Bump the npm_and_yarn group across 1 directory with 6 updates by dependabot[bot] · Pull Request #25 · github/typing-effect-element

dependabot · 2026-09-11T21:31:54Z

Bumps the npm_and_yarn group with 6 updates in the / directory:

Package	From	To
brace-expansion	`1.1.11`	`1.1.18`
brace-expansion	`2.1.0`	`2.1.4`
js-yaml	`3.13.1`	`3.15.2`
js-yaml	`4.1.1`	`4.3.2`
tmp	`0.0.33`	`removed`
serialize-javascript	`6.0.2`	`7.1.1`
socket.io-parser	`4.2.6`	`4.2.7`
ws	`8.20.1`	`8.21.3`

Updates brace-expansion from 1.1.11 to 1.1.18

Release notes

Sourced from brace-expansion's releases.

v1.1.15

Backport v5.0.6 change to v1 (#111) 0b09384

juliangruber/brace-expansion@v1.1.14...v1.1.15

v1.1.12

pkg: publish on tag 1.x c460dbd

fmt ccb8ac6

Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) c3c73c8

juliangruber/brace-expansion@v1.1.11...v1.1.12

Commits

758fcd6 1.1.18
27fbeed Merge commit from fork
5c57cc2 1.1.17
d757f1d npm ignore .claude
cb4b9e4 fix: backport GHSA-mh99-v99m-4gvg (#129)
447763a 1.1.16
d74e630 fix: v1 backport for CVE-2026-13149 (#122)
2203f4f 1.1.15
0b09384 Backport v5.0.6 change to v1 (#111)
10c05fc 1.1.14
Additional commits viewable in compare view

Updates brace-expansion from 2.1.0 to 2.1.4

Release notes

Sourced from brace-expansion's releases.

v1.1.15

Backport v5.0.6 change to v1 (#111) 0b09384

juliangruber/brace-expansion@v1.1.14...v1.1.15

v1.1.12

pkg: publish on tag 1.x c460dbd

fmt ccb8ac6

Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) c3c73c8

juliangruber/brace-expansion@v1.1.11...v1.1.12

Commits

758fcd6 1.1.18
27fbeed Merge commit from fork
5c57cc2 1.1.17
d757f1d npm ignore .claude
cb4b9e4 fix: backport GHSA-mh99-v99m-4gvg (#129)
447763a 1.1.16
d74e630 fix: v1 backport for CVE-2026-13149 (#122)
2203f4f 1.1.15
0b09384 Backport v5.0.6 change to v1 (#111)
10c05fc 1.1.14
Additional commits viewable in compare view

Updates js-yaml from 3.13.1 to 3.15.2

Changelog

Sourced from js-yaml's changelog.

3.15.2 - 2026-08-26

Changed

[backport] Hard-limit merge sequence size to 100.

Security

[backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

3.15.1 - 2026-07-31

Security

[backport] Remove quadratic complexity from !!omap duplicate key detection.

3.15.0 - 2026-06-27

Added

Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one safeLoad() / safeLoadAll() call.

[3.14.2] - 2025-11-15

Security

Fix prototype pollution in merge (<<).

[3.14.1] - 2020-12-07

Security

Fix possible code execution in (already unsafe) .load() (in &anchor).

[3.14.0] - 2020-05-22

Changed

Support safe/loadAll(input, options) variant of call.

CI: drop outdated nodejs versions.

Dev deps bump.

Fixed

Quote = in plain scalars #519.

Check the node type for !<?> tag in case user manually specifies it.

Verify that there are no null-bytes in input.

Fix wrong quote position when writing condensed flow, #526.

Commits

5c45bd6 3.15.2 released
5a708f9 dist rebuild
3485bc0 Backport merge limits from v5.4.1
f34812f Update .gitignore
ab85ae2 3.15.1 released
30a5e76 dist rebuild
22a8071 Backport quadratic complexity fix for !!omap
c34b6c4 3.15.0 released
21e13d3 dist rebuild
4165c62 Add v3-legacy tag for publish
Additional commits viewable in compare view

Updates js-yaml from 4.1.1 to 4.3.2

Changelog

Sourced from js-yaml's changelog.

3.15.2 - 2026-08-26

Changed

[backport] Hard-limit merge sequence size to 100.

Security

[backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

3.15.1 - 2026-07-31

Security

[backport] Remove quadratic complexity from !!omap duplicate key detection.

3.15.0 - 2026-06-27

Added

Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one safeLoad() / safeLoadAll() call.

[3.14.2] - 2025-11-15

Security

Fix prototype pollution in merge (<<).

[3.14.1] - 2020-12-07

Security

Fix possible code execution in (already unsafe) .load() (in &anchor).

[3.14.0] - 2020-05-22

Changed

Support safe/loadAll(input, options) variant of call.

CI: drop outdated nodejs versions.

Dev deps bump.

Fixed

Quote = in plain scalars #519.

Check the node type for !<?> tag in case user manually specifies it.

Verify that there are no null-bytes in input.

Fix wrong quote position when writing condensed flow, #526.

Commits

5c45bd6 3.15.2 released
5a708f9 dist rebuild
3485bc0 Backport merge limits from v5.4.1
f34812f Update .gitignore
ab85ae2 3.15.1 released
30a5e76 dist rebuild
22a8071 Backport quadratic complexity fix for !!omap
c34b6c4 3.15.0 released
21e13d3 dist rebuild
4165c62 Add v3-legacy tag for publish
Additional commits viewable in compare view

Removes tmp

Updates serialize-javascript from 6.0.2 to 7.1.1

Release notes

Sourced from serialize-javascript's releases.

v7.1.1

What's Changed

fix: fix XSS bypass via split </script payload across function bodies by @okuryu in yahoo/serialize-javascript#226

release: v7.1.1 by @okuryu in yahoo/serialize-javascript#227

Full Changelog: yahoo/serialize-javascript@v7.1.0...v7.1.1

v7.1.0

What's Changed

feat: add Node.js 26 to test matrix by @okuryu in yahoo/serialize-javascript#224

release: v7.1.0 by @okuryu in yahoo/serialize-javascript#225

Full Changelog: yahoo/serialize-javascript@v7.0.7...v7.1.0

v7.0.7

What's Changed

fix: reject spoofed RegExp objects with non-string source property by @redonkulus in yahoo/serialize-javascript#222

release: v7.0.7 by @okuryu in yahoo/serialize-javascript#223

Full Changelog: yahoo/serialize-javascript@v7.0.6...v7.0.7

v7.0.6

What's Changed

build(deps-dev): bump lodash from 4.17.23 to 4.18.1 by @dependabot[bot] in yahoo/serialize-javascript#215

fix: reject spoofed URL objects with non-string toString() result by @redonkulus in yahoo/serialize-javascript#217

release: v7.0.6 by @okuryu in yahoo/serialize-javascript#221

Full Changelog: yahoo/serialize-javascript@v7.0.5...v7.0.6

v7.0.5

Fixes

Improve robustness and validation for array-like object serialization.

Fix an issue where certain object structures could lead to excessive CPU usage.

For more details, please see GHSA-qj8w-gfj5-8c6v.

v7.0.4

What's Changed

release: v7.0.4 by @okuryu in yahoo/serialize-javascript#211

Full Changelog: yahoo/serialize-javascript@v7.0.3...v7.0.4

v7.0.3

fix(CVE-2020-7660): fix for RegExp.flags and Date.prototype.toISOString (#207) 2e609d0

... (truncated)

Commits

8c8caa7 release: v7.1.1
ffda9f1 fix: fix XSS bypass via split </script payload across function bodies
739145a release: v7.1.0
57865ed feat: add Node.js 26 to test matrix
01bec60 release: v7.0.7
5009715 fix: reject spoofed RegExp objects with non-string source property
153eb43 release: v7.0.6
a83d2cb fix: reject spoofed URL objects with non-string toString() result
451af65 build(deps-dev): bump lodash from 4.17.23 to 4.18.1 (#215)
df3f1c1 release: v7.0.5
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for serialize-javascript since your current version.

Updates socket.io-parser from 4.2.6 to 4.2.7

Release notes

Sourced from socket.io-parser's releases.

socket.io-parser@4.2.7

Bug Fixes

honor toJSON() when deconstructing a binary packet (#5518) (57f1114)

reject binary packets with zero attachments (7c6ef57)

New Contributors

@spokodev made their first contribution in socketio/socket.io#5518

Commits

4054894 chore(release): socket.io-parser@4.2.7
7c6ef57 fix(parser): reject binary packets with zero attachments
57f1114 fix(parser): honor toJSON() when deconstructing a binary packet (#5518)
8d2e4f7 docs(security): add CVE-2026-59724 and CVE-2026-59725
d2d753f refactor(sio): align client file matching in Node.js HTTP server
dfb5ab3 fix(sio): prevent uWebSockets.js from serving missing client files
dcbd961 perf(eio): optimize polling request body buffering
6bb2e7f refactor(sio): internalize base64id dependency
a80711a refactor(eio): internalize base64id dependency
8bead0f chore: upgrade to TypeScript 6
Additional commits viewable in compare view

Updates ws from 8.20.1 to 8.21.3

Release notes

Sourced from ws's releases.

8.21.3

Bug fixes

The server now correctly rejects permessage-deflate offers if the incoming client_max_window_bits parameter value is smaller than its configured clientMaxWindowBits (e97a20ea).

8.21.2

Bug fixes

Fixed a test for CITGM (2eb3be0b).

8.21.1

Bug fixes

Empty fragments are now counted toward the limit (a2f4e7c0).

The default values of the maxBufferedChunks and maxFragments options have been reduced (f197ac65).

8.21.0

Features

Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.
import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});
</tr></table>

... (truncated)

Commits

c791e70 [dist] 8.21.3
e97a20e [fix] Reject offers with client_max_window_bits below config
787ebf2 [dist] 8.21.2
b4d62eb Revert "[ci] Trust Coveralls Homebrew tap"
e4bb883 [security] Use GitHub PVR as main reporting channel
2eb3be0 [test] Skip test on Node.js versions where it does not apply
ae1de54 [dist] 8.21.1
8e9511b [ci] Trust Coveralls Homebrew tap
f197ac6 [fix] Lower default values of maxBufferedChunks and maxFragments
8df8265 [ci] Update actions/checkout action to v7
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the npm_and_yarn group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.11` | `1.1.18` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `2.1.0` | `2.1.4` | | [js-yaml](https://github.com/nodeca/js-yaml) | `3.13.1` | `3.15.2` | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.1` | `4.3.2` | | [tmp](https://github.com/raszi/node-tmp) | `0.0.33` | `removed` | | [serialize-javascript](https://github.com/yahoo/serialize-javascript) | `6.0.2` | `7.1.1` | | [socket.io-parser](https://github.com/socketio/socket.io) | `4.2.6` | `4.2.7` | | [ws](https://github.com/websockets/ws) | `8.20.1` | `8.21.3` | Updates `brace-expansion` from 1.1.11 to 1.1.18 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@1.1.11...v1.1.18) Updates `brace-expansion` from 2.1.0 to 2.1.4 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@1.1.11...v1.1.18) Updates `js-yaml` from 3.13.1 to 3.15.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/3.15.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.13.1...3.15.2) Updates `js-yaml` from 4.1.1 to 4.3.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/3.15.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.13.1...3.15.2) Removes `tmp` Updates `serialize-javascript` from 6.0.2 to 7.1.1 - [Release notes](https://github.com/yahoo/serialize-javascript/releases) - [Commits](yahoo/serialize-javascript@v6.0.2...v7.1.1) Updates `socket.io-parser` from 4.2.6 to 4.2.7 - [Release notes](https://github.com/socketio/socket.io/releases) - [Changelog](https://github.com/socketio/socket.io/blob/main/CHANGELOG.md) - [Commits](https://github.com/socketio/socket.io/compare/socket.io-parser@4.2.6...socket.io-parser@4.2.7) Updates `ws` from 8.20.1 to 8.21.3 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.20.1...8.21.3) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 1.1.18 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 2.1.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 3.15.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tmp dependency-version: dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: serialize-javascript dependency-version: 7.1.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: socket.io-parser dependency-version: 4.2.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 8.21.3 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

TylerJDev · 2026-09-14T13:56:19Z

@copilot fix CI.

Co-authored-by: TylerJDev <26746305+TylerJDev@users.noreply.github.com>

Copilot · 2026-09-14T13:58:48Z

@copilot fix CI.

Fixed in commit 4abe3b9 by pinning Chromium to 3.0.3 and regenerating the lockfile. Clean install, lint, build, and browser tests pass.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 11, 2026

dependabot Bot requested a review from a team as a code owner September 11, 2026 21:31

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 11, 2026

dependabot Bot mentioned this pull request Sep 11, 2026

Bump the npm_and_yarn group across 1 directory with 2 updates #21

Closed

Copilot started work on behalf of TylerJDev September 14, 2026 13:56 View session

Fix CI dependency installation

4abe3b9

Co-authored-by: TylerJDev <26746305+TylerJDev@users.noreply.github.com>

Copilot finished work on behalf of TylerJDev September 14, 2026 13:59

Copilot AI requested a review from TylerJDev September 14, 2026 13:59

TylerJDev approved these changes Sep 14, 2026

View reviewed changes

TylerJDev merged commit 996a136 into main Sep 14, 2026
5 checks passed

dependabot Bot deleted the dependabot/npm_and_yarn/npm_and_yarn-db8d5fb6da branch September 14, 2026 14:09

Navigation Menu

Uh oh!

Bump the npm_and_yarn group across 1 directory with 6 updates - #25

Bump the npm_and_yarn group across 1 directory with 6 updates#25
TylerJDev merged 2 commits into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-db8d5fb6da

dependabot Bot commented on behalf of github Sep 11, 2026

Uh oh!

TylerJDev commented Sep 14, 2026

Uh oh!

Copilot AI commented Sep 14, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 11, 2026

v1.1.15

v1.1.12

v1.1.15

v1.1.12

3.15.2 - 2026-08-26

Changed

Security

3.15.1 - 2026-07-31

Security

3.15.0 - 2026-06-27

Added

[3.14.2] - 2025-11-15

Security

[3.14.1] - 2020-12-07

Security

[3.14.0] - 2020-05-22

Changed

Fixed

3.15.2 - 2026-08-26

Changed

Security

3.15.1 - 2026-07-31

Security

3.15.0 - 2026-06-27

Added

[3.14.2] - 2025-11-15

Security

[3.14.1] - 2020-12-07

Security

[3.14.0] - 2020-05-22

Changed

Fixed

v7.1.1

What's Changed

v7.1.0

What's Changed

v7.0.7

What's Changed

v7.0.6

What's Changed

v7.0.5

Fixes

v7.0.4

What's Changed

v7.0.3

socket.io-parser@4.2.7

Bug Fixes

New Contributors

8.21.3

Bug fixes

8.21.2

Bug fixes

8.21.1

Bug fixes

8.21.0

Features

Bug fixes

Uh oh!

TylerJDev commented Sep 14, 2026

Uh oh!

Copilot AI commented Sep 14, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants