10Release notes
Sourced from http-proxy-middleware's releases.
Changelog
Sourced from http-proxy-middleware's changelog.
Commits
f0be839chore(package.json): v2.0.10 (#1271)19c860dci(github-actions): update publish.yml (#1270)d0f7d63fix: harden proxy-table matching to prevent routing bypass (#1268)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for http-proxy-middleware since your current version.
Updates
ip-addressfrom 10.0.1 to 10.2.0Commits
80fccaa10.2.0abaeb4dType Address4.addressMinusSuffix as non-nilable (closes #143)2878c29Preserve subnet prefix through Address6.to4() (closes #123) (#203)586666eReject trailing junk in Address6.fromURL (closes #158) (#202)80bc76eValidate static factories instead of silently overflowing (#201)98927beClarify isValid() accepts CIDRs with host bits set (#81)a0eb073Fix getScope() and broaden getType() classification (closes #122) (#200)ec52105Add networkForm() for CIDR network-address strings (#199)a9443a7Add isMapped4() predicate for IPv4-mapped IPv6 addresses (closes #62) (#198)f01d742Add address-property predicates (private, ULA, loopback, link-local, etc.) (#...Updates
lodash-esfrom 4.17.21 to 4.18.1Release notes
Sourced from lodash-es's releases.
Commits
cb0b9b9release(patch): bump main to 4.18.1 (#6177)75535f5chore: prune stale advisory refs (#6170)62e91bcdocs: remove n_ Node.js < 6 REPL note from README (#6165)59be2derelease(minor): bump to 4.18.0 (#6161)af63457fix: broken tests for _.template 879aaa91073a76fix: linting issues879aaa9fix: validate imports keys in _.templatefe8d32efix: block prototype pollution in baseUnset via constructor/prototype traversal18ba0a3refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)b819080ci: add dist sync validation workflow (#6137)Updates
picomatchfrom 2.3.1 to 2.3.2Release notes
Sourced from picomatch's releases.
Changelog
Sourced from picomatch's changelog.
... (truncated)
Commits
81cba8dPublish 2.3.2fc1f6b6Merge commit from forkeec17aeMerge commit from fork78f8ca4Merge pull request #156 from micromatch/backport-1443f4f10eMerge pull request #144 from Jason3S/jdent-object-propertiesUpdates
wsfrom 7.5.10 to 7.5.11Release notes
Sourced from ws's releases.
Commits
fd36cd8[dist] 7.5.11e14c458[security] Limit retained message parts