Data

Tools

Indexes

Applications

Experiments

Dependabot

An open index of dependabot pull requests across open source projects.

Bump the npm_and_yarn group across 1 directory with 38 updates

Closed
Number: #28
Type: Pull Request
State: Closed
Author: dependabot[bot] dependabot[bot]
Association: Contributor
Comments: 1
Created: August 22, 2025 at 03:24 AM UTC
(19 days ago)
Updated: September 09, 2025 at 07:22 AM UTC
(about 16 hours ago)
Closed: September 09, 2025 at 07:22 AM UTC
(about 16 hours ago)
Time to Close: 18 days
Labels:
dependencies javascript
Description:

Bumps the npm_and_yarn group with 13 updates in the / directory:

Package From To
ip 1.1.5 removed
react-scripts 4.0.1 5.0.1
@storybook/preset-create-react-app 3.1.7 9.1.3
@storybook/react 6.5.16 9.1.3
ansi-regex 3.0.0 3.0.1
json5 1.0.1 1.0.2
braces 2.3.2 3.0.3
webpack 4.44.2 5.101.3
@storybook/addon-essentials 6.5.16 8.6.14
prismjs 1.23.0 removed
@storybook/addon-actions 6.2.7 6.5.16
@storybook/addon-controls 6.2.7 6.5.16
tmpl 1.0.4 1.0.5

Removes ip

Updates react-scripts from 4.0.1 to 5.0.1

Changelog

Sourced from react-scripts's changelog.

4.0.3 (2021-02-22)

v4.0.3 is a maintenance release that includes minor bug fixes and dependency updates.

:bug: Bug Fix

  • react-scripts

:house: Internal

Committers: 4

Migrating from 4.0.2 to 4.0.3

Inside any created project that has not been ejected, run:

npm install --save --save-exact react-scripts@4.0.3

or

yarn add --exact react-scripts@4.0.3

4.0.2 (2021-02-03)

v4.0.2 is a maintenance release that includes minor bug fixes and documentation updates.

:rocket: New Feature

  • react-scripts

:bug: Bug Fix

... (truncated)

Commits

Updates @storybook/preset-create-react-app from 3.1.7 to 9.1.3

Release notes

Sourced from @​storybook/preset-create-react-app's releases.

v9.1.3

9.1.3

v9.1.2

9.1.2

v9.1.1

9.1.1

v9.1.0

9.1.0

Storybook 9.1 is packed with new features and improvements to enhance accessibility, streamline testing, and make your development workflow even smoother!

🚀 Improved upgrade command with monorepo support for seamless upgrades 🅰 Angular fixes for Tailwind 4, cache busting, and zoneless compatibility 🧪 sb.mock API and Automocking: one-line module mocking to simplify your testing workflow 🧪 Favicon shows test run status for quick visual feedback ⚛️ Easier configuration for React Native projects 🔥 Auto-abort play functions on HMR to avoid unwanted side effects 🏗️ Improved CSF factories API for type safe story definitions ♿️ A11y improvements across Storybook’s UI — addon panel, toolbar, sidebar, mobile & more 💯 Dozens more fixes and improvements based on community feedback!

... (truncated)

Changelog

Sourced from @​storybook/preset-create-react-app's changelog.

4.1.2

  • Use overrides from SB rather than defining ourselves #254

4.1.1

  • Update peer dependencies and add a note about versions #252

4.1.0

  • Add support for builder.core options to CRA preset #240

4.0.2

  • Fix bug merging core presets #238 #239

4.0.1

  • Support CJS files using Storybook's config #229

4.0.0

  • CRA: Add compatibility for CRA v5 #214

3.2.0

  • Add disableWebpackDefaults for forward-compatibility with SB core
Commits
  • ce39157 Bump version from "9.1.2" to "9.1.3" [skip ci]
  • 2bae930 Merge pull request #32283 from storybookjs/shilman/readme-utm-params
  • 99c205c Bump version from "9.1.1" to "9.1.2" [skip ci]
  • 933b626 Merge pull request #32220 from storybookjs/yann/fix-jsx-issue-2
  • a6bb54c Bump version from "9.1.0" to "9.1.1" [skip ci]
  • 073a65a Bump version from "9.1.0-beta.3" to "9.1.0" [skip ci]
  • d3746ae Bump version from "9.1.0-beta.2" to "9.1.0-beta.3" [skip ci]
  • 5ba8775 Bump version from "9.1.0-beta.1" to "9.1.0-beta.2" [skip ci]
  • c146de5 Bump version from "9.1.0-beta.0" to "9.1.0-beta.1" [skip ci]
  • b874fb2 Bump version from "9.1.0-alpha.10" to "9.1.0-beta.0" [skip ci]
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by storybook-bot, a new releaser for @​storybook/preset-create-react-app since your current version.


Updates @storybook/react from 6.5.16 to 9.1.3

Release notes

Sourced from @​storybook/react's releases.

v9.1.3

9.1.3

v9.1.2

9.1.2

v9.1.1

9.1.1

v9.1.0

9.1.0

Storybook 9.1 is packed with new features and improvements to enhance accessibility, streamline testing, and make your development workflow even smoother!

🚀 Improved upgrade command with monorepo support for seamless upgrades 🅰 Angular fixes for Tailwind 4, cache busting, and zoneless compatibility 🧪 sb.mock API and Automocking: one-line module mocking to simplify your testing workflow 🧪 Favicon shows test run status for quick visual feedback ⚛️ Easier configuration for React Native projects 🔥 Auto-abort play functions on HMR to avoid unwanted side effects 🏗️ Improved CSF factories API for type safe story definitions ♿️ A11y improvements across Storybook’s UI — addon panel, toolbar, sidebar, mobile & more 💯 Dozens more fixes and improvements based on community feedback!

... (truncated)

Changelog

Sourced from @​storybook/react's changelog.

9.1.3

9.1.2

9.1.1

9.1.0

Storybook 9.1 is packed with new features and improvements to enhance accessibility, streamline testing, and make your development workflow even smoother!

🚀 Improved upgrade command with monorepo support for seamless upgrades 🅰 Angular fixes for Tailwind 4, cache busting, and zoneless compatibility 🧪 sb.mock API and Automocking: one-line module mocking to simplify your testing workflow 🧪 Favicon shows test run status for quick visual feedback ⚛️ Easier configuration for React Native projects 🔥 Auto-abort play functions on HMR to avoid unwanted side effects 🏗️ Improved CSF factories API for type safe story definitions ♿️ A11y improvements across Storybook’s UI — addon panel, toolbar, sidebar, mobile & more 💯 Dozens more fixes and improvements based on community feedback!

... (truncated)

Commits
  • ce39157 Bump version from "9.1.2" to "9.1.3" [skip ci]
  • 2bae930 Merge pull request #32283 from storybookjs/shilman/readme-utm-params
  • 99c205c Bump version from "9.1.1" to "9.1.2" [skip ci]
  • 933b626 Merge pull request #32220 from storybookjs/yann/fix-jsx-issue-2
  • a6bb54c Bump version from "9.1.0" to "9.1.1" [skip ci]
  • 073a65a Bump version from "9.1.0-beta.3" to "9.1.0" [skip ci]
  • d3746ae Bump version from "9.1.0-beta.2" to "9.1.0-beta.3" [skip ci]
  • 5ba8775 Bump version from "9.1.0-beta.1" to "9.1.0-beta.2" [skip ci]
  • c146de5 Bump version from "9.1.0-beta.0" to "9.1.0-beta.1" [skip ci]
  • b874fb2 Bump version from "9.1.0-alpha.10" to "9.1.0-beta.0" [skip ci]
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by storybook-bot, a new releaser for @​storybook/react since your current version.


Updates ws from 6.2.1 to 7.5.10

Release notes

Sourced from ws's releases.

7.5.10

Bug fixes

  • Backported e55e5106 to the 7.x release line (22c28763).

7.5.9

Bug fixes

  • Backported bc8bd34e to the 7.x release line (0435e6e1).

7.5.8

Bug fixes

  • Backported 0fdcc0af to the 7.x release line (2758ed35).
  • Backported d68ba9e1 to the 7.x release line (dc1781bc).

7.5.7

Bug fixes

  • Backported 6946f5fe to the 7.x release line (1f72e2e1).

7.5.6

Bug fixes

  • Backported b8186dd1 to the 7.x release line (73dec34b).
  • Backported ed2b8039 to the 7.x release line (22a26afb).

7.5.5

Bug fixes

  • Backported ec9377ca to the 7.x release line (0e274acd).

7.5.4

Bug fixes

  • Backported 6a72da3e to the 7.x release line (76087fbf).
  • Backported 869c9892 to the 7.x release line (27997933).

7.5.3

Bug fixes

  • The WebSocketServer constructor now throws an error if more than one of the noServer, server, and port options are specefied (66e58d27).
  • Fixed a bug where a 'close' event was emitted by a WebSocketServer before the internal HTTP/S server was actually closed (5a587304).
  • Fixed a bug that allowed WebSocket connections to be established after WebSocketServer.prototype.close() was called (772236a1).

7.5.2

Bug fixes

... (truncated)

Commits
  • d962d70 [dist] 7.5.10
  • 22c2876 [security] Fix crash when the Upgrade header cannot be read (#2231)
  • 8a78f87 [dist] 7.5.9
  • 0435e6e [security] Fix same host check for ws+unix: redirects
  • 4271f07 [dist] 7.5.8
  • dc1781b [security] Drop sensitive headers when following insecure redirects
  • 2758ed3 [fix] Abort the handshake if the Upgrade header is invalid
  • a370613 [dist] 7.5.7
  • 1f72e2e [security] Drop sensitive headers when following redirects (#2013)
  • 8ecd890 [dist] 7.5.6
  • Additional commits viewable in compare view

Updates ansi-html from 0.0.7 to 0.0.9

Commits

Updates loader-utils from 1.2.3 to 1.4.0

Release notes

Sourced from loader-utils's releases.

v1.4.0

1.4.0 (2020-02-19)

Features

  • the resourceQuery is passed to the interpolateName method (#163) (cd0e428)

v1.3.0

1.3.0 (2020-02-19)

Features

  • support the [query] template for the interpolatedName method (#162) (469eeba)
Changelog

Sourced from loader-utils's changelog.

1.4.0 (2020-02-19)

Features

  • the resourceQuery is passed to the interpolateName method (#163) (cd0e428)

1.3.0 (2020-02-19)

Features

  • support the [query] template for the interpolatedName method (#162) (469eeba)

Commits
  • d95b8b5 chore(release): 1.4.0
  • cd0e428 feat: the resourceQuery is passed to the interpolateName method (#163)
  • 06d36cf chore(release): 1.3.0
  • 469eeba feat: support the [query] template for the interpolatedName method (#162)
  • 909c99d chore: funding.yml config and CI fix (#159)
  • b5b74f0 Set up CI with Azure Pipelines
  • 7970c48 docs: small grammar change (#144)
  • See full diff in compare view

Updates ansi-regex from 3.0.0 to 3.0.1

Commits

Updates async from 2.6.3 to 3.2.6

Changelog

Sourced from async's changelog.

v3.2.5

  • Ensure Error objects such as AggregateError are propagated without modification (#1920)

v3.2.4

  • Fix a bug in priorityQueue where it didn't wait for the result. (#1725)
  • Fix a bug where unshiftAsync was included in priorityQueue. (#1790)

v3.2.3

  • Fix bugs in comment parsing in autoInject. (#1767, #1780)

v3.2.2

  • Fix potential prototype pollution exploit

v3.2.1

v3.2.0

  • Fix a bug in Safari related to overwriting func.name
  • Remove built-in browserify configuration (#1653)
  • Varios doc fixes (#1688, #1703, #1704)

v3.1.1

  • Allow redefining name property on wrapped functions.

v3.1.0

  • Added q.pushAsync and q.unshiftAsync, analagous to q.push and q.unshift, except they always do not accept a callback, and reject if processing the task errors. (#1659)
  • Promises returned from q.push and q.unshift when a callback is not passed now resolve even if an error ocurred. (#1659)
  • Fixed a parsing bug in autoInject with complicated function bodies (#1663)
  • Added ES6+ configuration for Browserify bundlers (#1653)
  • Various doc fixes (#1664, #1658, #1665, #1652)

v3.0.1

Bug fixes

  • Fixed a regression where arrays passed to queue and cargo would be completely flattened. (#1645)
  • Clarified Async's browser support (#1643)

v3.0.0

The async/await release!

There are a lot of new features and subtle breaking changes in this major version, but the biggest feature is that most Async methods return a Promise if you omit the callback, meaning you can await them from within an async function.

</tr></table>

... (truncated)

Commits
  • 85fb18f Version 3.2.6
  • 8c0c941 Update built files
  • 5f756b4 Fix ReDoS (#1980)
  • 39cdc9b build(deps-dev): bump karma from 6.4.3 to 6.4.4 (#1985)
  • 7b8ddeb build(deps-dev): bump @​babel/core from 7.24.7 to 7.25.2 (#1981)
  • 4634a9d build(deps-dev): bump rollup from 4.18.0 to 4.19.2 (#1982)
  • afb176c build(deps-dev): bump chai from 4.4.1 to 4.5.0 (#1983)
  • 3568a74 build(deps-dev): bump @​babel/eslint-parser from 7.24.7 to 7.25.1 (#1984)
  • 9e885fd build(deps-dev): bump babel-plugin-istanbul from 6.1.1 to 7.0.0 (#1986)
  • f9c7f2a build(deps-dev): bump semver from 7.6.2 to 7.6.3 (#1987)
  • Additional commits viewable in compare view

Updates json5 from 1.0.1 to 1.0.2

Release notes

Sourced from json5's releases.

v1.0.2

  • Fix: Properties with the name __proto__ are added to objects and arrays. (#199) This also fixes a prototype pollution vulnerability reported by Jonathan Gregson! (#295). This has been backported to v1. (#298)
Changelog

Sourced from json5's changelog.

Unreleased [code, diff]

v2.2.3 [code, diff]

  • Fix: json5@2.2.3 is now the 'latest' release according to npm instead of v1.0.2. (#299)

v2.2.2 [code, diff]

  • Fix: Properties with the name __proto__ are added to objects and arrays. (#199) This also fixes a prototype pollution vulnerability reported by Jonathan Gregson! (#295).

v2.2.1 [code, diff]

  • Fix: Removed dependence on minimist to patch CVE-2021-44906. (#266)

v2.2.0 [code, diff]

  • New: Accurate and documented TypeScript declarations are now included. There is no need to install @types/json5. (#236, #244)

v2.1.3 [code, diff]

  • Fix: An out of memory bug when parsing numbers has been fixed. (#228, #229)

v2.1.2 [code, diff]

... (truncated)

Commits

Updates braces from 2.3.2 to 3.0.3

Changelog

Sourced from braces's changelog.

Release history

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

  • Changelogs are for humans, not machines.
  • There should be an entry for every single version.
  • The same types of changes should be grouped.
  • Versions and sections should be linkable.
  • The latest version comes first.
  • The release date of each versions is displayed.
  • Mention whether you follow Semantic Versioning.

Changelog entries are classified using the following labels (from keep-a-changelog):

  • Added for new features.
  • Changed for changes in existing functionality.
  • Deprecated for soon-to-be removed features.
  • Removed for now removed features.
  • Fixed for any bug fixes.
  • Security in case of vulnerabilities.

[3.0.0] - 2018-04-08

v3.0 is a complete refactor, resulting in a faster, smaller codebase, with fewer deps, and a more accurate parser and compiler.

Breaking Changes

  • The undocumented .makeRe method was removed
  • Require Node.js >= 8.3

Non-breaking changes

  • Caching was removed
Commits

Updates webpack from 4.44.2 to 5.101.3

Release notes

Sourced from webpack's releases.

v5.101.3

Fixes

  • Fixed resolve execution order issue from extra await in async modules
  • Avoid empty block for unused statement
  • Collect only specific expressions for destructuring assignment

v5.101.2

Fixes

  • Fixed syntax error when comment is on the last line
  • Handle var declaration for createRequire
  • Distinguish free variable and tagged variable

v5.101.1

Fixes

  • Filter deleted assets in processAdditionalAssets hook
  • HMR failure in defer module
  • Emit assets even if invalidation occurs again
  • Export types for serialization and deserialization in plugins and export the ModuleFactory class
  • Fixed the failure export of internal function for ES module chunk format
  • Fixed GetChunkFilename failure caused by dependOn entry
  • Fixed the import of missing dependency chunks
  • Fixed when entry chunk depends on the runtime chunk hash
  • Fixed module.exports bundle to ESM library
  • Adjusted the time of adding a group depending on the fragment of execution time
  • Fixed circle dependencies when require RawModule and condition of isDeferred
  • Tree-shakable module library should align preconditions of allowInlineStartup

v5.101.0

Fixes

  • Fixed concatenate optimization for ESM that caused undefined export
  • Respect the output.environment.nodePrefixForCoreModules option everywhere
  • Respect the output.importMetaName option everywhere
  • Fixed await async dependencies when accepting them during HMR
  • Better typescript types

Features

  • Added colors helpers for CLI
  • Enable tree-shaking for ESM external modules with named imports
  • Added the deferImport option to parser options

Performance Improvements

  • Fixed a regression in module concatenation after implementing deferred import support
  • Fixed a potential performance issue in CleanPlugin
  • Avoid extra require in some places

... (truncated)

Commits
  • 07b1ac0 chore(release): 5.101.3
  • 8d7efb8 chore(deps-dev): bump the dependencies group with 2 updates (#19816)
  • 935cbd8 docs: update examples (#19812)
  • dc79e95 fix: collect only specific expressions for destructuring assignment
  • 90ae8af fix: avoid empty block for unused statement
  • 8db97f8 fix: resolve execution order issue from extra await in async modules
  • c92deaf ci: pin Node.js 24.x to 24.5.0 in CI workflow (#19813)
  • c50930b refactor(test): correct the value retrieval
  • 613a5ad chore(deps-dev): bump @​babel/core in the dependencies group (#19807)
  • 1d9cc24 chore(release): 5.101.2
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by evilebottnawi, a new releaser for webpack since your current version.


Updates @storybook/addon-essentials from 6.5.16 to 8.6.14

Release notes

Sourced from @​storybook/addon-essentials's releases.

v8.6.14

8.6.14

v8.6.13

8.6.13

v8.6.12

8.6.12

v8.6.11

8.6.11

v8.6.10

8.6.10

v8.6.9

8.6.9

v8.6.8

8.6.8

... (truncated)

Changelog

Sourced from @​storybook/addon-essentials's changelog.

8.6.14

  • CLI: Add skip onboarding, recommended/minimal config - #30930, thanks @​shilman!
  • Core: Fix using dates in expect statements - #28413, thanks @​yann-combarnous!
  • React Native Web: Fix expo router by setting JS...

    Description has been truncated

Pull Request Statistics
Commits:
1
Files Changed:
2
Additions:
+18748
Deletions:
-24219
Package Dependencies
Package:
webpack
Ecosystem:
npm
Version Change:
4.44.2 → 5.101.3
Update Type:
Major
Package:
braces
Ecosystem:
npm
Version Change:
2.3.2 → 3.0.3
Update Type:
Major
Package:
prismjs
Ecosystem:
npm
Version Change:
1.23.0 → removed
Package:
@storybook/addon-controls
Ecosystem:
npm
Version Change:
6.2.7 → 6.5.16
Update Type:
Minor
Package:
@storybook/react
Ecosystem:
npm
Version Change:
6.5.16 → 9.1.3
Update Type:
Major
Package:
@storybook/addon-actions
Ecosystem:
npm
Version Change:
6.2.7 → 6.5.16
Update Type:
Minor
Package:
json5
Ecosystem:
npm
Version Change:
1.0.1 → 1.0.2
Update Type:
Patch
Package:
ansi-regex
Ecosystem:
npm
Version Change:
3.0.0 → 3.0.1
Update Type:
Patch
Package:
ip
Ecosystem:
npm
Version Change:
1.1.5 → removed
Package:
@storybook/addon-essentials
Ecosystem:
npm
Version Change:
6.5.16 → 8.6.14
Update Type:
Major
Package:
react-scripts
Ecosystem:
npm
Version Change:
4.0.1 → 5.0.1
Update Type:
Major
Package:
tmpl
Ecosystem:
npm
Version Change:
1.0.4 → 1.0.5
Update Type:
Patch
Package:
@storybook/preset-create-react-app
Ecosystem:
npm
Version Change:
3.1.7 → 9.1.3
Update Type:
Major
Security Advisories
Prototype Pollution in minimist
GHSA-xvch-5gv4-984h CVE-2021-44906 CRITICAL
Minimist prior to 1.2.6 and 0.2.4 is vulnerable to Prototype Pollution via file `index.js`, function `setKey()` (lines 69-95).
Actions
View on GitHub View Repository All Dependabot PRs
Technical Details
ID: 5616300
UUID: 2765004164
Node ID: PR_kwDOGMbvUs6kzp2E
Host: GitHub
Repository: cyrilf/css-for-js-mini-component-library
Merge State: Dirty