Skip to content

build(deps): bump minimatch and serve-handler in /docs#3394

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/docs/multi-920dfa8a4c
Open

build(deps): bump minimatch and serve-handler in /docs#3394
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/docs/multi-920dfa8a4c

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Mar 6, 2026

Bumps minimatch and serve-handler. These dependencies needed to be updated together.
Updates minimatch from 3.1.2 to 3.1.5

Commits

Updates minimatch from 9.0.5 to 9.0.9

Commits

Updates minimatch from 10.0.1 to 10.2.4

Commits

Updates serve-handler from 6.1.6 to 6.1.7

Release notes

Sourced from serve-handler's releases.

6.1.7

Patches

  • Fix: update minimatch to 3.1.5 to resolve security vulnerabilities: #228

Credits

Huge thanks to @​ParakhJaggi for helping!

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Note

Low Risk
Lockfile-only dependency bumps in the docs package; low functional risk but may affect docs build/runtime if the updated glob-matching dependencies behave differently.

Overview
Updates the docs lockfile to bump minimatch to 3.1.5 and serve-handler to 6.1.7 (pulling in the minimatch security fix).

Also refreshes related transitive versions under tools like rimraf/typedoc (e.g., minimatch, brace-expansion, balanced-match), removes the search-insights package entry from the lockfile, and marks typescript as a dev dependency in the lockfile.

Written by Cursor Bugbot for commit 3f1e0f0. This will update automatically on new commits. Configure here.

Bumps [minimatch](https://github.com/isaacs/minimatch) and [serve-handler](https://github.com/vercel/serve-handler). These dependencies needed to be updated together.

Updates `minimatch` from 3.1.2 to 3.1.5
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v3.1.2...v3.1.5)

Updates `minimatch` from 9.0.5 to 9.0.9
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v3.1.2...v3.1.5)

Updates `minimatch` from 10.0.1 to 10.2.4
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v3.1.2...v3.1.5)

Updates `serve-handler` from 6.1.6 to 6.1.7
- [Release notes](https://github.com/vercel/serve-handler/releases)
- [Commits](vercel/serve-handler@6.1.6...6.1.7)

---
updated-dependencies:
- dependency-name: minimatch
  dependency-version: 3.1.5
  dependency-type: indirect
- dependency-name: minimatch
  dependency-version: 9.0.9
  dependency-type: indirect
- dependency-name: minimatch
  dependency-version: 10.2.4
  dependency-type: indirect
- dependency-name: serve-handler
  dependency-version: 6.1.7
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Mar 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants