Skip to content

Bump the npm_and_yarn group across 1 directory with 7 updates#1

Open
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/npm_and_yarn/npm_and_yarn-86563a4da7
Open

Bump the npm_and_yarn group across 1 directory with 7 updates#1
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/npm_and_yarn/npm_and_yarn-86563a4da7

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot bot commented on behalf of github Sep 17, 2025

Bumps the npm_and_yarn group with 4 updates in the / directory: axios, brace-expansion, ws and convert-svg-to-png.

Updates axios from 1.8.4 to 1.12.2

Release notes

Sourced from axios's releases.

Release v1.12.2

Release notes:

Bug Fixes

  • fetch: use current global fetch instead of cached one when env fetch is not specified to keep MSW support; (#7030) (cf78825)

Contributors to this release

Release v1.12.1

Release notes:

Bug Fixes

Contributors to this release

Release v1.12.0

Release notes:

Bug Fixes

Features

  • adapter: surface low‑level network error details; attach original error via cause (#6982) (78b290c)
  • fetch: add fetch, Request, Response env config variables for the adapter; (#7003) (c959ff2)
  • support reviver on JSON.parse (#5926) (2a97634), closes #5924
  • types: extend AxiosResponse interface to include custom headers type (#6782) (7960d34)

Contributors to this release

... (truncated)

Changelog

Sourced from axios's changelog.

1.12.2 (2025-09-14)

Bug Fixes

  • fetch: use current global fetch instead of cached one when env fetch is not specified to keep MSW support; (#7030) (cf78825)

Contributors to this release

1.12.1 (2025-09-12)

Bug Fixes

Contributors to this release

1.12.0 (2025-09-11)

Bug Fixes

Features

  • adapter: surface low‑level network error details; attach original error via cause (#6982) (78b290c)
  • fetch: add fetch, Request, Response env config variables for the adapter; (#7003) (c959ff2)
  • support reviver on JSON.parse (#5926) (2a97634), closes #5924
  • types: extend AxiosResponse interface to include custom headers type (#6782) (7960d34)

Contributors to this release

... (truncated)

Commits

Updates brace-expansion from 2.0.1 to 2.0.2

Release notes

Sourced from brace-expansion's releases.

v2.0.2

  • pkg: publish on tag 2.x 14f1d91
  • fmt ed7780a
  • Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) 36603d5

juliangruber/brace-expansion@v2.0.1...v2.0.2

Commits

Updates brace-expansion from 1.1.11 to 1.1.12

Release notes

Sourced from brace-expansion's releases.

v2.0.2

  • pkg: publish on tag 2.x 14f1d91
  • fmt ed7780a
  • Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) 36603d5

juliangruber/brace-expansion@v2.0.1...v2.0.2

Commits

Updates form-data from 4.0.0 to 4.0.4

Release notes

Sourced from form-data's releases.

v4.0.4

v4.0.4 - 2025-07-16

Commits

  • [meta] add auto-changelog 811f682
  • [Tests] handle predict-v8-randomness failures in node < 17 and node > 23 1d11a76
  • [Fix] Switch to using crypto random for boundary values 3d17230
  • [Tests] fix linting errors 5e34080
  • [meta] actually ensure the readme backup isn’t published 316c82b
  • [Dev Deps] update @ljharb/eslint-config 58c25d7
  • [meta] fix readme capitalization 2300ca1

v4.0.3

v4.0.3 - 2025-06-05

Fixed

Commits

  • [eslint] use a shared config 426ba9a
  • [eslint] fix some spacing issues 2094191
  • [Refactor] use hasown 81ab41b
  • [Fix] validate boundary type in setBoundary() method 8d8e469
  • [Tests] add tests to check the behavior of getBoundary with non-strings 837b8a1
  • [Dev Deps] remove unused deps 870e4e6
  • [meta] remove local commit hooks e6e83cc
  • [Dev Deps] update eslint 4066fd6
  • [meta] fix scripts to use prepublishOnly c4bbb13

v4.0.2

v4.0.2 - 2025-02-14

Merged

Fixed

Commits

... (truncated)

Changelog

Sourced from form-data's changelog.

v4.0.4 - 2025-07-16

Commits

  • [meta] add auto-changelog 811f682
  • [Tests] handle predict-v8-randomness failures in node < 17 and node > 23 1d11a76
  • [Fix] Switch to using crypto random for boundary values 3d17230
  • [Tests] fix linting errors 5e34080
  • [meta] actually ensure the readme backup isn’t published 316c82b
  • [Dev Deps] update @ljharb/eslint-config 58c25d7
  • [meta] fix readme capitalization 2300ca1

v4.0.3 - 2025-06-05

Fixed

Commits

  • [eslint] use a shared config 426ba9a
  • [eslint] fix some spacing issues 2094191
  • [Refactor] use hasown 81ab41b
  • [Fix] validate boundary type in setBoundary() method 8d8e469
  • [Tests] add tests to check the behavior of getBoundary with non-strings 837b8a1
  • [Dev Deps] remove unused deps 870e4e6
  • [meta] remove local commit hooks e6e83cc
  • [Dev Deps] update eslint 4066fd6
  • [meta] fix scripts to use prepublishOnly c4bbb13

v4.0.2 - 2025-02-14

Merged

Fixed

Commits

  • Merge tags v2.5.3 and v3.0.3 92613b9
  • [Tests] migrate from travis to GHA 806eda7
  • [Tests] migrate from travis to GHA 8fdb3bc

... (truncated)

Commits
  • 41996f5 v4.0.4
  • 316c82b [meta] actually ensure the readme backup isn’t published
  • 2300ca1 [meta] fix readme capitalization
  • 811f682 [meta] add auto-changelog
  • 5e34080 [Tests] fix linting errors
  • 1d11a76 [Tests] handle predict-v8-randomness failures in node < 17 and node > 23
  • 58c25d7 [Dev Deps] update @ljharb/eslint-config
  • 3d17230 [Fix] Switch to using crypto random for boundary values
  • d8d67dc v4.0.3
  • e6e83cc [meta] remove local commit hooks
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by ljharb, a new releaser for form-data since your current version.


Updates ws from 8.5.0 to 8.18.0

Release notes

Sourced from ws's releases.

8.18.0

Features

  • Added support for Blob (#2229).

8.17.1

Bug fixes

  • Fixed a DoS vulnerability (#2231).

A request with a number of headers exceeding the[server.maxHeadersCount][] threshold could be used to crash a ws server.

const http = require('http');
const WebSocket = require('ws');
const wss = new WebSocket.Server({ port: 0 }, function () {
const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
const headers = {};
let count = 0;
for (let i = 0; i < chars.length; i++) {
if (count === 2000) break;
for (let j = 0; j &lt; chars.length; j++) {
  const key = chars[i] + chars[j];
  headers[key] = 'x';
if (++count === 2000) break;
}

}
headers.Connection = 'Upgrade';
headers.Upgrade = 'websocket';
headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';
headers['Sec-WebSocket-Version'] = '13';
const request = http.request({
headers: headers,
host: '127.0.0.1',
port: wss.address().port
});
request.end();
});

The vulnerability was reported by Ryan LaPointe in websockets/ws#2230.

... (truncated)

Commits
  • 976c53c [dist] 8.18.0
  • 59b9629 [feature] Add support for Blob (#2229)
  • 0d1b5e6 [security] Use more descriptive text for 2017 vulnerability link
  • 15f11a0 [security] Add new DoS vulnerability to SECURITY.md
  • 3c56601 [dist] 8.17.1
  • e55e510 [security] Fix crash when the Upgrade header cannot be read (#2231)
  • 6a00029 [test] Increase code coverage
  • ddfe4a8 [perf] Reduce the amount of crypto.randomFillSync() calls
  • b73b118 [dist] 8.17.0
  • 29694a5 [test] Use the highWaterMark variable
  • Additional commits viewable in compare view

Updates convert-svg-to-png from 0.6.4 to 0.7.1

Release notes

Sourced from convert-svg-to-png's releases.

0.7.1

  • Allow import('puppeteer').executablePath to be passed directly in launch options to allow other launch options to be passed to it as a function
  • Document supported CONVERT_SVG_* environment variables
  • Document potential issues with reduced quality on macOS
  • Add Docker support for running the test suite on a Linux-based image
  • Bump all dependencies to latest versions

0.7.0

  • Breaking Change: All packages now require Node.js v22 or newer
  • Breaking Change: Change createConverter to be async
  • Breaking Change: Rename Converter#destroy to Converter#close
  • Breaking Change: Rename puppeteer option to launch
  • Breaking Change: Change all convert-svg-to-<FORMAT> packages to only depend on puppeteer-core so consumers must depend on puppeteer and pass either a Browser instance via the browser option or LaunchOptions via the launch option to convert, convertFile, and createConverter functions
  • Breaking Change: Remove CLI support from all convert-svg-to-<FORMAT> packages and create new convert-svg-to-<FORMAT>-cli packages for that purpose (which come with puppeteer dependency to ensure browser is downloaded and installed for ease-of-use)
  • Rewrite the entire codebase in TypeScript and support both ESM and CJS usage
  • Add browser option to convert, convertFile, and createConverter functions to accept optional Browser instance
  • Add closeBehavior option to convert, convertFile, and createConverter functions to control the behavior when Converter#close is called
  • Add page option to convert, convertFile, and createConverter functions to accept optional options to be passed to puppeteer-core when creating a page
  • Add support for CONVERT_SVG_LAUNCH_OPTIONS environment variable to be merged with launch option
  • Change Converter to create and use BrowserContext per instance to use when opening new pages to ensure they are isolated and that they can be closed by the Converter accordingly
  • Change Converter#convert and Converter#convertFile to create a new temporary file and open a new Page per invocation to support safe concurrent invocations of these methods on the same Converter instance
  • Sanitize attributes on deeply nested SVG elements
  • Apply the round option to SVG width and height when applying the scale option
  • Improve documentation
  • Improve the developer experience for contributors with better tooling
  • Deprecate convert-svg-test-helper and create new convert-svg-core-test package as a replacement
  • Create new convert-svg-core-cli package to support CLI packages
  • Many internal changes to convert-svg-core
  • Bump all dependencies to latest versions
Changelog

Sourced from convert-svg-to-png's changelog.

Version 0.7.1, 2025.06.17

  • Allow import('puppeteer').executablePath to be passed directly in launch options to allow other launch options to be passed to it as a function
  • Document supported CONVERT_SVG_* environment variables
  • Document potential issues with reduced quality on macOS
  • Add Docker support for running the test suite on a Linux-based image
  • Bump all dependencies to latest versions

Version 0.7.0, 2025.06.14

  • Breaking Change: All packages now require Node.js v22 or newer
  • Breaking Change: Change createConverter to be async
  • Breaking Change: Rename Converter#destroy to Converter#close
  • Breaking Change: Rename puppeteer option to launch
  • Breaking Change: Change all convert-svg-to-<FORMAT> packages to only depend on puppeteer-core so consumers must depend on puppeteer and pass either a Browser instance via the browser option or LaunchOptions via the launch option to convert, convertFile, and createConverter functions
  • Breaking Change: Remove CLI support from all convert-svg-to-<FORMAT> packages and create new convert-svg-to-<FORMAT>-cli packages for that purpose (which come with puppeteer dependency to ensure browser is downloaded and installed for ease-of-use)
  • Rewrite the entire codebase in TypeScript and support both ESM and CJS usage
  • Add browser option to convert, convertFile, and createConverter functions to accept optional Browser instance
  • Add closeBehavior option to convert, convertFile, and createConverter functions to control the behavior when Converter#close is called
  • Add page option to convert, convertFile, and createConverter functions to accept optional options to be passed to puppeteer-core when creating a page
  • Add support for CONVERT_SVG_LAUNCH_OPTIONS environment variable to be merged with launch option
  • Change Converter to create and use BrowserContext per instance to use when opening new pages to ensure they are isolated and that they can be closed by the Converter accordingly
  • Change Converter#convert and Converter#convertFile to create a new temporary file and open a new Page per invocation to support safe concurrent invocations of these methods on the same Converter instance
  • Sanitize attributes on deeply nested SVG elements
  • Apply the round option to SVG width and height when applying the scale option
  • Improve documentation
  • Improve the developer experience for contributors with better tooling
  • Deprecate convert-svg-test-helper and create new convert-svg-core-test package as a replacement
  • Create new convert-svg-core-cli package to support CLI packages
  • Many internal changes to convert-svg-core
  • Bump all dependencies to latest versions
Commits
Maintainer changes

This version was pushed to npm by neocotic, a new releaser for convert-svg-to-png since your current version.


Updates tar-fs from 2.1.1 to 3.1.1

Commits

Updates tmp from 0.2.1 to 0.2.5

Changelog

Sourced from tmp's changelog.

v0.2.2 (2024-02-28)

🐛 Bug Fix

📝 Documentation

Committers: 5

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump the npm_and_yarn group across 1 directory with 7 updates
08ab2c5 
Bumps the npm_and_yarn group with 4 updates in the / directory: [axios](https://github.com/axios/axios), [brace-expansion](https://github.com/juliangruber/brace-expansion), [ws](https://github.com/websockets/ws) and [convert-svg-to-png](https://github.com/neocotic/convert-svg/tree/HEAD/packages/convert-svg-to-png).


Updates `axios` from 1.8.4 to 1.12.2
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.8.4...v1.12.2)

Updates `brace-expansion` from 2.0.1 to 2.0.2
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v2.0.1...v2.0.2)

Updates `brace-expansion` from 1.1.11 to 1.1.12
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v2.0.1...v2.0.2)

Updates `form-data` from 4.0.0 to 4.0.4
- [Release notes](https://github.com/form-data/form-data/releases)
- [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md)
- [Commits](form-data/form-data@v4.0.0...v4.0.4)

Updates `ws` from 8.5.0 to 8.18.0
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.5.0...8.18.0)

Updates `convert-svg-to-png` from 0.6.4 to 0.7.1
- [Release notes](https://github.com/neocotic/convert-svg/releases)
- [Changelog](https://github.com/neocotic/convert-svg/blob/main/CHANGES.md)
- [Commits](https://github.com/neocotic/convert-svg/commits/0.7.1/packages/convert-svg-to-png)

Updates `tar-fs` from 2.1.1 to 3.1.1
- [Commits](mafintosh/tar-fs@v2.1.1...v3.1.1)

Updates `tmp` from 0.2.1 to 0.2.5
- [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md)
- [Commits](raszi/node-tmp@v0.2.1...v0.2.5)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 1.12.2
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 2.0.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 1.1.12
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: form-data
  dependency-version: 4.0.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-version: 8.18.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: convert-svg-to-png
  dependency-version: 0.7.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: tar-fs
  dependency-version: 3.1.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: tmp
  dependency-version: 0.2.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 17, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants