chore(deps): bump the npm_and_yarn group across 1 directory with 10 updates - #4
Conversation
…pdates Bumps the npm_and_yarn group with 9 updates in the /docs directory: | Package | From | To | | --- | --- | --- | | [body-parser](https://github.com/expressjs/body-parser) | `1.20.5` | `1.20.6` | | [dompurify](https://github.com/cure53/DOMPurify) | `3.4.2` | `3.4.12` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.1.2` | `3.1.4` | | [launch-editor](https://github.com/vitejs/launch-editor) | `2.13.2` | `2.14.1` | | [qs](https://github.com/ljharb/qs) | `6.15.1` | `6.15.3` | | [svgo](https://github.com/svg/svgo) | `3.3.3` | `3.3.4` | | [webpack-dev-server](https://github.com/webpack/webpack-dev-server) | `5.2.4` | `5.2.6` | | [ws](https://github.com/websockets/ws) | `7.5.10` | `7.5.13` | | [websocket-driver](https://github.com/faye/websocket-driver-node) | `0.7.4` | `0.7.5` | Updates `body-parser` from 1.20.5 to 1.20.6 - [Release notes](https://github.com/expressjs/body-parser/releases) - [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md) - [Commits](expressjs/body-parser@1.20.5...1.20.6) Updates `dompurify` from 3.4.2 to 3.4.12 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.4.2...3.4.12) Updates `fast-uri` from 3.1.2 to 3.1.4 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.2...v3.1.4) Updates `launch-editor` from 2.13.2 to 2.14.1 - [Commits](vitejs/launch-editor@v2.13.2...v2.14.1) Updates `qs` from 6.15.1 to 6.15.3 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.15.1...v6.15.3) Updates `shell-quote` from 1.8.3 to 1.10.0 - [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md) - [Commits](ljharb/shell-quote@v1.8.3...v1.10.0) Updates `svgo` from 3.3.3 to 3.3.4 - [Release notes](https://github.com/svg/svgo/releases) - [Commits](svg/svgo@v3.3.3...v3.3.4) Updates `webpack-dev-server` from 5.2.4 to 5.2.6 - [Release notes](https://github.com/webpack/webpack-dev-server/releases) - [Changelog](https://github.com/webpack/webpack-dev-server/blob/v5.2.6/CHANGELOG.md) - [Commits](webpack/webpack-dev-server@v5.2.4...v5.2.6) Updates `ws` from 7.5.10 to 7.5.13 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@7.5.10...7.5.13) Updates `websocket-driver` from 0.7.4 to 0.7.5 - [Changelog](https://github.com/faye/websocket-driver-node/blob/main/CHANGELOG.md) - [Commits](faye/websocket-driver-node@0.7.4...0.7.5) --- updated-dependencies: - dependency-name: body-parser dependency-version: 1.20.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: dompurify dependency-version: 3.4.12 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: launch-editor dependency-version: 2.14.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.15.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: shell-quote dependency-version: 1.10.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: svgo dependency-version: 3.3.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: webpack-dev-server dependency-version: 5.2.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 7.5.13 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: websocket-driver dependency-version: 0.7.5 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
Quality Report — ConductionNL/portaliq @
|
| Check | PHP | Vue | Security | License | Tests |
|---|---|---|---|---|---|
| lint | ✅ | ||||
| phpcs | ✅ | ||||
| phpmd | ❌ | ||||
| psalm | ✅ | ||||
| phpstan | ✅ | ||||
| phpmetrics | ✅ | ||||
| eslint | ✅ | ||||
| stylelint | ✅ | ||||
| build | ✅ | ||||
| composer | ✅ | ✅ 100/100 | |||
| npm | ✅ | ✅ 871/871 | |||
| PHPUnit | ✅ | ||||
| Newman | ⏭️ | ||||
| Playwright | ✅ |
Quality workflow — 2026-08-04 11:55 UTC
Download the full PDF report from the workflow artifacts.
Verified by building it — and the control is the interesting half
So I built it myself, both arms, inside a real git worktree (the sitemap plugin shells out to
The control fails, and that is a live defect on
|
…led (#63) `docs/` does not build on `development` today, and nothing reports it. npm error `npm ci` can only install packages when your package.json npm error and package-lock.json are in sync. npm error Invalid: lock file's @conduction/docusaurus-preset@3.10.0 npm error does not satisfy @conduction/docusaurus-preset@3.28.0 `docs/package.json` requires `^3.12.0`; the committed lockfile pins 3.10.0. `npm ci` exits 1, so `npm run build` then exits 127 with "docusaurus: not found" — there is no installed toolchain to run. It went unnoticed because no job builds `docs/` on this branch: .github/workflows/documentation.yml triggers only on push/pull_request to a branch named `documentation`, and that branch does not exist (`git ls-remote origin refs/heads/documentation` is empty). This is the lockfile from dependabot #4, which regenerated it and in doing so moved the preset to 3.27.1 — satisfying the range. Landing it here rather than merging #4 because #4's checks last ran two weeks ago against merge-base 1f9dd87, a tree that no longer exists; its red `PHP Quality (phpmd)` is from that stale base and says nothing about a change that touches one JSON file under docs/. Measured, both arms, inside a real git worktree (the sitemap plugin shells out to `git log`, so building a copied-out docs/ fails for that reason alone — my first attempt hit exactly that false red): control development's lockfile npm ci exit 1 build exit 127 treatment this lockfile npm ci exit 0 build exit 0, 4.9M site, index.html Also carries 9 security bumps: body-parser 1.20.5->1.20.6 (CVE), dompurify 3.4.2->3.4.12, fast-uri 3.1.2->3.1.4, launch-editor 2.13.2->2.14.1, qs 6.15.1->6.15.3, svgo 3.3.3->3.3.4, webpack-dev-server 5.2.4->5.2.6, ws 7.5.10->7.5.13, websocket-driver 0.7.4->0.7.5. docs/package.json is untouched and is byte-identical to what it was at #4's merge-base, so the lockfile applies with no rebase.
|
Closing — the lockfile in this PR was landed as #63 (merged), on current Full verification, including the control arm that turned out to be the finding, is in the comment above: Not merged directly because this branch's checks last ran two weeks ago against merge-base The 9 security bumps you raised (body-parser CVE, dompurify, fast-uri, launch-editor, qs, svgo, webpack-dev-server, ws, websocket-driver) are all in #63. Filed #64 for the reason this survived: |
|
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests. To ignore these dependencies, configure ignore rules in dependabot.yml |
1 participant
Bumps the npm_and_yarn group with 9 updates in the /docs directory:
1.20.51.20.63.4.23.4.123.1.23.1.42.13.22.14.16.15.16.15.33.3.33.3.45.2.45.2.67.5.107.5.130.7.40.7.5Updates
body-parserfrom 1.20.5 to 1.20.6Release notes
Sourced from body-parser's releases.
Changelog
Sourced from body-parser's changelog.
Commits
5cc4fb81.20.6 (#746)3492672fix: improve limit option validation (#741)Updates
dompurifyfrom 3.4.2 to 3.4.12Release notes
Sourced from dompurify's releases.
... (truncated)
Commits
a9ca1e5release: 3.4.12 (#1537)0cae518release: 3.4.11 (#1494)6ee5716release: 3.4.10 (#1478)5210247release: 3.4.9 (#1459)bcdd828release: 3.4.8 (#1439)ca30f07release: 3.4.7 (#1414)bb7739erelease: 3.4.6 (#1394)011b0c7release: 3.4.5 (#1382)5817ad9release: 3.4.4 (#1374)520edb0release: 3.4.3 (#1352)Updates
fast-urifrom 3.1.2 to 3.1.4Release notes
Sourced from fast-uri's releases.
Commits
6aeece6Bumped v3.1.42d50fbafix: reject literal backslash in URI authority0549fe3Bumped v3.1.32a6d357Merge commit from forkUpdates
launch-editorfrom 2.13.2 to 2.14.1Commits
3f97c64v2.14.10cc9550fix: reject UNC paths (#138)afd1ab9ci: run tests on mac and windows (#136)0bfa328test: add some tests for launch-editor package (#135)1b006aechore: add README (#134)383ef26v2.14.06277209ci: harden publish settings520b2f7fix(deps): update all non-major dependencies (#129)475ac66chore(deps): update dependency lint-staged to v17 (#130)247bf1dchore(deps): update dependency yorkie to v2 (#131)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for launch-editor since your current version.
Updates
qsfrom 6.15.1 to 6.15.3Changelog
Sourced from qs's changelog.
Commits
18d085ev6.15.3c38af42[Deps] updateside-channeladce539[Dev Deps] updateeslint,mock-property,tape74a0f6a[Robustness]utils: enforcearrayLimitconsistently acrossmerge's arra...f4938f5[Tests]parse: characterize current lenient handling of unbalanced bracket ...5d5f723[Perf]utils: makecompactO(n) via a side-channel visited-set instead of...52afe00[Robustness]parse: throw thearrayLimiterror before splitting oversized...963e538[Fix]parse: enforcethrowOnLimitExceededfor cumulative array growth via...59da434[Fix]utils: respect encoding of surrogate pairs across chunks9532969[Robustness]utils.merge/utils.assign: avoid invoking__proto__sette...Updates
shell-quotefrom 1.8.3 to 1.10.0Changelog
Sourced from shell-quote's changelog.
Commits
64988d9v1.10.0617d119[Tests]quote: the tilde test escapes every~, not just a leading one (#9)59bbf8b[types] fix an error TS v6 ignores but v7 fails on190e236[Tests]quote: pin that a backslash with whitespace is not doubled in singl...a04d475[Dev Deps] update@arethetypeswrong/cli,evalmdb9545b3[New]parse: add opt-insplitUnquotedoption for shell field-splitting of...1b36468[readme]quote: use output verbatim; do not re-quote it (#11)1c36f3f[Tests]quote: pin conservative escaping of=,@,^,,,:,!(#11)e1c75cd[readme] documentparse's supported parameter-expansion subsetc0842c8[Fix]parse: match nested${...}braces so nested parameter expansion is ...Updates
svgofrom 3.3.3 to 3.3.4Release notes
Sourced from svgo's releases.
Commits
72a2388Merge commit from forkUpdates
webpack-dev-serverfrom 5.2.4 to 5.2.6Release notes
Sourced from webpack-dev-server's releases.
Changelog
Sourced from webpack-dev-server's changelog.
Commits
8a37b0echore(release): new release (#5697)f21ed0ffix: handle malformed Host and Origin headers (#5699)80cd9eefix: reject cross-site requests to open-editor and invalidate endpoints (#5698)308e853fix: handle undefined options in Server constructor (#5695)8b2b915chore: update branch references from v4 to v5 in workflow configuration870ed22chore: add v5 branch to release workflow triggersc3ee325chore(release): new release (#5682)60173befeat: add changeset validation and release workflow (#5680)948d5e6fix(proxy): match the HMR upgrade path exactly like the ws server (#5678)93e8996fix: skip HMR websocket path when forwarding upgrades to user-defined proxies...Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for webpack-dev-server since your current version.
Updates
wsfrom 7.5.10 to 7.5.13Release notes
Sourced from ws's releases.
Commits
1680801[dist] 7.5.1318bcb11[fix] Reset the fragment counter when the message is complete98fce81[dist] 7.5.12deec211[fix] Lower default values ofmaxBufferedChunksandmaxFragmentsfb8a193[fix] Count empty fragments toward the limit (#2329)fd36cd8[dist] 7.5.11e14c458[security] Limit retained message partsUpdates
websocket-driverfrom 0.7.4 to 0.7.5Changelog
Sourced from websocket-driver's changelog.
Commits
5d6a9aaBump version to 0.7.5c55679aFail the connection if a message is larger than the configured max length aft...5b197caClose a draft-75/76 connection if a length header grows to exceed the configu...fc93a48Test on Node v22, v24, and v262e82d34Test on recent versions of Nodee4962dbSwitch from Travis CI to GitHub Actions3f2f9b7Travis update: cache npm modules, remove sudo, run on Node 15Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.