Skip to content

Bump the npm_and_yarn group across 1 directory with 8 updates - #31

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-58c51c4e9b
Open

Bump the npm_and_yarn group across 1 directory with 8 updates#31
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-58c51c4e9b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 5, 2026

Copy link
Copy Markdown

Bumps the npm_and_yarn group with 8 updates in the / directory:

Package From To
picomatch 2.3.1 2.3.2
picomatch 4.0.3 4.0.7
baseline-browser-mapping 2.9.7 2.11.27
brace-expansion 1.1.12 1.1.21
brace-expansion 5.0.5 5.0.12
browserslist 4.28.1 4.29.3
fast-uri 3.1.0 3.1.8
js-yaml 3.14.2 3.15.2
js-yaml 4.1.1 4.3.2
liquidjs 10.24.0 10.30.0
ws 8.18.3 8.22.0

Updates picomatch from 2.3.1 to 2.3.2

Release notes

Sourced from picomatch's releases.

2.3.2

This is a security release fixing several security relevant issues.

What's Changed

Full Changelog: micromatch/picomatch@2.3.1...2.3.2

Changelog

Sourced from picomatch's changelog.

2.3.2 (2026-03-23)

Fixed

  • Avoided an exception when a glob pattern contains constructor (#144, 3f4f10e).

Security

  • Backported the extglob-quantifier ReDoS fix from 4.0.4. Risky repeated extglobs are now safely rewritten or treated as literals by default; positive numeric maxExtglobRecursion values allow limited nesting, while false disables the safeguard (CVE-2026-33671, eec17ae).
  • Prevented inherited object properties from being interpreted as POSIX character classes (CVE-2026-33672, fc1f6b6).
Commits

Updates picomatch from 4.0.3 to 4.0.7

Release notes

Sourced from picomatch's releases.

2.3.2

This is a security release fixing several security relevant issues.

What's Changed

Full Changelog: micromatch/picomatch@2.3.1...2.3.2

Changelog

Sourced from picomatch's changelog.

2.3.2 (2026-03-23)

Fixed

  • Avoided an exception when a glob pattern contains constructor (#144, 3f4f10e).

Security

  • Backported the extglob-quantifier ReDoS fix from 4.0.4. Risky repeated extglobs are now safely rewritten or treated as literals by default; positive numeric maxExtglobRecursion values allow limited nesting, while false disables the safeguard (CVE-2026-33671, eec17ae).
  • Prevented inherited object properties from being interpreted as POSIX character classes (CVE-2026-33672, fc1f6b6).
Commits

Updates baseline-browser-mapping from 2.9.7 to 2.11.27

Release notes

Sourced from baseline-browser-mapping's releases.

v2.11.0

What's Changed in 2.11.0

  • feat: Adds a new getTimeline() method for getting the series of minimum browser changes, either grouped by date or by browser.
  • refactor: Substantial refactoring of the data compression process that replaces the full list of browsers from @mdn/browser-compat-data and downstream-browsers.json and features from web-features (in their very pared down form) with a change-list timeline that reflects which versions supported Baseline (newly available) on a given date. Thanks to @​swwind for the idea!
  • refactor: Some common functions have been moved to a util.ts module for use in other scripts.
  • fix: Removes process.exit() calls when unsupported option combinations are passed to getCompatibleVersions() and getAllVersions() in favour of throwing an Error. There is a small security risk with process.exit() calls that sites accepting unsanitised inputs could be the subject of attacks. Unsupported config options now throw and Error which should allow for more graceful handling. Thanks to @​bnbdr for flagging this as vulnerability CVE-2026-45819 .

Fixes #134

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.10.44...v2.11.0

v2.10.0

What's Changed

  • Introduces support for Node 6 by refactoring all Object.entries and Object.values instances and lowering ES target in Rollup to es2015.
  • Adds specified Node version support in package.json for >=6.0.0.
  • Refactors CLI code to avoid parseArgs which is not supported by versions of Node prior to 18, changes import to require and changes Rollup export to cjs to allow execution on older versions of Node.
  • Adds a new legacy-test.js file that allows basic testing on older versions of Node where current versions of Jasmine and ESLint are not supported.
  • Adds a test matrix to run tests on all even-numbered Node versions from 6 to 24.
  • refactor publish workflows to support NPM's new OIDC integration

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.9.24...v2.10.0

Commits
  • 6141d06 Patch to 2.11.27 because browser or feature data changed
  • e1d166b Browser or feature data changed
  • 42972a7 Updating static site
  • c1934c6 Patch to 2.11.26 because browser or feature data changed
  • 4873684 Browser or feature data changed
  • 9030798 Updating static site
  • a5df351 Updating static site
  • ecc5b54 Updating static site
  • 719bf7a Patch to 2.11.25 because browser or feature data changed
  • c4f5b49 Browser or feature data changed
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for baseline-browser-mapping since your current version.


Updates brace-expansion from 1.1.12 to 1.1.21

Release notes

Sourced from brace-expansion's releases.

v1.1.15

  • Backport v5.0.6 change to v1 (#111) 0b09384

juliangruber/brace-expansion@v1.1.14...v1.1.15

Commits

Updates brace-expansion from 5.0.5 to 5.0.12

Release notes

Sourced from brace-expansion's releases.

v1.1.15

  • Backport v5.0.6 change to v1 (#111) 0b09384

juliangruber/brace-expansion@v1.1.14...v1.1.15

Commits

Updates browserslist from 4.28.1 to 4.29.3

Release notes

Sourced from browserslist's releases.

4.29.3

  • Updated Firefox ESR.

4.29.2

  • Fixed ignoring null usage in cover X in Y query (by @​wahidrizka).

4.29.1

4.29.0

  • Added query continuations across lines and array entries (by @​fzlzjerry).

4.28.9

4.28.8

  • Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

4.28.6

4.28.5

4.28.4

  • Fixed SyntaxError regression of 4.28.3.

4.28.3

  • Fixed baseline query case-insensitivity (by @​swwind).

4.28.2

Changelog

Sourced from browserslist's changelog.

4.29.3

  • Updated Firefox ESR.

4.29.2

  • Fixed ignoring null usage in cover X in Y query (by @​wahidrizka).

4.29.1

4.29.0

  • Added query continuations across lines and array entries (by @​fzlzjerry).

4.28.9

4.28.8

  • Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

4.28.6

4.28.5

4.28.4

  • Fixed SyntaxError regression of 4.28.3.

4.28.3

  • Fixed baseline query case-insensitivity (by @​swwind).

... (truncated)

Commits
  • b4809dd Release 4.29.3 version
  • 9d844f8 Update Firefox ESR
  • 0033f34 Update dependencies
  • 906d329 Release 4.29.2 version
  • ff8c83f Update dependencies
  • 067f4a1 Merge pull request #952 from wahidrizka/fix-cover-null-usage
  • f760921 Do not add versions without usage data to cover queries
  • 5be63f5 Merge pull request #953 from wahidrizka/docs-android-latest-version
  • 1e5356f Note that Android version queries return only the latest version
  • 5b7e941 Add missed changes to ChangeLog
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for browserslist since your current version.


Updates fast-uri from 3.1.0 to 3.1.8

Release notes

Sourced from fast-uri's releases.

v3.1.8

⚠️ Security Warning

This security release fixes the following medium-severity security advisory:

Users of the v3.x release line should upgrade to v3.1.8.

Full Changelog: fastify/fast-uri@v3.1.7...v3.1.8

v3.1.7

⚠️ Security Warning

This is a security release that fixes the following high-severity security advisories:

Users of the v3.x release line should upgrade to v3.1.7.

Full Changelog: fastify/fast-uri@v3.1.6...v3.1.7

v3.1.6

⚠️ Security Warning

This release addresses the following high-severity security advisories:

Users of the v3.x release line should upgrade to v3.1.6.

Full Changelog: fastify/fast-uri@v3.1.5...v3.1.6

v3.1.5

⚠️ Security Warning

Fix for GHSA-7p8r-x3mc-p8w7

Full Changelog: fastify/fast-uri@v3.1.4...v3.1.5

v3.1.4

⚠️ Security Release

Fix for GHSA-v2hh-gcrm-f6hx

Full Changelog: fastify/fast-uri@v3.1.3...v3.1.4

... (truncated)

Commits
  • ead3ab7 Bumped v3.1.8
  • c88b59e fix: normalize decoded reg-name case
  • 412e40a Bumped v3.1.7
  • 9f4c943 fix: backport port and IP-literal validation to v3.x (#216)
  • 1eb3ce4 fix: treat unterminated bracket hosts as reg-names again (#214)
  • 6f970b2 Bumped v3.1.6
  • d941579 fix: never run IDN canonicalization on bracketed IP literals
  • c0f0279 test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)
  • 37f3417 Merge commit from fork
  • 607bfbe Merge commit from fork
  • Additional commits viewable in compare view

Updates js-yaml from 3.14.2 to 3.15.2

Changelog

Sourced from js-yaml's changelog.

3.15.2 - 2026-08-26

Changed

  • [backport] Hard-limit merge sequence size to 100.

Security

  • [backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

3.15.1 - 2026-07-31

Security

  • [backport] Remove quadratic complexity from !!omap duplicate key detection.

3.15.0 - 2026-06-27

Added

  • Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one safeLoad() / safeLoadAll() call.
Commits

Updates js-yaml from 4.1.1 to 4.3.2

Changelog

Sourced from js-yaml's changelog.

3.15.2 - 2026-08-26

Changed

  • [backport] Hard-limit merge sequence size to 100.

Security

  • [backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

3.15.1 - 2026-07-31

Security

  • [backport] Remove quadratic complexity from !!omap duplicate key detection.

3.15.0 - 2026-06-27

Added

  • Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one safeLoad() / safeLoadAll() call.
Commits

Updates liquidjs from 10.24.0 to 10.30.0

Release notes

Sourced from liquidjs's releases.

v10.30.0

10.30.0 (2026-10-01)

Bug Fixes

  • base64_encode: encode large input in browser builds (#969) (8aace78), closes #967
  • date: compute %C and %y from the numeric year (#961) (e68514f)
  • date: compute %U and %W week numbers like strftime (#958) (0587ca8)
  • trim custom characters by Unicode code point (#955) (3fe244f)
  • truncatewords: ignore leading whitespace when counting words (#954) (65e200e)
  • url_decode: keep %2B as a literal plus when decoding (#939) (9af92f5)

Features

v10.29.0

10.29.0 (2026-08-11)

Features

v10.28.0

10.28.0 (2026-08-01)

Bug Fixes

  • date: %s returns Unix epoch unaffected by display timezone (#932) (39c8743), closes #931

Features

  • Add support of inner expressions enclosed by parentheses (#863) (afa5f54)

v10.27.2

10.27.2 (2026-07-09)

Bug Fixes

  • charge join/json/inspect filters by produced output size (#925) (7ab49f9)
  • date: zero-pad milliseconds when formatting %N fractional seconds (#929) (2634f9d)
  • enforce ownPropertyOnly for inherited array indices (#924) (552819a)
  • filters: modulo should follow divisor sign for negative operands (#922) (568bd5f)

... (truncated)

Changelog

Sourced from liquidjs's changelog.

10.30.0 (2026-10-01)

Bug Fixes

  • base64_encode: encode large input in browser builds (#969) (8aace78), closes #967
  • date: compute %C and %y from the numeric year (#961) (e68514f)
  • date: compute %U and %W week numbers like strftime (#958) (0587ca8)
  • trim custom characters by Unicode code point (#955) (3fe244f)
  • truncatewords: ignore leading whitespace when counting words (#954) (65e200e)
  • url_decode: keep %2B as a literal plus when decoding (#939) (9af92f5)

Features

10.29.0 (2026-08-11)

Features

10.28.0 (2026-08-01)

Bug Fixes

  • date: %s returns Unix epoch unaffected by display timezone (#932) (39c8743), closes #931

Features

  • Add support of inner expressions enclosed by parentheses (#863) (afa5f54)

10.27.2 (2026-07-09)

Bug Fixes

  • charge join/json/inspect filters by produced output size (#925) (7ab49f9)
  • date: zero-pad milliseconds when formatting %N fractional seconds (#929) (2634f9d)
  • enforce ownPropertyOnly for inherited array indices (#924) (552819a)
  • filters: modulo should follow divisor sign for negative operands (#922) (568bd5f)
  • filters: return empty for out-of-range slice begin or negative length (#928) (f9a1316)

10.27.1 (2026-06-23)

... (truncated)

Commits
  • 920166e chore(release): 10.30.0 [skip ci]
  • 259dcd4 docs: add josefguenther as a contributor for code (#972)
  • 8aace78 fix(base64_encode): encode large input in browser builds (#969)
  • 7dfa76b feat: await promises returned by Drop.valueOf() (#948) (#953) (#959)
  • e68514f fix(date): compute %C and %y from the numeric year (#961)
  • 28ae3fb docs: add web-orbit12 as a contributor for code (#960)
  • 0587ca8 fix(date): compute %U and %W week numbers like strftime (#958)
  • a2cdfb8 docs: add jakezwang as a contributor for code (#957)
  • 3fe244f fix: trim custom characters by Unicode code point (#955)
  • 0340ed5 docs: add youdie006 as a contributor for code (#956)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for liquidjs since your current version.


Updates ws from 8.18.3 to 8.22.0

Release notes

Sourced from ws's releases.

8.22.0

Features

  • Introduced the protocols option (8b918b01).

Bug fixes

  • Calling websocket.close() with invalid arguments no longer transitions the state to WebSocket.CLOSING (#2337).

8.21.3

Bug fixes

  • The server now correctly rejects permessage-deflate offers if the incoming client_max_window_bits parameter value is smaller than its configured clientMaxWindowBits (e97a20ea).

8.21.2

Bug fixes

  • Fixed a test for CITGM (2eb3be0b).

8.21.1

Bug fixes

  • Empty fragments are now counted toward the limit (a2f4e7c0).
  • The default values of the maxBufferedChunks and maxFragments options have been reduced (f197ac65).

8.21.0

Features

  • Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

  • Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.

import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
</tr></table>

... (truncated)

Commits
  • 297202c [dist] 8.22.0
  • 8b918b0 [feature] Introduce the protocols option
  • 73e03eb [ci] Update actions/setup-node action to v7
  • d9b8954 [fix] Change the ready state after validating the arguments (#2337)
  • c791e70 [dist] 8.21.3
  • e97a20e [fix] Reject offers with client_max_window_bits below config
  • 787ebf2 [dist] 8.21.2
  • b4d62eb Revert "[ci] Trust Coveralls Homebrew tap"
  • e4bb883 [security] Use GitHub PVR as main reporting channel
  • 2eb3be0 [test] Skip test on Node.js versions where it does not apply
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump the npm_and_yarn group across 1 directory with 8 updates
45d3ebb 
Bumps the npm_and_yarn group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [picomatch](https://github.com/micromatch/picomatch) | `2.3.1` | `2.3.2` |
| [picomatch](https://github.com/micromatch/picomatch) | `4.0.3` | `4.0.7` |
| [baseline-browser-mapping](https://github.com/web-platform-dx/baseline-browser-mapping) | `2.9.7` | `2.11.27` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.12` | `1.1.21` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `5.0.5` | `5.0.12` |
| [browserslist](https://github.com/browserslist/browserslist) | `4.28.1` | `4.29.3` |
| [fast-uri](https://github.com/fastify/fast-uri) | `3.1.0` | `3.1.8` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `3.14.2` | `3.15.2` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.1` | `4.3.2` |
| [liquidjs](https://github.com/harttle/liquidjs) | `10.24.0` | `10.30.0` |
| [ws](https://github.com/websockets/ws) | `8.18.3` | `8.22.0` |



Updates `picomatch` from 2.3.1 to 2.3.2
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@2.3.1...2.3.2)

Updates `picomatch` from 4.0.3 to 4.0.7
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@2.3.1...2.3.2)

Updates `baseline-browser-mapping` from 2.9.7 to 2.11.27
- [Release notes](https://github.com/web-platform-dx/baseline-browser-mapping/releases)
- [Commits](web-platform-dx/baseline-browser-mapping@v2.9.7...v2.11.27)

Updates `brace-expansion` from 1.1.12 to 1.1.21
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.21)

Updates `brace-expansion` from 5.0.5 to 5.0.12
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.21)

Updates `browserslist` from 4.28.1 to 4.29.3
- [Release notes](https://github.com/browserslist/browserslist/releases)
- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md)
- [Commits](browserslist/browserslist@4.28.1...4.29.3)

Updates `fast-uri` from 3.1.0 to 3.1.8
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.0...v3.1.8)

Updates `js-yaml` from 3.14.2 to 3.15.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/3.15.2/CHANGELOG.md)
- [Commits](nodeca/js-yaml@3.14.2...3.15.2)

Updates `js-yaml` from 4.1.1 to 4.3.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/3.15.2/CHANGELOG.md)
- [Commits](nodeca/js-yaml@3.14.2...3.15.2)

Updates `liquidjs` from 10.24.0 to 10.30.0
- [Release notes](https://github.com/harttle/liquidjs/releases)
- [Changelog](https://github.com/harttle/liquidjs/blob/master/CHANGELOG.md)
- [Commits](harttle/liquidjs@v10.24.0...v10.30.0)

Updates `ws` from 8.18.3 to 8.22.0
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.18.3...8.22.0)

---
updated-dependencies:
- dependency-name: picomatch
  dependency-version: 2.3.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: picomatch
  dependency-version: 4.0.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: baseline-browser-mapping
  dependency-version: 2.11.27
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 1.1.21
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 5.0.12
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: browserslist
  dependency-version: 4.29.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fast-uri
  dependency-version: 3.1.8
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 3.15.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 4.3.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: liquidjs
  dependency-version: 10.30.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-version: 8.22.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 5, 2026
@dependabot
dependabot Bot requested a review from pangolingo as a code owner October 5, 2026 09:23
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 5, 2026
@dependabot dependabot Bot mentioned this pull request Oct 5, 2026
Closed

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@pangolingo pangolingo Awaiting requested review from pangolingo pangolingo is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants