Data

Tools

Indexes

Applications

Experiments

Dependabot

An open index of dependabot pull requests across open source projects.

Bump the npm_and_yarn group across 3 directories with 15 updates

Open
Number: #15
Type: Pull Request
State: Open
Author: dependabot[bot] dependabot[bot]
Association: None
Comments: 0
Created: September 30, 2025 at 04:56 AM UTC
(2 days ago)
Updated: September 30, 2025 at 04:56 AM UTC
(2 days ago)
Labels:
dependencies javascript
Description:

Bumps the npm_and_yarn group with 15 updates in the / directory:

Package From To
gh-pages 3.2.3 5.0.0
next 13.4.13 14.2.32
cross-spawn 7.0.3 7.0.5
rollup 4.16.1 4.22.4
webpack 5.88.0 5.94.0
@adobe/css-tools 4.2.0 4.4.4
es5-ext 0.10.62 0.10.64
express 4.18.2 4.21.2
follow-redirects 1.15.2 1.15.11
markdown-to-jsx 7.3.2 7.7.13
nanoid 3.3.6 3.3.11
serialize-javascript 6.0.1 6.0.2
store2 2.14.2 2.14.4
tar-fs 2.1.1 2.1.4
undici 5.27.2 5.29.0

Bumps the npm_and_yarn group with 2 updates in the /tools/build directory: cross-spawn and rollup.
Bumps the npm_and_yarn group with 1 update in the /tools/storybook-addon directory: webpack.

Updates gh-pages from 3.2.3 to 5.0.0

Release notes

Sourced from gh-pages's releases.

v5.0.0

Potentially breaking change: the publish method now always returns a promise. Previously, it did not return a promise in some error cases. This should not impact most users.

Updates to the development dependencies required a minimum Node version of 14 for the tests. The library should still work on Node 12, but tests are no longer run in CI for version 12. A future major version of the library may drop support for version 12 altogether.

What's Changed

New Contributors

Full Changelog: https://github.com/tschaub/gh-pages/compare/v4.0.0...v5.0.0

v4.0.0

This release doesn't include any breaking changes, but due to updated development dependencies, tests are no longer run on Node 10.

What's Changed

Full Changelog: https://github.com/tschaub/gh-pages/compare/v3.2.3...v4.0.0

Changelog

Sourced from gh-pages's changelog.

v5.0.0

Potentially breaking change: the publish method now always returns a promise. Previously, it did not return a promise in some error cases. This should not impact most users.

Updates to the development dependencies required a minimum Node version of 14 for the tests. The library should still work on Node 12, but tests are no longer run in CI for version 12. A future major version of the library may drop support for version 12 altogether.

v4.0.0

This release doesn't include any breaking changes, but due to updated development dependencies, tests are no longer run on Node 10.

Commits
  • f729b97 5.0.0
  • 51534c7 Log changes
  • ace063b Merge pull request #438 from Vicropht/patch-1
  • 58e54be Merge pull request #459 from tschaub/dependabot/npm_and_yarn/async-3.2.4
  • 2189df3 Bump async from 2.6.4 to 3.2.4
  • 051846e Merge pull request #454 from tschaub/dependabot/npm_and_yarn/email-addresses-...
  • 5c91c67 Merge pull request #455 from tschaub/dependabot/github_actions/actions/setup-...
  • fe0ad83 Merge pull request #453 from tschaub/dependabot/github_actions/actions/checko...
  • b89287d Merge pull request #445 from Nezteb/patch-1
  • e890bd1 Bump email-addresses from 3.0.1 to 5.0.0
  • Additional commits viewable in compare view

Updates next from 13.4.13 to 14.2.32

Release notes

Sourced from next's releases.

v14.2.32

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • fix router handling when setting a location response header #82588

Credits

Huge thanks to @​ztanner for helping!

Commits

Updates cross-spawn from 7.0.3 to 7.0.5

Changelog

Sourced from cross-spawn's changelog.

7.0.5 (2024-11-07)

Bug Fixes

  • fix escaping bug introduced by backtracking (640d391)

7.0.4 (2024-11-07)

Bug Fixes

Commits
  • 0852683 chore(release): 7.0.5
  • 640d391 fix: fix escaping bug introduced by backtracking
  • bff0c87 chore: remove codecov
  • a7c6abc chore: replace travis with github workflows
  • 9b9246e chore(release): 7.0.4
  • 5ff3a07 fix: disable regexp backtracking (#160)
  • 9521e2d chore: fix tests in recent node js versions
  • 97ded39 chore: convert package lock
  • d52b6b9 chore: remove unused argument (#156)
  • 5d84384 chore: add travis jobs on ppc64le (#142)
  • Additional commits viewable in compare view

Updates rollup from 4.16.1 to 4.22.4

Release notes

Sourced from rollup's releases.

v4.22.4

4.22.4

2024-09-21

Bug Fixes

  • Fix a vulnerability in generated code that affects IIFE, UMD and CJS bundles when run in a browser context (#5671)

Pull Requests

v4.22.3

4.22.3

2024-09-21

Bug Fixes

  • Ensure that mutations in modules without side effects are observed while properly handling transitive dependencies (#5669)

Pull Requests

v4.22.2

4.22.2

2024-09-20

Bug Fixes

  • Revert fix for side effect free modules until other issues are investigated (#5667)

Pull Requests

v4.22.1

4.22.1

2024-09-20

Bug Fixes

  • Revert #5644 "stable chunk hashes" while issues are being investigated

Pull Requests

... (truncated)

Changelog

Sourced from rollup's changelog.

4.22.4

2024-09-21

Bug Fixes

  • Fix a vulnerability in generated code that affects IIFE, UMD and CJS bundles when run in a browser context (#5671)

Pull Requests

4.22.3

2024-09-21

Bug Fixes

  • Ensure that mutations in modules without side effects are observed while properly handling transitive dependencies (#5669)

Pull Requests

4.22.2

2024-09-20

Bug Fixes

  • Revert fix for side effect free modules until other issues are investigated (#5667)

Pull Requests

4.22.1

2024-09-20

Bug Fixes

  • Revert #5644 "stable chunk hashes" while issues are being investigated

Pull Requests

... (truncated)

Commits

Updates webpack from 5.88.0 to 5.94.0

Release notes

Sourced from webpack's releases.

v5.94.0

Bug Fixes

  • Added runtime condition for harmony reexport checked
  • Handle properly data/http/https protocols in source maps
  • Make bigint optimistic when browserslist not found
  • Move @​types/eslint-scope to dev deps
  • Related in asset stats is now always an array when no related found
  • Handle ASI for export declarations
  • Mangle destruction incorrect with export named default properly
  • Fixed unexpected asi generation with sequence expression
  • Fixed a lot of types

New Features

  • Added new external type "module-import"
  • Support webpackIgnore for new URL() construction
  • [CSS] @import pathinfo support

Security

  • Fixed DOM clobbering in auto public path

v5.93.0

Bug Fixes

  • Generate correct relative path to runtime chunks
  • Makes DefinePlugin quieter under default log level
  • Fixed mangle destructuring default in namespace import
  • Fixed consumption of eager shared modules for module federation
  • Strip slash for pretty regexp
  • Calculate correct contenthash for CSS generator options

New Features

  • Added the binary generator option for asset modules to explicitly keep source maps produced by loaders
  • Added the modern-module library value for tree shakable output
  • Added the overrideStrict option to override strict or non-strict mode for javascript modules

v5.92.1

Bug Fixes

  • Doesn't crash with an error when the css experiment is enabled and contenthash is used

v5.92.0

Bug Fixes

  • Correct tidle range's comutation for module federation
  • Consider runtime for pure expression dependency update hash
  • Return value in the subtractRuntime function for runtime logic

... (truncated)

Commits
  • eabf85d chore(release): 5.94.0
  • 955e057 security: fix DOM clobbering in auto public path
  • 9822387 test: fix
  • cbb86ed test: fix
  • 5ac3d7f fix: unexpected asi generation with sequence expression
  • 2411661 security: fix DOM clobbering in auto public path
  • b8c03d4 fix: unexpected asi generation with sequence expression
  • f46a03c revert: do not use heuristic fallback for "module-import"
  • 60f1898 fix: do not use heuristic fallback for "module-import"
  • 66306aa Revert "fix: module-import get fallback from externalsPresets"
  • Additional commits viewable in compare view

Updates @adobe/css-tools from 4.2.0 to 4.4.4

Changelog

Sourced from @​adobe/css-tools's changelog.

[4.4.4] - 2025-07-22

Changed

  • Switch from yarn to npm for package management
  • Switch from eslint to biome for code formatting and linting
  • Reformat codebase to comply with biome recommendations
  • Switch from webpack to rollup for bundling

Fixed

  • Fix module exports to ensure proper compatibility with bundlers
  • Add validation check to prevent future export issues

[4.4.3] - 2025-05-15

Security

  • Fix polynomial regular expression vulnerability on uncontrolled data
  • Refactor code to enable GitHub security static analysis

Performance

  • Improve parsing performance with minor optimizations
  • Replace regex patterns with string search (indexOf-based) for better performance

Added

  • Add new utility functions with comprehensive unit tests
  • Add improved formatting for CSS Grid template areas (#283 by @​jogibear9988)

Fixed

  • Fix TypeScript error with ConstructorParameters in Parcel bundler (#444)

[4.4.2] - 2025-02-12

Fixed

  • Fix regular expression for parsing quoted values in parentheses

[4.4.0] - 2024-06-05

Added

  • Add support for CSS @starting-style at-rule (#319)

[4.3.3] - 2024-01-24

Changed

  • Update package export configuration (#271)

[4.3.2] - 2023-11-28

Security

  • Fix ReDoS vulnerability with crafted CSS strings - CVE-2023-48631

Fixed

... (truncated)

Commits

Updates es5-ext from 0.10.62 to 0.10.64

Release notes

Sourced from es5-ext's releases.

0.10.64 (2024-02-27)

Bug Fixes

  • Revert update to postinstall script meant to fix Powershell issue, as it's a regression for some Linux terminals (c2e2bb9)

Comparison since last release

0.10.63 (2024-02-23)

Bug Fixes

  • Do not rely on problematic regex (3551cdd), addresses #201
  • Support ES2015+ function definitions in function#toStringTokens() (a52e957), addresses #021
  • Ensure postinstall script does not crash on Windows, fixes #181 (bf8ed79)

Maintenance Improvements

  • Simplify the manifest message (7855319)

Comparison since last release

Changelog

Sourced from es5-ext's changelog.

0.10.64 (2024-02-27)

Bug Fixes

  • Revert update to postinstall script meant to fix Powershell issue, as it's a regression for some Linux terminals (c2e2bb9)

0.10.63 (2024-02-23)

Bug Fixes

  • Do not rely on problematic regex (3551cdd), addresses #201
  • Support ES2015+ function definitions in function#toStringTokens() (a52e957), addresses #021
  • Ensure postinstall script does not crash on Windows, fixes #181 (bf8ed79)

Maintenance Improvements

  • Simplify the manifest message (7855319)
Commits
  • f76b03d chore: Release v0.10.64
  • 2881acd chore: Bump dependencies
  • c2e2bb9 fix: Revert update meant to fix Powershell issue, as it's a regression
  • 16f2b72 docs: Fix date in the changelog
  • de4e03c chore: Release v0.10.63
  • 3fd53b7 chore: Upgrade lint-staged to v13
  • bf8ed79 chore: Ensure postinstall script does not crash on Windows
  • 2cbbb07 chore: Bump dependencies
  • 22d0416 chore: Bump LICENSE year
  • a52e957 fix: Support ES2015+ function definitions in function#toStringTokens()
  • Additional commits viewable in compare view

Updates express from 4.18.2 to 4.21.2

Release notes

Sourced from express's releases.

4.21.2

What's Changed

Full Changelog: https://github.com/expressjs/express/compare/4.21.1...4.21.2

4.21.1

What's Changed

Full Changelog: https://github.com/expressjs/express/compare/4.21.0...4.21.1

4.21.0

What's Changed

New Contributors

Full Changelog: https://github.com/expressjs/express/compare/4.20.0...4.21.0

4.20.0

What's Changed

Important

  • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)
  • Remove link renderization in html while using res.redirect

Other Changes

... (truncated)

Changelog

Sourced from express's changelog.

4.21.2 / 2024-11-06

  • deps: path-to-regexp@0.1.12
    • Fix backtracking protection
  • deps: path-to-regexp@0.1.11
    • Throws an error on invalid path values

4.21.1 / 2024-10-08

4.21.0 / 2024-09-11

  • Deprecate res.location("back") and res.redirect("back") magic string
  • deps: serve-static@1.16.2
    • includes send@0.19.0
  • deps: finalhandler@1.3.1
  • deps: qs@6.13.0

4.20.0 / 2024-09-10

  • deps: serve-static@0.16.0
    • Remove link renderization in html while redirecting
  • deps: send@0.19.0
    • Remove link renderization in html while redirecting
  • deps: body-parser@0.6.0
    • add depth option to customize the depth level in the parser
    • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)
  • Remove link renderization in html while using res.redirect
  • deps: path-to-regexp@0.1.10
    • Adds support for named matching groups in the routes using a regex
    • Adds backtracking protection to parameters without regexes defined
  • deps: encodeurl@~2.0.0
    • Removes encoding of \, |, and ^ to align better with URL spec
  • Deprecate passing options.maxAge and options.expires to res.clearCookie
    • Will be ignored in v5, clearCookie will set a cookie with an expires in the past to instruct clients to delete the cookie

4.19.2 / 2024-03-25

  • Improved fix for open redirect allow list bypass

4.19.1 / 2024-03-20

  • Allow passing non-strings to res.location with new encoding handling checks

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by jonchurch, a new releaser for express since your current version.


Updates follow-redirects from 1.15.2 to 1.15.11

Commits
  • 21ef28a Release version 1.15.11 of the npm package.
  • 7c88135 Roll back tree shaking.
  • 6e389ba Release version 1.15.10 of the npm package.
  • 5bc496e Shake me up before you go-go.
  • 694d6b4 Bump minimist from 1.2.5 to 1.2.8
  • e4e55c7 Release version 1.15.9 of the npm package.
  • 31a1abf Attempt much more gentle detection.
  • d2aaa97 Fix url field.
  • 62558f0 Release version 1.15.8 of the npm package.
  • a8d1cee Return subtlety.
  • Additional commits viewable in compare view

Updates markdown-to-jsx from 7.3.2 to 7.7.13

Release notes

Sourced from markdown-to-jsx's releases.

v7.7.13

Patch Changes

  • da003e4: Fix exponential backtracking issue for unpaired inline delimiter sequences.

v7.7.12

Patch Changes

  • 4351ef5: Adjust text parsing to not split on double spaces unless followed by a newline.
  • 4351ef5: Special case detection of :shortcode: so the text processor doesn't break it into chunks, enables shortcode replacement via renderRule.

v7.7.11

Patch Changes

  • 4a692dc: Fixes the issue where link text containing multiple nested brackets is not parsed correctly.

    Before: [title[bracket1][bracket2]](https://github.com/quantizor/markdown-to-jsx/blob/HEAD/url) fails to parse as a link After: [title[bracket1][bracket2]](https://github.com/quantizor/markdown-to-jsx/blob/HEAD/url) correctly parses as a link

v7.7.10

Patch Changes

  • bf9dd3d: Unescape content intended for JSX attributes.

v7.7.9

+--------------------------+------------------------+-----------------------+
|                          │ simple markdown string │ large markdown string |
+--------------------------+------------------------+-----------------------+
| markdown-to-jsx (7.7.9)  │ 103,280 ops/sec        │ 403 ops/sec           |
+--------------------------+------------------------+-----------------------+
| markdown-to-jsx (7.7.8)  │ 101,922 ops/sec        │ 401 ops/sec           |
+--------------------------+------------------------+-----------------------+

Patch Changes

  • 95dda3e: Avoid creating unnecessary paragraphs inside of HTML.
  • 95dda3e: Fix HTML parser to avoid processing the inside of <pre> blocks.

v7.7.8

7.7.7 had a performance regression for very long input that has been resolved in 7.7.8, and then some.

+--------------------------+------------------------+-----------------------+
|                          │ simple markdown string │ large markdown string |
+--------------------------+------------------------+-----------------------+
| markdown-to-jsx (7.7.8)  │ 104,575 ops/sec        │ 386 ops/sec           |
+--------------------------+------------------------+-----------------------+
</tr></table>

... (truncated)

Changelog

Sourced from markdown-to-jsx's changelog.

7.7.13

Patch Changes

  • da003e4: Fix exponential backtracking issue for unpaired inline delimiter sequences.

7.7.12

Patch Changes

  • 4351ef5: Adjust text parsing to not split on double spaces unless followed by a newline.
  • 4351ef5: Special case detection of :shortcode: so the text processor doesn't break it into chunks, enables shortcode replacement via renderRule.

7.7.11

Patch Changes

  • 4a692dc: Fixes the issue where link text containing multiple nested brackets is not parsed correctly.

    Before: [title[bracket1][bracket2]](https://github.com/quantizor/markdown-to-jsx/blob/main/url) fails to parse as a link After: [title[bracket1][bracket2]](https://github.com/quantizor/markdown-to-jsx/blob/main/url) correctly parses as a link

7.7.10

Patch Changes

  • bf9dd3d: Unescape content intended for JSX attributes.

7.7.9

Patch Changes

  • 95dda3e: Avoid creating unnecessary paragraphs inside of HTML.
  • 95dda3e: Fix HTML parser to avoid processing the inside of <pre> blocks.

7.7.8

Patch Changes

  • db378c7: Implement early short-circuit for rules to avoid expensive throwaway work.
  • db378c7: Simpler fix that preserves existing performance.
  • db378c7: Various low-hanging minor performance enhancements by doing less work.
  • db378c7: Improve compression by inlining static RuleType entries when used in the codebase.

7.7.7

Patch Changes

  • 89c87e5: Handle spaces in text as a stop token to improve processing, also adapt paragraph detection to exclude non-atx compliant headings if that option is enabled.

... (truncated)

Commits

Updates nanoid from 3.3.6 to 3.3.11

Release notes

Sourced from nanoid's releases.

3.3.11

  • Fixed React Native support.

3.3.10

3.3.9

  • Reduced npm package size.
Changelog

Sourced from nanoid's changelog.

3.3.11

  • Fixed React Native support.

3.3.10

3.3.9

  • Reduced npm package size.

3.3.8

  • Fixed a way to break Nano ID by passing non-integer size (by @​myndzi).

3.3.7

  • Fixed node16 TypeScript support (by Saadi Myftija).
Commits

Updates serialize-javascript from 6.0.1 to 6.0.2

Release notes

Sourced from serialize-javascript's releases.

v6.0.2

  • fix: serialize URL string contents to prevent XSS (#173) f27d65d
  • Bump @​babel/traverse from 7.10.1 to 7.23.7 (#171) 02499c0
  • docs: update readme with URL support (#146) 0d88527
  • chore: update node version and lock file e2a3a91
  • fix typo (#164) 5a1fa64

https://github.com/yahoo/serialize-javascript/compare/v6.0.1...v6.0.2

Commits

Updates store2 from 2.14.2 to 2.14.4

Commits

Updates tar-fs from 2.1.1 to 2.1.4

Commits

Updates undici from 5.27.2 to 5.29.0

Description has been truncated

Pull Request Statistics
Commits:
1
Files Changed:
12
Additions:
+688
Deletions:
-579
Package Dependencies
Package:
tar-fs
Ecosystem:
npm
Version Change:
2.1.1 → 2.1.4
Update Type:
Patch
Package:
cross-spawn
Ecosystem:
npm
Version Change:
7.0.3 → 7.0.5
Update Type:
Patch
Package:
next
Ecosystem:
npm
Version Change:
13.4.13 → 14.2.32
Update Type:
Major
Package:
undici
Ecosystem:
npm
Version Change:
5.27.2 → 5.29.0
Update Type:
Minor
Package:
webpack
Ecosystem:
npm
Version Change:
5.88.0 → 5.94.0
Update Type:
Minor
Package:
serialize-javascript
Ecosystem:
npm
Version Change:
6.0.1 → 6.0.2
Update Type:
Patch
Package:
nanoid
Ecosystem:
npm
Version Change:
3.3.6 → 3.3.11
Update Type:
Patch
Package:
express
Ecosystem:
npm
Version Change:
4.18.2 → 4.21.2
Update Type:
Minor
Package:
store2
Ecosystem:
npm
Version Change:
2.14.2 → 2.14.4
Update Type:
Patch
Package:
es5-ext
Ecosystem:
npm
Version Change:
0.10.62 → 0.10.64
Update Type:
Patch
Package:
rollup
Ecosystem:
npm
Version Change:
4.16.1 → 4.22.4
Update Type:
Minor
Package:
follow-redirects
Ecosystem:
npm
Version Change:
1.15.2 → 1.15.11
Update Type:
Patch
Package:
@adobe/css-tools
Ecosystem:
npm
Version Change:
4.2.0 → 4.4.4
Update Type:
Minor
Package:
gh-pages
Ecosystem:
npm
Version Change:
3.2.3 → 5.0.0
Update Type:
Major
Package:
markdown-to-jsx
Ecosystem:
npm
Version Change:
7.3.2 → 7.7.13
Update Type:
Minor
Security Advisories
libwebp: OOB write in BuildHuffmanTable
GHSA-j7hp-h8jx-5ppr CVE-2023-4863 HIGH
Heap buffer overflow in libwebp allow a remote attacker to perform an out of bounds memory write via a crafted HTML page.
cookie accepts cookie name, path, and domain with out of bounds characters
GHSA-pxg6-pf52-xh8x CVE-2024-47764 LOW
### Impact The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. For example, `serialize("userName=<script>alert('XSS3')</script>; Max-Age=25920...
@adobe/css-tools Improper Input Validation and Inefficient Regular Expression Complexity
GHSA-prr3-c3m5-p7q2 CVE-2023-48631 MODERATE
### Impact @adobe/css-tools version 4.3.1 and earlier are affected by an Improper Input Validation vulnerability that could result in a denial of service while attempting to parse CSS. ### Patches...
Actions
View on GitHub View Repository All Dependabot PRs
Technical Details
ID: 8820227
UUID: 2872902748
Node ID: PR_kwDOKOsXk86rPQRc
Host: GitHub
Repository: dotcomrow/leafygreen-ui.github.io
Merge State: Unknown