Bump the npm_and_yarn group across 1 directory with 13 updates by dependabot[bot] · Pull Request #1 · NUMEN1156/docs

dependabot · 2025-09-30T04:43:56Z

Bumps the npm_and_yarn group with 10 updates in the / directory:

Package	From	To
express	`4.17.1`	`4.20.0`
liquidjs	`9.22.1`	`10.0.0`
next	`11.0.0`	`14.2.32`
@babel/traverse	`7.14.2`	`7.28.4`
qs	`6.5.2`	`6.5.3`
brace-expansion	`1.1.11`	`1.1.12`
decode-uri-component	`0.2.0`	`0.2.2`
json5	`1.0.1`	`1.0.2`
jszip	`3.6.0`	`3.10.1`
ws	`6.2.2`	`6.2.3`

Updates express from 4.17.1 to 4.20.0

Release notes

Sourced from express's releases.

4.20.0

What's Changed

Important

IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)

Remove link renderization in html while using res.redirect

Other Changes

4.19.2 Staging by @wesleytodd in expressjs/express#5561

remove duplicate location test for data uri by @wesleytodd in expressjs/express#5562

feat: document beta releases expectations by @marco-ippolito in expressjs/express#5565

Cut down on duplicated CI runs by @jonchurch in expressjs/express#5564

Add a Threat Model by @UlisesGascon in expressjs/express#5526

Assign captain of encodeurl by @blakeembrey in expressjs/express#5579

Nominate jonchurch as repo captain for http-errors, expressjs.com, morgan, cors, body-parser by @jonchurch in expressjs/express#5587

docs: update Security.md by @inigomarquinez in expressjs/express#5590

docs: update triage nomination policy by @UlisesGascon in expressjs/express#5600

Add CodeQL (SAST) by @UlisesGascon in expressjs/express#5433

docs: add UlisesGascon as triage initiative captain by @UlisesGascon in expressjs/express#5605

deps: encodeurl@~2.0.0 by @blakeembrey in expressjs/express#5569

skip QUERY method test by @jonchurch in expressjs/express#5628

ignore ETAG query test on 21 and 22, reuse skip util by @jonchurch in expressjs/express#5639

add support Node.js@22 in the CI by @mertcanaltin in expressjs/express#5627

doc: add table of contents, tc/triager lists to readme by @mertcanaltin in expressjs/express#5619

List and sort all projects, add captains by @blakeembrey in expressjs/express#5653

docs: add @UlisesGascon as captain for cookie-parser by @UlisesGascon in expressjs/express#5666

✨ bring back query tests for node 21 by @ctcpip in expressjs/express#5690

[v4] Deprecate res.clearCookie accepting options.maxAge and options.expires by @jonchurch in expressjs/express#5672

skip QUERY tests for Node 21 only, still not supported by @jonchurch in expressjs/express#5695

📝 update people, add ctcpip to TC by @ctcpip in expressjs/express#5683

remove minor version pinning from ci by @jonchurch in expressjs/express#5722

Fix link variable use in attribution section of CODE OF CONDUCT by @IamLizu in expressjs/express#5762

Replace Appveyor windows testing with GHA by @jonchurch in expressjs/express#5599

Add OSSF Scorecard badge by @UlisesGascon in expressjs/express#5436

update scorecard link by @bjohansebas in expressjs/express#5814

Nominate @IamLizu to the triage team by @UlisesGascon in expressjs/express#5836

deps: path-to-regexp@0.1.8 by @blakeembrey in expressjs/express#5603

docs: specify new instructions for question and discuss by @IamLizu in expressjs/express#5835

4.x: Upgrade merge-descriptors dependency by @RobinTail in expressjs/express#5781

path-to-regexp@0.1.10 by @blakeembrey in expressjs/express#5902

New Contributors

@marco-ippolito made their first contribution in expressjs/express#5565

@inigomarquinez made their first contribution in expressjs/express#5590

@mertcanaltin made their first contribution in expressjs/express#5627

@ctcpip made their first contribution in expressjs/express#5690

@bjohansebas made their first contribution in expressjs/express#5814

Full Changelog: expressjs/express@4.19.1...4.20.0

... (truncated)

Changelog

Sourced from express's changelog.

4.20.0 / 2024-09-10

deps: serve-static@0.16.0

Remove link renderization in html while redirecting

deps: send@0.19.0

Remove link renderization in html while redirecting

deps: body-parser@0.6.0

add depth option to customize the depth level in the parser

IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)

Remove link renderization in html while using res.redirect

deps: path-to-regexp@0.1.10

Adds support for named matching groups in the routes using a regex

Adds backtracking protection to parameters without regexes defined

deps: encodeurl@~2.0.0

Removes encoding of \, |, and ^ to align better with URL spec

Deprecate passing options.maxAge and options.expires to res.clearCookie

Will be ignored in v5, clearCookie will set a cookie with an expires in the past to instruct clients to delete the cookie

4.19.2 / 2024-03-25

Improved fix for open redirect allow list bypass

4.19.1 / 2024-03-20

Allow passing non-strings to res.location with new encoding handling checks

4.19.0 / 2024-03-20

Prevent open redirect allow list bypass due to encodeurl

deps: cookie@0.6.0

4.18.3 / 2024-02-29

Fix routing requests without method

deps: body-parser@1.20.2

Fix strict json error message on Node.js 19+

deps: content-type@~1.0.5

deps: raw-body@2.5.2

deps: cookie@0.6.0

Add partitioned option

4.18.2 / 2022-10-08

Fix regression routing a large stack in a single route

deps: body-parser@1.20.1

... (truncated)

Commits

21df421 4.20.0
4c9ddc1 feat: upgrade to serve-static@0.16.0
9ebe5d5 feat: upgrade to send@0.19.0 (#5928)
ec4a01b feat: upgrade to body-parser@1.20.3 (#5926)
54271f6 fix: don't render redirect values in anchor href
125bb74 path-to-regexp@0.1.10 (#5902)
2a980ad merge-descriptors@1.0.3 (#5781)
a3e7e05 docs: specify new instructions for question and discuss
c5addb9 deps: path-to-regexp@0.1.8 (#5603)
e35380a docs: add @IamLizu to the triage team (#5836)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for express since your current version.

Updates liquidjs from 9.22.1 to 10.0.0

Release notes

Sourced from liquidjs's releases.

v10.0.0

10.0.0 (2022-11-27)

chore

rename filters to snake style, #487 (ff112a4)

Code Refactoring

_evalToken renamed to evalToken (4e1a30a)

change ownPropertyOnly default value to true (7eb6216)

delay creation of operatorsTrie and hide this implementation (bb58d3e)

remove toThenable export (ffefd91)

remove use of internal Context class in evalValue argument (b115077)

Performance Improvements

target Node.js 14 for cjs bundle (main entry) (1f6ce7c)

BREAKING CHANGES

evalToken now returns a generator (LiquidJS async), which is different from evalToken in previous LiquidJS versions.

main entry need Node.js>=14 to run, you can build LiquidJS by your own by using ESM entry.

ownPropertyOnly default value changed to true

<liquidjs>.toThenable is removed, use <liquidjs>.toPromise instead

evalValue won't support Context as second argument anymore.

use operators instead of operatorsTrie as Tokenizer constructor argument, #500

keys in <liquidjs>.filters are now in snake case (instead of camel case), identical to that in Liquid template.

v9.43.0

9.43.0 (2022-11-27)

Features

support timezone offset argument for date filter, #553 (7a71485)

v9.42.1

9.42.1 (2022-10-21)

Bug Fixes

truncatewords should use at least one word, #537 (32f613f)

v9.42.0

... (truncated)

Changelog

Sourced from liquidjs's changelog.

10.0.0 (2022-11-27)

Code Refactoring

rename filters to snake style, #487 (ff112a4)

_evalToken renamed to evalToken (4e1a30a)

change ownPropertyOnly default value to true (7eb6216)

delay creation of operatorsTrie and hide this implementation (bb58d3e)

remove toThenable export (ffefd91)

remove use of internal Context class in evalValue argument (b115077)

Performance Improvements

target Node.js 14 for cjs bundle (main entry) (1f6ce7c)

BREAKING CHANGES

evalToken now returns a generator (LiquidJS async), which is different from evalToken in previous LiquidJS versions.

main entry need Node.js>=14 to run, you can build LiquidJS by your own by using ESM entry.

ownPropertyOnly default value changed to true

<liquidjs>.toThenable is removed, use <liquidjs>.toPromise instead

evalValue won't support Context as second argument anymore.

use operators instead of operatorsTrie as Tokenizer constructor argument, #500

keys in <liquidjs>.filters are now in snake case (instead of camel case), identical to that in Liquid template.

9.43.0 (2022-11-27)

Features

support timezone offset argument for date filter, #553 (7a71485)

9.42.1 (2022-10-21)

Bug Fixes

truncatewords should use at least one word, #537 (32f613f)

9.42.0 (2022-08-27)

Features

promise in expression & nested property, #533 #276 (bbf00f3)

9.41.0 (2022-08-24)

... (truncated)

Commits

9b9ef37 chore(release): 10.0.0 [skip ci]
5bbdc08 chore(deps): bump minimatch from 3.0.4 to 3.1.2
1380ac9 refactor: more consistent tags to make it easier to iterate over, #524
4e1a30a refactor: _evalToken renamed to evalToken
9299268 refactor: Tag class support in registerTag()
1f6ce7c perf: target Node.js 14 for cjs bundle (main entry)
7eb6216 refactor: change ownPropertyOnly default value to true
ffefd91 refactor: remove toThenable export
b115077 refactor: remove use of internal Context class in evalValue argument
bb58d3e refactor: delay creation of operatorsTrie and hide this implementation
Additional commits viewable in compare view

Updates next from 11.0.0 to 14.2.32

Release notes

Sourced from next's releases.

v14.2.32

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

fix router handling when setting a location response header #82588

Credits

Huge thanks to @ztanner for helping!

Commits

89ee561 v14.2.32
6a974ad [backport v14]: fix router handling when setting a location response header (...
55f7662 v14.2.31
5dd68a5 [backport v14]: fix(next/image): improve and simplify detect-content-type (#8...
bcc7c65 [backport v14]: fix(next/image): fix image-optimizer.ts headers (#82114) (#82...
243072b v14.2.30
f523d4a [backport]: config.allowedDevOrigins (#80410)
ca92115 v14.2.29
ec9ee87 Only share incremental cache for edge in next start (#79389)
e65628a v14.2.28
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by vercel-release-bot, a new releaser for next since your current version.

Updates @babel/runtime from 7.12.5 to 7.14.0

Commits

3c0152a v7.14.0
a0e20ac Simplify the wrapRegExp helper for named groups (#13201)
f63d73c Allow putting helpers in individual files (#13190)
006e2c9 v7.13.17
d94a8e5 v7.13.16
808d437 Support iterating generators in browsers without Symbol (#13129)
d1d404b v7.13.10
5f60bf0 Regenerate @babel/runtime-* package.json (#12964)
2c0e8d0 v7.13.9
9844eee Put back ESM helpers in a folder where we can use .js (#12919)
Additional commits viewable in compare view

Updates @babel/traverse from 7.14.2 to 7.28.4

Release notes

Sourced from @babel/traverse's releases.

v7.28.4 (2025-09-05)

Thanks @gwillen and @mrginglymus for your first PRs!

🏠 Internal

babel-core, babel-helper-check-duplicate-nodes, babel-traverse, babel-types

#17493 Update Jest to v30.1.1 (@JLHwung)

babel-plugin-transform-regenerator

#17455 chore: Clean up transform-regenerator (@liuxingbaoyu)

babel-core

#17474 Switch to @jridgewell/remapping (@mrginglymus)

Committers: 5

Babel Bot (@babel-bot)

Bill Collins (@mrginglymus)

Glenn Willen (@gwillen)

Huáng Jùnliàng (@JLHwung)

@liuxingbaoyu

v7.28.3 (2025-08-14)

👓 Spec Compliance

babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators, babel-plugin-transform-class-static-block, babel-preset-env

#17443 [static blocks] Do not inject new static fields after static code (@nicolo-ribaudo)

🐛 Bug Fix

babel-parser

#17465 fix(parser/typescript): parse import("./a", {with:{},}) (@easrng)

#17478 fix(parser): stop subscript parsing on async arrow (@JLHwung)

💅 Polish

babel-plugin-transform-regenerator, babel-plugin-transform-runtime

#17363 Do not save last yield in call in temp var (@nicolo-ribaudo)

📝 Documentation

#17448 move eslint-{parser,plugin} docs to the website (@JLHwung)

🏠 Internal

#17454 Enable type checking for scripts and babel-worker.cjs (@JLHwung)

🔬 Output optimization

babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions

#17444 Optimize do expression output (@JLHwung)

Committers: 5

Babel Bot (@babel-bot)

Huáng Jùnliàng (@JLHwung)

Jam Balaya (@JamBalaya56562)

Nicolò Ribaudo (@nicolo-ribaudo)

easrng (@easrng)

... (truncated)

Changelog

Sourced from @babel/traverse's changelog.

v7.28.4 (2025-09-05)

🏠 Internal

babel-core, babel-helper-check-duplicate-nodes, babel-traverse, babel-types

#17493 Update Jest to v30.1.1 (@JLHwung)

babel-plugin-transform-regenerator

#17455 chore: Clean up transform-regenerator (@liuxingbaoyu)

babel-core

#17474 Switch to @jridgewell/remapping (@mrginglymus)

v7.28.3 (2025-08-14)

👓 Spec Compliance

babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators, babel-plugin-transform-class-static-block, babel-preset-env

#17443 [static blocks] Do not inject new static fields after static code (@nicolo-ribaudo)

🐛 Bug Fix

babel-parser

#17465 fix(parser/typescript): parse import("./a", {with:{},}) (@easrng)

#17478 fix(parser): stop subscript parsing on async arrow (@JLHwung)

💅 Polish

babel-plugin-transform-regenerator, babel-plugin-transform-runtime

#17363 Do not save last yield in call in temp var (@nicolo-ribaudo)

📝 Documentation

#17448 move eslint-{parser,plugin} docs to the website (@JLHwung)

🏠 Internal

#17454 Enable type checking for scripts and babel-worker.cjs (@JLHwung)

🔬 Output optimization

babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions

#17444 Optimize do expression output (@JLHwung)

v7.28.2 (2025-07-24)

🐛 Bug Fix

babel-types

#17445 [babel 7] Make operator param in t.tsTypeOperator optional (@nicolo-ribaudo)

babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-regenerator, babel-preset-env, babel-runtime-corejs3

#17441 fix: regeneratorDefine compatibility with es5 strict mode (@liuxingbaoyu)

v7.28.1 (2025-07-12)

🐛 Bug Fix

babel-plugin-transform-async-generator-functions, babel-plugin-transform-regenerator

#17426 fix: regenerator correctly handles throw outside of try (@liuxingbaoyu)

📝 Documentation

babel-types

#17422 Add missing FunctionParameter docs (@JLHwung)

... (truncated)

Commits

35055e3 v7.28.4
b41f8cd Update Jest to v30.1.1 (#17493)
22493b6 Improve @babel/traverse typings (#17485)
18d88b8 Improve @babel/core typings (#17471)
ef155f5 v7.28.3
741cbd2 chore: fix various typos across codebase (#17476)
5051613 Type-check .d.ts file with strict: true (#17461)
ccc5fae v7.28.0
4b4e7e2 Create babel-helper-globals (#17297)
cf5ae03 LVal coverage updates (Part 2) (#17391)
Additional commits viewable in compare view

Updates loader-utils from 1.2.3 to 1.4.0

Release notes

Sourced from loader-utils's releases.

v1.4.0

1.4.0 (2020-02-19)

Features

the resourceQuery is passed to the interpolateName method (#163) (cd0e428)

v1.3.0

1.3.0 (2020-02-19)

Features

support the [query] template for the interpolatedName method (#162) (469eeba)

Changelog

Sourced from loader-utils's changelog.

1.4.0 (2020-02-19)

Features

the resourceQuery is passed to the interpolateName method (#163) (cd0e428)

1.3.0 (2020-02-19)

Features

support the [query] template for the interpolatedName method (#162) (469eeba)

Commits

d95b8b5 chore(release): 1.4.0
cd0e428 feat: the resourceQuery is passed to the interpolateName method (#163)
06d36cf chore(release): 1.3.0
469eeba feat: support the [query] template for the interpolatedName method (#162)
909c99d chore: funding.yml config and CI fix (#159)
b5b74f0 Set up CI with Azure Pipelines
7970c48 docs: small grammar change (#144)
See full diff in compare view

Updates qs from 6.5.2 to 6.5.3

Changelog

Sourced from qs's changelog.

6.5.3

[Fix] parse: ignore __proto__ keys (#428)

[Fix] utils.merge: avoid a crash with a null target and a truthy non-array source

[Fix] correctly parse nested arrays

[Fix] stringify: fix a crash with strictNullHandling and a custom filter/serializeDate (#279)

[Fix] utils: merge: fix crash when source is a truthy primitive & no options are provided

[Fix] when parseArrays is false, properly handle keys ending in []

[Fix] fix for an impossible situation: when the formatter is called with a non-string value

[Fix] utils.merge: avoid a crash with a null target and an array source

[Refactor] utils: reduce observable [[Get]]s

[Refactor] use cached Array.isArray

[Refactor] stringify: Avoid arr = arr.concat(...), push to the existing instance (#269)

[Refactor] parse: only need to reassign the var once

[Robustness] stringify: avoid relying on a global undefined (#427)

[readme] remove travis badge; add github actions/codecov badges; update URLs

[Docs] Clean up license text so it’s properly detected as BSD-3-Clause

[Docs] Clarify the need for "arrayLimit" option

[meta] fix README.md (#399)

[meta] add FUNDING.yml

[actions] backport actions from main

[Tests] always use String(x) over x.toString()

[Tests] remove nonexistent tape option

[Dev Deps] backport from main

Commits

298bfa5 v6.5.3
ed0f5dc [Fix] parse: ignore __proto__ keys (#428)
691e739 [Robustness] stringify: avoid relying on a global undefined (#427)
1072d57 [readme] remove travis badge; add github actions/codecov badges; update URLs
12ac1c4 [meta] fix README.md (#399)
0338716 [actions] backport actions from main
5639c20 Clean up license text so it’s properly detected as BSD-3-Clause
51b8a0b add FUNDING.yml
45f6759 [Fix] fix for an impossible situation: when the formatter is called with a no...
f814a7f [Dev Deps] backport from main
Additional commits viewable in compare view

Updates brace-expansion from 1.1.11 to 1.1.12

Release notes

Sourced from brace-expansion's releases.

v1.1.12

pkg: publish on tag 1.x c460dbd

fmt ccb8ac6

Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) c3c73c8

juliangruber/brace-expansion@v1.1.11...v1.1.12

Commits

44f33b4 1.1.12
c460dbd pkg: publish on tag 1.x
ccb8ac6 fmt
c3c73c8 Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65)
See full diff in compare view

Updates decode-uri-component from 0.2.0 to 0.2.2

Release notes

Sourced from decode-uri-component's releases.

v0.2.2

Prevent overwriting previously decoded tokens 980e0bf

SamVerschueren/decode-uri-component@v0.2.1...v0.2.2

v0.2.1

Switch to GitHub workflows 76abc93

Fix issue where decode throws - fixes #6 746ca5d

Update license (#1) 486d7e2

Tidelift tasks a650457

Meta tweaks 66e1c28

SamVerschueren/decode-uri-component@v0.2.0...v0.2.1

Commits

a0eea46 0.2.2
980e0bf Prevent overwriting previously decoded tokens
3c8a373 0.2.1
76abc93 Switch to GitHub workflows
746ca5d Fix issue where decode throws - fixes #6
486d7e2 Update license (#1)
a650457 Tidelift tasks
66e1c28 Meta tweaks
See full diff in compare view

Updates json5 from 1.0.1 to 1.0.2

Release notes

Sourced from json5's releases.

v1.0.2

Fix: Properties with the name __proto__ are added to objects and arrays. (#199) This also fixes a prototype pollution vulnerability reported by Jonathan Gregson! (#295). This has been backported to v1. (#298)

Changelog

Sourced from json5's changelog.

Unreleased [code, diff]

v2.2.3 [code, diff]

Fix: json5@2.2.3 is now the 'latest' release according to npm instead of v1.0.2. (#299)

v2.2.2 [code, diff]

Fix: Properties with the name __proto__ are added to objects and arrays. (#199) This also fixes a prototype pollution vulnerability reported by Jonathan Gregson! (#295).

v2.2.1 [code, diff]

Fix: Removed dependence on minimist to patch CVE-2021-44906. (#266)

v2.2.0 [code, diff]

New: Accurate and documented TypeScript declarations are now included. There is no need to install @types/json5. (#236, #244)

v2.1.3 [code, diff]

Fix: An out of memory bug when parsing numbers has been fixed. (#228, #229)

v2.1.2 [code, diff]

... (truncated)

Commits

a62db1e 1.0.2
e0c23fe docs: update CHANGELOG for v1.0.2
62a6540 fix: add proto to objects and arrays
See full diff in compare view

Updates jszip from 3.6.0 to 3.10.1

Changelog

Sourced from jszip's changelog.

v3.10.1 2022-08-02

Add sponsorship files.

If you appreciate the time spent maintaining JSZip then I would really appreciate your sponsorship.

Consolidate metadata types and expose OnUpdateCallback #851 and #852

use const instead var in example from README.markdown #828

Switch manual download link to HTTPS #839

Internals:

Replace jshint with eslint #842

Add performance tests #834

v3.10.0 2022-05-20

Change setimmediate dependency to more efficient one. Fixes Stuk/jszip#617 (see #829)

Update types of currentFile metadata to include null (see #826)

v3.9.1 2022-04-06

Fix recursive definition of InputFileFormat introduced in 3.9.0.

v3.9.0 2022-04-04

Update types JSZip#loadAsync to accept a promise for data, and remove arguments from new JSZip() (see #752)

Update types for compressionOptions to JSZipFileOptions and JSZipGeneratorOptions (see #722)

Add types for generateInternalStream (see #774)

v3.8.0 2022-03-30

Santize filenames when files are loaded with loadAsync, to avoid "zip slip" attacks. The original filename is available on each zip entry as unsafeOriginalName. See the documentation. Many thanks to McCaulay Hudson for reporting.

v3.7.1 2021-08-05

Fix build of dist files.

Note: this version ensures the changes from 3.7.0 are actually included in the dist files. Thanks to Evan W for reporting.

v3.7.0 2021-07-23

Fix: Use a null prototype object for this.files (see #766)

This change might break existing code if it uses prototype methods on the .files property of a zip object, for example zip.files.toString(). This approach is taken to prevent files in the zip overriding object methods that would exist on a normal object.

Commits

0f2f1e4 3.10.1
cae5510 Updates for v3.10.1
179c9a0 Update changelog for 3.10.1
61e1df5 Add Jekyll files to gitignore
f299cce Merge pull request #852 from Stuk/metadata-ts
852887a Consolidate metadata types and expose OnUpdateCallback
5be00df Add sponsorship files
dabe864 Update package-lock for benchmark
cc554da Merge pull request #841 from stevennyman/patch-2
caefbc0 Merge pull request #834 from Stuk/benchmark
Additional commits viewable in compare view

Updates ws from 6.2.2 to 6.2.3

Release notes

Sourced from ws's releases.

6.2.3

Bug fixes

Backported e55e5106 to the 6.x release line (eeb76d31).

Commits

d87f3b6 [dist] 6.2.3
eeb76d3 [security] Fix crash when the Upgrade header cannot be read (#2231)
See full diff in compare view

Updates path-to-regexp from 0.1.7 to 0.1.10

Release notes

Sourced from path-to-regexp's releases.

Backtrack protection

Fixed

Add backtrack protection to parameters 29b96b4

This will break some edge cases but should improve performance

https://github.com/pillarjs/path-to-regexp/compare/v0.1...
Description has been truncated

Bumps the npm_and_yarn group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [express](https://github.com/expressjs/express) | `4.17.1` | `4.20.0` | | [liquidjs](https://github.com/harttle/liquidjs) | `9.22.1` | `10.0.0` | | [next](https://github.com/vercel/next.js) | `11.0.0` | `14.2.32` | | [@babel/traverse](https://github.com/babel/babel/tree/HEAD/packages/babel-traverse) | `7.14.2` | `7.28.4` | | [qs](https://github.com/ljharb/qs) | `6.5.2` | `6.5.3` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.11` | `1.1.12` | | [decode-uri-component](https://github.com/SamVerschueren/decode-uri-component) | `0.2.0` | `0.2.2` | | [json5](https://github.com/json5/json5) | `1.0.1` | `1.0.2` | | [jszip](https://github.com/Stuk/jszip) | `3.6.0` | `3.10.1` | | [ws](https://github.com/websockets/ws) | `6.2.2` | `6.2.3` | Updates `express` from 4.17.1 to 4.20.0 - [Release notes](https://github.com/expressjs/express/releases) - [Changelog](https://github.com/expressjs/express/blob/master/History.md) - [Commits](expressjs/express@4.17.1...4.20.0) Updates `liquidjs` from 9.22.1 to 10.0.0 - [Release notes](https://github.com/harttle/liquidjs/releases) - [Changelog](https://github.com/harttle/liquidjs/blob/master/CHANGELOG.md) - [Commits](harttle/liquidjs@v9.22.1...v10.0.0) Updates `next` from 11.0.0 to 14.2.32 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v11.0.0...v14.2.32) Updates `@babel/runtime` from 7.12.5 to 7.14.0 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.14.0/packages/babel-runtime) Updates `@babel/traverse` from 7.14.2 to 7.28.4 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.28.4/packages/babel-traverse) Updates `loader-utils` from 1.2.3 to 1.4.0 - [Release notes](https://github.com/webpack/loader-utils/releases) - [Changelog](https://github.com/webpack/loader-utils/blob/master/CHANGELOG.md) - [Commits](webpack/loader-utils@v1.2.3...v1.4.0) Updates `qs` from 6.5.2 to 6.5.3 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.5.2...v6.5.3) Updates `brace-expansion` from 1.1.11 to 1.1.12 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@1.1.11...v1.1.12) Updates `decode-uri-component` from 0.2.0 to 0.2.2 - [Release notes](https://github.com/SamVerschueren/decode-uri-component/releases) - [Commits](SamVerschueren/decode-uri-component@v0.2.0...v0.2.2) Updates `json5` from 1.0.1 to 1.0.2 - [Release notes](https://github.com/json5/json5/releases) - [Changelog](https://github.com/json5/json5/blob/main/CHANGELOG.md) - [Commits](json5/json5@v1.0.1...v1.0.2) Updates `jszip` from 3.6.0 to 3.10.1 - [Changelog](https://github.com/Stuk/jszip/blob/main/CHANGES.md) - [Commits](Stuk/jszip@v3.6.0...v3.10.1) Updates `ws` from 6.2.2 to 6.2.3 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@6.2.2...6.2.3) Updates `path-to-regexp` from 0.1.7 to 0.1.10 - [Release notes](https://github.com/pillarjs/path-to-regexp/releases) - [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md) - [Commits](pillarjs/path-to-regexp@v0.1.7...v0.1.10) --- updated-dependencies: - dependency-name: express dependency-version: 4.20.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: liquidjs dependency-version: 10.0.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 14.2.32 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@babel/runtime" dependency-version: 7.14.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@babel/traverse" dependency-version: 7.28.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: loader-utils dependency-version: 1.4.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.5.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.12 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: decode-uri-component dependency-version: 0.2.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: json5 dependency-version: 1.0.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: jszip dependency-version: 3.10.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 6.2.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: path-to-regexp dependency-version: 0.1.10 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 30, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the npm_and_yarn group across 1 directory with 13 updates#1

Bump the npm_and_yarn group across 1 directory with 13 updates#1
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm_and_yarn-cb35974911

dependabot bot commented on behalf of github Sep 30, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot bot commented on behalf of github Sep 30, 2025

4.20.0

What's Changed

Important

Other Changes

New Contributors

4.20.0 / 2024-09-10

4.19.2 / 2024-03-25

4.19.1 / 2024-03-20

4.19.0 / 2024-03-20

4.18.3 / 2024-02-29

4.18.2 / 2022-10-08

v10.0.0

10.0.0 (2022-11-27)

chore

Code Refactoring

Performance Improvements

BREAKING CHANGES

v9.43.0

9.43.0 (2022-11-27)

Features

v9.42.1

9.42.1 (2022-10-21)

Bug Fixes

v9.42.0

10.0.0 (2022-11-27)

Code Refactoring

Performance Improvements

BREAKING CHANGES

9.43.0 (2022-11-27)

Features

9.42.1 (2022-10-21)

Bug Fixes

9.42.0 (2022-08-27)

Features

9.41.0 (2022-08-24)

v14.2.32

Core Changes

Credits

v7.28.4 (2025-09-05)

🏠 Internal

Committers: 5

v7.28.3 (2025-08-14)

👓 Spec Compliance

🐛 Bug Fix

💅 Polish

📝 Documentation

🏠 Internal

🔬 Output optimization

Committers: 5

v7.28.4 (2025-09-05)

🏠 Internal

v7.28.3 (2025-08-14)

👓 Spec Compliance

🐛 Bug Fix

💅 Polish

📝 Documentation

🏠 Internal

🔬 Output optimization

v7.28.2 (2025-07-24)

🐛 Bug Fix

v7.28.1 (2025-07-12)

🐛 Bug Fix

📝 Documentation

v1.4.0

1.4.0 (2020-02-19)

Features

v1.3.0

1.3.0 (2020-02-19)

Features

1.4.0 (2020-02-19)

Features

1.3.0 (2020-02-19)

Features

6.5.3

v1.1.12

v0.2.2

v0.2.1

v1.0.2