Skip to content
This repository was archived by the owner on Oct 8, 2026. It is now read-only.

Repository navigation

build(deps): bump the npm_and_yarn group across 2 directories with 23 updates - #382

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-df08fe7df2
Closed

build(deps): bump the npm_and_yarn group across 2 directories with 23 updates#382
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-df08fe7df2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 6, 2026

Copy link
Copy Markdown

Bumps the npm_and_yarn group with 1 update in the /packages/backend directory: fastify.
Bumps the npm_and_yarn group with 23 updates in the / directory:

Package From To
fastify 4.29.1 5.12.5
@babel/core 7.28.6 7.29.7
@fastify/static 7.0.4 10.1.5
@hono/node-server 1.19.9 1.19.17
nanoid 3.3.11 3.3.20
@vue/server-renderer 3.5.27 3.5.43
adm-zip 0.5.16 0.6.1
fast-uri 3.1.0 3.1.8
fast-uri 2.4.0 2.4.7
baseline-browser-mapping 2.9.19 2.11.27
brace-expansion 2.0.2 2.1.7
browserslist 4.28.1 4.29.3
fflate 0.8.2 0.8.3
figlet 1.10.0 1.12.0
form-data 4.0.5 4.0.6
hono 4.11.7 4.13.13
ip-address 10.1.0 10.7.3
postcss 8.5.6 8.5.29
proxy-addr 2.0.7 2.0.8
sharp 0.33.5 removed
shell-quote 1.8.3 1.12.0
source-map-js 1.2.1 1.2.2
stream-json 1.9.1 3.7.0
ws 8.19.0 8.22.0

Updates fastify from 4.29.1 to 5.12.5

Release notes

Sourced from fastify's releases.

v5.12.5

⚠️ Security release

What's Changed

Full Changelog: fastify/fastify@v5.12.4...v5.12.5

v5.12.4

Fixed the fastify.js version mismatch.

Full Changelog: fastify/fastify@v5.12.2...v5.12.4

v5.12.2

⚠️ Security release

What's Changed

Full Changelog: fastify/fastify@v5.12.1...v5.12.2

v5.12.1

⚠️ Security release

What's Changed

Full Changelog: fastify/fastify@v5.12.0...v5.12.1

v5.12.0

What's Changed

... (truncated)

Commits
  • ba235fd Bumped v5.12.5
  • ad06a4c Merge commit from fork
  • 7af0d77 [Backport 5.x] perf: avoid redundant request-part reads during validation (#7...
  • 990ebef [Backport 5.x] perf: reduce content-type parser overhead (#7019)
  • 1690e35 Bumped v5.12.4
  • 1c991c4 Bumped v5.12.3
  • 942a2be Bumped v5.12.2
  • 853f6e2 test(validation): cover normalization and async branches
  • f02d8d4 fix(validation): do not unwrap async validator results
  • 93c239a fix: reject malformed URLs before custom 404 handlers
  • Additional commits viewable in compare view

Updates fastify from 4.29.1 to 5.12.5

Release notes

Sourced from fastify's releases.

v5.12.5

⚠️ Security release

What's Changed

Full Changelog: fastify/fastify@v5.12.4...v5.12.5

v5.12.4

Fixed the fastify.js version mismatch.

Full Changelog: fastify/fastify@v5.12.2...v5.12.4

v5.12.2

⚠️ Security release

What's Changed

Full Changelog: fastify/fastify@v5.12.1...v5.12.2

v5.12.1

⚠️ Security release

What's Changed

Full Changelog: fastify/fastify@v5.12.0...v5.12.1

v5.12.0

What's Changed

... (truncated)

Commits
  • ba235fd Bumped v5.12.5
  • ad06a4c Merge commit from fork
  • 7af0d77 [Backport 5.x] perf: avoid redundant request-part reads during validation (#7...
  • 990ebef [Backport 5.x] perf: reduce content-type parser overhead (#7019)
  • 1690e35 Bumped v5.12.4
  • 1c991c4 Bumped v5.12.3
  • 942a2be Bumped v5.12.2
  • 853f6e2 test(validation): cover normalization and async branches
  • f02d8d4 fix(validation): do not unwrap async validator results
  • 93c239a fix: reject malformed URLs before custom 404 handlers
  • Additional commits viewable in compare view

Updates @babel/core from 7.28.6 to 7.29.7

Release notes

Sourced from @​babel/core's releases.

v7.29.7 (2026-05-25)

Re-release all packages with npm provenance attestations

v7.29.6 (2026-05-25)

🐛 Bug Fix

Committers: 3

v7.29.5 (2026-05-05)

🏠 Internal

  • babel-preset-env
    • Update @babel/* dependencies

v7.29.4 (2026-05-05)

🐛 Bug Fix

  • babel-plugin-transform-modules-systemjs
    • #17974 [7.x backport]fix(systemjs): improve module string name support (@​JLHwung)

Committers: 1

v7.29.3 (2026-04-30)

👓 Spec Compliance

🐛 Bug Fix

  • babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators
    • #17931 fix(decorators): replace super within all removed static elements (@​JLHwung)
  • babel-register
  • babel-compat-data, babel-plugin-bugfix-safari-rest-destructuring-rhs-array, babel-preset-env

💅 Polish

  • babel-parser

... (truncated)

Commits

Updates @fastify/static from 7.0.4 to 10.1.5

Release notes

Sourced from @​fastify/static's releases.

v10.1.5

What's Changed

New Contributors

Full Changelog: fastify/fastify-static@v10.1.4...v10.1.5

v10.1.4

This is a security release for GHSA-r799-r9gc-m956 (CVE-2026-90982).

It fixes a route guard and allowedPath bypass on case-insensitive filesystems. Users should upgrade to @fastify/static 10.1.4.

Full Changelog: fastify/fastify-static@v10.1.3...v10.1.4

v10.1.3

What's Changed

Full Changelog: fastify/fastify-static@v10.1.2...v10.1.3

v10.1.2

⚠️ Security Release

What's Changed

Full Changelog: fastify/fastify-static@v10.1.1...v10.1.2

v10.1.1

⚠️ Security Release

What's Changed

Full Changelog: fastify/fastify-static@v10.1.0...v10.1.1

v10.1.0

What's Changed

... (truncated)

Commits
  • 2f0953a Bumped v10.1.5
  • 275d87e fix: use registered root for relative downloads (#610)
  • a39a464 Bumped v10.1.4
  • ac46015 Ignore .pi
  • 6288466 test: consume compressed response bodies
  • 04134a4 test: cover rootless path validation on Windows
  • d9a8c0a test: make case-folding fallback portable
  • dbe65e8 Merge commit from fork
  • 48b821f chore: bump content-disposition in the dependencies group (#607)
  • ee3f89d chore: bump fastify/workflows/.github/workflows/plugins-ci.yml (#604)
  • Additional commits viewable in compare view

Updates @hono/node-server from 1.19.9 to 1.19.17

Release notes

Sourced from @​hono/node-server's releases.

v1.19.17

No release notes provided.

v1.19.14

What's Changed

Full Changelog: honojs/node-server@v1.19.13...v1.19.14

v1.19.13

Security Fix

Fixed an issue in Serve Static Middleware where inconsistent handling of repeated slashes (//) between the router and static file resolution could allow middleware to be bypassed. Users of Serve Static Middleware are encouraged to upgrade to this version.

See GHSA-92pp-h63x-v22m for details.

v1.19.12

What's Changed

Full Changelog: honojs/node-server@v1.19.11...v1.19.12

v1.19.11

What's Changed

Full Changelog: honojs/node-server@v1.19.10...v1.19.11

v1.19.10

Security Fix

Fixed an authorization bypass in Serve Static Middleware caused by inconsistent URL decoding (%2F handling) between the router and static file resolution. Users of Serve Static Middleware are encouraged to upgrade to this version.

See GHSA-wc8c-qw6v-h7f6 for details.

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​hono/node-server since your current version.


Updates nanoid from 3.3.11 to 3.3.20

Release notes

Sourced from nanoid's releases.

3.3.20

3.3.19

  • Fixed killing the app by setting huge user ID.

3.3.18

3.3.17

  • Fixed infinite loop on zero size.

3.3.16

3.3.15

  • Fixed npm provenance error.

3.3.14

  • Fixed random pool corruption on big ID sizes.

3.3.13

  • Reduced npm package size.

3.3.12

  • Fixed breaking Nano ID by requesting big ID.
Changelog

Sourced from nanoid's changelog.

3.3.20

3.3.19

3.3.18

3.3.17

  • Fixed infinite loop on zero size.

3.3.16

3.3.15

  • Fixed npm provenance error.

3.3.14

  • Fixed random pool corruption on big ID sizes.

3.3.13

  • Reduced npm package size.

3.3.12

  • Fixed breaking Nano ID by requesting big ID.
Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nanoid since your current version.


Updates @vue/server-renderer from 3.5.27 to 3.5.43

Release notes

Sourced from @​vue/server-renderer's releases.

v3.5.43

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.42

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.41

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.40

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.39

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.38

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.37

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.35

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.34

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.33

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.32

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.31

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.30

For stable releases, please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from @​vue/server-renderer's changelog.

3.5.43 (2026-09-17)

Bug Fixes

  • compiler-sfc: ignore comment delimiters inside strings and url() when parsing css vars (#15548) (2fde323)
  • compiler-sfc: prepend semicolon for await in switch case (#15498) (9a1df69), closes #15495
  • compiler-sfc: restore await scope when leaving nested blocks (5409708), closes #15465
  • compiler-sfc: reuse parsed parent configs across tsconfig walks (fix #15478) (#15480) (d6febaa)
  • hydration: run leave hooks for hydration placeholders (#15431) (5dda192)
  • reactivity: preserve readonly wrappers in array copy methods (#15469) (599f35b)
  • runtime-core: unmount v-once children after parent rerenders (#15435) (d720338)
  • shared: handle circular references in looseEqual (#15499) (718f782), closes #15496
  • shared: preserve comment-like text in style values (#15471) (b9456cb)
  • suspense: don't drop nested suspense patches during hydration (#15429) (76d42dc)
  • suspense: keep the boundary pending while its branch is patched (#15411) (bfcfe9e), closes #7506
  • suspense: patch a hydrating boundary's pending branch in place (#15432) (2cde6f7)
  • suspense: unmount the DOM an interrupted async component claimed (#15430) (fb9b45c)
  • types: keep optional props when a runtime prop uses a generic PropType (#15523) (243aabc), closes #9546

3.5.42 (2026-08-27)

Bug Fixes

  • hydration: handle async component unmount before lazy hydration (#15252) (6e1814a)
  • hydration: handle moving unresolved async fragment (#15263) (a72036f)
  • runtime-core: avoid caching unmounted suspense children (#15291) (b535917), closes #15288
  • runtime-core: keep .trim result when combined with .number v-model modifier (#15346) (f8d42e1)
  • runtime-core: resolve $el for dev root comment fragment (#15313) (8654f35), closes #12680
  • runtime-dom: support !important on CSS custom properties in style binding (#15348) (31da934)
  • server-renderer: reject CR in attribute names (#15266) (a2b40db)
  • shared: correctly compare Map and Set values (#15328) (ef82a26), closes #15320
  • suspense: don't treat the leaving branch as the fallback while its mount is pending (#15333) (cd19745), closes #15332
  • v-model: re-sync select when model is overridden in change handler (#15298) (6eaecc1), closes #10505

3.5.41 (2026-08-05)

Bug Fixes

... (truncated)

Commits
  • 5be58b4 release: v3.5.43
  • d63616c release: v3.5.42
  • a2b40db fix(server-renderer): reject CR in attribute names (#15266)
  • d2c458b release: v3.5.41
  • 4e467d7 fix(ssr): normalize hidden states during hydration (#13125)
  • 684a8de dx(runtime-core): warn when innerHTML/textContent overrides children (#15194)
  • 2506700 fix(slots): handle nullish v-bind slot props (#15177)
  • b6191cb fix(runtime-core): restore SSR setup state when handling async setup result (...
  • fa2885d release: v3.5.40
  • 8801e51 test: add expect warn
  • Additional commits viewable in compare view

Updates adm-zip from 0.5.16 to 0.6.1

Release notes

Sourced from adm-zip's releases.

v0.6.1

Full Changelog: cthackers/adm-zip@v0.6.0...v0.6.1

  • Updated dev dependencies
  • Fixed uncaught crash in async decompression on malformed DEFLATE data
  • Fixed addLocalFolder following symlinks out of the archived folder
  • Stripped setuid/setgid/sticky bits from extracted file permissions
  • Enforced the decompression size cap on the async path and for size 0
  • Rejected archives with duplicate entry names
  • Blocked extraction from writing through symlinks inside the target
  • Routed malformed-header parse errors through the async callback
  • Rejected zip entries whose declared data extent runs past the buffer
  • Fixed addLocalFolderPromise hanging on empty folders and swallowing errors
  • Fixed addLocalFolderAsync2 mangling local paths on Windows

v0.6.0

Full Changelog: cthackers/adm-zip@v0.5.18...v0.6.0

This release fixes a security vulnerability (CVE-2026-39244), resolves several long-standing bugs, ships built-in TypeScript types, and includes two behavior changes worth reading before you upgrade.

  • extractEntryTo(dirEntry, target, maintainEntryPath = false) now preserves subdirectories instead of flattening files into the target folder by basename (which also silently overwrote same-named files). (#306)
  • Extraction no longer fails when the modification time can't be set — utimes is now best-effort. (#379)
  • Minimum Node.js is now 14 (the code already required it; engines was incorrectly >=12).
  • CVE-2026-39244 — a crafted archive declaring a huge uncompressed size could force an unbounded Buffer.alloc and OOM the process; allocation is now bounded by the data actually present. Reported by Daniel Púa (devploit), Anh Hong, and José Antonio Zamudio Amaya. (#568)
  • Hardened entry-name lookup against object injection (proto names). Prototype-less table.
  • Data-descriptor regression rejecting valid archives (#548, #533, #554)
  • Directory permissions not restored on extract (#530)
  • Infinite recursion on symlink loops in addLocalFolder (#541)
  • Uncaught process crash in writeFileToAsync on write failure (#470, #459, #402)
  • Empty name on directory entries (#466)
  • test() always returned false for archives with files
  • ~6× faster entry sorting for large archives
  • Built-in TypeScript definitions (types.d.ts) — you can drop @​types/adm-zip

v0.5.18

What's Changed

New Contributors

Full Changelog: cthackers/adm-zip@v0.5.17...v0.5.18

v0.5.17

... (truncated)

Changelog

Sourced from adm-zip's changelog.

0.6.0 / 2026-07-10

Security

  • Fixed CVE-2026-39244: a crafted archive declaring a huge uncompressed size could force an unbounded Buffer.alloc (memory exhaustion / DoS) before any validation. Allocation is now bounded by the data actually present — STORED output is sized from the real bytes, DEFLATED output is grown by the inflater and capped at the declared size (#568)
  • Hardened the internal entry-name lookup table against object injection: entry names come from untrusted archives, and a name such as __proto__ previously resolved to Object.prototype, crashing addFile and hiding the entry from getEntry/readFile. The table is now prototype-less

Bug fixes

  • Fixed a regression (0.5.15) that rejected valid archives using a data descriptor (general-purpose bit 3). The payload is now validated against the authoritative central-directory CRC instead of requiring/parsing the trailing descriptor (#548, #533, #554)
  • Fixed extractAllTo/extractAllToAsync not restoring directory permissions with keepOriginalPermission; directory modes are applied after their contents are written, deepest path first, and no longer lock the extractor out of a restrictive directory (#530)
  • Fixed infinite recursion in addLocalFolder when a folder contains a symlink pointing back to an ancestor (e.g. workspace node_modules); the walk now tracks resolved real paths and skips already-visited directories (#541)
  • Fixed an uncaught exception (ERR_INVALID_ARG_TYPE) that crashed the process when writeFileToAsync could not open the target file (bad permissions, invalid filename, exhausted file descriptors); write failures are now reported through the callback and write errors are no longer silently swallowed (#470, #459, #402)
  • Fixed directory entries reporting an empty name (e.g. a/b/c/ now returns c) (#466)
  • Fixed extractEntryTo flattening subdirectories when maintainEntryPath is false; the structure below the extracted directory is now preserved instead of collapsing (and overwriting) files by basename (#306)
  • Fixed a failed utimes aborting extraction; setting the modification time is now best-effort and never fails extraction of already-written content (#379)
  • Fixed test() always returning false for any archive containing a file (it indexed the entries array with an entry object instead of reading the entry); it now correctly verifies each entry's CRC

Performance

  • Faster entry sorting when writing archives with many entries: names are decoded once instead of on every comparison (about 6× faster sort for large archives)

Added

  • Bundled TypeScript type definitions (types.d.ts), so @types/adm-zip is no longer required

Notes

  • Behavior change: extractEntryTo(dir, target, /* maintainEntryPath */ false) now preserves subdirectories beneath the extracted directory rather than flattening them
  • Behavior change: extraction no longer fails when the modification time cannot be set

0.5.4 / 2021-03-08

  • Fixed relative paths
  • Added zipcrypto encryption
  • Lower verMade for macOS when generating zip file

0.5.3 / 2021-02-07

  • Fixed filemode when unzipping

0.5.2 / 2021-01-27

  • Fixed path traversal issue (GHSL-2020-198)

0.5.1 / 2020-11-27

  • Incremented version (cthackers)
  • Fixed outFileName (cthackers)

0.5.0 / 2020-11-19

  • Added extra parameter to extractEntryTo so target filename can be renamed (cthackers)

... (truncated)

Details Description has been truncated

@dependabot
build(deps): bump the npm_and_yarn group across 2 directories with 23…
2ffa024 
… updates

Bumps the npm_and_yarn group with 1 update in the /packages/backend directory: [fastify](https://github.com/fastify/fastify).
Bumps the npm_and_yarn group with 23 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [fastify](https://github.com/fastify/fastify) | `4.29.1` | `5.12.5` |
| [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) | `7.28.6` | `7.29.7` |
| [@fastify/static](https://github.com/fastify/fastify-static) | `7.0.4` | `10.1.5` |
| [@hono/node-server](https://github.com/honojs/node-server) | `1.19.9` | `1.19.17` |
| [nanoid](https://github.com/ai/nanoid) | `3.3.11` | `3.3.20` |
| [@vue/server-renderer](https://github.com/vuejs/core/tree/HEAD/packages/server-renderer) | `3.5.27` | `3.5.43` |
| [adm-zip](https://github.com/cthackers/adm-zip) | `0.5.16` | `0.6.1` |
| [fast-uri](https://github.com/fastify/fast-uri) | `3.1.0` | `3.1.8` |
| [fast-uri](https://github.com/fastify/fast-uri) | `2.4.0` | `2.4.7` |
| [baseline-browser-mapping](https://github.com/web-platform-dx/baseline-browser-mapping) | `2.9.19` | `2.11.27` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `2.0.2` | `2.1.7` |
| [browserslist](https://github.com/browserslist/browserslist) | `4.28.1` | `4.29.3` |
| [fflate](https://github.com/101arrowz/fflate) | `0.8.2` | `0.8.3` |
| [figlet](https://github.com/patorjk/figlet.js) | `1.10.0` | `1.12.0` |
| [form-data](https://github.com/form-data/form-data) | `4.0.5` | `4.0.6` |
| [hono](https://github.com/honojs/hono) | `4.11.7` | `4.13.13` |
| [ip-address](https://github.com/beaugunderson/ip-address) | `10.1.0` | `10.7.3` |
| [postcss](https://github.com/postcss/postcss) | `8.5.6` | `8.5.29` |
| [proxy-addr](https://github.com/jshttp/proxy-addr) | `2.0.7` | `2.0.8` |
| [sharp](https://github.com/lovell/sharp) | `0.33.5` | `removed` |
| [shell-quote](https://github.com/ljharb/shell-quote) | `1.8.3` | `1.12.0` |
| [source-map-js](https://github.com/7rulnik/source-map-js) | `1.2.1` | `1.2.2` |
| [stream-json](https://github.com/uhop/stream-json) | `1.9.1` | `3.7.0` |
| [ws](https://github.com/websockets/ws) | `8.19.0` | `8.22.0` |



Updates `fastify` from 4.29.1 to 5.12.5
- [Release notes](https://github.com/fastify/fastify/releases)
- [Commits](fastify/fastify@v4.29.1...v5.12.5)

Updates `fastify` from 4.29.1 to 5.12.5
- [Release notes](https://github.com/fastify/fastify/releases)
- [Commits](fastify/fastify@v4.29.1...v5.12.5)

Updates `@babel/core` from 7.28.6 to 7.29.7
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.29.7/packages/babel-core)

Updates `@fastify/static` from 7.0.4 to 10.1.5
- [Release notes](https://github.com/fastify/fastify-static/releases)
- [Commits](fastify/fastify-static@v7.0.4...v10.1.5)

Updates `@hono/node-server` from 1.19.9 to 1.19.17
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v1.19.9...v1.19.17)

Updates `nanoid` from 3.3.11 to 3.3.20
- [Release notes](https://github.com/ai/nanoid/releases)
- [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md)
- [Commits](ai/nanoid@3.3.11...3.3.20)

Updates `@vue/server-renderer` from 3.5.27 to 3.5.43
- [Release notes](https://github.com/vuejs/core/releases)
- [Changelog](https://github.com/vuejs/core/blob/main/CHANGELOG.md)
- [Commits](https://github.com/vuejs/core/commits/v3.5.43/packages/server-renderer)

Updates `adm-zip` from 0.5.16 to 0.6.1
- [Release notes](https://github.com/cthackers/adm-zip/releases)
- [Changelog](https://github.com/cthackers/adm-zip/blob/master/history.md)
- [Commits](cthackers/adm-zip@v0.5.16...v0.6.1)

Updates `fast-uri` from 3.1.0 to 3.1.8
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.0...v3.1.8)

Updates `fast-uri` from 2.4.0 to 2.4.7
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.0...v3.1.8)

Updates `baseline-browser-mapping` from 2.9.19 to 2.11.27
- [Release notes](https://github.com/web-platform-dx/baseline-browser-mapping/releases)
- [Commits](web-platform-dx/baseline-browser-mapping@v2.9.19...v2.11.27)

Updates `brace-expansion` from 2.0.2 to 2.1.7
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v2.0.2...v2.1.7)

Updates `browserslist` from 4.28.1 to 4.29.3
- [Release notes](https://github.com/browserslist/browserslist/releases)
- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md)
- [Commits](browserslist/browserslist@4.28.1...4.29.3)

Updates `fflate` from 0.8.2 to 0.8.3
- [Release notes](https://github.com/101arrowz/fflate/releases)
- [Changelog](https://github.com/101arrowz/fflate/blob/master/CHANGELOG.md)
- [Commits](101arrowz/fflate@v0.8.2...v0.8.3)

Updates `figlet` from 1.10.0 to 1.12.0
- [Release notes](https://github.com/patorjk/figlet.js/releases)
- [Commits](patorjk/figlet.js@v1.10.0...v1.12.0)

Updates `form-data` from 4.0.5 to 4.0.6
- [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md)
- [Commits](form-data/form-data@v4.0.5...v4.0.6)

Updates `hono` from 4.11.7 to 4.13.13
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.11.7...v4.13.13)

Updates `ip-address` from 10.1.0 to 10.7.3
- [Release notes](https://github.com/beaugunderson/ip-address/releases)
- [Commits](beaugunderson/ip-address@v10.1.0...v10.7.3)

Updates `postcss` from 8.5.6 to 8.5.29
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.6...8.5.29)

Updates `proxy-addr` from 2.0.7 to 2.0.8
- [Release notes](https://github.com/jshttp/proxy-addr/releases)
- [Changelog](https://github.com/jshttp/proxy-addr/blob/master/HISTORY.md)
- [Commits](jshttp/proxy-addr@v2.0.7...v2.0.8)

Removes `sharp`

Updates `shell-quote` from 1.8.3 to 1.12.0
- [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md)
- [Commits](ljharb/shell-quote@v1.8.3...v1.12.0)

Updates `source-map-js` from 1.2.1 to 1.2.2
- [Release notes](https://github.com/7rulnik/source-map-js/releases)
- [Changelog](https://github.com/7rulnik/source-map-js/blob/main/CHANGELOG.md)
- [Commits](7rulnik/source-map-js@v1.2.1...v1.2.2)

Updates `stream-json` from 1.9.1 to 3.7.0
- [Commits](uhop/stream-json@1.9.1...3.7.0)

Updates `ws` from 8.19.0 to 8.22.0
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.19.0...8.22.0)

---
updated-dependencies:
- dependency-name: fastify
  dependency-version: 5.12.5
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: fastify
  dependency-version: 5.12.5
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@babel/core"
  dependency-version: 7.29.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@fastify/static"
  dependency-version: 10.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@hono/node-server"
  dependency-version: 1.19.17
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: nanoid
  dependency-version: 3.3.20
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@vue/server-renderer"
  dependency-version: 3.5.43
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: adm-zip
  dependency-version: 0.6.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fast-uri
  dependency-version: 3.1.8
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fast-uri
  dependency-version: 2.4.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: baseline-browser-mapping
  dependency-version: 2.11.27
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 2.1.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: browserslist
  dependency-version: 4.29.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fflate
  dependency-version: 0.8.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: figlet
  dependency-version: 1.12.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: form-data
  dependency-version: 4.0.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: hono
  dependency-version: 4.13.13
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ip-address
  dependency-version: 10.7.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: postcss
  dependency-version: 8.5.29
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: proxy-addr
  dependency-version: 2.0.8
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: sharp
  dependency-version:
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: shell-quote
  dependency-version: 1.12.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: source-map-js
  dependency-version: 1.2.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: stream-json
  dependency-version: 3.7.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-version: 8.22.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Changes to project dependencies (npm packages) javascript Pull requests that update javascript code labels Oct 6, 2026
@dependabot dependabot Bot added dependencies Changes to project dependencies (npm packages) javascript Pull requests that update javascript code labels Oct 6, 2026
@github-actions github-actions Bot added size/small Small effort: 1-2 hours of work frontend Frontend-related code (Vue.js, TypeScript, UI components) backend Backend-related code (Node.js, API, database, repositories) labels Oct 6, 2026
@github-actions

github-actions Bot commented Oct 6, 2026

Copy link
Copy Markdown
Contributor

Dependency Review

The following issues were found:

  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ✅ 0 package(s) with unknown licenses.
  • ⚠️ 2 packages with OpenSSF Scorecard issues.

View full job summary

@socket-security

socket-security Bot commented Oct 6, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedheroshot@​0.11.4 ⏵ 0.19.478 +110010096 +1100
Addedvitest@​5.0.3981007999100
Addedvue@​3.5.43991009196100
Updated@​fastify/​swagger-ui@​4.2.0 ⏵ 6.1.110010010096 +5100
Addedfastify@​5.12.59810010098100
Updatedcrawlee@​3.15.3 ⏵ 3.18.299 +28100100100100

View full report

@gander gander closed this Oct 6, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 6, 2026

Copy link
Copy Markdown
Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/npm_and_yarn-df08fe7df2 branch October 6, 2026 10:53
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

No reviews

Assignees

No one assigned

Labels

backend Backend-related code (Node.js, API, database, repositories) dependencies Changes to project dependencies (npm packages) frontend Frontend-related code (Vue.js, TypeScript, UI components) javascript Pull requests that update javascript code size/small Small effort: 1-2 hours of work

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@gander