chore(deps): bump the npm_and_yarn group across 1 directory with 7 updates by dependabot[bot] · Pull Request #274 · graphile/migrate

dependabot · 2026-10-14T18:53:05Z

Bumps the npm_and_yarn group with 7 updates in the / directory:

Package	From	To
@babel/core	`7.23.7`	`7.29.7`
browserslist	`4.22.2`	`4.29.3`
handlebars	`4.7.9`	`4.7.10`
js-yaml	`3.14.1`	`3.15.2`
shell-quote	`1.10.0`	`1.12.0`
source-map-js	`1.0.2`	`1.2.2`
undici	`8.10.1`	`8.11.2`

Updates @babel/core from 7.23.7 to 7.29.7

Release notes

Sourced from @babel/core's releases.

v7.29.7 (2026-05-25)

Re-release all packages with npm provenance attestations

v7.29.6 (2026-05-25)

🐛 Bug Fix

babel-generator

#18014 Catchup source map position in preserveFormat (@nicolo-ribaudo)

babel-core

#18001 [7.x packport]Improve input source map handling (@JLHwung)

babel-core, babel-generator

#17998 Preserve original identifier names from input sourcemaps (#17992) (@Andarist)

Committers: 3

Huáng Jùnliàng (@JLHwung)

Mateusz Burzyński (@Andarist)

Nicolò Ribaudo (@nicolo-ribaudo)

v7.29.5 (2026-05-05)

🏠 Internal

babel-preset-env

Update @babel/* dependencies

v7.29.4 (2026-05-05)

🐛 Bug Fix

babel-plugin-transform-modules-systemjs

#17974 [7.x backport]fix(systemjs): improve module string name support (@JLHwung)

Committers: 1

Huáng Jùnliàng (@JLHwung)

v7.29.3 (2026-04-30)

👓 Spec Compliance

babel-parser

#17923 Support flow extends bound (@JLHwung)

🐛 Bug Fix

babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators

#17931 fix(decorators): replace super within all removed static elements (@JLHwung)

babel-register

#17915 Fix thread synchronization issues in @babel/register (@liuxingbaoyu)

babel-compat-data, babel-plugin-bugfix-safari-rest-destructuring-rhs-array, babel-preset-env

#17788 Add bugfix plugin for Safari array rest destructuring bug (@JLHwung)

💅 Polish

babel-parser

... (truncated)

Commits

4fba754 v7.29.7
04ea6b2 v7.29.6
99f498a [7.x packport]Improve input source map handling (#18001)
feba0a3 Preserve original identifier names from input sourcemaps (#17992) (#17998)
aa8394e v7.29.0
ad0d03f [7.x backport] feat: Allow specifying startLine in code frame (#17739)
d7f4008 v7.28.6
e130225 Polish(standalone): improve message on invalid preset/plugin (#17606)
99dcba5 chore: enable some ts-eslint rules (#17592)
c92c491 Improve Unicode handling in code-frame tokenizer (#17589)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @babel/core since your current version.

Updates browserslist from 4.22.2 to 4.29.3

Release notes

Sourced from browserslist's releases.

4.29.3

Updated Firefox ESR.

4.29.2

Fixed ignoring null usage in cover X in Y query (by @wahidrizka).

4.29.1

Fixed config name loading protection on Windows (by @oss-security-shop).

Fixed case-insensitive negation queries (by @jakezwang).

Fixed percentage and supports queries case-insensitive (by @wahidrizka).

Fixed old Node.js tests (by @aaron-belenky).

Reduced code (by @charmander).

4.29.0

Added query continuations across lines and array entries (by @fzlzjerry).

4.28.9

Improve or parsing performance (by @NotAFlightRisk).

4.28.8

Fixed including kaios in baseline queries (by @Jaybhade).

4.28.7

Improved parsing performance.

Fixed unbounded memory growth (by @alanturing881).

Fixed prototype write issue (by @alanturing881).

4.28.6

Fixed Electron version queries (by @spokodev).

4.28.5

Fixed > and >= queries (by @spokodev).

4.28.4

Fixed SyntaxError regression of 4.28.3.

4.28.3

Fixed baseline query case-insensitivity (by @swwind).

4.28.2

Fix prototype pollution (by @chluo1997).

4.28.1

Removed Baseline warning since we have it own warning.

4.27.0

Added BROWSERSLIST_TRACE_WARNING environment variable.

4.26.3

Fixed throwOnMissing with extends query (by @alexander-akait).

... (truncated)

Changelog

Sourced from browserslist's changelog.

4.29.3

Updated Firefox ESR.

4.29.2

Fixed ignoring null usage in cover X in Y query (by @wahidrizka).

4.29.1

Fixed config name loading protection on Windows (by @oss-security-shop).

Fixed case-insensitive negation queries (by @jakezwang).

Fixed percentage and supports queries case-insensitive (by @wahidrizka).

Fixed old Node.js tests (by @aaron-belenky).

Reduced code (by @charmander).

4.29.0

Added query continuations across lines and array entries (by @fzlzjerry).

4.28.9

Improved or parsing performance (by @NotAFlightRisk).

4.28.8

Fixed including kaios in baseline queries (by @Jaybhade).

4.28.7

Improved parsing performance.

Fixed unbounded memory growth (by @alanturing881).

Fixed prototype write issue (by @alanturing881).

4.28.6

Fixed Electron version queries (by @spokodev).

4.28.5

Fixed > and >= queries (by @spokodev).

4.28.4

Fixed SyntaxError regression of 4.28.3.

4.28.3

Fixed baseline query case-insensitivity (by @swwind).

... (truncated)

Commits

b4809dd Release 4.29.3 version
9d844f8 Update Firefox ESR
0033f34 Update dependencies
906d329 Release 4.29.2 version
ff8c83f Update dependencies
067f4a1 Merge pull request #952 from wahidrizka/fix-cover-null-usage
f760921 Do not add versions without usage data to cover queries
5be63f5 Merge pull request #953 from wahidrizka/docs-android-latest-version
1e5356f Note that Android version queries return only the latest version
5b7e941 Add missed changes to ChangeLog
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for browserslist since your current version.

Updates handlebars from 4.7.9 to 4.7.10

Release notes

Sourced from handlebars's releases.

v4.7.10

security: Sanitize the source map URL when minifying - f37c599

security: Iterate lazily in #each and strip whitespace in linear time - 812c226

security: Escape <!-- and <script in precompiled output - 609d1b1 GHSA-xw65-4hp5-5hc7

security: Don't trust special properties on context data - ceec388 GHSA-p8wg-vrv2-v86f

security: Only compile partials that are template strings - c28ee7a

security: Only dispatch known node types in the Compiler and Visitor - 7d501a5

security: Validate AST values in the compiler instead of the parser - 703fdcc GHSA-8r5x-fm3f-whwj

Clarify that --root does not restrict filesystem access - 0fcf25c

Bump minimist to ^1.2.8 - ea8ed82

Fix Ruby component publishing documentation - d069c1c

Fix Composer component definition - 6714e07

Compatibility notes:

{{#each}} iterates iterables such as Map, Set and generators lazily, like for...of, instead of copying them into an array first. Values added to the iterable while the block renders are now visited too.

Commits

Changelog

Sourced from handlebars's changelog.

v4.7.10 - October 5th, 2026

security: Sanitize the source map URL when minifying - f37c599

security: Iterate lazily in #each and strip whitespace in linear time - 812c226

security: Escape <!-- and <script in precompiled output - 609d1b1 GHSA-xw65-4hp5-5hc7

security: Don't trust special properties on context data - ceec388 GHSA-p8wg-vrv2-v86f

security: Only compile partials that are template strings - c28ee7a

security: Only dispatch known node types in the Compiler and Visitor - 7d501a5

security: Validate AST values in the compiler instead of the parser - 703fdcc GHSA-8r5x-fm3f-whwj

Clarify that --root does not restrict filesystem access - 0fcf25c

Bump minimist to ^1.2.8 - ea8ed82

Fix Ruby component publishing documentation - d069c1c

Fix Composer component definition - 6714e07

Compatibility notes:

{{#each}} iterates iterables such as Map, Set and generators lazily, like for...of, instead of copying them into an array first. Values added to the iterable while the block renders are now visited too.

Commits

Commits

45ce152 v4.7.10
e47b236 Update release notes
f37c599 Sanitize the source map URL when minifying
812c226 Iterate lazily in #each and strip whitespace in linear time
609d1b1 Escape <!-- and <script in precompiled output
ceec388 Don't trust special properties on context data
c28ee7a Only compile partials that are template strings
7d501a5 Only dispatch known node types in the Compiler and Visitor
703fdcc Validate AST values in the compiler instead of the parser
0fcf25c Clarify that --root does not restrict filesystem access
Additional commits viewable in compare view

Updates js-yaml from 3.14.1 to 3.15.2

Changelog

Sourced from js-yaml's changelog.

3.15.2 - 2026-08-26

Changed

[backport] Hard-limit merge sequence size to 100.

Security

[backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

3.15.1 - 2026-07-31

Security

[backport] Remove quadratic complexity from !!omap duplicate key detection.

3.15.0 - 2026-06-27

Added

Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one safeLoad() / safeLoadAll() call.

[3.14.2] - 2025-11-15

Security

Fix prototype pollution in merge (<<).

Commits

5c45bd6 3.15.2 released
5a708f9 dist rebuild
3485bc0 Backport merge limits from v5.4.1
f34812f Update .gitignore
ab85ae2 3.15.1 released
30a5e76 dist rebuild
22a8071 Backport quadratic complexity fix for !!omap
c34b6c4 3.15.0 released
21e13d3 dist rebuild
4165c62 Add v3-legacy tag for publish
Additional commits viewable in compare view

Updates shell-quote from 1.10.0 to 1.12.0

Changelog

Sourced from shell-quote's changelog.

v1.12.0 - 2026-10-02

Fixed

[New] parse: support here-documents (<<) [#31](https://github.com/ljharb/shell-quote/issues/31)

Commits

[New] parse: support tab-stripping here-documents (<<-) dbfac37

[New] parse: support output process substitution (>() 2053315

[New] parse: support the case test-next terminator (;;&) 7d688b9

[New] parse: support the case fall-through terminator (;&) f27010e

[New] parse: support redirecting output despite noclobber (>|) b78d19c

[New] parse: support opening a file for reading and writing (<>) 21cc333

[New] parse: support redirecting stdout and stderr (&>) 6ad6cd2

[New] parse: support appending stdout and stderr (&>>) 90cde9c

[Dev Deps] update @ljharb/eslint-config 3a7b4ae

v1.11.0 - 2026-09-29

Fixed

[Refactor] quote: drop a replace that can never match in the single-quote branch [#15](https://github.com/ljharb/shell-quote/issues/15)

[New] parse: support bash ANSI-C quoting ($'...') [#32](https://github.com/ljharb/shell-quote/issues/32)

Commits

[Fix] quote: reject line terminators in tokens after a comment 6002b2e

[Fix] parse: preserve text after special shell parameters 81b08a5

[Fix] parse: an escaped backslash does not escape the character after it d708019

[Fix] quote: preserve ! in arguments that also contain ' ad39927

[Fix] parse: treat $_name as a variable name, not $_ followed by text 28f88cd

[Fix] quote: preserve empty glob patterns 35c9b97

[Fix] quote: escape ~ in glob patterns to prevent shell tilde-expansion 239d49c

[Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint, evalmd b1e406e

[meta] npmignore some files ebfc308

[actions] add permissions 3429b0d

[actions] set least-privilege cache-mode 36f2394

[Dev Deps] update eslint 6de9a41

Commits

6ecb8aa v1.12.0
3a7b4ae [Dev Deps] update @ljharb/eslint-config
7d688b9 [New] parse: support the case test-next terminator (;;&)
f27010e [New] parse: support the case fall-through terminator (;&)
90cde9c [New] parse: support appending stdout and stderr (&>>)
6ad6cd2 [New] parse: support redirecting stdout and stderr (&>)
2053315 [New] parse: support output process substitution (>()
b78d19c [New] parse: support redirecting output despite noclobber (>|)
21cc333 [New] parse: support opening a file for reading and writing (\<>)
dbfac37 [New] parse: support tab-stripping here-documents (<<-)
Additional commits viewable in compare view

Updates source-map-js from 1.0.2 to 1.2.2

Release notes

Sourced from source-map-js's releases.

v1.2.2

Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval (#29) @xfournet

Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)

Reported by @waydeshi in #76. A fix was also proposed by @aniebiet in #78.

v1.2.1

Fix TS2306 “not a module” errors in type definitions (#16) @andersk

Ensure null source is respected (#26) @dragomirtitian

Improve ts declarations to be null-safe (#27) @dragomirtitian

v1.2.0

Allow to pass options to SourceMapGenerator using SourceMapGenerator.fromSourceMap as second argument
var generator = sourceMap.SourceMapGenerator.fromSourceMap(new SourceMapConsumer(), {
  ignoreInvalidMapping: true,
});
Add generator options to fromSourceMap (#22) @ai

v1.1.0

Add ignoreInvalidMapping option to SourceMapGenerator. If enabled, source-map-js will not throw an error on the incorrect previous source map. Instead, it will print warnings and ignore broken mappings.
var generator = new sourceMap.SourceMapGenerator({
  file: "my-generated-javascript-file.js",
  sourceRoot: "http://example.com/app/js/",
  ignoreInvalidMapping: true,
});
Do not throw an error since broken prev map is popular issue #20 (#20) @ai

Add ignoreInvalidMapping option (#21) @7rulnik

v1.0.3

Use sourceContents when non-null, even if it's an empty string (#17) @bshepherdson

Changelog

Sourced from source-map-js's changelog.

1.2.2

Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval (#29) @xfournet

Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)

Reported by @waydeshi in #76. A fix was also proposed by @aniebiet in #78.

1.2.1

Fix TS2306 “not a module” errors in type definitions (#16) @andersk

Ensure null source is respected (#26) @dragomirtitian

Improve ts declarations to be null-safe (#27) @dragomirtitian

1.2.0

Allow to pass options to SourceMapGenerator using SourceMapGenerator.fromSourceMap as second argument
var generator = sourceMap.SourceMapGenerator.fromSourceMap(new SourceMapConsumer(), {
  ignoreInvalidMapping: true,
});
Add generator options to fromSourceMap (#22) @ai

1.1.0

Add ignoreInvalidMapping option to SourceMapGenerator. If enabled, source-map-js will not throw an error on the incorrect previous source map. Instead, it will print warnings and ignore broken mappings.
var generator = new sourceMap.SourceMapGenerator({
  file: "my-generated-javascript-file.js",
  sourceRoot: "http://example.com/app/js/",
  ignoreInvalidMapping: true,
});
Do not throw an error since broken prev map is popular issue (#20) @ai

Add ignoreInvalidMapping option (#21) @7rulnik

1.0.3

Use sourceContents when non-null, even if it's an empty string (#17) @bshepherdson

Commits

0a1d334 1.2.2
4c6fa26 Update changelog
cf76580 Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)
7899a86 Fix crash when executing browser with CSP script-src that don't permit unsafe...
428d49f 1.2.1
c8b2f0b Update changelog
bd538e4 Improve ts declarations (#27)
0f58a3f Ensure null source is respected. (#26)
9403576 Fix TS2306 “not a module” errors in type definitions (#16)
9b69fab 1.2.0
Additional commits viewable in compare view

Updates undici from 8.10.1 to 8.11.2

Release notes

Sourced from undici's releases.

v8.11.2

What's Changed

fix: close rejected HTTP/2 WebSocket handshake streams by @mcollina in nodejs/undici#5873

fix: avoid reconnecting aborted requests by @Junaid-PK in nodejs/undici#5846

New Contributors

@Junaid-PK made their first contribution in nodejs/undici#5846

Full Changelog: nodejs/undici@v8.11.1...v8.11.2

v8.11.1

What's Changed

deslopify websocket test by @KhafraDev in nodejs/undici#5851

Revert "fix: preserve HTTP/2 for legacy fetch consumers" by @mcollina in nodejs/undici#5860

fix websocketstream bugs by @KhafraDev in nodejs/undici#5863

fix hang on 3xx response with large body by @KhafraDev in nodejs/undici#5850

docs: warn about buffering response bodies by @mcollina in nodejs/undici#5872

test: cover native fetch gzip decoding through the legacy bridge by @mcollina in nodejs/undici#5874

Full Changelog: nodejs/undici@v8.11.0...v8.11.1

v8.11.0

What's Changed

fix: complete upgrade diagnostics lifecycle by @BridgeAR in nodejs/undici#5761

build(deps): bump step-security/harden-runner from 2.19.4 to 2.21.0 by @dependabot[bot] in nodejs/undici#5753

fix(decompress): join a repeated content-encoding header by @luantaraschi in nodejs/undici#5664

fix(cookies): keep a cookie named proto in getCookies by @luantaraschi in nodejs/undici#5663

build(deps-dev): bump jest from 30.5.0 to 30.5.1 by @dependabot[bot] in nodejs/undici#5784

build(deps): bump got from 15.1.0 to 16.0.0 in /benchmarks by @dependabot[bot] in nodejs/undici#5785

fix: selectively re-enable SIMD for ppc64 by @richardlau in nodejs/undici#5776

use private fields for brand checks by @KhafraDev in nodejs/undici#5792

fix(h2): do not unref a session with open streams by @kjsik11 in nodejs/undici#5782

fix(h2): avoid pool fan-out during ALPN negotiation by @mcollina in nodejs/undici#5799

fix issue #5715 by @KhafraDev in nodejs/undici#5805

ci: extend macOS Node.js workflow timeout by @mcollina in nodejs/undici#5775

fix(env-http-proxy-agent): NO_PROXY wildcard semantics by @mcollina in nodejs/undici#5777

fix(h2): do not replay a request whose response already started after GOAWAY by @kjsik11 in nodejs/undici#5788

test: skip HTTP/2 churn test on Node.js 25 on all platforms by @kjsik11 in nodejs/undici#5790

fix(proxy-agent): preserve repeated iterable headers by @GiHoon1123 in nodejs/undici#5779

docs(errors): document ProxyConnectionError (UND_ERR_PRX_CONN) by @kilisamemarisaaa in nodejs/undici#5781

dataurl parsing improvements + update WPT by @KhafraDev in nodejs/undici#5812

fix(decompress): treat inherited Object.prototype names as unsupported encodings by @NgoQuocViet2001 in nodejs/undici#5807

test(h2): stabilize http2-connection by @ViniciusDev26 in nodejs/undici#5801

fix: preserve HTTP/2 for non-upgrade legacy requests by @mcollina in nodejs/undici#5811

fix: skip drain dispatch for clientTtl-evicted clients in PoolBase by @vwong in nodejs/undici#5677

chore: update tests blocking release by @vwong in nodejs/undici#5828

build(deps): bump uWebSockets.js from v20.68.0 to v20.70.0 in /benchmarks by @dependabot[bot] in nodejs/undici#5824

fix(deduplicate): settle requests when composed with retry by @mcollina in nodejs/undici#5817

fix(cache): do not report aborted on successful cache hits by @Yahiro025 in nodejs/undici#5819

... (truncated)

Commits

7e016ad Bumped v8.11.2 (#5886)
fcdd5a6 fix: skip reconnecting for aborted requests (#5846)
dd28c5c fix: close rejected HTTP/2 WebSocket handshake streams (#5873)
5e0a2f8 Bumped v8.11.1 (#5871)
2b72898 test: cover native fetch gzip decoding through the legacy bridge (#5874)
636bf51 docs: warn about buffering response bodies (#5872)
8145595 fix hang on 3xx response with large body (#5850)
f3cbe48 fix websocketstream bugs (#5863)
1d4ea0a Revert "fix: preserve HTTP/2 for legacy fetch consumers" (#5860)
77d7b3f deslopify websocket test (#5851)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

…dates Bumps the npm_and_yarn group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) | `7.23.7` | `7.29.7` | | [browserslist](https://github.com/browserslist/browserslist) | `4.22.2` | `4.29.3` | | [handlebars](https://github.com/handlebars-lang/handlebars.js) | `4.7.9` | `4.7.10` | | [js-yaml](https://github.com/nodeca/js-yaml) | `3.14.1` | `3.15.2` | | [shell-quote](https://github.com/ljharb/shell-quote) | `1.10.0` | `1.12.0` | | [source-map-js](https://github.com/7rulnik/source-map-js) | `1.0.2` | `1.2.2` | | [undici](https://github.com/nodejs/undici) | `8.10.1` | `8.11.2` | Updates `@babel/core` from 7.23.7 to 7.29.7 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.7/packages/babel-core) Updates `browserslist` from 4.22.2 to 4.29.3 - [Release notes](https://github.com/browserslist/browserslist/releases) - [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md) - [Commits](browserslist/browserslist@4.22.2...4.29.3) Updates `handlebars` from 4.7.9 to 4.7.10 - [Release notes](https://github.com/handlebars-lang/handlebars.js/releases) - [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/v4.7.10/release-notes.md) - [Commits](handlebars-lang/handlebars.js@v4.7.9...v4.7.10) Updates `js-yaml` from 3.14.1 to 3.15.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/3.15.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.14.1...3.15.2) Updates `shell-quote` from 1.10.0 to 1.12.0 - [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md) - [Commits](ljharb/shell-quote@v1.10.0...v1.12.0) Updates `source-map-js` from 1.0.2 to 1.2.2 - [Release notes](https://github.com/7rulnik/source-map-js/releases) - [Changelog](https://github.com/7rulnik/source-map-js/blob/main/CHANGELOG.md) - [Commits](7rulnik/source-map-js@v1.0.2...v1.2.2) Updates `undici` from 8.10.1 to 8.11.2 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v8.10.1...v8.11.2) --- updated-dependencies: - dependency-name: "@babel/core" dependency-version: 7.29.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: browserslist dependency-version: 4.29.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: handlebars dependency-version: 4.7.10 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 3.15.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: shell-quote dependency-version: 1.12.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: source-map-js dependency-version: 1.2.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 8.11.2 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 14, 2026

yarn dedupe

2b216a1

benjie merged commit 33ffc29 into main Oct 14, 2026
16 checks passed

dependabot Bot deleted the dependabot/npm_and_yarn/npm_and_yarn-665037f95d branch October 14, 2026 19:22

Navigation Menu

Repository navigation

chore(deps): bump the npm_and_yarn group across 1 directory with 7 updates - #274

chore(deps): bump the npm_and_yarn group across 1 directory with 7 updates#274
benjie merged 2 commits into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-665037f95d

dependabot Bot commented on behalf of github Oct 14, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 14, 2026

v7.29.7 (2026-05-25)

v7.29.6 (2026-05-25)

🐛 Bug Fix

Committers: 3

v7.29.5 (2026-05-05)

🏠 Internal

v7.29.4 (2026-05-05)

🐛 Bug Fix

Committers: 1

v7.29.3 (2026-04-30)

👓 Spec Compliance

🐛 Bug Fix

💅 Polish

4.29.3

4.29.2

4.29.1

4.29.0

4.28.9

4.28.8

4.28.7

4.28.6

4.28.5

4.28.4

4.28.3

4.28.2

4.28.1

4.27.0

4.26.3

4.29.3

4.29.2

4.29.1

4.29.0

4.28.9

4.28.8

4.28.7

4.28.6

4.28.5

4.28.4

4.28.3

v4.7.10

v4.7.10 - October 5th, 2026

3.15.2 - 2026-08-26

Changed

Security

3.15.1 - 2026-07-31

Security

3.15.0 - 2026-06-27

Added

[3.14.2] - 2025-11-15

Security

v1.12.0 - 2026-10-02

Fixed

Commits

v1.11.0 - 2026-09-29

Fixed

Commits

v1.2.2

v1.2.1

v1.2.0

v1.1.0

v1.0.3

1.2.2

1.2.1

1.2.0

1.1.0

1.0.3

v8.11.2

What's Changed

New Contributors

v8.11.1

What's Changed

v8.11.0

What's Changed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels