Bump the npm_and_yarn group across 7 directories with 14 updates by dependabot[bot] · Pull Request #22 · SoftwareExplorer6600/react

dependabot · 2026-05-19T16:04:48Z

Bumps the npm_and_yarn group with 10 updates in the / directory:

Package	From	To
electron	`23.1.2`	`39.8.5`
webpack-dev-server	`4.15.0`	`5.2.4`
@babel/plugin-transform-modules-systemjs	`7.10.5`	`7.29.4`
fast-xml-parser	`3.19.0`	`3.21.1`
follow-redirects	`1.15.6`	`1.16.0`
lodash	`4.17.21`	`4.18.1`
node-forge	`1.3.1`	`1.4.0`
protocol-buffers-schema	`3.3.2`	`3.6.1`
serialize-javascript	`6.0.1`	`6.0.2`
simple-git	`3.28.0`	`3.36.0`

Bumps the npm_and_yarn group with 6 updates in the /compiler directory:

Package	From	To
@babel/plugin-transform-modules-systemjs	`7.25.9`	`7.29.4`
follow-redirects	`1.15.6`	`1.16.0`
lodash	`4.17.21`	`4.18.1`
path-to-regexp	`8.2.0`	`8.4.2`
axios	`1.7.4`	`1.16.1`
basic-ftp	`5.0.5`	`5.3.1`

Bumps the npm_and_yarn group with 4 updates in the /compiler/apps/playground directory: follow-redirects, lodash, axios and next.
Bumps the npm_and_yarn group with 1 update in the /packages/react-devtools-extensions directory: webpack-dev-server.
Bumps the npm_and_yarn group with 1 update in the /packages/react-devtools-inline directory: webpack-dev-server.
Bumps the npm_and_yarn group with 1 update in the /packages/react-devtools-shell directory: webpack-dev-server.
Bumps the npm_and_yarn group with 1 update in the /packages/react-devtools-timeline directory: webpack-dev-server.

Updates electron from 23.1.2 to 39.8.5

Release notes

Sourced from electron's releases.

electron v39.8.5

Release Notes for v39.8.5

Fixes

Fixed a crash in clipboard.readImage() when the clipboard contains malformed image data. #50493 (Also in 40, 41, 42)

Fixed a crash when calling an offscreen shared texture's release() after the texture object was garbage collected. #50499 (Also in 40, 41, 42)

electron v39.8.4

Release Notes for v39.8.4

Fixes

Fixed an issue where nodeIntegrationInWorker overrides in setWindowOpenHandler were not honored for child windows sharing a renderer process with their opener. #50468 (Also in 38, 40, 41)

Fixed crash when handling JavaScript dialogs from windows opened with invalid or empty URLs. #50400 (Also in 40, 41, 42)

Fixed improper focus tracking in BaseWindow on MacOS. #50338 (Also in 40, 41, 42)

Fixed window freeze when failing to enter/exit fullscreen on macOS. #50341 (Also in 40, 41, 42)

Other Changes

Added support for using a proxy during yarn install. #50349 (Also in 40, 41, 42)

Backported fix for 485935305. #50440

Backported fix for 489381399. #50443

Backported fix for chromium:475877320. #50436

Backported fixes for 484751092, 487117772. #50461

electron v39.8.3

Release Notes for v39.8.3

Fixes

Added additional ASAR support to additional fs copy methods. #50284 (Also in 40, 41, 42)

Fixed user resizing of transparent windows on win32 platform. #50300 (Also in 40, 41, 42)

electron v39.8.2

Release Notes for v39.8.2

Other Changes

Backported fix for b/491421267. #50230

electron v39.8.1

Release Notes for v39.8.1

Fixes

Added validation to protocol client methods to reject protocol names that do not conform to the RFC 3986 URI scheme grammar. #50156 (Also in 38, 40, 41)

Fixed an issue on macOS where calling autoUpdater.quitAndInstall() could fail if checkForUpdates() was called again after an update was already downloaded. #50215 (Also in 40, 41)

Fixed an issue where Chrome Devtools menus may not appear in certain embedded windows. #50136 (Also in 40, 41)

Fixed an issue where additionalData passed to app.requestSingleInstanceLock on Windows could be truncated or fail to deserialize in the primary instance's second-instance event. #50174 (Also in 38, 40, 41)

Fixed an issue where screen.getCursorScreenPoint() crashed on Wayland when it was called before a BrowserWindow had been created. #50106 (Also in 40, 41)

... (truncated)

Commits

9d2f8cb refactor: remove dead named-window lookup from guest-window-manager (#50498)
1173004 fix: crash calling OSR shared texture release() after texture GC'd (#50499)
be37ade fix: crash in clipboard.readImage() on malformed image data (#50493)
7007907 chore: cherry-pick 3 changes from chromium (#50461)
2c8b6ee chore: cherry-pick fbfb27470bf6 from chromium (#50436)
4c64377 chore: cherry-pick 50b057660b4d from chromium (#50440)
0ef0561 fix: read nodeIntegrationInWorker from per-frame WebPreferences (#50122) (#50...
64373df chore: cherry-pick 074d472db745 from chromium (#50443)
13e4407 fix: don't re-parse URL unnecessarily when handling dialogs (#50400)
16a0385 ci: output build cache hit rate as GHA annotation (#50369)
Additional commits viewable in compare view

Updates webpack-dev-server from 4.15.0 to 5.2.4

Release notes

Sourced from webpack-dev-server's releases.

v5.2.4

5.2.4 (2026-05-11)

Bug Fixes

set Cross-Origin-Resource-Policy header to prevent source code theft over HTTP

v5.2.3

5.2.3 (2026-01-12)

Bug Fixes

add cause for errorObject (#5518) (37b033d)

compatibility with event target and universal target and lazy compilation (574026c)

overlay: add ESC key to dismiss overlay (#5598) (f91baa8)

progress indicator styles (#5557) (41a53a1)

upgrade selfsigned to v5

v5.2.2

5.2.2 (2025-06-03)

Bug Fixes

"Overlay enabled" false positive (18e72ee)

do not crush when error is null for runtime errors (#5447) (309991f)

remove unnecessary header X_TEST (#5451) (64a6124)

respect the allowedHosts option for cross-origin header check (#5510) (03d1214)

v5.2.1

5.2.1 (2025-03-26)

Security

cross-origin requests are not allowed unless allowed by Access-Control-Allow-Origin header

requests with an IP addresses in the Origin header are not allowed to connect to WebSocket server unless configured by allowedHosts or it different from the Host header

The above changes may make the dev server not work if you relied on such behavior, but unfortunately they carry security risks, so they were considered as fixes.

Bug Fixes

prevent overlay for errors caught by React error boundaries (#5431) (8c1abc9)

take the first network found instead of the last one, this restores the same behavior as 5.0.4 (#5411) (ffd0b86)

v5.2.0

5.2.0 (2024-12-11)

Features

... (truncated)

Changelog

Sourced from webpack-dev-server's changelog.

5.2.4 (2026-05-11)

Bug Fixes

set Cross-Origin-Resource-Policy header to prevent source code theft over HTTP

5.2.3 (2026-01-12)

Bug Fixes

add cause for errorObject (#5518) (37b033d)

compatibility with event target and universal target and lazy compilation (574026c)

overlay: add ESC key to dismiss overlay (#5598) (f91baa8)

progress indicator styles (#5557) (41a53a1)

upgrade selfsigned to v5

5.2.2 (2025-06-03)

Bug Fixes

"Overlay enabled" false positive (18e72ee)

do not crush when error is null for runtime errors (#5447) (309991f)

remove unnecessary header X_TEST (#5451) (64a6124)

respect the allowedHosts option for cross-origin header check (#5510) (03d1214)

5.2.1 (2025-03-26)

Security

cross-origin requests are not allowed unless allowed by Access-Control-Allow-Origin header

requests with an IP addresses in the Origin header are not allowed to connect to WebSocket server unless configured by allowedHosts or it different from the Host header

The above changes may make the dev server not work if you relied on such behavior, but unfortunately they carry security risks, so they were considered as fixes.

Bug Fixes

prevent overlay for errors caught by React error boundaries (#5431) (8c1abc9)

take the first network found instead of the last one, this restores the same behavior as 5.0.4 (#5411) (ffd0b86)

5.2.0 (2024-12-11)

Features

added getClientEntry and getClientHotEntry methods to get clients entries (dc642a8)

Bug Fixes

... (truncated)

Commits

fd40130 chore(release): 5.2.4
ece4f36 chore: update deps (#5661)
a216144 ci: fix test (#5658)
df073c5 Merge commit from fork
b550a70 chore(release): 5.2.3
9704dc5 chore: upgrade selfsigned to v5 and remove node-forge dependency (#5618)
92bf644 chore: bump express to update qs (#5621)
792b2f0 chore(deps-dev): bump the dependencies group with 4 updates (#5606)
6d587ca chore(deps): bump the dependencies group across 1 directory with 27 updates (...
f91baa8 fix(overlay): add ESC key to dismiss overlay (#5598)
Additional commits viewable in compare view

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates @babel/plugin-transform-modules-systemjs from 7.10.5 to 7.29.4

Release notes

Sourced from @babel/plugin-transform-modules-systemjs's releases.

v7.29.4 (2026-05-05)

🐛 Bug Fix

babel-plugin-transform-modules-systemjs

#17974 [7.x backport]fix(systemjs): improve module string name support (@JLHwung)

Committers: 1

Huáng Jùnliàng (@JLHwung)

v7.29.3 (2026-04-30)

👓 Spec Compliance

babel-parser

#17923 Support flow extends bound (@JLHwung)

🐛 Bug Fix

babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators

#17931 fix(decorators): replace super within all removed static elements (@JLHwung)

babel-register

#17915 Fix thread synchronization issues in @babel/register (@liuxingbaoyu)

babel-compat-data, babel-plugin-bugfix-safari-rest-destructuring-rhs-array, babel-preset-env

#17788 Add bugfix plugin for Safari array rest destructuring bug (@JLHwung)

💅 Polish

babel-parser

#17782 Improve trailing comma comment handling (@JLHwung)

📝 Documentation

#17847 Replace npmjs.com links with npmx.dev (@nicolo-ribaudo)

🏃‍♀️ Performance

babel-helper-import-to-platform-api, babel-plugin-proposal-import-wasm-source, babel-plugin-transform-json-modules

#17818 Load async Wasm and JSON imports in parallel (@nicolo-ribaudo)

Committers: 4

Babel Bot (@babel-bot)

Huáng Jùnliàng (@JLHwung)

Nicolò Ribaudo (@nicolo-ribaudo)

@liuxingbaoyu

v7.29.2 (2026-03-16)

👓 Spec Compliance

babel-parser

#17840 [7.x backport] async x => {} must be in leading pos (@JLHwung)

🐛 Bug Fix

babel-helpers, babel-plugin-transform-async-generator-functions, babel-preset-env, babel-runtime-corejs3

#17805 [7.x backport] fix: Properly handle await in finally (@liuxingbaoyu)

babel-preset-env

... (truncated)

Commits

a458f66 v7.29.4
32ebd5a [7.x backport]fix(systemjs): improve module string name support (#17974)
aa8394e v7.29.0
0053db6 Update polyfill packages (#17727)
61647ae v7.28.5
a177d55 [Babel 8] Use t.traverseFast to replace some path.traverse (#17518)
eebd3a0 v7.27.1
317e332 Enforce node protocol import (#17207)
fdc0fb5 [Babel 8] Bump nodejs requirements to ^20.19.0 || >= 22.12.0 (#17204)
cd24cc0 chore: Update TS 5.7 (#17053)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @babel/plugin-transform-modules-systemjs since your current version.

Updates fast-xml-parser from 3.19.0 to 3.21.1

Changelog

Sourced from fast-xml-parser's changelog.

3.21.1 / 2021-10-31

Correctly format JSON elements with a text prop but no attribute props ( By haddadnj )

3.21.0 / 2021-10-25

feat: added option rootNodeName to set tag name for array input when converting js object to XML.

feat: added option alwaysCreateTextNode to force text node creation (by: @massimo-ua)

⚠️ feat: Better error location for unclosed tags. (by @Gei0r)

Some error messages would be changed when validating XML. Eg

{ InvalidXml: "Invalid '[ \"rootNode\"]' found." } → {InvalidTag: "Unclosed tag 'rootNode'."}

{ InvalidTag: "Closing tag 'rootNode' is expected inplace of 'rootnode'." } → { InvalidTag: "Expected closing tag 'rootNode' (opened in line 1) instead of closing tag 'rootnode'."}

⚠️ feat: Column in error response when validating XML
{
  "code": "InvalidAttr",
  "msg":  "Attribute 'abc' is repeated.",
  "line": 1,
  "col": 22
}
3.20.1 / 2021-09-25

update strnum package

3.20.0 / 2021-09-10

Use strnum npm package to parse string to number

breaking change: long number will be parsed to scientific notation.

Commits

dccf7fe fix: JSON format for tags with text but no attribute
3eb1def Correctly format JSON elements with a text prop but no attribute props (#387)
a616869 fix: make nyc a devDep (#386)
75c20fe Create Docs
2c4c5e5 fix github build for coverage path
75947c4 update checklist
c05b37c update browser bundles
01727d0 update dependencies
71616d6 update package detail
a85b377 (feat) option set tag name for input js obj when converts to XML
Additional commits viewable in compare view

Updates follow-redirects from 1.15.6 to 1.16.0

Commits

0c23a22 Release version 1.16.0 of the npm package.
844c4d3 Add sensitiveHeaders option.
5e8b8d0 ci: add Node.js 24.x to the CI matrix
7953e22 ci: upgrade GitHub Actions to use setup-node@v6 and checkout@v6
86dc1f8 Sanitizing input.
21ef28a Release version 1.15.11 of the npm package.
7c88135 Roll back tree shaking.
6e389ba Release version 1.15.10 of the npm package.
5bc496e Shake me up before you go-go.
694d6b4 Bump minimist from 1.2.5 to 1.2.8
Additional commits viewable in compare view

Updates lodash from 4.17.21 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

lodash: lodash/lodash@4.18.0-npm...4.18.1-npm

lodash-es: lodash/lodash@4.18.0-es...4.18.1-es

lodash-amd: lodash/lodash@4.18.0-amd...4.18.1-amd

lodash.templatelodash/lodash@4.18.0-npm-packages...4.18.1-npm-packages

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

Add security notice for _.template in threat model and API docs (#6099)

Document lower > upper behavior in _.random (#6115)

Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

lodash.orderby

lodash.tonumber

lodash.trim

lodash.trimend

lodash.sortedindexby

lodash.zipobjectdeep

lodash.unset

lodash.omit

lodash.template

Commits

cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
75535f5 chore: prune stale advisory refs (#6170)
62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
59be2de release(minor): bump to 4.18.0 (#6161)
af63457 fix: broken tests for _.template 879aaa9
1073a76 fix: linting issues
879aaa9 fix: validate imports keys in _.template
fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
b819080 ci: add dist sync validation workflow (#6137)
Additional commits viewable in compare view

Updates node-forge from 1.3.1 to 1.4.0

Changelog

Sourced from node-forge's changelog.

1.4.0 - 2026-03-24

Security

HIGH: Denial of Service in BigInteger.modInverse()

A Denial of Service (DoS) vulnerability exists due to an infinite loop in the BigInteger.modInverse() function (inherited from the bundled jsbn library). When modInverse() is called with a zero value as input, the internal Extended Euclidean Algorithm enters an unreachable exit condition, causing the process to hang indefinitely and consume 100% CPU.

Reported by Kr0emer.

CVE ID: CVE-2026-33891

GHSA ID: GHSA-5gfm-wpxj-wjgq

HIGH: Signature forgery in RSA-PKCS due to ASN.1 extra field.

RSASSA PKCS#1 v1.5 signature verification accepts forged signatures for low public exponent keys (e=3). Attackers can forge signatures by stuffing "garbage" bytes within the ASN.1 structure in order to construct a signature that passes verification, enabling Bleichenbacher style forgery. This issue is similar to CVE-2022-24771, but adds bytes in an addition field within the ASN.1 structure, rather than outside of it.

Additionally, forge does not validate that signatures include a minimum of 8 bytes of padding as defined by the specification, providing attackers additional space to construct Bleichenbacher forgeries.

Reported as part of a U.C. Berkeley security research project by:

Austin Chu, Sohee Kim, and Corban Villa.

CVE ID: CVE-2026-33894

GHSA ID: GHSA-ppp5-5v6c-4jwp

HIGH: Signature forgery in Ed25519 due to missing S < L check.

Ed25519 signature verification accepts forged non-canonical signatures where the scalar S is not reduced modulo the group order (S >= L). A valid signature and its S + L variant both verify in forge, while Node.js crypto.verify (OpenSSL-backed) rejects the S + L variant, as defined by the specification. This class of signature malleability has been exploited in practice to bypass authentication and authorization logic (see CVE-2026-25793, CVE-2022-35961). Applications relying on signature uniqueness (i.e., dedup by signature bytes, replay tracking, signed-object canonicalization checks) may be bypassed.

