Bump the npm_and_yarn group across 3 directories with 7 updates

[dependabot]

Bumps the npm_and_yarn group with 3 updates in the / directory: ws, qs and shell-quote.
Bumps the npm_and_yarn group with 1 update in the /examples/plotly-viewer directory: protocol-buffers-schema.
Bumps the npm_and_yarn group with 3 updates in the /extension-vscode directory: qs, follow-redirects and tmp.

Updates ws from 8.17.1 to 8.21.0

Release notes

Sourced from ws's releases.

8.21.0

Features

• Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

• Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.

import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(client close - code: ${code} reason: ${reason.toString()});
});
});
wss.on('connection', function (ws) {
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(server close - code: ${code} reason: ${reason.toString()});
});
});

The vulnerability was responsibly disclosed and fixed by Nadav Magier.

In vulnerable versions, the issue can be mitigated by lowering the value of the maxPayload option if possible.

8.20.1

... (truncated)

Commits

• bca91ad [dist] 8.21.0
• 2b2abd4 [security] Limit retained message parts
• 78eabe2 [security] Add latest vulnerability to SECURITY.md
• 5d9b316 [dist] 8.20.1
• c0327ec [security] Fix uninitialized memory disclosure in websocket.close()
• ce2a3d6 [ci] Test on node 26
• 58e45b8 [ci] Do not test on node 25
• 5f26c24 [ci] Run the lint step on node 24
• 8439255 [dist] 8.20.0
• d3503c1 [minor] Export the PerMessageDeflate class and header utils
• Additional commits viewable in compare view

Updates qs from 6.15.0 to 6.15.3

Changelog

Sourced from qs's changelog.

6.15.3

• [Fix] parse: enforce throwOnLimitExceeded for cumulative array growth via combine/merge
• [Fix] utils: respect encoding of surrogate pairs across chunks (#559)
• [Robustness] parse: throw the arrayLimit error before splitting oversized comma values
• [Robustness] utils.merge / utils.assign: avoid invoking __proto__ setter when copying own properties
• [Robustness] utils: enforce arrayLimit consistently across merge's array paths
• [Perf] utils: make compact O(n) via a side-channel visited-set instead of Array.indexOf
• [Deps] update side-channel
• [Dev Deps] update eslint, mock-property, tape
• [Tests] parse: characterize current lenient handling of unbalanced bracket keys (#558)

6.15.2

• [Fix] stringify: skip null/undefined entries in arrayFormat: 'comma' + encodeValuesOnly instead of crashing in encoder
• [Fix] stringify: use configured delimiter after charsetSentinel (#555)
• [Fix] stringify: apply formatter to encoded key under strictNullHandling (#554)
• [Fix] stringify: skip null/undefined filter-array entries instead of crashing in encoder (#551)
• [Fix] parse: handle nested bracket groups and add regression tests (#530)
• [readme] fix grammar (#550)
• [Dev Deps] update @ljharb/eslint-config
• [Tests] add regression tests for keys containing percent-encoded bracket text

6.15.1

• [Fix] parse: parameterLimit: Infinity with throwOnLimitExceeded: true silently drops all parameters
• [Deps] update @ljharb/eslint-config
• [Dev Deps] update @ljharb/eslint-config, iconv-lite
• [Tests] increase coverage

Commits

• 18d085e v6.15.3
• c38af42 [Deps] update side-channel
• adce539 [Dev Deps] update eslint, mock-property, tape
• 74a0f6a [Robustness] utils: enforce arrayLimit consistently across merge's arra...
• f4938f5 [Tests] parse: characterize current lenient handling of unbalanced bracket ...
• 5d5f723 [Perf] utils: make compact O(n) via a side-channel visited-set instead of...
• 52afe00 [Robustness] parse: throw the arrayLimit error before splitting oversized...
• 963e538 [Fix] parse: enforce throwOnLimitExceeded for cumulative array growth via...
• 59da434 [Fix] utils: respect encoding of surrogate pairs across chunks
• 9532969 [Robustness] utils.merge / utils.assign: avoid invoking __proto__ sette...
• Additional commits viewable in compare view

Updates shell-quote from 1.8.1 to 1.9.0

Changelog

Sourced from shell-quote's changelog.

v1.9.0 - 2026-06-24

Commits

• [New] add types dca6e21
• [Dev Deps] update eslint 9aa9e8f
• [Fix] parse: finalize tokens in linear time (GHSA-395f-4hp3-45gv) 7ff5488
• [actions] update workflows 75e8497
• [actions] Windows + node 4/6/7: pin eslint to 9 before install, since npm 2/3 cannot stage eslint 10@types/esrecurse 3fb739d
• [actions] retry npm install on Windows to survive npm 2/3 staging-rename flake abe0163
• [actions] Windows + node 5/7: install deps with a modern node b4bafa2
• [Fix] quote: escape leading ~ to prevent shell tilde-expansion 7a76c1a
• [Dev Deps] update auto-changelog, tape 7184b44
• [Dev Deps] apparently jackspeak is no longer in the graph 9ba368a

v1.8.4 - 2026-05-22

Commits

• [Fix] quote: validate object-token shapes 4378a6e
• [Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint, npmignore 22ebec0
• [Tests] increase coverage 9f3caa3
• [readme] replace runkit CI badge with shields.io check-runs badge 3344a04
• [Dev Deps] update @ljharb/eslint-config 699c511

v1.8.3 - 2025-06-01

Fixed

• [Fix] remove unnecessary backslash escaping in single quotes [#15](https://github.com/ljharb/shell-quote/issues/15)

v1.8.2 - 2024-11-27

Fixed

• [Fix] quote: preserve empty strings [#18](https://github.com/ljharb/shell-quote/issues/18)

Commits

• [meta] fix changelog tags 0fb9fd8
• [actions] split out node 10-20, and 20+ 819bd84
• [Dev Deps] update @ljharb/eslint-config, auto-changelog, npmignore, tape fc56408
• [actions] update npm for windows tests fdeb0fd
• [Dev Deps] update @ljharb/eslint-config, aud, tape b8a4a3b
• [actions] prevent node 14 on ARM mac from failing 9eecafc
• [meta] exclude more files from the package 4044e7f
• [Tests] replace aud with npm audit 8cfdbd8
• [meta] add missing engines.node 843820e
• [Dev Deps] add missing peer dep 4c3b88d
• [Dev Deps] pin jackspeak since 2.1.2+ depends on npm aliases, which kill the install process in npm < 6 80322ed

Commits

• db09fc7 v1.9.0
• 7ff5488 [Fix] parse: finalize tokens in linear time (GHSA-395f-4hp3-45gv)
• b4bafa2 [actions] Windows + node 5/7: install deps with a modern node
• 3fb739d [actions] Windows + node 4/6/7: pin eslint to 9 before install, since npm 2/3...
• abe0163 [actions] retry npm install on Windows to survive npm 2/3 staging-rename flake
• 7a76c1a [Fix] quote: escape leading ~ to prevent shell tilde-expansion
• 75e8497 [actions] update workflows
• dca6e21 [New] add types
• 9aa9e8f [Dev Deps] update eslint
• 9ba368a [Dev Deps] apparently jackspeak is no longer in the graph
• Additional commits viewable in compare view

Updates vega-functions from 5.18.1 to 6.1.1

Release notes

Sourced from vega-functions's releases.

v6.1.1

Full Changelog: vega/vega@v6.1.0...v6.1.1

v6.1.0

What's Changed

• chore: bump cli to v6.0.0 by @​lsh in vega/vega#4043
• fix: update version in specs by @​domoritz in vega/vega#4045
• feat: export schema from vega package by @​domoritz in vega/vega#4046

Full Changelog: vega/vega@v6.0.0...v6.1.0

v6.0.0

changes since v5.33.0

monorepo

• Vega is now ESM only! (via #4018) (Thanks @​domoritz!)
• (fix) Correct browser export syntax (via #4039) (Thanks @​domoritz!)
• (fix) Fix source maps (via #4041) (Thanks @​domoritz!)
• (fix) handle string datetime in interpreter (via #4042) (Thanks @​domoritz!)

vega-typings

• Expose resetSVGDefIds (via #4012) (Thanks @​domoritz!)

docs

• Update deps and datasets (via #4036) (Thanks @​domoritz!)

v5.33.1

What's Changed

Fixes GHSA-7f2v-3qq3-vvjf for v5 releases

• fix: improve expressions by @​markov00 in vega/vega#4147
• chore(build): remove schema publish from long term support branch by @​hydrosquall in vega/vega#4154
• build: bump lockfile for 5.33.1 release by @​hydrosquall in vega/vega#4158

Full Changelog: vega/vega@v5.33.0...v5.33.1

v5.33.0

Changes since v5.32.0

docs

• Add release number to docs for base64 encode/decode (atob, btoa) (via #4023). (Thanks @​hydrosquall!)
• Fix docs for exponential regression (via #4024). (Thanks @​elliot-at-looker!)

v5.32.0

Changes since v5.31.0

... (truncated)

Commits

• See full diff in compare view

Updates protocol-buffers-schema from 3.6.0 to 3.6.1

Commits

• 46c34bd 3.6.1
• 2351031 Fixed parse.js to prevent Prototype Pollution (#70)
• See full diff in compare view

Updates qs from 6.15.0 to 6.15.3

Changelog

Sourced from qs's changelog.

6.15.3

• [Fix] parse: enforce throwOnLimitExceeded for cumulative array growth via combine/merge
• [Fix] utils: respect encoding of surrogate pairs across chunks (#559)
• [Robustness] parse: throw the arrayLimit error before splitting oversized comma values
• [Robustness] utils.merge / utils.assign: avoid invoking __proto__ setter when copying own properties
• [Robustness] utils: enforce arrayLimit consistently across merge's array paths
• [Perf] utils: make compact O(n) via a side-channel visited-set instead of Array.indexOf
• [Deps] update side-channel
• [Dev Deps] update eslint, mock-property, tape
• [Tests] parse: characterize current lenient handling of unbalanced bracket keys (#558)

6.15.2

• [Fix] stringify: skip null/undefined entries in arrayFormat: 'comma' + encodeValuesOnly instead of crashing in encoder
• [Fix] stringify: use configured delimiter after charsetSentinel (#555)
• [Fix] stringify: apply formatter to encoded key under strictNullHandling (#554)
• [Fix] stringify: skip null/undefined filter-array entries instead of crashing in encoder (#551)
• [Fix] parse: handle nested bracket groups and add regression tests (#530)
• [readme] fix grammar (#550)
• [Dev Deps] update @ljharb/eslint-config
• [Tests] add regression tests for keys containing percent-encoded bracket text

6.15.1

• [Fix] parse: parameterLimit: Infinity with throwOnLimitExceeded: true silently drops all parameters
• [Deps] update @ljharb/eslint-config
• [Dev Deps] update @ljharb/eslint-config, iconv-lite
• [Tests] increase coverage

Commits

• 18d085e v6.15.3
• c38af42 [Deps] update side-channel
• adce539 [Dev Deps] update eslint, mock-property, tape
• 74a0f6a [Robustness] utils: enforce arrayLimit consistently across merge's arra...
• f4938f5 [Tests] parse: characterize current lenient handling of unbalanced bracket ...
• 5d5f723 [Perf] utils: make compact O(n) via a side-channel visited-set instead of...
• 52afe00 [Robustness] parse: throw the arrayLimit error before splitting oversized...
• 963e538 [Fix] parse: enforce throwOnLimitExceeded for cumulative array growth via...
• 59da434 [Fix] utils: respect encoding of surrogate pairs across chunks
• 9532969 [Robustness] utils.merge / utils.assign: avoid invoking __proto__ sette...
• Additional commits viewable in compare view

Updates follow-redirects from 1.15.5 to 1.16.0

Commits

• 0c23a22 Release version 1.16.0 of the npm package.
• 844c4d3 Add sensitiveHeaders option.
• 5e8b8d0 ci: add Node.js 24.x to the CI matrix
• 7953e22 ci: upgrade GitHub Actions to use setup-node@v6 and checkout@v6
• 86dc1f8 Sanitizing input.
• 21ef28a Release version 1.15.11 of the npm package.
• 7c88135 Roll back tree shaking.
• 6e389ba Release version 1.15.10 of the npm package.
• 5bc496e Shake me up before you go-go.
• 694d6b4 Bump minimist from 1.2.5 to 1.2.8
• Additional commits viewable in compare view

Updates tmp from 0.2.5 to 0.2.7

Commits

• 8ea1f37 Bump up the version
• 8f24f78 Merge commit from fork
• ce787f3 Reject non-string prefix, postfix, template
• 41f7159 Bump up the version
• efa4a06 Merge commit from fork
• 7ef2728 Check for relative values
• See full diff in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.