Bump the npm_and_yarn group across 24 directories with 11 updates by dependabot[bot] · Pull Request #736 · webforfutureinc/react

dependabot · 2026-07-21T13:53:35Z

Bumps the npm_and_yarn group with 6 updates in the / directory:

Package	From	To
@babel/core	`7.24.5`	`7.29.6`
undici	`5.28.4`	`6.27.0`
shell-quote	`1.7.1`	`1.9.0`
webpack-dev-server	`4.15.0`	`5.2.6`
adm-zip	`0.4.13`	`0.4.16`
websocket-driver	`0.7.3`	`0.7.5`

Bumps the npm_and_yarn group with 6 updates in the /compiler directory:

Package	From	To
@babel/core	`7.2.0`	`7.29.6`
undici	`6.23.0`	`6.27.0`
shell-quote	`1.8.1`	`1.10.0`
body-parser	`2.2.0`	`2.3.0`
js-yaml	`3.14.1`	`3.15.0`
@modelcontextprotocol/sdk	`1.9.0`	`1.26.0`

Bumps the npm_and_yarn group with 3 updates in the /compiler/apps/playground directory: @babel/core, shell-quote and js-yaml.
Bumps the npm_and_yarn group with 1 update in the /compiler/packages/react-forgive/client directory: brace-expansion.
Bumps the npm_and_yarn group with 2 updates in the /fixtures/attribute-behavior directory: brace-expansion and websocket-driver.
Bumps the npm_and_yarn group with 2 updates in the /fixtures/concurrent/time-slicing directory: brace-expansion and websocket-driver.
Bumps the npm_and_yarn group with 2 updates in the /fixtures/dom directory: brace-expansion and websocket-driver.
Bumps the npm_and_yarn group with 2 updates in the /fixtures/eslint-v6 directory: brace-expansion and js-yaml.
Bumps the npm_and_yarn group with 2 updates in the /fixtures/eslint-v7 directory: brace-expansion and js-yaml.
Bumps the npm_and_yarn group with 2 updates in the /fixtures/eslint-v8 directory: brace-expansion and js-yaml.
Bumps the npm_and_yarn group with 2 updates in the /fixtures/eslint-v9 directory: brace-expansion and js-yaml.
Bumps the npm_and_yarn group with 2 updates in the /fixtures/expiration directory: brace-expansion and websocket-driver.
Bumps the npm_and_yarn group with 2 updates in the /fixtures/fiber-debugger directory: brace-expansion and websocket-driver.
Bumps the npm_and_yarn group with 2 updates in the /fixtures/fizz directory: @babel/core and brace-expansion.
Bumps the npm_and_yarn group with 5 updates in the /fixtures/flight directory:

Package	From	To
@babel/core	`7.18.10`	`7.29.6`
undici	`5.28.4`	`6.27.0`
shell-quote	`1.8.1`	`1.10.0`
body-parser	`1.20.1`	`1.20.6`
js-yaml	`3.13.1`	`3.15.0`

Bumps the npm_and_yarn group with 4 updates in the /fixtures/flight-esm directory: undici, shell-quote, body-parser and brace-expansion.
Bumps the npm_and_yarn group with 2 updates in the /fixtures/flight-parcel directory: shell-quote and js-yaml.
Bumps the npm_and_yarn group with 3 updates in the /fixtures/legacy-jsx-runtimes directory: @babel/core, brace-expansion and js-yaml.
Bumps the npm_and_yarn group with 4 updates in the /fixtures/owner-stacks directory: @babel/core, shell-quote, http-proxy-middleware and websocket-driver.
Bumps the npm_and_yarn group with 3 updates in the /fixtures/ssr directory: brace-expansion, http-proxy-middleware and websocket-driver.
Bumps the npm_and_yarn group with 3 updates in the /fixtures/ssr2 directory: @babel/core, body-parser and brace-expansion.
Bumps the npm_and_yarn group with 4 updates in the /fixtures/view-transition directory: @babel/core, shell-quote, http-proxy-middleware and websocket-driver.
Bumps the npm_and_yarn group with 1 update in the /packages/react-devtools-shell directory: webpack-dev-server.
Bumps the npm_and_yarn group with 1 update in the /packages/react-devtools-timeline directory: webpack-dev-server.

Updates @babel/core from 7.24.5 to 7.29.6

Release notes

Sourced from @babel/core's releases.

v7.29.6 (2026-05-25)

🐛 Bug Fix

babel-generator

#18014 Catchup source map position in preserveFormat (@nicolo-ribaudo)

babel-core

#18001 [7.x packport]Improve input source map handling (@JLHwung)

babel-core, babel-generator

#17998 Preserve original identifier names from input sourcemaps (#17992) (@Andarist)

Committers: 3

Huáng Jùnliàng (@JLHwung)

Mateusz Burzyński (@Andarist)

Nicolò Ribaudo (@nicolo-ribaudo)

v7.29.5 (2026-05-05)

🏠 Internal

babel-preset-env

Update @babel/* dependencies

v7.29.4 (2026-05-05)

🐛 Bug Fix

babel-plugin-transform-modules-systemjs

#17974 [7.x backport]fix(systemjs): improve module string name support (@JLHwung)

Committers: 1

Huáng Jùnliàng (@JLHwung)

v7.29.3 (2026-04-30)

👓 Spec Compliance

babel-parser

#17923 Support flow extends bound (@JLHwung)

🐛 Bug Fix

babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators

#17931 fix(decorators): replace super within all removed static elements (@JLHwung)

babel-register

#17915 Fix thread synchronization issues in @babel/register (@liuxingbaoyu)

babel-compat-data, babel-plugin-bugfix-safari-rest-destructuring-rhs-array, babel-preset-env

#17788 Add bugfix plugin for Safari array rest destructuring bug (@JLHwung)

💅 Polish

babel-parser

#17782 Improve trailing comma comment handling (@JLHwung)

📝 Documentation

#17847 Replace npmjs.com links with npmx.dev (@nicolo-ribaudo)

... (truncated)

Commits

04ea6b2 v7.29.6
99f498a [7.x packport]Improve input source map handling (#18001)
feba0a3 Preserve original identifier names from input sourcemaps (#17992) (#17998)
aa8394e v7.29.0
ad0d03f [7.x backport] feat: Allow specifying startLine in code frame (#17739)
d7f4008 v7.28.6
e130225 Polish(standalone): improve message on invalid preset/plugin (#17606)
99dcba5 chore: enable some ts-eslint rules (#17592)
c92c491 Improve Unicode handling in code-frame tokenizer (#17589)
d725e39 Add BABEL_7_TO_8_DANGEROUSLY_DISABLE_VERSION_CHECK (#17569)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @babel/core since your current version.