Reported as part of a U.C. Berkeley security research project by:

Austin Chu, Sohee Kim, and Corban Villa.

CVE ID: CVE-2026-33895

GHSA ID: GHSA-q67f-28xg-22rw

HIGH: basicConstraints bypass in certificate chain verification.

pki.verifyCertificateChain() does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the basicConstraints and keyUsage extensions. This allows any leaf certificate (without these extensions) to act as a CA and sign other certificates, which node-forge will accept as valid.

Reported by Doruk Tan Ozturk (@peaktwilight) - doruk.ch

CVE ID: CVE-2026-33896

GHSA ID: GHSA-2328-f5f3-gj25

... (truncated)

Commits

fa385f9 Release 1.4.0.
07d4e16 Update changelog.
cb90fd9 Update changelog.
963e7c5 Add unit test for "pseudonym"
f0b6f5b Add pseudonym OID
3df48a3 Fix missing CVE ID.
2e49283 Add x509 basicConstraints check.
bdecf11 Add canonical signature scaler check for S < L.
af094e6 Add RSA padding and DigestInfo length checks.
796eeb1 Improve jsbn fix.
Additional commits viewable in compare view

Updates path-to-regexp from 0.1.10 to 0.1.13

Release notes

Sourced from path-to-regexp's releases.

v8.4.2

Fixed

Error on trailing backslash (#434) 9a78879

Performance

Minimize array allocations (#437) 937c02d

Improve compile performance (#436) 57247e6

Should improve compilation performance by ~25%

Remove internal tokenization during parse (#435) 5844988

Should improve parse performance by ~20%

Bundle size to 1.93 kB, from 1.97 kB.

pillarjs/path-to-regexp@v8.4.1...v8.4.2

v8.4.1

Fixed

Remove trie deduplication (#431) 6bc8e84

Using a trie required non-greedy matching, which regressed wildcards in non-ending mode by matching them up until the first match. For example:

/*foo with /a/b = /a

/*foo.htmlwith /a/b.html/c.html = /a/b.html

Allow backtrack handling to match itself (#427) 5bcd30b

When backtracking was introduced, it rejected matching things like /:"a"_:"b" against /foo__. This makes intuitive sense because the second parameter is not going to backtrack on _ anymore, but it's somewhat unexpected since there's no reason it shouldn't match the second _.

pillarjs/path-to-regexp@v8.4.0...v8.4.1

v8.4.0

Important

Fix CVE-2026-4926 (GHSA-j3q9-mxjg-w52f)

Fix CVE-2026-4923 (GHSA-27v5-c462-wpq7)

Fixed

Restricts wildcard backtracking when using more than 1 in a path (pillarjs/path-to-regexp#421)

Changed

Dedupes regex prefixes (pillarjs/path-to-regexp#422)

This will result in shorter regular expressions for some cases using optional groups

Rejects large optional route combinations (pillarjs/path-to-regexp#424)

When using groups such as /users{/delete} it will restrict the number of generated combinations to < 256, equivalent to 8 top-level optional groups and unlikely to occur in a real world application, but avoids exploding the regex size for applications that accept user created routes

... (truncated)

Commits

cbf3025 8.4.2
937c02d Minimize array allocations (#437)
57247e6 Improve compile performance (#436)
5844988 Remove internal tokenization during parse (#435)
9a78879 Error on trailing backslash (#434)
7f05876 8.4.1
6bc8e84 Remove trie deduplication (#431)
5bcd30b Allow backtrack handling to match itself (#427)
9f9c6c5 Add parsing to benchmarks (#418)
9fd31e0 Add trailing: false tests (#428)
Additional commits viewable in compare view

Updates protocol-buffers-schema from 3.3.2 to 3.6.1

Commits

46c34bd 3.6.1
2351031 Fixed parse.js to prevent Prototype Pollution (#70)
b901de0 3.6.0
08c35b0 fix: preserve imports when parsing to json and then stringifying back to prot...
76f815d 3.5.2
203a6ba Support reserved enums (#61)
5de5b21 3.5.1
56e25d4 fix old node
cfc576f 3.5.0
a0e199e fix: update tokenizer to handle options with spaces. Fix mafintosh/protocol-b...
Additional commits viewable in compare view

Updates serialize-javascript from 6.0.1 to 6.0.2

Release notes

Sourced from serialize-javascript's releases.

v6.0.2

fix: serialize URL string contents to prevent XSS (#173) f27d65d

Bump @babel/traverse from 7.10.1 to 7.23.7 (#171) 02499c0

docs: update readme with URL support (#146) 0d88527

chore: update node version and lock file e2a3a91

fix typo (#164) 5a1fa64

yahoo/serialize-javascript@v6.0.1...v6.0.2

Commits

b71ec23 6.0.2
f27d65d fix: serialize URL string contents to prevent XSS (#173)
02499c0 Bump @babel/traverse from 7.10.1 to 7.23.7 (#171)
0d88527 docs: update readme with URL support (#146)
e2a3a91 chore: update node version and lock file
5a1fa64 fix typo (#164)
See full diff in compare view

Updates simple-git from 3.28.0 to 3.36.0

Release notes

Sourced from simple-git's releases.

simple-git@3.36.0

Minor Changes

89a2294: Extend known exploitable configuration keys and per-task environment variables.

Note - ParsedVulnerabilities from argv-parser is removed in favour of a readonly array of Vulnerability to match usage in simple-git, rolled into the new vulnerabilityCheck for simpler access to the identified issues.

Thanks to @zebbern for identifying the need to block core.fsmonitor. Thanks to @kodareef5 for identifying the need to block GIT_CONFIG_COUNT environment variables and --template / merge related config.

Patch Changes

1ad57e8: Remove conflicting node:buffer import

Updated dependencies [89a2294]

Updated dependencies [675570a]

@simple-git/argv-parser@1.1.0

@simple-git/args-pathspec@1.0.3

simple-git@3.35.2

Patch Changes

0cf9d8c: Improvements for mono-repo publishing pipeline

Updated dependencies [0cf9d8c]

@simple-git/args-pathspec@1.0.2

@simple-git/argv-parser@1.0.3

simple-git@3.35.1

Patch Changes

0de400e: Update monorepo version handling during publish

Updated dependencies [0de400e]

@simple-git/argv-parser@1.0.2

simple-git@3.33.0

Minor ChangesDescription has been truncated

Bumps the npm_and_yarn group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [electron](https://github.com/electron/electron) | `23.1.2` | `39.8.5` | | [webpack-dev-server](https://github.com/webpack/webpack-dev-server) | `4.15.0` | `5.2.4` | | [@babel/plugin-transform-modules-systemjs](https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-modules-systemjs) | `7.10.5` | `7.29.4` | | [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) | `3.19.0` | `3.21.1` | | [follow-redirects](https://github.com/follow-redirects/follow-redirects) | `1.15.6` | `1.16.0` | | [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.18.1` | | [node-forge](https://github.com/digitalbazaar/forge) | `1.3.1` | `1.4.0` | | [protocol-buffers-schema](https://github.com/mafintosh/protocol-buffers-schema) | `3.3.2` | `3.6.1` | | [serialize-javascript](https://github.com/yahoo/serialize-javascript) | `6.0.1` | `6.0.2` | | [simple-git](https://github.com/steveukx/git-js/tree/HEAD/simple-git) | `3.28.0` | `3.36.0` | Bumps the npm_and_yarn group with 6 updates in the /compiler directory: | Package | From | To | | --- | --- | --- | | [@babel/plugin-transform-modules-systemjs](https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-modules-systemjs) | `7.25.9` | `7.29.4` | | [follow-redirects](https://github.com/follow-redirects/follow-redirects) | `1.15.6` | `1.16.0` | | [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.18.1` | | [path-to-regexp](https://github.com/pillarjs/path-to-regexp) | `8.2.0` | `8.4.2` | | [axios](https://github.com/axios/axios) | `1.7.4` | `1.16.1` | | [basic-ftp](https://github.com/patrickjuchli/basic-ftp) | `5.0.5` | `5.3.1` | Bumps the npm_and_yarn group with 4 updates in the /compiler/apps/playground directory: [follow-redirects](https://github.com/follow-redirects/follow-redirects), [lodash](https://github.com/lodash/lodash), [axios](https://github.com/axios/axios) and [next](https://github.com/vercel/next.js). Bumps the npm_and_yarn group with 1 update in the /packages/react-devtools-extensions directory: [webpack-dev-server](https://github.com/webpack/webpack-dev-server). Bumps the npm_and_yarn group with 1 update in the /packages/react-devtools-inline directory: [webpack-dev-server](https://github.com/webpack/webpack-dev-server). Bumps the npm_and_yarn group with 1 update in the /packages/react-devtools-shell directory: [webpack-dev-server](https://github.com/webpack/webpack-dev-server). Bumps the npm_and_yarn group with 1 update in the /packages/react-devtools-timeline directory: [webpack-dev-server](https://github.com/webpack/webpack-dev-server). Updates `electron` from 23.1.2 to 39.8.5 - [Release notes](https://github.com/electron/electron/releases) - [Commits](electron/electron@v23.1.2...v39.8.5) Updates `webpack-dev-server` from 4.15.0 to 5.2.4 - [Release notes](https://github.com/webpack/webpack-dev-server/releases) - [Changelog](https://github.com/webpack/webpack-dev-server/blob/main/CHANGELOG.md) - [Commits](webpack/webpack-dev-server@v4.15.0...v5.2.4) Updates `@babel/plugin-transform-modules-systemjs` from 7.10.5 to 7.29.4 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.4/packages/babel-plugin-transform-modules-systemjs) Updates `fast-xml-parser` from 3.19.0 to 3.21.1 - [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases) - [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md) - [Commits](NaturalIntelligence/fast-xml-parser@3.19.0...v3.21.1) Updates `follow-redirects` from 1.15.6 to 1.16.0 - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.15.6...v1.16.0) Updates `lodash` from 4.17.21 to 4.18.1 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.18.1) Updates `node-forge` from 1.3.1 to 1.4.0 - [Changelog](https://github.com/digitalbazaar/forge/blob/main/CHANGELOG.md) - [Commits](digitalbazaar/forge@v1.3.1...v1.4.0) Updates `path-to-regexp` from 0.1.10 to 0.1.13 - [Release notes](https://github.com/pillarjs/path-to-regexp/releases) - [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md) - [Commits](pillarjs/path-to-regexp@v8.2.0...v8.4.2) Updates `protocol-buffers-schema` from 3.3.2 to 3.6.1 - [Commits](mafintosh/protocol-buffers-schema@v3.3.2...v3.6.1) Updates `serialize-javascript` from 6.0.1 to 6.0.2 - [Release notes](https://github.com/yahoo/serialize-javascript/releases) - [Commits](yahoo/serialize-javascript@v6.0.1...v6.0.2) Updates `simple-git` from 3.28.0 to 3.36.0 - [Release notes](https://github.com/steveukx/git-js/releases) - [Changelog](https://github.com/steveukx/git-js/blob/main/simple-git/CHANGELOG.md) - [Commits](https://github.com/steveukx/git-js/commits/simple-git@3.36.0/simple-git) Updates `@babel/plugin-transform-modules-systemjs` from 7.25.9 to 7.29.4 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.4/packages/babel-plugin-transform-modules-systemjs) Updates `follow-redirects` from 1.15.6 to 1.16.0 - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.15.6...v1.16.0) Updates `lodash` from 4.17.21 to 4.18.1 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.18.1) Updates `path-to-regexp` from 8.2.0 to 8.4.2 - [Release notes](https://github.com/pillarjs/path-to-regexp/releases) - [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md) - [Commits](pillarjs/path-to-regexp@v8.2.0...v8.4.2) Updates `axios` from 1.7.4 to 1.16.1 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.7.4...v1.16.1) Updates `basic-ftp` from 5.0.5 to 5.3.1 - [Release notes](https://github.com/patrickjuchli/basic-ftp/releases) - [Changelog](https://github.com/patrickjuchli/basic-ftp/blob/master/CHANGELOG.md) - [Commits](patrickjuchli/basic-ftp@v5.0.5...v5.3.1) Updates `follow-redirects` from 1.15.9 to 1.16.0 - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.15.6...v1.16.0) Updates `lodash` from 4.17.21 to 4.18.1 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.18.1) Updates `axios` from 1.7.7 to 1.16.1 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.7.4...v1.16.1) Updates `next` from 15.5.9 to 15.5.18 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v15.5.9...v15.5.18) Updates `webpack-dev-server` from 4.15.2 to 5.2.4 - [Release notes](https://github.com/webpack/webpack-dev-server/releases) - [Changelog](https://github.com/webpack/webpack-dev-server/blob/main/CHANGELOG.md) - [Commits](webpack/webpack-dev-server@v4.15.0...v5.2.4) Updates `webpack-dev-server` from 4.15.2 to 5.2.4 - [Release notes](https://github.com/webpack/webpack-dev-server/releases) - [Changelog](https://github.com/webpack/webpack-dev-server/blob/main/CHANGELOG.md) - [Commits](webpack/webpack-dev-server@v4.15.0...v5.2.4) Updates `webpack-dev-server` from 4.15.2 to 5.2.4 - [Release notes](https://github.com/webpack/webpack-dev-server/releases) - [Changelog](https://github.com/webpack/webpack-dev-server/blob/main/CHANGELOG.md) - [Commits](webpack/webpack-dev-server@v4.15.0...v5.2.4) Updates `webpack-dev-server` from 4.15.2 to 5.2.4 - [Release notes](https://github.com/webpack/webpack-dev-server/releases) - [Changelog](https://github.com/webpack/webpack-dev-server/blob/main/CHANGELOG.md) - [Commits](webpack/webpack-dev-server@v4.15.0...v5.2.4) --- updated-dependencies: - dependency-name: electron dependency-version: 39.8.5 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: webpack-dev-server dependency-version: 5.2.4 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: "@babel/plugin-transform-modules-systemjs" dependency-version: 7.29.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-xml-parser dependency-version: 3.21.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: follow-redirects dependency-version: 1.16.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.18.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: node-forge dependency-version: 1.4.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: path-to-regexp dependency-version: 0.1.13 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: protocol-buffers-schema dependency-version: 3.6.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: serialize-javascript dependency-version: 6.0.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: simple-git dependency-version: 3.36.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@babel/plugin-transform-modules-systemjs" dependency-version: 7.29.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: follow-redirects dependency-version: 1.16.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.18.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: path-to-regexp dependency-version: 8.4.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: axios dependency-version: 1.16.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: basic-ftp dependency-version: 5.3.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: follow-redirects dependency-version: 1.16.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.18.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: axios dependency-version: 1.16.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.18 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: webpack-dev-server dependency-version: 5.2.4 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: webpack-dev-server dependency-version: 5.2.4 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: webpack-dev-server dependency-version: 5.2.4 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: webpack-dev-server dependency-version: 5.2.4 dependency-type: direct:development dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 19, 2026

dependabot Bot mentioned this pull request May 19, 2026

Bump serialize-javascript from 6.0.1 to 6.0.2 #3

Closed

Navigation Menu

Bump the npm_and_yarn group across 7 directories with 14 updates - #22

Bump the npm_and_yarn group across 7 directories with 14 updates#22
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-9893cb0ea6

dependabot Bot commented on behalf of github May 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github May 19, 2026

electron v39.8.5

Release Notes for v39.8.5

Fixes

electron v39.8.4

Release Notes for v39.8.4

Fixes

Other Changes

electron v39.8.3

Release Notes for v39.8.3

Fixes

electron v39.8.2

Release Notes for v39.8.2

Other Changes

electron v39.8.1

Release Notes for v39.8.1

Fixes

v5.2.4

5.2.4 (2026-05-11)

Bug Fixes

v5.2.3

5.2.3 (2026-01-12)

Bug Fixes

v5.2.2

5.2.2 (2025-06-03)

Bug Fixes

v5.2.1

5.2.1 (2025-03-26)

Security

Bug Fixes

v5.2.0

5.2.0 (2024-12-11)

Features

5.2.4 (2026-05-11)

Bug Fixes

5.2.3 (2026-01-12)

Bug Fixes

5.2.2 (2025-06-03)

Bug Fixes

5.2.1 (2025-03-26)

Security

Bug Fixes

5.2.0 (2024-12-11)

Features

Bug Fixes

v7.29.4 (2026-05-05)

🐛 Bug Fix

Committers: 1

v7.29.3 (2026-04-30)

👓 Spec Compliance

🐛 Bug Fix

💅 Polish

📝 Documentation

🏃‍♀️ Performance

Committers: 4

v7.29.2 (2026-03-16)

👓 Spec Compliance

🐛 Bug Fix

4.18.1

Bugs

4.18.0

v4.18.0

Security

Docs

lodash.* modular packages

1.4.0 - 2026-03-24

Security

v8.4.2

v8.4.1

v8.4.0

v6.0.2

simple-git@3.36.0

Minor Changes

Patch Changes

simple-git@3.35.2

Patch Changes

simple-git@3.35.1

Patch Changes

simple-git@3.33.0

`lodash.*` modular packages