Bump the npm_and_yarn group across 2 directories with 16 updates#9
Open
dependabot[bot] wants to merge 1 commit intomainfrom
Open
Bump the npm_and_yarn group across 2 directories with 16 updates#9dependabot[bot] wants to merge 1 commit intomainfrom
dependabot[bot] wants to merge 1 commit intomainfrom
Conversation
Bumps the npm_and_yarn group with 15 updates in the /apps/api directory: | Package | From | To | | --- | --- | --- | | [express-handlebars](https://github.com/express-handlebars/express-handlebars) | `3.1.0` | `5.3.1` | | [jsonwebtoken](https://github.com/auth0/node-jsonwebtoken) | `8.5.1` | `9.0.0` | | [multer](https://github.com/expressjs/multer) | `1.4.4` | `2.1.1` | | [sequelize](https://github.com/sequelize/sequelize) | `6.37.7` | `6.37.8` | | [ajv](https://github.com/ajv-validator/ajv) | `6.12.6` | `6.14.0` | | [braces](https://github.com/micromatch/braces) | `2.3.2` | `3.0.3` | | [cookie](https://github.com/jshttp/cookie) | `0.3.1` | `removed` | | [dottie](https://github.com/mickhansen/dottie.js) | `2.0.6` | `2.0.7` | | [minimatch](https://github.com/isaacs/minimatch) | `3.1.2` | `3.1.5` | | [minimatch](https://github.com/isaacs/minimatch) | `9.0.5` | `9.0.9` | | [flatted](https://github.com/WebReflection/flatted) | `2.0.2` | `3.4.2` | | [jws](https://github.com/brianloveswords/node-jws) | `3.2.2` | `3.2.3` | | [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.17.23` | | [property-expr](https://github.com/jquense/expr) | `1.5.1` | `2.0.6` | | [qs](https://github.com/ljharb/qs) | `6.13.0` | `6.14.2` | | [validator](https://github.com/validatorjs/validator.js) | `13.15.15` | `13.15.26` | Bumps the npm_and_yarn group with 1 update in the /apps/web directory: [ajv](https://github.com/ajv-validator/ajv). Updates `express-handlebars` from 3.1.0 to 5.3.1 - [Release notes](https://github.com/express-handlebars/express-handlebars/releases) - [Changelog](https://github.com/express-handlebars/express-handlebars/blob/master/CHANGELOG.md) - [Commits](express-handlebars/express-handlebars@v3.1.0...v5.3.1) Updates `jsonwebtoken` from 8.5.1 to 9.0.0 - [Changelog](https://github.com/auth0/node-jsonwebtoken/blob/master/CHANGELOG.md) - [Commits](auth0/node-jsonwebtoken@v8.5.1...v9.0.0) Updates `multer` from 1.4.4 to 2.1.1 - [Release notes](https://github.com/expressjs/multer/releases) - [Changelog](https://github.com/expressjs/multer/blob/main/CHANGELOG.md) - [Commits](expressjs/multer@v1.4.4...v2.1.1) Updates `sequelize` from 6.37.7 to 6.37.8 - [Release notes](https://github.com/sequelize/sequelize/releases) - [Changelog](https://github.com/sequelize/sequelize/blob/main/CHANGELOG.md) - [Commits](sequelize/sequelize@v6.37.7...v6.37.8) Updates `ajv` from 6.12.6 to 6.14.0 - [Release notes](https://github.com/ajv-validator/ajv/releases) - [Commits](ajv-validator/ajv@v6.12.6...v6.14.0) Updates `braces` from 2.3.2 to 3.0.3 - [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md) - [Commits](https://github.com/micromatch/braces/commits/3.0.3) Removes `cookie` Updates `dottie` from 2.0.6 to 2.0.7 - [Release notes](https://github.com/mickhansen/dottie.js/releases) - [Commits](mickhansen/dottie.js@v2.0.6...v2.0.7) Updates `minimatch` from 3.1.2 to 3.1.5 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v3.1.2...v3.1.5) Updates `minimatch` from 9.0.5 to 9.0.9 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v3.1.2...v3.1.5) Updates `flatted` from 2.0.2 to 3.4.2 - [Commits](WebReflection/flatted@v2.0.2...v3.4.2) Updates `jws` from 3.2.2 to 3.2.3 - [Release notes](https://github.com/brianloveswords/node-jws/releases) - [Changelog](https://github.com/auth0/node-jws/blob/master/CHANGELOG.md) - [Commits](auth0/node-jws@v3.2.2...v3.2.3) Updates `lodash` from 4.17.21 to 4.17.23 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.17.23) Updates `property-expr` from 1.5.1 to 2.0.6 - [Changelog](https://github.com/jquense/expr/blob/master/CHANGELOG.md) - [Commits](https://github.com/jquense/expr/commits) Updates `qs` from 6.13.0 to 6.14.2 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.13.0...v6.14.2) Updates `validator` from 13.15.15 to 13.15.26 - [Release notes](https://github.com/validatorjs/validator.js/releases) - [Changelog](https://github.com/validatorjs/validator.js/blob/master/CHANGELOG.md) - [Commits](validatorjs/validator.js@13.15.15...13.15.26) Updates `ajv` from 8.12.0 to 8.18.0 - [Release notes](https://github.com/ajv-validator/ajv/releases) - [Commits](ajv-validator/ajv@v6.12.6...v6.14.0) Updates `minimatch` from 3.1.2 to 3.1.5 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v3.1.2...v3.1.5) Updates `on-headers` from 1.0.2 to 1.1.0 - [Release notes](https://github.com/jshttp/on-headers/releases) - [Changelog](https://github.com/jshttp/on-headers/blob/master/HISTORY.md) - [Commits](jshttp/on-headers@v1.0.2...v1.1.0) --- updated-dependencies: - dependency-name: express-handlebars dependency-version: 5.3.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: jsonwebtoken dependency-version: 9.0.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: multer dependency-version: 2.1.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: sequelize dependency-version: 6.37.8 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: ajv dependency-version: 6.14.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: braces dependency-version: 3.0.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: cookie dependency-version: dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: dottie dependency-version: 2.0.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: minimatch dependency-version: 3.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: minimatch dependency-version: 9.0.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: flatted dependency-version: 3.4.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: jws dependency-version: 3.2.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.17.23 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: property-expr dependency-version: 2.0.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.14.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: validator dependency-version: 13.15.26 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ajv dependency-version: 8.18.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: minimatch dependency-version: 3.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: on-headers dependency-version: 1.1.0 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the npm_and_yarn group with 15 updates in the /apps/api directory:
3.1.05.3.18.5.19.0.01.4.42.1.16.37.76.37.86.12.66.14.02.3.23.0.30.3.1removed2.0.62.0.73.1.23.1.59.0.59.0.92.0.23.4.23.2.23.2.34.17.214.17.231.5.12.0.66.13.06.14.213.15.1513.15.26Bumps the npm_and_yarn group with 1 update in the /apps/web directory: ajv.
Updates
express-handlebarsfrom 3.1.0 to 5.3.1Release notes
Sourced from express-handlebars's releases.
... (truncated)
Changelog
Sourced from express-handlebars's changelog.
... (truncated)
Commits
63e8010chore(release): 5.3.1 [skip ci]78c47a2fix: add note about security2cde11echore: update package-lock.json9a6cf60chore(deps): update devdependency eslint to ^7.25.0fbc5681Merge pull request #157 from express-handlebars/renovate/node-10.x1e2b967chore(deps): update devdependency eslint-plugin-promise to ^5.1.04bcc294chore(deps): update devdependency eslint to ^7.24.06ffb7eechore(deps): update devdependency eslint-plugin-promise to v58b9f920chore(deps): update devdependency@semantic-release/npmto ^7.1.1b291a6bchore(deps): update node.js to >=v10.24.1Maintainer changes
This version was pushed to npm by tonybrix, a new releaser for express-handlebars since your current version.
Updates
jsonwebtokenfrom 8.5.1 to 9.0.0Changelog
Sourced from jsonwebtoken's changelog.
Commits
e1fa9dcMerge pull request from GHSA-8cf7-32gw-wr335eaedbfchore(ci): remove github test actions job (#861)cd4163echore(ci): configure Github Actions jobs for Tests & Security Scanning (#856)ecdf6ccfix!: Prevent accidental use of insecure key sizes & misconfiguration of secr...8345030fix(sign&verify)!: Remove defaultnonesupport fromsignandverifymet...7e6a86bUpload OpsLevel YAML (#849)74d5719docs: update references vercel/ms references (#770)d71e383docs: document "invalid token" error3765003docs: fix spelling in README.md: Peak -> Peek (#754)a46097edocs: make decode impossible to discover before verifyMaintainer changes
This version was pushed to npm by julien.wollscheid, a new releaser for jsonwebtoken since your current version.
Updates
multerfrom 1.4.4 to 2.1.1Release notes
Sourced from multer's releases.
... (truncated)
Changelog
Sourced from multer's changelog.
Commits
368c8a12.1.1 (#1380)7e66481🐛 fix recursion issue643571e✅ add explicit test for client able to send body without abrupt disconnecte86fa52fix error/abort handlingca37779chore(deps): bump actions/checkout from 4.1.1 to 6.0.2 (#1374)13088f4chore(deps): bump actions/upload-artifact from 4.5.0 to 7.0.0 (#1375)bc6a1d1chore(deps): bump github/codeql-action from 3.24.7 to 4.32.4 (#1376)c496e93chore(deps): bump coverallsapp/github-action from 1.2.5 to 2.3.6 (#1377)fa173d3chore(deps): bump ossf/scorecard-action from 2.4.0 to 2.4.3 (#1378)17d7f51chore: add node version to 25.x in CIMaintainer changes
This version was pushed to npm by ulisesgascon, a new releaser for multer since your current version.
Updates
sequelizefrom 6.37.7 to 6.37.8Release notes
Sourced from sequelize's releases.
Commits
cb7f99afix: validate cast types in JSON where clausesb147528Merge commit from fork4b8b5b9meta: Fix MSSQL CI (#17931)Maintainer changes
This version was pushed to npm by wikirik, a new releaser for sequelize since your current version.
Updates
ajvfrom 6.12.6 to 6.14.0Commits
e3af0a76.14.0b552ed6add regExp option to address $data exploit via a regular expression (CVE-2025...72f2286docs: update v7 info231e52bMerge pull request #1320 from philsturgeon/patch-1d3475fcAdd spectral, an AJV util from a sponsor413afe0docs: v7.0.0-beta.311e997bupdate readme for v7Updates
bracesfrom 2.3.2 to 3.0.3Changelog
Sourced from braces's changelog.
Commits
Removes
cookieUpdates
dottiefrom 2.0.6 to 2.0.7Commits
334c32b2.0.77e8fa13fix: check all path segments for dangerous keys (bypass of CVE-2023-2… (#43)a72eb99Update test GitHub Action (#40)Updates
minimatchfrom 3.1.2 to 3.1.5Commits
7bba9783.1.5bd25942docs: add warning about ReDoS1a9c27cfix partial matching of globstar patterns1a2e0843.1.4ae24656update lockfileb100374limit recursion for **, improve perf considerably26ffeaalockfile update9eca892lock node version to 1400c323b3.1.330486b2update CI matrix and actionsUpdates
minimatchfrom 9.0.5 to 9.0.9Commits
7bba9783.1.5bd25942docs: add warning about ReDoS1a9c27cfix partial matching of globstar patterns1a2e0843.1.4ae24656update lockfileb100374limit recursion for **, improve perf considerably26ffeaalockfile update9eca892lock node version to 1400c323b3.1.330486b2update CI matrix and actionsUpdates
flattedfrom 2.0.2 to 3.4.2Commits
3bf09093.4.2885ddccfix CWE-13210bdba70added flatted-view to the benchmark2a02dce3.4.1fba4e8fMerge pull request #89 from WebReflection/python-fix5fe8648added "when in Rome" also a test for PHP53517adsome minor improvementb3e2a0cFixing recursion issue in Python tooc4b46dbAdd SECURITY.md for security policy and reportingf86d071Create dependabot.yml for version updatesUpdates
jwsfrom 3.2.2 to 3.2.3Release notes
Sourced from jws's releases.
Changelog
Sourced from jws's changelog.
Commits
4f6e73fMerge commit from forkbd0fea5version 3.2.37c3b4b4Enhance tests for HMAC streaming sign and verifya9b8ed9Improve secretOrKey initialization in VerifyStream6707fdeImprove secret handling in SignStreamMaintainer changes
This version was pushed to npm by julien.wollscheid, a new releaser for jws since your current version.
Updates
lodashfrom 4.17.21 to 4.17.23Commits
dec55b7Bump main to v4.17.23 (#6088)19c9251fix: setCacheHas JSDoc return type should be boolean (#6071)b5e6729jsdoc: Add -0 and BigInt zeros to _.compact falsey values list (#6062)edadd45Prevent prototype pollution on baseUnset function4879a7adoc: fix autoLink function, conversion of source links (#6056)9648f69chore: removeyarn.lockfile (#6053)dfa407dci: remove legacy configuration files (#6052)156e196feat: add renovate setup (#6039)933e106ci: add pipeline for Bun (#6023)072a807docs: update links related to Open JS Foundation (#5968)Updates
property-exprfrom 1.5.1 to 2.0.6Commits
Updates
qsfrom 6.13.0 to 6.14.2Changelog
Sourced from qs's changelog.
... (truncated)
Commits
bdcf0c7v6.14.2294db90[readme] document thataddQueryPrefixdoes not add?to empty output5c308e5[readme] clarifyparseArraysandarrayLimitdocumentation6addf8c[Fix]parse: mark overflow objects for indexed notation exceedingarrayLimitcfc108f[Fix]arrayLimitmeans max count, not max index, incombine/merge/`pars...febb644[Fix]parse: throw onarrayLimitexceeded with indexed notation when `thr...f6a7abf[Fix]parse: enforcearrayLimitoncomma-parsed valuesfbc5206[Fix]parse: fix error message to reflect arrayLimit as max index; remove e...1b9a8b4[actions] fix rebase workflow permissions2a35775[meta] fix changelog typo (arrayLength→arrayLimit)Updates
validatorfrom 13.15.15 to 13.15.26Release notes
Sourced from validator's releases.
... (truncated)
Changelog
Sourced from validator's changelog.
Commits
784e52adocs(matches): add ReDoS note to README (#2640)6531047fix(isHexColor): addrequire_hashtagoption (#2535)f605a9cfix(isURL): handle possible bypass with URL-encoded content (#2633)a165ebefix(isIBAN): improveIRlocale (#2634)9113304fix(build): move to trusted publishing (#2631)f2b5c17maintenance: 2511 release (#2627)d457ecafix(isLength): correctly handle Unicode variation selectors (#2616)f2e3633docs: add install instructions to contibution guide (#2621)cf40145fix: URL validation for hostnames with ports (no protocol) (#2622)4af6124maintenance: 2510 release (#2585)Maintainer changes
This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for validator since your current version.
Updates
ajvfrom 8.12.0 to 8.18.0Commits
e3af0a76.14.0b552ed6add regExp option to address $data exploit via a regular expression (CVE-2025...72f2286docs: update v7 info231e52bMerge pull request #1320 from philsturgeon/patch-1d3475fcAdd spectral, an AJV util from a sponsor413afe0docs: v7.0.0-beta.311e997bupdate readme for v7Updates
minimatchfrom 3.1.2 to 3.1.5Commits
7bba9783.1.5bd25942docs: add warning about ReDoS1a9c27cDescription has been truncated