Updates undici from 5.28.4 to 6.27.0

Release notes

Sourced from undici's releases.

v6.27.0

⚠️ Security Release

This release line addresses 4 security advisories.
Action required: Upgrade to undici 6.27.0 or later.
npm install undici@^6.27.0
Note on patched version: the v6 fixes shipped in v6.27.0, not 6.26.0 — v6.26.0 contains only the chunked-EOF fix (#5308) and the version bump, none of the security fixes below.

The v6 line is not affected by the SOCKS5 advisories (GHSA-vmh5-mc38-953g, GHSA-hm92-r4w5-c3mj), the shared-cache disclosure (GHSA-pr7r-676h-xcf6), or the 8.x-only WebSocket regression (GHSA-38rv-x7px-6hhq).

Summary

Advisory CVE Severity (CVSS) Fixed in Fix commit

GHSA-vxpw-j846-p89q CVE-2026-12151 High (7.5) 6.27.0 b7f252e7

GHSA-p88m-4jfj-68fv CVE-2026-9679 Moderate (5.9) 6.27.0 25efa447

GHSA-g8m3-5g58-fq7m CVE-2026-11525 Low (3.7) 6.27.0 25efa447

GHSA-35p6-xmwp-9g52 CVE-2026-6733 Low (3.7) 6.27.0 f4c31d60

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

GHSA-vxpw-j846-p89q · CWE-400, CWE-770 Fix: b7f252e7 Backport WebSocket maxPayloadSize fixes (#5423, backported to v6 in #5428)

A malicious WebSocket server can stream a large number of small or empty continuation frames. Undici enforced a limit on cumulative payload size but did not limit the number of fragments per message, leading to unbounded memory growth and denial of service. All releases from 6.17.0 onward are affected.

Affected: applications using new WebSocket(...) or WebSocketStream against untrusted endpoints.

Workaround: none — upgrade is required.

Moderate severity

HTTP header injection via Set-Cookie percent-decoding — CVE-2026-9679

... (truncated)

Commits

551138c Bumped v6.27.0 (#5431)
b7f252e Backport WebSocket maxPayloadSize fixes to v7.x (#5423) (#5428)
25efa44 fix(cookies): preserve values and parse SameSite strictly
f4c31d6 fix: guard idle socket validation to skip fresh sockets (#5400)
768beac Bumped v6.26.0 (#5323)
7917b25 fix: validate EOF for chunked h1 responses (#5308)
3420499 Bumped v6.25.0 (#5029)
d7a1e55 feat: add configurable maxPayloadSize for WebSocket (#4955)
a9d1848 Do not mark v6.x releases as latest
0126586 Ignore local agent configuration files
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for undici since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates shell-quote from 1.7.1 to 1.9.0

Changelog

Sourced from shell-quote's changelog.

v1.9.0 - 2026-06-24

Commits

[New] add types dca6e21

[Dev Deps] update eslint 9aa9e8f

[Fix] parse: finalize tokens in linear time (GHSA-395f-4hp3-45gv) 7ff5488

[actions] update workflows 75e8497

[actions] Windows + node 4/6/7: pin eslint to 9 before install, since npm 2/3 cannot stage eslint 10@types/esrecurse 3fb739d

[actions] retry npm install on Windows to survive npm 2/3 staging-rename flake abe0163

[actions] Windows + node 5/7: install deps with a modern node b4bafa2

[Fix] quote: escape leading ~ to prevent shell tilde-expansion 7a76c1a

[Dev Deps] update auto-changelog, tape 7184b44

[Dev Deps] apparently jackspeak is no longer in the graph 9ba368a

v1.8.4 - 2026-05-22

Commits

[Fix] quote: validate object-token shapes 4378a6e

[Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint, npmignore 22ebec0

[Tests] increase coverage 9f3caa3

[readme] replace runkit CI badge with shields.io check-runs badge 3344a04

[Dev Deps] update @ljharb/eslint-config 699c511

v1.8.3 - 2025-06-01

Fixed

[Fix] remove unnecessary backslash escaping in single quotes [#15](https://github.com/ljharb/shell-quote/issues/15)

v1.8.2 - 2024-11-27

Fixed

[Fix] quote: preserve empty strings [#18](https://github.com/ljharb/shell-quote/issues/18)

Commits

[meta] fix changelog tags 0fb9fd8

[actions] split out node 10-20, and 20+ 819bd84

[Dev Deps] update @ljharb/eslint-config, auto-changelog, npmignore, tape fc56408

[actions] update npm for windows tests fdeb0fd

[Dev Deps] update @ljharb/eslint-config, aud, tape b8a4a3b

[actions] prevent node 14 on ARM mac from failing 9eecafc

[meta] exclude more files from the package 4044e7f

[Tests] replace aud with npm audit 8cfdbd8

[meta] add missing engines.node 843820e

[Dev Deps] add missing peer dep 4c3b88d

[Dev Deps] pin jackspeak since 2.1.2+ depends on npm aliases, which kill the install process in npm < 6 80322ed

... (truncated)

Commits

db09fc7 v1.9.0
7ff5488 [Fix] parse: finalize tokens in linear time (GHSA-395f-4hp3-45gv)
b4bafa2 [actions] Windows + node 5/7: install deps with a modern node
3fb739d [actions] Windows + node 4/6/7: pin eslint to 9 before install, since npm 2/3...
abe0163 [actions] retry npm install on Windows to survive npm 2/3 staging-rename flake
7a76c1a [Fix] quote: escape leading ~ to prevent shell tilde-expansion
75e8497 [actions] update workflows
dca6e21 [New] add types
9aa9e8f [Dev Deps] update eslint
9ba368a [Dev Deps] apparently jackspeak is no longer in the graph
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by ljharb, a new releaser for shell-quote since your current version.

