Data

Tools

Indexes

Applications

Experiments

Dependabot

An open index of dependabot pull requests across open source projects.

Bump the npm_and_yarn group across 3 directories with 28 updates

Open
Number: #3
Type: Pull Request
State: Open
Author: dependabot[bot] dependabot[bot]
Association: None
Comments: 0
Created: May 14, 2025 at 07:14 PM UTC
(10 months ago)
Updated: May 14, 2025 at 07:14 PM UTC
(10 months ago)
Labels:
dependencies javascript
Description:

Bumps the npm_and_yarn group with 8 updates in the / directory:

Package From To
@babel/runtime 7.24.5 7.27.1
braces 3.0.2 3.0.3
cookie 0.5.0 0.7.2
next-auth 4.24.7 4.24.11
cross-spawn 7.0.3 7.0.6
micromatch 4.0.5 4.0.8
nanoid 3.3.7 3.3.11
next 14.2.3 15.3.2

Bumps the npm_and_yarn group with 6 updates in the /docs directory:

Package From To
cross-spawn 5.1.0 7.0.6
nanoid 3.3.7 3.3.11
next 14.2.3 14.2.26
pug 3.0.2 3.0.3
express 4.19.2 5.1.0
ws 8.16.0 8.18.2

Bumps the npm_and_yarn group with 13 updates in the /sweep_chat directory:

Package From To
@babel/runtime 7.24.5 7.27.1
cookie 0.5.0 0.7.2
next-auth 4.24.7 4.24.11
micromatch 4.0.5 4.0.8
nanoid 3.3.7 3.3.11
next 14.2.3 14.2.28
@babel/helpers 7.24.5 7.27.1
@octokit/endpoint 10.1.1 10.1.4
@octokit/plugin-paginate-rest 11.3.0 11.6.0
@octokit/request 9.1.1 9.2.3
@sentry/browser 8.2.1 8.55.0
@sentry/nextjs 8.2.1 8.55.0
axios 1.7.2 1.9.0

Updates @babel/runtime from 7.24.5 to 7.27.1

Release notes

Sourced from @​babel/runtime's releases.

v7.27.1 (2025-04-30)

Thanks @​kermanx and @​woaitsAryan for your first PRs!

:eyeglasses: Spec Compliance

:bug: Bug Fix

  • babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions, babel-traverse
  • babel-helper-wrap-function, babel-plugin-transform-async-to-generator
  • babel-helper-remap-async-to-generator, babel-plugin-transform-async-to-generator
  • babel-helper-fixtures, babel-parser
  • babel-generator, babel-parser
    • #17226 Fill optional AST properties when both estree and typescript parser plugin are enabled (Part 2) (@​JLHwung)
  • babel-parser
    • #17224 Fill optional AST properties when both estree and typescript parser plugin are enabled (Part 1) (@​JLHwung)
    • #17080 Fix start of TSParameterProperty (@​JLHwung)
  • babel-compat-data, babel-preset-env
  • babel-traverse
  • babel-generator

:nail_care: Polish

  • babel-plugin-bugfix-v8-spread-parameters-in-optional-chaining, babel-plugin-proposal-decorators, babel-plugin-transform-arrow-functions, babel-plugin-transform-class-properties, babel-plugin-transform-destructuring, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-chaining, babel-plugin-transform-parameters, babel-traverse

:house: Internal

  • babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • babel-compat-data, babel-preset-env
  • babel-compat-data, babel-standalone
  • babel-register
  • babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-regenerator, babel-preset-env, babel-runtime-corejs3
  • All packages

... (truncated)

Changelog

Sourced from @​babel/runtime's changelog.

v7.27.1 (2025-04-30)

:eyeglasses: Spec Compliance

:bug: Bug Fix

  • babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions, babel-traverse
  • babel-helper-wrap-function, babel-plugin-transform-async-to-generator
  • babel-helper-remap-async-to-generator, babel-plugin-transform-async-to-generator
  • babel-helper-fixtures, babel-parser
  • babel-generator, babel-parser
    • #17226 Fill optional AST properties when both estree and typescript parser plugin are enabled (Part 2) (@​JLHwung)
  • babel-parser
    • #17224 Fill optional AST properties when both estree and typescript parser plugin are enabled (Part 1) (@​JLHwung)
    • #17080 Fix start of TSParameterProperty (@​JLHwung)
  • babel-compat-data, babel-preset-env
  • babel-traverse
  • babel-generator

:nail_care: Polish

  • babel-plugin-bugfix-v8-spread-parameters-in-optional-chaining, babel-plugin-proposal-decorators, babel-plugin-transform-arrow-functions, babel-plugin-transform-class-properties, babel-plugin-transform-destructuring, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-chaining, babel-plugin-transform-parameters, babel-traverse

:house: Internal

  • babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • babel-compat-data, babel-preset-env
  • babel-compat-data, babel-standalone
  • Other
  • babel-register
  • babel-cli, babel-compat-data, babel-core, babel-generator, babel-helper-compilation-targets, babel-helper-fixtures, babel-helper-module-imports, babel-helper-module-transforms, babel-helper-plugin-test-runner, babel-helper-transform-fixture-test-runner, babel-helpers, babel-node, babel-parser, babel-plugin-transform-modules-amd, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-systemjs, babel-plugin-transform-modules-umd, babel-plugin-transform-react-display-name, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-plugin-transform-typeof-symbol, babel-plugin-transform-typescript, babel-preset-env, babel-register, babel-standalone, babel-types
  • babel-plugin-transform-regenerator

... (truncated)

Commits

Updates braces from 3.0.2 to 3.0.3

Commits

Updates cookie from 0.5.0 to 0.7.2

Release notes

Sourced from cookie's releases.

v0.7.2

Fixed

  • Fix object assignment of hasOwnProperty (#177) bc38ffd

https://github.com/jshttp/cookie/compare/v0.7.1...v0.7.2

0.7.1

Fixed

  • Allow leading dot for domain (#174)
    • Although not permitted in the spec, some users expect this to work and user agents ignore the leading dot according to spec
  • Add fast path for serialize without options, use obj.hasOwnProperty when parsing (#172)

https://github.com/jshttp/cookie/compare/v0.7.0...v0.7.1

0.7.0

https://github.com/jshttp/cookie/compare/v0.6.0...v0.7.0

0.6.0

  • Add partitioned option
Commits
Maintainer changes

This version was pushed to npm by blakeembrey, a new releaser for cookie since your current version.


Updates next-auth from 4.24.7 to 4.24.11

Commits
  • 6bca388 chore(release): bump version [skip ci]
  • c46fd4f chore(deps): allow react v19 as peer deps (#12352)
  • 3dfe5d5 chore: Update docusaurus.config.js
  • 0447db0 chore(v4): add sent.dm sponsor (#12172)
  • 5a5859a docs: Update options.md
  • 5ad7fb4 docs: Update options.md
  • c7ea50d chore(release): bump version [skip ci]
  • 490a033 fix: support AUTH_SECRET for compat with npx auth secret
  • 1e6be72 fix: functions that return promises must be async (#12105)
  • ddab3cc chore(release): bump version [skip ci]
  • Additional commits viewable in compare view

Updates cross-spawn from 7.0.3 to 7.0.6

Changelog

Sourced from cross-spawn's changelog.

7.0.6 (2024-11-18)

Bug Fixes

  • update cross-spawn version to 7.0.5 in package-lock.json (f700743)

7.0.5 (2024-11-07)

Bug Fixes

  • fix escaping bug introduced by backtracking (640d391)

7.0.4 (2024-11-07)

Bug Fixes

Commits
  • 77cd97f chore(release): 7.0.6
  • 6717de4 chore: upgrade standard-version
  • f700743 fix: update cross-spawn version to 7.0.5 in package-lock.json
  • 9a7e3b2 chore: fix build status badge
  • 0852683 chore(release): 7.0.5
  • 640d391 fix: fix escaping bug introduced by backtracking
  • bff0c87 chore: remove codecov
  • a7c6abc chore: replace travis with github workflows
  • 9b9246e chore(release): 7.0.4
  • 5ff3a07 fix: disable regexp backtracking (#160)
  • Additional commits viewable in compare view

Updates micromatch from 4.0.5 to 4.0.8

Release notes

Sourced from micromatch's releases.

4.0.8

Ultimate release that fixes both CVE-2024-4067 and CVE-2024-4068. We consider the issues low-priority, so even if you see automated scanners saying otherwise, don't be scared.

Changelog

Sourced from micromatch's changelog.

[4.0.8] - 2024-08-22

  • backported CVE-2024-4067 fix (from v4.0.6) over to 4.x branch

[4.0.7] - 2024-05-22

  • this is basically v4.0.5, with some README updates
  • it is vulnerable to CVE-2024-4067
  • Updated braces to v3.0.3 to avoid CVE-2024-4068
  • does NOT break API compatibility

[4.0.6] - 2024-05-21

  • Added hasBraces to check if a pattern contains braces.
  • Fixes CVE-2024-4067
  • BREAKS API COMPATIBILITY
  • Should be labeled as a major release, but it's not.
Commits
  • 8bd704e 4.0.8
  • a0e6841 run verb to generate README documentation
  • 4ec2884 Merge branch 'v4' into hauserkristof-feature/v4.0.8
  • 03aa805 Merge pull request #266 from hauserkristof/feature/v4.0.8
  • 814f5f7 lint
  • 67fcce6 fix: CHANGELOG about braces & CVE-2024-4068, v4.0.5
  • 113f2e3 fix: CVE numbers in CHANGELOG
  • d9dbd9a feat: updated CHANGELOG
  • 2ab1315 fix: use actions/setup-node@v4
  • 1406ea3 feat: rework test to work on macos with node 10,12 and 14
  • Additional commits viewable in compare view

Updates nanoid from 3.3.7 to 3.3.11

Release notes

Sourced from nanoid's releases.

3.3.11

  • Fixed React Native support.

3.3.10

3.3.9

  • Reduced npm package size.
Changelog

Sourced from nanoid's changelog.

3.3.11

  • Fixed React Native support.

3.3.10

3.3.9

  • Reduced npm package size.

3.3.8

  • Fixed a way to break Nano ID by passing non-integer size (by @​myndzi).
Commits

Updates next from 14.2.3 to 15.3.2

Release notes

Sourced from next's releases.

v15.3.2

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • backport: fix(turbopack): Store persistence of wrapped task on RawVc::LocalOutput (#78488) (#78883)
  • @​next/mdx: Use stable turbopack config options (#78880)
  • Fix react-compiler: Fix detection of interest (#78879)
  • Fix turbopack: Backport sourcemap bugfix (#78881)
  • [next-server] preserve rsc query for rsc redirects (#78876)
  • Update middleware public/static matching (#78875)

Credits

Huge thanks to @​ijjk, @​huozhi, @​kdy1, @​wbinnssmith, and @​bgw for helping!

v15.3.1

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • chore: Backport SWC-based RC optimization (#78260)
  • fix: bump image-size@1.2.1 (#78164)

Credits

Huge thanks to @​kdy1 and @​styfle for helping!

v15.3.1-canary.15

Core Changes

  • [Turbopack] refactor persistent caching from log based to cow approach: #76234

Misc Changes

  • fix(turbo-tasks-fs): Handle filesystem watcher rescan events: #78045

Credits

Huge thanks to @​bgw and @​sokra for helping!

v15.3.1-canary.14

Core Changes

  • Add graceful error boundary for bots requests: #78298
  • make sure eslint-plugin-next is built when running 'pnpm dev': #78305
  • Migrate pages API routes to handler interface: #78166

... (truncated)

Commits

Updates cross-spawn from 5.1.0 to 7.0.6

Changelog

Sourced from cross-spawn's changelog.

7.0.6 (2024-11-18)

Bug Fixes

  • update cross-spawn version to 7.0.5 in package-lock.json (f700743)

7.0.5 (2024-11-07)

Bug Fixes

  • fix escaping bug introduced by backtracking (640d391)

7.0.4 (2024-11-07)

Bug Fixes

Commits
  • 77cd97f chore(release): 7.0.6
  • 6717de4 chore: upgrade standard-version
  • f700743 fix: update cross-spawn version to 7.0.5 in package-lock.json
  • 9a7e3b2 chore: fix build status badge
  • 0852683 chore(release): 7.0.5
  • 640d391 fix: fix escaping bug introduced by backtracking
  • bff0c87 chore: remove codecov
  • a7c6abc chore: replace travis with github workflows
  • 9b9246e chore(release): 7.0.4
  • 5ff3a07 fix: disable regexp backtracking (#160)
  • Additional commits viewable in compare view

Updates nanoid from 3.3.7 to 3.3.11

Release notes

Sourced from nanoid's releases.

3.3.11

  • Fixed React Native support.

3.3.10

3.3.9

  • Reduced npm package size.
Changelog

Sourced from nanoid's changelog.

3.3.11

  • Fixed React Native support.

3.3.10

3.3.9

  • Reduced npm package size.

3.3.8

  • Fixed a way to break Nano ID by passing non-integer size (by @​myndzi).
Commits

Updates next from 14.2.3 to 14.2.26

Release notes

Sourced from next's releases.

v15.3.2

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • backport: fix(turbopack): Store persistence of wrapped task on RawVc::LocalOutput (#78488) (#78883)
  • @​next/mdx: Use stable turbopack config options (#78880)
  • Fix react-compiler: Fix detection of interest (#78879)
  • Fix turbopack: Backport sourcemap bugfix (#78881)
  • [next-server] preserve rsc query for rsc redirects (#78876)
  • Update middleware public/static matching (#78875)

Credits

Huge thanks to @​ijjk, @​huozhi, @​kdy1, @​wbinnssmith, and @​bgw for helping!

v15.3.1

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • chore: Backport SWC-based RC optimization (#78260)
  • fix: bump image-size@1.2.1 (#78164)

Credits

Huge thanks to @​kdy1 and @​styfle for helping!

v15.3.1-canary.15

Core Changes

  • [Turbopack] refactor persistent caching from log based to cow approach: #76234

Misc Changes

  • fix(turbo-tasks-fs): Handle filesystem watcher rescan events: #78045

Credits

Huge thanks to @​bgw and @​sokra for helping!

v15.3.1-canary.14

Core Changes

  • Add graceful error boundary for bots requests: #78298
  • make sure eslint-plugin-next is built when running 'pnpm dev': #78305
  • Migrate pages API routes to handler interface: #78166

... (truncated)

Commits

Updates pug from 3.0.2 to 3.0.3

Release notes

Sourced from pug's releases.

pug-code-gen@3.0.3

Bug Fixes

  • Validate templateName and globals are valid JavaScript identifiers to prevent possible remote code execution if un-trusted user input is passed to the compilation options (#3438)

pug@3.0.3

Bug Fixes

  • Update pug-code-gen with the following fix: (#3438)

    Validate templateName and globals are valid JavaScript identifiers to prevent possible remote code execution if un-trusted user input is passed to the compilation options

Commits

Updates dompurify from 3.0.8 to 3.2.5

Release notes

Sourced from dompurify's releases.

DOMPurify 3.2.5

  • Added a check to the mXSS detection regex to be more strict, thanks @​masatokinugawa
  • Added ESM type imports in source, removes patch function, thanks @​donmccurdy
  • Added script to verify various TypeScript configurations, thanks @​reduckted
  • Added more modern browsers to the Karma launchers list
  • Added Node 23.x to tested runtimes, removed Node 17.x
  • Fixed the generation of source maps, thanks @​reduckted
  • Fixed an unexpected behavior with ALLOWED_URI_REGEXP using the 'g' flag, thanks @​hhk-png
  • Fixed a few typos in the README file

DOMPurify 3.2.4

  • Fixed a conditional and config dependent mXSS-style bypass reported by @​nsysean
  • Added a new feature to allow specific hook removal, thanks @​davecardwell
  • Added purify.js and purify.min.js to exports, thanks @​Aetherinox
  • Added better logic in case no window object is president, thanks @​yehuya
  • Updated some dependencies called out by dependabot
  • Updated license files etc to show the correct year

DOMPurify 3.2.3

DOMPurify 3.2.2

  • Fixed a possible bypass in case a rather specific config for custom elements is set, thanks @​yaniv-git
  • Fixed several minor issues with the type definitions, thanks again @​reduckted
  • Fixed a minor issue with the types reference for trusted types, thanks @​reduckted
  • Fixed a minor problem with the template detection regex on some systems, thanks @​svdb99

DOMPurify 3.2.1

DOMPurify 3.2.0

DOMPurify 3.1.7

  • Fixed an issue with comment detection and possible bypasses with specific config settings, thanks @​masatokinugawa
  • Fixed several smaller typos in documentation and test & build files, thanks @​christianhg
  • Added better support for Angular compiler, thanks @​jeroen1602
  • Added several new attributes to HTML and SVG allow-list, thanks @​Gigabyte5671 and @​Rotzbua
  • Removed the foreignObject element from the list of HTML entry-points, thanks @​masatokinugawa
  • Bumped several dependencies to be more up to date

DOMPurify 3.1.6

  • Fixed an issue with the execution logic of attribute hooks to prevent bypasses, thanks @​kevin-mizu
  • Fixed an issue with element removal leading to uncaught errors through DOM Clobbering, thanks @​realansgar
  • Fixed a minor problem with the bower file pointing to the wrong dist path
  • Fixed several minor typos in docs, comments and comment blocks, thanks @​Rotzbua
  • Updated several development dependencies

... (truncated)

Commits
  • 7806004 Merge pull request #1082 from cure53/main
  • f14c22f chore: Preparing 3.2.5 release
  • c69d7a8 Merge pull request #1080 from hhk-png/main
  • fce40b5 chore: for lint
  • 59e8664 Merge branch 'cure53:main' into main
  • e62e3ef fix: Using ALLOWED_URI_REGEXP with the 'g' flag leads to incorrect results
  • b428788 Update README.md
  • 72c00db Merge branch 'main' of github.com:cure53/DOMPurify
  • 49882dc test: Added Node 23.x to tested runtimes, removed Node 17.x
  • 2e5fd64 Merge pull request #1078 from reduckted/fix-sourcemaps
  • Additional commits viewable in compare view

Updates express from 4.19.2 to 5.1.0

Release notes

Sourced from express's releases.

v5.1.0

What's Changed

Pull Request Statistics
Commits:
1
Files Changed:
5
Additions:
+4946
Deletions:
-2629
Package Dependencies
Package:
@babel/runtime
Ecosystem:
npm
Version Change:
7.24.5 → 7.27.1
Update Type:
Minor
Package:
cross-spawn
Ecosystem:
npm
Version Change:
7.0.3 → 7.0.6
Update Type:
Patch
Package:
next
Ecosystem:
npm
Version Change:
14.2.3 → 15.3.2
Update Type:
Major
Package:
nanoid
Ecosystem:
npm
Version Change:
3.3.7 → 3.3.11
Update Type:
Patch
Package:
braces
Ecosystem:
npm
Version Change:
3.0.2 → 3.0.3
Update Type:
Patch
Package:
micromatch
Ecosystem:
npm
Version Change:
4.0.5 → 4.0.8
Update Type:
Patch
Package:
cookie
Ecosystem:
npm
Version Change:
0.5.0 → 0.7.2
Update Type:
Minor
Package:
next-auth
Ecosystem:
npm
Version Change:
4.24.7 → 4.24.11
Update Type:
Patch
Security Advisories
Uncontrolled resource consumption in braces
GHSA-grv7-fg5c-xmjg CVE-2024-4068 HIGH
The NPM package `braces` fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends "imbalanced braces" as input, the...
Regular Expression Denial of Service (ReDoS) in micromatch
GHSA-952p-6rrq-rcjv CVE-2024-4067 MODERATE
The NPM package `micromatch` prior to version 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in `index.js` because the patter...
Actions
View on GitHub View Repository All Dependabot PRs
Technical Details
ID: 1037393
UUID: 2520146266
Node ID: PR_kwDONlH3fs6WNmFa
Host: GitHub
Repository: https-gitcom/swee
Merge State: Unknown