Bump the npm_and_yarn group across 5 directories with 10 updates by dependabot[bot] · Pull Request #320 · sderickson/saflib

dependabot · 2026-06-23T18:47:49Z

Bumps the npm_and_yarn group with 5 updates in the / directory:

Package	From	To
fast-uri	`3.0.6`	`3.1.2`
js-cookie	`3.0.5`	`3.0.8`
js-yaml	`4.1.1`	`4.2.0`
markdown-it	`14.1.1`	`14.2.0`
protobufjs	`7.5.5`	`7.6.4`

Bumps the npm_and_yarn group with 1 update in the /email/email directory: nodemailer.
Bumps the npm_and_yarn group with 1 update in the /email/email-service directory: nodemailer.
Bumps the npm_and_yarn group with 1 update in the /sentry directory: vite.
Bumps the npm_and_yarn group with 1 update in the /vite directory: vite.

Updates form-data from 2.5.5 to 4.0.5

Changelog

Sourced from form-data's changelog.

v4.0.5 - 2025-11-17

Commits

[Tests] Switch to newer v8 prediction library; enable node 24 testing 16e0076

[Dev Deps] update @ljharb/eslint-config, eslint 5822467

[Fix] set Symbol.toStringTag in the proper place 76d0dee

v4.0.4 - 2025-07-16

Commits

[meta] add auto-changelog 811f682

[Tests] handle predict-v8-randomness failures in node < 17 and node > 23 1d11a76

[Fix] Switch to using crypto random for boundary values 3d17230

[Tests] fix linting errors 5e34080

[meta] actually ensure the readme backup isn’t published 316c82b

[Dev Deps] update @ljharb/eslint-config 58c25d7

[meta] fix readme capitalization 2300ca1

v4.0.3 - 2025-06-05

Fixed

[Fix] append: avoid a crash on nullish values [#577](https://github.com/form-data/form-data/issues/577)

Commits

[eslint] use a shared config 426ba9a

[eslint] fix some spacing issues 2094191

[Refactor] use hasown 81ab41b

[Fix] validate boundary type in setBoundary() method 8d8e469

[Tests] add tests to check the behavior of getBoundary with non-strings 837b8a1

[Dev Deps] remove unused deps 870e4e6

[meta] remove local commit hooks e6e83cc

[Dev Deps] update eslint 4066fd6

[meta] fix scripts to use prepublishOnly c4bbb13

v4.0.2 - 2025-02-14

Merged

[Fix] set Symbol.toStringTag when available [#573](https://github.com/form-data/form-data/issues/573)

[Fix] set Symbol.toStringTag when available [#573](https://github.com/form-data/form-data/issues/573)

fix (npmignore): ignore temporary build files [#532](https://github.com/form-data/form-data/issues/532)

fix (npmignore): ignore temporary build files [#532](https://github.com/form-data/form-data/issues/532)

Fixed

[Fix] set Symbol.toStringTag when available (#573) [#396](https://github.com/form-data/form-data/issues/396)

... (truncated)

Commits

68ff7dd v4.0.5
5822467 [Dev Deps] update @ljharb/eslint-config, eslint
76d0dee [Fix] set Symbol.toStringTag in the proper place
16e0076 [Tests] Switch to newer v8 prediction library; enable node 24 testing
41996f5 v4.0.4
316c82b [meta] actually ensure the readme backup isn’t published
2300ca1 [meta] fix readme capitalization
811f682 [meta] add auto-changelog
5e34080 [Tests] fix linting errors
1d11a76 [Tests] handle predict-v8-randomness failures in node < 17 and node > 23
Additional commits viewable in compare view

Updates postcss from 8.4.49 to 8.5.6

Release notes

Sourced from postcss's releases.

8.5.6

Fixed ContainerWithChildren type discriminating (by @Goodwine).

8.5.5

Fixed package.json→exports compatibility with some tools (by @JounQin).

8.5.4

Fixed Parcel compatibility issue (by @git-sumitchaudhary).

8.5.3

Added more details to Unknown word error (by @hiepxanh).

Fixed types (by @romainmenke).

Fixed docs (by @catnipan).

8.5.2

Fixed end position of rules with semicolon (by @romainmenke).

8.5.1

Fixed backwards compatibility for complex cases (by @romainmenke).

8.5 “Duke Alloces”

PostCSS 8.5 brought API to work better with non-CSS sources like HTML, Vue.js/Svelte sources or CSS-in-JS.

@romainmenke during his work on Stylelint added Input#document in additional to Input#css.
root.source.input.document //=> "<p>Hello</p>
                           //    <style>
                           //    p {
                           //      color: green;
                           //    }
                           //    </style>"
root.source.input.css      //=> "p {
                           //      color: green;
                           //    }"
Thanks to Sponsors

This release was possible thanks to our community.

If your company wants to support the sustainability of front-end infrastructure or wants to give some love to PostCSS, you can join our supporters by:

Tidelift with a Spotify-like subscription model supporting all projects from your lock file.

Direct donations at GitHub Sponsors or Open Collective.

Changelog

Sourced from postcss's changelog.

8.5.6

Fixed ContainerWithChildren type discriminating (by @Goodwine).

8.5.5

Fixed package.json→exports compatibility with some tools (by @JounQin).

8.5.4

Fixed Parcel compatibility issue (by @git-sumitchaudhary).

8.5.3

Added more details to Unknown word error (by @hiepxanh).

Fixed types (by @romainmenke).

Fixed docs (by @catnipan).

8.5.2

Fixed end position of rules with semicolon (by @romainmenke).

8.5.1

Fixed backwards compatibility for complex cases (by @romainmenke).

8.5 “Duke Alloces”

Added Input#document for sources like CSS-in-JS or HTML (by @romainmenke).

Commits

91d6eb5 Release 8.5.6 version
65ffc55 Update dependencies
ecd20eb Fix ContainerWithChildren to allow discriminating the node type by comparing ...
c181597 Release 8.5.5 version
c5523fb Update dependencies
2e3450c refactor: import should be listed before require (#2052)
4d720bd Update EM text
6cb4a66 Release 8.5.4 version
ec5c1e0 Update dependencies
e85e938 Fix code format
Additional commits viewable in compare view

Updates fast-uri from 3.0.6 to 3.1.2

Release notes

Sourced from fast-uri's releases.

v3.1.2

⚠️ Security Release

Fix for GHSA-v39h-62p7-jpjc

What's Changed

Handle malformed fragment decoding as a parse error by @mcollina in fastify/fast-uri#171

Full Changelog: fastify/fast-uri@v3.1.1...v3.1.2

v3.1.1

⚠️ Security Release

Fix for GHSA-q3j6-qgpj-74h6

What's Changed

build(deps-dev): bump tsd from 0.32.0 to 0.33.0 by @dependabot[bot] in fastify/fast-uri#148

build(deps): bump actions/checkout from 4 to 5 by @dependabot[bot] in fastify/fast-uri#149

chore(.npmrc): ignore scripts by @Fdawgs in fastify/fast-uri#150

build(deps-dev): remove @fastify/pre-commit by @Fdawgs in fastify/fast-uri#151

build(deps): bump actions/setup-node from 4 to 5 by @dependabot[bot] in fastify/fast-uri#152

ci(ci): add concurrency config by @Fdawgs in fastify/fast-uri#153

build(deps): bump actions/setup-node from 5 to 6 by @dependabot[bot] in fastify/fast-uri#154

build(deps): bump actions/checkout from 5 to 6 by @dependabot[bot] in fastify/fast-uri#156

chore(license): standardise license notice by @Fdawgs in fastify/fast-uri#159

style: remove trailing whitespace by @Fdawgs in fastify/fast-uri#161

ci: remove unused github files by @Tony133 in fastify/fast-uri#162

chore: update readme by @Tony133 in fastify/fast-uri#164

build(deps): bump fastify/workflows/.github/workflows/plugins-ci-package-manager.yml from 5 to 6 by @dependabot[bot] in fastify/fast-uri#165

build(deps): bump fastify/workflows/.github/workflows/plugins-ci.yml from 5 to 6 by @dependabot[bot] in fastify/fast-uri#166

build(deps-dev): bump neostandard from 0.12.2 to 0.13.0 by @dependabot[bot] in fastify/fast-uri#167

ci: add lock-threads workflow by @Fdawgs in fastify/fast-uri#169

New Contributors

@Tony133 made their first contribution in fastify/fast-uri#162

Full Changelog: fastify/fast-uri@v3.1.0...v3.1.1

v3.1.0

What's Changed

ci: remove master branch support by @Fdawgs in fastify/fast-uri#126

chore(test) remove .gitkeep by @Fdawgs in fastify/fast-uri#128

ci(ci): set job permissions by @Fdawgs in fastify/fast-uri#129

ci: set permissions at workflow level by @Fdawgs in fastify/fast-uri#131

ci: set workflow permissions to read-only by default by @Fdawgs in fastify/fast-uri#132

ci(ci): restore job level permissions by @Fdawgs in fastify/fast-uri#133

build(deps-dev): bump tsd from 0.31.2 to 0.32.0 by @dependabot[bot] in fastify/fast-uri#134

ci(ci): pin actions to commit-hash by @Fdawgs in fastify/fast-uri#135

ci: add node 24 to test matrix by @Fdawgs in fastify/fast-uri#136

... (truncated)

Commits

919dd8e Bumped v3.1.2
c65ba57 fixup: linting
6c86c17 Merge commit from fork
a95158a Handle malformed fragment decoding without throwing (#171)
cea547c Bumped v3.1.1
876ce79 Merge commit from fork
dcdf690 ci: add lock-threads workflow (#169)
c860e65 build(deps-dev): bump neostandard from 0.12.2 to 0.13.0 (#167)
9b4c6dc build(deps): bump fastify/workflows/.github/workflows/plugins-ci.yml (#166)
85d09a9 build(deps): bump fastify/workflows/.github/workflows/plugins-ci-package-mana...
Additional commits viewable in compare view

Updates js-cookie from 3.0.5 to 3.0.8

Release notes

Sourced from js-cookie's releases.

v3.0.8

Restore ES5 compatibility, inadvertently broken in 3.0.7 - #959

Lift Node version restriction, inadvertently restricted to >= 20 in 3.0.7 - #956

v3.0.7

Prevent cookie attribute injection: CVE-2026-46625 (eb3c40e)

Add Partitioned attribute to readme (b994768)

Publish to npm registry via trusted publisher exclusively (4dc71be)

Ensure consistent behaviour for get('name') + get() (1953d30)

Commits

d7a1096 Craft v3.0.8 release
248e685 Use existing Chrome with puppeteer
fc04269 Remove QUnit related workaround in Grunt config
265a685 Tidy up package lock file
478e591 Disable Node deprecation DEP0044 for release workflow
331d524 Fix node version config for E2E test job
11d773d Ensure ECMAScript compatibility
d788646 Remove engines property from package
e7d9a4d Fix typo in test assertion message
b5fca24 Make credentials use explicit in release workflow
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for js-cookie since your current version.

Updates js-yaml from 4.1.1 to 4.2.0

Changelog

Sourced from js-yaml's changelog.

[4.2.0] - 2026-06-01

Added

Added docs/safety.md with notes about processing untrusted YAML.

Added maxDepth (100) loader option. Not a problem, but gives a better exception instead of RangeError on stack overflow.

Added maxMergeSeqLength (20) loader option. Not a problem after merge fix, but an additional restriction for safety.

Added sourcemaps to dist/ builds.

Changed

Stop resolving numbers with underscores as numeric scalars, #627.

Switched dev toolchains to Vite / neostandard.

Updated demo.

Reorganized tests.

dist/ files are no longer kept in the repository.

Fixed

Fix parsing of properties on the first implicit block mapping key, #62.

Fix trailing whitespace handling when folding flow scalar lines, #307.

Reject top-level block scalars without content indentation, #280.

Ensure numbers survive round-trip, #737.

Fix test coverage for issue #221.

Fix flow scalar trailing whitespace folding, #307.

Fix digits in YAML named tag handles.

Security

Fix potential DoS via quadratic complexity in merge - deduplicate repeated elements (makes sense for malformed files > 10K).

[3.14.2] - 2025-11-15

Security

Backported v4.1.1 fix to v3

Commits

590dbab 4.2.0 released
f944dc5 Add package.json funding field
f692719 Changelog update
9971a06 Fix digits in YAML named tag handles
464a5b8 Fix flow scalar trailing whitespace folding, close #307
1fda4f7 Tests for #567, #565
031ad07 Stop resolving numbers with underscores as numeric scalars, #627
e46d223 CI config update
9023fee Add lockfile
990e6f4 Docs update
Additional commits viewable in compare view

Updates undici from 6.24.0 to 7.24.5

Release notes

Sourced from undici's releases.

v7.24.5

What's Changed

Formdata tests by @KhafraDev in nodejs/undici#4902

test: add unexpected disconnect guards to more client test files by @samayer12 in nodejs/undici#4844

fix(cache): only apply 1-year deleteAt for immutable responses by @metalix2 in nodejs/undici#4913

New Contributors

@metalix2 made their first contribution in nodejs/undici#4913

Full Changelog: nodejs/undici@v7.24.4...v7.24.5

v7.24.4

What's Changed

fix(fetch): handle URL credentials in dispatch path extraction by @mcollina in nodejs/undici#4892

Full Changelog: nodejs/undici@v7.24.3...v7.24.4

v7.24.3

What's Changed

fix(h2): TypeError: Cannot read properties of null (reading 'push') i… by @hxinhan in nodejs/undici#4881

Full Changelog: nodejs/undici@v7.24.2...v7.24.3

v7.24.2

What's Changed

fix fetch path logic by @KhafraDev in nodejs/undici#4890

remove maxDecompressedMessageSize by @KhafraDev in nodejs/undici#4891

Full Changelog: nodejs/undici@v7.24.1...v7.24.2

v7.24.1

What's Changed

fix: proto pollution by @rahulyadav5524 in nodejs/undici#4885

Full Changelog: nodejs/undici@v7.24.0...v7.24.1

v7.24.0

Undici v7.24.0 Security Release Notes

This release addresses multiple security vulnerabilities in Undici.

Upgrade guidance

All users on v7 should upgrade to v7.24.0 or later.

Fixed advisories

... (truncated)

Commits

51fd661 Bumped v7.24.5 (#4915)
9077500 fix(cache): only apply 1-year deleteAt for immutable responses (#4913)
1c5dc1a test: add unexpected disconnect guards to more client test files (#4844)
2885361 Formdata tests (#4902)
4991f3e Bumped v7.24.4
ea3a06d fix(fetch): preserve path for credentialed URLs (#4892)
9b96516 Bumped v7.24.3
7926660 Ignore .githuman
9eaa5af fix(h2): TypeError: Cannot read properties of null (reading 'push') in Reques...
a9bfe21 ignore .pi
Additional commits viewable in compare view

Updates markdown-it from 14.1.1 to 14.2.0

Changelog

Sourced from markdown-it's changelog.

[14.2.0] - 2026-05-24

Added

isPunctCharCode to utilities.

Fixed

Don't end HTML comment blocks on a blank line, #1155.

Properly recognize astral chars (surrogates) in delimiter scans for emphasis-like markers, #1072. Big thanks to @tats-u for his global efforts with improving CJK support.

Preserve unicode whitespaces when trimm headings/paragraphs, #1074.

More strict entities decode to avoid false positives ;, #1096.

Restore block parser state on fail in lheading rule, #1131.

Security

Fixed poor smartquotes perfomance on > 70k quotes in single block

Bumped linkify-it to 5.0.1 with fixed potential perfomance issues.

Commits

829797a 14.2.0 released
9ce2087 Fix smartquotes perfomance
02e73b8 linkify-it bump
68cfb8c fix: don't end HTML comment blocks on a blank line (#1155)
1083137 Readme cleanup
97c7ca2 Update funding info
c471b55 Changelog update
7769621 isPunctChar => isPunctCharCode
aa2aa70 fix: always reset parentType in lheading rule (#1131)
59955f2 Polish PRs #1072, #1074
Additional commits viewable in compare view

Updates protobufjs from 7.5.5 to 7.6.4

Release notes

Sourced from protobufjs's releases.

protobufjs: v7.6.4

7.6.4 (2026-06-12)

Bug Fixes

Reconfigure and speed up CI (#2329) (574f761)

Remove inquire submodule (#2327) (06ddd07)

protobufjs: v7.6.3

7.6.3 (2026-06-09)

Bug Fixes

Avoid name collisions in generated code (#2311) (78a9576)

Preserve null conversion behavior for fieldless messages (#2312) (df91652)

protobufjs: v7.6.2

7.6.2 (2026-05-30)

Bug Fixes

Backport consistency and correctness fixes (#2294) (a92f72e)

protobufjs: v7.6.1

7.6.1 (2026-05-22)

Bug Fixes

Backport misc utility hardening (#2280) (8a45c13)

Treat fixed64 as unsigned in converters (#2266) (479dfdc)

protobufjs: v7.6.0

7.6.0 (2026-05-18)

Features

Support BigInt conversions (7.x) (#2258) (f769242)

protobufjs: v7.5.9

7.5.9 (2026-05-17)

Bug Fixes

Backport bundler-safe optional module lookups (#2254) (0853a62)

... (truncated)

Changelog

Sourced from protobufjs's changelog.

7.6.4 (2026-06-12)

Bug Fixes

Reconfigure and speed up CI (#2329) (574f761)

Remove inquire submodule (#2327) (06ddd07)

7.6.3 (2026-06-09)

Bug Fixes

Avoid name collisions in generated code (#2311) (78a9576)

Preserve null conversion behavior for fieldless messages (#2312) (df91652)

7.6.2 (2026-05-30)

Bug Fixes

Backport consistency and correctness fixes (#2294) (a92f72e)

7.6.1 (2026-05-22)

Bug Fixes

Backport misc utility hardening (#2280) (8a45c13)

Treat fixed64 as unsigned in converters (#2266) (479dfdc)

7.6.0 (2026-05-18)

Features

Support BigInt conversions (7.x) (#2258) (f769242)

7.5.9 (2026-05-17)

Bug Fixes

Backport bundler-safe optional module lookups (#2254) (0853a62)

7.5.8 (2026-05-12)

Bug Fixes

... (truncated)

Commits

f8f64ef chore: release protobufjs-v7.x (#2330)
574f761 fix: Reconfigure and speed up CI (#2329)
06ddd07 fix: Remove inquire submodule (#2327)
1d3796d chore: release protobufjs-v7.x (#2317)
df91652 fix: Preserve null conversion behavior for fieldless messages (#2312)
78a9576 fix: Avoid name collisions in generated code (#2311)
ec90ef9 chore: release protobufjs-v7.x (#2295)
a92f72e fix: Backport consistency and correctness fixes (#2294)
f0b50d2 chore: release protobufjs-v7.x (#2268)
8a45c13 fix: Backport misc utility hardening (#2280)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for protobufjs since your current version.

Updates vite from 5.4.21 to 7.3.1

Release notes

Sourced from vite's releases.

v8.0.16

Please refer to CHANGELOG.md for details.

v8.0.15

Please refer to CHANGELOG.md for details.

v8.0.14

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.0.16 (2026-06-01)

Bug Fixes

deps: reject UNC paths for launch-editor-middleware (#22571) (50b9512)

reject windows alternate paths (#22572) (dc245c7)

8.0.15 (2026-06-01)

Features

send 408 on request timeout (#22476) (c85c9ee)

update rolldown to 1.0.3 (#22538) (646dbed)

Bug Fixes

capitalize error messages and remove spurious space in parse error (#22488) (85a0eff)

deps: update all non-major dependencies (#22511) (2686d7d)

dev: fix html-proxy cache key mismatch for /@fs/ HTML paths (#21762) (47c4213)

glob: error on relative glob in virtual module when no files match (#22497) (5c8e98f)

optimizer: close the rolldown bundle when write() rejects (#22528) (e3cfb9d)

resolve: provide onWarn for viteResolvePlugin in JS plugin containers (#22509) (40985f1)

Miscellaneous Chores

deps: update rolldown-related dependencies (#22566) (3052a67)

Code Refactoring

correct logic in collectAllModules function (#22562) (6978a9c)

8.0.14 (2026-05-21)

Features

update rolldown to 1.0.2 (#22484) (96efc88)

Bug Fixes

deps: update all non-major dependencies (#22471) (98b8163)

dev: handle errors when sending messages to vite server (#22450) (e8e9a34)

html: handle trailing slash paths in transformIndexHtml (#22480) (5d94d1b)

optimizer: pass oxc jsx options to transformSync in dependency scan (#22342) (b3132da)

Miscellaneous Chores

deps: update rolldown-related dependencies (#22470) (7cb728e)

remove irrelevant commits from changelog (2c69495)

Code Refactoring

glob: do not rewrite import path for absolute base (#22310) (0ae2844)

... (truncated)

Commits

f94df87 release: v8.0.16
dc245c7 fix: reject windows alternate paths (#22572)
50b9512 fix(deps): reject UNC paths for launch-editor-middleware (#22571)
8d1b019 release: v8.0.15
2686d7d fix(deps): update all non-major dependencies (#22511)
3052a67 chore(deps): update rolldown-related dependencies (#22566)
e3cfb9d fix(optimizer): close the rolldown bundle when write() rejects (#22528)
6978a9c refactor: correct logic in collectAllModules function (#22562)
646dbed feat: update rolldown to 1.0.3 (#22538)
85a0eff fix: capitalize error messages and remove spurious space in parse error (#22488)
Additional commits viewable in compare view

Updates nodemailer from 8.0.11 to 9.0.1

Release notes

Sourced from nodemailer's releases.

v9.0.1

9.0.1 (2026-06-17)

Bug Fixes

enforce disableFileAccess/disableUrlAccess for raw message option (a82e060)

v9.0.0

9.0.0 (2026-06-14)

⚠ BREAKING CHANGES

HTTPS requests made while fetching remote content (attachment href/path URLs, OAuth2 token endpoints, HTTP/HTTPS proxy CONNECT) now validate the server's TLS certificate by default. Requests to hosts with self-signed, expired, or hostname-mismatched certificates that previously succeeded will now fail. Opt back out per request with tls.rejectUnauthorized=false (transport options, or a per-attachment tls option).

Bug Fixes

replace deprecated url.parse with a WHATWG URL wrapper (0c080fb)

validate TLS certificates by default when fetching remote content (6a947ac)

Changelog

Sourced from nodemailer's changelog.

9.0.1 (2026-06-17)

Bug Fixes

enforce disableFileAccess/disableUrlAccess for raw message option (a82e060)

9.0.0 (2026-06-14)

⚠ BREAKING CHANGES

HTTPS requests made while fetching remote content (attachment href/path URLs, OAuth2 token endpoints, HTTP/HTTPS proxy CONNECT) now validate the server's TLS certificate by default. Requests to hosts with self-signed, expired, or hostname-mismatched certificates that previously succeeded will now fail. Opt back out per request with tls.rejectUnauthorized=false (transport options, or a per-attachment tls option).

Bug Fixes

replace deprecated url.parse with a WHATWG URL wrapper (0c080fb)

validate TLS certificates by default when fetching remote content (6a947ac)

Commits

69cf625 chore(master): release 9.0.1 (#1828)
a82e060 fix: enforce disableFileAccess/disableUrlAccess for raw message option
4e58450 chore: update dev dependencies
541f5fd chore(master): release 9.0.0 (#1827)
0c080fb fix: replace deprecated url.parse with a WHATWG URL wrapper
6a947ac fix!: validate TLS certificates by default when fetching remote content
See full diff in compare view

Updates nodemailer from 8.0.11 to 9.0.1

Release notes

Sourced from nodemailer's releases.

v9.0.1

9.0.1 (2026-06-17)

Bug Fixes

enforce disableFileAccess/disableUrlAccess for raw message option (a82e060)

v9.0.0

Bumps the npm_and_yarn group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [fast-uri](https://github.com/fastify/fast-uri) | `3.0.6` | `3.1.2` | | [js-cookie](https://github.com/js-cookie/js-cookie) | `3.0.5` | `3.0.8` | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.1` | `4.2.0` | | [markdown-it](https://github.com/markdown-it/markdown-it) | `14.1.1` | `14.2.0` | | [protobufjs](https://github.com/protobufjs/protobuf.js) | `7.5.5` | `7.6.4` | Bumps the npm_and_yarn group with 1 update in the /email/email directory: [nodemailer](https://github.com/nodemailer/nodemailer). Bumps the npm_and_yarn group with 1 update in the /email/email-service directory: [nodemailer](https://github.com/nodemailer/nodemailer). Bumps the npm_and_yarn group with 1 update in the /sentry directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). Bumps the npm_and_yarn group with 1 update in the /vite directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). Updates `form-data` from 2.5.5 to 4.0.5 - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v2.5.5...v4.0.5) Updates `postcss` from 8.4.49 to 8.5.6 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.4.49...8.5.6) Updates `fast-uri` from 3.0.6 to 3.1.2 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.0.6...v3.1.2) Updates `js-cookie` from 3.0.5 to 3.0.8 - [Release notes](https://github.com/js-cookie/js-cookie/releases) - [Commits](js-cookie/js-cookie@v3.0.5...v3.0.8) Updates `js-yaml` from 4.1.1 to 4.2.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.1...4.2.0) Updates `undici` from 6.24.0 to 7.24.5 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v6.24.0...v7.24.5) Updates `markdown-it` from 14.1.1 to 14.2.0 - [Changelog](https://github.com/markdown-it/markdown-it/blob/master/CHANGELOG.md) - [Commits](markdown-it/markdown-it@14.1.1...14.2.0) Updates `protobufjs` from 7.5.5 to 7.6.4 - [Release notes](https://github.com/protobufjs/protobuf.js/releases) - [Changelog](https://github.com/protobufjs/protobuf.js/blob/protobufjs-v7.6.4/CHANGELOG.md) - [Commits](protobufjs/protobuf.js@protobufjs-v7.5.5...protobufjs-v7.6.4) Updates `vite` from 5.4.21 to 7.3.1 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.0.16/packages/vite) Updates `nodemailer` from 8.0.11 to 9.0.1 - [Release notes](https://github.com/nodemailer/nodemailer/releases) - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](nodemailer/nodemailer@v8.0.11...v9.0.1) Updates `nodemailer` from 8.0.11 to 9.0.1 - [Release notes](https://github.com/nodemailer/nodemailer/releases) - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](nodemailer/nodemailer@v8.0.11...v9.0.1) Updates `vite` from 8.0.13 to 8.0.16 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.0.16/packages/vite) Updates `vite` from 8.0.13 to 8.0.16 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.0.16/packages/vite) --- updated-dependencies: - dependency-name: form-data dependency-version: 4.0.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-cookie dependency-version: 3.0.8 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.2.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 7.24.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: markdown-it dependency-version: 14.2.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: protobufjs dependency-version: 7.6.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 7.3.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: nodemailer dependency-version: 9.0.1 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: nodemailer dependency-version: 9.0.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 8.0.16 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 8.0.16 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 23, 2026

This was referenced Jun 23, 2026

Bump the npm_and_yarn group across 3 directories with 8 updates #318

Closed

Bump the npm_and_yarn group across 1 directory with 4 updates #319

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the npm_and_yarn group across 5 directories with 10 updates#320

Bump the npm_and_yarn group across 5 directories with 10 updates#320
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-6ed9cd541a

dependabot Bot commented on behalf of github Jun 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Jun 23, 2026

v4.0.5 - 2025-11-17

Commits

v4.0.4 - 2025-07-16

Commits

v4.0.3 - 2025-06-05

Fixed

Commits

v4.0.2 - 2025-02-14

Merged

Fixed

8.5.6

8.5.5

8.5.4

8.5.3

8.5.2

8.5.1

8.5 “Duke Alloces”

Thanks to Sponsors

8.5.6

8.5.5

8.5.4

8.5.3

8.5.2

8.5.1

8.5 “Duke Alloces”

v3.1.2

⚠️ Security Release

What's Changed

v3.1.1

⚠️ Security Release

What's Changed

New Contributors

v3.1.0

What's Changed

v3.0.8

v3.0.7

[4.2.0] - 2026-06-01

Added

Changed

Fixed

Security

[3.14.2] - 2025-11-15

Security

v7.24.5

What's Changed

New Contributors

v7.24.4

What's Changed

v7.24.3

What's Changed

v7.24.2

What's Changed

v7.24.1

What's Changed

v7.24.0

Undici v7.24.0 Security Release Notes

Upgrade guidance

Fixed advisories

[14.2.0] - 2026-05-24

Added

Fixed

Security

protobufjs: v7.6.4

7.6.4 (2026-06-12)

Bug Fixes

protobufjs: v7.6.3

7.6.3 (2026-06-09)

Bug Fixes

protobufjs: v7.6.2

7.6.2 (2026-05-30)

Bug Fixes

protobufjs: v7.6.1

7.6.1 (2026-05-22)

Bug Fixes

protobufjs: v7.6.0

7.6.0 (2026-05-18)

Features

protobufjs: v7.5.9