Bump the npm_and_yarn group across 2 directories with 19 updates - #532
Open
dependabot[bot] wants to merge 1 commit into
Open
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
Bumps the npm_and_yarn group with 1 update in the /controller/web-server directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). Bumps the npm_and_yarn group with 15 updates in the /policy/frontend directory: | Package | From | To | | --- | --- | --- | | [express](https://github.com/expressjs/express) | `4.19.2` | `4.22.2` | | [http-proxy-middleware](https://github.com/chimurai/http-proxy-middleware) | `1.0.6` | `2.0.10` | | [@babel/plugin-transform-modules-systemjs](https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-modules-systemjs) | `7.12.1` | `7.29.8` | | [ajv](https://github.com/ajv-validator/ajv) | `6.12.6` | `6.15.0` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.11` | `1.1.18` | | [cipher-base](https://github.com/crypto-browserify/cipher-base) | `1.0.4` | `1.0.7` | | [flatted](https://github.com/WebReflection/flatted) | `3.1.0` | `3.4.4` | | [follow-redirects](https://github.com/follow-redirects/follow-redirects) | `1.15.6` | `1.16.0` | | [form-data](https://github.com/form-data/form-data) | `3.0.1` | `3.0.5` | | [js-yaml](https://github.com/nodeca/js-yaml) | `3.14.1` | `3.15.1` | | [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.18.1` | | [pbkdf2](https://github.com/browserify/pbkdf2) | `3.1.1` | `3.1.6` | | [picomatch](https://github.com/micromatch/picomatch) | `2.2.2` | `2.3.2` | | [sha.js](https://github.com/crypto-browserify/sha.js) | `2.4.11` | `2.4.12` | | [yaml](https://github.com/eemeli/yaml) | `1.10.0` | `1.10.3` | Updates `vite` from 5.4.21 to 8.2.2 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.2.2/packages/vite) Updates `express` from 4.19.2 to 4.22.2 - [Release notes](https://github.com/expressjs/express/releases) - [Changelog](https://github.com/expressjs/express/blob/v4.22.2/History.md) - [Commits](expressjs/express@4.19.2...v4.22.2) Updates `http-proxy-middleware` from 1.0.6 to 2.0.10 - [Release notes](https://github.com/chimurai/http-proxy-middleware/releases) - [Changelog](https://github.com/chimurai/http-proxy-middleware/blob/v2.0.10/CHANGELOG.md) - [Commits](chimurai/http-proxy-middleware@v1.0.6...v2.0.10) Updates `@babel/plugin-transform-modules-systemjs` from 7.12.1 to 7.29.8 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.8/packages/babel-plugin-transform-modules-systemjs) Updates `ajv` from 6.12.6 to 6.15.0 - [Release notes](https://github.com/ajv-validator/ajv/releases) - [Commits](ajv-validator/ajv@v6.12.6...v6.15.0) Updates `body-parser` from 1.20.2 to 1.20.6 - [Release notes](https://github.com/expressjs/body-parser/releases) - [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md) - [Commits](expressjs/body-parser@1.20.2...1.20.6) Updates `brace-expansion` from 1.1.11 to 1.1.18 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@1.1.11...v1.1.18) Updates `cipher-base` from 1.0.4 to 1.0.7 - [Changelog](https://github.com/browserify/cipher-base/blob/master/CHANGELOG.md) - [Commits](browserify/cipher-base@v1.0.4...v1.0.7) Updates `express` from 4.19.2 to 4.22.2 - [Release notes](https://github.com/expressjs/express/releases) - [Changelog](https://github.com/expressjs/express/blob/v4.22.2/History.md) - [Commits](expressjs/express@4.19.2...v4.22.2) Updates `flatted` from 3.1.0 to 3.4.4 - [Commits](WebReflection/flatted@v3.1.0...v3.4.4) Updates `follow-redirects` from 1.15.6 to 1.16.0 - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.15.6...v1.16.0) Updates `form-data` from 3.0.1 to 3.0.5 - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v3.0.1...v3.0.5) Updates `js-yaml` from 3.14.1 to 3.15.1 - [Changelog](https://github.com/nodeca/js-yaml/blob/3.15.1/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.14.1...3.15.1) Updates `lodash` from 4.17.21 to 4.18.1 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.18.1) Updates `path-to-regexp` from 0.1.7 to 0.1.13 - [Release notes](https://github.com/pillarjs/path-to-regexp/releases) - [Changelog](https://github.com/pillarjs/path-to-regexp/blob/v.0.1.13/History.md) - [Commits](pillarjs/path-to-regexp@v0.1.7...v.0.1.13) Updates `pbkdf2` from 3.1.1 to 3.1.6 - [Changelog](https://github.com/browserify/pbkdf2/blob/master/CHANGELOG.md) - [Commits](browserify/pbkdf2@v3.1.1...v3.1.6) Updates `picomatch` from 2.2.2 to 2.3.2 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@2.2.2...2.3.2) Updates `qs` from 6.11.0 to 6.15.3 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.11.0...v6.15.3) Updates `sha.js` from 2.4.11 to 2.4.12 - [Changelog](https://github.com/browserify/sha.js/blob/master/CHANGELOG.md) - [Commits](browserify/sha.js@v2.4.11...v2.4.12) Updates `yaml` from 1.10.0 to 1.10.3 - [Release notes](https://github.com/eemeli/yaml/releases) - [Commits](eemeli/yaml@v1.10.0...v1.10.3) --- updated-dependencies: - dependency-name: "@babel/plugin-transform-modules-systemjs" dependency-version: 7.29.8 dependency-type: indirect - dependency-name: ajv dependency-version: 6.15.0 dependency-type: indirect - dependency-name: body-parser dependency-version: 1.20.6 dependency-type: indirect - dependency-name: brace-expansion dependency-version: 1.1.18 dependency-type: indirect - dependency-name: cipher-base dependency-version: 1.0.7 dependency-type: indirect - dependency-name: express dependency-version: 4.22.2 dependency-type: indirect - dependency-name: express dependency-version: 4.22.2 dependency-type: indirect - dependency-name: flatted dependency-version: 3.4.4 dependency-type: indirect - dependency-name: follow-redirects dependency-version: 1.16.0 dependency-type: indirect - dependency-name: form-data dependency-version: 3.0.5 dependency-type: indirect - dependency-name: http-proxy-middleware dependency-version: 2.0.10 dependency-type: direct:development - dependency-name: js-yaml dependency-version: 3.15.1 dependency-type: indirect - dependency-name: lodash dependency-version: 4.18.1 dependency-type: indirect - dependency-name: path-to-regexp dependency-version: 0.1.13 dependency-type: indirect - dependency-name: pbkdf2 dependency-version: 3.1.6 dependency-type: indirect - dependency-name: picomatch dependency-version: 2.3.2 dependency-type: indirect - dependency-name: qs dependency-version: 6.15.3 dependency-type: indirect - dependency-name: sha.js dependency-version: 2.4.12 dependency-type: indirect - dependency-name: vite dependency-version: 8.2.1 dependency-type: direct:development - dependency-name: yaml dependency-version: 1.10.3 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/controller/node-js/server/npm_and_yarn-e7387b5db9
branch
from
August 22, 2026 20:04
24165e5 to
d7cb767
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the npm_and_yarn group with 1 update in the /controller/web-server directory: vite.
Bumps the npm_and_yarn group with 15 updates in the /policy/frontend directory:
4.19.24.22.21.0.62.0.107.12.17.29.86.12.66.15.01.1.111.1.181.0.41.0.73.1.03.4.41.15.61.16.03.0.13.0.53.14.13.15.14.17.214.18.13.1.13.1.62.2.22.3.22.4.112.4.121.10.01.10.3Updates
vitefrom 5.4.21 to 8.2.2Release notes
Sourced from vite's releases.
... (truncated)
Changelog
Sourced from vite's changelog.
... (truncated)
Commits
de1111arelease: v8.2.2cb77e2atest(ssr): add destructing assignment case for moduleRunnerTransform (#23308)9db0b61fix(ssr): rewrite computed key of destructing parameter (#23307)8413052fix: respectresolve.preserveSymlinkswhen resolving root (fix #23197) (#23...05a003efix(config): resolve sourcemap paths against sourcemap location (#23239)495d9fffeat(deps): widen@vitejs/devtoolspeer range to v0.5.0 (#23302)1d9fa39refactor: use JSON import attributes instead of readFileSync in constants (#2...2804636fix(css): don't pass empty targets to lightningcss (#23295)599b44btest(module-runner): simplify server-hmr tests (#23300)4a261f2test(module-runner): add TLA circular import case (#23299)Updates
expressfrom 4.19.2 to 4.22.2Release notes
Sourced from express's releases.
... (truncated)
Changelog
Sourced from express's changelog.
... (truncated)
Commits
df0abc94.22.2836d3664.xupdate qs to 6.15.1, body-parser 1.20.5 (#7224)8d09bfefix: restore array parsing for req.query repeated keys (#7181)d39e8addeps: body-parser@~1.20.4 (#7021)efe85d9deps: qs@^6.14.1 (#6972)f62378e📝 add note to history12fae144.22.15ddf311Revert "sec: security patch for CVE-2024-51999"49744ab4.22.0 (#6921)6e97452sec: security patch for CVE-2024-51999Maintainer changes
This version was pushed to npm by jonchurch, a new releaser for express since your current version.
Updates
http-proxy-middlewarefrom 1.0.6 to 2.0.10Release notes
Sourced from http-proxy-middleware's releases.
... (truncated)
Changelog
Sourced from http-proxy-middleware's changelog.
... (truncated)
Commits
f0be839chore(package.json): v2.0.10 (#1271)19c860dci(github-actions): update publish.yml (#1270)d0f7d63fix: harden proxy-table matching to prevent routing bypass (#1268)617a7c9chore(package): v2.0.9 (#1099)d22d587fix(fixRequestBody): check readableLength (#1097)d03d51bchore(package): v2.0.8 (#1094)c50dd06fix(fixRequestBody): handle invalid request (#1091)76a9d8dfix(fixRequestBody): prevent multiple .write() calls (#1090)1e92339ci(github-actions): fix npm tag90afb7cchore(package): v2.0.7Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for http-proxy-middleware since your current version.
Install script changes
This version modifies
preparescript that runs during installation. Review the package contents before updating.Updates
@babel/plugin-transform-modules-systemjsfrom 7.12.1 to 7.29.8Release notes
Sourced from @babel/plugin-transform-modules-systemjs's releases.
... (truncated)
Commits
5de11cav7.29.8f08d434fix(systemjs): support proto as an export name (#18044)4fba754v7.29.7a458f66v7.29.432ebd5a[7.x backport]fix(systemjs): improve module string name support (#17974)aa8394ev7.29.00053db6Update polyfill packages (#17727)61647aev7.28.5a177d55[Babel 8] Uset.traverseFastto replace somepath.traverse(#17518)eebd3a0v7.27.1Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for
@babel/plugin-transform-modules-systemjssince your current version.Updates
ajvfrom 6.12.6 to 6.15.0Commits
184bc326.15.0fea46aftest/fix prototype pollution via $data ref with format keyword (#2606)e3af0a76.14.0b552ed6add regExp option to address $data exploit via a regular expression (CVE-2025...72f2286docs: update v7 info231e52bMerge pull request #1320 from philsturgeon/patch-1d3475fcAdd spectral, an AJV util from a sponsor413afe0docs: v7.0.0-beta.311e997bupdate readme for v7Updates
body-parserfrom 1.20.2 to 1.20.6Release notes
Sourced from body-parser's releases.
... (truncated)
Changelog
Sourced from body-parser's changelog.
Commits
5cc4fb81.20.6 (#746)3492672fix: improve limit option validation (#741)0defdberelease(patch): 1.20.5cd0e7a0deps(qs): bump qs to 6.15.16f24d7efix: correct off-by-one error in parameterCount (#716)b849bd5deps: qs@~6.14.1 (#690)2c55e2frefactor(json): simplify strict mode error string construction (#692)7db202c1.20.4 (#672)d8f8adbci: add CodeQL (SAST) (#670)6d133c1chore: remove SECURITY.md (#669)Maintainer changes
This version was pushed to npm by ulisesgascon, a new releaser for body-parser since your current version.
Updates
brace-expansionfrom 1.1.11 to 1.1.18Release notes
Sourced from brace-expansion's releases.
Commits
758fcd61.1.1827fbeedMerge commit from fork5c57cc21.1.17d757f1dnpm ignore.claudecb4b9e4fix: backport GHSA-mh99-v99m-4gvg (#129)447763a1.1.16d74e630fix: v1 backport for CVE-2026-13149 (#122)2203f4f1.1.150b09384Backport v5.0.6 change to v1 (#111)10c05fc1.1.14Updates
cipher-basefrom 1.0.4 to 1.0.7Changelog
Sourced from cipher-base's changelog.
Commits
0056718v1.0.7fd1e5ee[Refactor] useto-buffer08ba803[Dev Deps] update@ljharb/eslint-configf5249f9v1.0.6b7ddd2a[Fix] io.js 3.0 - Node.js 5.3 typed array supportf03cebfv1.0.588dc806[meta] addauto-changelog7a137d7[meta] addnpmignoreandsafe-publish-latest5c02918[meta] fix package.json indentation8fd1364[Fix] return valid values on multi-byte-wide TypedArray inputMaintainer changes
This version was pushed to npm by ljharb, a new releaser for cipher-base since your current version.
Install script changes
This version adds
prepublishscript that runs during installation. Review the package contents before updating.Updates
expressfrom 4.19.2 to 4.22.2Release notes
Sourced from express's releases.