Data

Tools

Indexes

Applications

Experiments

Dependabot

An open index of dependabot pull requests across open source projects.

Javascript dependency: Bump the web-javascript-minor-and-patch group across 1 directory with 42 updates

Open
Number: #39
Type: Pull Request
State: Open
Author: dependabot[bot] dependabot[bot]
Association: Unknown
Comments: 1
Created: November 14, 2026 at 02:54 PM UTC
(about 7 hours ago)
Updated: November 14, 2026 at 02:54 PM UTC
(about 7 hours ago)
Description:

Bumps the web-javascript-minor-and-patch group with 42 updates in the /web directory:

Package From To
@tanstack/react-query 5.102.8 5.107.1
@tanstack/react-virtual 3.14.10 3.14.26
anti-trojan-source 1.12.2 1.13.1
axios 1.20.0 1.21.1
chart.js 4.5.1 4.6.1
diff-arrays-of-objects 1.1.11 1.1.12
dompurify 3.4.14 3.4.17
hotkeys-js 4.0.7 4.1.2
ip-address 10.5.0 10.7.6
lossless-json 4.3.1 4.3.3
marked 18.0.11 18.2.0
moment 2.30.1 2.31.0
moment-timezone 0.6.3 0.6.6
postcss 8.5.26 8.5.32
rc-dock 4.0.0-alpha.3 4.1.0
react 19.2.8 19.3.1
@types/react 19.2.18 19.3.0
react-checkbox-tree 2.0.2 2.1.1
react-dom 19.2.8 19.3.1
@types/react-dom 19.2.5 19.3.0
react-draggable 4.7.1 4.7.2
react-frame-component 5.2.7 5.3.2
react-timer-hook 4.0.6 4.0.9
react-virtualized-auto-sizer 2.0.3 2.0.4
socket.io-client 4.8.3 4.8.4
sql-formatter 15.8.2 15.9.0
zustand 5.0.15 5.1.0
@babel/core 7.29.7 7.29.13
@babel/eslint-parser 7.29.7 7.29.13
@testing-library/dom 10.4.1 10.4.2
@testing-library/user-event 14.6.3 14.6.9
autoprefixer 10.5.4 10.6.2
core-js 3.50.0 3.51.0
eslint-plugin-jest 29.16.6 29.17.0
globals 17.12.0 17.14.0
html-react-parser 6.1.7 6.1.9
jest 30.5.1 30.5.2
jest-environment-jsdom 30.5.1 30.5.2
typescript-eslint 8.69.0 8.72.2
webpack 5.108.4 5.112.2
webpack-bundle-analyzer 5.3.2 5.4.2
sharp 0.35.4 0.35.5

Updates @tanstack/react-query from 5.102.8 to 5.107.1

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.107.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-devtools@​5.107.1
    • @​tanstack/react-query@​5.107.1

@​tanstack/react-query-next-experimental@​5.107.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/react-query@​5.107.1

@​tanstack/react-query-persist-client@​5.107.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-persist-client-core@​5.107.1
    • @​tanstack/react-query@​5.107.1

@​tanstack/react-query@​5.107.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.107.1

@​tanstack/react-query-devtools@​5.107.0

Patch Changes

  • Updated dependencies [a4d72f7]:
    • @​tanstack/query-devtools@​5.107.0
    • @​tanstack/react-query@​5.107.0

@​tanstack/react-query-next-experimental@​5.107.0

Patch Changes

  • Updated dependencies []:
    • @​tanstack/react-query@​5.107.0

@​tanstack/react-query-persist-client@​5.107.0

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-persist-client-core@​5.107.0
    • @​tanstack/react-query@​5.107.0

@​tanstack/react-query@​5.107.0

Patch Changes

... (truncated)

Changelog

Sourced from @​tanstack/react-query's changelog.

5.107.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.107.1

5.107.0

Patch Changes

  • Updated dependencies [b6add89]:
    • @​tanstack/query-core@​5.107.0

5.106.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.106.1

5.106.0

Patch Changes

  • Updated dependencies []:
    • @​tanstack/query-core@​5.106.0

5.105.3

Patch Changes

5.105.2

Patch Changes

  • #12230 1e1caa5 - Update the observer options before subscribing so revealing an <Activity> tree whose query key changed while hidden no longer fetches the previous key.

  • #12480 8d0dc27 - Exclude status from the filters accepted by QueryClient.isMutating, useIsMutating, and injectIsMutating. These APIs always count mutations with status: 'pending'.

  • Updated dependencies [2ee2fd9, 8d0dc27, e69cac6, f2215d2, 86e7957, b6576b3, af0e0ef, 05d9b6a]:

    • @​tanstack/query-core@​5.105.2

5.105.1

Patch Changes

  • #11373 7ccba6e - fix({react,preact,angular,solid,vue}-query/infiniteQueryOptions): correct the overload selected for a possibly-undefined 'initialData'

... (truncated)

Commits

Updates @tanstack/react-virtual from 3.14.10 to 3.14.26

Release notes

Sourced from @​tanstack/react-virtual's releases.

@​tanstack/react-virtual@​3.14.26

Patch Changes

@​tanstack/react-virtual@​3.14.25

Patch Changes

  • Updated dependencies [9d7ff67]:
    • @​tanstack/virtual-core@​3.19.10

@​tanstack/react-virtual@​3.14.24

Patch Changes

@​tanstack/react-virtual@​3.14.23

Patch Changes

  • Updated dependencies [2343004]:
    • @​tanstack/virtual-core@​3.19.8

@​tanstack/react-virtual@​3.14.22

Patch Changes

@​tanstack/react-virtual@​3.14.21

Patch Changes

  • Updated dependencies [05bb4d3]:
    • @​tanstack/virtual-core@​3.19.6

@​tanstack/react-virtual@​3.14.20

Patch Changes

@​tanstack/react-virtual@​3.14.19

Patch Changes

  • Updated dependencies [269e8ed]:
    • @​tanstack/virtual-core@​3.19.4

@​tanstack/react-virtual@​3.14.18

Patch Changes

... (truncated)

Changelog

Sourced from @​tanstack/react-virtual's changelog.

3.14.26

Patch Changes

3.14.25

Patch Changes

  • Updated dependencies [9d7ff67]:
    • @​tanstack/virtual-core@​3.19.10

3.14.24

Patch Changes

3.14.23

Patch Changes

  • Updated dependencies [2343004]:
    • @​tanstack/virtual-core@​3.19.8

3.14.22

Patch Changes

3.14.21

Patch Changes

  • Updated dependencies [05bb4d3]:
    • @​tanstack/virtual-core@​3.19.6

3.14.20

Patch Changes

3.14.19

... (truncated)

Commits

Updates anti-trojan-source from 1.12.2 to 1.13.1

Release notes

Sourced from anti-trojan-source's releases.

v1.13.1

1.13.1 (2026-11-03)

Bug Fixes

  • ci: pin package-manager toolchains (#38) (6c52e7f)

v1.13.0

1.13.0 (2026-09-08)

Features

  • Update README with video and image examples (5c95bf5)
Commits

Updates axios from 1.20.0 to 1.21.1

Release notes

Sourced from axios's releases.

v1.21.1 — November 9, 2026

This release raises the minimum follow-redirects version to fix a published CVE, fixes a Next.js prerendering failure caused by the response duration timer, corrects the getAdapter typings, and includes documentation corrections, new test coverage, CI runner changes and dependency updates.

🔒 Security Fixes

  • follow-redirects: Raised the follow-redirects range from ^1.16.0 to ^1.16.2 to fix CVE-2026-116689 (GHSA-mrwp-f3q8-3g9p). In the vulnerable versions, sensitiveHeaders arrays from another realm were ignored and custom credentials could follow redirects. Only the Node.js HTTP adapter is affected, and there are no API changes. (#11410)

🐛 Bug Fixes

  • Response Duration: dispatchRequest now measures response.duration with performance.now() and uses Date.now() only when performance.now() isn't available. In v1.21.0, any axios request from a Server Component failed Next.js production builds with Cache Components (cacheComponents: true), because Next.js rejects Date.now() while prerendering. The duration is still a whole number of milliseconds, and system clock changes no longer affect it. (#11411)
  • TypeScript: getAdapter now accepts an optional config?: AxiosRequestConfig in index.d.ts and index.d.cts, matching what it does at runtime. You can now call getAdapter('fetch', { env: { fetch: myFetch } }) without a cast. (#11404)

🔧 Maintenance & Chores

  • Documentation Corrections: Brought the README and docs site in line with how axios actually behaves:

    • transformRequest runs for every method, and transformers receive (data, headers, status).
    • responseType and Content-Type have no default value.
    • AxiosHeaders#get and #normalize are described correctly.
    • Errors should be identified with axios.isAxiosError(), not by name.
    • The error tables now list ECONNREFUSED and ERR_FORM_DATA_DEPTH_EXCEEDED, and note that FormData parsing has a fixed depth limit that maxDepth doesn't change.
    • New notes cover what redact doesn't scan, which adapters enforce maxContentLength / maxBodyLength, and how formToJSON() handles field name collisions.

    (#11374, #11373, #11389, #11419, #11429, #11430)

  • Docs Site: Added a Partners page, a shared card design for sponsors and partners, a Namespace sponsor badge, and a blog whose first post announces HeroDevs Never-Ending Support for Axios v0. Also applied the v1.20.0/v1.21.0 release notes to the docs, and fixed internal links in the es, fr and zh translations so they keep their locale prefix. (#11390, #11399, #11400, #11412, #11401)

  • Test Coverage: Added cancellation tests across the HTTP, fetch and XHR adapters. They cover AbortSignal, CancelToken, cancelling while a request interceptor is pending, and timeout precedence. Also added tests for no_proxy edge cases in shouldBypassProxy, such as internationalized domain names, malformed CIDR and IPv4 entries, and port-qualified entries. Neither changes runtime behavior. (#11376, #11431)

  • CI: GitHub Actions jobs now run on Namespace runners. The npm publish job stays on GitHub-hosted runners, because npm provenance and trusted publishing (OIDC) only work there. (#11396)

  • Dependencies: Updated development and tooling dependencies, including vitest and @vitest/* (to 5.x at the root), typescript (7.x at the root), vite, rollup, eslint, playwright, @commitlint/*, @rollup/plugin-alias, @rollup/plugin-terser, body-parser, multer, serialize-javascript, fast-uri, qs, zizmorcore/zizmor-action, and follow-redirects in /docs. (#11383, #11375, #11372, #11345, #11392, #11387, #11386, #11385, #11391, #11388, #11395, #11421, #11422, #11426)

  • Release: Prepared the 1.21.1 release. (#11435)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

Full Changelog

v1.21.0 — October 21, 2026

This release adds response timing and opt-in UTF-8 Basic authentication, improves request handling across runtimes, and changes how header defaults are recognized.

... (truncated)

Changelog

Sourced from axios's changelog.

Changelog

v1.21.0 — October 21, 2026

This release adds response timing and opt-in UTF-8 Basic authentication, improves request handling across runtimes, and changes how header defaults are recognized.

⚠️ Breaking Changes & Deprecations

  • Header Defaults: Only plain objects, null-prototype maps, and compatible AxiosHeaders instances are treated as common or method-specific defaults; literal headers such as Link are now preserved. Applications using custom class instances as defaults must convert them to plain maps, for example { post: { ...customDefaults } }, or compatible AxiosHeaders. Otherwise, those instances become literal header values, including on requests using other methods. (#11156)

🚀 New Features

  • Response Timing: Added response.duration, in milliseconds, including on error.response when present. Timing measures adapter execution and excludes interceptors and transforms; streamed responses stop timing when the stream becomes available. Axios replaces any existing duration value supplied by a custom adapter. (#11214)
  • UTF-8 Basic Authentication: Added transitional.encodeBasicAuthUsername: true to support Unicode usernames in XHR and Fetch requests. The option defaults to false, preserving existing authentication behavior; applications opting in should supply the original Unicode username and remove manual pre-encoding workarounds. (#11159)

🐛 Bug Fixes

  • Fetch Compatibility: Restored requests in runtimes such as Cloudflare Workers that reject the implicit cache: 'default', while preserving explicit caller settings. Response-size failures now retain their original ERR_BAD_RESPONSE and request context when runtime wrappers replace the underlying stream error. (#11194, #11179)
  • Runtime Consistency: Aligned encoded-byte size accounting, multipart uploads, proxy routing, same-origin resolution, parameter merging, and form serialization across adapters. Circular parameters now reject with ERR_BAD_OPTION_VALUE, and sparse or non-index numeric form fields serialize as keyed objects. With proxy: false, native proxyEnv agents using unsupported pool-management or TLS-session lifecycle overrides now reject with ERR_BAD_OPTION_VALUE; construct those agents without proxyEnv. (#11242)
  • Header Handling: Preserved headers named __proto__ using safe casing without changing the AxiosHeaders instance prototype. Function matchers in has(), delete(), and clear() now receive the headers instance as this, matching their declared contract. (#11134, #11216)
  • URL and Data URL Parsing: Accepted case-insensitive supported URL schemes and Base64 markers, and corrected decoding of percent-encoded Base64 data URLs. Node data URL allocation estimates remain aligned with decoding so configured size limits apply before allocation. (#11138, #11163, #11294)
  • Error Diagnostics: Preserved short reconstructed request stacks and appended wrapped error stacks under Caused by: so tooling that reads only error.stack retains the original failure context. (#11132, #11142)
  • Interceptor Removal: Restored removal through canonical numeric-string interceptor IDs, including after registry compaction. (#11139)
  • Proxy TLS: HTTPS CONNECT tunnels now apply current origin TLS options from an explicit httpsAgent, or from https.globalAgent when no explicit agent is supplied. This preserves process-wide custom CA settings through proxy tunnels. (#11178)
  • XHR Lifecycle: Used asynchronous Cookie Store reads for XSRF tokens where supported, preserving cookie fallback, timeout accounting, and cancellation. Upload and download progress listeners are now removed on completion, failure, timeout, and cancellation. (#11166, #11225)
  • HTTP/2 Sessions: Stopped reusing sessions immediately after GOAWAY and prevented draining sessions from scheduling idle timers that could delay process exit. (#11210)
  • TypeScript Declarations: Exposed the response-default marker as a public type to resolve TS2527 when consumers emit declarations involving unresolved response generics, covering both ESM and CommonJS. (#11125)

🔧 Maintenance & Chores

  • Configuration Performance: Reduced request configuration merge overhead, particularly for requests with many headers, while preserving merge semantics and prototype-pollution guards. (#11208)
  • Same-Origin Checks: Removed obsolete Internet Explorer detection without changing origin decisions in supported environments. (#11174)
  • Dependencies: Updated follow-redirects to 1.16.1 and refreshed development, documentation, test, and GitHub Actions dependencies. Removed unused dayjs from the docs package, root chalk, and chai from CJS module tests. (#11169, #11188, #11189, #11195, #11212, #11213, #11218, #11220, #11221, #11230, #11234, #11244, #11245, #11266, #11267, #11268, #11269, #11270, #11271, #11272, #11298, #11302, #11303, #11304, #11305, #11306, #11313, #11321, #11322, #11323, #11342)
  • Documentation: Fixed interceptor test links, updated README CDN examples to the published 1.20.0 bundle, and corrected guidance on interceptor options and request lifecycle ordering. (#11228, #11149, #11335)
  • Contributor Workflow: Consolidated agent instructions in AGENTS.md, standardized PR labels, required prerelease notes and validation evidence, and clarified that npm test requires installed Playwright browsers. (#11238, #11273, #11223, #11284)
  • Sponsors and Support: Added HeroDevs, Code for Japan, and Sweepico sponsor listings, refreshed sponsor data, and documented extended security support for Axios v0. (#11222, #11249, #11252, #11341)
  • Proxy Regression Coverage: Added a long dotted request-hostname test for NO_PROXY handling, extending coverage of an existing denial-of-service fix. (#11235)
  • Release Preparation: Updated package version metadata for 1.21.0. (#11346)

🌟 New Contributors

Welcome to our 24 new contributors. Thank you for helping improve Axios:

... (truncated)

Commits
  • 335e2f8 chore(release): prepare release 1.21.1 (#11435)
  • c07e981 docs: note that FormData parsing has a fixed depth limit (#11430)
  • f0fcec7 test(helpers): cover IDN, CIDR and port edge cases in shouldBypassProxy (#11431)
  • 4f203a9 docs(i18n): add locale prefix to internal links in es, fr, zh docs (#11401)
  • 98156ee docs: correct request config and AxiosHeaders descriptions (#11389)
  • a81d62a test: cover cancellation lifecycle and timeout precedence (#11376)
  • a42a19a docs: add missing error codes to the error tables (#11429)
  • 1fcaf82 chore(deps-dev): refresh development dependencies (#11426)
  • fb88a1b chore(deps-dev): bump the development_dependencies group with 4 updates (#11422)
  • 31cc02a chore(deps): bump zizmorcore/zizmor-action from 0.7.1 to 0.8.0 in the github-...
  • Additional commits viewable in compare view

Updates chart.js from 4.5.1 to 4.6.1

Release notes

Sourced from chart.js's releases.

v4.6.1

Essential Links

  • #12355 fix: trusted publishing fix + version 4.6.1 bump

Thanks to @​etimberg

v4.6.0

Essential Links

  • #12354 chore: version bump to 4.6.0 to prepare for release
  • #12328 test: stabilize overlapping polar-area label fixture

Enhancements

  • #12238 Corrected spacing in pie/doughnut/polarArea (Fixes #10059)
  • #12130 Enable scale title stroke (12092)

Bugs Fixed

  • #12283 filler plugin fill extends past line when offset: true + index scale min/max
  • #12155 Fix early exit from clearStacks
  • #12142 Use integer canvas dimensions

Types

  • #12321 fix(types): allow scriptable and indexed grid tick widths

Documentation

  • #12258 Add a note that axis labels can span lines
  • #12134 docs: Add note about flexbox/grid layout responsivity issue
  • #12139 Fix amount of category scales count in docs

Development

  • #12306 Bump actions/setup-node from 6 to 7
  • #12303 Bump actions/checkout from 6 to 7

... (truncated)

Commits
  • 76d8cf8 fix: trusted publishing fix + version 4.6.1 bump (#12355)
  • 4e5443d chore: version bump to 4.6.0 to prepare for release (#12354)
  • 7169e65 fix(types): allow scriptable and indexed grid tick widths (#12321)
  • 714b48c test: stabilize overlapping polar-area labels across browsers (#12328)
  • 6a86e23 Bump actions/setup-node from 6 to 7 (#12306)
  • afb3d64 Bump actions/checkout from 6 to 7 (#12303)
  • 0db976c Bump pnpm/action-setup from 4.2.0 to 6.1.0 (#12307)
  • d2ddcf9 Specify build script for compressed size (#12310)
  • b972574 filler plugin fill extends past line when offset: true + index scale min/max ...
  • 0ad783f Use node 24 for CI (#12309)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for chart.js since your current version.


Updates diff-arrays-of-objects from 1.1.11 to 1.1.12

Release notes

Sourced from diff-arrays-of-objects's releases.

v1.11.12

Dependency security patches

Commits

Updates dompurify from 3.4.14 to 3.4.17

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.17

  • Fixed an issue with IN_PLACE, SAFE_FOR_TEMPLATES and shadow roots, thanks @​manus-pi
  • Fixed IN_PLACE handling of nodes that hooks or custom elements tough during sanitization, thanks @​uttej-badwane
  • Fixed the SMIL attributeName guard in XHTML mode, thanks @​Koukyosyumei
  • Hardened several smaller edge cases (namespaces, literal-text elements, isValidAttribute()), thanks @​artiphishell
  • Added a purify-edge test runner as a compatibility check, thanks @​anzal1
  • Clarified the IN_PLACE documentation in the README about possible risks
  • Updated several dependencies

DOMPurify 3.4.16

  • Fixed a problem with IN_PLACE node removal when working with hooks, thanks @​manus-pi
  • Fixed a problem with IN_PLACE sanitization and raw-text roots, thanks @​h-t-m
  • Fixed a problem with ESM default exports landing in CommonJS declarations, thanks @​ssi02014
  • Migrated from rollup to rolldown because performance, thanks @​ssi02014
  • Bumped several dependencies where possible

DOMPurify 3.4.15

  • Added better clobbering hardening when XML content is involved, thanks @​gnyselcuk
  • Added several smaller hardening and edge-case improvements, thanks @​leechristensen
  • Bumped several dependencies where possible
Commits

Updates hotkeys-js from 4.0.7 to 4.1.2

Release notes

Sourced from hotkeys-js's releases.

v4.1.2

Buy me a coffee npm bundle size npm version

Documentation v4.1.2: https://raw.githack.com/jaywcjlove/hotkeys/8bfc8b4/index.html
Comparing Changes: https://github.com/jaywcjlove/hotkeys-js/compare/v4.1.1...v4.1.2

npm i hotkeys-js@4.1.2
  • 🐞 fix: reset modifier state on window focus changes ref:0 (
    Package Dependencies
    Package:
     globals
    Ecosystem:
    npm
    Version Change:
    17.12.0 → 17.14.0
    Update Type:
    Minor
    Package:
    axios
    Ecosystem:
    npm
    Version Change:
    1.20.0 → 1.21.1
    Update Type:
    Minor
    Package:
    @types/react
    Ecosystem:
    npm
    Version Change:
    19.2.18 → 19.3.0
    Update Type:
    Minor
    Package:
    react-dom
    Ecosystem:
    npm
    Version Change:
    19.2.8 → 19.3.1
    Update Type:
    Minor
    Package:
    @tanstack/react-query
    Ecosystem:
    npm
    Version Change:
    5.102.8 → 5.107.1
    Update Type:
    Minor
    Package:
    @types/react-dom
    Ecosystem:
    npm
    Version Change:
    19.2.5 → 19.3.0
    Update Type:
    Minor
    Package:
    webpack
    Ecosystem:
    npm
    Version Change:
    5.108.4 → 5.112.2
    Update Type:
    Minor
    Package:
    @babel/core
    Ecosystem:
    npm
    Version Change:
    7.29.7 → 7.29.13
    Update Type:
    Patch
    Package:
    dompurify
    Ecosystem:
    npm
    Version Change:
    3.4.14 → 3.4.17
    Update Type:
    Patch
    Package:
    zustand
    Ecosystem:
    npm
    Version Change:
    5.0.15 → 5.1.0
    Update Type:
    Minor
    Package:
    postcss
    Ecosystem:
    npm
    Version Change:
    8.5.26 → 8.5.32
    Update Type:
    Patch
    Package:
    typescript-eslint
    Ecosystem:
    npm
    Version Change:
    8.69.0 → 8.72.2
    Update Type:
    Minor
    Package:
    core-js
    Ecosystem:
    npm
    Version Change:
    3.50.0 → 3.51.0
    Update Type:
    Minor
    Package:
    @testing-library/user-event
    Ecosystem:
    npm
    Version Change:
    14.6.3 → 14.6.9
    Update Type:
    Patch
    Package:
    marked
    Ecosystem:
    npm
    Version Change:
    18.0.11 → 18.2.0
    Update Type:
    Minor
    Package:
    autoprefixer
    Ecosystem:
    npm
    Version Change:
    10.5.4 → 10.6.2
    Update Type:
    Minor
    Package:
    moment-timezone
    Ecosystem:
    npm
    Version Change:
    0.6.3 → 0.6.6
    Update Type:
    Patch
    Package:
    eslint-plugin-jest
    Ecosystem:
    npm
    Version Change:
    29.16.6 → 29.17.0
    Update Type:
    Minor
    Package:
    lossless-json
    Ecosystem:
    npm
    Version Change:
    4.3.1 → 4.3.3
    Update Type:
    Patch
    Package:
    @babel/eslint-parser
    Ecosystem:
    npm
    Version Change:
    7.29.7 → 7.29.13
    Update Type:
    Patch
    Package:
    react
    Ecosystem:
    npm
    Version Change:
    19.2.8 → 19.3.1
    Update Type:
    Minor
    Package:
    jest
    Ecosystem:
    npm
    Version Change:
    30.5.1 → 30.5.2
    Update Type:
    Patch
    Package:
    sharp
    Ecosystem:
    npm
    Version Change:
    0.35.4 → 0.35.5
    Update Type:
    Patch
    Package:
    webpack-bundle-analyzer
    Ecosystem:
    npm
    Version Change:
    5.3.2 → 5.4.2
    Update Type:
    Minor
    Package:
    sql-formatter
    Ecosystem:
    npm
    Version Change:
    15.8.2 → 15.9.0
    Update Type:
    Minor
    Package:
    moment
    Ecosystem:
    npm
    Version Change:
    2.30.1 → 2.31.0
    Update Type:
    Minor
    Package:
    chart.js
    Ecosystem:
    npm
    Version Change:
    4.5.1 → 4.6.1
    Update Type:
    Minor
    Package:
    socket.io-client
    Ecosystem:
    npm
    Version Change:
    4.8.3 → 4.8.4
    Update Type:
    Patch
    Package:
    @testing-library/dom
    Ecosystem:
    npm
    Version Change:
    10.4.1 → 10.4.2
    Update Type:
    Patch
    Package:
    jest-environment-jsdom
    Ecosystem:
    npm
    Version Change:
    30.5.1 → 30.5.2
    Update Type:
    Patch
    Package:
    hotkeys-js
    Ecosystem:
    npm
    Version Change:
    4.0.7 → 4.1.2
    Update Type:
    Minor
    Package:
    react-virtualized-auto-sizer
    Ecosystem:
    npm
    Version Change:
    2.0.3 → 2.0.4
    Update Type:
    Patch
    Package:
    html-react-parser
    Ecosystem:
    npm
    Version Change:
    6.1.7 → 6.1.9
    Update Type:
    Patch
    Package:
    @tanstack/react-virtual
    Ecosystem:
    npm
    Version Change:
    3.14.10 → 3.14.26
    Update Type:
    Patch
    Package:
    ip-address
    Ecosystem:
    npm
    Version Change:
    10.5.0 → 10.7.6
    Update Type:
    Minor
    Package:
    rc-dock
    Ecosystem:
    npm
    Version Change:
    4.0.0-alpha.3 → 4.1.0
    Update Type:
    Minor
    Package:
    react-timer-hook
    Ecosystem:
    npm
    Version Change:
    4.0.6 → 4.0.9
    Update Type:
    Patch
    Package:
    react-draggable
    Ecosystem:
    npm
    Version Change:
    4.7.1 → 4.7.2
    Update Type:
    Patch
    Package:
    react-frame-component
    Ecosystem:
    npm
    Version Change:
    5.2.7 → 5.3.2
    Update Type:
    Minor
    Package:
    react-checkbox-tree
    Ecosystem:
    npm
    Version Change:
    2.0.2 → 2.1.1
    Update Type:
    Minor
    Package:
    anti-trojan-source
    Ecosystem:
    npm
    Version Change:
    1.12.2 → 1.13.1
    Update Type:
    Minor
    Package:
    diff-arrays-of-objects
    Ecosystem:
    npm
    Version Change:
    1.1.11 → 1.1.12
    Update Type:
    Patch
Security Advisories
follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects
GHSA-mrwp-f3q8-3g9p CVE-2026-116689 HIGH
### Summary follow-redirects 1.16.0 and 1.16.1 validate the documented sensitiveHeaders option with instanceof Array. An array created in another JavaScript realm is silently replaced with an empt...
Actions
View on GitHub View Repository All Dependabot PRs
Technical Details
ID: 16820626
UUID: 6391585204
Node ID: PR_kwDOUhBH9c8AAAABPKdeGQ
Host: GitHub
Repository: Vermillion-Develop/pgadmin4_ru