Bump the npm_and_yarn group across 1 directory with 29 updates by dependabot[bot] · Pull Request #12 · shortstorybox/metabase

dependabot · 2025-10-02T02:10:45Z

Bumps the npm_and_yarn group with 22 updates in the / directory:

Package	From	To
jspdf	`2.5.1`	`3.0.2`
jsrsasign	`10.5.25`	`11.0.0`
mysql2	`3.1.0`	`3.9.8`
esbuild	`0.17.9`	`0.25.0`
postcss	`8.4.19`	`8.4.31`
webpack	`5.85.0`	`5.94.0`
webpack-dev-server	`4.15.0`	`5.2.1`
@adobe/css-tools	`4.0.1`	`4.4.4`
@babel/traverse	`7.12.1`	`7.28.4`
browserify-sign	`4.2.1`	`4.2.5`
cipher-base	`1.0.4`	`1.0.7`
color-string	`1.5.4`	`1.9.1`
elliptic	`6.5.3`	`6.6.1`
fast-loops	`1.1.3`	`1.1.4`
follow-redirects	`1.13.0`	`1.15.11`
http-cache-semantics	`4.1.0`	`4.2.0`
jsonata	`1.8.6`	`1.8.7`
path-parse	`1.0.6`	`1.0.7`
sha.js	`2.4.11`	`2.4.12`
store2	`2.12.0`	`2.14.4`
tar	`6.1.11`	`6.2.1`
ua-parser-js	`0.7.23`	`0.7.41`

Updates jspdf from 2.5.1 to 3.0.2

Release notes

Sourced from jspdf's releases.

v3.0.2

This release fixes a security issue where parsing of corrupt PNG images could lead to long running loops and denial of service.

What's Changed

[Snyk] Upgrade @babel/runtime from 7.26.7 to 7.26.9 by @MrRio in parallax/jsPDF#3847

Fix parsing corrupt PNG images in addImage method by @HackbrettXXX in parallax/jsPDF#3880. The atob and btoa dependencies have been removed and the fast-png dependency has been added.

New Contributors

@WardenDrew made their first contribution in parallax/jsPDF#3872

Full Changelog: parallax/jsPDF@v3.0.1...v3.0.2

v3.0.1

This release fixes two security vulnerabilities:

Upgrade optional dependency canvg to 3.0.11

Fix a ReDoS vulnerability in the addImage method and the methods html and addSvgAsImage, which depend on addImage

v3.0.0

This major release officially drops support for Internet Explorer and fixes a security vulnerability in the html function by updating the optional dependency dompurify to v3.2.4. There are no other breaking changes.

New Contributors

@nlqivision made their first contribution in parallax/jsPDF#3812

@dependabot made their first contribution in parallax/jsPDF#3826

@hainenber made their first contribution in parallax/jsPDF#3827

Full Changelog: parallax/jsPDF@v2.5.2...v3.0.0

v2.5.2

This release upgrades the Dompurify dependency to 2.5.4 with fixes a vulnerability with high severity: GHSA-mmhx-hmjr-r674.

It also upgrades fflate, core-js, and @babel/runtime to more recent versions.

What's Changed

Implement justifying for unicode fonts by @owenl131 in parallax/jsPDF#3285

chore: update dompurify version 2.5.4 by @MarcioMeier in parallax/jsPDF#3768

[Snyk] Upgrade fflate from 0.4.8 to 0.8.1 by @MrRio in parallax/jsPDF#3666

[Snyk] Upgrade core-js from 3.6.5 to 3.33.0 by @MrRio in parallax/jsPDF#3664

[Snyk] Upgrade @babel/runtime from 7.14.6 to 7.23.2 by @MrRio in parallax/jsPDF#3665

Commits

543b356 3.0.2
4cf3ab6 Fix parsing corrupt PNG images in the addImage method (#3880)
7c51caa Correct the millimeter unit conversion constant in docs (#3872)
d8bfc9f fix: upgrade @babel/runtime from 7.26.7 to 7.26.9 (#3847)
57cbe94 3.0.1
7cf6ddf fix: upgrade @babel/runtime from 7.26.0 to 7.26.7 (#3832)
b167c43 improve performance of data url parsing in addimage (#3843)
c4b7421 don't use saucelabs in CI to be able to correctly run CI for PRs
6136d4b Upgrade canvg from 3.0.6 to 3.0.11 (#3836)
d0c605f 3.0.0
Additional commits viewable in compare view

Updates jsrsasign from 10.5.25 to 11.0.0

Release notes

Sourced from jsrsasign's releases.

remove RSA and RSAOAEP encryption for Marvin attack

Changes from 10.9.0 to 11.0.0 (2024-Jan-16)

remove RSA PKCS#1.5 end OAEP encryption/decryption for Marvin attack (#598)

src/crypto.js

remove KJUR.crypto.Cipher class for RSA and RSAOAEP encryption/decryption

ext/{rsa,rsa2}.js remove encrypt/decrypt/encryptOAEP/decryptOAEP for RSAKey class

enhanced support for encrypted PKCS8

Changes from 10.8.6 to 10.9.0 (2023-Nov-27)

KEYUTIL.getPEM is updated not to use weak ciphers (#599)

default encryptionScheme is changed from des-EDE3-CBC to aes256-CBC

default prf is changed from hmacWithSHA1 to hmacWithSHA256

src/keyutil.js

more encrypted PKCS#8 private key support

KEYUTIL.getKey now supports encrypted PKCS#8 private key with aes128-CBC, aes256-CBC encrypted and using hmacWithSHA224/256/384/512 as psudorandom function.

KEYUTIL.getPEM now supports such as above encrypted PKCS#8 PEM priavte key.

src/crypto.js

Cipher.decrypt/encrypt now supports symmetric ciphers (des-EDE3-CBC,aes128-CBC,aes256-CBC)

src/base64x.js

function inttohex and twoscompl are added

src/asn1.js

ASN1Util.bigIntToMinTwosComplementsHex is now DEPRECATED. use twoscompl.

src/asn1x509.js

aes*-CBC and hmacWithSHA* OIDs are added

test/qunit-do-{base64x,crypto-cipher,keyutil-eprv,keyutil,keyutil-p8egen}.html

update and add some test cases for above

stop bower support (bower.json removed)

X509.getExtSubjectDirectoryAttributes another bugfix

Changes from 10.8.5 to 10.8.6 (2023-Apr-26)

src/x509.js

another bugfix X509.getExtSubjectDirectoryAttributes method

X509.getExtSubjectDirectoryAttributes bugfix

Changes from 10.8.4 to 10.8.5 (2023-Apr-26)

src/x509.js

bugfix X509.getExtSubjectDirectoryAttributes method

more SubjectDirectoryExtension support

Changes from 10.8.3 to 10.8.4 (2023-Apr-26)

src/asn1x509.js

SubjectDirectoryAttributes class

add array of array support for arbitrary attribute value

src/x509.js

add X509.getExtSubjectDirectoryAttributes method for ExtSubjectDirectoryAttributes extension

... (truncated)

Changelog

Sourced from jsrsasign's changelog.

ChangeLog for jsrsasign

restore KJUR.crypto.Cipher class without RSA/RSAOAEP support

Changes from 11.0.0 to 11.1.0 (2024-Feb-01)

src/crypto.js

restore KJUR.crypto.Cipher class without RSA and RSAOAEP encryption/decryption support

remove RSA and RSAOAEP encryption for Marvin attack

Changes from 10.9.0 to 11.0.0 (2024-Jan-16)

remove RSA PKCS#1.5 end OAEP encryption/decryption for Marvin attack (#598)

src/crypto.js

remove KJUR.crypto.Cipher class for RSA and RSAOAEP encryption/decryption

ext/{rsa,rsa2}.js remove encrypt/decrypt/encryptOAEP/decryptOAEP for RSAKey class

enhanced support for encrypted PKCS8

Changes from 10.8.6 to 10.9.0 (2023-Nov-27)

KEYUTIL.getPEM is updated not to use weak ciphers (#599)

default encryptionScheme is changed from des-EDE3-CBC to aes256-CBC

default prf is changed from hmacWithSHA1 to hmacWithSHA256

src/keyutil.js

more encrypted PKCS#8 private key support

KEYUTIL.getKey now supports encrypted PKCS#8 private key with aes128-CBC, aes256-CBC encrypted and using hmacWithSHA224/256/384/512 as psudorandom function.

KEYUTIL.getPEM now supports such as above encrypted PKCS#8 PEM priavte key.

src/crypto.js

Cipher.decrypt/encrypt now supports symmetric ciphers (des-EDE3-CBC,aes128-CBC,aes256-CBC)

src/base64x.js

function inttohex and twoscompl are added

src/asn1.js

ASN1Util.bigIntToMinTwosComplementsHex is now DEPRECATED. use twoscompl.

src/asn1x509.js

aes*-CBC and hmacWithSHA* OIDs are added

test/qunit-do-{base64x,crypto-cipher,keyutil-eprv,keyutil,keyutil-p8egen}.html

update and add some test cases for above

stop bower support (bower.json removed)

X509.getExtSubjectDirectoryAttributes another bugfix

Changes from 10.8.5 to 10.8.6 (2023-Apr-26)

src/x509.js

another bugfix X509.getExtSubjectDirectoryAttributes method

X509.getExtSubjectDirectoryAttributes bugfix

Changes from 10.8.4 to 10.8.5 (2023-Apr-26)

src/x509.js

bugfix X509.getExtSubjectDirectoryAttributes method

... (truncated)

Commits

d73befc 11.0.0 release
32f73af update jsdoc
df54d0b enhanced support for encrypted PKCS8
59920c4 10.8.6 release
c195be8 10.8.5 release
04af7f5 10.8.4 release
d679050 10.8.3 release
97921fb 10.8.2 release
d332357 Merge pull request #583 from davedoesdev/master
1cfd939 Fix OAEP padding
Additional commits viewable in compare view

Updates mysql2 from 3.1.0 to 3.9.8

Release notes

Sourced from mysql2's releases.

v3.9.8

3.9.8 (2024-05-26)

Bug Fixes

security: sanitize fields and tables when using nestTables (#2702) (efe3db5)

support deno + caching_sha2_password FULL_AUTHENTICATION_PACKET flow (#2704) (2e03694)

typings: typo from jonServerPublicKey to onServerPublicKey (#2699) (8b5f691)

v3.9.7

3.9.7 (2024-04-21)

Bug Fixes

security: sanitize timezone parameter value to prevent code injection - report by zhaoyudi (Nebulalab) (#2608) (7d4b098)

v3.9.6

3.9.6 (2024-04-18)

Bug Fixes

binary parser sometimes reads out of packet bounds when results contain null and typecast is false (#2601) (705835d)

v3.9.5

3.9.5 (2024-04-17)

Bug Fixes

revert breaking change in results creation (#2591) (f7c60d0)

v3.9.4

3.9.4 (2024-04-09)

Bug Fixes

SSL: separate each certificate into an individual item #2542 (63f1055)

security: improve supportBigNumbers and bigNumberStrings sanitization (#2572) (74abf9e)

Fixes a potential RCE attack vulnerability reported by Vsevolod Kokorin (Slonser) of Solidlab

security: improve results object creation (#2574) (4a964a3)

Fixes a potential Prototype Pollution attack vulnerability reported by Vsevolod Kokorin (Slonser) of Solidlab

docs: improve the contribution guidelines (#2552) (8a818ce)

v3.9.3

3.9.3 (2024-03-26)

... (truncated)

Changelog

Sourced from mysql2's changelog.

3.9.8 (2024-05-26)

Bug Fixes

security: sanitize fields and tables when using nestTables (#2702) (efe3db5)

support deno + caching_sha2_password FULL_AUTHENTICATION_PACKET flow (#2704) (2e03694)

typings: typo from jonServerPublicKey to onServerPublicKey (#2699) (8b5f691)

3.9.7 (2024-04-21)

Bug Fixes

security: sanitize timezone parameter value to prevent code injection (#2608) (7d4b098)

3.9.6 (2024-04-18)

Bug Fixes

binary parser sometimes reads out of packet bounds when results contain null and typecast is false (#2601) (705835d)

3.9.5 (2024-04-17)

Bug Fixes

revert breaking change in results creation (#2591) (f7c60d0)

3.9.4 (2024-04-09)

Bug Fixes

docs: improve the contribution guidelines (#2552) (8a818ce)

security: improve results object creation (#2574) (4a964a3)

security: improve supportBigNumbers and bigNumberStrings sanitization (#2572) (74abf9e)

3.9.3 (2024-03-26)

Bug Fixes

security: improve cache key formation (#2424) (0d54b0c)

Fixes a potential parser cache poisoning attack vulnerability reported by Vsevolod Kokorin (Slonser) of Solidlab

update Amazon RDS SSL CA cert (#2131) (d9dccfd)

3.9.2 (2024-02-26)

... (truncated)

Commits

f637d3f chore(master): release 3.9.8 (#2700)
efe3db5 fix(security): sanitize fields and tables when using nestTables (#2702)
2e03694 fix: support deno + caching_sha2_password FULL_AUTHENTICATION_PACKET flow (#2...
8b5f691 fix(typings): typo from jonServerPublicKey to onServerPublicKey (#2699)
5c75802 build(deps-dev): bump tsx from 4.10.5 to 4.11.0 in /website (#2695)
179769f build(deps): bump @easyops-cn/docusaurus-search-local in /website (#2696)
56289e2 build(deps-dev): bump poku from 1.12.1 to 1.13.0 (#2698)
b029308 build(deps-dev): bump poku from 1.12.1 to 1.13.0 in /website (#2697)
539acb8 build(deps): bump lucide-react from 0.378.0 to 0.379.0 in /website (#2693)
dc80580 build(deps-dev): bump @typescript-eslint/eslint-plugin from 7.9.0 to 7.10.0 i...
Additional commits viewable in compare view

Updates esbuild from 0.17.9 to 0.25.0

Release notes

Sourced from esbuild's releases.

v0.25.0

This release deliberately contains backwards-incompatible changes. To avoid automatically picking up releases like this, you should either be pinning the exact version of esbuild in your package.json file (recommended) or be using a version range syntax that only accepts patch upgrades such as ^0.24.0 or ~0.24.0. See npm's documentation about semver for more information.
Restrict access to esbuild's development server (GHSA-67mh-4wv8-2f99)

This change addresses esbuild's first security vulnerability report. Previously esbuild set the Access-Control-Allow-Origin header to * to allow esbuild's development server to be flexible in how it's used for development. However, this allows the websites you visit to make HTTP requests to esbuild's local development server, which gives read-only access to your source code if the website were to fetch your source code's specific URL. You can read more information in the report.

Starting with this release, CORS will now be disabled, and requests will now be denied if the host does not match the one provided to --serve=. The default host is 0.0.0.0, which refers to all of the IP addresses that represent the local machine (e.g. both 127.0.0.1 and 192.168.0.1). If you want to customize anything about esbuild's development server, you can put a proxy in front of esbuild and modify the incoming and/or outgoing requests.

In addition, the serve() API call has been changed to return an array of hosts instead of a single host string. This makes it possible to determine all of the hosts that esbuild's development server will accept.

Thanks to @sapphi-red for reporting this issue.

Delete output files when a build fails in watch mode (#3643)

It has been requested for esbuild to delete files when a build fails in watch mode. Previously esbuild left the old files in place, which could cause people to not immediately realize that the most recent build failed. With this release, esbuild will now delete all output files if a rebuild fails. Fixing the build error and triggering another rebuild will restore all output files again.
Fix correctness issues with the CSS nesting transform (#3620, #3877, #3933, #3997, #4005, #4037, #4038)

This release fixes the following problems:
Naive expansion of CSS nesting can result in an exponential blow-up of generated CSS if each nesting level has multiple selectors. Previously esbuild sometimes collapsed individual nesting levels using :is() to limit expansion. However, this collapsing wasn't correct in some cases, so it has been removed to fix correctness issues.
/* Original code */
.parent {
  > .a,
  > .b1 > .b2 {
    color: red;
  }
}
/* Old output (with --supported:nesting=false) */
.parent > :is(.a, .b1 > .b2) {
color: red;
}
/* New output (with --supported:nesting=false) */
.parent > .a,
.parent > .b1 > .b2 {
color: red;
}
Thanks to @tim-we for working on a fix.
The & CSS nesting selector can be repeated multiple times to increase CSS specificity. Previously esbuild ignored this possibility and incorrectly considered && to have the same specificity as &. With this release, this should now work correctly:
/* Original code (color should be red) */

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2023

This changelog documents all esbuild versions published in the year 2023 (versions 0.16.13 through 0.19.11).

0.19.11
Fix TypeScript-specific class transform edge case (#3559)

The previous release introduced an optimization that avoided transforming super() in the class constructor for TypeScript code compiled with useDefineForClassFields set to false if all class instance fields have no initializers. The rationale was that in this case, all class instance fields are omitted in the output so no changes to the constructor are needed. However, if all of this is the case and there are #private instance fields with initializers, those private instance field initializers were still being moved into the constructor. This was problematic because they were being inserted before the call to super() (since super() is now no longer transformed in that case). This release introduces an additional optimization that avoids moving the private instance field initializers into the constructor in this edge case, which generates smaller code, matches the TypeScript compiler's output more closely, and avoids this bug:
// Original code
class Foo extends Bar {
  #private = 1;
  public: any;
  constructor() {
    super();
  }
}
// Old output (with esbuild v0.19.9)
class Foo extends Bar {
constructor() {
super();
this.#private = 1;
}
#private;
}
// Old output (with esbuild v0.19.10)
class Foo extends Bar {
constructor() {
this.#private = 1;
super();
}
#private;
}
// New output
class Foo extends Bar {
#private = 1;
constructor() {
super();
}
}
Minifier: allow reording a primitive past a side-effect (#3568)

The minifier previously allowed reordering a side-effect past a primitive, but didn't handle the case of reordering a primitive past a side-effect. This additional case is now handled:

... (truncated)

Commits

e9174d6 publish 0.25.0 to npm
c27dbeb fix hosts in plugin-tests.js
6794f60 fix hosts in node-unref-tests.js
de85afd Merge commit from fork
da1de1b fix #4065: bitwise operators can return bigints
f4e9d19 switch case liveness: default is always last
7aa47c3 fix #4028: minify live/dead switch cases better
22ecd30 minify: more constant folding for strict equality
4cdf03c fix #4053: reordering of .tsx in node_modules
dc71977 fix #3692: 0 now picks a random ephemeral port
Additional commits viewable in compare view

Updates postcss from 8.4.19 to 8.4.31

Release notes

Sourced from postcss's releases.

8.4.31

Fixed \r parsing to fix CVE-2023-44270.

8.4.30

Improved source map performance (by @romainmenke).

8.4.29

Fixed Node#source.offset (by @idoros).

Fixed docs (by @coliff).

8.4.28

Fixed Root.source.end for better source map (by @romainmenke).

Fixed Result.root types when process() has no parser.

8.4.27

Fixed Container clone methods types.

8.4.26

Fixed clone methods types.

8.4.25

Improve stringify performance (by @romainmenke).

Fixed docs (by @vikaskaliramna07).

8.4.24

Fixed Plugin types.

8.4.23

Fixed warnings in TypeDoc.

8.4.22

Fixed TypeScript support with node16 (by @remcohaszing).

8.4.21

Fixed Input#error types (by @hudochenkov).

8.4.20

Fixed source map generation for childless at-rules like @layer.

Changelog

Sourced from postcss's changelog.

8.4.31

Fixed \r parsing to fix CVE-2023-44270.

8.4.30

Improved source map performance (by Romain Menke).

8.4.29

Fixed Node#source.offset (by Ido Rosenthal).

Fixed docs (by Christian Oliff).

8.4.28

Fixed Root.source.end for better source map (by Romain Menke).

Fixed Result.root types when process() has no parser.

8.4.27

Fixed Container clone methods types.

8.4.26

Fixed clone methods types.

8.4.25

Improve stringify performance (by Romain Menke).

Fixed docs (by @vikaskaliramna07).

8.4.24

Fixed Plugin types.

8.4.23

Fixed warnings in TypeDoc.

8.4.22

Fixed TypeScript support with node16 (by Remco Haszing).

8.4.21

Fixed Input#error types (by Aleks Hudochenkov).

8.4.20

Fixed source map generation for childless at-rules like @layer.

Commits

90208de Release 8.4.31 version
58cc860 Fix carrier return parsing
4fff8e4 Improve pnpm test output
cd43ed1 Update dependencies
caa916b Update dependencies
8972f76 Typo
11a5286 Typo
45c5501 Release 8.4.30 version
bc3c341 Update linter
b2be58a Merge pull request #1881 from romainmenke/improve-sourcemap-performance--phil...
Additional commits viewable in compare view

Updates webpack from 5.85.0 to 5.94.0

Release notes

Sourced from webpack's releases.

v5.94.0

Bug Fixes

Added runtime condition for harmony reexport checked

Handle properly data/http/https protocols in source maps

Make bigint optimistic when browserslist not found

Move @types/eslint-scope to dev deps

Related in asset stats is now always an array when no related found

Handle ASI for export declarations

Mangle destruction incorrect with export named default properly

Fixed unexpected asi generation with sequence expression

Fixed a lot of types

New Features

Added new external type "module-import"

Support webpackIgnore for new URL() construction

[CSS] @import pathinfo support

Security

Fixed DOM clobbering in auto public path

v5.93.0

Bug Fixes

Generate correct relative path to runtime chunks

Makes DefinePlugin quieter under default log level

Fixed mangle destructuring default in namespace import

Fixed consumption of eager shared modules for module federation

Strip slash for pretty regexp

Calculate correct contenthash for CSS generator options

New Features

Added the binary generator option for asset modules to explicitly keep source maps produced by loaders

Added the modern-module library value for tree shakable output

Added the overrideStrict option to override strict or non-strict mode for javascript modules

v5.92.1

Bug Fixes

Doesn't crash with an error when the css experiment is enabled and contenthash is used

v5.92.0

Bug Fixes

Correct tidle range's comutation for module federation

Consider runtime for pure expression dependency update hash

Return value in the subtractRuntime function for runtime logic

... (truncated)

Commits

eabf85d chore(release): 5.94.0
955e057 security: fix DOM clobbering in auto public path
9822387 test: fix
cbb86ed test: fix
5ac3d7f fix: unexpected asi generation with sequence expression
2411661 security: fix DOM clobbering in auto public path
b8c03d4 fix: unexpected asi generation with sequence expression
f46a03c revert: do not use heuristic fallback for "module-import"
60f1898 fix: do not use heuristic fallback for "module-import"
66306aa Revert "fix: module-import get fallback from externalsPresets"
Additional commits viewable in compare view

Updates webpack-dev-server from 4.15.0 to 5.2.1

Release notes

Sourced from webpack-dev-server's releases.

v5.2.1

5.2.1 (2025-03-26)

Security

cross-origin requests are not allowed unless allowed by Access-Control-Allow-Origin header

requests with an IP addresses in the Origin header are not allowed to connect to WebSocket server unless configured by allowedHosts or it different from the Host header

The above changes may make the dev server not work if you relied on such behavior, but unfortunately they carry security risks, so they were considered as fixes.

Bug Fixes

prevent overlay for errors caught by React error boundaries (#5431) (8c1abc9)

take the first network found instead of the last one, this restores the same behavior as 5.0.4 (#5411) (ffd0b86)

v5.2.0

5.2.0 (2024-12-11)

Features

added getClientEntry and getClientHotEntry methods to get clients entries (dc642a8)

Bug Fixes

speed up initial client bundling (145b5d0)

v5.1.0

5.1.0 (2024-09-03)

Features

add visual progress indicators (a8f40b7)

added the app option to be Function (by default only with connect compatibility frameworks) (3096148)

allow the server option to be Function (#5275) (02a1c6d)

http2 support for connect and connect compatibility frameworks which support HTTP2 (#5267) (6509a3f)

Bug Fixes

check the platform property to determinate the target (#5269) (c3b532c)

ipv6 output (#5270) (06005e7)

replace rimraf with rm (#5162) (1a1561f)

replace default gateway (#5255) (f5f0902)

support devServer: false (#5272) (8b341cb)

v5.0.4

5.0.4 (2024-03-19)

... (truncated)

Changelog

Sourced from webpack-dev-server's changelog.

5.2.1 (2025-03-26)

Security

cross-origin requests are not allowed unless allowed by Access-Control-Allow-Origin header

requests with an IP addresses in the Origin header are not allowed to connect to WebSocket server unless configured by allowedHosts or it different from the Host header

The above changes may make the dev server not work if you relied on such behavior, but unfortunately they carry security risks, so they were considered as fixes.

Bug Fixes

prevent overlay for errors caught by React error boundaries (#5431) (8c1abc9)

take the first network found instead of the last one, this restores the same behavior as 5.0.4 (#5411) (ffd0b86)

5.2.0 (2024-12-11)

Features

added getClientEntry and getClientHotEntry methods to get clients entries (dc642a8)

Bug Fixes

speed up initial client bundling (145b5d0)

5.1.0 (2024-09-03)

Features

add visual progress indicators (a8f40b7)

added the app option to be Function (by default only with connect compatibility frameworks) (3096148)

allow the server option to be Function (#5275) (02a1c6d)

http2 support for connect and connect compatibility frameworks which support HTTP2 (#5267) (6509a3f)

Bug Fixes

check the platform property to determinate the target (#5269) (c3b532c)

ipv6 output (#5270) (06005e7)

replace rimraf with rm (#5162) (1a1561f)

replace default gateway (#5255) (f5f0902)

support devServer: false (#5272) (8b341cb)

5.0.4 (2024-03-19)

Bug Fixes

... (truncated)

Commits

0d22a08 chore(release): 5.2.1
6045b1e chore(deps): update (#5444)
ffd0b86 fix: take the first network found instead of the last one, this restores the ...
9ea7b08 ci: update dependency-review-action (#5442)
5c9378b Merge commit from fork
d2575ad Merge commit from fork
8c1abc9 fix: prevent overlay for errors caught by React error boundaries (#5431)
5a39c70 ci: update codecov/codecov-action to v5 (#5406)
55220a8 chore(deps-dev): bump the dependencies group across 1 directory with 4 update...
09f6f8e chore(deps): bump the dependencies group across 1 directory with 2 updates (#...
Additional commits viewable in compare view

Updates @adobe/css-tools from 4.0.1 to 4.4.4

Changelog

Sourced from @adobe/css-tools's changelog.

[4.4.4] - 2025-07-22

Changed

Switch from yarn to npm for package management

Switch from eslint to biome for code formatting and linting

Reformat codebase to comply with biome recommendations

Switch from webpack to rollup for bundling

Fixed

Fix module exports to ensure proper compatibility with bundlers

Add validation check to prevent future export issues

[4.4.3] - 2025-05-15

Security

Fix polynomial regular expression vulnerability on uncontrolled data

Refactor code to enable GitHub security static analysis

Performance

Improve parsing performance with minor optimizations

Replace regex patterns with string search (indexOf-based) for better performance

Added

Add new utility functions with comprehensive unit tests

Add improved formatting for CSS Grid template areas (#283 by @jogibear9988)

Fixed

Fix TypeScript error with ConstructorParameters in Parcel bundler (#444)

[4.4.2] - 2025-02-12

Fixed

Fix regular expression for parsing quoted values in parentheses

[4.4.0] - 2024-06-05

Added

Add support for CSS @starting-style at-rule (#319)

[4.3.3] - 2024-01-24

Changed

Update package export configuration (#271)

[4.3.2] - 2023-11-28

Security

Fix ReDoS vulnerability with crafted CSS strings - CVE-2023-48631

Fixed

... (truncated)

Commits

See full diff in compare view

Updates @babel/traverse from 7.12.1 to 7.28.4

Release notes

Sourced from @babel/traverse's releases.

v7.28.4 (2025-09-05)

Thanks @gwillen and @mrginglymus for your first PRs!

🏠 Internal

babel-core, babel-helper-check-duplicate-nodes, babel-traverse, babel-types

#17493 Update Jest to v30.1.1 (@JLHwung)

babel-plugin-transform-regenerator

#17455 chore: Clean up transform-regenerator (@liuxingbaoyu)

babel-core

#17474 Switch to @jridgewell/remapping (@mrginglymus)

Committers: 5

Babel Bot (@babel-bot)

Bill Collins (@mrginglymus)

Glenn Willen (@gwillen)

Huáng Jùnliàng (@JLHwung)

@liuxingbaoyu

v7.28.3 (2025-08-14)

👓 Spec Compliance

babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators, babel-plugin-transform-class-static-block, babel-preset-env

#17443 [static blocks] Do not inject new static fields after static code (@nicolo-ribaudo)

🐛 Bug Fix

babel-parser

#17465 fix(parser/typescript): parse import("./a", {with:{},}) (@easrng)

#17478 fix(parser): stop subscript parsing on async arrow (@JLHwung)

💅 Polish

babel-plugin-transform-regenerator, babel-plugin-transform-runtime

#17363 Do not save last yield in call in temp var (@nicolo-ribaudo)

📝 Documentation

#17448 move eslint-{parser,plugin} docs to the website (@JLHwung)

🏠 Internal

#17454 Enable type checking for scripts and babel-worker.cjs (@JLHwung)

🔬 Output optimization

babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions

#17444 Optimize do expression output (Description has been truncated

Bumps the npm_and_yarn group with 22 updates in the / directory: | Package | From | To | | --- | --- | --- | | [jspdf](https://github.com/parallax/jsPDF) | `2.5.1` | `3.0.2` | | [jsrsasign](https://github.com/kjur/jsrsasign) | `10.5.25` | `11.0.0` | | [mysql2](https://github.com/sidorares/node-mysql2) | `3.1.0` | `3.9.8` | | [esbuild](https://github.com/evanw/esbuild) | `0.17.9` | `0.25.0` | | [postcss](https://github.com/postcss/postcss) | `8.4.19` | `8.4.31` | | [webpack](https://github.com/webpack/webpack) | `5.85.0` | `5.94.0` | | [webpack-dev-server](https://github.com/webpack/webpack-dev-server) | `4.15.0` | `5.2.1` | | [@adobe/css-tools](https://github.com/adobe/css-tools) | `4.0.1` | `4.4.4` | | [@babel/traverse](https://github.com/babel/babel/tree/HEAD/packages/babel-traverse) | `7.12.1` | `7.28.4` | | [browserify-sign](https://github.com/crypto-browserify/browserify-sign) | `4.2.1` | `4.2.5` | | [cipher-base](https://github.com/crypto-browserify/cipher-base) | `1.0.4` | `1.0.7` | | [color-string](https://github.com/Qix-/color-string) | `1.5.4` | `1.9.1` | | [elliptic](https://github.com/indutny/elliptic) | `6.5.3` | `6.6.1` | | [fast-loops](https://github.com/robinweser/fast-loops) | `1.1.3` | `1.1.4` | | [follow-redirects](https://github.com/follow-redirects/follow-redirects) | `1.13.0` | `1.15.11` | | [http-cache-semantics](https://github.com/kornelski/http-cache-semantics) | `4.1.0` | `4.2.0` | | [jsonata](https://github.com/jsonata-js/jsonata) | `1.8.6` | `1.8.7` | | [path-parse](https://github.com/jbgutierrez/path-parse) | `1.0.6` | `1.0.7` | | [sha.js](https://github.com/crypto-browserify/sha.js) | `2.4.11` | `2.4.12` | | [store2](https://github.com/nbubna/store) | `2.12.0` | `2.14.4` | | [tar](https://github.com/isaacs/node-tar) | `6.1.11` | `6.2.1` | | [ua-parser-js](https://github.com/faisalman/ua-parser-js) | `0.7.23` | `0.7.41` | Updates `jspdf` from 2.5.1 to 3.0.2 - [Release notes](https://github.com/parallax/jsPDF/releases) - [Changelog](https://github.com/parallax/jsPDF/blob/master/RELEASE.md) - [Commits](parallax/jsPDF@v2.5.1...v3.0.2) Updates `jsrsasign` from 10.5.25 to 11.0.0 - [Release notes](https://github.com/kjur/jsrsasign/releases) - [Changelog](https://github.com/kjur/jsrsasign/blob/master/ChangeLog.txt) - [Commits](kjur/jsrsasign@10.5.25...11.0.0) Updates `mysql2` from 3.1.0 to 3.9.8 - [Release notes](https://github.com/sidorares/node-mysql2/releases) - [Changelog](https://github.com/sidorares/node-mysql2/blob/master/Changelog.md) - [Commits](sidorares/node-mysql2@v3.1.0...v3.9.8) Updates `esbuild` from 0.17.9 to 0.25.0 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2023.md) - [Commits](evanw/esbuild@v0.17.9...v0.25.0) Updates `postcss` from 8.4.19 to 8.4.31 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.4.19...8.4.31) Updates `webpack` from 5.85.0 to 5.94.0 - [Release notes](https://github.com/webpack/webpack/releases) - [Commits](webpack/webpack@v5.85.0...v5.94.0) Updates `webpack-dev-server` from 4.15.0 to 5.2.1 - [Release notes](https://github.com/webpack/webpack-dev-server/releases) - [Changelog](https://github.com/webpack/webpack-dev-server/blob/main/CHANGELOG.md) - [Commits](webpack/webpack-dev-server@v4.15.0...v5.2.1) Updates `@adobe/css-tools` from 4.0.1 to 4.4.4 - [Changelog](https://github.com/adobe/css-tools/blob/main/docs/CHANGELOG.md) - [Commits](https://github.com/adobe/css-tools/commits) Updates `@babel/traverse` from 7.12.1 to 7.28.4 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.28.4/packages/babel-traverse) Updates `body-parser` from 1.19.0 to 1.20.3 - [Release notes](https://github.com/expressjs/body-parser/releases) - [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md) - [Commits](expressjs/body-parser@1.19.0...1.20.3) Updates `browserify-sign` from 4.2.1 to 4.2.5 - [Changelog](https://github.com/browserify/browserify-sign/blob/main/CHANGELOG.md) - [Commits](browserify/browserify-sign@v4.2.1...v4.2.5) Updates `canvg` from 3.0.10 to 3.0.11 - [Release notes](https://github.com/canvg/canvg/releases) - [Changelog](https://github.com/canvg/canvg/blob/v3.0.11/CHANGELOG.md) - [Commits](https://github.com/canvg/canvg/commits/v3.0.11) Updates `cipher-base` from 1.0.4 to 1.0.7 - [Changelog](https://github.com/browserify/cipher-base/blob/master/CHANGELOG.md) - [Commits](browserify/cipher-base@v1.0.4...v1.0.7) Updates `color-string` from 1.5.4 to 1.9.1 - [Release notes](https://github.com/Qix-/color-string/releases) - [Changelog](https://github.com/Qix-/color-string/blob/master/CHANGELOG.md) - [Commits](Qix-/color-string@1.5.4...1.9.1) Updates `dompurify` from 2.4.5 to 3.2.7 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@2.4.5...3.2.7) Updates `elliptic` from 6.5.3 to 6.6.1 - [Commits](indutny/elliptic@v6.5.3...v6.6.1) Updates `express` from 4.17.1 to 4.21.2 - [Release notes](https://github.com/expressjs/express/releases) - [Changelog](https://github.com/expressjs/express/blob/4.21.2/History.md) - [Commits](expressjs/express@4.17.1...4.21.2) Updates `fast-loops` from 1.1.3 to 1.1.4 - [Commits](https://github.com/robinweser/fast-loops/commits) Updates `follow-redirects` from 1.13.0 to 1.15.11 - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.13.0...v1.15.11) Updates `http-cache-semantics` from 4.1.0 to 4.2.0 - [Commits](https://github.com/kornelski/http-cache-semantics/commits) Updates `http-proxy-middleware` from 2.0.6 to 2.0.9 - [Release notes](https://github.com/chimurai/http-proxy-middleware/releases) - [Changelog](https://github.com/chimurai/http-proxy-middleware/blob/v2.0.9/CHANGELOG.md) - [Commits](chimurai/http-proxy-middleware@v2.0.6...v2.0.9) Updates `jsonata` from 1.8.6 to 1.8.7 - [Release notes](https://github.com/jsonata-js/jsonata/releases) - [Changelog](https://github.com/jsonata-js/jsonata/blob/v1.8.7/CHANGELOG.md) - [Commits](jsonata-js/jsonata@v1.8.6...v1.8.7) Updates `nanoid` from 3.1.31 to 3.3.11 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](ai/nanoid@3.1.31...3.3.11) Updates `path-parse` from 1.0.6 to 1.0.7 - [Commits](https://github.com/jbgutierrez/path-parse/commits/v1.0.7) Updates `path-to-regexp` from 0.1.7 to 0.1.12 - [Release notes](https://github.com/pillarjs/path-to-regexp/releases) - [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md) - [Commits](pillarjs/path-to-regexp@v0.1.7...v0.1.12) Updates `sha.js` from 2.4.11 to 2.4.12 - [Changelog](https://github.com/browserify/sha.js/blob/master/CHANGELOG.md) - [Commits](browserify/sha.js@v2.4.11...v2.4.12) Updates `store2` from 2.12.0 to 2.14.4 - [Commits](nbubna/store@2.12.0...2.14.4) Updates `tar` from 6.1.11 to 6.2.1 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v6.1.11...v6.2.1) Updates `ua-parser-js` from 0.7.23 to 0.7.41 - [Release notes](https://github.com/faisalman/ua-parser-js/releases) - [Changelog](https://github.com/faisalman/ua-parser-js/blob/master/CHANGELOG.md) - [Commits](faisalman/ua-parser-js@0.7.23...0.7.41) --- updated-dependencies: - dependency-name: jspdf dependency-version: 3.0.2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: jsrsasign dependency-version: 11.0.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: mysql2 dependency-version: 3.9.8 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: esbuild dependency-version: 0.25.0 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.4.31 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: webpack dependency-version: 5.94.0 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: webpack-dev-server dependency-version: 5.2.1 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: "@adobe/css-tools" dependency-version: 4.4.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@babel/traverse" dependency-version: 7.28.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: body-parser dependency-version: 1.20.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: browserify-sign dependency-version: 4.2.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: canvg dependency-version: 3.0.11 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: cipher-base dependency-version: 1.0.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: color-string dependency-version: 1.9.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: dompurify dependency-version: 3.2.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: elliptic dependency-version: 6.6.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: express dependency-version: 4.21.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-loops dependency-version: 1.1.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: follow-redirects dependency-version: 1.15.11 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: http-cache-semantics dependency-version: 4.2.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: http-proxy-middleware dependency-version: 2.0.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: jsonata dependency-version: 1.8.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: nanoid dependency-version: 3.3.11 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: path-parse dependency-version: 1.0.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: path-to-regexp dependency-version: 0.1.12 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: sha.js dependency-version: 2.4.12 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: store2 dependency-version: 2.14.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tar dependency-version: 6.2.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ua-parser-js dependency-version: 0.7.41 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 2, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the npm_and_yarn group across 1 directory with 29 updates#12

Bump the npm_and_yarn group across 1 directory with 29 updates#12
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/npm_and_yarn/npm_and_yarn-cf68404159

dependabot Bot commented on behalf of github Oct 2, 2025

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 2, 2025

v3.0.2

What's Changed

New Contributors

v3.0.1

v3.0.0

New Contributors

v2.5.2

What's Changed

remove RSA and RSAOAEP encryption for Marvin attack

enhanced support for encrypted PKCS8

X509.getExtSubjectDirectoryAttributes another bugfix

X509.getExtSubjectDirectoryAttributes bugfix

more SubjectDirectoryExtension support

v3.9.8

3.9.8 (2024-05-26)

Bug Fixes

v3.9.7

3.9.7 (2024-04-21)

Bug Fixes

v3.9.6

3.9.6 (2024-04-18)

Bug Fixes

v3.9.5

3.9.5 (2024-04-17)

Bug Fixes

v3.9.4

3.9.4 (2024-04-09)

Bug Fixes

v3.9.3

3.9.3 (2024-03-26)

3.9.8 (2024-05-26)

Bug Fixes

3.9.7 (2024-04-21)

Bug Fixes

3.9.6 (2024-04-18)

Bug Fixes

3.9.5 (2024-04-17)

Bug Fixes

3.9.4 (2024-04-09)

Bug Fixes

3.9.3 (2024-03-26)

Bug Fixes

3.9.2 (2024-02-26)

v0.25.0

Changelog: 2023

0.19.11

8.4.31

8.4.30

8.4.29

8.4.28

8.4.27

8.4.26

8.4.25

8.4.24

8.4.23

8.4.22

8.4.21

8.4.20

8.4.31

8.4.30

8.4.29

8.4.28

8.4.27

8.4.26

8.4.25

8.4.24

8.4.23

8.4.22

8.4.21

8.4.20

v5.94.0

Bug Fixes

New Features

Security

v5.93.0

Bug Fixes

New Features

v5.92.1