build(deps): bump the npm_and_yarn group across 4 directories with 16 updates by dependabot[bot] · Pull Request #209 · juspay/litellm

dependabot · 2026-07-09T19:23:33Z

Bumps the npm_and_yarn group with 10 updates in the /docs/my-website directory:

Package	From	To
uuid	`9.0.1`	`14.0.0`
@babel/plugin-transform-modules-systemjs	`7.28.5`	`7.29.7`
dompurify	`3.3.0`	`3.4.11`
fast-uri	`3.1.0`	`3.1.3`
form-data	`4.0.5`	`4.0.6`
mermaid	`11.12.1`	`11.16.0`
qs	`6.14.1`	`6.14.2`
shell-quote	`1.8.3`	`1.9.0`
webpack-dev-server	`5.2.2`	`6.0.0`
ws	`7.5.10`	`7.5.11`

Bumps the npm_and_yarn group with 1 update in the /litellm-js/spend-logs directory: hono.
Bumps the npm_and_yarn group with 2 updates in the /tests/proxy_admin_ui_tests/ui_unit_tests directory: form-data and ws.
Bumps the npm_and_yarn group with 15 updates in the /ui/litellm-dashboard directory:

Package	From	To
uuid	`11.1.0`	`14.0.0`
@babel/plugin-transform-modules-systemjs	`7.28.5`	`7.29.7`
dompurify	`3.3.0`	`3.4.11`
fast-uri	`3.1.0`	`3.1.3`
form-data	`4.0.5`	`4.0.6`
mermaid	`11.12.1`	`11.16.0`
postcss	`8.5.6`	`8.5.10`
qs	`6.14.1`	`6.14.2`
shell-quote	`1.8.3`	`1.9.0`
webpack-dev-server	`5.2.2`	`6.0.0`
ws	`7.5.10`	`7.5.11`
next	`14.2.35`	`15.5.18`
vite	`7.2.4`	`8.1.4`
vitest	`3.2.4`	`4.1.10`
axios	`1.13.2`	`1.18.1`

Updates uuid from 9.0.1 to 14.0.0

Release notes

Sourced from uuid's releases.

v14.0.0

14.0.0 (2026-04-19)

⚠ BREAKING CHANGES

expect crypto to be global everywhere (requires node@20+) (#935)

drop node@18 support (#934)

Features

drop node@18 support (#934) (dc4ddb8)

Bug Fixes

expect crypto to be global everywhere (requires node@20+) (#935) (f2c235f)

Use GITHUB_TOKEN for release-please and enable npm provenance (#925) (ffa3138)

v13.0.2

13.0.2 (2026-05-04)

Bug Fixes

rerelease to fix provenance. (49ccb35)

v13.0.1

13.0.1 (2026-04-27)

Bug Fixes

backport fix for GHSA-w5hq-g745-h8pq (9d27ddf)

v13.0.0

13.0.0 (2025-09-08)

⚠ BREAKING CHANGES

make browser exports the default (#901)

Bug Fixes

make browser exports the default (#901) (bce9d72)

v12.0.1

12.0.1 (2026-04-29)

... (truncated)

Changelog

Sourced from uuid's changelog.

14.0.0 (2026-04-19)

Security

Fixes GHSA-w5hq-g745-h8pq: v3(), v5(), and v6() did not validate that writes would remain within the bounds of a caller-supplied buffer, allowing out-of-bounds writes when an invalid offset was provided. A RangeError is now thrown if offset < 0 or offset + 16 > buf.length.

⚠ BREAKING CHANGES

crypto is now expected to be globally defined (requires node@20+) (#935)

drop node@18 support (#934)

upgrade minimum supported TypeScript version to 5.4.3, in keeping with the project's policy of supporting TypeScript versions released within the last two years

13.0.0 (2025-09-08)

⚠ BREAKING CHANGES

make browser exports the default (#901)

Bug Fixes

make browser exports the default (#901) (bce9d72)

12.0.0 (2025-09-05)

⚠ BREAKING CHANGES

update to typescript@5.2 (#887)

remove CommonJS support (#886)

drop node@16 support (#883)

Features

add node@24 to ci matrix (#879) (42b6178)

drop node@16 support (#883) (0f38cf1)

remove CommonJS support (#886) (ae786e2)

update to typescript@5.2 (#887) (c7ee405)

Bug Fixes

improve v4() performance (#894) (5fd974c)

restore node: prefix (#889) (e1f42a3)

11.1.0 (2025-02-19)

... (truncated)

