Bumps the npm_and_yarn group with 2 updates in the / directory: [@octokit/request](https://github.com/octokit/request.js) and [flatted](https://github.com/WebReflection/flatted).
Bumps the npm_and_yarn group with 9 updates in the /crypto directory:
| Package | From | To |
| --- | --- | --- |
| [semver](https://github.com/npm/node-semver) | `5.7.1` | `5.7.2` |
| [ajv](https://github.com/ajv-validator/ajv) | `6.12.6` | `6.14.0` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.11` | `1.1.12` |
| [cross-spawn](https://github.com/moxystudio/node-cross-spawn) | `6.0.5` | `6.0.6` |
| [form-data](https://github.com/form-data/form-data) | `2.3.3` | `3.0.4` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `3.14.1` | `3.14.2` |
| [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.17.23` |
| [minimatch](https://github.com/isaacs/minimatch) | `3.0.4` | `3.1.5` |
| [@babel/helpers](https://github.com/babel/babel/tree/HEAD/packages/babel-helpers) | `7.13.10` | `7.29.2` |
Updates `@octokit/request` from 5.4.14 to 8.4.1
- [Release notes](https://github.com/octokit/request.js/releases)
- [Commits](octokit/request.js@v5.4.14...v8.4.1)
Updates `@octokit/request-error` from 1.2.1 to 5.1.1
- [Release notes](https://github.com/octokit/request-error.js/releases)
- [Commits](octokit/request-error.js@v1.2.1...v5.1.1)
Updates `flatted` from 2.0.2 to 3.4.2
- [Commits](WebReflection/flatted@v2.0.2...v3.4.2)
Updates `tmp` from 0.0.33 to 0.1.0
- [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md)
- [Commits](raszi/node-tmp@v0.0.33...v0.1.0)
Updates `semver` from 5.7.1 to 5.7.2
- [Release notes](https://github.com/npm/node-semver/releases)
- [Changelog](https://github.com/npm/node-semver/blob/v5.7.2/CHANGELOG.md)
- [Commits](npm/node-semver@v5.7.1...v5.7.2)
Updates `ajv` from 6.12.6 to 6.14.0
- [Release notes](https://github.com/ajv-validator/ajv/releases)
- [Commits](ajv-validator/ajv@v6.12.6...v6.14.0)
Updates `brace-expansion` from 1.1.11 to 1.1.12
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@1.1.11...v1.1.12)
Updates `cross-spawn` from 6.0.5 to 6.0.6
- [Changelog](https://github.com/moxystudio/node-cross-spawn/blob/v6.0.6/CHANGELOG.md)
- [Commits](moxystudio/node-cross-spawn@v6.0.5...v6.0.6)
Updates `form-data` from 2.3.3 to 3.0.4
- [Release notes](https://github.com/form-data/form-data/releases)
- [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md)
- [Commits](https://github.com/form-data/form-data/commits/v3.0.4)
Updates `js-yaml` from 3.14.1 to 3.14.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@3.14.1...3.14.2)
Updates `lodash` from 4.17.21 to 4.17.23
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.17.23)
Updates `minimatch` from 3.0.4 to 3.1.5
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v3.0.4...v3.1.5)
Updates `@babel/helpers` from 7.13.10 to 7.29.2
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.29.2/packages/babel-helpers)
Updates `ws` from 3.3.3 to 7.5.10
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@3.3.3...7.5.10)
---
updated-dependencies:
- dependency-name: "@octokit/request"
dependency-version: 8.4.1
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: "@octokit/request-error"
dependency-version: 5.1.1
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: flatted
dependency-version: 3.4.2
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: tmp
dependency-version: 0.1.0
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: semver
dependency-version: 5.7.2
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: ajv
dependency-version: 6.14.0
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: brace-expansion
dependency-version: 1.1.12
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: cross-spawn
dependency-version: 6.0.6
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: form-data
dependency-version: 3.0.4
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: js-yaml
dependency-version: 3.14.2
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: lodash
dependency-version: 4.17.23
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: minimatch
dependency-version: 3.1.5
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: "@babel/helpers"
dependency-version: 7.29.2
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: ws
dependency-version: 7.5.10
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
added
dependencies
Bumps the npm_and_yarn group with 2 updates in the / directory: @octokit/request and flatted.
Bumps the npm_and_yarn group with 9 updates in the /crypto directory:
5.7.15.7.26.12.66.14.01.1.111.1.126.0.56.0.62.3.33.0.43.14.13.14.24.17.214.17.233.0.43.1.57.13.107.29.2Updates
@octokit/requestfrom 5.4.14 to 8.4.1Release notes
Sourced from
@octokit/request's releases.... (truncated)
Commits
356411efix: ReDos regex vulnerability, reported by@DayShift(#741)abc4955feat: re-addredirectrequest option (#636)4e7127cfix: upgrade@octokit/endpoint2e67925feat(security): Add provenance (#685)6822e8bfix: upgrade@octokit/typesdbfeab2feat: add documentation link in error message (#667)c013de4docs: fix spelling errors (#671)3d22c38chore(deps): update dependency prettier to v3.2.5984ec17chore(deps): update dependency esbuild to ^0.20.02a9cf78ci(action): update peter-evans/create-or-update-comment action to v4Updates
@octokit/request-errorfrom 1.2.1 to 5.1.1Release notes
Sourced from
@octokit/request-error's releases.... (truncated)
Commits
b51ed27test: ReDos regex vulnerability, reported by@dayshift12a14f0fix: ReDos regex vulnerability, reported by@dayshift3af20bdfix: upgrade@octokit/typesto v1394147e8feat(security): Add provenance (#416)590fc39fix(deps): update dependency@octokit/typesto v12 (#366)4b9c57eci(action): update peter-evans/create-or-update-comment digest to 46da6c0710afc3ci(action): update peter-evans/create-or-update-comment digest to 1f6c514c82c8ceci(action): update peter-evans/create-or-update-comment digest to 223779bec24eadci(action): update peter-evans/create-or-update-comment digest to 46846e5 (#362)365f18dci(action): update actions/checkout action to v4Maintainer changes
This version was pushed to npm by octokitbot, a new releaser for
@octokit/request-errorsince your current version.Updates
flattedfrom 2.0.2 to 3.4.2Commits
3bf09093.4.2885ddccfix CWE-13210bdba70added flatted-view to the benchmark2a02dce3.4.1fba4e8fMerge pull request #89 from WebReflection/python-fix5fe8648added "when in Rome" also a test for PHP53517adsome minor improvementb3e2a0cFixing recursion issue in Python tooc4b46dbAdd SECURITY.md for security policy and reportingf86d071Create dependabot.yml for version updatesUpdates
tmpfrom 0.0.33 to 0.1.0Changelog
Sourced from tmp's changelog.
Commits
05aba23Merge pull request #188 from raszi/gh-1870f7a3d4fix #187: restore behaviour for #18269ad512Merge pull request #177 from raszi/gh-17684cea56Merge pull request #184 from raszi/gh-1825591fdfchore: remove duplicate dependencies section from package.json48b9f72fix gh-176: fail early if there is no tmp dir specified, add rimraf dependenc...150ab4eMerge pull request #159 from raszi/gh-121bd853cbfix test for #1210c5bc5cmerge rebase to master153ddbbcleaning upUpdates
semverfrom 5.7.1 to 5.7.2Release notes
Sourced from semver's releases.
Changelog
Sourced from semver's changelog.
Commits
f8cc313chore: release 5.7.22f8fd41fix: better handling of whitespace (#585)deb5ad5chore:@npmcli/template-oss@4.16.0Maintainer changes
This version was pushed to npm by lukekarrys, a new releaser for semver since your current version.
Updates
ajvfrom 6.12.6 to 6.14.0Commits
e3af0a76.14.0b552ed6add regExp option to address $data exploit via a regular expression (CVE-2025...72f2286docs: update v7 info231e52bMerge pull request #1320 from philsturgeon/patch-1d3475fcAdd spectral, an AJV util from a sponsor413afe0docs: v7.0.0-beta.311e997bupdate readme for v7Updates
brace-expansionfrom 1.1.11 to 1.1.12Release notes
Sourced from brace-expansion's releases.
Commits
44f33b41.1.12c460dbdpkg: publish on tag 1.xccb8ac6fmtc3c73c8Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65)Updates
cross-spawnfrom 6.0.5 to 6.0.6Changelog
Sourced from cross-spawn's changelog.
Commits
d35c865chore(release): 6.0.65a37e19chore: update package.json and package.lockba5aaeffix: disable regexp backtracking (#160)f4af31cfix(core): support worker threads (#127)Updates
form-datafrom 2.3.3 to 3.0.4Release notes
Sourced from form-data's releases.
Changelog
Sourced from form-data's changelog.
... (truncated)
Commits
Maintainer changes
This version was pushed to npm by ljharb, a new releaser for form-data since your current version.
Install script changes
This version modifies
prepublishscript that runs during installation. Review the package contents before updating.Updates
js-yamlfrom 3.14.1 to 3.14.2Changelog
Sourced from js-yaml's changelog.
... (truncated)
Commits
9963d363.14.2 released10d3c8edist rebuild5278870fix prototype pollution in merge (<<) (#731)Updates
lodashfrom 4.17.21 to 4.17.23Commits
dec55b7Bump main to v4.17.23 (#6088)19c9251fix: setCacheHas JSDoc return type should be boolean (#6071)b5e6729jsdoc: Add -0 and BigInt zeros to _.compact falsey values list (#6062)edadd45Prevent prototype pollution on baseUnset function4879a7adoc: fix autoLink function, conversion of source links (#6056)9648f69chore: removeyarn.lockfile (#6053)dfa407dci: remove legacy configuration files (#6052)156e196feat: add renovate setup (#6039)933e106ci: add pipeline for Bun (#6023)072a807docs: update links related to Open JS Foundation (#5968)Updates
minimatchfrom 3.0.4 to 3.1.5Commits
7bba9783.1.5bd25942docs: add warning about ReDoS1a9c27cfix partial matching of globstar patterns1a2e0843.1.4ae24656update lockfileb100374limit recursion for **, improve perf considerably26ffeaalockfile update9eca892lock node version to 1400c323b3.1.330486b2update CI matrix and actionsUpdates
@babel/helpersfrom 7.13.10 to 7.29.2Release notes
Sourced from
@babel/helpers's releases.... (truncated)
Commits
37d5595v7.29.21c0a08d[7.x backport] fix: Properly handle await in finally (#17805)d7f4008v7.28.699dcba5chore: enable some ts-eslint rules (#17592)c1b55f6Useeslint.config.mts(#17573)35055e3v7.28.418d88b8Improve@babel/coretypings (#17471)ef155f5v7.28.3741cbd2chore: fix various typos across codebase (#17476)cac0ff4v7.28.2Maintainer changes
This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for
@babel/helperssince your current version.Updates
wsfrom 3.3.3 to 7.5.10Release notes
Sourced from ws's releases.
... (truncated)
Commits
d962d70[dist] 7.5.1022c2876[security] Fix crash when the Upgrade header cannot be read (#2231)8a78f87[dist] 7.5.90435e6e[security] Fix same host check for ws+unix: redirects4271f07[dist] 7.5.8dc1781b[security] Drop sensitive headers when following insecure redirects2758ed3[fix] Abort the handshake if the Upgrade header is invalida370613[dist] 7.5.71f72e2e[security] Drop sensitive headers when following redirects (#2013)8ecd890[dist] 7.5.6Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.