Install script changes

This version adds prepublish script that runs during installation. Review the package contents before updating.

Updates webpack-dev-server from 4.15.0 to 5.2.6

Release notes

Sourced from webpack-dev-server's releases.

v5.2.6

Patch Changes

fix: allow undefined as the Server constructor options argument again (by @bjohansebas in #5695)

Restores accepting undefined (defaulting it to {}) for the options argument, so passing a webpack config's optional devServer field type-checks and works as before.

Protect the built-in state-changing routes (/webpack-dev-server/invalidate and /webpack-dev-server/open-editor) against cross-site request forgery. Requests are now checked with Sec-Fetch-Site (falling back to an Origin/Host comparison when it is absent), so a cross-site page can no longer trigger a rebuild or open a file in the editor. Same-origin requests, user-initiated navigations, and non-browser clients (e.g. curl) are unaffected. (by @bjohansebas in #5698)

Handle malformed Host and Origin header values gracefully when validating requests. (by @bjohansebas in #5699)

v5.2.5

Patch Changes

Skip the HMR WebSocket path when forwarding upgrade requests to user-defined proxies, so custom proxy WebSocket upgrades are no longer intercepted by the dev server. (by @bjohansebas in #5680)

v5.2.4

5.2.4 (2026-05-11)

Bug Fixes

set Cross-Origin-Resource-Policy header to prevent source code theft over HTTP

v5.2.3

5.2.3 (2026-01-12)

Bug Fixes

add cause for errorObject (#5518) (37b033d)

compatibility with event target and universal target and lazy compilation (574026c)

overlay: add ESC key to dismiss overlay (#5598) (f91baa8)

progress indicator styles (#5557) (41a53a1)

upgrade selfsigned to v5

v5.2.2

5.2.2 (2025-06-03)

Bug Fixes

"Overlay enabled" false positive (18e72ee)

do not crush when error is null for runtime errors (#5447) (309991f)

remove unnecessary header X_TEST (#5451) (64a6124)

respect the allowedHosts option for cross-origin header check (#5510) (03d1214)

v5.2.1

5.2.1 (2025-03-26)

... (truncated)

Changelog

Sourced from webpack-dev-server's changelog.

5.2.6

Patch Changes

fix: allow undefined as the Server constructor options argument again (by @bjohansebas in #5695)

Restores accepting undefined (defaulting it to {}) for the options argument, so passing a webpack config's optional devServer field type-checks and works as before.

Protect the built-in state-changing routes (/webpack-dev-server/invalidate and /webpack-dev-server/open-editor) against cross-site request forgery. Requests are now checked with Sec-Fetch-Site (falling back to an Origin/Host comparison when it is absent), so a cross-site page can no longer trigger a rebuild or open a file in the editor. Same-origin requests, user-initiated navigations, and non-browser clients (e.g. curl) are unaffected. (by @bjohansebas in #5698)

Handle malformed Host and Origin header values gracefully when validating requests. (by @bjohansebas in #5699)

5.2.5

Patch Changes

Skip the HMR WebSocket path when forwarding upgrade requests to user-defined proxies, so custom proxy WebSocket upgrades are no longer intercepted by the dev server. (by @bjohansebas in #5680)

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

5.2.4 (2026-05-11)

Bug Fixes

set Cross-Origin-Resource-Policy header to prevent source code theft over HTTP

5.2.3 (2026-01-12)

Bug Fixes

add cause for errorObject (#5518) (37b033d)

compatibility with event target and universal target and lazy compilation (574026c)

overlay: add ESC key to dismiss overlay (#5598) (f91baa8)

progress indicator styles (#5557) (41a53a1)

upgrade selfsigned to v5

5.2.2 (2025-06-03)

Bug Fixes

"Overlay enabled" false positive (18e72ee)

do not crush when error is null for runtime errors (#5447) (309991f)

remove unnecessary header X_TEST (#5451) (64a6124)

respect the allowedHosts option for cross-origin header check (#5510) (03d1214)

5.2.1 (2025-03-26)

Security

... (truncated)

Commits

8a37b0e chore(release): new release (#5697)
f21ed0f fix: handle malformed Host and Origin headers (#5699)
80cd9ee fix: reject cross-site requests to open-editor and invalidate endpoints (#5698)
308e853 fix: handle undefined options in Server constructor (#5695)
8b2b915 chore: update branch references from v4 to v5 in workflow configuration
870ed22 chore: add v5 branch to release workflow triggers
c3ee325 chore(release): new release (#5682)
60173be feat: add changeset validation and release workflow (#5680)
948d5e6 fix(proxy): match the HMR upgrade path exactly like the ws server (#5678)
93e8996 fix: skip HMR websocket path when forwarding upgrades to user-defined proxies...
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for webpack-dev-server since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates adm-zip from 0.4.13 to 0.4.16

Changelog

Sourced from adm-zip's changelog.

0.4.16 / 2020-06-23

Updated mocha version to fix vulnerability (cthackers)

Update project version (cthackers)

fix: throw real exception objects on error (Matthew Sainsbury)

Version number incremented (Saqib M)

Update zipFile.js (Saqib M)

Update README.md with the latest URLs (Takuya Noguchi)

Update Node.js version to use in CI tests (Takuya Noguchi)

process.versions is null when the library is used in browser (Emiliano Necciari)

0.4.14 / 2020-02-06

Version increment for npm publish (cthackers)

Iterate over entries without storing their metadata (Pierre Lehnen)

Add partial support for zip64 (larger number of entries) (Pierre Lehnen)

Escape $ sign for regex in addLocalFolder() (William)

fix accent filename (mart_-)

Removed improperly raised error while decompressing empty file asynchronously. (Nicolas Leclerc)

fix: CRC is unexpectedly changed after zip is re-created (teppeis)

Commits

9d2eb0b Updated mocha version to fix vulnerability
9bb5fb9 Update project version
10a8c1c Merge pull request #250 from opichals/patch-1
c87b983 Merge pull request #279 from willjouo/master
de614ea Merge pull request #308 from tnir/copyedit-docs-with-https
b94b8e5 Merge pull request #307 from tnir/update-nodejs-for-testing
ff355f5 Merge pull request #313 from mattsains/master
a13f520 Merge pull request #312 from saqibmushtaq/master
79c21ff fix: throw real exception objects on error
235e7bf Version number incremented
Additional commits viewable in compare view

Updates body-parser from 1.20.3 to 1.20.6

Release notes

Sourced from body-parser's releases.

v2.3.0

Important: Security

Security fix for CVE-2026-12590 (GHSA-v422-hmwv-36x6)

What's Changed

build(deps): bump actions/download-artifact from 6.0.0 to 7.0.0 by @dependabot[bot] in expressjs/body-parser#681

build(deps): bump actions/checkout from 5.0.0 to 6.0.1 by @dependabot[bot] in expressjs/body-parser#682

build(deps): bump actions/setup-node from 6.0.0 to 6.1.0 by @dependabot[bot] in expressjs/body-parser#683

build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 by @dependabot[bot] in expressjs/body-parser#685

build(deps): bump github/codeql-action from 4.31.2 to 4.31.9 by @dependabot[bot] in expressjs/body-parser#684

perf(urlencoded): move empty-body guard to avoid extra function closure by @Phillip9587 in expressjs/body-parser#647

Improve ESM compatibility by @Phillip9587 in expressjs/body-parser#697

docs: add recommendations for configuring payload limits by @bjohansebas in expressjs/body-parser#699

build(deps): bump actions/setup-node from 6.1.0 to 6.2.0 by @dependabot[bot] in expressjs/body-parser#701

build(deps): bump github/codeql-action from 4.31.10 to 4.32.0 by @dependabot[bot] in expressjs/body-parser#702

build(deps): bump actions/checkout from 6.0.1 to 6.0.2 by @dependabot[bot] in expressjs/body-parser#700

chore: add explicit type commonjs to package.json by @Phillip9587 in expressjs/body-parser#711

deps: update dependencies to latest versions by @Phillip9587 in expressjs/body-parser#708

build(deps): bump actions/download-artifact from 7.0.0 to 8.0.0 by @dependabot[bot] in expressjs/body-parser#712

build(deps): bump github/codeql-action from 4.32.0 to 4.32.4 by @dependabot[bot] in expressjs/body-parser#713

build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0 by @dependabot[bot] in expressjs/body-parser#714

fix: improve limit option validation by @Phillip9587 in expressjs/body-parser#698

build(deps): bump github/codeql-action from 4.32.4 to 4.35.1 by @dependabot[bot] in expressjs/body-parser#719

build(deps): bump actions/setup-node from 6.2.0 to 6.3.0 by @dependabot[bot] in expressjs/body-parser#718

build(deps): bump actions/download-artifact from 8.0.0 to 8.0.1 by @dependabot[bot] in expressjs/body-parser#717

perf: eliminate conditional check in json strict mode hot path by @Phillip9587 in expressjs/body-parser#651

ci: add node.js 26 to text matrix by @Phillip9587 in expressjs/body-parser#726

build(deps): bump actions/setup-node from 6.3.0 to 6.4.0 by @dependabot[bot] in expressjs/body-parser#725

build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 by @dependabot[bot] in expressjs/body-parser#724

build(deps): bump github/codeql-action from 4.35.1 to 4.35.3 by @dependabot[bot] in expressjs/body-parser#723

Upgrade "content-type" by @blakeembrey in expressjs/body-parser#728

refactor: switch to const/let and enable eslint no-var rule by @Phillip9587 in expressjs/body-parser#729

Update outdated reference to MDN docs by @krzysdz in expressjs/body-parser#730

build(deps): bump github/codeql-action from 4.35.3 to 4.36.1 by @dependabot[bot] in expressjs/body-parser#731

build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in expressjs/body-parser#732

chore: updated deps to latest by @Phillip9587 in expressjs/body-parser#733

2.3.0 by @UlisesGascon in expressjs/body-parser#735

New Contributors

@krzysdz made their first contribution in expressjs/body-parser#730

Full Changelog: expressjs/body-parser@v2.2.2...v2.3.0

v2.2.2

What's Changed

docs: update README links by @efekrskl in expressjs/body-parser#673

docs: release notes for the v1.20.4 release by @Phillip9587 in expressjs/body-parser#674

docs: update URL-encoded parser description to include ISO-8859-1 encoding support by @Phillip9587 in expressjs/body-parser#679

docs: use standard jsdoc tags everywhere by @Phillip9587 in expressjs/body-parser#677

... (truncated)

Changelog

Sourced from body-parser's changelog.

2.3.0 / 2026-06-15

Security fix for GHSA-v422-hmwv-36x6

fix: use static exports instead of lazy getters to improve ESM compatibility

feat: add subpath exports for individual parsers

fix: improve limit option validation (#698)

Invalid limit values (e.g. unparseable strings or NaN) now throw instead of being silently ignored, which previously disabled size limit enforcement

null and undefined fall back to the default 100kb limit

deps:

content-type@^2.0.0

http-errors@^2.0.1

iconv-lite^0.7.2

qs@^6.15.2

raw-body@^3.0.2

type-is@^2.1.0

2.2.2 / 2026-01-07

deps: qs@^6.14.1

refactor(json): simplify strict mode error string construction

2.2.1 / 2025-11-24

Security fix for GHSA-wqch-xfxh-vrr4

deps:

type-is@^2.0.1

iconv-lite@^0.7.0

Handle split surrogate pairs when encoding UTF-8

Avoid false positives in encodingExists by using prototype-less objects

raw-body@^3.0.1

debug@^4.4.3

Commits

d0f2ace 2.3.0 (#735)
7d03f2f chore: updated deps to latest (#733)
8024ba7 build(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#732)
32b4ed4 build(deps): bump github/codeql-action from 4.35.3 to 4.36.1 (#731)
ff0f6b9 docs: update outdated reference to MDN docs (#730)
14d001a refactor: switch to const/let and enable eslint no-var rule (#729)
37f36a2 deps: update content-type and type-is (#728)
e1c244b build(deps): bump github/codeql-action from 4.35.1 to 4.35.3 (#723)
e01087f build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#724)
a7698d3 build(deps): bump actions/setup-node from 6.3.0 to 6.4.0 (#725)
Additional commits viewable in compare view

Updates http-proxy-middleware from 2.0.6 to 2.0.10

Release notes

Sourced from http-proxy-middleware's releases.

v2.0.10-beta.0

What's Changed

fix: harden proxy-table matching to prevent routing bypass by @G-Rath in chimurai/http-proxy-middleware#1268

ci(github-actions): update publish.yml by @chimurai in chimurai/http-proxy-middleware#1270

New Contributors

@G-Rath made their first contribution in chimurai/http-proxy-middleware#1268

Full Changelog: chimurai/http-proxy-middleware@v2.0.9...v2.0.10-beta.0

v2.0.9

What's Changed

fix(fixRequestBody): check readableLength by @chimurai in chimurai/http-proxy-middleware#1097

chore(package): v2.0.9 by @chimurai in chimurai/http-proxy-middleware#1099

Full Changelog: chimurai/http-proxy-middleware@v2.0.8...v2.0.9

v2.0.8

What's Changed

fix(fixRequestBody): prevent multiple .write() calls by @chimurai in chimurai/http-proxy-middleware#1090

fix(fixRequestBody): handle invalid request by @chimurai in chimurai/http-proxy-middleware#1091

chore(package): v2.0.8 by @chimurai in chimurai/http-proxy-middleware#1094

Full Changelog: chimurai/http-proxy-middleware@v2.0.7...v2.0.8

Changelog

Sourced from http-proxy-middleware's changelog.

v2.0.10

fix(router): harden proxy-table matching (exact host for host+path keys, prefix-only path matching) to prevent routing bypass

v2.0.9

fix(fixRequestBody): check readableLength

v2.0.8

fix(fixRequestBody): prevent multiple .write() calls

fix(fixRequestBody): handle invalid request

Commits

f0be839 chore(package.json): v2.0.10 (#1271)
19c860d ci(github-actions): update publish.yml (#1270)
d0f7d63 fix: harden proxy-table matching to prevent routing bypass (#1268)
617a7c9 chore(package): v2.0.9 (#1099)
d22d587 fix(fixRequestBody): check readableLength (#1097)
d03d51b chore(package): v2.0.8 (

Bumps the npm_and_yarn group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) | `7.24.5` | `7.29.6` | | [undici](https://github.com/nodejs/undici) | `5.28.4` | `6.27.0` | | [shell-quote](https://github.com/ljharb/shell-quote) | `1.7.1` | `1.9.0` | | [webpack-dev-server](https://github.com/webpack/webpack-dev-server) | `4.15.0` | `5.2.6` | | [adm-zip](https://github.com/cthackers/adm-zip) | `0.4.13` | `0.4.16` | | [websocket-driver](https://github.com/faye/websocket-driver-node) | `0.7.3` | `0.7.5` | Bumps the npm_and_yarn group with 6 updates in the /compiler directory: | Package | From | To | | --- | --- | --- | | [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) | `7.2.0` | `7.29.6` | | [undici](https://github.com/nodejs/undici) | `6.23.0` | `6.27.0` | | [shell-quote](https://github.com/ljharb/shell-quote) | `1.8.1` | `1.10.0` | | [body-parser](https://github.com/expressjs/body-parser) | `2.2.0` | `2.3.0` | | [js-yaml](https://github.com/nodeca/js-yaml) | `3.14.1` | `3.15.0` | | [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.9.0` | `1.26.0` | Bumps the npm_and_yarn group with 3 updates in the /compiler/apps/playground directory: [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core), [shell-quote](https://github.com/ljharb/shell-quote) and [js-yaml](https://github.com/nodeca/js-yaml). Bumps the npm_and_yarn group with 1 update in the /compiler/packages/react-forgive/client directory: [brace-expansion](https://github.com/juliangruber/brace-expansion). Bumps the npm_and_yarn group with 2 updates in the /fixtures/attribute-behavior directory: [brace-expansion](https://github.com/juliangruber/brace-expansion) and [websocket-driver](https://github.com/faye/websocket-driver-node). Bumps the npm_and_yarn group with 2 updates in the /fixtures/concurrent/time-slicing directory: [brace-expansion](https://github.com/juliangruber/brace-expansion) and [websocket-driver](https://github.com/faye/websocket-driver-node). Bumps the npm_and_yarn group with 2 updates in the /fixtures/dom directory: [brace-expansion](https://github.com/juliangruber/brace-expansion) and [websocket-driver](https://github.com/faye/websocket-driver-node). Bumps the npm_and_yarn group with 2 updates in the /fixtures/eslint-v6 directory: [brace-expansion](https://github.com/juliangruber/brace-expansion) and [js-yaml](https://github.com/nodeca/js-yaml). Bumps the npm_and_yarn group with 2 updates in the /fixtures/eslint-v7 directory: [brace-expansion](https://github.com/juliangruber/brace-expansion) and [js-yaml](https://github.com/nodeca/js-yaml). Bumps the npm_and_yarn group with 2 updates in the /fixtures/eslint-v8 directory: [brace-expansion](https://github.com/juliangruber/brace-expansion) and [js-yaml](https://github.com/nodeca/js-yaml). Bumps the npm_and_yarn group with 2 updates in the /fixtures/eslint-v9 directory: [brace-expansion](https://github.com/juliangruber/brace-expansion) and [js-yaml](https://github.com/nodeca/js-yaml). Bumps the npm_and_yarn group with 2 updates in the /fixtures/expiration directory: [brace-expansion](https://github.com/juliangruber/brace-expansion) and [websocket-driver](https://github.com/faye/websocket-driver-node). Bumps the npm_and_yarn group with 2 updates in the /fixtures/fiber-debugger directory: [brace-expansion](https://github.com/juliangruber/brace-expansion) and [websocket-driver](https://github.com/faye/websocket-driver-node). Bumps the npm_and_yarn group with 2 updates in the /fixtures/fizz directory: [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) and [brace-expansion](https://github.com/juliangruber/brace-expansion). Bumps the npm_and_yarn group with 5 updates in the /fixtures/flight directory: | Package | From | To | | --- | --- | --- | | [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) | `7.18.10` | `7.29.6` | | [undici](https://github.com/nodejs/undici) | `5.28.4` | `6.27.0` | | [shell-quote](https://github.com/ljharb/shell-quote) | `1.8.1` | `1.10.0` | | [body-parser](https://github.com/expressjs/body-parser) | `1.20.1` | `1.20.6` | | [js-yaml](https://github.com/nodeca/js-yaml) | `3.13.1` | `3.15.0` | Bumps the npm_and_yarn group with 4 updates in the /fixtures/flight-esm directory: [undici](https://github.com/nodejs/undici), [shell-quote](https://github.com/ljharb/shell-quote), [body-parser](https://github.com/expressjs/body-parser) and [brace-expansion](https://github.com/juliangruber/brace-expansion). Bumps the npm_and_yarn group with 2 updates in the /fixtures/flight-parcel directory: [shell-quote](https://github.com/ljharb/shell-quote) and [js-yaml](https://github.com/nodeca/js-yaml). Bumps the npm_and_yarn group with 3 updates in the /fixtures/legacy-jsx-runtimes directory: [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core), [brace-expansion](https://github.com/juliangruber/brace-expansion) and [js-yaml](https://github.com/nodeca/js-yaml). Bumps the npm_and_yarn group with 4 updates in the /fixtures/owner-stacks directory: [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core), [shell-quote](https://github.com/ljharb/shell-quote), [http-proxy-middleware](https://github.com/chimurai/http-proxy-middleware) and [websocket-driver](https://github.com/faye/websocket-driver-node). Bumps the npm_and_yarn group with 3 updates in the /fixtures/ssr directory: [brace-expansion](https://github.com/juliangruber/brace-expansion), [http-proxy-middleware](https://github.com/chimurai/http-proxy-middleware) and [websocket-driver](https://github.com/faye/websocket-driver-node). Bumps the npm_and_yarn group with 3 updates in the /fixtures/ssr2 directory: [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core), [body-parser](https://github.com/expressjs/body-parser) and [brace-expansion](https://github.com/juliangruber/brace-expansion). Bumps the npm_and_yarn group with 4 updates in the /fixtures/view-transition directory: [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core), [shell-quote](https://github.com/ljharb/shell-quote), [http-proxy-middleware](https://github.com/chimurai/http-proxy-middleware) and [websocket-driver](https://github.com/faye/websocket-driver-node). Bumps the npm_and_yarn group with 1 update in the /packages/react-devtools-shell directory: [webpack-dev-server](https://github.com/webpack/webpack-dev-server). Bumps the npm_and_yarn group with 1 update in the /packages/react-devtools-timeline directory: [webpack-dev-server](https://github.com/webpack/webpack-dev-server). Updates `@babel/core` from 7.24.5 to 7.29.6 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.6/packages/babel-core) Updates `undici` from 5.28.4 to 6.27.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v5.28.4...v6.27.0) Updates `shell-quote` from 1.7.1 to 1.9.0 - [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md) - [Commits](ljharb/shell-quote@v1.7.1...v1.9.0) Updates `webpack-dev-server` from 4.15.0 to 5.2.6 - [Release notes](https://github.com/webpack/webpack-dev-server/releases) - [Changelog](https://github.com/webpack/webpack-dev-server/blob/v5.2.6/CHANGELOG.md) - [Commits](webpack/webpack-dev-server@v4.15.0...v5.2.6) Updates `adm-zip` from 0.4.13 to 0.4.16 - [Release notes](https://github.com/cthackers/adm-zip/releases) - [Changelog](https://github.com/cthackers/adm-zip/blob/master/history.md) - [Commits](cthackers/adm-zip@v0.4.13...v0.4.16) Updates `body-parser` from 1.20.3 to 1.20.6 - [Release notes](https://github.com/expressjs/body-parser/releases) - [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md) - [Commits](expressjs/body-parser@v2.2.0...v2.3.0) Updates `http-proxy-middleware` from 2.0.6 to 2.0.10 - [Release notes](https://github.com/chimurai/http-proxy-middleware/releases) - [Changelog](https://github.com/chimurai/http-proxy-middleware/blob/v2.0.10/CHANGELOG.md) - [Commits](chimurai/http-proxy-middleware@v2.0.7...v2.0.10) Updates `websocket-driver` from 0.7.3 to 0.7.5 - [Changelog](https://github.com/faye/websocket-driver-node/blob/main/CHANGELOG.md) - [Commits](faye/websocket-driver-node@0.7.3...0.7.5) Updates `@babel/core` from 7.2.0 to 7.29.6 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.6/packages/babel-core) Updates `undici` from 6.23.0 to 6.27.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v5.28.4...v6.27.0) Updates `shell-quote` from 1.8.1 to 1.10.0 - [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md) - [Commits](ljharb/shell-quote@v1.7.1...v1.9.0) Updates `body-parser` from 2.2.0 to 2.3.0 - [Release notes](https://github.com/expressjs/body-parser/releases) - [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md) - [Commits](expressjs/body-parser@v2.2.0...v2.3.0) Updates `js-yaml` from 3.14.1 to 3.15.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.14.1...3.15.0) Updates `@modelcontextprotocol/sdk` from 1.9.0 to 1.26.0 - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases) - [Commits](modelcontextprotocol/typescript-sdk@1.9.0...v1.26.0) Updates `@babel/core` from 7.25.2 to 7.29.6 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.6/packages/babel-core) Updates `shell-quote` from 1.8.1 to 1.10.0 - [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md) - [Commits](ljharb/shell-quote@v1.7.1...v1.9.0) Updates `js-yaml` from 4.1.0 to 4.3.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.14.1...3.15.0) Updates `brace-expansion` from 2.0.1 to 2.1.2 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v2.0.1...v2.1.2) Updates `brace-expansion` from 1.1.8 to 1.1.16 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v2.0.1...v2.1.2) Updates `websocket-driver` from 0.6.5 to 0.7.5 - [Changelog](https://github.com/faye/websocket-driver-node/blob/main/CHANGELOG.md) - [Commits](faye/websocket-driver-node@0.7.3...0.7.5) Updates `brace-expansion` from 1.1.11 to 1.1.16 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v2.0.1...v2.1.2) Updates `websocket-driver` from 0.7.4 to 0.7.5 - [Changelog](https://github.com/faye/websocket-driver-node/blob/main/CHANGELOG.md) - [Commits](faye/websocket-driver-node@0.7.3...0.7.5) Updates `brace-expansion` from 1.1.11 to 1.1.16 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v2.0.1...v2.1.2) Updates `websocket-driver` from 0.7.4 to 0.7.5 - [Changelog](https://github.com/faye/websocket-driver-node/blob/main/CHANGELOG.md) - [Commits](faye/websocket-driver-node@0.7.3...0.7.5) Updates `brace-expansion` from 1.1.11 to 1.1.16 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v2.0.1...v2.1.2) Updates `js-yaml` from 3.14.1 to 3.15.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.14.1...3.15.0) Updates `brace-expansion` from 1.1.11 to 1.1.16 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v2.0.1...v2.1.2) Updates `js-yaml` from 3.14.1 to 3.15.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.14.1...3.15.0) Updates `brace-expansion` from 1.1.11 to 1.1.16 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v2.0.1...v2.1.2) Updates `js-yaml` from 4.1.0 to 4.3.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.14.1...3.15.0) Updates `brace-expansion` from 1.1.11 to 1.1.16 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v2.0.1...v2.1.2) Updates `js-yaml` from 4.1.0 to 4.3.