Skip to content

Bump the npm_and_yarn group across 1 directory with 8 updates - #137

Open
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/npm_and_yarn-79db0ba89a
Open

Bump the npm_and_yarn group across 1 directory with 8 updates#137
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/npm_and_yarn-79db0ba89a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 13, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 8 updates in the / directory:

Package From To
brace-expansion 1.1.14 1.1.22
svgo 3.3.3 3.3.5
esbuild 0.28.0 0.28.2
fast-uri 3.1.2 3.1.9
immutable 5.1.5 5.2.1
qs 6.14.2 6.16.2
ws 8.20.0 8.23.0
ws 7.5.10 7.5.14
websocket-driver 0.7.4 0.7.5

Updates brace-expansion from 1.1.14 to 1.1.22

Release notes

Sourced from brace-expansion's releases.

v1.1.15

  • Backport v5.0.6 change to v1 (#111) 0b09384

juliangruber/brace-expansion@v1.1.14...v1.1.15

Commits

Updates svgo from 3.3.3 to 3.3.5

Release notes

Sourced from svgo's releases.

v3.3.5

What's Changed

Security

  • Backport the removeScriptElement hardening from SVGO v4 in #2269:
    • reject executable data: URLs and legacy vbscript: URLs
    • sanitize executable HTML inside <foreignObject> elements
    • handle namespace-prefixed SVG anchors and URL schemes containing ASCII tabs or newlines

This addresses GHSA-4vpr-x523-8j87 and GHSA-w27v-7q3p-w38r for the v3 release line.

Support

SVGO v3 is not officially supported; please consider upgrading to SVGO v4. This security fix has been backported, but there is no commitment to backport more complex changes in the future.

See the migration guide from v3 to v4.

v3.3.4

What's Changed

Security

Support

SVGO v3 is not officially supported, please consider upgrading to SVGO v4 instead. We've backported this fix as there are security implications, but there is no commitment to do this for more complex changes in future.

Consider reading our Migration Guide from v3 to v4 which should ease the process.

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for svgo since your current version.


Updates esbuild from 0.28.0 to 0.28.2

Release notes

Sourced from esbuild's releases.

v0.28.2

  • Fix tree shaking bug due to TypeScript import alias (#4507)

    This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

    import Base from './dep.js';
import Alias = Base.SomeType;

  • Fix CSS minification bug involving & (#4497)

    This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

    /* Original code */
.a .b {
  & .b:not(& .c) {
    color: red;
  }
}
/* Old output (with --minify) */
.a .b{.b:not(& .c){color:red}}
/* New output (with --minify) */
.a .b{& .b:not(& .c){color:red}}

    This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

  • Avoid overwriting input files without --allow-overwrite (#4484)

    For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

    This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

  • Fix incorrect code generated when using top-level await (#4498)

    Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

  • Fix a minification bug with lowered logical assignment operators (#4508)

    This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

    // Original code
function foo() {
  let x
  bar(x ||= {})

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.2

  • Fix tree shaking bug due to TypeScript import alias (#4507)

    This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

    import Base from './dep.js';
import Alias = Base.SomeType;

  • Fix CSS minification bug involving & (#4497)

    This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

    /* Original code */
.a .b {
  & .b:not(& .c) {
    color: red;
  }
}
/* Old output (with --minify) */
.a .b{.b:not(& .c){color:red}}
/* New output (with --minify) */
.a .b{& .b:not(& .c){color:red}}

    This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

  • Avoid overwriting input files without --allow-overwrite (#4484)

    For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

    This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

  • Fix incorrect code generated when using top-level await (#4498)

    Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

  • Fix a minification bug with lowered logical assignment operators (#4508)

    This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

    // Original code
function foo() {
  let x

... (truncated)

Commits
  • 609683d publish 0.28.2 to npm
  • 11b1fe4 add to release notes
  • ab50d91 css: fix green/blue channel swap in oklch gamut mapping (#4488)
  • 04627b6 fix #4498: async TLA checks need a worklist
  • 5c15177 disable gopls in the go folder
  • fc2ee9b css: adjust parser to allow --foo: {...}
  • 209db54 release notes for css nesting bugfix
  • c625d31 fix #4497: preserve nested ampersands during minification (#4500)
  • 34474e2 better isolation of current part in js parser
  • 07f6e8c fix #4507: import assignment tree-shaking bug
  • Additional commits viewable in compare view

Updates fast-uri from 3.1.2 to 3.1.9

Release notes

Sourced from fast-uri's releases.

v3.1.9

Security

This security release fixes four URI parsing and normalization vulnerabilities in fast-uri 3.x. Applications that process untrusted URI input should upgrade to v3.1.9.

  • Medium — URI scheme spoofing through percent-encoded schemes (GHSA-w74x-v6f9-j3xg, CVE-2026-110306): percent-encoded scheme input is now rejected instead of being decoded into a live scheme.
  • Medium — Host confusion during domain-host canonicalization (GHSA-wjr9-j795-jxcr, CVE-2026-110180): malformed domain hosts containing ambiguous delimiters or stripped control characters are now rejected instead of being silently rewritten.
  • Low — Incorrect relative-reference normalization (GHSA-xhq7-xmqj-769h, CVE-2026-110095): dot-segment removal now preserves the resolution semantics of relative references.
  • Low — Scheme injection in suffix references (GHSA-333x-w4r6-6crp, CVE-2026-110725): first-segment colons in path-only suffix references are now escaped so the output is not reparsed as a scheme.

Upgrade with:

npm install fast-uri@3.1.9

Thanks to @​zekth for reporting the scheme, host, and relative-reference issues, and to @​UlisesGascon for finding the suffix-reference issue and reviewing the remediations.

What's Changed

Full Changelog: fastify/fast-uri@v3.1.8...v3.1.9

v3.1.8

⚠️ Security Warning

This security release fixes the following medium-severity security advisory:

Users of the v3.x release line should upgrade to v3.1.8.

Full Changelog: fastify/fast-uri@v3.1.7...v3.1.8

v3.1.7

⚠️ Security Warning

This is a security release that fixes the following high-severity security advisories:

Users of the v3.x release line should upgrade to v3.1.7.

Full Changelog: fastify/fast-uri@v3.1.6...v3.1.7

v3.1.6

⚠️ Security Warning

... (truncated)

Commits
  • 0def703 Bumped v3.1.9
  • a1d0da2 test: generate only relative path references
  • 9eb8759 fix: preserve relative paths in suffix and relative resolution
  • 54c30f7 docs: note suffix-reference authority ambiguity
  • 39e6493 fix: escape a first-segment colon in suffix references
  • 745183c test: cover first-segment colon in suffix references
  • ddfc6a5 fix(SEC-03): reject non reg-name characters in domain hosts
  • d86a8d2 fix: keep a colon-first segment behind "./" in relative normalization
  • eb483b5 test: cover colon-first relative references in normalization
  • b110a35 fix(SEC-02): preserve meaning of relative references during normalization
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for fast-uri since your current version.


Updates immutable from 5.1.5 to 5.2.1

Release notes

Sourced from immutable's releases.

v5.2.1

What's Changed

Full Changelog: immutable-js/immutable-js@v5.2.0...v5.2.1

v5.2.0

What's Changed

New Contributors

Full Changelog: immutable-js/immutable-js@v5.1.10...v5.2.0

v5.1.10

  • fix(Seq): Incorrect (NaN) keys when iterating in reverse an indexed lazy Sequence of unknown size #2268
  • fix(Seq): Stack overflow when slicing a zipped Sequence of unknown size from the end - by @​b84330808 in immutable-js/immutable-js#2311
  • fix(Seq): Incorrect keys of an interposed Sequence when iterated in reverse - by @​b84330808 in immutable-js/immutable-js#2310
  • fix(Seq): Incorrect keys of a filtered indexed Seq when iterated in reverse - by @​b84330808 in immutable-js/immutable-js#2309
  • fix(Seq): Fix takeLast(0) on a Sequence of unknown size - by @​b84330808 in immutable-js/immutable-js#2313
  • fix(Seq): skipWhile and skipUntil on an indexed Seq now renumber iterator keys from 0, consistently with toArray and entrySeq, and entries() no longer throws once exhausted. This also fixes iterating a chained map/filter and equals on such sequences - by @​wozhenbang2004 in immutable-js/immutable-js#2319
  • [TypeScript]: on a MapOf (a Map built from an object), delete and remove of a required key now give a MapOf without that key (Map({ a: 1, b: 'b' }).delete('b') is a MapOf<{ a: number }>) instead of never. Deleting an optional key still keeps the type. #2312

Doc

  • [TypeScript]: on a MapOf (a Map built from an object), delete and remove of a required key now give a MapOf without that key (Map({ a: 1, b: 'b' }).delete('b') is a MapOf<{ a: number }>) instead of never. Deleting an optional key still keeps the type. #2312

New Contributors

Full Changelog: immutable-js/immutable-js@v5.1.9...v5.1.10

v5.1.9

What's Changed

Full Changelog: immutable-js/immutable-js@v5.1.8...v5.1.9

v5.1.8

What's Changed

... (truncated)

Changelog

Sourced from immutable's changelog.

5.2.1

  • [TypeScript] The functional getIn accepts a key path typed KeyPath again, like the one a wrapper function receives and forwards. It was a type error since 5.2.0; the result is unknown, as in 5.1. #2328 by @​jdeniau
  • [TypeScript] The methods setIn, updateIn, mergeIn, mergeDeepIn, deleteIn, removeIn, the untyped getIn and hasIn, and the functions setIn and removeIn type their key path as KeyPath, which the functions hasIn and updateIn already used: an array-like or an ordered Immutable collection, as the runtime accepts. A path typed KeyPath is now accepted everywhere. A path typed Iterable<…> is now a type error, like an ES6 Set or a generator, which throw Invalid keyPath at runtime: type it KeyPath<…> instead, exported since 5.1.0. #2328 by @​jdeniau

5.2.0

  • Fix keySeq() on a lazy indexed Seq of unknown size in #2325 by kevin9327

[TypeScript] Record#getIn is typed from the Record's properties, like MapOf#getIn

No runtime change. Record#getIn also accepts a notSetValue, as the runtime always did.

const Address = Record({ city: '', zip: 0 });
const Person = Record({ name: '', address: Address() });
const person = Person();
person.getIn(['address', 'city']); // was unknown, now string
person.getIn(['address', 'street']); // was unknown, now a type error: expected one of "city" | "zip"
person.getIn(['address', 'street'], 'nsv'); // was a type error (one argument expected), now 'nsv'

[TypeScript] Record#update(updater) is properly typed

const point = Record({ x: 0, y: 0 })();
point.update((p) => p.x + p.y); // was a type error (two arguments expected), now number

[TypeScript Break] A key path the types can not follow is a type error

For MapOf#getIn, Record#getIn and the functional getIn. Such a path previously gave never, which TypeScript accepted silently, and a valid path needed as const to give its type.

const map = Map({ a: { b: 1 } });
map.getIn(['a', 'b']); // was never (number with ['a', 'b'] as const), now number without as const
map.getIn(['z']); // was never, now a type error: expected one of "a"
map.getIn(['a', 'b', 'c']); // was never, now a type error: no key can be read from number
map.getIn(['z'], 'nsv'); // was never, now 'nsv': with a notSetValue, a key the types do not know is accepted

A path only known at runtime is typed as such, and the result is unknown:

const path: Array<string> = ['a', 'b'];
map.getIn(path); // was never, now unknown
</tr></table>

... (truncated)

Commits
  • 4c18997 5.2.1
  • 1449984 Merge pull request #2328 from jdeniau/getin-forwarded-keypath
  • dc12267 [TypeScript] Type every key path parameter as KeyPath
  • 4844b96 [TypeScript] getIn: accept a key path typed KeyPath
  • 7146ae1 Merge pull request #2326 from immutable-js/release-5.2.0
  • 3e7070b Add changelog for 5.2.0
  • 92e6eaa 5.2.0
  • b39d130 Merge pull request #2324 from jdeniau/typed-record-getin
  • 2de4534 [TypeScript] getIn: follow a nested Record, accept an object key of a Map
  • 4ac12cc [TypeScript] getIn: a key that may be missing and generic collections
  • Additional commits viewable in compare view

Updates qs from 6.14.2 to 6.16.2

Changelog

Sourced from qs's changelog.

6.16.2

  • [Fix] stringify: encode keys when allowEmptyArrays is set (#561)
  • [meta] use double quotes for better OS support
  • [Dev Deps] update evalmd, npmignore
  • [Tests] stringify: pin allowEmptyArrays output for keys that need no encoding

6.16.1

  • [Fix] parse: do not mutate an object input
  • [Fix] stringify: stop re-encoding structural separator dots when encodeDotInKeys is set (#564)
  • [Fix] stringify: arrayFormat: 'comma': pass the full encoder arguments with encodeValuesOnly
  • [Fix] utils: encode + as %2B in iso-8859-1 mode so values round-trip (#565)
  • [Fix] parse: only convert top-level dots to brackets when allowDots is on (#621)
  • [Fix] stringify: ignore inherited array format names (#622)
  • [Fix] stringify: arrayFormat: 'comma': do not throw on elements with no callable toString
  • [Fix] utils: merge: seed an overflow container's index from its own keys, not just the source
  • [Fix] utils: merge: keep a strictMerge conflict container's index and arrayLimit correct
  • [Fix] parse: only treat [] as array syntax when it ends the key
  • [Perf] decode: skip decoders when there is no percent sign (#583)
  • [Robustness] utils: merge: apply arrayLimit to the two-element array built for colliding values
  • [Robustness] parse: bound the nesting added by repeated strictMerge conflicts (credit @​Yeaseen)
  • [Docs] document that qs and flat parsers disagree about parameter names
  • [Docs] clarify that throwOnLimitExceeded limits each array, not the total number of values
  • [Docs] clarify 6.14.1/6.15.2 parse bracket behavior change (#567, #568)
  • [meta] fix changelog indents
  • [actions] set least-privilege cache-mode
  • [Tests] utils: decode: add missing cases
  • [Tests] parse: characterize the ]= split when an = precedes any bracket group (#620)
  • [Tests] parse: allowDots: cover stray close brackets before a dot
  • [Dev Deps] update @ljharb/eslint-config, eslint, tape

6.16.0

  • [New] stringify: add a depth option to bound recursion depth (default Infinity)
  • [Fix] stringify: serialize Date values when a filter is provided
  • [Fix] parse: enforce arrayLimit on comma groups under []= when throwOnLimitExceeded is set
  • [Fix] parse: flatten a collection appended to an overflowed array (#571)
  • [Fix] utils: isBuffer: do not invoke a non-callable constructor.isBuffer
  • [Fix] stringify: do not let allowEmptyArrays skip cycle detection (or drop own keys) on an empty array with own properties
  • [Fix] stringify: encode dots in a top-level key with a primitive value when encodeDotInKeys is set (#562)
  • [Docs] threat model: clarify stringify deep-nesting DoS is caller-bounded
  • [Docs] clarify arrayLimit is a representation threshold, not an element-count cap
  • [Tests] parse: remove a test that pinned []= comma groups escaping arrayLimit
  • [Tests] stringify: pin current encodeDotInKeys separator-dot behavior
  • [Dev Deps] update @ljharb/eslint-config, eslint
  • [Dev Deps] update eslint, evalmd

6.15.4

  • [Fix] stringify: encode keys when allowEmptyArrays is set (#561)
  • [meta] use double quotes for better OS support
  • [Dev Deps] update @ljharb/eslint-config, evalmd, npmignore, tape
  • [Tests] stringify: pin allowEmptyArrays output for keys that need no encoding

... (truncated)

Commits
  • 136912a v6.16.2
  • 6ed1c73 [Dev Deps] update evalmd, npmignore
  • a09bc29 [meta] use double quotes for better OS support
  • 5d3b1b9 [Fix] stringify: encode keys when allowEmptyArrays is set
  • f13ec6c [Tests] stringify: pin allowEmptyArrays output for keys that need no enco...
  • 2471b66 v6.16.1
  • 51f736e [Docs] document that qs and flat parsers disagree about parameter names
  • 40239f7 [Dev Deps] update tape
  • d219359 [Fix] parse: do not mutate an object input
  • 98157dc [Fix] stringify: stop re-encoding structural separator dots when `encodeDot...
  • Additional commits viewable in compare view

Updates ws from 8.20.0 to 8.23.0

Release notes

Sourced from ws's releases.

8.23.0

Features

  • Introduced the maxPendingAutoPongs option (ace7248f).

Bug fixes

  • Fixed a remote memory exhaustion DoS vulnerability (ace7248f).

A malicious peer can flood the other peer with Ping frames while stopping reads, forcing it to buffer Pong frames that are automatically sent in response until memory is exhausted, leading to process termination due to OOM.

import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(125);
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
ws.pause();
(function ping() {
  ws.ping(data, function (err) {
    if (err) return;
    ping();
  });
})();

});
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(client close - code: ${code} reason: ${reason.toString()});
});
});
wss.on('connection', function (ws) {
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(server close - code: ${code} reason: ${reason.toString()});
});
});

The vulnerability was responsibly disclosed by multiple reporters:

... (truncated)

Commits
  • d387219 [dist] 8.23.0
  • ace7248 [security] Limit automatically sent pending pongs
  • 73d283c [test] Ensure DuplexSockets automatically emit the 'close' event
  • 2582a67 [dist] 8.22.2
  • 3eec252 [perf] Do not retain the read buffer via the close reason (#2354)
  • 9757c69 [fix] Do not modify the url.URL object (#2353)
  • e23d55e [fix] Percent-decode the userinfo of the URL (#2352)
  • 335a610 [perf] Do not retain the read buffer via the frame mask (#2350)
  • f40ccff [doc] Adjust Node.js version requirement in README (#2348)
  • c18a80a [dist] 8.22.1
  • Additional commits viewable in compare view

Updates ws from 7.5.10 to 7.5.14

Release notes

Sourced from ws's releases.

8.23.0

Features

  • Introduced the maxPendingAutoPongs option (ace7248f).

Bug fixes

  • Fixed a remote memory exhaustion DoS vulnerability (ace7248f).

A malicious peer can flood the other peer with Ping frames while stopping reads, forcing it to buffer Pong frames that are automatically sent in response until memory is exhausted, leading to process termination due to OOM.

import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(125);
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
ws.pause();
(function ping() {
  ws.ping(data, function (err) {
    if (err) return;
    ping();
  });
})();

});
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(client close - code: ${code} reason: ${reason.toString()});
});
});
wss.on('connection', function (ws) {
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(server close - code: ${code} reason: ${reason.toString()});
});
});

The vulnerability was responsibly disclosed by multiple reporters:

... (truncated)

Commits
  • d387219 [dist] 8.23.0
  • ace7248 [security] Limit automatically sent pending pongs
  • 73d283c [test] Ensure DuplexSockets automatically emit the 'close' event
  • 2582a67 [dist] 8.22.2
  • 3eec252 [perf] Do not retain the read buffer via the close reason (#2354)
  • 9757c69 [fix] Do not modify the url.URL object (#2353)
  • e23d55e [fix] Percent-decode the userinfo of the URL (#2352)
  • 335a610 [perf] Do not retain the read buffer via the frame mask (#2350)
  • f40ccff [doc] Adjust Node.js version requirement in README (#2348)
  • c18a80a [dist] 8.22.1
  • Additional commits viewable in compare view

Updates websocket-driver from 0.7.4 to 0.7.5

Changelog

Sourced from websocket-driver's changelog.

0.7.5 / 2026-06-04

  • Close a draft-75/76 connection if a length header grows to exceed the configured max length
  • Fail the connection if a message is larger than the configured max length after extension processing
Commits
  • 5d6a9aa Bump version to 0.7.5
  • c55679a Fail the connection if a message is larger than the configured max length aft...
  • 5b197ca Close a draft-75/76 connection if a length header grows to exceed the configu...
  • fc93a48 Test on Node v22, v24, and v26
  • 2e82d34 Test on recent versions of Node
  • e4962db Switch from Travis CI to GitHub Actions
  • 3f2f9b7 Travis update: cache npm modules, remove sudo, run on Node 15
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump the npm_and_yarn group across 1 directory with 8 updates
125d577 
Bumps the npm_and_yarn group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.14` | `1.1.22` |
| [svgo](https://github.com/svg/svgo) | `3.3.3` | `3.3.5` |
| [esbuild](https://github.com/evanw/esbuild) | `0.28.0` | `0.28.2` |
| [fast-uri](https://github.com/fastify/fast-uri) | `3.1.2` | `3.1.9` |
| [immutable](https://github.com/immutable-js/immutable-js) | `5.1.5` | `5.2.1` |
| [qs](https://github.com/ljharb/qs) | `6.14.2` | `6.16.2` |
| [ws](https://github.com/websockets/ws) | `8.20.0` | `8.23.0` |
| [ws](https://github.com/websockets/ws) | `7.5.10` | `7.5.14` |
| [websocket-driver](https://github.com/faye/websocket-driver-node) | `0.7.4` | `0.7.5` |



Updates `brace-expansion` from 1.1.14 to 1.1.22
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.14...v1.1.22)

Updates `svgo` from 3.3.3 to 3.3.5
- [Release notes](https://github.com/svg/svgo/releases)
- [Commits](svg/svgo@v3.3.3...v3.3.5)

Updates `esbuild` from 0.28.0 to 0.28.2
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md)
- [Commits](evanw/esbuild@v0.28.0...v0.28.2)

Updates `fast-uri` from 3.1.2 to 3.1.9
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.2...v3.1.9)

Updates `immutable` from 5.1.5 to 5.2.1
- [Release notes](https://github.com/immutable-js/immutable-js/releases)
- [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md)
- [Commits](immutable-js/immutable-js@v5.1.5...v5.2.1)

Updates `qs` from 6.14.2 to 6.16.2
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.14.2...v6.16.2)

Updates `ws` from 8.20.0 to 8.23.0
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.20.0...8.23.0)

Updates `ws` from 7.5.10 to 7.5.14
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.20.0...8.23.0)

Updates `websocket-driver` from 0.7.4 to 0.7.5
- [Changelog](https://github.com/faye/websocket-driver-node/blob/main/CHANGELOG.md)
- [Commits](faye/websocket-driver-node@0.7.4...0.7.5)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 1.1.22
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: svgo
  dependency-version: 3.3.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: esbuild
  dependency-version: 0.28.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fast-uri
  dependency-version: 3.1.9
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: immutable
  dependency-version: 5.2.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.16.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-version: 8.23.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-version: 7.5.14
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: websocket-driver
  dependency-version: 0.7.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants