Bump the npm_and_yarn group across 2 directories with 20 updates

Closed

Number: #23
Type: Pull Request
State: Closed

Author:

dependabot[bot]
Association: None
Comments: 0

Created: August 06, 2025 at 08:20 PM UTC
(4 months ago)

Updated: August 06, 2025 at 10:44 PM UTC
(4 months ago)

Closed: August 06, 2025 at 10:44 PM UTC
(4 months ago)

Time to Close: about 2 hours

Labels:
dependencies javascript

Description:

Bumps the npm_and_yarn group with 8 updates in the /bin/Debug/net8.0/my-app directory:

Package	From	To
express	`4.19.2`	`4.21.2`
braces	`3.0.2`	`3.0.3`
cookie	`0.4.2`	`0.7.1`
socket.io	`4.7.4`	`4.8.1`
esbuild	`0.19.11`	`0.25.5`
@angular-devkit/build-angular	`17.1.3`	`20.1.5`
ws	`8.11.0`	`8.17.1`
socket.io-adapter	`2.5.2`	`2.5.5`

Bumps the npm_and_yarn group with 8 updates in the /wwwroot directory:

Package	From	To
express	`4.19.2`	`4.21.2`
braces	`3.0.2`	`3.0.3`
cookie	`0.4.2`	`0.7.1`
socket.io	`4.7.4`	`4.8.1`
esbuild	`0.19.11`	`0.25.5`
@angular-devkit/build-angular	`17.1.3`	`20.1.5`
ws	`8.11.0`	`8.17.1`
socket.io-adapter	`2.5.2`	`2.5.5`

Updates express from 4.19.2 to 4.21.2

Release notes

Sourced from express's releases.

4.21.2

What's Changed

Add funding field (v4) by @bjohansebas in expressjs/express#6065

deps: path-to-regexp@0.1.11 by @blakeembrey in expressjs/express#5956

deps: bump path-to-regexp@0.1.12 by @jonchurch in expressjs/express#6209

Release: 4.21.2 by @UlisesGascon in expressjs/express#6094

Full Changelog: https://github.com/expressjs/express/compare/4.21.1...4.21.2

4.21.1

What's Changed

Backport a fix for CVE-2024-47764 to the 4.x branch by @joshbuker in expressjs/express#6029

Release: 4.21.1 by @UlisesGascon in expressjs/express#6031

Full Changelog: https://github.com/expressjs/express/compare/4.21.0...4.21.1

4.21.0

What's Changed

Deprecate "back" magic string in redirects by @blakeembrey in expressjs/express#5935

finalhandler@1.3.1 by @wesleytodd in expressjs/express#5954

fix(deps): serve-static@1.16.2 by @wesleytodd in expressjs/express#5951

Upgraded dependency qs to 6.13.0 to match qs in body-parser by @agadzinski93 in expressjs/express#5946

New Contributors

@agadzinski93 made their first contribution in expressjs/express#5946

Full Changelog: https://github.com/expressjs/express/compare/4.20.0...4.21.0

4.20.0

What's Changed

Important

IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)

Remove link renderization in html while using res.redirect

Other Changes

4.19.2 Staging by @wesleytodd in expressjs/express#5561

remove duplicate location test for data uri by @wesleytodd in expressjs/express#5562

feat: document beta releases expectations by @marco-ippolito in expressjs/express#5565

Cut down on duplicated CI runs by @jonchurch in expressjs/express#5564

Add a Threat Model by @UlisesGascon in expressjs/express#5526

Assign captain of encodeurl by @blakeembrey in expressjs/express#5579

Nominate jonchurch as repo captain for http-errors, expressjs.com, morgan, cors, body-parser by @jonchurch in expressjs/express#5587

docs: update Security.md by @inigomarquinez in expressjs/express#5590

docs: update triage nomination policy by @UlisesGascon in expressjs/express#5600

Add CodeQL (SAST) by @UlisesGascon in expressjs/express#5433

docs: add UlisesGascon as triage initiative captain by @UlisesGascon in expressjs/express#5605

... (truncated)

Changelog

Sourced from express's changelog.

4.21.2 / 2024-11-06

deps: path-to-regexp@0.1.12

Fix backtracking protection

deps: path-to-regexp@0.1.11

Throws an error on invalid path values

4.21.1 / 2024-10-08

Backported a fix for CVE-2024-47764

4.21.0 / 2024-09-11

Deprecate res.location("back") and res.redirect("back") magic string

deps: serve-static@1.16.2

includes send@0.19.0

deps: finalhandler@1.3.1

deps: qs@6.13.0

4.20.0 / 2024-09-10

deps: serve-static@0.16.0

Remove link renderization in html while redirecting

deps: send@0.19.0

Remove link renderization in html while redirecting

deps: body-parser@0.6.0

add depth option to customize the depth level in the parser

IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)

Remove link renderization in html while using res.redirect

deps: path-to-regexp@0.1.10

Adds support for named matching groups in the routes using a regex

Adds backtracking protection to parameters without regexes defined

deps: encodeurl@~2.0.0

Removes encoding of \, |, and ^ to align better with URL spec

Deprecate passing options.maxAge and options.expires to res.clearCookie

Will be ignored in v5, clearCookie will set a cookie with an expires in the past to instruct clients to delete the cookie

Commits

1faf228 4.21.2
2e0fb64 deps: bump path-to-regexp@0.1.12 (#6209)
59fc270 deps: path-to-regexp@0.1.11 (#5956)
51fc39c docs: add funding (#6065)
8e229f9 4.21.1
a024c8a fix(deps): cookie@0.7.1
7e562c6 4.21.0
1bcde96 fix(deps): qs@6.13.0 (#5946)
7d36477 fix(deps): serve-static@1.16.2 (#5951)
40d2d8f fix(deps): finalhandler@1.3.1
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by jonchurch, a new releaser for express since your current version.

Updates body-parser from 1.20.2 to 1.20.3

Release notes

Sourced from body-parser's releases.

1.20.3

What's Changed

Important

deps: qs@6.13.0

add depth option to customize the depth level in the parser

IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity). Documentation

Other changes

chore: add support for OSSF scorecard reporting by @inigomarquinez in expressjs/body-parser#522

ci: fix errors in ci github action for node 8 and 9 by @inigomarquinez in expressjs/body-parser#523

fix: pin to node@22.4.1 by @wesleytodd in expressjs/body-parser#527

deps: qs@6.12.3 by @melikhov-dev in expressjs/body-parser#521

Add OSSF Scorecard badge by @bjohansebas in expressjs/body-parser#531

Linter by @UlisesGascon in expressjs/body-parser#534

Release: 1.20.3 by @UlisesGascon in expressjs/body-parser#535

New Contributors

@inigomarquinez made their first contribution in expressjs/body-parser#522

@melikhov-dev made their first contribution in expressjs/body-parser#521

@bjohansebas made their first contribution in expressjs/body-parser#531

@UlisesGascon made their first contribution in expressjs/body-parser#534

Full Changelog: https://github.com/expressjs/body-parser/compare/1.20.2...1.20.3

Changelog

Sourced from body-parser's changelog.

1.20.3 / 2024-09-10

deps: qs@6.13.0

add depth option to customize the depth level in the parser

IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)

Commits

1752951 1.20.3
39744cf chore: linter (#534)
b2695c4 Merge commit from fork
ade0f3f add scorecard to readme (#531)
99a1bd6 deps: qs@6.12.3 (#521)
9478591 fix: pin to node@22.4.1
83db46a ci: fix errors in ci github action for node 8 and 9 (#523)
9d4e212 chore: add support for OSSF scorecard reporting (#522)
See full diff in compare view

Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for body-parser since your current version.

Updates braces from 3.0.2 to 3.0.3

Commits

74b2db2 3.0.3
88f1429 update eslint. lint, fix unit tests.
415d660 Snyk js braces 6838727 (#40)
190510f fix tests, skip 1 test in test/braces.expand
716eb9f readme bump
a5851e5 Merge pull request #37 from coderaiser/fix/vulnerability
2092bd1 feature: braces: add maxSymbols (https://github.com/micromatch/braces/issues/...
9f5b4cf fix: vulnerability (https://security.snyk.io/vuln/SNYK-JS-BRACES-6838727)
98414f9 remove funding file
665ab5d update keepEscaping doc (#27)
Additional commits viewable in compare view

Updates cookie from 0.4.2 to 0.7.1

Release notes

Sourced from cookie's releases.

0.7.1

Fixed

Allow leading dot for domain (#174)

Although not permitted in the spec, some users expect this to work and user agents ignore the leading dot according to spec

Add fast path for serialize without options, use obj.hasOwnProperty when parsing (#172)

https://github.com/jshttp/cookie/compare/v0.7.0...v0.7.1

0.7.0

perf: parse cookies ~10% faster (#144 by @kurtextrem and #170)

fix: narrow the validation of cookies to match RFC6265 (#167 by @bewinsnw)

fix: add main to package.json for rspack (#166 by @proudparrot2)

https://github.com/jshttp/cookie/compare/v0.6.0...v0.7.0

0.6.0

Add partitioned option

0.5.0

Add priority option

Fix expires option to reject invalid dates

pref: improve default decode speed

pref: remove slow string split in parse

Commits

cf4658f 0.7.1
6a8b8f5 Allow leading dot for domain (#174)
58015c0 Remove more code and perf wins (#172)
ab057d6 0.7.0
5f02ca8 Migrate history to GitHub releases
a5d591c Migrate history to GitHub releases
51968f9 Skip isNaN
9e7ca51 perf(parse): cache length, return early (#144)
d6f39b0 Fix tests for old node
6bb701f Remove failing scorecard
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by blakeembrey, a new releaser for cookie since your current version.

Updates socket.io from 4.7.4 to 4.8.1

Release notes

Sourced from socket.io's releases.

socket.io@4.8.1

Due to a change in the bundler configuration, the production bundle (socket.io.min.js) did not support sending and receiving binary data in version 4.8.0. This is now fixed.

Dependencies

engine.io@~6.6.0 (no change)

ws@~8.17.1 (no change)

socket.io-client@4.8.1

Bug Fixes

bundle: do not mangle the "_placeholder" attribute (ca9e994)

Dependencies

engine.io-client@~6.6.1 (no change)

ws@~8.17.1 (no change)

socket.io-client@4.8.0

Features

Custom transport implementations

The transports option now accepts an array of transport implementations:
import { io } from "socket.io-client";
import { XHR, WebSocket } from "engine.io-client";
const socket = io({
transports: [XHR, WebSocket]
});
Here is the list of provided implementations:

Transport Description

Fetch HTTP long-polling based on the built-in fetch() method.

NodeXHR HTTP long-polling based on the XMLHttpRequest object provided by the xmlhttprequest-ssl package.

XHR HTTP long-polling based on the built-in XMLHttpRequest object.

NodeWebSocket WebSocket transport based on the WebSocket object provided by the ws package.

WebSocket WebSocket transport based on the built-in WebSocket object.

WebTransport WebTransport transport based on the built-in WebTransport object.

Usage:

Transport browser Node.js Deno Bun

Transport	Description
`Fetch`	HTTP long-polling based on the built-in `fetch()` method.
`NodeXHR`	HTTP long-polling based on the `XMLHttpRequest` object provided by the `xmlhttprequest-ssl` package.
`XHR`	HTTP long-polling based on the built-in `XMLHttpRequest` object.
`NodeWebSocket`	WebSocket transport based on the `WebSocket` object provided by the `ws` package.
`WebSocket`	WebSocket transport based on the built-in `WebSocket` object.
`WebTransport`	WebTransport transport based on the built-in `WebTransport` object.

... (truncated)

Commits

91e1c8b chore(release): socket.io@4.8.1
8d5528a chore(release): socket.io-client@4.8.1
71387e5 refactor(sio-client): reexport transports from the engine
aead835 refactor(sio): make Namespace._fns private (#5196)
029e010 chore(release): engine.io-client@6.6.2
4ca6ddb docs(nuxt): update example with latest version
ca9e994 fix(sio-client): do not mangle the "_placeholder" attribute
4865f2e fix(eio-client): prevent infinite loop with Node.js built-in WebSocket
d4b3dde ci: use Node.js 22
3b68658 chore: bump @fails-components/webtransport to version 1.1.4 (dev)
Additional commits viewable in compare view

Updates esbuild from 0.19.11 to 0.25.5

Release notes

Sourced from esbuild's releases.

v0.25.5
Fix a regression with browser in package.json (#4187)

The fix to #4144 in version 0.25.3 introduced a regression that caused browser overrides specified in package.json to fail to override relative path names that end in a trailing slash. That behavior change affected the axios@0.30.0 package. This regression has been fixed, and now has test coverage.
Add support for certain keywords as TypeScript tuple labels (#4192)

Previously esbuild could incorrectly fail to parse certain keywords as TypeScript tuple labels that are parsed by the official TypeScript compiler if they were followed by a ? modifier. These labels included function, import, infer, new, readonly, and typeof. With this release, these keywords will now be parsed correctly. Here's an example of some affected code:
type Foo = [
  value: any,
  readonly?: boolean, // This is now parsed correctly
]
Add CSS prefixes for the stretch sizing value (#4184)

This release adds support for prefixing CSS declarations such as div { width: stretch }. That CSS is now transformed into this depending on what the --target= setting includes:
div {
  width: -webkit-fill-available;
  width: -moz-available;
  width: stretch;
}
v0.25.4
Add simple support for CORS to esbuild's development server (#4125)

Starting with version 0.25.0, esbuild's development server is no longer configured to serve cross-origin requests. This was a deliberate change to prevent any website you visit from accessing your running esbuild development server. However, this change prevented (by design) certain use cases such as "debugging in production" by having your production website load code from localhost where the esbuild development server is running.

To enable this use case, esbuild is adding a feature to allow Cross-Origin Resource Sharing (a.k.a. CORS) for simple requests. Specifically, passing your origin to the new cors option will now set the Access-Control-Allow-Origin response header when the request has a matching Origin header. Note that this currently only works for requests that don't send a preflight OPTIONS request, as esbuild's development server doesn't currently support OPTIONS requests.

Some examples:
CLI:
esbuild --servedir=. --cors-origin=https://example.com
JS:
const ctx = await esbuild.context({})
await ctx.serve({
  servedir: '.',
  cors: {

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2023

This changelog documents all esbuild versions published in the year 2023 (versions 0.16.13 through 0.19.11).

Commits

ea453bf publish 0.25.5 to npm
223ddc6 fix #4187: browser package.json regression
b2c8251 fix #4192: typescript tuple label parser edge case
28cf2f3 fix #4184: css prefixes for stretch
bee1b09 fix comment indents
9ddfe5f run make update-compat-table
c339f34 fix a misplaced comment
218d29e publish 0.25.4 to npm
e66cd0b dev server: simple support for CORS requests (#4171)
8bf3368 js api: validate some options as arrays of strings
Additional commits viewable in compare view

Updates @angular-devkit/build-angular from 17.1.3 to 20.1.5

Release notes

Sourced from @angular-devkit/build-angular's releases.

20.1.5

@angular/cli

Commit Description

cache MCP best practices content and add tool annotations

20.1.4

@angular/cli

Commit Description

skip workspace-specific tools when outside a workspace

@angular/build

Commit Description

skip vite transformation of CSS-like assets

20.1.3

@angular/build

Commit Description

update vite to 7.0.6

20.1.2

@angular/cli

Commit Description

define option is being included multiple times in the JSON help

@angular-devkit/core

Commit Description

use crypto.randomUUID instead of Date.now for unique string in tmp file names

20.1.1

@angular/build

Commit Description

emit a warning when outputHashing is set to all or bundles when HMR is enabled

normalize code coverage include paths to POSIX

20.1.0

@schematics/angular

Commit Description

use signal in app component

@angular/cli

Commit Description

add initial MCP server implementation

@angular-devkit/build-angular

| Commit | Description |

Commit	Description
	cache MCP best practices content and add tool annotations

Commit	Description
	skip workspace-specific tools when outside a workspace

Commit	Description
	skip vite transformation of CSS-like assets

Commit	Description
	update `vite` to `7.0.6`

Commit	Description
	`define` option is being included multiple times in the JSON help

Commit	Description
	use crypto.randomUUID instead of Date.now for unique string in tmp file names

Commit	Description
	emit a warning when `outputHashing` is set to `all` or `bundles` when HMR is enabled
	normalize code coverage include paths to POSIX

Commit	Description
	use signal in app component

Commit	Description
	add initial MCP server implementation

... (truncated)

Changelog

Sourced from @angular-devkit/build-angular's changelog.

20.1.5 (2025-08-06)

@angular/cli

Commit Type Description

48ca04474 fix cache MCP best practices content and add tool annotations

20.2.0-next.2 (2025-07-30)

@angular/cli

Commit Type Description

193b39416 fix skip workspace-specific tools when outside a workspace

@angular/build

Commit Type Description

7a183730c fix skip vite transformation of CSS-like assets

20.1.4 (2025-07-30)

@angular/cli

Commit Type Description

2d753cc62 fix skip workspace-specific tools when outside a workspace

@angular/build

Commit Type Description

42d72ef4d fix skip vite transformation of CSS-like assets

20.1.3 (2025-07-24)

Commit	Type	Description
48ca04474	fix	cache MCP best practices content and add tool annotations

Commit	Type	Description
193b39416	fix	skip workspace-specific tools when outside a workspace

Commit	Type	Description
7a183730c	fix	skip vite transformation of CSS-like assets

Commit	Type	Description
2d753cc62	fix	skip workspace-specific tools when outside a workspace

Commit	Type	Description
42d72ef4d	fix	skip vite transformation of CSS-like assets

... (truncated)

Commits

2c0e973 release: cut the v20.1.5 release
761bc78 build: update to latest dev-infra in the workspace
48ca044 fix(@angular/cli): cache MCP best practices content and add tool annotations
8601f06 refactor(@angular/cli): update suggested MCP server configuration output
2ed9c37 test(@angular/cli): add initial e2e test for MCP server tool registration
9a2b642 refactor(@angular/cli): add instructional text to MCP server
ffc4c67 release: cut the v20.1.4 release
2d753cc fix(@angular/cli): skip workspace-specific tools when outside a workspace
42d72ef fix(@angular/build): skip vite transformation of CSS-like assets
0489fe7 refactor(@angular/build): update MCP best practices guide content
Additional commits viewable in compare view

Updates http-proxy-middleware from 2.0.6 to 2.0.9

Release notes

Sourced from http-proxy-middleware's releases.

v2.0.9

What's Changed

fix(fixRequestBody): check readableLength by @chimurai in chimurai/http-proxy-middleware#1097

chore(package): v2.0.9 by @chimurai in chimurai/http-proxy-middleware#1099

Full Changelog: https://github.com/chimurai/http-proxy-middleware/compare/v2.0.8...v2.0.9

v2.0.8

What's Changed

fix(fixRequestBody): prevent multiple .write() calls by @chimurai in chimurai/http-proxy-middleware#1090

fix(fixRequestBody): handle invalid request by @chimurai in chimurai/http-proxy-middleware#1091

chore(package): v2.0.8 by @chimurai in chimurai/http-proxy-middleware#1094

Full Changelog: https://github.com/chimurai/http-proxy-middleware/compare/v2.0.7...v2.0.8

v2.0.7

Full Changelog: https://github.com/chimurai/http-proxy-middleware/compare/v2.0.6...v2.0.7

v2.0.7-beta.1

Full Changelog: https://github.com/chimurai/http-proxy-middleware/compare/v2.0.7-beta.0...v2.0.7-beta.1

v2.0.7-beta.0

Full Changelog: https://github.com/chimurai/http-proxy-middleware/compare/v2.0.6...v2.0.7-beta.0

Changelog

Sourced from http-proxy-middleware's changelog.

v2.0.9

fix(fixRequestBody): check readableLength

v2.0.8

fix(fixRequestBody): prevent multiple .write() calls

fix(fixRequestBody): handle invalid request

v2.0.7

ci(github actions): add publish.yml

fix(filter): handle errors

Commits

617a7c9 chore(package): v2.0.9 (#1099)
d22d587 fix(fixRequestBody): check readableLength (#1097)
d03d51b chore(package): v2.0.8 (#1094)
c50dd06 fix(fixRequestBody): handle invalid request (#1091)
76a9d8d fix(fixRequestBody): prevent multiple .write() calls (#1090)
1e92339 ci(github-actions): fix npm tag
90afb7c chore(package): v2.0.7
0b4274e fix(filter): handle errors
1bd6dd5 ci(github actions): add publish.yml
See full diff in compare view

Updates nanoid from 3.3.7 to 3.3.11

Release notes

Sourced from nanoid's releases.

3.3.11

Fixed React Native support.

3.3.10

Fixed React Native support (by @steida).

3.3.9

Reduced npm package size.

Changelog

Sourced from nanoid's changelog.

3.3.11

Fixed React Native support.

3.3.10

Fixed React Native support (by @steida).

3.3.9

Reduced npm package size.

3.3.8

Fixed a way to break Nano ID by passing non-integer size (by @myndzi).

Commits

37289ce Release 3.3.11 version
23690b7 Fix CI
c147962 Fix RN support
a83734e Move to manually ESM/CJS dual package
bb12e8a Release 3.3.10 version
8f44264 Fix Expo support
adf9b0c Release 3.3.9 version
1c6f088 Remove dev file from npm package
3044cd5 Release 3.3.8 version
4fe3495 Update size limit
Additional commits viewable in compare view

Updates on-headers from 1.0.2 to 1.1.0

Release notes

Sourced from on-headers's releases.

1.1.0

Important

Fix CVE-2025-7339 (GHSA-76c9-3jph-rj3q)

What's Changed

Migrate CI pipeline to GitHub actions by @carpasse in jshttp/on-headers#12

fix README.md badges by @carpasse in jshttp/on-headers#13

add OSSF scorecard action by @carpasse in jshttp/on-headers#14

fix: use ubuntu-latest as ci runner by @UlisesGascon in jshttp/on-headers#19

ci: apply OSSF Scorecard security best practices by @UlisesGascon in jshttp/on-headers#20

👷 add upstream change detection by @ctcpip in jshttp/on-headers#31

✨ add script to update known hashes by @ctcpip in jshttp/on-headers#32

💚 update CI - add newer node versions by @ctcpip in jshttp/on-headers#33

New Contributors

@carpasse made their first contribution in jshttp/on-headers#12

@UlisesGascon made their first contribution in jshttp/on-headers#19

@ctcpip made their first contribution in jshttp/on-headers#31

Full Changelog: https://github.com/jshttp/on-headers/compare/v1.0.2...v1.1.0

Changelog

Sourced from on-headers's changelog.

1.1.0 / 2025-07-17

Fix CVE-2025-7339 (GHSA-76c9-3jph-rj3q)

Commits

4b017af 1.1.0
b636f2d ♻️ refactor header array code
3e2c2d4 ✨ ignore falsy header keys, matching node behavior
172eb41 ✨ support duplicate headers
c6e3849 🔒️ fix array handling
6893518 💚 update CI - add newer node versions
56a345d ✨ add script to update known hashes
175ab21 👷 add upstream change detection (#31)
ce0b2c8 ci: apply OSSF Scorecard security best practices (#20)
1a38c54 fix: use ubuntu-latest as ci runner (#19)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for on-headers since your current version.

Updates path-to-regexp from 0.1.7 to 0.1.12

Release notes

Sourced from path-to-regexp's releases.

Fix backtracking (again)

Fixed

Improved backtracking protection for 0.1.x, will break some previously valid paths (see previous advisory: https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j)

https://github.com/pillarjs/path-to-regexp/compare/v0.1.11...v0.1.12

Error on bad input

Changed

Add error on bad input values 8f09549

https://github.com/pillarjs/path-to-regexp/compare/v0.1.10...v0.1.11

Backtrack protection

Fixed

Add backtrack protection to parameters 29b96b4

This will break some edge cases but should improve performance

https://github.com/pillarjs/path-to-regexp/compare/v0.1.9...v0.1.10

Support non-lookahead regex output

Added

Allow a non-lookahead regex (#312) c4272e4

https://github.com/component/path-to-regexp/compare/v0.1.8...v0.1.9

Support named matching groups in RegExp

Added

Add support for named matching groups (#301) 114f62d

https://github.com/pillarjs/path-to-regexp/compare/v0.1.7...v0.1.8

Commits

640e694 0.1.12
f01c26a Merge commit from fork
0c71192 0.1.11
8f09549 Add error on bad input values
c827fce 0.1.10
29b96b4 Add backtrack protection to parameters
ac4c234 Update repo url (#314)
bdb6635 0.1.9
c4272e4 Allow a non-lookahead regex (#312)
51a1955 0.1.8
Additional commits viewable in compare view

Updates rollup from 4.9.6 to 4.44.1

Release notes

Sourced from rollup's releases.

v4.44.1

4.44.1

2025-06-26

Bug Fixes

Reinstate maxParallelFileOps limit of 1000 to resolve the issue for some (#5992)

Pull Requests

#5988: fix(deps): lock file maintenance minor/patch updates (@renovate[bot], @lukastaegert)

#5992: Set maxParallelFileOps to 1000 (@lukastaegert)

v4.44.0

4.44.0

2025-06-19

Features

Remove limit on maxParallelFileOps as this could break watch mode with the commonjs plugin (#5986)

Bug Fixes

Provide better source mappings when coarse intermediate maps are used (#5985)

Pull Requests

#5984: fix(deps): lock file maintenance minor/patch updates (@renovate[bot], @lukastaegert)

#5985: Improve approximation of coarse sourcemap segments (@TrickyPi)

#5986: Remove limit on max parallel file ops (@lukastaegert)

v4.43.0

4.43.0

2025-06-11

Features

Provide new fs option and this.fs API to replace file system (#5944)

Pull Requests

#5944: feat(options): Add an option for overriding the file system module in the JS API (@EggDice, @lukastaeger... Description has been truncated



      
        
          
            
              
              Pull Request Statistics
            
          
          
            
                
                  Commits:

                  
                  1
                
              
                
                  Files Changed:

                  
                  4
                
              
                
                  Additions:

                  
                    
                    +12168
                  
                
              
                
                  Deletions:

                  
                    
                    -7372


          
            
              
              Package Dependencies
            
          
          
              
                
                  
                    Package:

                    
                      ws
                  
                  
                  
                    Ecosystem:

                    npm
                  
                  
                    
                      Version Change:

                      8.11.0 → 8.17.1
                    
                  
                    
                      Update Type:

                      
                        Minor
                      
                    
                  
                
              
              
                
                  
                    Package:

                    
                      @angular-devkit/build-angular
                  
                  
                  
                    Ecosystem:

                    npm
                  
                  
                    
                      Version Change:

                      17.1.3 → 20.1.5
                    
                  
                    
                      Update Type:

                      
                        Major
                      
                    
                  
                
              
              
                
                  
                    Package:

                    
                      braces
                  
                  
                  
                    Ecosystem:

                    npm
                  
                  
                    
                      Version Change:

                      3.0.2 → 3.0.3
                    
                  
                    
                      Update Type:

                      
                        Patch
                      
                    
                  
                
              
              
                
                  
                    Package:

                    
                      express
                  
                  
                  
                    Ecosystem:

                    npm
                  
                  
                    
                      Version Change:

                      4.19.2 → 4.21.2
                    
                  
                    
                      Update Type:

                      
                        Minor
                      
                    
                  
                
              
              
                
                  
                    Package:

                    
                      esbuild
                  
                  
                  
                    Ecosystem:

                    npm
                  
                  
                    
                      Version Change:

                      0.19.11 → 0.25.5
                    
                  
                    
                      Update Type:

                      
                        Minor
                      
                    
                  
                
              
              
                
                  
                    Package:

                    
                      cookie
                  
                  
                  
                    Ecosystem:

                    npm
                  
                  
                    
                      Version Change:

                      0.4.2 → 0.7.1
                    
                  
                    
                      Update Type:

                      
                        Minor
                      
                    
                  
                
              
              
                
                  
                    Package:

                    
                      socket.io
                  
                  
                  
                    Ecosystem:

                    npm
                  
                  
                    
                      Version Change:

                      4.7.4 → 4.8.1
                    
                  
                    
                      Update Type:

                      
                        Minor
                      
                    
                  
                
              
              
                
                  
                    Package:

                    
                      socket.io-adapter
                  
                  
                  
                    Ecosystem:

                    npm
                  
                  
                    
                      Version Change:

                      2.5.2 → 2.5.5
                    
                  
                    
                      Update Type:

                      
                        Patch
                      
                    
                  
                
              
          
        

      
        
          
            
              
              Security Advisories
            
          
          
              
                
                  
                    
                      path-to-regexp outputs backtracking regular expressions
                      
                      
                          GHSA-9wv6-86v2-598j
                          CVE-2024-45296
                        
                          
                            HIGH
                          
                      
                      
                        
                          ### Impact

A bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (`.`). For example, `/:a-:b`.

### Patches

F...
                        
                    
                  
                
              
                
                  
                    
                      cookie accepts cookie name, path, and domain with out of bounds characters
                      
                      
                          GHSA-pxg6-pf52-xh8x
                          CVE-2024-47764
                        
                          
                            LOW
                          
                      
                      
                        
                          ### Impact

The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. For example, `serialize("userName=<script>alert('XSS3')</script>; Max-Age=25920...
                        
                    
                  
                
              
                
                  
                    
                      on-headers is vulnerable to http response header manipulation
                      
                      
                          GHSA-76c9-3jph-rj3q
                          CVE-2025-7339
                        
                          
                            LOW
                          
                      
                      
                        
                          ### Impact

A bug in on-headers versions `< 1.1.0` may result in response headers being inadvertently modified when an array is passed to `response.writeHead()`

### Patches

Users should upgrade t...



    
    
      
        
          Actions
        
        
          
            
            View on GitHub
          
          
            
            View Repository
          
          
            
            All Dependabot PRs
        
      

      
        
          Technical Details
        
        
          
            
              ID:
              4694719
            
            
              UUID:
              2725517681
            
            
              Node ID:
              PR_kwDOLP6sz86idBlx
            
            
              Host:
              GitHub
            
            
              Repository:
              batuhan-basoglu/NET-Web-API-w-Angular
            
                
                  Mergeable:
                  
                      Yes
                  
                
                
                  Merge State:
                  Unstable

ID:	`4694719`
UUID:	`2725517681`
Node ID:	`PR_kwDOLP6sz86idBlx`
Host:	GitHub
Repository:	batuhan-basoglu/NET-Web-API-w-Angular
Mergeable:	Yes
Merge State:	Unstable

Bump the npm_and_yarn group across 2 directories with 20 updates

4.21.2

What's Changed

4.21.1

What's Changed

4.21.0

What's Changed

New Contributors

4.20.0

What's Changed

Important

Other Changes

4.21.2 / 2024-11-06

4.21.1 / 2024-10-08

4.21.0 / 2024-09-11

4.20.0 / 2024-09-10

1.20.3

What's Changed

Important

Other changes

New Contributors

1.20.3 / 2024-09-10

0.7.1

0.7.0

0.6.0

0.5.0

socket.io@4.8.1

Dependencies

socket.io-client@4.8.1

Bug Fixes

Dependencies

socket.io-client@4.8.0

Features

Custom transport implementations

v0.25.5

v0.25.4

Changelog: 2023

20.1.5

@​angular/cli

20.1.4

@​angular/cli

@​angular/build

20.1.3

@​angular/build

20.1.2

@​angular/cli

@​angular-devkit/core

20.1.1

@​angular/build

20.1.0

@​schematics/angular

@​angular/cli

@​angular-devkit/build-angular

20.1.5 (2025-08-06)

@​angular/cli

20.2.0-next.2 (2025-07-30)

@​angular/cli

@​angular/build

20.1.4 (2025-07-30)

@​angular/cli

@​angular/build

20.1.3 (2025-07-24)

v2.0.9

What's Changed

v2.0.8

What's Changed

v2.0.7

v2.0.7-beta.1

v2.0.7-beta.0

v2.0.9

v2.0.8

v2.0.7

3.3.11

3.3.10

3.3.9

3.3.11

3.3.10

3.3.9

3.3.8

1.1.0

`@angular/cli`

`@angular/cli`

`@angular/build`

`@angular/build`

`@angular/cli`

`@angular-devkit/core`

`@angular/build`

`@schematics/angular`

`@angular/cli`

`@angular-devkit/build-angular`

`@angular/cli`

`@angular/cli`

`@angular/build`

`@angular/cli`

`@angular/build`

Support named matching groups in `RegExp`