Data

Tools

Indexes

Applications

Experiments

Dependabot

An open index of dependabot pull requests across open source projects.

Bump the npm_and_yarn group across 1 directory with 26 updates

Open
Number: #1
Type: Pull Request
State: Open
Author: dependabot[bot] dependabot[bot]
Association: None
Comments: 0
Created: May 10, 2025 at 10:07 PM UTC
(4 months ago)
Updated: May 10, 2025 at 10:07 PM UTC
(4 months ago)
Labels:
dependencies javascript
Description:

Bumps the npm_and_yarn group with 20 updates in the / directory:

Package From To
@grpc/grpc-js 1.9.13 1.13.3
@nestjs/common 10.3.0 10.4.16
vite 5.0.10 5.4.19
@babel/runtime 7.23.6 7.27.1
path-to-regexp 0.1.7 8.2.0
@nestjs/core 10.3.0 10.4.17
cross-spawn 5.1.0 7.0.6
@swc/cli 0.1.63 0.7.5
axios 0.21.4 removed
pm2 5.3.0 5.4.3
body-parser 1.20.1 1.20.3
@nestjs/platform-express 10.3.0 10.4.17
braces 3.0.2 3.0.3
ip 1.1.8 removed
pac-resolver 7.0.0 7.0.1
socks 2.7.1 2.8.4
micromatch 4.0.5 4.0.8
systeminformation 5.21.22 5.25.11
ws 7.4.6 7.5.10
@pm2/agent 2.0.3 2.0.4

Updates @grpc/grpc-js from 1.9.13 to 1.13.3

Release notes

Sourced from @​grpc/grpc-js's releases.

@​grpc/grpc-js 1.13.3

  • Disable Nagle's algorithm (#2936)
  • Avoid calling http2.getDefaultSettings (#2937)

@​grpc/grpc-js 1.13.2

  • Fix a bug that caused clients to be unable to connect through local proxies (#2933)

@​grpc/grpc-js 1.13.1

  • Fix a bug that caused the rejectUnauthorized channel credentials option to be handled incorrectly (#2926)
  • Fix a bug that caused the client to never send retries if any retryThrottling config was set (#2927)
  • Fix a bug that caused clients to incorrectly send retries if the feature was disabled by a channel option and a retry config was provided (#2927)

@​grpc/grpc-js-xds 1.13.0

@​grpc/grpc-js 1.13.0

Changelog

  • Add support for channel option grpc-node.flow_control_window to control HTTP/2 flow control window size (#2864 contributed by @​rickihastings)
  • Show meaningful error messages more consistently when requests fail (#2868)
  • Add support for CIDR blocks in no_proxyenvironment variable (#2876 contributed by @​melkouri)
  • Fix a bug that caused server interceptor sendMetadata methods to not be called if the server interceptor did not explicitly send metadata (#2897)
  • Fix IPv6-mapped IPv4 address parsing in channelz, and represent them as IPv4 addresses (#2909)

Experimental API changes

Added:

  • SecureConnector
  • SecureConnectResult
  • SUBCHANNEL_ARGS_EXCLUDE_KEY_PREFIX
  • Server#experimentalRegisterListenerToChannelz protected method
  • ServerexperimentalUnregisterListenerFromChannelz protected method
  • Server#experimentalCreateConnectionInjectorWithChannelzRef protected method

Modified:

  • LoadBalancer: Removed the ChannelCredentials constructor argument
  • LoadBalancer: Removed the ChannelOptions constructor argument
  • LoadBalancer#updateAddressList: Replaced the attributes argument with one of type ChannelOptions.
  • ChannelControlHelper#createSubchannel: Removed the ChannelCredentials argument
  • LeafLoadBalancer: Removed the ChannelCredentials constructor argument

@​grpc/grpc-js@​1.12.6

  • Allow garbage collection of IDLE channels (#2896)

@​grpc/grpc-js 1.12.5

... (truncated)

Commits
  • 863a81a Merge pull request #2940 from murgatroid99/grpc-js_1.13.3
  • 75a96ec grpc-js: Bump to 1.13.3
  • 07486d8 Merge pull request #2937 from murgatroid99/grpc-js_avoid_getDefaultSettings
  • 6f916c9 Merge pull request #2936 from murgatroid99/grpc-js_disable_nagle
  • 482006e grpc-js: Avoid calling http2.getDefaultSettings
  • 6168fe8 grpc-js: Disable Nagle's Algorithm
  • 9652680 Merge pull request #2933 from murgatroid99/grpc-js_channel_options_fix
  • bdcbdf4 grpc-js: Consistently reference the same options object in the channel constr...
  • b937786 Merge pull request #2928 from murgatroid99/grpc-js_1.13.1
  • 2bb7eae grpc-js: Bump to 1.13.1
  • Additional commits viewable in compare view

Updates @nestjs/common from 10.3.0 to 10.4.16

Release notes

Sourced from @​nestjs/common's releases.

v10.4.16

What's Changed

Full Changelog: https://github.com/nestjs/nest/compare/v10.4.15...v10.4.16

v10.4.15 (2024-12-09)

Dependencies

v10.4.13 (2024-12-03)

Bug fixes

  • common
    • #14256 chore(common): Add type declaration for RawBody decorator with pipes (@​sapenlei)

Dependencies

Committers: 3

v10.4.12 (2024-11-29)

Bug fixes

Dependencies

... (truncated)

Commits
  • 6c8aec6 chore(@​nestjs) publish v10.4.16 release
  • 2b9e132 chore: update outdated tests, make file-type optional
  • cb0d650 chore: remove duplicate packages
  • 6196ab2 Merge branch 'Chathula-fix-nestjs-common-mime-validator'
  • 0ac7959 chore: minor tweaks
  • 312a54a Update packages/common/pipes/file/file-type.validator.ts
  • a28fc03 refactor(common): move back file type validator options type
  • 07b4b38 refactor(common): move file-type package to peer dependencies
  • 0b7af8a refactor(common): refactor code to use simple eval
  • 6953b7a fix(common): used eval import
  • Additional commits viewable in compare view

Updates vite from 5.0.10 to 5.4.19

Release notes

Sourced from vite's releases.

v5.4.19

Please refer to CHANGELOG.md for details.

v5.4.18

Please refer to CHANGELOG.md for details.

v5.4.17

Please refer to CHANGELOG.md for details.

v5.4.16

Please refer to CHANGELOG.md for details.

v5.4.15

Please refer to CHANGELOG.md for details.

v5.4.14

Please refer to CHANGELOG.md for details.

v5.4.13

Please refer to CHANGELOG.md for details.

v5.4.12

This version contains a breaking change due to security fixes. See https://github.com/vitejs/vite/security/advisories/GHSA-vg6x-rcgg-rjx6 for more details.

Please refer to CHANGELOG.md for details.

v5.4.11

Please refer to CHANGELOG.md for details.

v5.4.10

Please refer to CHANGELOG.md for details.

v5.4.9

Please refer to CHANGELOG.md for details.

v5.4.8

Please refer to CHANGELOG.md for details.

v5.4.7

Please refer to CHANGELOG.md for details.

v5.4.6

Please refer to CHANGELOG.md for details.

plugin-legacy@5.4.3

Please refer to CHANGELOG.md for details.

v5.1.8

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

5.4.19 (2025-04-30)

5.4.18 (2025-04-10)

5.4.17 (2025-04-03)

5.4.16 (2025-03-31)

5.4.15 (2025-03-24)

5.4.14 (2025-01-21)

5.4.13 (2025-01-20)

5.4.12 (2025-01-20)

  • fix!: check host header to prevent DNS rebinding attacks and introduce server.allowedHosts (9da4abc)
  • fix!: default server.cors: false to disallow fetching from untrusted origins (dfea38f)
  • fix: verify token for HMR WebSocket connection (b71a5c8)
  • chore: add deps update changelog (ecd2375)

... (truncated)

Commits

Updates @babel/runtime from 7.23.6 to 7.27.1

Release notes

Sourced from @​babel/runtime's releases.

v7.27.1 (2025-04-30)

Thanks @​kermanx and @​woaitsAryan for your first PRs!

:eyeglasses: Spec Compliance

:bug: Bug Fix

  • babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions, babel-traverse
  • babel-helper-wrap-function, babel-plugin-transform-async-to-generator
  • babel-helper-remap-async-to-generator, babel-plugin-transform-async-to-generator
  • babel-helper-fixtures, babel-parser
  • babel-generator, babel-parser
    • #17226 Fill optional AST properties when both estree and typescript parser plugin are enabled (Part 2) (@​JLHwung)
  • babel-parser
    • #17224 Fill optional AST properties when both estree and typescript parser plugin are enabled (Part 1) (@​JLHwung)
    • #17080 Fix start of TSParameterProperty (@​JLHwung)
  • babel-compat-data, babel-preset-env
  • babel-traverse
  • babel-generator

:nail_care: Polish

  • babel-plugin-bugfix-v8-spread-parameters-in-optional-chaining, babel-plugin-proposal-decorators, babel-plugin-transform-arrow-functions, babel-plugin-transform-class-properties, babel-plugin-transform-destructuring, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-chaining, babel-plugin-transform-parameters, babel-traverse

:house: Internal

  • babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • babel-compat-data, babel-preset-env
  • babel-compat-data, babel-standalone
  • babel-register
  • babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-regenerator, babel-preset-env, babel-runtime-corejs3
  • All packages

... (truncated)

Changelog

Sourced from @​babel/runtime's changelog.

v7.27.1 (2025-04-30)

:eyeglasses: Spec Compliance

:bug: Bug Fix

  • babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions, babel-traverse
  • babel-helper-wrap-function, babel-plugin-transform-async-to-generator
  • babel-helper-remap-async-to-generator, babel-plugin-transform-async-to-generator
  • babel-helper-fixtures, babel-parser
  • babel-generator, babel-parser
    • #17226 Fill optional AST properties when both estree and typescript parser plugin are enabled (Part 2) (@​JLHwung)
  • babel-parser
    • #17224 Fill optional AST properties when both estree and typescript parser plugin are enabled (Part 1) (@​JLHwung)
    • #17080 Fix start of TSParameterProperty (@​JLHwung)
  • babel-compat-data, babel-preset-env
  • babel-traverse
  • babel-generator

:nail_care: Polish

  • babel-plugin-bugfix-v8-spread-parameters-in-optional-chaining, babel-plugin-proposal-decorators, babel-plugin-transform-arrow-functions, babel-plugin-transform-class-properties, babel-plugin-transform-destructuring, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-chaining, babel-plugin-transform-parameters, babel-traverse

:house: Internal

  • babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • babel-compat-data, babel-preset-env
  • babel-compat-data, babel-standalone
  • Other
  • babel-register
  • babel-cli, babel-compat-data, babel-core, babel-generator, babel-helper-compilation-targets, babel-helper-fixtures, babel-helper-module-imports, babel-helper-module-transforms, babel-helper-plugin-test-runner, babel-helper-transform-fixture-test-runner, babel-helpers, babel-node, babel-parser, babel-plugin-transform-modules-amd, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-systemjs, babel-plugin-transform-modules-umd, babel-plugin-transform-react-display-name, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-plugin-transform-typeof-symbol, babel-plugin-transform-typescript, babel-preset-env, babel-register, babel-standalone, babel-types
  • babel-plugin-transform-regenerator

... (truncated)

Commits

Updates path-to-regexp from 0.1.7 to 8.2.0

Release notes

Sourced from path-to-regexp's releases.

8.2.0

Fixed

  • Allowing path-to-regexp to run on older browsers by targeting ES2015
    • Target ES2015 5969033
      • Also saved 0.22kb (10%!) by removing the private class field down level
    • Remove s flag from regexp 51dbd45

https://github.com/pillarjs/path-to-regexp/compare/v8.1.0...v8.2.0

v8.1.0

Added

  • Adds pathToRegexp method back for generating a regex
  • Adds stringify method for converting TokenData into a path string

https://github.com/pillarjs/path-to-regexp/compare/v8.0.0...v8.1.0

Simpler API

Heads up! This is a fairly large change (again) and I need to apologize in advance. If I foresaw what this version would have ended up being I would not have released version 7. A longer blog post and explanation will be incoming this week, but the pivot has been due to work on Express.js v5 and this will the finalized syntax used in Express moving forward.

Edit: The post is out - https://blakeembrey.com/posts/2024-09-web-redos/

Added

  • Adds key names to wildcards using *name syntax, aligns with : behavior but using an asterisk instead

Changed

  • Removes group suffixes of ?, +, and * - only optional exists moving forward (use wildcards for +, {*foo} for *)
  • Parameter names follow JS identifier rules and allow unicode characters

Added

  • Parameter names can now be quoted, e.g. :"foo-bar"
  • Match accepts an array of values, so the signature is now string | TokenData | Array<string | TokenData>

Removed

  • Removes loose mode
  • Removes regular expression overrides of parameters

https://github.com/pillarjs/path-to-regexp/compare/v7.1.0...v8.0.0

Support array inputs (again)

Added

  • Support array inputs for match and pathToRegexp 3fdd88f

https://github.com/pillarjs/path-to-regexp/compare/v7.1.0...v7.2.0

... (truncated)

Changelog

Sourced from path-to-regexp's changelog.

Moved to GitHub Releases

3.0.0 / 2019-01-13

  • Always use prefix character as delimiter token, allowing any character to be a delimiter (e.g. /:att1-:att2-:att3-:att4-:att5)
  • Remove partial support, prefer escaping the prefix delimiter explicitly (e.g. \\/(apple-)?icon-:res(\\d+).png)

2.4.0 / 2018-08-26

  • Support start option to disable anchoring from beginning of the string

2.3.0 / 2018-08-20

  • Use delimiter when processing repeated matching groups (e.g. foo/bar has no prefix, but has a delimiter)

2.2.1 / 2018-04-24

  • Allow empty string with end: false to match both relative and absolute paths

2.2.0 / 2018-03-06

  • Pass token as second argument to encode option (e.g. encode(value, token))

2.1.0 / 2017-10-20

  • Handle non-ending paths where the final character is a delimiter
    • E.g. /foo/ before required either /foo/ or /foo// to match in non-ending mode

2.0.0 / 2017-08-23

  • New option! Ability to set endsWith to match paths like /test?query=string up to the query string
  • New option! Set delimiters for specific characters to be treated as parameter prefixes (e.g. /:test)
  • Remove isarray dependency
  • Explicitly handle trailing delimiters instead of trimming them (e.g. /test/ is now treated as /test/ instead of /test when matching)
  • Remove overloaded keys argument that accepted options
  • Remove keys list attached to the RegExp output
  • Remove asterisk functionality (it's a real pain to properly encode)
  • Change tokensToFunction (e.g. compile) to accept an encode function for pretty encoding (e.g. pass your own implementation)

1.7.0 / 2016-11-08

  • Allow a delimiter option to be passed in with tokensToRegExp which will be used for "non-ending" token match situations

1.6.0 / 2016-10-03

  • Populate RegExp.keys when using the tokensToRegExp method (making it consistent with the main export)
  • Allow a delimiter option to be passed in with parse
  • Updated TypeScript definition with Keys and Options updated

1.5.3 / 2016-06-15

... (truncated)

Commits

Updates @nestjs/core from 10.3.0 to 10.4.17

Release notes

Sourced from @​nestjs/core's releases.

v10.4.16

What's Changed

Full Changelog: https://github.com/nestjs/nest/compare/v10.4.15...v10.4.16

v10.4.15 (2024-12-09)

Dependencies

v10.4.13 (2024-12-03)

Bug fixes

  • common
    • #14256 chore(common): Add type declaration for RawBody decorator with pipes (@​sapenlei)

Dependencies

Committers: 3

v10.4.12 (2024-11-29)

Bug fixes

Dependencies

... (truncated)

Commits

Updates cross-spawn from 5.1.0 to 7.0.6

Changelog

Sourced from cross-spawn's changelog.

7.0.6 (2024-11-18)

Bug Fixes

  • update cross-spawn version to 7.0.5 in package-lock.json (f700743)

7.0.5 (2024-11-07)

Bug Fixes

  • fix escaping bug introduced by backtracking (640d391)

7.0.4 (2024-11-07)

Bug Fixes

7.0.3 (2020-05-25)

Bug Fixes

  • detect path key based on correct environment (#133) (159e7e9)

7.0.2 (2020-04-04)

Bug Fixes

  • fix worker threads in Node >=11.10.0 (#132) (6c5b4f0)

7.0.1 (2019-10-07)

Bug Fixes

7.0.0 (2019-09-03)

⚠ BREAKING CHANGES

  • drop support for Node.js < 8

  • drop support for versions below Node.js 8 (#125) (16feb53)

... (truncated)

Commits
  • 77cd97f chore(release): 7.0.6
  • 6717de4 chore: upgrade standard-version
  • f700743 fix: update cross-spawn version to 7.0.5 in package-lock.json
  • 9a7e3b2 chore: fix build status badge
  • 0852683 chore(release): 7.0.5
  • 640d391 fix: fix escaping bug introduced by backtracking
  • bff0c87 chore: remove codecov
  • a7c6abc chore: replace travis with github workflows
  • 9b9246e chore(release): 7.0.4
  • 5ff3a07 fix: disable regexp backtracking (#160)
  • Additional commits viewable in compare view

Updates @swc/cli from 0.1.63 to 0.7.5

Commits

Removes axios

Updates pm2 from 5.3.0 to 5.4.3

Release notes

Sourced from <...

Description has been truncated

Pull Request Statistics
Commits:
1
Files Changed:
7
Additions:
+3368
Deletions:
-2325
Package Dependencies
Package:
axios
Ecosystem:
npm
Version Change:
0.21.4 → removed
Package:
@babel/runtime
Ecosystem:
npm
Version Change:
7.23.6 → 7.27.1
Update Type:
Minor
Package:
cross-spawn
Ecosystem:
npm
Version Change:
5.1.0 → 7.0.6
Update Type:
Major
Package:
vite
Ecosystem:
npm
Version Change:
5.0.10 → 5.4.19
Update Type:
Minor
Package:
pm2
Ecosystem:
npm
Version Change:
5.3.0 → 5.4.3
Update Type:
Minor
Package:
ws
Ecosystem:
npm
Version Change:
7.4.6 → 7.5.10
Update Type:
Minor
Package:
braces
Ecosystem:
npm
Version Change:
3.0.2 → 3.0.3
Update Type:
Patch
Package:
micromatch
Ecosystem:
npm
Version Change:
4.0.5 → 4.0.8
Update Type:
Patch
Package:
@nestjs/common
Ecosystem:
npm
Version Change:
10.3.0 → 10.4.16
Update Type:
Minor
Package:
path-to-regexp
Ecosystem:
npm
Version Change:
0.1.7 → 8.2.0
Update Type:
Major
Package:
ip
Ecosystem:
npm
Version Change:
1.1.8 → removed
Package:
@nestjs/platform-express
Ecosystem:
npm
Version Change:
10.3.0 → 10.4.17
Update Type:
Minor
Package:
body-parser
Ecosystem:
npm
Version Change:
1.20.1 → 1.20.3
Update Type:
Patch
Package:
@nestjs/core
Ecosystem:
npm
Version Change:
10.3.0 → 10.4.17
Update Type:
Minor
Package:
socks
Ecosystem:
npm
Version Change:
2.7.1 → 2.8.4
Update Type:
Minor
Package:
@grpc/grpc-js
Ecosystem:
npm
Version Change:
1.9.13 → 1.13.3
Update Type:
Minor
Package:
@swc/cli
Ecosystem:
npm
Version Change:
0.1.63 → 0.7.5
Update Type:
Minor
Package:
pac-resolver
Ecosystem:
npm
Version Change:
7.0.0 → 7.0.1
Update Type:
Patch
Package:
systeminformation
Ecosystem:
npm
Version Change:
5.21.22 → 5.25.11
Update Type:
Minor
Package:
@pm2/agent
Ecosystem:
npm
Version Change:
2.0.3 → 2.0.4
Update Type:
Patch
Security Advisories
Websites were able to send any requests to the development server and read the response in vite
GHSA-vg6x-rcgg-rjx6 CVE-2025-24010 MODERATE
### Summary Vite allowed any websites to send any requests to the development server and read the response due to default CORS settings and lack of validation on the Origin header for WebSocket con...
Actions
View on GitHub View Repository All Dependabot PRs
Technical Details
ID: 149263
UUID: 2511765077
Node ID: PR_kwDOLE18jc6Vtn5V
Host: GitHub
Repository: ogbcode/turbo-nest-grpc-vite-react-ssr-tailwind-pwa-i18n-template
Merge State: Unknown