Bump the npm_and_yarn group across 2 directories with 22 updates by dependabot[bot] · Pull Request #7 · Brunojoe1994/lit.dev

dependabot · 2026-06-18T01:43:14Z

Bumps the npm_and_yarn group with 18 updates in the / directory:

Package	From	To
markdown-it	`12.3.2`	`14.2.0`
rollup	`2.79.1`	`2.80.0`
koa	`2.13.4`	`3.1.2`
playwright	`1.28.1`	`1.61.0`
ws	`7.5.9`	`7.5.11`
ws	`8.14.2`	`8.21.0`
cross-spawn	`7.0.3`	`7.0.6`
@tootallnate/once	`1.1.2`	`removed`
braces	`3.0.2`	`3.0.3`
ejs	`3.1.9`	`3.1.10`
handlebars	`4.7.7`	`4.7.9`
ip	`1.1.8`	`removed`
liquidjs	`10.7.1`	`10.27.0`
micromatch	`4.0.5`	`4.0.8`
node-forge	`1.3.1`	`1.4.0`
path-to-regexp	`6.2.1`	`6.3.0`
pug	`3.0.2`	`3.0.4`
qs	`6.11.2`	`6.15.2`
undici	`5.21.0`	`6.24.1`

Bumps the npm_and_yarn group with 1 update in the /packages/lit-dev-content directory: markdown-it.

Updates markdown-it from 12.3.2 to 14.2.0

Changelog

Sourced from markdown-it's changelog.

[14.2.0] - 2026-05-24

Added

isPunctCharCode to utilities.

Fixed

Don't end HTML comment blocks on a blank line, #1155.

Properly recognize astral chars (surrogates) in delimiter scans for emphasis-like markers, #1072. Big thanks to @tats-u for his global efforts with improving CJK support.

Preserve unicode whitespaces when trimm headings/paragraphs, #1074.

More strict entities decode to avoid false positives ;, #1096.

Restore block parser state on fail in lheading rule, #1131.

Security

Fixed poor smartquotes perfomance on > 70k quotes in single block

Bumped linkify-it to 5.0.1 with fixed potential perfomance issues.

[14.1.1] - 2026-01-11

Security

Fixed regression from v13 in linkify inline rule. Specific patterns could cause high CPU use. Thanks to @ltduc147 for report.

[14.1.0] - 2024-03-19

Changed

Updated CM spec compatibility to 0.31.2, #1009.

Fixed

Fixed quadratic complexity when parsing references, #996.

Fixed quadratic output size with pathological user input in tables, #1000.

[14.0.0] - 2023-12-08

Changed

Drop ancient browsers support (use .fromCodePoint and other features).

Rewrite to ESM (including all plugins/deps). CJS fallback still available. No signatures changed, except markdown-it-emoji plugin.

Dropped dist/ folder from repo, build on package publish.

Set punicode.js as external dependency.

Fixed

Html tokens inside img alt are now rendered as their original text, #896.

Hardbreaks inside img alt are now rendered as newlines.

[13.0.2] - 2023-09-26

Security

Fixed crash/infinite loop caused by linkify inline rule, #957.

... (truncated)

Commits

829797a 14.2.0 released
9ce2087 Fix smartquotes perfomance
02e73b8 linkify-it bump
68cfb8c fix: don't end HTML comment blocks on a blank line (#1155)
1083137 Readme cleanup
97c7ca2 Update funding info
c471b55 Changelog update
7769621 isPunctChar => isPunctCharCode
aa2aa70 fix: always reset parentType in lheading rule (#1131)
59955f2 Polish PRs #1072, #1074
Additional commits viewable in compare view

Updates rollup from 2.79.1 to 2.80.0

Release notes

Sourced from rollup's releases.

v.2.79.2

2.79.2

2024-09-26

Bug Fixes

Fix a vulnerability in generated code that affects IIFE, UMD and CJS bundles when run in a browser context (#5671)

Pull Requests

#5671: Fix DOM Clobbering CVE (@lukastaegert)

Changelog

Sourced from rollup's changelog.

2.80.0

2026-02-22

Features

Throw when the generated bundle contains paths that would leave the output directory (#6277)

Pull Requests

#6277: Validate bundle stays within output dir (@lukastaegert)

2.79.2

2024-09-26

Bug Fixes

Resolve CVE-2024-43788 (#5677)

Pull Requests

#5677: resolve DOM Clobbering CVE-2024-43788 (backport to v2) (@fabianszabo)

Commits

d17ae15 2.80.0
d6dee5e Validate bundle stays within output dir (#6277)
c9bd03d 2.79.2
48aef33 fix: resolve DOM Clobbering CVE-2024-43788 (backport to v2) (#5677)
See full diff in compare view

Updates koa from 2.13.4 to 3.1.2

Release notes

Sourced from koa's releases.

v3.1.2

What's Changed

fix: typo in troubleshooting.md by @WuMingDao in koajs/koa#1916

build(deps-dev): bump qs from 6.14.0 to 6.14.1 by @dependabot[bot] in koajs/koa#1921

build(deps): bump http-errors from 2.0.0 to 2.0.1 by @dependabot[bot] in koajs/koa#1919

build(deps): bump mime-types from 3.0.1 to 3.0.2 by @dependabot[bot] in koajs/koa#1918

docs: use correct term "Server-Sent Events" in guide by @jtr860830 in koajs/koa#1920

build(deps): bump content-disposition from 0.5.4 to 1.0.1 by @dependabot[bot] in koajs/koa#1917

build(deps-dev): bump js-yaml from 4.1.0 to 4.1.1 by @dependabot[bot] in koajs/koa#1922

fix(security): Host Header Injection via ctx.hostname by @killagu GHSA-7gcc-r8m5-44qm

New Contributors

@WuMingDao made their first contribution in koajs/koa#1916

@jtr860830 made their first contribution in koajs/koa#1920

Full Changelog: koajs/koa@v3.1.1...v3.1.2

v3.1.1

What's Changed

fix: only original value destroy if the new value is not a stream by @yowainwright in koajs/koa#1914

Full Changelog: koajs/koa@v3.1.0...v3.1.1

v3.1.0

What's Changed

feat: fixes mem leak relating to issue-1834 by @yowainwright in koajs/koa#1893

fix: adds steam clean up by @yowainwright in koajs/koa#1910

Full Changelog: koajs/koa@v3.0.3...v3.1.0

v3.0.3

What's Changed

fix: normalize referer before redirect by @fengmk2 in koajs/koa#1908

Full Changelog: koajs/koa@v3.0.2...v3.0.3

v3.0.2

What's Changed

fix: fixes response.attachment behaviour leads to Content-Type Sniffing by @yowainwright in koajs/koa#1904

chore: use NPM trusted publishing with semver tag triggers by @Copilot in koajs/koa#1907

New Contributors

@Copilot made their first contribution in koajs/koa#1907

Full Changelog: koajs/koa@v3.0.1...v3.0.2

v3.0.1

... (truncated)

Changelog

Sourced from koa's changelog.

[!IMPORTANT] Moving forwards we are using the GitHub releases page at https://github.com/koajs/koa/releases in combination with np for publishing releases and their changelogs.

3.0.0-alpha.3 / 2025-02-11

fixes

Avoid redos on host and protocol getter

3.0.0-alpha.2 / 2024-11-04

breaking changes

Update http-errors to v2.0.0 #1486

ctx.throw now requires a format of ctx.throw(status, error, properties). See: https://www.npmjs.com/package/http-errors

Remove res.redirect('back'), add back() method to ctx #1115

Replace node querystring with URLSearchParams #1828

Remove obsolete createAsyncCtxStorageMiddleware #1817

features

Add support for web WHATWG #1830

updates

Update cookies to ~0.9.1 #1846

Update statuses to ^2.0.1

Update supertest to ^7.0.0 #1841

fixes

Fix exports.defaults in package.json #1630

Fix leaky handles in tests #1838

Fix body null checks #1814

Fix reformatting redirect URLs #1805 #1804

Fix passing ctx in error handler #1758

migrations

Migrate from jest to the native node test runner #1845

3.0.0-alpha.1 / 2023-04-12

fixes

[e98b8d1] - fix: can not get currentContext in error handler (#1758) (Gxkl <gxkl203@gmail.com>)

3.0.0-alpha.0 / 2023-01-02

Breaking Changes

... (truncated)

Commits

c5a52e0 3.1.2
55ab9ba Merge commit from fork
fecd464 build(deps-dev): bump js-yaml from 4.1.0 to 4.1.1 (#1922)
d2066cf build(deps): bump content-disposition from 0.5.4 to 1.0.1 (#1917)
8694a06 docs: use correct term "Server-Sent Events" in guide (#1920)
096682b build(deps): bump mime-types from 3.0.1 to 3.0.2 (#1918)
8215c2e build(deps): bump http-errors from 2.0.0 to 2.0.1 (#1919)
cfe5ec6 build(deps-dev): bump qs from 6.14.0 to 6.14.1 (#1921)
0a6afa5 fix: typo in troubleshooting.md (#1916)
2e52fb5 3.1.1
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for koa since your current version.

Updates playwright from 1.28.1 to 1.61.0

Release notes

Sourced from playwright's releases.

v1.61.0

🔑 WebAuthn passkeys

New Credentials virtual authenticator, available via browserContext.credentials, lets tests register passkeys and answer navigator.credentials.create() / navigator.credentials.get() ceremonies in the page — no real hardware key required, works in all browsers:
const context = await browser.newContext();
// Seed a passkey your backend provisioned for a test user.
await context.credentials.create('example.com', {
id: credentialId,
userHandle,
privateKey,
publicKey,
});
await context.credentials.install();
const page = await context.newPage();
await page.goto('https://example.com/login');
// The page's navigator.credentials.get() is answered with the seeded passkey.
You can also let the app register a passkey once in a setup test, read it back with credentials.get(), and seed it into later tests — see Credentials for details.

🗃️ Web Storage

New WebStorage API, available via page.localStorage and page.sessionStorage, reads and writes the page's storage for the current origin:
await page.localStorage.setItem('token', 'abc');
const token = await page.localStorage.getItem('token');
const items = await page.sessionStorage.items();
New APIs

Network

apiResponse.securityDetails() and apiResponse.serverAddr() mirror the browser-side response.securityDetails() and response.serverAddr().

Browser and Screencast

New option artifactsDir in browserType.connectOverCDP() controls where artifacts such as traces and downloads are stored when attached to an existing browser.

New option cursor in screencast.showActions() controls the cursor decoration rendered for pointer actions.

The onFrame callback in screencast.start() now receives a timestamp of when the frame was presented by the browser.

Test runner

The testOptions.video option now supports the same set of modes as trace: new 'on-all-retries', 'retain-on-first-failure' and 'retain-on-failure-and-retries' values. See the video modes table for which runs are recorded and kept in each mode.

Supported expect.soft.poll(...).

New fullConfig.argv — a snapshot of process.argv from the runner process, handy for reading custom arguments passed after the -- separator.

New fullConfig.failOnFlakyTests mirrors the config option, so reporters can explain why a flaky run failed.

testInfo.errors now lists each sub-error of an AggregateError as a separate entry.

... (truncated)

Commits

1cc5a90 cherry-pick(#41295): chore: PLAYWRIGHT_TRACING_NO_WEBSOCKET_FRAMES and PLAYWR...
a6772bd cherry-pick(#41280): Revert "fix(trace-viewer): add keyboard navigation to `N...
8133dcf cherry-pick(#41283): docs: add Ubuntu 26.04 and Node.js 26.x to system requir...
812432e chore: mark v1.61.0 (#41277)
ac05145 fix(fetch): report serverAddr and securityDetails for reused sockets (#41267)
056efc9 fix(trace-viewer): add keyboard navigation to NetworkFilters component (#41...
41f7b9a chore: fixes uncovered by the .NET 1.61 roll (#41266)
ba50778 fix(mcp): assign caps as array for legacy --vision flag (#41253)
b8ee5ae docs: release notes for v1.61 (#41261)
49c1f69 fix(trace viewer): load trace from a local file (#41263)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for playwright since your current version.

Updates ws from 7.5.9 to 7.5.11

Release notes

Sourced from ws's releases.

7.5.11

Bug fixes

Backported 2b2abd45 to the 7.x release line (e14c4586).

7.5.10

Bug fixes

Backported e55e5106 to the 7.x release line (22c28763).

Commits

fd36cd8 [dist] 7.5.11
e14c458 [security] Limit retained message parts
d962d70 [dist] 7.5.10
22c2876 [security] Fix crash when the Upgrade header cannot be read (#2231)
See full diff in compare view

Updates ws from 8.14.2 to 8.21.0

Release notes

Sourced from ws's releases.

7.5.11

Bug fixes

Backported 2b2abd45 to the 7.x release line (e14c4586).

7.5.10

Bug fixes

Backported e55e5106 to the 7.x release line (22c28763).

Commits

fd36cd8 [dist] 7.5.11
e14c458 [security] Limit retained message parts
d962d70 [dist] 7.5.10
22c2876 [security] Fix crash when the Upgrade header cannot be read (#2231)
See full diff in compare view

Updates cross-spawn from 7.0.3 to 7.0.6

Changelog

Sourced from cross-spawn's changelog.

7.0.6 (2024-11-18)

Bug Fixes

update cross-spawn version to 7.0.5 in package-lock.json (f700743)

7.0.5 (2024-11-07)

Bug Fixes

fix escaping bug introduced by backtracking (640d391)

7.0.4 (2024-11-07)

Bug Fixes

disable regexp backtracking (#160) (5ff3a07)

Commits

77cd97f chore(release): 7.0.6
6717de4 chore: upgrade standard-version
f700743 fix: update cross-spawn version to 7.0.5 in package-lock.json
9a7e3b2 chore: fix build status badge
0852683 chore(release): 7.0.5
640d391 fix: fix escaping bug introduced by backtracking
bff0c87 chore: remove codecov
a7c6abc chore: replace travis with github workflows
9b9246e chore(release): 7.0.4
5ff3a07 fix: disable regexp backtracking (#160)
Additional commits viewable in compare view

Updates @octokit/plugin-paginate-rest from 2.18.0 to 14.0.0

Release notes

Sourced from @octokit/plugin-paginate-rest's releases.

v14.0.0

14.0.0 (2025-10-31)

Features

add immutable releases, enterprise team membership, enterprise team organization endpoints (413e899)

BREAKING CHANGES

Remove GET /projects/{project_id}/columns

Remove GET /enterprises/{enterprise}/secret-scanning/alerts

v13.2.1

13.2.1 (2025-10-20)

Bug Fixes

deps: update @octokit/types (#698) (ba56fbc)

v13.2.0

13.2.0 (2025-09-29)

Features

new Projects v2 endpoints, new code scanning dismissal endpoints, many other endpoints (#690) (0e236cb)

v13.1.1

13.1.1 (2025-06-27)

Bug Fixes

handle url in response when using pagination with compareCommits (#686) (8e5da25)

v13.1.0

13.1.0 (2025-06-16)

Features

add paginatantion support for compareCommits and compareCommitsWithBasehead (#678) (6d8ea8a)

v13.0.1

13.0.1 (2025-05-25)

... (truncated)

Commits

413e899 feat: add immutable releases, enterprise team membership, enterprise team org...
3d311d6 chore(deps): update dependency @types/node to v24 (#701)
ba56fbc fix(deps): update @octokit/types (#698)
80745be ci(action): update actions/checkout action to v5 (#687)
0e236cb feat: new Projects v2 endpoints, new code scanning dismissal endpoints, many ...
bf19e3e chore(deps): update dependency prettier to v3.6.2 (#685)
4f9fc56 ci(action): update actions/setup-node action to v5 (#688)
8e5da25 fix: handle url in response when using pagination with compareCommits (#686)
6d8ea8a feat: add paginatantion support for compareCommits and `compareCommitsWith...
8ec2713 fix(deps): update @octokit/types - no new paginated endpoints (#680)
Additional commits viewable in compare view

Updates @octokit/request from 5.6.3 to 10.0.10

Release notes

Sourced from @octokit/request's releases.

v10.0.10

10.0.10 (2026-05-26)

Bug Fixes

remove unused fast-content-type-parse dependency (#808) (25b0838)

v10.0.9

10.0.9 (2026-05-12)

Bug Fixes

deps: switch to using the "content-type" package for content type parsing (#807) (a9f64a0)

v10.0.8

10.0.8 (2026-02-20)

Bug Fixes

use json-with-bigint instead of built-in JSON methods in order to properly support int64's (#798) (f13f5d9)

v10.0.7

10.0.7 (2025-11-13)

Bug Fixes

readme: properly structure the options for custom agent (#786) (f17c1c1), closes #785

v10.0.6

10.0.6 (2025-10-30)

Bug Fixes

deps: update dependency @octokit/types to v16 (#783) (1aeac56)

v10.0.5

10.0.5 (2025-09-29)

Bug Fixes

deps: update octokit deps (#772) (30f83b6)

v10.0.4

10.0.4 (2025-09-29)

... (truncated)

Commits

25b0838 fix: remove unused fast-content-type-parse dependency (#808)
b3d6b0b chore(deps): update dependency esbuild to ^0.28.0 (#804)
7fdf739 ci(action): update actions/create-github-app-token action to v3 (#801)
58b1f87 ci(action): update actions/add-to-project action to v2 (#806)
a9f64a0 fix(deps): switch to using the "content-type" package for content type parsin...
4abc280 chore(deps): update dependency undici to v7.24.0 [security] (#800)
f13f5d9 fix: use json-with-bigint instead of built-in JSON methods in order to prop...
9ba6ae0 Document that unsuccessful HTTP status code result in an exception (#795)
7160b82 chore(deps): replace glob with tinyglobby (#791)
ab8018b ci(action): update peter-evans/create-or-update-comment action to v5 (#776)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @octokit/request since your current version.

Updates @octokit/request-error from 2.1.0 to 7.1.0

Release notes

Sourced from @octokit/request-error's releases.

v7.1.0

7.1.0 (2025-11-13)

Features

inherit options from base Error class to add support for the cause property (#535/#536) (2ea2780)

v7.0.2

7.0.2 (2025-10-30)

Bug Fixes

deps: update dependency @octokit/types to v16 (#533) (e5a75ef)

v7.0.1

7.0.1 (2025-09-29)

Bug Fixes

deps: update dependency @octokit/types to v15 (#522) (4a453f2)

v7.0.0

7.0.0 (2025-05-20)

Continuous Integration

stop testing against NodeJS v18 (#512) (8eee0c1)

BREAKING CHANGES

Drop support for NodeJS v18

build: set minimal node version in build script to v20

ci: stop testing against NodeJS v18

v6.1.8

6.1.8 (2025-04-10)

Bug Fixes

deps: update dependency @octokit/types to v14 (#505) (ab4ea7b)

v6.1.7

... (truncated)

Commits

2ea2780 feat: inherit options from base Error class to add support for the cause ...
ac7b309 chore(deps): update vitest monorepo to v4 (major) (#531)
dadc76d ci(action): update peter-evans/create-or-update-comment action to v5 (#525)
f57f2e6 build(deps): lock file maintenance (#534)
e5a75ef fix(deps): update dependency @octokit/types to v16 (#533)
e5d5de2 chore(deps): update dependency @types/node to v24 (#532)
8cc127b ci(action): update actions/setup-node action to v6 (#529)
b3a876b build(deps): lock file maintenance (#527)
cf1817b ci(action): update github/codeql-action action to v4 (#528)
61f1e87 chore(deps): update dependency tinybench to v5 (#519)
Additional commits viewable in compare view

Removes @tootallnate/once

Updates braces from 3.0.2 to 3.0.3

Commits

74b2db2 3.0.3
88f1429 update eslint. lint, fix unit tests.
415d660 Snyk js braces 6838727 (#40)
190510f fix tests, skip 1 test in test/braces.expand
716eb9f readme bump
a5851e5 Merge pull request #37 from coderaiser/fix/vulnerability
2092bd1 feature: braces: add maxSymbols (https://github.com/micromatch/braces/issues/...
9f5b4cf fix: vulnerability (https://security.snyk.io/vuln/SNYK-JS-BRACES-6838727)
98414f9 remove funding file
665ab5d update keepEscaping doc (#27)
Additional commits viewable in compare view

Updates ejs from 3.1.9 to 3.1.10

Release notes

Sourced from ejs's releases.

v3.1.10

Version 3.1.10

Commits

d3f807d Version 3.1.10
9ee26dd Mocha TDD
e469741 Basic pollution protection
715e950 Merge pull request #756 from Jeffrey-mu/main
cabe314 Include advanced usage examples
29b076c Added header
11503c7 Merge branch 'main' of github.com:mde/ejs into main
7690404 Added security banner to README
f47d7ae Update SECURITY.md
828cea1 Update SECURITY.md
Additional commits viewable in compare view

Updates handlebars from 4.7.7 to 4.7.9

Release notes

Sourced from handlebars's releases.

