Skip to content

Bump the npm_and_yarn group across 1 directory with 7 updates - #663

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/npm_and_yarn-e8d1824c84
Open

Bump the npm_and_yarn group across 1 directory with 7 updates#663
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/npm_and_yarn-e8d1824c84

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 9, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 7 updates in the / directory:

Package From To
brace-expansion 1.1.15 1.1.18
js-yaml 3.15.0 3.15.1
dompurify 3.4.11 3.4.13
fast-uri 3.1.2 3.1.5
ip-address 10.2.0 10.4.0
undici 6.27.0 6.28.0
postcss 8.5.16 8.5.26

Updates brace-expansion from 1.1.15 to 1.1.18

Commits

Updates js-yaml from 3.15.0 to 3.15.1

Changelog

Sourced from js-yaml's changelog.

3.15.1 - 2026-07-31

Security

  • [backport] Remove quadratic complexity from !!omap duplicate key detection.
Commits

Updates dompurify from 3.4.11 to 3.4.13

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.13

  • Fixed an issue with hook removal during IN_PLACE sanitization, thanks @鈥媖oyokr
  • Fixed an issue with hooks potentially bypassing the clone guard, thanks @鈥婣kshayjainG
  • Fixed an issue with DOM clobbering via ownerDocument during IN_PLACE, thanks @鈥婣kshayjainG
  • Bumped several dependencies where possible

DOMPurify 3.4.12

  • Fixed an issue where a hook would not get called for custom elements, thanks @鈥婻ikuxx0
  • Hardened the handling of hooks removing elements, @鈥媘krause-bee360
  • Added support for a few new SVG attributes, thanks @鈥媍bn-falias & @鈥婦evelop-KIM
  • Hardened the handling of declarative partial updates
  • Updated the documentation is several spots, README, wiki, etc.
  • Bumped several dependencies where possible
Commits

Updates fast-uri from 3.1.2 to 3.1.5

Release notes

Sourced from fast-uri's releases.

v3.1.5

鈿狅笍 Security Warning

Fix for GHSA-7p8r-x3mc-p8w7

Full Changelog: fastify/fast-uri@v3.1.4...v3.1.5

v3.1.4

鈿狅笍 Security Release

Fix for GHSA-v2hh-gcrm-f6hx

Full Changelog: fastify/fast-uri@v3.1.3...v3.1.4

v3.1.3

鈿狅笍 Security Release

Full Changelog: fastify/fast-uri@v3.1.2...v3.1.3

Commits

Updates ip-address from 10.2.0 to 10.4.0

Release notes

Sourced from ip-address's releases.

v10.4.0

What's Changed

Full Changelog: beaugunderson/ip-address@v10.3.1...v10.4.0

v10.3.1

Full Changelog: beaugunderson/ip-address@v10.3.0...v10.3.1

v10.3.0

Full Changelog: beaugunderson/ip-address@v10.2.2...v10.3.0

v10.2.2

Full Changelog: beaugunderson/ip-address@v10.2.1...v10.2.2

v10.2.1

Full Changelog: beaugunderson/ip-address@v10.2.0...v10.2.1

Commits
  • fbb8db2 10.4.0
  • 45a2b11 Validate the byte arrays Address6 is given (#217)
  • bac8810 Keep the package loadable on node 12, and enforce it (#216)
  • 9b3d848 Add a security policy and a README section on security posture
  • e84a7b3 Order the README API reference Address4, Address6, AddressError
  • 015160b Collapse each class in the README API reference
  • 34061a8 Pin checkout and setup-node to commits in the release job
  • c5fae5d Pin action-gh-release to a commit and move it to 3.0.2
  • e0ef048 Replace CircleCI with GitHub Actions
  • 5e3ceb7 Add GitHub Actions CI across Node 20, 22, 24 and 25 (#213)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for ip-address since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates undici from 6.27.0 to 6.28.0

Release notes

Sourced from undici's releases.

v6.28.0

鈿狅笍 Security fixes

  • GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 740a0b7c.
  • GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by cba3a52a, with corrected fixtures in 4fd5a0c6.
  • GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by af748404.

GHSA-4cwx-7wf7-3272 and GHSA-jr45-8vmc-qm54 affect the cache interceptor in Undici v7 and v8; Undici v6 is not in their affected version ranges.

Full Changelog: nodejs/undici@v6.27.0...v6.28.0

Commits
  • 01a912e Bumped v6.28.0 (#5591)
  • 481ecfc Use Node 22 and npm 11 to release
  • 740a0b7 fix: validate blob body content type
  • 2698e49 fix: validate coerced header values for CRLF (#5579)
  • 4fd5a0c test(retry): correct broken content-range fixtures in retry-handler.js
  • cba3a52 fix(retry): reject partial content length mismatch
  • af74840 fix: harden cookie domain, path, and unparsed attribute validation
  • See full diff in compare view

Updates postcss from 8.5.16 to 8.5.26

Release notes

Sourced from postcss's releases.

8.5.26

8.5.25

  • Fixed 8.5.17 visitor regression.
  • Fixed list.split() for non-string values (by @鈥媋mir-rezaei).

8.5.24

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

  • Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

  • Fixed Maximum call stack size exceeded error.
  • Fixed Prototype hijacking for postcss.fromJSON().
  • Fixed Input#origin() for unmapped end position (by @鈥媍hatman-media).
Changelog

Sourced from postcss's changelog.

8.5.26

8.5.25

  • Fixed 8.5.17 visitor regression.
  • Fixed list.split() for non-string values (by @鈥媋mir-rezaei).

8.5.24

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

  • Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

  • Fixed Maximum call stack size exceeded error.
  • Fixed Prototype hijacking for postcss.fromJSON().
  • Fixed Input#origin() for unmapped end position (by @鈥媍hatman-media).
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump the npm_and_yarn group across 1 directory with 7 updates
b2b3974 
Bumps the npm_and_yarn group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.15` | `1.1.18` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `3.15.0` | `3.15.1` |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.4.11` | `3.4.13` |
| [fast-uri](https://github.com/fastify/fast-uri) | `3.1.2` | `3.1.5` |
| [ip-address](https://github.com/beaugunderson/ip-address) | `10.2.0` | `10.4.0` |
| [undici](https://github.com/nodejs/undici) | `6.27.0` | `6.28.0` |
| [postcss](https://github.com/postcss/postcss) | `8.5.16` | `8.5.26` |



Updates `brace-expansion` from 1.1.15 to 1.1.18
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.15...v1.1.18)

Updates `js-yaml` from 3.15.0 to 3.15.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/3.15.1/CHANGELOG.md)
- [Commits](nodeca/js-yaml@3.15.0...3.15.1)

Updates `dompurify` from 3.4.11 to 3.4.13
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.11...3.4.13)

Updates `fast-uri` from 3.1.2 to 3.1.5
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.2...v3.1.5)

Updates `ip-address` from 10.2.0 to 10.4.0
- [Release notes](https://github.com/beaugunderson/ip-address/releases)
- [Commits](beaugunderson/ip-address@v10.2.0...v10.4.0)

Updates `undici` from 6.27.0 to 6.28.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.27.0...v6.28.0)

Updates `postcss` from 8.5.16 to 8.5.26
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.16...8.5.26)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 1.1.18
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 3.15.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: dompurify
  dependency-version: 3.4.13
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fast-uri
  dependency-version: 3.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ip-address
  dependency-version: 10.4.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 6.28.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: postcss
  dependency-version: 8.5.26
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 9, 2026
@dependabot dependabot Bot mentioned this pull request Aug 9, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants