chore(deps): bump the npm_and_yarn group across 2 directories with 10 updates
Type: Pull Request
State: Open
![dependabot[bot]](https://github.com/dependabot.png)
Association: Contributor
Comments: 4
(18 days ago)
(6 days ago)
dependencies javascript
Bumps the npm_and_yarn group with 8 updates in the / directory:
Package | From | To |
---|---|---|
fastify | 4.29.0 |
4.29.1 |
undici | 6.20.1 |
6.21.2 |
vitest | 2.1.8 |
2.1.9 |
@babel/runtime | 7.26.0 |
7.28.3 |
pbkdf2 | 3.1.2 |
3.1.3 |
sha.js | 2.4.11 |
2.4.12 |
tmp | 0.2.3 |
0.2.5 |
vite | 5.4.11 |
5.4.19 |
Bumps the npm_and_yarn group with 3 updates in the /sdk directory: @babel/runtime, brace-expansion and @babel/helpers.
Updates fastify
from 4.29.0 to 4.29.1
Release notes
Sourced from fastify's releases.
v4.29.1
⚠️ Security Release ⚠️
Fix for "Invalid content-type parsing could lead to validation bypass" and CVE-2025-32442.
Full Changelog: https://github.com/fastify/fastify/compare/v4.29.0...v4.29.1
Commits
Updates undici
from 6.20.1 to 6.21.2
Release notes
Sourced from undici's releases.
v6.21.2
What's Changed
- fix(types): add missing DNS interceptor by
@slagiewka
in nodejs/undici#4024- [v6.x] fix wpts on windows by
@mcollina
in nodejs/undici#4093- Removed clients with unrecoverable errors from the Pool nodejs/undici#4088
New Contributors
@slagiewka
made their first contribution in nodejs/undici#4024Full Changelog: https://github.com/nodejs/undici/compare/v6.21.1...v6.21.2
v6.21.1
⚠️ Security Release ⚠️
Fixes CVE CVE-2025-22150 https://github.com/nodejs/undici/security/advisories/GHSA-c76h-2ccp-4975 (embargoed until 22-01-2025).
What's Changed
- fix(#3736): back-port 183f8e9 to v6.x by
@ggoodman
in nodejs/undici#3855- fix(#3817): send servername for SNI on TLS (#3821) [backport] by
@metcoder95
in nodejs/undici#3864- fix: sending formdata bodies with http2 (#3863) [backport] by
@metcoder95
in nodejs/undici#3866- [Backport v6.x] fix: Fixed the issue that there is no running request when http2 goaway by
@github-actions
in nodejs/undici#3877- types: [backport] Update return type of RetryCallback (#3851) by
@metcoder95
in nodejs/undici#3876Full Changelog: https://github.com/nodejs/undici/compare/v6.21.0...v6.21.1
v6.21.0
What's Changed
- [Backport v6.x] web: mark as uncloneable when possible (#3709) by
@jazelly
in nodejs/undici#3744- [Backport v6.x] fetch: fix content-encoding order by
@github-actions
in nodejs/undici#3764- [Backport v6.x] fix: handle undefined deref() of WeakRef(socket) by
@github-actions
in nodejs/undici#3822- [Backport v6.x] fix: range end is zero-indexed by
@github-actions
in nodejs/undici#3827Full Changelog: https://github.com/nodejs/undici/compare/v6.20.1...v6.21.0
Commits
b63d939
Bumped v6.21.2de1e4b8
[v6.x] fix wpts on windows (#4093)4e07dda
test: fix windows wpt (#4050)1333871
Removed clients with unrecoverable errors from the Pool (#4088)a0e76c7
fix(types): add missing DNS interceptor (#4024)e260e7b
Bumped v6.21.1c3acc60
Merge commit from fork2414bc9
Update return type of RetryCallback (#3851) (#3876)be8cd0a
[Backport v6.x] fix: Fixed the issue that there is no running request when ht...ee6176c
fix: sending formdata bodies with http2 (#3863) [backport] (#3866)- Additional commits viewable in compare view
Updates vitest
from 2.1.8 to 2.1.9
Release notes
Sourced from vitest's releases.
v2.1.9
This release includes security patches for:
- Browser mode serves arbitrary files | CVE-2025-24963
- Remote Code Execution when accessing a malicious website while Vitest API server is listening | CVE-2025-24964
🐞 Bug Fixes
- backport vitest-dev/vitest#7317 to v2 - by
@hi-ogawa
in vitest-dev/vitest#7318- (backport #7340 to v2) restrict served files from
/__screenshot-error
- by@hi-ogawa
in vitest-dev/vitest#7343View changes on GitHub
Commits
c9e59a0
chore: release v2.1.9e0fe1d8
fix: backport #7317 to v2 (#7318)- See full diff in compare view
Updates @babel/runtime
from 7.26.0 to 7.28.3
Release notes
Sourced from @babel/runtime
's releases.
v7.28.3 (2025-08-14)
:eyeglasses: Spec Compliance
babel-helper-create-class-features-plugin
,babel-plugin-proposal-decorators
,babel-plugin-transform-class-static-block
,babel-preset-env
- #17443 [static blocks] Do not inject new static fields after static code (
@nicolo-ribaudo
):bug: Bug Fix
babel-parser
:nail_care: Polish
babel-plugin-transform-regenerator
,babel-plugin-transform-runtime
- #17363 Do not save last yield in call in temp var (
@nicolo-ribaudo
):memo: Documentation
:house: Internal
:microscope: Output optimization
babel-plugin-proposal-destructuring-private
,babel-plugin-proposal-do-expressions
Committers: 5
- Babel Bot (
@babel-bot
)- Huáng Jùnliàng (
@JLHwung
)- Jam Balaya (
@JamBalaya56562
)- Nicolò Ribaudo (
@nicolo-ribaudo
)- easrng (
@easrng
)v7.28.2 (2025-07-24)
Thanks
@souhailaS
for your first PR!:bug: Bug Fix
babel-types
- #17445 [babel 7] Make
operator
param int.tsTypeOperator
optional (@nicolo-ribaudo
)babel-helpers
,babel-plugin-transform-async-generator-functions
,babel-plugin-transform-regenerator
,babel-preset-env
,babel-runtime-corejs3
- #17441 fix:
regeneratorDefine
compatibility with es5 strict mode (@liuxingbaoyu
)Committers: 4
- Babel Bot (
@babel-bot
)- Nicolò Ribaudo (
@nicolo-ribaudo
)- SOUHAILA SERBOUT (
@souhailaS
)@liuxingbaoyu
v7.28.1 (2025-07-12)
... (truncated)
Changelog
Sourced from @babel/runtime
's changelog.
v7.28.3 (2025-08-14)
:eyeglasses: Spec Compliance
babel-helper-create-class-features-plugin
,babel-plugin-proposal-decorators
,babel-plugin-transform-class-static-block
,babel-preset-env
- #17443 [static blocks] Do not inject new static fields after static code (
@nicolo-ribaudo
):bug: Bug Fix
babel-parser
:nail_care: Polish
babel-plugin-transform-regenerator
,babel-plugin-transform-runtime
- #17363 Do not save last yield in call in temp var (
@nicolo-ribaudo
):memo: Documentation
:house: Internal
:microscope: Output optimization
babel-plugin-proposal-destructuring-private
,babel-plugin-proposal-do-expressions
v7.28.2 (2025-07-24)
:bug: Bug Fix
babel-types
- #17445 [babel 7] Make
operator
param int.tsTypeOperator
optional (@nicolo-ribaudo
)babel-helpers
,babel-plugin-transform-async-generator-functions
,babel-plugin-transform-regenerator
,babel-preset-env
,babel-runtime-corejs3
- #17441 fix:
regeneratorDefine
compatibility with es5 strict mode (@liuxingbaoyu
)v7.28.1 (2025-07-12)
:bug: Bug Fix
babel-plugin-transform-async-generator-functions
,babel-plugin-transform-regenerator
- #17426 fix:
regenerator
correctly handlesthrow
outside oftry
(@liuxingbaoyu
):memo: Documentation
:leftwards_arrow_with_hook: Revert
babel-plugin-proposal-destructuring-private
,babel-plugin-proposal-do-expressions
,babel-types
v7.28.0 (2025-07-02)
:rocket: New Feature
babel-node
- #17147 Support top level await in node repl (
@liuxingbaoyu
)babel-types
... (truncated)
Commits
ef155f5
v7.28.3cac0ff4
v7.28.2f68ac51
chore: Avoid CITGM errors (#17382)baa4cb8
v7.27.67d06930
v7.27.45b9468d
Reduceregenerator
size more (#17287)cb78b5b
[babel 8] Do not replace globalregeneratorRuntime
references in regenerato...a0690e3
SplitregeneratorRuntime
into multiple helpers (#17238)da5e371
v7.27.3eebd3a0
v7.27.1- Additional commits viewable in compare view
Updates pbkdf2
from 3.1.2 to 3.1.3
Changelog
Sourced from pbkdf2's changelog.
v3.1.3 - 2025-06-20
Commits
- Only apps should have lockfiles
8b06730
- [lint] fix whitespace
9a76e2f
- [lint] fix parens/curlies/semis/etc
6fd84bf
- [meta] add
auto-changelog
796c38d
- [Tests] fix tests in node 17
3661fb0
- Revert "[Tests] fix tests in node < 3"
7431b57
- [Tests] fix tests in node < 3
eb9f97a
- [Fix] ensure unknown algorithms throw + known ones match node
26d4fd3
- [Tests] add GHA, always run nyc
513906a
- [lint] fix a few more rules
ab04da8
- [lint] switch to eslint
89694cf
- [Tests] add coverage
d0d534b
- [Refactor] use
to-buffer
e3102a8
- [readme] improve badges
fca0c9d
- [Tests] remove unused travis file
a2c7d93
- [meta] switch from
files
tonpmignore
7f31fbc
- [Tests] use .nycrc
8d628e8
- [Refactor] minor tweaks
fc61005
- [Deps] update
create-hmac
,safe-buffer
,sha.js
ae2a7d0
- [Fix] pin
create-hash
,ripemd160
due to breaking changese079968
- [Tests] fix tests in node 3
45fbcf3
- [meta] skip publishing benchmarks
19ea57b
- [Dev Deps] add missing peer dep
645e252
Commits
3e40827
v3.1.3e3102a8
[Refactor] useto-buffer
7431b57
Revert "[Tests] fix tests in node < 3"19ea57b
[meta] skip publishing benchmarksa2c7d93
[Tests] remove unused travis file645e252
[Dev Deps] add missing peer dep796c38d
[meta] addauto-changelog
d0d534b
[Tests] add coverage7f31fbc
[meta] switch fromfiles
tonpmignore
fca0c9d
[readme] improve badges- Additional commits viewable in compare view
Maintainer changes
This version was pushed to npm by ljharb, a new releaser for pbkdf2 since your current version.
Updates sha.js
from 2.4.11 to 2.4.12
Changelog
Sourced from sha.js's changelog.
v2.4.12 - 2025-07-01
Commits
- [eslint] switch to eslint
7acadfb
- [meta] add
auto-changelog
b46e711
- [eslint] fix package.json indentation
df9d521
- [Tests] migrate from travis to GHA
c43c64a
- [Fix] support multi-byte wide typed arrays
f2a258e
- [meta] reorder package.json
d8d77c0
- [meta] add
npmignore
35aec35
- [Tests] avoid console logs
73e33ae
- [Tests] fix tests run in batch
2629130
- [Tests] drop node requirement to 0.10
00c7f23
- [Dev Deps] update
buffer
,hash-test-vectors
,standard
,tape
,typedarray
92b5de5
- [Tests] drop node requirement to v3
9b5eca8
- [meta] set engines to
>= 4
807084c
- Only apps should have lockfiles
c72789c
- [Deps] update
inherits
,safe-buffer
5428cfc
- [Dev Deps] update
@ljharb/eslint-config
2dbe0aa
- update README to reflect LICENSE
8938256
- [Dev Deps] add missing peer dep
d528896
- [Dev Deps] remove unused
buffer
dep94ca724
Commits
eb4ea2f
v2.4.12d8d77c0
[meta] reorder package.jsondf9d521
[eslint] fix package.json indentation35aec35
[meta] addnpmignore
d528896
[Dev Deps] add missing peer depb46e711
[meta] addauto-changelog
94ca724
[Dev Deps] remove unusedbuffer
dep2dbe0aa
[Dev Deps] update@ljharb/eslint-config
73e33ae
[Tests] avoid console logsf2a258e
[Fix] support multi-byte wide typed arrays- Additional commits viewable in compare view
Maintainer changes
This version was pushed to npm by ljharb, a new releaser for sha.js since your current version.
Updates tmp
from 0.2.3 to 0.2.5
Commits
3d2fe38
Bump up the versione162828
Merge pull request #309 from fflorent/fix-tmp-dir-with-dirb847d2f
Fix use of tmp.dir() withdir
option08fa3ab
Update version1cf4ec5
Merge commit from fork188b25e
Fix GHSA-52f5-9888-hmc673b9fe4
Add test case for GHSA-52f5-9888-hmc6b8e2f29
Remove broken tests2892a02
Remove outdated URLf592318
Reformat package.json- Additional commits viewable in compare view
Updates vite
from 5.4.11 to 5.4.19
Release notes
Sourced from vite's releases.
v5.4.19
Please refer to CHANGELOG.md for details.
v5.4.18
Please refer to CHANGELOG.md for details.
v5.4.17
Please refer to CHANGELOG.md for details.
v5.4.16
Please refer to CHANGELOG.md for details.
v5.4.15
Please refer to CHANGELOG.md for details.
v5.4.14
Please refer to CHANGELOG.md for details.
v5.4.13
Please refer to CHANGELOG.md for details.
v5.4.12
This version contains a breaking change due to security fixes. See https://github.com/vitejs/vite/security/advisories/GHSA-vg6x-rcgg-rjx6 for more details.
Please refer to CHANGELOG.md for details.
Changelog
Sourced from vite's changelog.
5.4.19 (2025-04-30)
5.4.18 (2025-04-10)
- fix: backport #19830, reject requests with
#
in request-target (#19831) (823675b), closes #19830 #198315.4.17 (2025-04-03)
5.4.16 (2025-03-31)
5.4.15 (2025-03-24)
5.4.14 (2025-01-21)
- fix:
preview.allowedHosts
with specific values was not respected (#19246) (9df6e6b), closes #19246- fix: allow CORS from loopback addresses by default (#19249) (7d1699c), closes #19249
5.4.13 (2025-01-20)
5.4.12 (2025-01-20)
Commits
80a333a
release: v5.4.19766947e
fix: backport #19965, check static serve file inside sirv (#19966)731b77d
release: v5.4.18823675b
fix: backport #19830, reject requests with#
in request-target (#19831)0a2518a
release: v5.4.1784b2b46
fix: backport #19782, fs check with svg and relative paths (#19784)712cb71
release: v5.4.16b627c50
fix: backport #19761, fs check in transform middleware (#19762)9b0f4c8
release: v5.4.15807d7f0
fix: backport #19702, fs raw query with query separators (#19703)- Additional commits viewable in compare view
Updates @babel/runtime
from 7.23.2 to 7.28.3
Release notes
Sourced from @babel/runtime
's releases.
v7.28.3 (2025-08-14)
:eyeglasses: Spec Compliance
babel-helper-create-class-features-plugin
,babel-plugin-proposal-decorators
,babel-plugin-transform-class-static-block
,babel-preset-env
- #17443 [static blocks] Do not inject new static fields after static code (
@nicolo-ribaudo
):bug: Bug Fix
babel-parser
:nail_care: Polish
babel-plugin-transform-regenerator
,babel-plugin-transform-runtime
- #17363 Do not save last yield in call in temp var (
@nicolo-ribaudo
):memo: Documentation
:house: Internal
:microscope: Output optimization
babel-plugin-proposal-destructuring-private
,babel-plugin-proposal-do-expressions
Committers: 5
- Babel Bot (
@babel-bot
)- Huáng Jùnliàng (
@JLHwung
)- Jam Balaya (
@JamBalaya56562
)- Nicolò Ribaudo (
@nicolo-ribaudo
)- easrng (
@easrng
)v7.28.2 (2025-07-24)
Thanks
@souhailaS
for your first PR!:bug: Bug Fix
babel-types
- #17445 [babel 7] Make
operator
param int.tsTypeOperator
optional (@nicolo-ribaudo
)babel-helpers
,babel-plugin-transform-async-generator-functions
,babel-plugin-transform-regenerator
,babel-preset-env
,babel-runtime-corejs3
- #17441 fix:
regeneratorDefine
compatibility with es5 strict mode (@liuxingbaoyu
)Committers: 4
- Babel Bot (
@babel-bot
)- Nicolò Ribaudo (
@nicolo-ribaudo
)- SOUHAILA SERBOUT (
@souhailaS
)@liuxingbaoyu
v7.28.1 (2025-07-12)
... (truncated)
Changelog
Sourced from @babel/runtime
's changelog.
v7.28.3 (2025-08-14)
:eyeglasses: Spec Compliance
babel-helper-create-class-features-plugin
,babel-plugin-proposal-decorators
,babel-plugin-transform-class-static-block
,babel-preset-env
- #17443 [static blocks] Do not inject new static fields after static code (
@nicolo-ribaudo
):bug: Bug Fix
babel-parser
:nail_care: Polish
babel-plugin-transform-regenerator
,babel-plugin-transform-runtime
- #17363 Do not save last yield in call in temp var (
@nicolo-ribaudo
):memo: Documentation
:house: Internal
:microscope: Output optimization
babel-plugin-proposal-destructuring-private
,babel-plugin-proposal-do-expressions
v7.28.2 (2025-07-24)
:bug: Bug Fix
babel-types
- #17445 [babel 7] Make
operator
param int.tsTypeOperator
optional (@nicolo-ribaudo
)babel-helpers
,babel-plugin-transform-async-generator-functions
,babel-plugin-transform-regenerator
,babel-preset-env
,babel-runtime-corejs3
- #17441 fix:
regeneratorDefine
compatibility with es5 strict mode (@liuxingbaoyu
)v7.28.1 (2025-07-12)
:bug: Bug Fix
babel-plugin-transform-async-generator-functions
,babel-plugin-transform-regenerator
- #17426 fix:
regenerator
correctly handlesthrow
outside oftry
(@liuxingbaoyu
):memo: Documentation
:leftwards_arrow_with_hook: Revert
babel-plugin-proposal-destructuring-private
,babel-plugin-proposal-do-expressions
,babel-types
v7.28.0 (2025-07-02)
:rocket: New Feature
babel-node
- #17147 Support top level await in node repl (
@liuxingbaoyu
)babel-types
... (truncated)
Commits
ef155f5
v7.28.3cac0ff4
v7.28.2f68ac51
chore: Avoid CITGM errors (#17382)baa4cb8
v7.27.67d06930
v7.27.45b9468d
Reduceregenerator
size more (#17287)cb78b5b
[babel 8] Do not replace globalregeneratorRuntime
references in regenerato...a0690e3
SplitregeneratorRuntime
into multiple helpers (#17238)da5e371
v7.27.3eebd3a0
v7.27.1- Additional commits viewable in compare view
Updates brace-expansion
from 1.1.11 to 1.1.12
Release notes
Sourced from brace-expansion's releases.
v1.1.12
- pkg: publish on tag 1.x c460dbd
- fmt ccb8ac6
- Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) c3c73c8
https://github.com/juliangruber/brace-expansion/compare/v1.1.11...v1.1.12
Commits
Updates @babel/helpers
from 7.23.2 to 7.28.3
Release notes
Sourced from @babel/helpers
's releases.
v7.28.3 (2025-08-14)
:eyeglasses: Spec Compliance
babel-helper-create-class-features-plugin
,babel-plugin-proposal-decorators
,babel-plugin-transform-class-static-block
,babel-preset-env
- #17443 [static blocks] Do not inject new static fields after static code (
@nicolo-ribaudo
):bug: Bug Fix
babel-parser
:nail_care: Polish
babel-plugin-transform-regenerator
,babel-plugin-transform-runtime
- #17363 Do not save last yield in call in temp var (
@nicolo-ribaudo
):memo: Documentation
:house: Internal
:microscope: Output optimization
babel-plugin-proposal-destructuring-private
,babel-plugin-proposal-do-expressions
Committers: 5
- Babel Bot (
@babel-bot
)- Huáng Jùnliàng (
@JLHwung
)- Jam Balaya (
@JamBalaya56562
)- Nicolò Ribaudo (
@nicolo-ribaudo
)- easrng (
@easrng
)v7.28.2 (2025-07-24)
Thanks
@souhailaS
for your first PR!:bug: Bug Fix
babel-types
- #17445 [babel 7] Make
operator
param int.tsTypeOperator
optional (@nicolo-ribaudo
)babel-helpers
,babel-plugin-transform-async-generator-functions
,babel-plugin-transform-regenerator
,babel-preset-env
,babel-runtime-corejs3
- #17441 fix:
regeneratorDefine
compatibility with es5 strict mode (@liuxingbaoyu
)Committers: 4
- Babel Bot (
@babel-bot
)- Nicolò Ribaudo (
@nicolo-ribaudo
)- SOUHAILA SERBOUT (
@souhailaS
)@liuxingbaoyu
v7.28.1 (2025-07-12)
... (truncated)
Changelog
Sourced from @babel/helpers
's changelog.
v7.28.3 (2025-08-14)
:eyeglasses: Spec Compliance
babel-helper-create-class-features-plugin
,babel-plugin-proposal-decorators
,babel-plugin-transform-class-static-block
,babel-preset-env
- #17443 [static blocks] Do not inject new static fields after static code (
@nicolo-ribaudo
):bug: Bug Fix
babel-parser
:nail_care: Polish
babel-plugin-transform-regenerator
,babel-plugin-transform-runtime
- #17363 Do not save last yield in call in temp var (
@nicolo-ribaudo
):memo: Documentation
:house: Internal
Description has been truncated
PR-Codex overview
This PR focuses on updating dependencies in the
package.json
andyarn.lock
files, ensuring the project uses the latest versions of various libraries, enhancing stability and performance.Detailed summary
- Updated
fastify
from^4.28.1
to^4.29.1
- Updated
undici
from^6.20.1
to^6.21.2
- Updated
vitest
from^2.0.3
to^2.1.9
- Updated several Babel packages to versions
^7.27.1
and^7.28.x
- Updated
picocolors
to^1.1.1
- Updated
brace-expansion
to^1.1.12
- Updated
pbkdf2
to3.1.3
and adjusted dependencies accordingly✨ Ask PR-Codex anything about this PR by commenting with
/codex {your question}
Pull Request Statistics
0
0
+0
-0
Package Dependencies
Security Advisories
Websites were able to send any requests to the development server and read the response in vite
Vitest browser mode serves arbitrary files
Fastify vulnerable to invalid content-type parsing, which could lead to validation bypass
Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening
Use of Insufficiently Random Values in undici
tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter
Technical Details
ID: | 5616102 |
UUID: | 3343987851 |
Node ID: | PR_kwDOJEmqjs6kzpg_ |
Host: | GitHub |
Repository: | thirdweb-dev/engine |