Skip to content

Bump the npm_and_yarn group across 1 directory with 9 updates - #12

Merged
Omena0 merged 2 commits into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-3f598d2541
Oct 31, 2026
Merged

Bump the npm_and_yarn group across 1 directory with 9 updates#12
Omena0 merged 2 commits into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-3f598d2541

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 20, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 9 updates in the / directory:

Package From To
brace-expansion 1.1.15 1.1.21
form-data 4.0.5 4.0.6
http-cache-semantics 4.2.0 4.3.0
joi 18.2.1 18.3.0
nanoid 3.3.12 3.3.20
postcss 8.5.15 8.5.31
svgo 3.3.3 3.3.5
svgo 4.0.1 4.1.0
source-map-js 1.2.1 1.2.2
undici 7.28.0 7.30.1

Updates brace-expansion from 1.1.15 to 1.1.21

Commits

Updates form-data from 4.0.5 to 4.0.6

Changelog

Sourced from form-data's changelog.

v4.0.6 - 2026-06-12

Commits

  • [Fix] escape CR, LF, and " in field names and filenames 8dff42c
  • [Dev Deps] update @ljharb/eslint-config, auto-changelog, tape f31d21e
  • [Deps] update hasown, mime-types 92ae0eb
  • [Dev Deps] update js-randomness-predictor 67b0f65
Commits
  • 64190db v4.0.6
  • 92ae0eb [Deps] update hasown, mime-types
  • f31d21e [Dev Deps] update @ljharb/eslint-config, auto-changelog, tape
  • 8dff42c [Fix] escape CR, LF, and " in field names and filenames
  • 67b0f65 [Dev Deps] update js-randomness-predictor
  • See full diff in compare view

Updates http-cache-semantics from 4.2.0 to 4.3.0

Commits

Updates joi from 18.2.1 to 18.3.0

Commits
  • b3973e5 18.3.0
  • 1ec93ab Merge pull request #3160 from hapijs/feat/prepare-undefined
  • a08984c feat: accept undefined values in prepare
  • fc3f3bc 18.2.9
  • e7791cb Merge pull request #3152 from hapijs/chore/3151-cleanup
  • 7363128 chore: cleanup for #3151
  • 03a9543 Merge pull request #3151 from carfeii/fix/messages-flat-code-proto-pollution
  • 5b8333c Reject proto as a flat messages() code, closing a sibling of GHSA-gg4h-3h...
  • e30b50e 18.2.8
  • 1c9dede Merge pull request #3149 from hapijs/chore/optimize-schema-creation
  • Additional commits viewable in compare view

Updates nanoid from 3.3.12 to 3.3.20

Release notes

Sourced from nanoid's releases.

3.3.20

3.3.19

  • Fixed killing the app by setting huge user ID.

3.3.18

3.3.17

  • Fixed infinite loop on zero size.

3.3.16

3.3.15

  • Fixed npm provenance error.

3.3.14

  • Fixed random pool corruption on big ID sizes.

3.3.13

  • Reduced npm package size.
Changelog

Sourced from nanoid's changelog.

3.3.20

3.3.19

3.3.18

3.3.17

  • Fixed infinite loop on zero size.

3.3.16

3.3.15

  • Fixed npm provenance error.

3.3.14

  • Fixed random pool corruption on big ID sizes.

3.3.13

  • Reduced npm package size.
Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nanoid since your current version.


Updates postcss from 8.5.15 to 8.5.31

Release notes

Sourced from postcss's releases.

8.5.31

8.5.30

  • Fix broken map on </style> escaping (by @​Rufflet).

8.5.29

8.5.28

  • Fixes types regression.

8.5.27

8.5.26

  • Fixed list.split() regression (by @​lazerg).
  • Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

  • Fixed 8.5.17 visitor regression.
  • Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

  • Preserve the BOM after the processing (by @​hdimer).

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

8.5.19

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.31

8.5.30

  • Fix broken map on </style> escaping (by @​Rufflet).

8.5.29

8.5.28

  • Fixes types regression.

8.5.27

8.5.26

  • Fixed list.split() regression (by @​lazerg).
  • Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

  • Fixed 8.5.17 visitor regression.
  • Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

  • Preserve the BOM after the processing (by @​hdimer).

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.


Updates svgo from 3.3.3 to 3.3.5

Release notes

Sourced from svgo's releases.

v3.3.5

What's Changed

Security

  • Backport the removeScriptElement hardening from SVGO v4 in #2269:
    • reject executable data: URLs and legacy vbscript: URLs
    • sanitize executable HTML inside <foreignObject> elements
    • handle namespace-prefixed SVG anchors and URL schemes containing ASCII tabs or newlines

This addresses GHSA-4vpr-x523-8j87 and GHSA-w27v-7q3p-w38r for the v3 release line.

Support

SVGO v3 is not officially supported; please consider upgrading to SVGO v4. This security fix has been backported, but there is no commitment to backport more complex changes in the future.

See the migration guide from v3 to v4.

v3.3.4

What's Changed

Security

Support

SVGO v3 is not officially supported, please consider upgrading to SVGO v4 instead. We've backported this fix as there are security implications, but there is no commitment to do this for more complex changes in future.

Consider reading our Migration Guide from v3 to v4 which should ease the process.

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for svgo since your current version.


Updates svgo from 4.0.1 to 4.1.0

Release notes

Sourced from svgo's releases.

v3.3.5

What's Changed

Security

  • Backport the removeScriptElement hardening from SVGO v4 in #2269:
    • reject executable data: URLs and legacy vbscript: URLs
    • sanitize executable HTML inside <foreignObject> elements
    • handle namespace-prefixed SVG anchors and URL schemes containing ASCII tabs or newlines

This addresses GHSA-4vpr-x523-8j87 and GHSA-w27v-7q3p-w38r for the v3 release line.

Support

SVGO v3 is not officially supported; please consider upgrading to SVGO v4. This security fix has been backported, but there is no commitment to backport more complex changes in the future.

See the migration guide from v3 to v4.

v3.3.4

What's Changed

Security

Support

SVGO v3 is not officially supported, please consider upgrading to SVGO v4 instead. We've backported this fix as there are security implications, but there is no commitment to do this for more complex changes in future.

Consider reading our Migration Guide from v3 to v4 which should ease the process.

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for svgo since your current version.


Updates source-map-js from 1.2.1 to 1.2.2

Release notes

Sourced from source-map-js's releases.

v1.2.2

Changelog

Sourced from source-map-js's changelog.

1.2.2

Commits

Updates undici from 7.28.0 to 7.30.1

Release notes

Sourced from undici's releases.

v7.30.1

Security fixes

High severity

Denial of service via TLS 1.2 certificate-changing renegotiation

CVE-2026-87018 · GHSA-qrxm-fqhp-jwvm

A malicious or compromised HTTPS server could crash the Node.js process by initiating TLS 1.2 renegotiation and presenting a different, CA-trusted certificate whose hostname did not match the requested host. The resulting socket error reached an assertion in undici's HTTP/1.1 and HTTP/2 connection handling. This release handles post-connect certificate errors without terminating the process.

TLS certificate validation bypass through dropped Agent options

CVE-2026-109383 · GHSA-2m5v-pch6-74hx

Agent used a JSON-based clone for constructor options, which silently removed function-valued TLS options such as checkServerIdentity. Applications relying on custom certificate or public-key verification could therefore accept a certificate that the callback was intended to reject. This release preserves TLS options when creating per-origin dispatchers.

Cache poisoning and cross-user disclosure through cross-origin redirects

CVE-2026-109829 · GHSA-4w7w-5xrc-9h26

When an originless Agent combined redirect and shared-cache interceptors as compose(redirect(), cache()), a response from a cross-origin redirect could be stored under the original URL. This could allow persistent cache poisoning or disclosure of user-specific responses to later callers. This release verifies the response origin before caching and preserves redirect-hop cache-control policy.

Denial of service through excessive Content-Encoding values

CVE-2026-109869 · GHSA-xjj6-f33q-929c

A malicious HTTP server could crash the Node.js process by returning more than five content codings and closing the connection before sending the body. Although fetch() rejected the response, an error from an orphaned internal stream could remain unhandled. This release validates the content-encoding chain before creating the body stream and aborts oversized chains safely.

Medium severity

Denial of service through the decompress interceptor

CVE-2026-87029 · GHSA-55wc-3pg8-jfw6

An exception thrown by a downstream response handler from an asynchronous decompression callback could escape as an uncaught exception. A server could trigger this when decompress was composed with a handler such as dump with a size limit. This release converts downstream handler exceptions into per-request errors.

Subresource Integrity bypass with non-lowercase algorithm tokens

CVE-2026-109841 · GHSA-f72v-6w45-q472

fetch() treated valid mixed-case or uppercase SRI algorithm tokens, such as SHA256, as unknown and could accept a response whose body did not match the configured digest. This release normalizes algorithm tokens before validation and digest selection.

Denial of service through unbounded EventSource parser state

CVE-2026-109924 · GHSA-4qv8-2p9j-2685

A malicious Server-Sent Events endpoint could exhaust process memory by sending many tiny data: fields without completing an event, or by splitting an unfinished line across many chunks. This release bounds retained EventSource parser state, including field counts, buffered chunks, unfinished-line length, and retained field data.

Denial of service through unbounded automatic WebSocket PONG buffering

... (truncated)

Commits
  • 7507102 Bumped v7.30.1 (#6022)
  • 7d60c7b [v7.x] fix(cookies): backport #5663, #5808 and #5832 (#6019)
  • 0227d5d fix: avoid unbounded recursion in Set-Cookie attribute parser (#5757) (#5997)
  • 5394462 fix(websocket): bound automatic PONG writes under backpressure
  • 2991627 fix(eventsource): bound retained SSE parser state
  • 18bc8a1 fix(sri): accept non-lowercase algorithm tokens
  • 63cba77 fix(decompress): converge downstream handler throws to per-request errors
  • 07ded49 fix(fetch): abort excessive content encoding responses
  • b20b82a fix(cache): prevent cross-origin redirect cache confusion
  • 04cb74b fix: preserve Agent connection options
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump the npm_and_yarn group across 1 directory with 9 updates
e4145d4 
Bumps the npm_and_yarn group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.15` | `1.1.21` |
| [form-data](https://github.com/form-data/form-data) | `4.0.5` | `4.0.6` |
| [http-cache-semantics](https://github.com/kornelski/http-cache-semantics) | `4.2.0` | `4.3.0` |
| [joi](https://github.com/hapijs/joi) | `18.2.1` | `18.3.0` |
| [nanoid](https://github.com/ai/nanoid) | `3.3.12` | `3.3.20` |
| [postcss](https://github.com/postcss/postcss) | `8.5.15` | `8.5.31` |
| [svgo](https://github.com/svg/svgo) | `3.3.3` | `3.3.5` |
| [svgo](https://github.com/svg/svgo) | `4.0.1` | `4.1.0` |
| [source-map-js](https://github.com/7rulnik/source-map-js) | `1.2.1` | `1.2.2` |
| [undici](https://github.com/nodejs/undici) | `7.28.0` | `7.30.1` |



Updates `brace-expansion` from 1.1.15 to 1.1.21
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.15...v1.1.21)

Updates `form-data` from 4.0.5 to 4.0.6
- [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md)
- [Commits](form-data/form-data@v4.0.5...v4.0.6)

Updates `http-cache-semantics` from 4.2.0 to 4.3.0
- [Commits](https://github.com/kornelski/http-cache-semantics/commits)

Updates `joi` from 18.2.1 to 18.3.0
- [Commits](hapijs/joi@v18.2.1...v18.3.0)

Updates `nanoid` from 3.3.12 to 3.3.20
- [Release notes](https://github.com/ai/nanoid/releases)
- [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md)
- [Commits](ai/nanoid@3.3.12...3.3.20)

Updates `postcss` from 8.5.15 to 8.5.31
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.15...8.5.31)

Updates `svgo` from 3.3.3 to 3.3.5
- [Release notes](https://github.com/svg/svgo/releases)
- [Commits](svg/svgo@v3.3.3...v3.3.5)

Updates `svgo` from 4.0.1 to 4.1.0
- [Release notes](https://github.com/svg/svgo/releases)
- [Commits](svg/svgo@v3.3.3...v3.3.5)

Updates `source-map-js` from 1.2.1 to 1.2.2
- [Release notes](https://github.com/7rulnik/source-map-js/releases)
- [Changelog](https://github.com/7rulnik/source-map-js/blob/main/CHANGELOG.md)
- [Commits](7rulnik/source-map-js@v1.2.1...v1.2.2)

Updates `undici` from 7.28.0 to 7.30.1
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.28.0...v7.30.1)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 1.1.21
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: form-data
  dependency-version: 4.0.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: http-cache-semantics
  dependency-version: 4.3.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: joi
  dependency-version: 18.3.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: nanoid
  dependency-version: 3.3.20
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: postcss
  dependency-version: 8.5.31
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: svgo
  dependency-version: 3.3.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: svgo
  dependency-version: 4.1.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: source-map-js
  dependency-version: 1.2.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 7.30.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 20, 2026
@Omena0
Omena0 enabled auto-merge October 31, 2026 17:13
@Omena0
Omena0 disabled auto-merge October 31, 2026 17:16
@Omena0
Omena0 merged commit 257d44a into main Oct 31, 2026
7 checks passed
@Omena0
Omena0 deleted the dependabot/npm_and_yarn/npm_and_yarn-3f598d2541 branch October 31, 2026 17:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Omena0 Omena0 Omena0 approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Omena0