Bump the npm_and_yarn group across 2 directories with 12 updates#1216
Bump the npm_and_yarn group across 2 directories with 12 updates#1216dependabot[bot] wants to merge 1 commit intomasterfrom
Conversation
Bumps the npm_and_yarn group with 11 updates in the / directory: | Package | From | To | | --- | --- | --- | | [minimatch](https://github.com/isaacs/minimatch) | `9.0.5` | `10.2.1` | | [undici](https://github.com/nodejs/undici) | `6.21.2` | `6.23.0` | | [@smithy/config-resolver](https://github.com/smithy-lang/smithy-typescript/tree/HEAD/packages/config-resolver) | `4.0.1` | `4.4.7` | | [ajv](https://github.com/ajv-validator/ajv) | `6.12.6` | `6.14.0` | | [axios](https://github.com/axios/axios) | `1.8.4` | `1.13.5` | | [bn.js](https://github.com/indutny/bn.js) | `4.12.0` | `4.12.3` | | [cipher-base](https://github.com/crypto-browserify/cipher-base) | `1.0.4` | `1.0.7` | | [diff](https://github.com/kpdecker/jsdiff) | `5.2.0` | `5.2.2` | | [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.17.23` | | [pbkdf2](https://github.com/browserify/pbkdf2) | `3.1.2` | `3.1.5` | | [sha.js](https://github.com/crypto-browserify/sha.js) | `2.4.11` | `2.4.12` | Bumps the npm_and_yarn group with 1 update in the /packages/core directory: [minimatch](https://github.com/isaacs/minimatch). Updates `minimatch` from 9.0.5 to 10.2.1 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v9.0.5...v10.2.1) Updates `undici` from 6.21.2 to 6.23.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v6.21.2...v6.23.0) Updates `@smithy/config-resolver` from 4.0.1 to 4.4.7 - [Release notes](https://github.com/smithy-lang/smithy-typescript/releases) - [Changelog](https://github.com/smithy-lang/smithy-typescript/blob/main/packages/config-resolver/CHANGELOG.md) - [Commits](https://github.com/smithy-lang/smithy-typescript/commits/@smithy/config-resolver@4.4.7/packages/config-resolver) Updates `ajv` from 6.12.6 to 6.14.0 - [Release notes](https://github.com/ajv-validator/ajv/releases) - [Commits](ajv-validator/ajv@v6.12.6...v6.14.0) Updates `axios` from 1.8.4 to 1.13.5 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.8.4...v1.13.5) Updates `bn.js` from 4.12.0 to 4.12.3 - [Release notes](https://github.com/indutny/bn.js/releases) - [Changelog](https://github.com/indutny/bn.js/blob/master/CHANGELOG.md) - [Commits](indutny/bn.js@v4.12.0...v4.12.3) Updates `cipher-base` from 1.0.4 to 1.0.7 - [Changelog](https://github.com/browserify/cipher-base/blob/master/CHANGELOG.md) - [Commits](browserify/cipher-base@v1.0.4...v1.0.7) Updates `diff` from 5.2.0 to 5.2.2 - [Changelog](https://github.com/kpdecker/jsdiff/blob/master/release-notes.md) - [Commits](kpdecker/jsdiff@v5.2.0...v5.2.2) Updates `form-data` from 4.0.0 to 4.0.5 - [Release notes](https://github.com/form-data/form-data/releases) - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v4.0.0...v4.0.5) Updates `lodash` from 4.17.21 to 4.17.23 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.17.23) Updates `pbkdf2` from 3.1.2 to 3.1.5 - [Changelog](https://github.com/browserify/pbkdf2/blob/master/CHANGELOG.md) - [Commits](browserify/pbkdf2@v3.1.2...v3.1.5) Updates `sha.js` from 2.4.11 to 2.4.12 - [Changelog](https://github.com/browserify/sha.js/blob/master/CHANGELOG.md) - [Commits](browserify/sha.js@v2.4.11...v2.4.12) Updates `minimatch` from 9.0.6 to 10.2.2 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v9.0.5...v10.2.1) --- updated-dependencies: - dependency-name: minimatch dependency-version: 10.2.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 6.23.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@smithy/config-resolver" dependency-version: 4.4.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ajv dependency-version: 6.14.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: axios dependency-version: 1.13.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: bn.js dependency-version: 4.12.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: cipher-base dependency-version: 1.0.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: diff dependency-version: 5.2.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: form-data dependency-version: 4.0.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.17.23 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: pbkdf2 dependency-version: 3.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: sha.js dependency-version: 2.4.12 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: minimatch dependency-version: 10.2.2 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
added
dependencies
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
Caution Review the following alerts detected in dependencies. According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.
|
Bumps the npm_and_yarn group with 11 updates in the / directory:
9.0.510.2.16.21.26.23.04.0.14.4.76.12.66.14.01.8.41.13.54.12.04.12.31.0.41.0.75.2.05.2.24.17.214.17.233.1.23.1.52.4.112.4.12Bumps the npm_and_yarn group with 1 update in the /packages/core directory: minimatch.
Updates
minimatchfrom 9.0.5 to 10.2.1Changelog
Sourced from minimatch's changelog.
... (truncated)
Commits
6d7ac3410.2.12e111f3coalesce consecutive non-globstar * characters1a62a2a10.2.0758b5a3changelog 10.2903e50badd braceExpandMax option, formata50a11010.1.3a08c046move back to og brace-expansionfde70d110.1.205210d8update depsba4093cupdate workflows and package stuffUpdates
undicifrom 6.21.2 to 6.23.0Release notes
Sourced from undici's releases.
Commits
fbc31e2Bumped v6.23.03477c94chore: release flow using provenanced3aafeafix: limit Content-Encoding chain to 5 to prevent resource exhaustionf9c9185Bumped v6.22.0f670f2afeat: make UndiciErrors reliable to instanceof (#4472) (#4480)422e397feat(ProxyAgent) improve Curl-y behavior in HTTP->HTTP Proxy connections (#41...4a06ffefeat(ProxyAgent): match Curl behavior in HTTP->HTTP Proxy connections (#4180)...4cb3974fix: fix EnvHttpProxyAgent for the Node.js bundle (#4064) (#4432)44c23e5fix: fix wrong stream canceled up after cloning (v6) (#4414)da0e823Bumped v6.21.4Maintainer changes
This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for undici since your current version.
Updates
@smithy/config-resolverfrom 4.0.1 to 4.4.7Release notes
Sourced from
@smithy/config-resolver's releases.Changelog
Sourced from
@smithy/config-resolver's changelog.... (truncated)
Commits
1f51a0cVersion NPM packagesa028fc5chore: replace rimraf with premove (#1834)0e8cc49Version NPM packages7e4bbf6chore: upgrade rimraf to v5.0.10 (#1829)521d67cVersion NPM packages8b90f36Version NPM packagescc0124eVersion NPM packages07f95d9Version NPM packages372b46ffix(config-resolver): allow asterisk region with warning (#1760)472a5eaVersion NPM packagesUpdates
ajvfrom 6.12.6 to 6.14.0Commits
e3af0a76.14.0b552ed6add regExp option to address $data exploit via a regular expression (CVE-2025...72f2286docs: update v7 info231e52bMerge pull request #1320 from philsturgeon/patch-1d3475fcAdd spectral, an AJV util from a sponsor413afe0docs: v7.0.0-beta.311e997bupdate readme for v7Updates
axiosfrom 1.8.4 to 1.13.5Release notes
Sourced from axios's releases.
... (truncated)
Changelog
Sourced from axios's changelog.
... (truncated)
Commits
29f7542chore(release): prepare release 1.13.5 (#7379)431c3a3ci: fix run condition (#7373)9ff3a78ci: update ymls (#7372)265b712docs: fix deprecated Buffer constructor and formatting issues in README (#7371)475e75afeat: add input validation to isAbsoluteURL (#7326)28c7215fix: Denial of Service via proto Key in mergeConfig (#7369)04cf019docs: clarify object check comment (#7323)696fa75fix: status is missing in AxiosError on and after v1.13.3 (#7368)569f028fix: added a option to choose between legacy and the new request/response int...44b7c9fchore(deps-dev): bump karma-sourcemap-loader (#7360)Maintainer changes
This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for axios since your current version.
Updates
bn.jsfrom 4.12.0 to 4.12.3Commits
39fe4384.12.367ecb35backport(4.x): fix imaskn state (#317)c4098ba4.12.26277fd7backport(4.x): Fix imuln/muln with zero (backport of #313) (#314)ac0d4af4.12.1a5f14b4Fix serious issue in.toString(16)(#309)0cd2661Remove package-lock.json added by npmUpdates
cipher-basefrom 1.0.4 to 1.0.7Changelog
Sourced from cipher-base's changelog.
Commits
0056718v1.0.7fd1e5ee[Refactor] useto-buffer08ba803[Dev Deps] update@ljharb/eslint-configf5249f9v1.0.6b7ddd2a[Fix] io.js 3.0 - Node.js 5.3 typed array supportf03cebfv1.0.588dc806[meta] addauto-changelog7a137d7[meta] addnpmignoreandsafe-publish-latest5c02918[meta] fix package.json indentation8fd1364[Fix] return valid values on multi-byte-wide TypedArray inputMaintainer changes
This version was pushed to npm by ljharb, a new releaser for cipher-base since your current version.
Install script changes
This version adds
prepublishscript that runs during installation. Review the package contents before updating.Updates
difffrom 5.2.0 to 5.2.2Changelog
Sourced from diff's changelog.
Commits
b7b6339v5.2.2b5377abUpdate package version to 5.2.17801789Backport kpdecker/jsdiff#649042a837Backport kpdecker/jsdiff#647Updates
form-datafrom 4.0.0 to 4.0.5Release notes
Sourced from form-data's releases.
... (truncated)
Changelog
Sourced from form-data's changelog.
... (truncated)
Commits
68ff7ddv4.0.55822467[Dev Deps] update@ljharb/eslint-config,eslint76d0dee[Fix] set Symbol.toStringTag in the proper place16e0076[Tests] Switch to newer v8 prediction library; enable node 24 testing41996f5v4.0.4316c82b[meta] actually ensure the readme backup isn’t published2300ca1[meta] fix readme capitalization811f682[meta] addauto-changelog5e34080[Tests] fix linting errors1d11a76[Tests] handle predict-v8-randomness failures in node < 17 and node > 23Maintainer changes
This version was pushed to npm by ljharb, a new releaser for form-data since your current version.
Install script changes
This version modifies
prepublishscript that runs during installation. Review the package contents before updating.Updates
lodashfrom 4.17.21 to 4.17.23Commits
dec55b7Bump main to v4.17.23 (#6088)19c9251fix: setCacheHas JSDoc return type should be boolean (#6071)b5e6729jsdoc: Add -0 and BigInt zeros to _.compact falsey values list (#6062)edadd45Prevent prototype pollution on baseUnset function4879a7adoc: fix autoLink function, conversion of source links (#6056)9648f69chore: removeyarn.lockfile (#6053)dfa407dci: remove legacy configuration files (#6052)156e196feat: add renovate setup (#6039)933e106ci: add pipeline for Bun (#6023)072a807docs: update links related to Open JS Foundation (#5968)Updates
pbkdf2from 3.1.2 to 3.1.5Changelog
Sourced from pbkdf2's changelog.
Commits
3687905v3.1.567bd94d[Fix] only allow finite iterations8f59d96[Fix] restore node 0.10 supportd2dc5f0[Fix] check parameters before the "no Promise" bailoutb2ad615v3.1.48dbf49b[Deps] updatecreate-hash,ripemd160,sha.js,to-bufferaaf870b[Dev Deps] update@ljharb/eslint-configd15bc35[meta] update repo URLs3e40827v3.1.3e3102a8[Refactor] useto-bufferMaintainer changes
This version was pushed to npm by ljharb, a new releaser for pbkdf2 since your current version.
Updates
sha.jsfrom 2.4.11 to 2.4.12Changelog
Sourced from sha.js's changelog.