Commits

7c1ea08 chore(main): release 14.0.0 (#926)
3d2c5b0 Merge commit from fork
f2c235f fix!: expect crypto to be global everywhere (requires node@20+) (#935)
529ef08 chore: upgrade TypeScript and fixup types (#927)
086fd79 chore: update dependencies (#933)
dc4ddb8 feat!: drop node@18 support (#934)
0f1f9c9 chore: switch to Biome for parsing and linting (#932)
e2879e6 chore: use maintained version of npm-run-all (#930)
ffa3138 fix: Use GITHUB_TOKEN for release-please and enable npm provenance (#925)
0423d49 docs: remove obsolete v1 option notes (#915)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for uuid since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates @babel/plugin-transform-modules-systemjs from 7.28.5 to 7.29.7

Release notes

Sourced from @babel/plugin-transform-modules-systemjs's releases.

v7.29.7 (2026-05-25)

Re-release all packages with npm provenance attestations

v7.29.6 (2026-05-25)

🐛 Bug Fix

babel-generator

#18014 Catchup source map position in preserveFormat (@nicolo-ribaudo)

babel-core

#18001 [7.x packport]Improve input source map handling (@JLHwung)

babel-core, babel-generator

#17998 Preserve original identifier names from input sourcemaps (#17992) (@Andarist)

Committers: 3

Huáng Jùnliàng (@JLHwung)

Mateusz Burzyński (@Andarist)

Nicolò Ribaudo (@nicolo-ribaudo)

v7.29.5 (2026-05-05)

🏠 Internal

babel-preset-env

Update @babel/* dependencies

v7.29.4 (2026-05-05)

🐛 Bug Fix

babel-plugin-transform-modules-systemjs

#17974 [7.x backport]fix(systemjs): improve module string name support (@JLHwung)

Committers: 1

Huáng Jùnliàng (@JLHwung)

v7.29.3 (2026-04-30)

👓 Spec Compliance

babel-parser

#17923 Support flow extends bound (@JLHwung)

🐛 Bug Fix

babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators

#17931 fix(decorators): replace super within all removed static elements (@JLHwung)

babel-register

#17915 Fix thread synchronization issues in @babel/register (@liuxingbaoyu)

babel-compat-data, babel-plugin-bugfix-safari-rest-destructuring-rhs-array, babel-preset-env

#17788 Add bugfix plugin for Safari array rest destructuring bug (@JLHwung)

💅 Polish

babel-parser

... (truncated)

Commits

4fba754 v7.29.7
a458f66 v7.29.4
32ebd5a [7.x backport]fix(systemjs): improve module string name support (#17974)
aa8394e v7.29.0
0053db6 Update polyfill packages (#17727)
See full diff in compare view

Updates dompurify from 3.3.0 to 3.4.11

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.11

Fixed an issue with a leaky config for hooks via setConfig, thanks @trace37labs

Bumped vulnerable development dependencies to arrive at plain 0 with npm audit

Updated the osv-scanner suppression list as no vulnerable dependencies are left for now

Updated up the linting tool-chain and removed now-redundant lint directives

Updated the documentation is several spots, README, wiki, etc.

Bumped several dependencies where possible

DOMPurify 3.4.10

Refactored codebase for clarity: extracted the public type declarations into types.ts

Decomposed the three largest sanitizer functions into focused helpers

Removed duplicated defaults and dead branches, consolidated SAFE_FOR_TEMPLATES scrubbing into single shared path

Improved per-node performance by hoisting the mXSS probe regexes and testing textContent before innerHTML

Added a deterministic micro-benchmark harness (npm run bench) with a --compare mode

Reduced CI cost by running the full three-engine browser suite once per PR

Refreshed the demos/ folder so every demo runs again, and added a SVG-via-<img> demo

Documented the bench and test:happydom scripts in the README

Completed the Attack Classes & Bypass History wiki page

Bumped several dependencies where possible

DOMPurify 3.4.9

Further improved the handling of Trusted Types config options, thanks @offset

Further improved the handling of IN_PLACE sanitization, thanks @mozfreddyb

Added more test coverage for IN_PLACE and Trusted Types related usage

Bumped several dependencies where possible

Updated README and wiki with more accurate documentation & attack samples

DOMPurify 3.4.8

Cleaned up the repository root, renamed some and removed unneeded files

Fixed an issue with handling of Trusted Types policies, thanks @fulstadev

Fixed the node iterator for better template scrubbing, thanks @IamLeandrooooo

Included formerly missing LICENSE-MPL in published npm package, thanks @asamuzaK

Bumped several dependencies where possible

DOMPurify 3.4.7

Hardened the handling of Shadow Roots when using IN_PLACE, thanks @GameZoneHacker

Removed a problem leading to permanent hook pollution, thanks @offset

Refactored the test suite and expanded test coverage significantly

DOMPurify 3.4.6

Fixed several issues with DOM Clobbering in IN_PLACE mode, thanks @offset & @Bankde

Hardened the checks for cross-realm IN_PLACE and Shadow DOM sanitization, thanks @offset & @Bankde

Added more test coverage for IN_PLACE and general DOM Clobbering attacks

Bumped several dependencies where possible

DOMPurify 3.4.5

Fixed a bypass caused by the new HTML element selectedcontent added in 3.4.4, thanks @KabirAcharya

Note that this is a security release for an issue introduced in 3.4.4 and should be upgraded to immediately.

... (truncated)

Commits

0cae518 release: 3.4.11 (#1494)
6ee5716 release: 3.4.10 (#1478)
5210247 release: 3.4.9 (#1459)
bcdd828 release: 3.4.8 (#1439)
ca30f07 release: 3.4.7 (#1414)
bb7739e release: 3.4.6 (#1394)
011b0c7 release: 3.4.5 (#1382)
5817ad9 release: 3.4.4 (#1374)
520edb0 release: 3.4.3 (#1352)
6f67fd3 Sync/3.4.2 (#1322)
Additional commits viewable in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates fast-uri from 3.1.0 to 3.1.3

Release notes

Sourced from fast-uri's releases.

v3.1.3

⚠️ Security Release

Fixes: GHSA-4c8g-83qw-93j6

Full Changelog: fastify/fast-uri@v3.1.2...v3.1.3

v3.1.2

⚠️ Security Release

Fix for GHSA-v39h-62p7-jpjc

What's Changed

Handle malformed fragment decoding as a parse error by @mcollina in fastify/fast-uri#171

Full Changelog: fastify/fast-uri@v3.1.1...v3.1.2

v3.1.1

⚠️ Security Release

Fix for GHSA-q3j6-qgpj-74h6

What's Changed

build(deps-dev): bump tsd from 0.32.0 to 0.33.0 by @dependabot[bot] in fastify/fast-uri#148

build(deps): bump actions/checkout from 4 to 5 by @dependabot[bot] in fastify/fast-uri#149

chore(.npmrc): ignore scripts by @Fdawgs in fastify/fast-uri#150

build(deps-dev): remove @fastify/pre-commit by @Fdawgs in fastify/fast-uri#151

build(deps): bump actions/setup-node from 4 to 5 by @dependabot[bot] in fastify/fast-uri#152

ci(ci): add concurrency config by @Fdawgs in fastify/fast-uri#153

build(deps): bump actions/setup-node from 5 to 6 by @dependabot[bot] in fastify/fast-uri#154

build(deps): bump actions/checkout from 5 to 6 by @dependabot[bot] in fastify/fast-uri#156

chore(license): standardise license notice by @Fdawgs in fastify/fast-uri#159

style: remove trailing whitespace by @Fdawgs in fastify/fast-uri#161

ci: remove unused github files by @Tony133 in fastify/fast-uri#162

chore: update readme by @Tony133 in fastify/fast-uri#164

build(deps): bump fastify/workflows/.github/workflows/plugins-ci-package-manager.yml from 5 to 6 by @dependabot[bot] in fastify/fast-uri#165

build(deps): bump fastify/workflows/.github/workflows/plugins-ci.yml from 5 to 6 by @dependabot[bot] in fastify/fast-uri#166

build(deps-dev): bump neostandard from 0.12.2 to 0.13.0 by @dependabot[bot] in fastify/fast-uri#167

ci: add lock-threads workflow by @Fdawgs in fastify/fast-uri#169

New Contributors

@Tony133 made their first contribution in fastify/fast-uri#162

Full Changelog: fastify/fast-uri@v3.1.0...v3.1.1

Commits

0549fe3 Bumped v3.1.3
2a6d357 Merge commit from fork
919dd8e Bumped v3.1.2
c65ba57 fixup: linting
6c86c17 Merge commit from fork
a95158a Handle malformed fragment decoding without throwing (#171)
cea547c Bumped v3.1.1
876ce79 Merge commit from fork
dcdf690 ci: add lock-threads workflow (#169)
c860e65 build(deps-dev): bump neostandard from 0.12.2 to 0.13.0 (#167)
Additional commits viewable in compare view

Updates form-data from 4.0.5 to 4.0.6

Changelog

Sourced from form-data's changelog.

v4.0.6 - 2026-06-12

Commits

[Fix] escape CR, LF, and " in field names and filenames 8dff42c

[Dev Deps] update @ljharb/eslint-config, auto-changelog, tape f31d21e

[Deps] update hasown, mime-types 92ae0eb

[Dev Deps] update js-randomness-predictor 67b0f65

Commits

64190db v4.0.6
92ae0eb [Deps] update hasown, mime-types
f31d21e [Dev Deps] update @ljharb/eslint-config, auto-changelog, tape
8dff42c [Fix] escape CR, LF, and " in field names and filenames
67b0f65 [Dev Deps] update js-randomness-predictor
See full diff in compare view

Updates mermaid from 11.12.1 to 11.16.0

Release notes

Sourced from mermaid's releases.

mermaid@11.16.0

Minor Changes

#7535 ea1c48f Thanks @ragelink! - feat(cynefin): Adds the Cynefin framework as a new diagram type (beta) to Mermaid (available as cynefin-beta). The Cynefin framework, created by Dave Snowden, is a decision-making framework that categorizes problems into five complexity domains, widely used in agile, incident management, strategy, and organizational design.

#7721 f45cc2c Thanks @notionparallax! - feat(treeView): add box-drawing character input support for treeView diagrams

#7550 f1f4d45 Thanks @DominicBurkart! - feat(xychart): add per-point text labels for xychart line plots

#7527 b4d0442 Thanks @notionparallax! - feat(treeView): Extends the existing treeView-beta diagram with features useful for representing file/directory structures.

#7793 a6f097d Thanks @SSDWGG! - feat(er): support optional ER attribute types with a ? suffix

#7772 37f2e36 Thanks @devareddy05! - feat(gantt): support multiple excludes / includes lines so long exclusion lists can be split into commented groups (#6270)

#7708 4e63e9d Thanks @txmxthy! - feat(architecture): add align row|column {ids…} directive to architecture-beta diagrams so authors can declare horizontal or vertical alignment of services explicitly.

#7760 05223be Thanks @ngdaniels! - feat(pie): Enhance Pie Chart - Enable donut chart, Set legend position, and highlight slice

#7251 216e4e9 Thanks @ydah! - feat(railroad): Add support for Railroad Diagrams (Syntax Diagrams) with four input syntaxes: IR (railroad-beta), EBNF (railroad-ebnf-beta), ABNF (railroad-abnf-beta), and PEG (railroad-peg-beta).

#7774 e5c75e6 Thanks @ngdaniels! - feat(xychart): enable rotate label on X-axis

#7791 974fa7b Thanks @knsv-bot! - feat(swimlane): add swimlane as a standalone diagram type with a dedicated layered orthogonal layout algorithm

Patch Changes

#7744 633c261 Thanks @ashishjain0512! - fix(architecture): add architecture.seed config option to make architecture diagrams render deterministically. Resolves #7729.

#7732 c8ba156 Thanks @rkdfx! - fix: tolerate leading horizontal whitespace before YAML frontmatter delimiters. Closes mermaid-js/mermaid#7613

#7314 4e4e6c4 Thanks @darshanr0107! - fix(flowchart): Prevent crash when flowchart node shape is undefined

#7762 cfd2391 Thanks @Dharya-dev! - fix(class): support styling and callbacks for generic classes

#7284 c1f116d Thanks @darshanr0107! - fix(gantt): Render gantt vertical markers without affecting row layout or chart height

#7786 72fbab1 Thanks @knsv-bot! - fix(er): allow special characters (e.g. dots) in ER diagram attribute names and types by escaping them with backticks

#7672 4887e97 Thanks @sjackson0109! - fix(flowchart): respect per-subgraph direction keyword in Dagre layout. Fixes #4648

#7734 a4c1e50 Thanks @OfirHaf! - fix(block): read block padding and sanitize config dynamically instead of at module load time

#7674 cc75089 Thanks @cyphercodes! - fix(block): respect current DOMPurify config when sanitizing labels

#7711 be2e282 Thanks @Jinacker! - fix(flowchart): render flowchart and state self-loop edges as a single SVG path.

#7781 d945968 Thanks @Dharya-dev! - fix(radar): align axis labels based on angular position to prevent clipping

#7661 2f5e9e8 Thanks @nabila401! - fix(venn): fix 3-circle venn diagram union rendering

... (truncated)

Commits

7c0cafc Version Packages: v11.16.0 (#7916)
26acd1a Merge pull request #7915 from mermaid-js/release/11.16.0
5a8eae7 Merge branch 'master' into release/11.16.0
dd5ea77 Merge pull request #7913 from mermaid-js/pebr/fix-changesets
658ee66 docs: fix missing bumps of @mermaid-js/parser
04259a1 docs: fix author and commit on examples changeset
c9dcfb1 docs: update changeset diagram scopes
a34dab9 docs: remove swimlane/cynefin bugfix changesets
e81f31f docs: remove local-editor changeset
7223f03 Minor correction
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for mermaid since your current version.

Updates qs from 6.14.1 to 6.14.2

Changelog

Sourced from qs's changelog.

6.14.2

[Fix] parse: mark overflow objects for indexed notation exceeding arrayLimit (#546)

[Fix] arrayLimit means max count, not max index, in combine/merge/parseArrayValue

[Fix] parse: throw on arrayLimit exceeded with indexed notation when throwOnLimitExceeded is true (#529)

[Fix] parse: enforce arrayLimit on comma-parsed values

[Fix] parse: fix error message to reflect arrayLimit as max index; remove extraneous comments (#545)

[Robustness] avoid .push, use void

[readme] document that addQueryPrefix does not add ? to empty output (#418)

[readme] clarify parseArrays and arrayLimit documentation (#543)

[readme] replace runkit CI badge with shields.io check-runs badge

[meta] fix changelog typo (arrayLength → arrayLimit)

[actions] fix rebase workflow permissions

Commits

bdcf0c7 v6.14.2
294db90 [readme] document that addQueryPrefix does not add ? to empty output
5c308e5 [readme] clarify parseArrays and arrayLimit documentation
6addf8c [Fix] parse: mark overflow objects for indexed notation exceeding arrayLimit
cfc108f [Fix] arrayLimit means max count, not max index, in combine/merge/`pars...
febb644 [Fix] parse: throw on arrayLimit exceeded with indexed notation when `thr...
f6a7abf [Fix] parse: enforce arrayLimit on comma-parsed values
fbc5206 [Fix] parse: fix error message to reflect arrayLimit as max index; remove e...
1b9a8b4 [actions] fix rebase workflow permissions
2a35775 [meta] fix changelog typo (arrayLength → arrayLimit)
Additional commits viewable in compare view

Updates shell-quote from 1.8.3 to 1.9.0

Changelog

Sourced from shell-quote's changelog.

v1.9.0 - 2026-06-24

Commits

[New] add types dca6e21

[Dev Deps] update eslint 9aa9e8f

[Fix] parse: finalize tokens in linear time (GHSA-395f-4hp3-45gv) 7ff5488

[actions] update workflows 75e8497

[actions] Windows + node 4/6/7: pin eslint to 9 before install, since npm 2/3 cannot stage eslint 10@types/esrecurse 3fb739d

[actions] retry npm install on Windows to survive npm 2/3 staging-rename flake abe0163

[actions] Windows + node 5/7: install deps with a modern node b4bafa2

[Fix] quote: escape leading ~ to prevent shell tilde-expansion 7a76c1a

[Dev Deps] update auto-changelog, tape 7184b44

[Dev Deps] apparently jackspeak is no longer in the graph 9ba368a

v1.8.4 - 2026-05-22

Commits

[Fix] quote: validate object-token shapes 4378a6e

[Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint, npmignore 22ebec0

[Tests] increase coverage 9f3caa3

[readme] replace runkit CI badge with shields.io check-runs badge 3344a04

[Dev Deps] update @ljharb/eslint-config 699c511

Commits

db09fc7 v1.9.0
7ff5488 [Fix] parse: finalize tokens in linear time (GHSA-395f-4hp3-45gv)
b4bafa2 [actions] Windows + node 5/7: install deps with a modern node
3fb739d [actions] Windows + node 4/6/7: pin eslint to 9 before install, since npm 2/3...
abe0163 [actions] retry npm install on Windows to survive npm 2/3 staging-rename flake
7a76c1a [Fix] quote: escape leading ~ to prevent shell tilde-expansion
75e8497 [actions] update workflows
dca6e21 [New] add types
9aa9e8f [Dev Deps] update eslint
9ba368a [Dev Deps] apparently jackspeak is no longer in the graph
Additional commits viewable in compare view

Updates webpack-dev-server from 5.2.2 to 6.0.0

Release notes

Sourced from webpack-dev-server's releases.

v6.0.0

Major Changes

Bump Express to v5. See the Express 5 migration guide for the full list of breaking changes. (by @bjohansebas in #5674)

Bump the webpack peer dependency range from ^5.0.0 to ^5.101.0. (by @bjohansebas in #5674)

Drop support for Node.js < 22.15.0. (by @bjohansebas in #5674)

Convert the source to native ES modules. The package keeps "type": "module" and now exposes both an ESM and a CommonJS build via the exports field: ESM consumers import the native lib/, while CommonJS consumers require() a transpiled dist/ build, allowing the package to be consumed from both ESM and CommonJS without relying on require(ESM) for CommonJS consumers. (by @bjohansebas in #5674)

Remove CLI flags. Use the serve command from webpack-cli together with a configuration file or the programmatic API instead. (by @bjohansebas in #5674)

Remove the internalIP and internalIPSync static methods from Server. Resolve the local IP yourself if you need it. (by @bjohansebas in #5674)

Remove the bypass option from proxy configuration. Use the router or context options provided by http-proxy-middleware instead. (by @bjohansebas in #5674)

Remove SockJS support. The webSocketServer option no longer accepts "sockjs"; use the default "ws" transport instead. (by @bjohansebas in #5674)

Remove the spdy dependency. Use the built-in node:http2 module via the server option for HTTP/2 support. (by @bjohansebas in #5674)

Update http-proxy-middleware to v4. See the http-proxy-middleware v3 release notes and v4 release notes for the full list of breaking changes. (by @bjohansebas in #5674)

Update webpack-dev-middleware to v8 and sync originalUrl for middleware compatibility. server.middleware.getFilenameFromUrl() is now asynchronous and resolves to { filename, extra: { stats, outputFileSystem } }. See the webpack-dev-middleware v8 release notes for details. (by @bjohansebas in #5674)

Minor Changes

Add plugin support. webpack-dev-server can now be used as a webpack plugin, integrating with the compiler lifecycle without explicitly passing a compiler, preventing multiple server starts on recompilation, ensuring clean shutdown, and supporting MultiCompiler setups with multiple independent plugin servers. (by @bjohansebas in #5674)

Enable the compression middleware for HTTP/2 connections. (by @bjohansebas in #5674)

Remove the colorette dependency in favor of native ANSI styling. (by @bjohansebas in #5674)

Update chokidar to v5 and extend watchFiles.options.ignored to support glob string patterns via tinyglobby. (by @bjohansebas in #5674)

Use compiler.platform to determine the target environment instead of inspecting the resolved target string. Universal targets ("universal" or ["web", "node"], where compiler.platform.universal is true since webpack 5.108.0) are treated as web targets so the client runtime is injected. (by @bjohansebas in #5674)

Use the WHATWG URL API instead of the deprecated url.parse. (by @bjohansebas in #5674)

Patch Changes

Bump production dependencies, notably open to v11 and p-retry to v8. (by @bjohansebas in #5674)

Reject cross-site requests to the internal open-editor and invalidate endpoints. They performed state-changing actions (opening a file in the editor, forcing a recompilation) on any GET request, so a page the developer visited could trigger them. They now require a same-origin request, validated via Sec-Fetch-Site with an Origin/Host fallback. (by @bjohansebas in #5691)

Treat loopback aliases (127.0.0.1, ::1, localhost) as equivalent in isSameOrigin so the WebSocket client does not reject valid same-origin connections. (by @bjohansebas in #5674)

Migrate the test suite from Jest to node:test and set up the jsdom environment. (by @bjohansebas in #5674)

... (truncated)

Changelog

Sourced from webpack-dev-server's changelog.

6.0.0

Major Changes

Bump Express to v5. See the Express 5 migration guide for the full list of breaking changes. (by @bjohansebas in #5674)

Bump the webpack peer dependency range from ^5.0.0 to ^5.101.0. (by @bjohansebas in #5674)

Drop support for Node.js < 22.15.0. (by @bjohansebas in #5674)

Convert the source to native ES modules. The package keeps "type": "module" and now exposes both an ESM and a CommonJS build via the exports field: ESM consumers import the native lib/, while CommonJS consumers require() a transpiled dist/ build — so the package works from both ESM and CommonJS, including environments where requir...
Description has been truncated

… updates Bumps the npm_and_yarn group with 10 updates in the /docs/my-website directory: | Package | From | To | | --- | --- | --- | | [uuid](https://github.com/uuidjs/uuid) | `9.0.1` | `14.0.0` | | [@babel/plugin-transform-modules-systemjs](https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-modules-systemjs) | `7.28.5` | `7.29.7` | | [dompurify](https://github.com/cure53/DOMPurify) | `3.3.0` | `3.4.11` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.1.0` | `3.1.3` | | [form-data](https://github.com/form-data/form-data) | `4.0.5` | `4.0.6` | | [mermaid](https://github.com/mermaid-js/mermaid) | `11.12.1` | `11.16.0` | | [qs](https://github.com/ljharb/qs) | `6.14.1` | `6.14.2` | | [shell-quote](https://github.com/ljharb/shell-quote) | `1.8.3` | `1.9.0` | | [webpack-dev-server](https://github.com/webpack/webpack-dev-server) | `5.2.2` | `6.0.0` | | [ws](https://github.com/websockets/ws) | `7.5.10` | `7.5.11` | Bumps the npm_and_yarn group with 1 update in the /litellm-js/spend-logs directory: [hono](https://github.com/honojs/hono). Bumps the npm_and_yarn group with 2 updates in the /tests/proxy_admin_ui_tests/ui_unit_tests directory: [form-data](https://github.com/form-data/form-data) and [ws](https://github.com/websockets/ws). Bumps the npm_and_yarn group with 15 updates in the /ui/litellm-dashboard directory: | Package | From | To | | --- | --- | --- | | [uuid](https://github.com/uuidjs/uuid) | `11.1.0` | `14.0.0` | | [@babel/plugin-transform-modules-systemjs](https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-modules-systemjs) | `7.28.5` | `7.29.7` | | [dompurify](https://github.com/cure53/DOMPurify) | `3.3.0` | `3.4.11` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.1.0` | `3.1.3` | | [form-data](https://github.com/form-data/form-data) | `4.0.5` | `4.0.6` | | [mermaid](https://github.com/mermaid-js/mermaid) | `11.12.1` | `11.16.0` | | [postcss](https://github.com/postcss/postcss) | `8.5.6` | `8.5.10` | | [qs](https://github.com/ljharb/qs) | `6.14.1` | `6.14.2` | | [shell-quote](https://github.com/ljharb/shell-quote) | `1.8.3` | `1.9.0` | | [webpack-dev-server](https://github.com/webpack/webpack-dev-server) | `5.2.2` | `6.0.0` | | [ws](https://github.com/websockets/ws) | `7.5.10` | `7.5.11` | | [next](https://github.com/vercel/next.js) | `14.2.35` | `15.5.18` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `7.2.4` | `8.1.4` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `3.2.4` | `4.1.10` | | [axios](https://github.com/axios/axios) | `1.13.2` | `1.18.1` | Updates `uuid` from 9.0.1 to 14.0.0 - [Release notes](https://github.com/uuidjs/uuid/releases) - [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md) - [Commits](uuidjs/uuid@v9.0.1...v14.0.0) Updates `@babel/plugin-transform-modules-systemjs` from 7.28.5 to 7.29.7 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.7/packages/babel-plugin-transform-modules-systemjs) Updates `dompurify` from 3.3.0 to 3.4.11 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.3.0...3.4.11) Updates `fast-uri` from 3.1.0 to 3.1.3 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.0...v3.1.3) Updates `form-data` from 4.0.5 to 4.0.6 - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v4.0.5...v4.0.6) Updates `mermaid` from 11.12.1 to 11.16.0 - [Release notes](https://github.com/mermaid-js/mermaid/releases) - [Commits](https://github.com/mermaid-js/mermaid/compare/mermaid@11.12.1...mermaid@11.16.0) Updates `qs` from 6.14.1 to 6.14.2 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.14.1...v6.14.2) Updates `shell-quote` from 1.8.3 to 1.9.0 - [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md) - [Commits](ljharb/shell-quote@v1.8.3...v1.9.0) Updates `webpack-dev-server` from 5.2.2 to 6.0.0 - [Release notes](https://github.com/webpack/webpack-dev-server/releases) - [Changelog](https://github.com/webpack/webpack-dev-server/blob/main/CHANGELOG.md) - [Commits](webpack/webpack-dev-server@v5.2.2...v6.0.0) Updates `ws` from 7.5.10 to 7.5.11 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@7.5.10...7.5.11) Updates `hono` from 4.10.6 to 4.12.28 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.10.6...v4.12.28) Updates `form-data` from 4.0.5 to 4.0.6 - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v4.0.5...v4.0.6) Updates `ws` from 8.18.3 to 8.21.0 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@7.5.10...7.5.11) Updates `uuid` from 11.1.0 to 14.0.0 - [Release notes](https://github.com/uuidjs/uuid/releases) - [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md) - [Commits](uuidjs/uuid@v9.0.1...v14.0.0) Updates `@babel/plugin-transform-modules-systemjs` from 7.28.5 to 7.29.7 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.7/packages/babel-plugin-transform-modules-systemjs) Updates `dompurify` from 3.3.0 to 3.4.11 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.3.0...3.4.11) Updates `fast-uri` from 3.1.0 to 3.1.3 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.0...v3.1.3) Updates `form-data` from 4.0.5 to 4.0.6 - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v4.0.5...v4.0.6) Updates `mermaid` from 11.12.1 to 11.16.0 - [Release notes](https://github.com/mermaid-js/mermaid/releases) - [Commits](https://github.com/mermaid-js/mermaid/compare/mermaid@11.12.1...mermaid@11.16.0) Updates `postcss` from 8.5.6 to 8.5.10 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.6...8.5.10) Updates `qs` from 6.14.1 to 6.14.2 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.14.1...v6.14.2) Updates `shell-quote` from 1.8.3 to 1.9.0 - [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md) - [Commits](ljharb/shell-quote@v1.8.3...v1.9.0) Updates `webpack-dev-server` from 5.2.2 to 6.0.0 - [Release notes](https://github.com/webpack/webpack-dev-server/releases) - [Changelog](https://github.com/webpack/webpack-dev-server/blob/main/CHANGELOG.md) - [Commits](webpack/webpack-dev-server@v5.2.2...v6.0.0) Updates `ws` from 7.5.10 to 7.5.11 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@7.5.10...7.5.11) Updates `next` from 14.2.35 to 15.5.18 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v14.2.35...v15.5.18) Updates `vite` from 7.2.4 to 8.1.4 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.1.4/packages/vite) Updates `vitest` from 3.2.4 to 4.1.10 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/vitest) Updates `vitest` from 3.2.4 to 4.1.10 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/vitest) Updates `axios` from 1.13.2 to 1.18.1 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.13.2...v1.18.1) --- updated-dependencies: - dependency-name: uuid dependency-version: 14.0.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@babel/plugin-transform-modules-systemjs" dependency-version: 7.29.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: dompurify dependency-version: 3.4.11 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: form-data dependency-version: 4.0.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: mermaid dependency-version: 11.16.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.14.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: shell-quote dependency-version: 1.9.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: webpack-dev-server dependency-version: 6.0.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 7.5.11 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.12.28 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: form-data dependency-version: 4.0.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 8.21.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: uuid dependency-version: 14.0.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@babel/plugin-transform-modules-systemjs" dependency-version: 7.29.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: dompurify dependency-version: 3.4.11 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: form-data dependency-version: 4.0.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: mermaid dependency-version: 11.16.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.10 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.14.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: shell-quote dependency-version: 1.9.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: webpack-dev-server dependency-version: 6.0.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 7.5.11 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.18 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 8.1.4 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: vitest dependency-version: 4.1.10 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: vitest dependency-version: 4.1.10 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: axios dependency-version: 1.18.1 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 9, 2026

Navigation Menu

Uh oh!

build(deps): bump the npm_and_yarn group across 4 directories with 16 updates - #209

build(deps): bump the npm_and_yarn group across 4 directories with 16 updates#209
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/docs/my-website/npm_and_yarn-c535dedcf7

dependabot Bot commented on behalf of github Jul 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 9, 2026

v14.0.0

14.0.0 (2026-04-19)

⚠ BREAKING CHANGES

Features

Bug Fixes

v13.0.2

13.0.2 (2026-05-04)

Bug Fixes

v13.0.1

13.0.1 (2026-04-27)

Bug Fixes

v13.0.0

13.0.0 (2025-09-08)

⚠ BREAKING CHANGES

Bug Fixes

v12.0.1

12.0.1 (2026-04-29)

14.0.0 (2026-04-19)

Security

⚠ BREAKING CHANGES

13.0.0 (2025-09-08)

⚠ BREAKING CHANGES

Bug Fixes

12.0.0 (2025-09-05)

⚠ BREAKING CHANGES

Features

Bug Fixes

11.1.0 (2025-02-19)

v7.29.7 (2026-05-25)

v7.29.6 (2026-05-25)

🐛 Bug Fix

Committers: 3

v7.29.5 (2026-05-05)

🏠 Internal

v7.29.4 (2026-05-05)

🐛 Bug Fix

Committers: 1

v7.29.3 (2026-04-30)

👓 Spec Compliance

🐛 Bug Fix

💅 Polish

DOMPurify 3.4.11

DOMPurify 3.4.10

DOMPurify 3.4.9

DOMPurify 3.4.8

DOMPurify 3.4.7

DOMPurify 3.4.6

DOMPurify 3.4.5

v3.1.3

⚠️ Security Release

v3.1.2

⚠️ Security Release

What's Changed

v3.1.1

⚠️ Security Release

What's Changed

New Contributors

v4.0.6 - 2026-06-12

Commits

mermaid@11.16.0

Minor Changes

Patch Changes

6.14.2

v1.9.0 - 2026-06-24

Commits

v1.8.4 - 2026-05-22

Commits

v6.0.0

Major Changes

Minor Changes

Patch Changes

6.0.0

Major Changes

Uh oh!

Reviewers

Assignees

Labels