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.14.1...3.15.0) Updates `brace-expansion` from 1.1.8 to 1.1.16 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v2.0.1...v2.1.2) Updates `websocket-driver` from 0.7.0 to 0.7.5 - [Changelog](https://github.com/faye/websocket-driver-node/blob/main/CHANGELOG.md) - [Commits](faye/websocket-driver-node@0.7.3...0.7.5) Updates `brace-expansion` from 1.1.6 to 1.1.16 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v2.0.1...v2.1.2) Updates `websocket-driver` from 0.6.5 to 0.7.5 - [Changelog](https://github.com/faye/websocket-driver-node/blob/main/CHANGELOG.md) - [Commits](faye/websocket-driver-node@0.7.3...0.7.5) Updates `@babel/core` from 7.14.3 to 7.29.6 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.6/packages/babel-core) Updates `brace-expansion` from 1.1.11 to 1.1.16 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v2.0.1...v2.1.2) Updates `@babel/core` from 7.18.10 to 7.29.6 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.6/packages/babel-core) Updates `undici` from 5.28.4 to 6.27.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v5.28.4...v6.27.0) Updates `shell-quote` from 1.8.1 to 1.10.0 - [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md) - [Commits](ljharb/shell-quote@v1.7.1...v1.9.0) Updates `body-parser` from 1.20.1 to 1.20.6 - [Release notes](https://github.com/expressjs/body-parser/releases) - [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md) - [Commits](expressjs/body-parser@v2.2.0...v2.3.0) Updates `js-yaml` from 3.13.1 to 3.15.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.14.1...3.15.0) Updates `undici` from 5.22.1 to 6.27.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v5.28.4...v6.27.0) Updates `shell-quote` from 1.8.1 to 1.10.0 - [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md) - [Commits](ljharb/shell-quote@v1.7.1...v1.9.0) Updates `body-parser` from 1.20.2 to 1.20.6 - [Release notes](https://github.com/expressjs/body-parser/releases) - [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md) - [Commits](expressjs/body-parser@v2.2.0...v2.3.0) Updates `brace-expansion` from 1.1.11 to 1.1.16 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v2.0.1...v2.1.2) Updates `shell-quote` from 1.8.2 to 1.10.0 - [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md) - [Commits](ljharb/shell-quote@v1.7.1...v1.9.0) Updates `js-yaml` from 4.1.0 to 4.3.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.14.1...3.15.0) Updates `@babel/core` from 7.20.12 to 7.29.7 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.6/packages/babel-core) Updates `brace-expansion` from 1.1.11 to 1.1.16 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v2.0.1...v2.1.2) Updates `js-yaml` from 3.14.1 to 3.15.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.14.1...3.15.0) Updates `@babel/core` from 7.26.7 to 7.29.7 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.6/packages/babel-core) Updates `shell-quote` from 1.8.2 to 1.10.0 - [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md) - [Commits](ljharb/shell-quote@v1.7.1...v1.9.0) Updates `http-proxy-middleware` from 2.0.7 to 2.0.10 - [Release notes](https://github.com/chimurai/http-proxy-middleware/releases) - [Changelog](https://github.com/chimurai/http-proxy-middleware/blob/v2.0.10/CHANGELOG.md) - [Commits](chimurai/http-proxy-middleware@v2.0.7...v2.0.10) Updates `websocket-driver` from 0.7.4 to 0.7.5 - [Changelog](https://github.com/faye/websocket-driver-node/blob/main/CHANGELOG.md) - [Commits](faye/websocket-driver-node@0.7.3...0.7.5) Updates `brace-expansion` from 1.1.11 to 1.1.16 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v2.0.1...v2.1.2) Updates `http-proxy-middleware` from 0.17.3 to 2.0.10 - [Release notes](https://github.com/chimurai/http-proxy-middleware/releases) - [Changelog](https://github.com/chimurai/http-proxy-middleware/blob/v2.0.10/CHANGELOG.md) - [Commits](chimurai/http-proxy-middleware@v2.0.7...v2.0.10) Updates `websocket-driver` from 0.7.4 to 0.7.5 - [Changelog](https://github.com/faye/websocket-driver-node/blob/main/CHANGELOG.md) - [Commits](faye/websocket-driver-node@0.7.3...0.7.5) Updates `@babel/core` from 7.14.3 to 7.29.6 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.6/packages/babel-core) Updates `body-parser` from 1.19.0 to 1.20.6 - [Release notes](https://github.com/expressjs/body-parser/releases) - [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md) - [Commits](expressjs/body-parser@v2.2.0...v2.3.0) Updates `brace-expansion` from 1.1.11 to 5.0.7 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v2.0.1...v2.1.2) Updates `@babel/core` from 7.26.0 to 7.29.7 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.6/packages/babel-core) Updates `shell-quote` from 1.8.2 to 1.10.0 - [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md) - [Commits](ljharb/shell-quote@v1.7.1...v1.9.0) Updates `http-proxy-middleware` from 3.0.3 to 3.0.7 - [Release notes](https://github.com/chimurai/http-proxy-middleware/releases) - [Changelog](https://github.com/chimurai/http-proxy-middleware/blob/v2.0.10/CHANGELOG.md) - [Commits](chimurai/http-proxy-middleware@v2.0.7...v2.0.10) Updates `websocket-driver` from 0.7.4 to 0.7.5 - [Changelog](https://github.com/faye/websocket-driver-node/blob/main/CHANGELOG.md) - [Commits](faye/websocket-driver-node@0.7.3...0.7.5) Updates `webpack-dev-server` from 4.15.2 to 6.0.0 - [Release notes](https://github.com/webpack/webpack-dev-server/releases) - [Changelog](https://github.com/webpack/webpack-dev-server/blob/v5.2.6/CHANGELOG.md) - [Commits](webpack/webpack-dev-server@v4.15.0...v5.2.6) Updates `webpack-dev-server` from 4.15.2 to 6.0.0 - [Release notes](https://github.com/webpack/webpack-dev-server/releases) - [Changelog](https://github.com/webpack/webpack-dev-server/blob/v5.2.6/CHANGELOG.md) - [Commits](webpack/webpack-dev-server@v4.15.0...v5.2.6) --- updated-dependencies: - dependency-name: "@babel/core" dependency-version: 7.29.6 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 6.27.0 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: shell-quote dependency-version: 1.9.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: webpack-dev-server dependency-version: 5.2.6 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: adm-zip dependency-version: 0.4.16 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: body-parser dependency-version: 1.20.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: http-proxy-middleware dependency-version: 2.0.10 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: websocket-driver dependency-version: 0.7.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@babel/core" dependency-version: 7.29.6 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 6.27.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: shell-quote dependency-version: 1.10.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: body-parser dependency-version: 2.3.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 3.15.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@modelcontextprotocol/sdk" dependency-version: 1.26.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@babel/core" dependency-version: 7.29.6 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: shell-quote dependency-version: 1.10.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.3.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 2.1.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.16 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: websocket-driver dependency-version: 0.7.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.16 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: websocket-driver dependency-version: 0.7.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.16 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: websocket-driver dependency-version: 0.7.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.16 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 3.15.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.16 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 3.15.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.16 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.3.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.16 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.3.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.16 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: websocket-driver dependency-version: 0.7.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.16 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: websocket-driver dependency-version: 0.7.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@babel/core" dependency-version: 7.29.6 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.16 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@babel/core" dependency-version: 7.29.6 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 6.27.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: shell-quote dependency-version: 1.10.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: body-parser dependency-version: 1.20.6 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 3.15.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 6.27.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: shell-quote dependency-version: 1.10.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: body-parser dependency-version: 1.20.6 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.16 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: shell-quote dependency-version: 1.10.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.3.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@babel/core" dependency-version: 7.29.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.16 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 3.15.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@babel/core" dependency-version: 7.29.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: shell-quote dependency-version: 1.10.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: http-proxy-middleware dependency-version: 2.0.10 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: websocket-driver dependency-version: 0.7.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.16 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: http-proxy-middleware dependency-version: 2.0.10 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: websocket-driver dependency-version: 0.7.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@babel/core" dependency-version: 7.29.6 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: body-parser dependency-version: 1.20.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 5.0.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@babel/core" dependency-version: 7.29.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: shell-quote dependency-version: 1.10.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: http-proxy-middleware dependency-version: 3.0.7 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: websocket-driver dependency-version: 0.7.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: webpack-dev-server dependency-version: 6.0.0 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: webpack-dev-server dependency-version: 6.0.0 dependency-type: direct:development dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jul 21, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump the npm_and_yarn group across 24 directories with 11 updates#736

Bump the npm_and_yarn group across 24 directories with 11 updates#736
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-c4427735ff

dependabot Bot commented on behalf of github Jul 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Advisory	CVE	Severity (CVSS)	Fixed in	Fix commit
GHSA-vxpw-j846-p89q	CVE-2026-12151	High (7.5)	6.27.0	`b7f252e7`
GHSA-p88m-4jfj-68fv	CVE-2026-9679	Moderate (5.9)	6.27.0	`25efa447`
GHSA-g8m3-5g58-fq7m	CVE-2026-11525	Low (3.7)	6.27.0	`25efa447`
GHSA-35p6-xmwp-9g52	CVE-2026-6733	Low (3.7)	6.27.0	`f4c31d60`

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 21, 2026

v7.29.6 (2026-05-25)

🐛 Bug Fix

Committers: 3

v7.29.5 (2026-05-05)

🏠 Internal

v7.29.4 (2026-05-05)

🐛 Bug Fix

Committers: 1

v7.29.3 (2026-04-30)

👓 Spec Compliance

🐛 Bug Fix

💅 Polish

📝 Documentation

v6.27.0

⚠️ Security Release

Summary

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

Moderate severity

HTTP header injection via Set-Cookie percent-decoding — CVE-2026-9679

v1.9.0 - 2026-06-24

Commits

v1.8.4 - 2026-05-22

Commits

v1.8.3 - 2025-06-01

Fixed

v1.8.2 - 2024-11-27

Fixed

Commits

v5.2.6

Patch Changes

v5.2.5

Patch Changes

v5.2.4

5.2.4 (2026-05-11)

Bug Fixes

v5.2.3

5.2.3 (2026-01-12)

Bug Fixes

v5.2.2

5.2.2 (2025-06-03)

Bug Fixes

v5.2.1

5.2.1 (2025-03-26)

5.2.6

Patch Changes

5.2.5

Patch Changes

5.2.4 (2026-05-11)

Bug Fixes

5.2.3 (2026-01-12)

Bug Fixes

5.2.2 (2025-06-03)

Bug Fixes

5.2.1 (2025-03-26)

Security

0.4.16 / 2020-06-23

0.4.14 / 2020-02-06

v2.3.0

Important: Security

What's Changed

New Contributors

v2.2.2

What's Changed

2.3.0 / 2026-06-15

2.2.2 / 2026-01-07

2.2.1 / 2025-11-24

v2.0.10-beta.0

What's Changed

New Contributors

v2.0.9

What's Changed

v2.0.8

What's Changed

v2.0.10

v2.0.9

v2.0.8