v4.7.9

fix: enable shell mode for spawn to resolve Windows EINVAL issue - e0137c2

fix type "RuntimeOptions" also accepting string partials - eab1d14

feat(types): set hash to be a Record<string, any> - de4414d

fix non-contiguous program indices - 4512766

refactor: rename i to startPartIndex - e497a35

security: fix security issues - 68d8df5

GHSA-2w6w-674q-4c4q

GHSA-3mfm-83xf-c92r

GHSA-xhpv-hc6g-r9c6

GHSA-xjpj-3mr7-gcpf

GHSA-9cx6-37pm-9jff

GHSA-2qvq-rjwj-gvw9

GHSA-7rx3-28cr-v5wh

GHSA-442j-39wm-28r2

Commits

v4.7.8

Make library compatible with workers (#1894) - 3d3796c

Don't rely on Node.js global object (#1776) - 2954e7e

Fix compiling of each block params in strict mode (#1855) - 30dbf04

Fix rollup warning when importing Handlebars as ESM - 03d387b

Fix bundler issue with webpack 5 (#1862) - c6c6bbb

Use https instead of git for mustache submodule - 88ac068

Commits

Changelog

Sourced from handlebars's changelog.

v4.7.9 - March 26th, 2026

fix: enable shell mode for spawn to resolve Windows EINVAL issue - e0137c2

fix type "RuntimeOptions" also accepting string partials - eab1d14

feat(types): set hash to be a Record<string, any> - de4414d

fix non-contiguous program indices - 4512766

refactor: rename i to startPartIndex - e497a35

security: fix security issues - 68d8df5

Commits

v4.7.8 - July 27th, 2023

Make library compatible with workers (#1894) - 3d3796c

Don't rely on Node.js global object (#1776) - 2954e7e

Fix compiling of each block params in strict mode (#1855) - 30dbf04

Fix rollup warning when importing Handlebars as ESM - 03d387b

Fix bundler issue with webpack 5 (#1862) - c6c6bbb

Use https instead of git for mustache submodule - 88ac068

Commits

Commits

dce542c v4.7.9
8a41389 Update release notes
68d8df5 Fix security issues
b2a0831 Fix browser tests
9f98c16 Fix release script
45443b4 Revert "Improve partial indenting performance"
8841a5f Fix CI errors with linting
e0137c2 fix: enable shell mode for spawn to resolve Windows EINVAL issue
e914d60 Improve rendering performance
7de4b41 Upgrade GitHub Actions checkout and setup-node on 4.x branch
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by jaylinski, a new releaser for handlebars since your current version.

Removes ip

Updates jws from 3.2.2 to 4.0.0

Release notes

Sourced from jws's releases.

v4.0.0

No release notes provided.

v3.2.3

Changed

Fix advisory GHSA-869p-cjfg-cm3x: createSign and createVerify now require that a non empty secret is provided (via opts.secret, opts.privateKey or opts.key) when using HMAC algorithms.

Upgrading JWA version to 1.4.2, addressing a compatibility issue for Node >= 25.

Commits

1389f6d v4.0.0
e4593f1 jwa@^2.0.0
9deb311 README: Use SVG build badge (#87)
See full diff in compare view

Updates liquidjs from 10.7.1 to 10.27.0

Release notes

Sourced from liquidjs's releases.

v10.27.0

10.27.0 (2026-05-15)

Features

context: null-prototype scope frames via createScope (#899) (

Bumps the npm_and_yarn group with 18 updates in the / directory: | Package | From | To | | --- | --- | --- | | [markdown-it](https://github.com/markdown-it/markdown-it) | `12.3.2` | `14.2.0` | | [rollup](https://github.com/rollup/rollup) | `2.79.1` | `2.80.0` | | [koa](https://github.com/koajs/koa) | `2.13.4` | `3.1.2` | | [playwright](https://github.com/microsoft/playwright) | `1.28.1` | `1.61.0` | | [ws](https://github.com/websockets/ws) | `7.5.9` | `7.5.11` | | [ws](https://github.com/websockets/ws) | `8.14.2` | `8.21.0` | | [cross-spawn](https://github.com/moxystudio/node-cross-spawn) | `7.0.3` | `7.0.6` | | [@tootallnate/once](https://github.com/TooTallNate/once) | `1.1.2` | `removed` | | [braces](https://github.com/micromatch/braces) | `3.0.2` | `3.0.3` | | [ejs](https://github.com/mde/ejs) | `3.1.9` | `3.1.10` | | [handlebars](https://github.com/handlebars-lang/handlebars.js) | `4.7.7` | `4.7.9` | | [ip](https://github.com/indutny/node-ip) | `1.1.8` | `removed` | | [liquidjs](https://github.com/harttle/liquidjs) | `10.7.1` | `10.27.0` | | [micromatch](https://github.com/micromatch/micromatch) | `4.0.5` | `4.0.8` | | [node-forge](https://github.com/digitalbazaar/forge) | `1.3.1` | `1.4.0` | | [path-to-regexp](https://github.com/pillarjs/path-to-regexp) | `6.2.1` | `6.3.0` | | [pug](https://github.com/pugjs/pug) | `3.0.2` | `3.0.4` | | [qs](https://github.com/ljharb/qs) | `6.11.2` | `6.15.2` | | [undici](https://github.com/nodejs/undici) | `5.21.0` | `6.24.1` | Bumps the npm_and_yarn group with 1 update in the /packages/lit-dev-content directory: [markdown-it](https://github.com/markdown-it/markdown-it). Updates `markdown-it` from 12.3.2 to 14.2.0 - [Changelog](https://github.com/markdown-it/markdown-it/blob/master/CHANGELOG.md) - [Commits](markdown-it/markdown-it@12.3.2...14.2.0) Updates `rollup` from 2.79.1 to 2.80.0 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/v2.80.0/CHANGELOG.md) - [Commits](rollup/rollup@v2.79.1...v2.80.0) Updates `koa` from 2.13.4 to 3.1.2 - [Release notes](https://github.com/koajs/koa/releases) - [Changelog](https://github.com/koajs/koa/blob/master/History.md) - [Commits](koajs/koa@2.13.4...v3.1.2) Updates `playwright` from 1.28.1 to 1.61.0 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.28.1...v1.61.0) Updates `ws` from 7.5.9 to 7.5.11 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@7.5.9...7.5.11) Updates `ws` from 8.14.2 to 8.21.0 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@7.5.9...7.5.11) Updates `cross-spawn` from 7.0.3 to 7.0.6 - [Changelog](https://github.com/moxystudio/node-cross-spawn/blob/master/CHANGELOG.md) - [Commits](moxystudio/node-cross-spawn@v7.0.3...v7.0.6) Updates `@octokit/plugin-paginate-rest` from 2.18.0 to 14.0.0 - [Release notes](https://github.com/octokit/plugin-paginate-rest.js/releases) - [Commits](octokit/plugin-paginate-rest.js@v2.18.0...v14.0.0) Updates `@octokit/request` from 5.6.3 to 10.0.10 - [Release notes](https://github.com/octokit/request.js/releases) - [Commits](octokit/request.js@v5.6.3...v10.0.10) Updates `@octokit/request-error` from 2.1.0 to 7.1.0 - [Release notes](https://github.com/octokit/request-error.js/releases) - [Commits](octokit/request-error.js@v2.1.0...v7.1.0) Removes `@tootallnate/once` Updates `braces` from 3.0.2 to 3.0.3 - [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md) - [Commits](micromatch/braces@3.0.2...3.0.3) Updates `ejs` from 3.1.9 to 3.1.10 - [Release notes](https://github.com/mde/ejs/releases) - [Changelog](https://github.com/mde/ejs/blob/main/RELEASE_NOTES_v5.md) - [Commits](mde/ejs@v3.1.9...v3.1.10) Updates `handlebars` from 4.7.7 to 4.7.9 - [Release notes](https://github.com/handlebars-lang/handlebars.js/releases) - [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/v4.7.9/release-notes.md) - [Commits](handlebars-lang/handlebars.js@v4.7.7...v4.7.9) Removes `ip` Updates `jws` from 3.2.2 to 4.0.0 - [Release notes](https://github.com/brianloveswords/node-jws/releases) - [Changelog](https://github.com/auth0/node-jws/blob/master/CHANGELOG.md) - [Commits](auth0/node-jws@v3.2.2...v4.0.0) Updates `liquidjs` from 10.7.1 to 10.27.0 - [Release notes](https://github.com/harttle/liquidjs/releases) - [Changelog](https://github.com/harttle/liquidjs/blob/master/CHANGELOG.md) - [Commits](harttle/liquidjs@v10.7.1...v10.27.0) Updates `micromatch` from 4.0.5 to 4.0.8 - [Release notes](https://github.com/micromatch/micromatch/releases) - [Changelog](https://github.com/micromatch/micromatch/blob/master/CHANGELOG.md) - [Commits](micromatch/micromatch@4.0.5...4.0.8) Updates `node-forge` from 1.3.1 to 1.4.0 - [Changelog](https://github.com/digitalbazaar/forge/blob/main/CHANGELOG.md) - [Commits](digitalbazaar/forge@v1.3.1...v1.4.0) Updates `path-to-regexp` from 6.2.1 to 6.3.0 - [Release notes](https://github.com/pillarjs/path-to-regexp/releases) - [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md) - [Commits](pillarjs/path-to-regexp@v6.2.1...v6.3.0) Updates `pug` from 3.0.2 to 3.0.4 - [Release notes](https://github.com/pugjs/pug/releases) - [Commits](https://github.com/pugjs/pug/compare/pug@3.0.2...pug@3.0.4) Updates `qs` from 6.11.2 to 6.15.2 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.11.2...v6.15.2) Updates `undici` from 5.21.0 to 6.24.1 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v5.21.0...v6.24.1) Updates `markdown-it` from 12.3.2 to 14.2.0 - [Changelog](https://github.com/markdown-it/markdown-it/blob/master/CHANGELOG.md) - [Commits](markdown-it/markdown-it@12.3.2...14.2.0) --- updated-dependencies: - dependency-name: markdown-it dependency-version: 14.2.0 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: rollup dependency-version: 2.80.0 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: koa dependency-version: 3.1.2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: playwright dependency-version: 1.61.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 7.5.11 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 8.21.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: cross-spawn dependency-version: 7.0.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@octokit/plugin-paginate-rest" dependency-version: 14.0.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@octokit/request" dependency-version: 10.0.10 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@octokit/request-error" dependency-version: 7.1.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@tootallnate/once" dependency-version: dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: braces dependency-version: 3.0.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ejs dependency-version: 3.1.10 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: handlebars dependency-version: 4.7.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ip dependency-version: dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: jws dependency-version: 4.0.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: liquidjs dependency-version: 10.27.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: micromatch dependency-version: 4.0.8 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: node-forge dependency-version: 1.4.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: path-to-regexp dependency-version: 6.3.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: pug dependency-version: 3.0.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.15.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 6.24.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: markdown-it dependency-version: 14.2.0 dependency-type: direct:development dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 18, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the npm_and_yarn group across 2 directories with 22 updates#7

Bump the npm_and_yarn group across 2 directories with 22 updates#7
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-017cb34cee

dependabot Bot commented on behalf of github Jun 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Jun 18, 2026

[14.2.0] - 2026-05-24

Added

Fixed

Security

[14.1.1] - 2026-01-11

Security

[14.1.0] - 2024-03-19

Changed

Fixed

[14.0.0] - 2023-12-08

Changed

Fixed

[13.0.2] - 2023-09-26

Security

v.2.79.2

2.79.2

Bug Fixes

Pull Requests

2.80.0

Features

Pull Requests

2.79.2

Bug Fixes

Pull Requests

v3.1.2

What's Changed

New Contributors

v3.1.1

What's Changed

v3.1.0

What's Changed

v3.0.3

What's Changed

v3.0.2

What's Changed

New Contributors

v3.0.1

3.0.0-alpha.3 / 2025-02-11

3.0.0-alpha.2 / 2024-11-04

3.0.0-alpha.1 / 2023-04-12

3.0.0-alpha.0 / 2023-01-02

Breaking Changes

v1.61.0

🔑 WebAuthn passkeys

🗃️ Web Storage

New APIs

Network

Browser and Screencast

Test runner

7.5.11

Bug fixes

7.5.10

Bug fixes

7.5.11

Bug fixes

7.5.10

Bug fixes

7.0.6 (2024-11-18)

Bug Fixes

7.0.5 (2024-11-07)

Bug Fixes

7.0.4 (2024-11-07)

Bug Fixes

v14.0.0

14.0.0 (2025-10-31)

Features

BREAKING CHANGES

v13.2.1

13.2.1 (2025-10-20)

Bug Fixes

v13.2.0

13.2.0 (2025-09-29)

Features

v13.1.1

13.1.1 (2025-06-27)

Bug Fixes

v13.1.0

13.1.0 (2025-06-16)