chore(deps): bump the npm_and_yarn group across 1 directory with 6 updates by dependabot[bot] · Pull Request #6 · hashim21223445/blockly

dependabot · 2025-11-16T04:22:04Z

Bumps the npm_and_yarn group with 5 updates in the / directory:

Package	From	To
js-yaml	`4.1.0`	`4.1.1`
braces	`3.0.2`	`3.0.3`
follow-redirects	`1.15.4`	`1.15.11`
tar-fs	`3.0.4`	`3.1.1`
tmp	`0.0.33`	`0.2.5`

Updates js-yaml from 4.1.0 to 4.1.1

Changelog

Sourced from js-yaml's changelog.

[4.1.1] - 2025-11-12

Security

Fix prototype pollution issue in yaml merge (<<) operator.

Commits

cc482e7 4.1.1 released
50968b8 dist rebuild
d092d86 lint fix
383665f fix prototype pollution in merge (<<)
0d3ca7a README.md: HTTP => HTTPS (#678)
49baadd doc: 'empty' style option for !!null
ba3460e Fix demo link (#618)
See full diff in compare view

Updates braces from 3.0.2 to 3.0.3

Commits

74b2db2 3.0.3
88f1429 update eslint. lint, fix unit tests.
415d660 Snyk js braces 6838727 (#40)
190510f fix tests, skip 1 test in test/braces.expand
716eb9f readme bump
a5851e5 Merge pull request #37 from coderaiser/fix/vulnerability
2092bd1 feature: braces: add maxSymbols (https://github.com/micromatch/braces/issues/...
9f5b4cf fix: vulnerability (https://security.snyk.io/vuln/SNYK-JS-BRACES-6838727)
98414f9 remove funding file
665ab5d update keepEscaping doc (#27)
Additional commits viewable in compare view

Updates follow-redirects from 1.15.4 to 1.15.11

Commits

21ef28a Release version 1.15.11 of the npm package.
7c88135 Roll back tree shaking.
6e389ba Release version 1.15.10 of the npm package.
5bc496e Shake me up before you go-go.
694d6b4 Bump minimist from 1.2.5 to 1.2.8
e4e55c7 Release version 1.15.9 of the npm package.
31a1abf Attempt much more gentle detection.
d2aaa97 Fix url field.
62558f0 Release version 1.15.8 of the npm package.
a8d1cee Return subtlety.
Additional commits viewable in compare view

Updates tar-fs from 3.0.4 to 3.1.1

Commits

0aa57de 3.1.1
0bd54cd expand check
cb1c571 3.1.0
374460e add optional disablement of symlink validation (#119)
5bfe6df 3.0.10
63e12f9 bare support
2ceedf4 3.0.9
647447b check windows tweak (#115)
e4a7a40 3.0.8
504ca0f upgrade bare packages
Additional commits viewable in compare view

Updates ws from 8.13.0 to 8.18.3

Release notes

Sourced from ws's releases.

8.18.3

Bug fixes

Fixed a spec violation where the Sec-WebSocket-Version header was not added to the HTTP response if the client requested version was either invalid or unacceptable (#2291).

8.18.2

Bug fixes

Fixed an issue that, during message decompression when the maximum size was exceeded, led to the emission of an inaccurate error and closure of the connection with an improper close code (#2285).

8.18.1

Bug fixes

The length of the UNIX domain socket paths in the tests has been shortened to make them work when run via CITGM (021f7b8b).

8.18.0

Features

Added support for Blob (#2229).

8.17.1

Bug fixes

Fixed a DoS vulnerability (#2231).

A request with a number of headers exceeding the[server.maxHeadersCount][] threshold could be used to crash a ws server.
const http = require('http');
const WebSocket = require('ws');
const wss = new WebSocket.Server({ port: 0 }, function () {
const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
const headers = {};
let count = 0;
for (let i = 0; i < chars.length; i++) {
if (count === 2000) break;
for (let j = 0; j &lt; chars.length; j++) {
  const key = chars[i] + chars[j];
  headers[key] = 'x';

</tr></table>

... (truncated)

Commits

dabbdec [dist] 8.18.3
33f5dba [fix] Respond with the supported protocol versions (#2291)
22a5a17 [ci] Test on node 24
e67eb7a [ci] Do not test on node 23
fa670f2 [ci] Run the lint step on node 22
0eb8535 [dist] 8.18.2
4f20aed [fix] Handle oversized messages with designated error (#2285)
aa998e3 [pkg] Update globals to version 16.0.0
cf25954 [minor] Fix nit in error message
b92745a [dist] 8.18.1
Additional commits viewable in compare view

Updates tmp from 0.0.33 to 0.2.5

Changelog

Sourced from tmp's changelog.

v0.2.2 (2024-02-28)

🐛 Bug Fix

#278 Closes #268: Revert "fix #246: remove any double quotes or single quotes… (@mbargiel)

📝 Documentation

#279 Closes #266: move paragraph on graceful cleanup to the head of the documentation (@silkentrance)

Committers: 5

Carsten Klein (@silkentrance)

Dave Nicolson (@dnicolson)

KARASZI István (@raszi)

Maxime Bargiel (@mbargiel)

@robertoaceves

v0.2.1 (2020-04-28)

🚀 Enhancement

#252 Closes #250: introduce tmpdir option for overriding the system tmp dir (@silkentrance)

🏠 Internal

#253 Closes #191: generate changelog from pull requests using lerna-changelog (@silkentrance)

Committers: 1

Carsten Klein (@silkentrance)

v0.2.0 (2020-04-25)

🚀 Enhancement

#234 feat: stabilize tmp for v0.2.0 release (@silkentrance)

🐛 Bug Fix

#231 Closes #230: regression after fix for #197 (@silkentrance)

#220 Closes #197: return sync callback when using the sync interface, otherwise return the async callback (@silkentrance)

#193 Closes #192: tmp must not exit the process on its own (@silkentrance)

📝 Documentation

#221 Gh 206 document name option (@silkentrance)

🏠 Internal

#226 Closes #212: enable direct name option test (@silkentrance)

#225 Closes #211: existing tests must clean up after themselves (@silkentrance)

#224 Closes #217: name tests must use tmpName (@silkentrance)

#223 Closes #214: refactor tests and lib (@silkentrance)

#198 Update dependencies to latest versions (@matsev)

... (truncated)

Commits

3d2fe38 Bump up the version
e162828 Merge pull request #309 from fflorent/fix-tmp-dir-with-dir
b847d2f Fix use of tmp.dir() with dir option
08fa3ab Update version
1cf4ec5 Merge commit from fork
188b25e Fix GHSA-52f5-9888-hmc6
73b9fe4 Add test case for GHSA-52f5-9888-hmc6
b8e2f29 Remove broken tests
2892a02 Remove outdated URL
f592318 Reformat package.json
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

…dates Bumps the npm_and_yarn group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.0` | `4.1.1` | | [braces](https://github.com/micromatch/braces) | `3.0.2` | `3.0.3` | | [follow-redirects](https://github.com/follow-redirects/follow-redirects) | `1.15.4` | `1.15.11` | | [tar-fs](https://github.com/mafintosh/tar-fs) | `3.0.4` | `3.1.1` | | [tmp](https://github.com/raszi/node-tmp) | `0.0.33` | `0.2.5` | Updates `js-yaml` from 4.1.0 to 4.1.1 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.0...4.1.1) Updates `braces` from 3.0.2 to 3.0.3 - [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md) - [Commits](micromatch/braces@3.0.2...3.0.3) Updates `follow-redirects` from 1.15.4 to 1.15.11 - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.15.4...v1.15.11) Updates `tar-fs` from 3.0.4 to 3.1.1 - [Commits](mafintosh/tar-fs@v3.0.4...v3.1.1) Updates `ws` from 8.13.0 to 8.18.3 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.13.0...8.18.3) Updates `tmp` from 0.0.33 to 0.2.5 - [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md) - [Commits](raszi/node-tmp@v0.0.33...v0.2.5) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.1.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: braces dependency-version: 3.0.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: follow-redirects dependency-version: 1.15.11 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tar-fs dependency-version: 3.1.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 8.18.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tmp dependency-version: 0.2.5 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

semanticdiff-com · 2025-11-16T04:22:08Z

Review changes with

Changed Files

File	Status
package.json	25% smaller
package-lock.json	Unsupported file format

snyk-io · 2025-11-16T04:22:15Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 16, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the npm_and_yarn group across 1 directory with 6 updates#6

chore(deps): bump the npm_and_yarn group across 1 directory with 6 updates#6
dependabot[bot] wants to merge 1 commit intodevelopfrom
dependabot/npm_and_yarn/npm_and_yarn-22c0e40af4

dependabot bot commented on behalf of github Nov 16, 2025

Uh oh!

semanticdiff-com bot commented Nov 16, 2025 •

edited

Loading

Uh oh!

snyk-io bot commented Nov 16, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot bot commented on behalf of github Nov 16, 2025

[4.1.1] - 2025-11-12

Security

8.18.3

Bug fixes

8.18.2

Bug fixes

8.18.1

Bug fixes

8.18.0

Features

8.17.1

Bug fixes

v0.2.2 (2024-02-28)

🐛 Bug Fix

📝 Documentation

Committers: 5

v0.2.1 (2020-04-28)

🚀 Enhancement

🏠 Internal

Committers: 1

v0.2.0 (2020-04-25)

🚀 Enhancement

🐛 Bug Fix

📝 Documentation

🏠 Internal

Uh oh!

semanticdiff-com bot commented Nov 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

snyk-io bot commented Nov 16, 2025

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

semanticdiff-com bot commented Nov 16, 2025 •

edited

Loading