Skip to content

chore(deps): bump the npm_and_yarn group across 2 directories with 14 updates - #17

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-570913ade1
Open

chore(deps): bump the npm_and_yarn group across 2 directories with 14 updates#17
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-570913ade1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 19, 2026

Copy link
Copy Markdown

Bumps the npm_and_yarn group with 9 updates in the / directory:

Package From To
next 16.2.4 16.2.11
postcss 8.5.12 8.5.23
vite 5.4.21 6.4.3
brace-expansion 2.1.0 2.1.4
brace-expansion 5.0.5 5.0.9
brace-expansion 1.1.14 1.1.18
body-parser 2.2.2 2.3.0
fast-xml-builder 1.1.5 1.3.1
form-data 4.0.5 4.0.6
js-yaml 4.1.1 4.3.1
sharp 0.34.5 0.35.2

Bumps the npm_and_yarn group with 1 update in the /apps/extension directory: vite.

Updates next from 16.2.4 to 16.2.11

Release notes

Sourced from next's releases.

v16.2.11

This release contains security fixes for the following advisories:

High:

Moderate:

v16.2.10

Contains no changes except publishing @next/swc-wasm-web which was accidentally not published since 16.2.4.

v16.2.9

Empty release to ensure next@latest points at a stable release. Next.js only allows publishing with Trusted Publishing enabled. In order to fix NPM dist-tags, we have to release a new version. Updating dist-tags is not possible with Trusted Publishing.

v16.2.8

Release with no changes in an attempt to fix next@latest pointing at a prerelease version.

Commits
  • 9beca08 v16.2.11
  • 3c48c7a [16.x] Fix Turbopack middleware matcher with i18n single locale
  • ac1eff3 [16.x] Improve performance of checking valid MPA form submissions
  • 9a4651e [16.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
  • b512063 [16.x] Set correct origin for internal redirects in custom server
  • d303326 [16.x] Ensure exotic rewrite param values are properly encoded
  • 73b9487 [16.x] fix(fetch-cache): key fetch(Request, init) by the effective request
  • bf9d17f [16.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies
  • fe28768 [16.x] fix(next/image): improve performance of detectContentType()
  • d8afb8d [16.x] Performance improvements when decoding React Server function payloads
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.


Updates postcss from 8.5.12 to 8.5.23

Release notes

Sourced from postcss's releases.

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

8.5.19

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

  • Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

  • Fixed Maximum call stack size exceeded error.
  • Fixed Prototype hijacking for postcss.fromJSON().
  • Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

8.5.15

  • Fixed declaration parsing performance (by @​homanp).

8.5.14

8.5.13

  • Fixed postcss-scss commend regression.
Changelog

Sourced from postcss's changelog.

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

8.5.19

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

  • Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

  • Fixed Maximum call stack size exceeded error.
  • Fixed Prototype hijacking for postcss.fromJSON().
  • Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

8.5.15

  • Fixed declaration parsing performance (by @​homanp).

8.5.14

8.5.13

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.


Updates vite from 5.4.21 to 6.4.3

Release notes

Sourced from vite's releases.

v6.4.3

Please refer to CHANGELOG.md for details.

v6.4.2

Please refer to CHANGELOG.md for details.

v6.4.1

Please refer to CHANGELOG.md for details.

v6.4.0

Please refer to CHANGELOG.md for details.

v6.3.7

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

6.4.3 (2026-06-01)

6.4.2 (2026-04-06)

6.4.1 (2025-10-20)

6.4.0 (2025-10-15)

  • feat: allow passing down resolved config to vite's createServer (#20932) (ca6455e), closes #20932

6.3.7 (2025-10-14)

  • fix(esbuild): inject esbuild helpers correctly for esbuild 0.25.9+ (#20940) (c59a222), closes #20940

6.3.6 (2025-09-08)

6.3.5 (2025-05-05)

6.3.4 (2025-04-30)

  • fix: check static serve file inside sirv (#19965) (c22c43d), closes #19965
  • fix(optimizer): return plain object when using require to import externals in optimized dependenci (efc5eab), closes #19940

... (truncated)

Commits

Updates brace-expansion from 2.1.0 to 2.1.4

Release notes

Sourced from brace-expansion's releases.

v2.1.1

  • Backport v5.0.6 change to v2 (#109) c3a817c

juliangruber/brace-expansion@v2.1.0...v2.1.1

Commits

Updates brace-expansion from 5.0.5 to 5.0.9

Release notes

Sourced from brace-expansion's releases.

v2.1.1

  • Backport v5.0.6 change to v2 (#109) c3a817c

juliangruber/brace-expansion@v2.1.0...v2.1.1

Commits

Updates brace-expansion from 1.1.14 to 1.1.18

Release notes

Sourced from brace-expansion's releases.

v2.1.1

  • Backport v5.0.6 change to v2 (#109) c3a817c

juliangruber/brace-expansion@v2.1.0...v2.1.1

Commits

Updates body-parser from 2.2.2 to 2.3.0

Release notes

Sourced from body-parser's releases.

v2.3.0

Important: Security

What's Changed

New Contributors

Full Changelog: expressjs/body-parser@v2.2.2...v2.3.0

Changelog

Sourced from body-parser's changelog.

2.3.0 / 2026-06-15

  • Security fix for GHSA-v422-hmwv-36x6
  • fix: use static exports instead of lazy getters to improve ESM compatibility
  • feat: add subpath exports for individual parsers
  • fix: improve limit option validation (#698)
    • Invalid limit values (e.g. unparseable strings or NaN) now throw instead of being silently ignored, which previously disabled size limit enforcement
    • null and undefined fall back to the default 100kb limit
  • deps:
    • content-type@^2.0.0
    • http-errors@^2.0.1
    • iconv-lite^0.7.2
    • qs@^6.15.2
    • raw-body@^3.0.2
    • type-is@^2.1.0
Commits
  • d0f2ace 2.3.0 (#735)
  • 7d03f2f chore: updated deps to latest (#733)
  • 8024ba7 build(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#732)
  • 32b4ed4 build(deps): bump github/codeql-action from 4.35.3 to 4.36.1 (#731)
  • ff0f6b9 docs: update outdated reference to MDN docs (#730)
  • 14d001a refactor: switch to const/let and enable eslint no-var rule (#729)
  • 37f36a2 deps: update content-type and type-is (#728)
  • e1c244b build(deps): bump github/codeql-action from 4.35.1 to 4.35.3 (#723)
  • e01087f build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#724)
  • a7698d3 build(deps): bump actions/setup-node from 6.3.0 to 6.4.0 (#725)
  • Additional commits viewable in compare view

Updates esbuild from 0.21.5 to 0.25.4

Release notes

Sourced from esbuild's releases.

v0.25.4

  • Add simple support for CORS to esbuild's development server (#4125)

    Starting with version 0.25.0, esbuild's development server is no longer configured to serve cross-origin requests. This was a deliberate change to prevent any website you visit from accessing your running esbuild development server. However, this change prevented (by design) certain use cases such as "debugging in production" by having your production website load code from localhost where the esbuild development server is running.

    To enable this use case, esbuild is adding a feature to allow Cross-Origin Resource Sharing (a.k.a. CORS) for simple requests. Specifically, passing your origin to the new cors option will now set the Access-Control-Allow-Origin response header when the request has a matching Origin header. Note that this currently only works for requests that don't send a preflight OPTIONS request, as esbuild's development server doesn't currently support OPTIONS requests.

    Some examples:

    • CLI:

      esbuild --servedir=. --cors-origin=https://example.com

    • JS:

      const ctx = await esbuild.context({})
await ctx.serve({
  servedir: '.',
  cors: {
    origin: 'https://example.com',
  },
})

    • Go:

      ctx, _ := api.Context(api.BuildOptions{})
ctx.Serve(api.ServeOptions{
  Servedir: ".",
  CORS: api.CORSOptions{
    Origin: []string{"https://example.com"},
  },
})

    The special origin * can be used to allow any origin to access esbuild's development server. Note that this means any website you visit will be able to read everything served by esbuild.

  • Pass through invalid URLs in source maps unmodified (#4169)

    This fixes a regression in version 0.25.0 where sources in source maps that form invalid URLs were not being passed through to the output. Version 0.25.0 changed the interpretation of sources from file paths to URLs, which means that URL parsing can now fail. Previously URLs that couldn't be parsed were replaced with the empty string. With this release, invalid URLs in sources should now be passed through unmodified.

  • Handle exports named __proto__ in ES modules (#4162, #4163)

    In JavaScript, the special property name __proto__ sets the prototype when used inside an object literal. Previously esbuild's ESM-to-CommonJS conversion didn't special-case the property name of exports named __proto__ so the exported getter accidentally became the prototype of the object literal. It's unclear what this affects, if anything, but it's better practice to avoid this by using a computed property name in this case.

    This fix was contributed by @​magic-akari.

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2024

This changelog documents all esbuild versions published in the year 2024 (versions 0.19.12 through 0.24.2).

0.24.2

  • Fix regression with --define and import.meta (#4010, #4012, #4013)

    The previous change in version 0.24.1 to use a more expression-like parser for define values to allow quoted property names introduced a regression that removed the ability to use --define:import.meta=.... Even though import is normally a keyword that can't be used as an identifier, ES modules special-case the import.meta expression to behave like an identifier anyway. This change fixes the regression.

    This fix was contributed by @​sapphi-red.

0.24.1

  • Allow es2024 as a target in tsconfig.json (#4004)

    TypeScript recently added es2024 as a compilation target, so esbuild now supports this in the target field of tsconfig.json files, such as in the following configuration file:

    {
  "compilerOptions": {
    "target": "ES2024"
  }
}

    As a reminder, the only thing that esbuild uses this field for is determining whether or not to use legacy TypeScript behavior for class fields. You can read more in the documentation.

    This fix was contributed by @​billyjanitsch.

  • Allow automatic semicolon insertion after get/set

    This change fixes a grammar bug in the parser that incorrectly treated the following code as a syntax error:

    class Foo {
  get
  *x() {}
  set
  *y() {}
}

    The above code will be considered valid starting with this release. This change to esbuild follows a similar change to TypeScript which will allow this syntax starting with TypeScript 5.7.

  • Allow quoted property names in --define and --pure (#4008)

    The define and pure API options now accept identifier expressions containing quoted property names. Previously all identifiers in the identifier expression had to be bare identifiers. This change now makes --define and --pure consistent with --global-name, which already supported quoted property names. For example, the following is now possible:

    

    • 






... (truncated)





Commits

    

  • 218d29e publish 0.25.4 to npm
    • 

  • e66cd0b dev server: simple support for CORS requests (#4171)
    • 

  • 8bf3368 js api: validate some options as arrays of strings
    • 

  • 1e7375a js api: simplify comma-separated array validation
    • 

  • 5f5964d release notes for #4163
    • 

  • adb5284 fix: handle __proto__ as a computed property in exports and add tests for s...
    • 

  • 0aa9f7b fix #4169: keep invalid source map URLs unmodified
    • 

  • 5959289 add additional guards for #4114 when using :is()
    • 

  • 677910b publish 0.25.3 to npm
    • 

  • a41040e fix #4110: support custom non-IP host values
    • 

  • Additional commits viewable in compare view
    • 







Updates fast-xml-builder from 1.1.5 to 1.3.1



Release notes

Sourced from fast-xml-builder's releases.




v1.3.1


What's Changed



New Contributors



Full Changelog: NaturalIntelligence/fast-xml-builder@v1.3.0...v1.3.1







Changelog

Sourced from fast-xml-builder's changelog.




1.3.1 (2026-08-14)


    

  • fix: preserve negative sign for zero (By rajanpanth)
    • 



1.3.0 (2026-07-11)


    

  • upgrade:

      

    • xml-naming v0.3.0: cache support
      • 

    • PEM v1.6.2: sibling bug fix
      • 

    

    • 



1.2.1 (2026-07-03)


    

  • fix: escape quotes in stopNode attribute values (By greymoth)
    • 

  • fix: neutralize double hyphen in multi-key comment object (By spokodev)
    • 



1.2.0 (2026-05-08)


    

  • Add support for sanitizeName option
    • 

  • Support xml-naming for validating and sanitizing tag and attribute names
    • 



1.1.9 (2026-05-06)


    

  • fix: format output for preserve order when indent by is set to empty string
    • 



1.1.8 (2026-05-05)


    

  • fix: skip text property for PI tags
    • 

  • improve typings
    • 



1.1.7 (2026--05-04)


    

  • fix security issues when attribute value contains quotes
    • 



1.1.6 (2026--05-04)


    

  • fix security issues related to comment
    • 

  • skip comment with null value
    • 



1.1.5 (2026-04-17)


    

  • fix security issues related to comment and cdata
    • 



1.1.4 (2026-03-16)


    

  • support maxNestedTags option
    • 



1.1.3 (2026-03-13)


    

  • declare Matcher & Expression as unknown so user is not forced to install path-expression-matcher
    • 



1.1.2 (2026-03-11)


    

  • fix typings
    • 



1.1.1 (2026-03-11)


    

  • upgrade path-expression-matcher to 1.1.3
    • 



1.1.0 (2026-03-10)





... (truncated)





Commits





Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for fast-xml-builder since your current version.






Updates form-data from 4.0.5 to 4.0.6



Changelog

Sourced from form-data's changelog.




v4.0.6 - 2026-06-12


Commits


    

  • [Fix] escape CR, LF, and " in field names and filenames 8dff42c
    • 

  • [Dev Deps] update @ljharb/eslint-config, auto-changelog, tape f31d21e
    • 

  • [Deps] update hasown, mime-types 92ae0eb
    • 

  • [Dev Deps] update js-randomness-predictor 67b0f65
    • 








Commits

    

  • 64190db v4.0.6
    • 

  • 92ae0eb [Deps] update hasown, mime-types
    • 

  • f31d21e [Dev Deps] update @ljharb/eslint-config, auto-changelog, tape
    • 

  • 8dff42c [Fix] escape CR, LF, and " in field names and filenames
    • 

  • 67b0f65 [Dev Deps] update js-randomness-predictor
    • 

  • See full diff in compare view
    • 







Updates js-yaml from 4.1.1 to 4.3.1



Changelog

Sourced from js-yaml's changelog.




4.3.1 - 2026-07-31


Security


    

  • [backport] Remove quadratic complexity from !!omap duplicate key detection.
    • 



4.3.0 - 2026-06-27


Added


    

  • [backport] Added maxTotalMergeKeys (10000) loader option to limit the total number of
keys processed by YAML merge (<<) across one load() / loadAll() call.
    • 



Fixed


    

  • Restore umd builds back to es5.
    • 



Removed


    

  • [backport] maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge
processing.
    • 



[4.2.0] - 2026-06-01


Added


    

  • Added docs/safety.md with notes about processing untrusted YAML.
    • 

  • Added maxDepth (100) loader option. Not a problem, but gives a better
exception instead of RangeError on stack overflow.
    • 

  • Added maxMergeSeqLength (20) loader option. Not a problem after merge fix,
but an additional restriction for safety.
    • 

  • Added sourcemaps to dist/ builds.
    • 



Changed


    

  • Stop resolving numbers with underscores as numeric scalars, #627.
    • 

  • Switched dev toolchains to Vite / neostandard.
    • 

  • Updated demo.
    • 

  • Reorganized tests.
    • 

  • dist/ files are no longer kept in the repository.
    • 



Fixed


    

  • Fix parsing of properties on the first implicit block mapping key, #62.
    • 

  • Fix trailing whitespace handling when folding flow scalar lines, #307.
    • 

  • Reject top-level block scalars without content indentation, #280.
    • 

  • Ensure numbers survive round-trip, #737.
    • 

  • Fix test coverage for issue #221.
    • 

  • Fix flow scalar trailing whitespace folding, #307.
    • 

  • Fix digits in YAML named tag handles.
    • 



Security


    

  • Fix potential DoS via quadratic complexity in merge - deduplicate repeated
elements (makes sense for malformed files > 10K).
    • 



[3.14.2] - 2025-11-15


Security





... (truncated)





Commits

    

  • 86e91b8 4.3.1 released
    • 

  • c3cc4b0 Backport quadratic complexity fix for !!omap
    • 

  • 33d05b5 4.3.0 released
    • 

  • 663bfab Drop demo publish, to not override new v5 one.
    • 

  • 1cb8c7b Add v4-legacy tag for publish
    • 

  • 02f27af Restore umd builds back to es5
    • 

  • 8be84ed Fix es5 compatibility
    • 

  • 59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
    • 

  • 6842ef6 doc polish
    • 

  • 590dbab 4.2.0 released
    • 

  • Additional commits viewable in 

    

  
  



      


          

          
  
  

    
  
    
    

  

  

  



                    

          
        





  





    



      

  
        

  

      

  
  

  
          

  

    

      


  

        
          @dependabot
  




      

        
          chore(deps): bump the npm_and_yarn group across 2 directories with 14…
        

          
                        
      


      

        

    
    
    

  

    


      


      

        

          

    
    
    

  

  

    
  



        

      


      

        
          d5df884
        
      

    

  

    

      
… updates

Bumps the npm_and_yarn group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [next](https://github.com/vercel/next.js) | `16.2.4` | `16.2.11` |
| [postcss](https://github.com/postcss/postcss) | `8.5.12` | `8.5.23` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `5.4.21` | `6.4.3` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `2.1.0` | `2.1.4` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `5.0.5` | `5.0.9` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.14` | `1.1.18` |
| [body-parser](https://github.com/expressjs/body-parser) | `2.2.2` | `2.3.0` |
| [fast-xml-builder](https://github.com/NaturalIntelligence/fast-xml-builder) | `1.1.5` | `1.3.1` |
| [form-data](https://github.com/form-data/form-data) | `4.0.5` | `4.0.6` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.1` | `4.3.1` |
| [sharp](https://github.com/lovell/sharp) | `0.34.5` | `0.35.2` |

Bumps the npm_and_yarn group with 1 update in the /apps/extension directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite).


Updates `next` from 16.2.4 to 16.2.11
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.2.4...v16.2.11)

Updates `postcss` from 8.5.12 to 8.5.23
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.12...8.5.23)

Updates `vite` from 5.4.21 to 6.4.3
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v6.4.3/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v6.4.3/packages/vite)

Updates `brace-expansion` from 2.1.0 to 2.1.4
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v2.1.0...v2.1.4)

Updates `brace-expansion` from 5.0.5 to 5.0.9
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v2.1.0...v2.1.4)

Updates `brace-expansion` from 1.1.14 to 1.1.18
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v2.1.0...v2.1.4)

Updates `body-parser` from 2.2.2 to 2.3.0
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@v2.2.2...v2.3.0)

Updates `esbuild` from 0.21.5 to 0.25.4
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2024.md)
- [Commits](evanw/esbuild@v0.21.5...v0.25.4)

Updates `fast-xml-builder` from 1.1.5 to 1.3.1
- [Release notes](https://github.com/NaturalIntelligence/fast-xml-builder/releases)
- [Changelog](https://github.com/NaturalIntelligence/fast-xml-builder/blob/main/CHANGELOG.md)
- [Commits](NaturalIntelligence/fast-xml-builder@v1.1.5...v1.3.1)

Updates `form-data` from 4.0.5 to 4.0.6
- [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md)
- [Commits](form-data/form-data@v4.0.5...v4.0.6)

Updates `js-yaml` from 4.1.1 to 4.3.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.1...4.3.1)

Updates `nanoid` from 3.3.11 to 3.3.18
- [Release notes](https://github.com/ai/nanoid/releases)
- [Changelog](https://github.com/ai/nanoid/blob/3.3.18/CHANGELOG.md)
- [Commits](ai/nanoid@3.3.11...3.3.18)

Updates `qs` from 6.15.1 to 6.15.3
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.15.1...v6.15.3)

Updates `sharp` from 0.34.5 to 0.35.2
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](lovell/sharp@v0.34.5...v0.35.2)

Updates `undici` from 7.24.8 to 7.29.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.24.8...v7.29.0)

Updates `ws` from 8.18.0 to 8.21.0
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.18.0...8.21.0)

Updates `vite` from 5.4.21 to 8.2.1
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v6.4.3/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v6.4.3/packages/vite)

---
updated-dependencies:
- dependency-name: next
  dependency-version: 16.2.11
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: postcss
  dependency-version: 8.5.23
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 6.4.3
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 2.1.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 5.0.9
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 1.1.18
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: body-parser
  dependency-version: 2.3.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: esbuild
  dependency-version: 0.25.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fast-xml-builder
  dependency-version: 1.3.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: form-data
  dependency-version: 4.0.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 4.3.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: nanoid
  dependency-version: 3.3.18
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.15.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: sharp
  dependency-version: 0.35.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 7.29.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-version: 8.21.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 8.2.1
  dependency-type: direct:development
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>

    







  








      

  
            

    

      
    

    


      


          @dependabot
dependabot
Bot



            added
      
  dependencies

  Pull requests that update a dependency file

      
  javascript

  Pull requests that update javascript code

  labels


      Aug 19, 2026

    

  












  
  

    

      

  










  








  
      

  
    Sign up for free
    to join this conversation on GitHub.
    Already have an account?
    Sign in to comment


  










    
        

  

    
    

    

  

    Reviewers
  


    

    No reviews







  
      

  


      
  

    Assignees
  



        


    No one assigned







  
        


  


  

    Labels
  



    

      
    dependencies

  Pull requests that update a dependency file
  
    javascript

  Pull requests that update javascript code








  
        

  

    

        

    Projects
  


        




    None yet




  



  
        


  

    
  

    Milestone
  


      No milestone





    
      
          


  

    

      
        

          
  

    Development
  



            


Successfully merging this pull request may close these issues.





  
  



      
    

  




      

  
  
        

  

    

      0 participants