Skip to content

Bump the npm_and_yarn group across 2 directories with 23 updates#1

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/Yggdrasil/npm_and_yarn-9fb5b9dd5d
Open

Bump the npm_and_yarn group across 2 directories with 23 updates#1
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/Yggdrasil/npm_and_yarn-9fb5b9dd5d

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Feb 3, 2026

Bumps the npm_and_yarn group with 6 updates in the /Yggdrasil directory:

Package From To
express 4.19.2 4.22.0
ws 8.17.0 8.17.1
esbuild 0.21.3 0.27.2
js-yaml 3.14.1 3.14.2
braces 3.0.2 3.0.3
lodash 4.17.21 removed

Bumps the npm_and_yarn group with 7 updates in the /Sleipnir directory:

Package From To
express 4.19.2 4.22.1
esbuild 0.23.0 0.27.2
cookie 0.4.2 0.7.2
lodash 4.17.21 4.17.23
@angular/common 17.3.9 21.1.2
@angular/compiler 17.3.9 21.1.2
tar 6.2.1 7.5.7

Updates express from 4.19.2 to 4.22.0

Release notes

Sourced from express's releases.

4.22.0

Important: Security

What's Changed

Full Changelog: expressjs/express@4.21.2...4.22.0

4.21.2

What's Changed

Full Changelog: expressjs/express@4.21.1...4.21.2

4.21.1

What's Changed

Full Changelog: expressjs/express@4.21.0...4.21.1

4.21.0

What's Changed

New Contributors

... (truncated)

Changelog

Sourced from express's changelog.

4.22.0 / 2025-12-01

4.21.2 / 2024-11-06

  • deps: path-to-regexp@0.1.12
    • Fix backtracking protection
  • deps: path-to-regexp@0.1.11
    • Throws an error on invalid path values

4.21.1 / 2024-10-08

4.21.0 / 2024-09-11

  • Deprecate res.location("back") and res.redirect("back") magic string
  • deps: serve-static@1.16.2
    • includes send@0.19.0
  • deps: finalhandler@1.3.1
  • deps: qs@6.13.0

4.20.0 / 2024-09-10

  • deps: serve-static@0.16.0
    • Remove link renderization in html while redirecting
  • deps: send@0.19.0
    • Remove link renderization in html while redirecting
  • deps: body-parser@0.6.0
    • add depth option to customize the depth level in the parser
    • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)
  • Remove link renderization in html while using res.redirect
  • deps: path-to-regexp@0.1.10
    • Adds support for named matching groups in the routes using a regex
    • Adds backtracking protection to parameters without regexes defined
  • deps: encodeurl@~2.0.0
    • Removes encoding of \, |, and ^ to align better with URL spec
  • Deprecate passing options.maxAge and options.expires to res.clearCookie
    • Will be ignored in v5, clearCookie will set a cookie with an expires in the past to instruct clients to delete the cookie
Commits

Updates ws from 8.17.0 to 8.17.1

Release notes

Sourced from ws's releases.

8.17.1

Bug fixes

  • Fixed a DoS vulnerability (#2231).

A request with a number of headers exceeding the[server.maxHeadersCount][] threshold could be used to crash a ws server.

const http = require('http');
const WebSocket = require('ws');
const wss = new WebSocket.Server({ port: 0 }, function () {
const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
const headers = {};
let count = 0;
for (let i = 0; i < chars.length; i++) {
if (count === 2000) break;
for (let j = 0; j &lt; chars.length; j++) {
  const key = chars[i] + chars[j];
  headers[key] = 'x';
if (++count === 2000) break;
}

}
headers.Connection = 'Upgrade';
headers.Upgrade = 'websocket';
headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';
headers['Sec-WebSocket-Version'] = '13';
const request = http.request({
headers: headers,
host: '127.0.0.1',
port: wss.address().port
});
request.end();
});

The vulnerability was reported by Ryan LaPointe in websockets/ws#2230.

In vulnerable versions of ws, the issue can be mitigated in the following ways:

  1. Reduce the maximum allowed length of the request headers using the [--max-http-header-size=size][] and/or the [maxHeaderSize][] options so that no more headers than the server.maxHeadersCount limit can be sent.

... (truncated)

Commits
  • 3c56601 [dist] 8.17.1
  • e55e510 [security] Fix crash when the Upgrade header cannot be read (#2231)
  • 6a00029 [test] Increase code coverage
  • ddfe4a8 [perf] Reduce the amount of crypto.randomFillSync() calls
  • See full diff in compare view

Updates esbuild from 0.21.3 to 0.27.2

Release notes

Sourced from esbuild's releases.

v0.27.2

  • Allow import path specifiers starting with #/ (#4361)

    Previously the specification for package.json disallowed import path specifiers starting with #/, but this restriction has recently been relaxed and support for it is being added across the JavaScript ecosystem. One use case is using it for a wildcard pattern such as mapping #/* to ./src/* (previously you had to use another character such as #_* instead, which was more confusing). There is some more context in nodejs/node#49182.

    This change was contributed by @​hybrist.

  • Automatically add the -webkit-mask prefix (#4357, #4358)

    This release automatically adds the -webkit- vendor prefix for the mask CSS shorthand property:

    /* Original code */
main {
  mask: url(x.png) center/5rem no-repeat
}
/* Old output (with --target=chrome110) */
main {
mask: url(x.png) center/5rem no-repeat;
}
/* New output (with --target=chrome110) */
main {
-webkit-mask: url(x.png) center/5rem no-repeat;
mask: url(x.png) center/5rem no-repeat;
}

    This change was contributed by @​BPJEnnova.

  • Additional minification of switch statements (#4176, #4359)

    This release contains additional minification patterns for reducing switch statements. Here is an example:

    // Original code
switch (x) {
  case 0:
    foo()
    break
  case 1:
  default:
    bar()
}
// Old output (with --minify)
switch(x){case 0:foo();break;case 1:default:bar()}
// New output (with --minify)

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2024

This changelog documents all esbuild versions published in the year 2024 (versions 0.19.12 through 0.24.2).

0.24.2

  • Fix regression with --define and import.meta (#4010, #4012, #4013)

    The previous change in version 0.24.1 to use a more expression-like parser for define values to allow quoted property names introduced a regression that removed the ability to use --define:import.meta=.... Even though import is normally a keyword that can't be used as an identifier, ES modules special-case the import.meta expression to behave like an identifier anyway. This change fixes the regression.

    This fix was contributed by @​sapphi-red.

0.24.1

  • Allow es2024 as a target in tsconfig.json (#4004)

    TypeScript recently added es2024 as a compilation target, so esbuild now supports this in the target field of tsconfig.json files, such as in the following configuration file:

    {
  "compilerOptions": {
    "target": "ES2024"
  }
}

    As a reminder, the only thing that esbuild uses this field for is determining whether or not to use legacy TypeScript behavior for class fields. You can read more in the documentation.

    This fix was contributed by @​billyjanitsch.

  • Allow automatic semicolon insertion after get/set

    This change fixes a grammar bug in the parser that incorrectly treated the following code as a syntax error:

    class Foo {
  get
  *x() {}
  set
  *y() {}
}

    The above code will be considered valid starting with this release. This change to esbuild follows a similar change to TypeScript which will allow this syntax starting with TypeScript 5.7.

  • Allow quoted property names in --define and --pure (#4008)

    The define and pure API options now accept identifier expressions containing quoted property names. Previously all identifiers in the identifier expression had to be bare identifiers. This change now makes --define and --pure consistent with --global-name, which already supported quoted property names. For example, the following is now possible:

    

    • 






... (truncated)





Commits

    

  • cd83297 publish 0.27.2 to npm
    • 

  • 2759721 additional tests for switch with break
    • 

  • fd2b4b3 update release notes
    • 

  • c8d93a7 fix #4357: -webkit- prefix for mask shorthand (#4358)
    • 

  • 92ff12c compat table: update @types/node
    • 

  • a35eceb compat table: fix a type error with the new types
    • 

  • f598984 fix make compat-table to install dependencies
    • 

  • f7f6df0 release notes for #4361
    • 

  • 6f8ec15 fix: allow subpath imports that start with #/ (#4361)
    • 

  • f7ae61f minify some switch statements to if-else statement
    • 

  • Additional commits viewable in compare view
    • 






Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for esbuild since your current version.






Updates js-yaml from 3.14.1 to 3.14.2



Changelog

Sourced from js-yaml's changelog.




[3.14.2] - 2025-11-15


Security


    

  • Backported v4.1.1 fix to v3
    • 



[4.1.1] - 2025-11-12


Security


    

  • Fix prototype pollution issue in yaml merge (<<) operator.
    • 



[4.1.0] - 2021-04-15


Added


    

  • Types are now exported as yaml.types.XXX.
    • 

  • Every type now has options property with original arguments kept as they were
(see yaml.types.int.options as an example).
    • 



Changed


    

  • Schema.extend() now keeps old type order in case of conflicts
(e.g. Schema.extend([ a, b, c ]).extend([ b, a, d ]) is now ordered as abcd instead of cbad).
    • 



[4.0.0] - 2021-01-03


Changed


    

  • Check migration guide to see details for all breaking changes.
    • 

  • Breaking: "unsafe" tags !!js/function, !!js/regexp, !!js/undefined are
moved to js-yaml-js-types package.
    • 

  • Breaking: removed safe* functions. Use load, loadAll, dump
instead which are all now safe by default.
    • 

  • yaml.DEFAULT_SAFE_SCHEMA and yaml.DEFAULT_FULL_SCHEMA are removed, use
yaml.DEFAULT_SCHEMA instead.
    • 

  • yaml.Schema.create(schema, tags) is removed, use schema.extend(tags) instead.
    • 

  • !!binary now always mapped to Uint8Array on load.
    • 

  • Reduced nesting of /lib folder.
    • 

  • Parse numbers according to YAML 1.2 instead of YAML 1.1 (01234 is now decimal,
0o1234 is octal, 1:23 is parsed as string instead of base60).
    • 

  • dump() no longer quotes :, [, ], (, ) except when necessary, #470, #557.
    • 

  • Line and column in exceptions are now formatted as (X:Y) instead of
at line X, column Y (also present in compact format), #332.
    • 

  • Code snippet created in exceptions now contains multiple lines with line numbers.
    • 

  • dump() now serializes undefined as null in collections and removes keys with
undefined in mappings, #571.
    • 

  • dump() with skipInvalid=true now serializes invalid items in collections as null.
    • 

  • Custom tags starting with ! are now dumped as !tag instead of !<!tag>, #576.
    • 

  • Custom tags starting with tag:yaml.org,2002: are now shorthanded using !!, #258.
    • 



Added


    

  • Added .mjs (es modules) support.
    • 

  • Added quotingType and forceQuotes options for dumper to configure
string literal style, #290, #529.
    • 

  • Added styles: { '!!null': 'empty' } option for dumper
(serializes { foo: null } as "foo: "), #570.
    • 






... (truncated)





Commits






Updates body-parser from 1.20.2 to 1.20.4



Release notes

Sourced from body-parser's releases.




1.20.4


What's Changed



Full Changelog: expressjs/body-parser@1.20.3...1.20.4


1.20.3


What's Changed


Important


    

  • deps: qs@6.13.0
    • 

  • add depth option to customize the depth level in the parser
    • 

  • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity). Documentation
    • 



Other changes



New Contributors



Full Changelog: expressjs/body-parser@1.20.2...1.20.3







Changelog

Sourced from body-parser's changelog.




1.20.4 / 2025-12-01


    

  • deps: qs@~6.14.0
    • 

  • deps: use tilde notation for dependencies
    • 

  • deps: http-errors@~2.0.1
    • 

  • deps: raw-body@~2.5.3
    • 



1.20.3 / 2024-09-10


    

  • deps: qs@6.13.0
    • 

  • add depth option to customize the depth level in the parser
    • 

  • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)
    • 








Commits





Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for body-parser since your current version.






Updates braces from 3.0.2 to 3.0.3



Commits






Updates cookie from 0.6.0 to 0.7.2



Release notes

Sourced from cookie's releases.




v0.7.2


Fixed


    

  • Fix object assignment of hasOwnProperty (#177)  bc38ffd
    • 



jshttp/cookie@v0.7.1...v0.7.2


0.7.1


Fixed


    

  • Allow leading dot for domain (#174)

      

    • Although not permitted in the spec, some users expect this to work and user agents ignore the leading dot according to spec
      • 

    

    • 

  • Add fast path for serialize without options, use obj.hasOwnProperty when parsing (#172)
    • 



jshttp/cookie@v0.7.0...v0.7.1


0.7.0



jshttp/cookie@v0.6.0...v0.7.0


0.6.0


    

  • Add partitioned option
    • 



0.5.0


    

  • Add priority option
    • 

  • Fix expires option to reject invalid dates
    • 

  • pref: improve default decode speed
    • 

  • pref: remove slow string split in parse
    • 








Commits





Maintainer changes

This version was pushed to npm by blakeembrey, a new releaser for cookie since your current version.






Removes lodash


Updates path-to-regexp from 0.1.7 to 0.1.12



Release notes

Sourced from path-to-regexp's releases.




Fix backtracking (again)


Fixed


    

  • Improved backtracking protection for 0.1.x, will break some previously valid paths (see previous advisory: GHSA-9wv6-86v2-598j)
    • 



pillarjs/path-to-regexp@v0.1.11...v0.1.12


Error on bad input


Changed


    

  • Add error on bad input values  8f09549
    • 



pillarjs/path-to-regexp@v0.1.10...v0.1.11


Backtrack protection


Fixed


    

  • Add backtrack protection to parameters  29b96b4

      

    • This will break some edge cases but should improve performance
      • 

    

    • 



pillarjs/path-to-regexp@v0.1.9...v0.1.10


Support non-lookahead regex output


Added


    

  • Allow a non-lookahead regex (#312)  c4272e4
    • 



component/path-to-regexp@v0.1.8...v0.1.9


Support named matching groups in RegExp


Added


    

  • Add support for named matching groups (#301)  114f62d
    • 



pillarjs/path-to-regexp@v0.1.7...v0.1.8







Commits






Updates qs from 6.11.0 to 6.14.1



Changelog

Sourced from qs's changelog.




6.14.1


    

  • [Fix] ensure arrayLength applies to [] notation as well
    • 

  • [Fix] parse: when a custom decoder returns null for a key, ignore that key
    • 

  • [Refactor] parse: extract key segment splitting helper
    • 

  • [meta] add threat model
    • 

  • [actions] add workflow permissions
    • 

  • [Tests] stringify: increase coverage
    • 

  • [Dev Deps] update eslint, @ljharb/eslint-config, npmignore, es-value-fixtures, for-each, object-inspect
    • 



6.14.0


    

  • [New] parse: add throwOnParameterLimitExceeded option (#517)
    • 

  • [Refactor] parse: use utils.combine more
    • 

  • [patch] parse: add explicit throwOnLimitExceeded default
    • 

  • [actions] use shared action; re-add finishers
    • 

  • [meta] Fix changelog formatting bug
    • 

  • [Deps] update side-channel
    • 

  • [Dev Deps] update es-value-fixtures, has-bigints, has-proto, has-symbols
    • 

  • [Tests] increase coverage
    • 



6.13.1


    

  • [Fix] stringify: avoid a crash when a filter key is null
    • 

  • [Fix] utils.merge: functions should not be stringified into keys
    • 

  • [Fix] parse: avoid a crash with interpretNumericEntities: true, comma: true, and iso charset
    • 

  • [Fix] stringify: ensure a non-string filter does not crash
    • 

  • [Refactor] use __proto__ syntax instead of Object.create for null objects
    • 

  • [Refactor] misc cleanup
    • 

  • [Tests] utils.merge: add some coverage
    • 

  • [Tests] fix a test case
    • 

  • [actions] split out node 10-20, and 20+
    • 

  • [Dev Deps] update es-value-fixtures, mock-property, object-inspect, tape
    • 



6.13.0


    

  • [New] parse: add strictDepth option (#511)
    • 

  • [Tests] use npm audit instead of aud
    • 



6.12.3


    

  • [Fix] parse: properly account for strictNullHandling when allowEmptyArrays
    • 

  • [meta] fix changelog indentation
    • 



6.12.2


    

  • [Fix] parse: parse encoded square brackets (#506)
    • 

  • [readme] add CII best practices badge
    • 



6.12.1


    

  • [Fix] parse: Disable decodeDotInKeys by default to restore previous behavior (#501)
    • 

  • [Performance] utils: Optimize performance under large data volumes, reduce memory usage, and speed up processing (#502)
    • 

  • [Refactor] utils: use +=
    • 

  • [Tests] increase coverage
    • 



6.12.0





... (truncated)





Commits

    

  • 3fa11a5 v6.14.1
    • 

  • a626704 [Dev Deps] update npmignore
    • 

  • 3086902 [Fix] ensure arrayLength applies to [] notation as well
    • 

  • fc7930e [Dev Deps] update eslint, @ljharb/eslint-config
    • 

  • 0b06aac [Dev Deps] update @ljharb/eslint-config
    • 

  • 64951f6 [Refactor] parse: extract key segment splitting helper
    • 

  • e1bd259 [Dev Deps] update @ljharb/eslint-config
    • 

  • f4b3d39 [eslint] add eslint 9 optional peer dep
    • 

  • 6e94d95 [Dev Deps] update eslint, @ljharb/eslint-config, npmignore
    • 

  • 973dc3c [actions] add workflow permissions
    • 

  • Additional commits viewable in compare view
    • 







Updates send from 0.18.0 to 0.19.2



Release notes

Sourced from send's releases.




0.19.2


What's Changed



Full Changelog: pillarjs/send@0.19.1...0.19.2


0.19.1


What's Changed



Full Changelog: pillarjs/send@0.19.0...0.19.1


0.19.0


What's Changed



New Contributors



Full Changelog: pillarjs/send@0.18.0...0.19.0







Changelog

Sourced from send's changelog.




0.19.2 / 2025-12-15


    

  • deps: use tilde notation for dependencies
    • 

  • deps: http-errors@~2.0.1
    • 

  • deps: statuses@~2.0.2
    • 



0.19.1 / 2024-10-09


    

  • deps: encodeurl@~2.0.0
    • 



0.19.0 / 2024-09-10


    

  • Remove link renderization in html while redirecting
    • 








Commits





Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for send since your current version.






Updates serve-static from 1.15.0 to 1.16.3



Release notes

Sourced from serve-static's releases.




v1.16.3


What's Changed



Full Changelog: expressjs/serve-static@v1.16.2...v1.16.3


v1.16.2


What's Changed



Full Changelog: expressjs/serve-static@v1.16.1...v1.16.2


v1.16.1


What's Changed



New Contributors



Full Changelog: expressjs/serve-static@1.16.0...v1.16.1


1.16.0


What's Changed



New Contributors



Full Changelog: expressjs/serve-static@v1.15.0...1.16.0







Changelog

Sourced from serve-static's changelog.




1.16.3 / 2024-12-15


    

  • deps: send@~0.19.1

      

    • deps: encodeurl@~2.0.0
      • 

    

    • 



1.16.2 / 2024-09-11


    

  • deps: encodeurl@~2.0.0
    • 



1.16.1 / 2024-09-11


    

  • deps: send@0.19.0
    • 



1.16.0 / 2024-09-10


    

  • Remove link renderization in html while redirecting
    • 








Commits





Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for serve-static since your current version.






Updates express from 4.19.2 to 4.22.1



Release notes

Sourced from express's releases.




4.22.0


Important: Security



What's Changed



    

  
  



      


          

          
  
  

    
  
    
    

  

  

  



                    

          
        





  





    



      

  
        

  

      

  
  

  
          

  

    

      


  

      
        @dependabot
  




      

        
          Bump the npm_and_yarn group across 2 directories with 23 updates
        

          
                        
      


      

        

    
    
    

  

    


      


      

        

          

    
    
    

  

  

    
  



        

      


      

        
          776147f
        
      

    

  

    

      
Bumps the npm_and_yarn group with 6 updates in the /Yggdrasil directory:

| Package | From | To |
| --- | --- | --- |
| [express](https://github.com/expressjs/express) | `4.19.2` | `4.22.0` |
| [ws](https://github.com/websockets/ws) | `8.17.0` | `8.17.1` |
| [esbuild](https://github.com/evanw/esbuild) | `0.21.3` | `0.27.2` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `3.14.1` | `3.14.2` |
| [braces](https://github.com/micromatch/braces) | `3.0.2` | `3.0.3` |
| [lodash](https://github.com/lodash/lodash) | `4.17.21` | `removed` |

Bumps the npm_and_yarn group with 7 updates in the /Sleipnir directory:

| Package | From | To |
| --- | --- | --- |
| [express](https://github.com/expressjs/express) | `4.19.2` | `4.22.1` |
| [esbuild](https://github.com/evanw/esbuild) | `0.23.0` | `0.27.2` |
| [cookie](https://github.com/jshttp/cookie) | `0.4.2` | `0.7.2` |
| [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.17.23` |
| [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common) | `17.3.9` | `21.1.2` |
| [@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler) | `17.3.9` | `21.1.2` |
| [tar](https://github.com/isaacs/node-tar) | `6.2.1` | `7.5.7` |



Updates `express` from 4.19.2 to 4.22.0
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/4.22.0/History.md)
- [Commits](expressjs/express@4.19.2...4.22.0)

Updates `ws` from 8.17.0 to 8.17.1
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.17.0...8.17.1)

Updates `esbuild` from 0.21.3 to 0.27.2
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2024.md)
- [Commits](evanw/esbuild@v0.21.3...v0.27.2)

Updates `js-yaml` from 3.14.1 to 3.14.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@3.14.1...3.14.2)

Updates `body-parser` from 1.20.2 to 1.20.4
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@1.20.2...1.20.4)

Updates `braces` from 3.0.2 to 3.0.3
- [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md)
- [Commits](micromatch/braces@3.0.2...3.0.3)

Updates `cookie` from 0.6.0 to 0.7.2
- [Release notes](https://github.com/jshttp/cookie/releases)
- [Commits](jshttp/cookie@v0.4.2...v0.7.2)

Removes `lodash`

Updates `path-to-regexp` from 0.1.7 to 0.1.12
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v0.1.7...v0.1.12)

Updates `qs` from 6.11.0 to 6.14.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.11.0...v6.14.1)

Updates `send` from 0.18.0 to 0.19.2
- [Release notes](https://github.com/pillarjs/send/releases)
- [Changelog](https://github.com/pillarjs/send/blob/master/HISTORY.md)
- [Commits](pillarjs/send@0.18.0...0.19.2)

Updates `serve-static` from 1.15.0 to 1.16.3
- [Release notes](https://github.com/expressjs/serve-static/releases)
- [Changelog](https://github.com/expressjs/serve-static/blob/master/HISTORY.md)
- [Commits](expressjs/serve-static@v1.15.0...v1.16.3)

Updates `express` from 4.19.2 to 4.22.1
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/4.22.0/History.md)
- [Commits](expressjs/express@4.19.2...4.22.0)

Updates `esbuild` from 0.23.0 to 0.27.2
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2024.md)
- [Commits](evanw/esbuild@v0.21.3...v0.27.2)

Updates `js-yaml` from 3.14.1 to 4.1.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@3.14.1...3.14.2)

Updates `body-parser` from 1.20.2 to 1.20.4
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@1.20.2...1.20.4)

Updates `braces` from 3.0.2 to 3.0.3
- [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md)
- [Commits](micromatch/braces@3.0.2...3.0.3)

Updates `cookie` from 0.4.2 to 0.7.2
- [Release notes](https://github.com/jshttp/cookie/releases)
- [Commits](jshttp/cookie@v0.4.2...v0.7.2)

Updates `lodash` from 4.17.21 to 4.17.23
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](https://github.com/lodash/lodash/commits)

Updates `path-to-regexp` from 0.1.7 to 0.1.12
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v0.1.7...v0.1.12)

Updates `qs` from 6.11.0 to 6.14.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.11.0...v6.14.1)

Updates `send` from 0.18.0 to 0.19.2
- [Release notes](https://github.com/pillarjs/send/releases)
- [Changelog](https://github.com/pillarjs/send/blob/master/HISTORY.md)
- [Commits](pillarjs/send@0.18.0...0.19.2)

Updates `serve-static` from 1.15.0 to 1.16.3
- [Release notes](https://github.com/expressjs/serve-static/releases)
- [Changelog](https://github.com/expressjs/serve-static/blob/master/HISTORY.md)
- [Commits](expressjs/serve-static@v1.15.0...v1.16.3)

Updates `@angular/common` from 17.3.9 to 21.1.2
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v21.1.2/packages/common)

Updates `@angular/compiler` from 17.3.9 to 21.1.2
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v21.1.2/packages/compiler)

Updates `http-proxy-middleware` from 2.0.6 to 2.0.9
- [Release notes](https://github.com/chimurai/http-proxy-middleware/releases)
- [Changelog](https://github.com/chimurai/http-proxy-middleware/blob/v2.0.9/CHANGELOG.md)
- [Commits](chimurai/http-proxy-middleware@v2.0.6...v2.0.9)

Updates `node-forge` from 1.3.1 to 1.3.3
- [Changelog](https://github.com/digitalbazaar/forge/blob/main/CHANGELOG.md)
- [Commits](digitalbazaar/forge@v1.3.1...v1.3.3)

Updates `on-headers` from 1.0.2 to 1.1.0
- [Release notes](https://github.com/jshttp/on-headers/releases)
- [Changelog](https://github.com/jshttp/on-headers/blob/master/HISTORY.md)
- [Commits](jshttp/on-headers@v1.0.2...v1.1.0)

Updates `rollup` from 4.17.2 to 4.57.1
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.17.2...v4.57.1)

Updates `tar` from 6.2.1 to 7.5.7
- [Release notes](https://github.com/isaacs/node-tar/releases)
- [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md)
- [Commits](isaacs/node-tar@v6.2.1...v7.5.7)

Updates `undici` from 6.11.1 to 7.18.2
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.11.1...v7.18.2)

Updates `vite` from 5.1.7 to 7.3.0
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v7.3.0/packages/vite)

Updates `webpack` from 5.90.3 to 5.104.1
- [Release notes](https://github.com/webpack/webpack/releases)
- [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md)
- [Commits](webpack/webpack@v5.90.3...v5.104.1)

Updates `webpack-dev-server` from 4.15.1 to 5.2.2
- [Release notes](https://github.com/webpack/webpack-dev-server/releases)
- [Changelog](https://github.com/webpack/webpack-dev-server/blob/main/CHANGELOG.md)
- [Commits](webpack/webpack-dev-server@v4.15.1...v5.2.2)

---
updated-dependencies:
- dependency-name: express
  dependency-version: 4.22.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-version: 8.17.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: esbuild
  dependency-version: 0.27.2
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 3.14.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: body-parser
  dependency-version: 1.20.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: braces
  dependency-version: 3.0.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: cookie
  dependency-version: 0.7.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: lodash
  dependency-version: 
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: path-to-regexp
  dependency-version: 0.1.12
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.14.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: send
  dependency-version: 0.19.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: serve-static
  dependency-version: 1.16.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: express
  dependency-version: 4.22.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: esbuild
  dependency-version: 0.27.2
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 4.1.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: body-parser
  dependency-version: 1.20.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: braces
  dependency-version: 3.0.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: cookie
  dependency-version: 0.7.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: lodash
  dependency-version: 4.17.23
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: path-to-regexp
  dependency-version: 0.1.12
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.14.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: send
  dependency-version: 0.19.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: serve-static
  dependency-version: 1.16.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@angular/common"
  dependency-version: 21.1.2
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@angular/compiler"
  dependency-version: 21.1.2
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: http-proxy-middleware
  dependency-version: 2.0.9
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: node-forge
  dependency-version: 1.3.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: on-headers
  dependency-version: 1.1.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: rollup
  dependency-version: 4.57.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: tar
  dependency-version: 7.5.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 7.18.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 7.3.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: webpack
  dependency-version: 5.104.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: webpack-dev-server
  dependency-version: 5.2.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>

    







  








      

  
            

    

      
    

    


      


          @dependabot
dependabot
bot



            added
      

  dependencies

  Pull requests that update a dependency file

      

  javascript

  Pull requests that update javascript code

  labels


      Feb 3, 2026

    

  












  
  

    

      

  










  








  
      

  
    Sign up for free
    to join this conversation on GitHub.
    Already have an account?
    Sign in to comment


  










      

  

    
    

    

  

    Reviewers
  


    

    No reviews






    
    
    

    

  


      
  

    Assignees
  



        


    No one assigned







      


  


  

    Labels
  



    

      

    dependencies

  Pull requests that update a dependency file
  

    javascript

  Pull requests that update javascript code








      

  

    

        

    Projects
  


        




    None yet




  



      


  

    
  

    Milestone
  


      No milestone





    
      
          


  

    

      
        

          
  

    Development
  



            


Successfully merging this pull request may close these issues.





  
  



      
    

  




      

    

  
        

  

    

      0 participants