Data

Tools

Indexes

Applications

Experiments

Dependabot

An open index of dependabot pull requests across open source projects.

Bump the npm_and_yarn group across 1 directory with 23 updates

Open
Number: #9
Type: Pull Request
State: Open
Author: dependabot[bot] dependabot[bot]
Association: Unknown
Comments: 1
Created: October 30, 2026 at 12:18 AM UTC
(about 5 hours ago)
Updated: October 30, 2026 at 12:18 AM UTC
(about 5 hours ago)
Labels:
dependencies
Description:

Bumps the npm_and_yarn group with 23 updates in the /react-spa directory:

Package From To
@babel/core 7.25.2 7.29.7
@babel/plugin-transform-modules-systemjs 7.25.0 7.29.8
js-yaml 3.14.1 3.15.2
brace-expansion 1.1.11 1.1.21
brace-expansion 2.0.1 2.1.7
browserslist 4.23.3 4.29.5
compression 1.7.4 1.8.2
fast-uri 3.0.1 3.1.9
flatted 3.3.1 3.4.4
follow-redirects 1.15.6 1.16.2
form-data 3.0.1 3.0.5
http-proxy-middleware 2.0.6 2.0.11
launch-editor 2.8.1 2.14.2
lodash 4.17.21 4.18.1
nanoid 3.3.7 3.3.20
node-forge 1.3.1 1.4.2
picomatch 2.3.1 2.3.2
postcss-selector-parser 6.1.1 6.1.5
proxy-addr 2.0.7 2.0.8
qs 6.11.0 6.16.2
shell-quote 1.8.1 1.12.0
source-map-js 1.2.0 1.2.2
ws 8.18.0 8.22.0
ws 7.5.10 7.5.13
websocket-driver 0.7.4 0.7.5

Updates @babel/core from 7.25.2 to 7.29.7

Release notes

Sourced from @​babel/core's releases.

v7.29.7 (2026-05-25)

Re-release all packages with npm provenance attestations

v7.29.6 (2026-05-25)

:bug: Bug Fix

Committers: 3

v7.29.5 (2026-05-05)

:house: Internal

  • babel-preset-env
    • Update @babel/* dependencies

v7.29.4 (2026-05-05)

:bug: Bug Fix

  • babel-plugin-transform-modules-systemjs
    • #17974 [7.x backport]fix(systemjs): improve module string name support (@​JLHwung)

Committers: 1

v7.29.3 (2026-04-30)

:eyeglasses: Spec Compliance

:bug: Bug Fix

  • babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators
    • #17931 fix(decorators): replace super within all removed static elements (@​JLHwung)
  • babel-register
  • babel-compat-data, babel-plugin-bugfix-safari-rest-destructuring-rhs-array, babel-preset-env

:nail_care: Polish

  • babel-parser

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​babel/core since your current version.


Updates @babel/plugin-transform-modules-systemjs from 7.25.0 to 7.29.8

Release notes

Sourced from @​babel/plugin-transform-modules-systemjs's releases.

v7.29.8 (2026-07-31)

:eyeglasses: Spec Compliance

  • babel-generator, babel-parser, babel-plugin-transform-spread, babel-traverse, babel-types

:bug: Bug Fix

  • babel-generator
  • babel-node, babel-plugin-transform-modules-systemjs

Committers: 2

v7.29.7 (2026-05-25)

Re-release all packages with npm provenance attestations

v7.29.6 (2026-05-25)

:bug: Bug Fix

Committers: 3

v7.29.5 (2026-05-05)

:house: Internal

  • babel-preset-env
    • Update @babel/* dependencies

v7.29.4 (2026-05-05)

:bug: Bug Fix

  • babel-plugin-transform-modules-systemjs
    • #17974 [7.x backport]fix(systemjs): improve module string name support (@​JLHwung)

Committers: 1

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​babel/plugin-transform-modules-systemjs since your current version.


Updates js-yaml from 3.14.1 to 3.15.2

Changelog

Sourced from js-yaml's changelog.

3.15.2 - 2026-08-26

Changed

  • [backport] Hard-limit merge sequence size to 100.

Security

  • [backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

3.15.1 - 2026-07-31

Security

  • [backport] Remove quadratic complexity from !!omap duplicate key detection.

3.15.0 - 2026-06-27

Added

  • Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one safeLoad() / safeLoadAll() call.

[3.14.2] - 2025-11-15

Security

  • Fix prototype pollution in merge (<<).
Commits

Updates brace-expansion from 1.1.11 to 1.1.21

Release notes

Sourced from brace-expansion's releases.

v1.1.15

  • Backport v5.0.6 change to v1 (#111) 0b09384

https://github.com/juliangruber/brace-expansion/compare/v1.1.14...v1.1.15

v1.1.12

  • pkg: publish on tag 1.x c460dbd
  • fmt ccb8ac6
  • Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) c3c73c8

https://github.com/juliangruber/brace-expansion/compare/v1.1.11...v1.1.12

Commits

Updates brace-expansion from 2.0.1 to 2.1.7

Release notes

Sourced from brace-expansion's releases.

v1.1.15

  • Backport v5.0.6 change to v1 (#111) 0b09384

https://github.com/juliangruber/brace-expansion/compare/v1.1.14...v1.1.15

v1.1.12

  • pkg: publish on tag 1.x c460dbd
  • fmt ccb8ac6
  • Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) c3c73c8

https://github.com/juliangruber/brace-expansion/compare/v1.1.11...v1.1.12

Commits

Updates browserslist from 4.23.3 to 4.29.5

Release notes

Sourced from browserslist's releases.

4.29.5

4.29.4

  • Fixed joined version bounds in version ray and range queries (by @​ybai08).
  • Fixed whitespaces processing (by @​abhu85).

4.29.3

  • Updated Firefox ESR.

4.29.2

  • Fixed ignoring null usage in cover X in Y query (by @​wahidrizka).

4.29.1

4.29.0

  • Added query continuations across lines and array entries (by @​fzlzjerry).

4.28.9

4.28.8

  • Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

4.28.6

4.28.5

4.28.4

  • Fixed SyntaxError regression of 4.28.3.

4.28.3

  • Fixed baseline query case-insensitivity (by @​swwind).

4.28.2

4.28.1

... (truncated)

Changelog

Sourced from browserslist's changelog.

4.29.5

4.29.4

  • Fixed joined version bounds in version ray and range queries (by @​ybai08).
  • Fixed whitespaces processing (by @​abhu85).

4.29.3

  • Updated Firefox ESR.

4.29.2

  • Fixed ignoring null usage in cover X in Y query (by @​wahidrizka).

4.29.1

4.29.0

  • Added query continuations across lines and array entries (by @​fzlzjerry).

4.28.9

4.28.8

  • Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

4.28.6

4.28.5

... (truncated)

Commits
  • 2e4b904 Release 4.29.5 version
  • 11a13ec Update dependencies
  • e80fabc Merge pull request #957 from nk-batman21/fix-coverage-custom-stats-versions
  • cac8029 Normalize custom statistics versions in coverage
  • f7a99b9 Release 4.29.4 version
  • 03fc702 Update dependencies
  • efe07e1 Merge pull request #956 from ybai08/fix-joined-range-bounds
  • ef50f5b Fix joined version bounds in version ray and range queries
  • 8219dd7 Merge pull request #954 from abhu85/fix-since-extends-whitespace
  • 893120b Allow arbitrary whitespaces in since, extends, config and not queries
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for browserslist since your current version.


Updates compression from 1.7.4 to 1.8.2

Release notes

Sourced from compression's releases.

v1.8.2

Important

What's Changed

New Contributors

Full Changelog: https://github.com/expressjs/compression/compare/v1.8.1...v1.8.2

v1.8.1

What's Changed

... (truncated)

Changelog

Sourced from compression's changelog.

1.8.2

1.8.1

1.8.0

  • Use res.headersSent when available
  • Replace _implicitHeader with writeHead property
  • add brotli support for versions of node that support it
  • Add the enforceEncoding option for requests without Accept-Encoding header

1.7.5

  • deps: Replace accepts with negotiator@~0.6.4
    • Add preference option
  • deps: bytes@3.1.2
    • Add petabyte (pb) support
    • Fix "thousandsSeparator" incorrecting formatting fractional part
    • Fix return value for un-parsable strings
  • deps: compressible@~2.0.18
    • Mark font/ttf as compressible
    • Remove compressible from multipart/mixed
    • deps: mime-db@'>= 1.43.0 < 2'
  • deps: safe-buffer@5.2.1
Commits
  • 0f97074 1.8.2 (#287)
  • 151f63e fix: destroy compression stream on response close
  • 0a76495 fix: match Cache-Control no-transform directive case-insensitively (#286)
  • c17b6e5 docs: update outdated Brotli note and fix npm install docs URL (#276)
  • 112911a chore(ci): npm-publish via reusable workflows (#269)
  • 1bf5eb0 build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 (#267)
  • d8fe64d build(deps): bump actions/setup-node from 6.0.0 to 6.1.0 (#266)
  • b218ff5 build(deps): bump github/codeql-action from 4.31.5 to 4.31.9 (#265)
  • 8a1cf8e build(deps): bump actions/download-artifact from 6.0.0 to 7.0.0 (#268)
  • 4a19855 build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 (#257)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for compression since your current version.


Updates fast-uri from 3.0.1 to 3.1.9

Release notes

Sourced from fast-uri's releases.

v3.1.9

Security

This security release fixes four URI parsing and normalization vulnerabilities in fast-uri 3.x. Applications that process untrusted URI input should upgrade to v3.1.9.

  • Medium — URI scheme spoofing through percent-encoded schemes (GHSA-w74x-v6f9-j3xg, CVE-2026-110306): percent-encoded scheme input is now rejected instead of being decoded into a live scheme.
  • Medium — Host confusion during domain-host canonicalization (GHSA-wjr9-j795-jxcr, CVE-2026-110180): malformed domain hosts containing ambiguous delimiters or stripped control characters are now rejected instead of being silently rewritten.
  • Low — Incorrect relative-reference normalization (GHSA-xhq7-xmqj-769h, CVE-2026-110095): dot-segment removal now preserves the resolution semantics of relative references.
  • Low — Scheme injection in suffix references (GHSA-333x-w4r6-6crp, CVE-2026-110725): first-segment colons in path-only suffix references are now escaped so the output is not reparsed as a scheme.

Upgrade with:

npm install fast-uri@3.1.9

Thanks to @​zekth for reporting the scheme, host, and relative-reference issues, and to @​UlisesGascon for finding the suffix-reference issue and reviewing the remediations.

What's Changed

Full Changelog: https://github.com/fastify/fast-uri/compare/v3.1.8...v3.1.9

v3.1.8

⚠️ Security Warning

This security release fixes the following medium-severity security advisory:

Users of the v3.x release line should upgrade to v3.1.8.

Full Changelog: https://github.com/fastify/fast-uri/compare/v3.1.7...v3.1.8

v3.1.7

⚠️ Security Warning

This is a security release that fixes the following high-severity security advisories:

Users of the v3.x release line should upgrade to v3.1.7.

Full Changelog: https://github.com/fastify/fast-uri/compare/v3.1.6...v3.1.7

v3.1.6

⚠️ Security Warning

... (truncated)

Commits
  • 0def703 Bumped v3.1.9
  • a1d0da2 test: generate only relative path references
  • 9eb8759 fix: preserve relative paths in suffix and relative resolution
  • 54c30f7 docs: note suffix-reference authority ambiguity
  • 39e6493 fix: escape a first-segment colon in suffix references
  • 745183c test: cover first-segment colon in suffix references
  • ddfc6a5 fix(SEC-03): reject non reg-name characters in domain hosts
  • d86a8d2 fix: keep a colon-first segment behind "./" in relative normalization
  • eb483b5 test: cover colon-first relative references in normalization
  • b110a35 fix(SEC-02): preserve meaning of relative references during normalization
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for fast-uri since your current version.


Updates flatted from 3.3.1 to 3.4.4

Commits

Updates follow-redirects from 1.15.6 to 1.16.2

Commits
  • e3b45a7 Release version 1.16.2 of the npm package.
  • b0a7751 Use Array.isArray.
  • d96d1fe Add funding emergency notice.
  • 4630125 Release version 1.16.1 of the npm package.
  • 9865ca4 Support key/value header arrays.
  • 080a76d Escape all RegExp modifiers.
  • 0c23a22 Release version 1.16.0 of the npm package.
  • 844c4d3 Add sensitiveHeaders option.
  • 5e8b8d0 ci: add Node.js 24.x to the CI matrix
  • 7953e22 ci: upgrade GitHub Actions to use setup-node@v6 and checkout@v6
  • Additional commits viewable in compare view

Updates form-data from 3.0.1 to 3.0.5

Changelog

Sourced from form-data's changelog.

v3.0.5 - 2026-06-12

Commits

  • [Fix] escape CR, LF, and " in field names and filenames 8777e67
  • [Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint, tape 27c61a5
  • [Deps] update hasown 6a8a1c6

v3.0.4 - 2025-07-16

Fixed

Commits

  • [eslint] update linting config f5e7eb0
  • [meta] add auto-changelog d2eb290
  • [Tests] handle predict-v8-randomness failures in node < 17 and node > 23 e8c574c
  • [Fix] Switch to using crypto random for boundary values c6ced61
  • [Refactor] use hasown 1a78b5d
  • [Fix] validate boundary type in setBoundary() method 70bbaa0
  • [Tests] add tests to check the behavior of getBoundary with non-strings b22a64e
  • [meta] actually ensure the readme backup isn’t published 0150851
  • [meta] remove local commit hooks fc42bb9
  • [Dev Deps] remove unused deps a14d09e
  • [meta] fix scripts to use prepublishOnly 11d9f73
  • [meta] fix readme capitalization fc38b48

v3.0.3 - 2025-02-14

Merged

Fixed

Commits

  • [Refactor] use Object.prototype.hasOwnProperty.call 7fecefe
  • [Dev Deps] update @types/node, browserify, coveralls, cross-spawn, eslint, formidable, in-publish, pkgfiles, pre-commit, puppeteer, request, tape, typescript 8261fcb
  • Only apps should have lockfiles b82f590
  • [Dev Deps] pin request which via tough-cookie ^2.4 depends on psl e5df7f2
  • [Deps] update mime-types 5a5bafe

v3.0.2 - 2024-10-10

Merged

... (truncated)

Commits
  • be3f3cf v3.0.5
  • 6a8a1c6 [Deps] update hasown
  • 27c61a5 [Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint, tape
  • 8777e67 [Fix] escape CR, LF, and " in field names and filenames
  • 9c82fcd v3.0.4
  • e8c574c [Tests] handle predict-v8-randomness failures in node < 17 and node > 23
  • c6ced61 [Fix] Switch to using crypto random for boundary values
  • 0150851 [meta] actually ensure the readme backup isn’t published
  • fc38b48 [meta] fix readme capitalization
  • d2eb290 [meta] add auto-changelog
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by ljharb, a new releaser for form-data since your current version.

Install script changes

This version modifies prepublish script that runs during installation. Review the package contents before updating.


Updates http-proxy-middleware from 2.0.6 to 2.0.11

Release notes

Sourced from http-proxy-middleware's releases.

v2.0.11

What's Changed

Full Changelog: https://github.com/chimurai/http-proxy-middleware/compare/v2.0.10...v2.0.11

v2.0.10

What's Changed

  • fix: harden proxy-table matching to prevent routing bypass by @​G-Rath in
    Package Dependencies
    Package:
     http-proxy-middleware
    Ecosystem:
    npm
    Version Change:
    2.0.6 → 2.0.11
    Update Type:
    Patch
    Package:
    ws
    Ecosystem:
    npm
    Version Change:
    8.18.0 → 8.22.0
    Update Type:
    Minor
    Package:
    nanoid
    Ecosystem:
    npm
    Version Change:
    3.3.7 → 3.3.20
    Update Type:
    Patch
    Package:
    @babel/core
    Ecosystem:
    npm
    Version Change:
    7.25.2 → 7.29.7
    Update Type:
    Minor
    Package:
    form-data
    Ecosystem:
    npm
    Version Change:
    3.0.1 → 3.0.5
    Update Type:
    Patch
    Package:
    follow-redirects
    Ecosystem:
    npm
    Version Change:
    1.15.6 → 1.16.2
    Update Type:
    Minor
    Package:
    lodash
    Ecosystem:
    npm
    Version Change:
    4.17.21 → 4.18.1
    Update Type:
    Minor
    Package:
    qs
    Ecosystem:
    npm
    Version Change:
    6.11.0 → 6.16.2
    Update Type:
    Minor
    Package:
    browserslist
    Ecosystem:
    npm
    Version Change:
    4.23.3 → 4.29.5
    Update Type:
    Minor
    Package:
    shell-quote
    Ecosystem:
    npm
    Version Change:
    1.8.1 → 1.12.0
    Update Type:
    Minor
    Package:
    node-forge
    Ecosystem:
    npm
    Version Change:
    1.3.1 → 1.4.2
    Update Type:
    Minor
    Package:
    compression
    Ecosystem:
    npm
    Version Change:
    1.7.4 → 1.8.2
    Update Type:
    Minor
    Package:
    js-yaml
    Ecosystem:
    npm
    Version Change:
    3.14.1 → 3.15.2
    Update Type:
    Minor
    Package:
    @babel/plugin-transform-modules-systemjs
    Ecosystem:
    npm
    Version Change:
    7.25.0 → 7.29.8
    Update Type:
    Minor
    Package:
    fast-uri
    Ecosystem:
    npm
    Version Change:
    3.0.1 → 3.1.9
    Update Type:
    Minor
    Package:
    flatted
    Ecosystem:
    npm
    Version Change:
    3.3.1 → 3.4.4
    Update Type:
    Minor
    Package:
    picomatch
    Ecosystem:
    npm
    Version Change:
    2.3.1 → 2.3.2
    Update Type:
    Patch
    Package:
    postcss-selector-parser
    Ecosystem:
    npm
    Version Change:
    6.1.1 → 6.1.5
    Update Type:
    Patch
    Package:
    launch-editor
    Ecosystem:
    npm
    Version Change:
    2.8.1 → 2.14.2
    Update Type:
    Minor
    Package:
    source-map-js
    Ecosystem:
    npm
    Version Change:
    1.2.0 → 1.2.2
    Update Type:
    Patch
    Package:
    brace-expansion
    Ecosystem:
    npm
    Version Change:
    1.1.11 → 1.1.21
    Update Type:
    Patch
    Package:
    proxy-addr
    Ecosystem:
    npm
    Version Change:
    2.0.7 → 2.0.8
    Update Type:
    Patch
    Package:
    websocket-driver
    Ecosystem:
    npm
    Version Change:
    0.7.4 → 0.7.5
    Update Type:
    Patch
Security Advisories
on-headers is vulnerable to http response header manipulation
GHSA-76c9-3jph-rj3q CVE-2025-7339 LOW
### Impact A bug in on-headers versions `< 1.1.0` may result in response headers being inadvertently modified when an array is passed to `response.writeHead()` ### Patches Users should upgrade t...
fast-uri vulnerable to authority injection via an unvalidated port in serialize
GHSA-qw65-cvwx-89v3 CVE-2026-84292 HIGH
### Impact `fast-uri` serializes the `port` component of a URI without validating it. When recomposing the authority, `fast-uri` escapes the userinfo and host components but concatenates the port ...
fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority
GHSA-58mr-gqgx-xq4g CVE-2026-84394 HIGH
### Impact `fast-uri` accepts a host that contains an unbalanced or misplaced authority bracket (`[` or `]`) without reporting an error. A host that starts with `[` but does not end with `]`, such...
fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets
GHSA-hrr3-gc8f-f4qj CVE-2026-86472 MODERATE
### Impact `fast-uri` folds the host to lowercase before it percent-decodes the host, so a percent-encoded uppercase unreserved octet such as `%41` decodes to a literal `A` that is never folded. F...
compression vulnerable to Denial of Service via memory leak on premature response close
GHSA-vc2v-76pw-4v95 CVE-2026-87776 HIGH
### Impact A vulnerability in compression `< 1.8.2` allows an attacker to trigger a Denial of Service (DoS) by disconnecting while a compressed response is being sent. When the client aborts the c...
fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding
GHSA-w74x-v6f9-j3xg CVE-2026-110306 MODERATE
### Impact `fast-uri` percent-decodes the scheme component with the legacy global `unescape()` before validating it, so an input whose decoded scheme is a valid but dangerous token is emitted as a...
fast-uri vulnerable to improper path equivalence in relative reference normalization
GHSA-xhq7-xmqj-769h CVE-2026-110095 LOW
### Impact `fast-uri`'s `normalize()` and `serialize()` apply RFC 3986 dot-segment removal (`remove_dot_segments`) to the path of a relative-path reference. RFC 3986 section 5.2.4 defines that alg...
fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization
GHSA-wjr9-j795-jxcr CVE-2026-110180 MODERATE
### Impact `fast-uri` versions `>= 2.4.2, <= 2.4.7`, `>= 3.1.3, <= 3.1.8`, and `>= 4.0.1, <= 4.2.2` can silently rewrite the host of an HTTP-family URL (`http`, `https`, `ws`, `wss`, or any scheme...
fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references
GHSA-333x-w4r6-6crp CVE-2026-110725 LOW
### Impact `fast-uri`'s `serialize()`, `normalize()`, and `resolve()`, when called with the non-default option `reference: 'suffix'` on a reference that has no authority, emit a relative reference...
Actions
View on GitHub View Repository All Dependabot PRs
Technical Details
ID: 16764377
UUID: 6110801461
Node ID: PR_kwDOUJekpM8AAAABLqQVag
Host: GitHub
Repository: Isuruvh/ms-identity-docs-code-javascript