Bump the npm_and_yarn group across 1 directory with 18 updates #1

dependabot · 2025-01-13T13:43:12Z

Bumps the npm_and_yarn group with 15 updates in the / directory:

Package	From	To
webpack	`5.88.2`	`5.94.0`
@adobe/css-tools	`4.3.1`	`4.4.1`
@babel/traverse	`7.22.17`	`7.26.5`
braces	`3.0.2`	`3.0.3`
cross-spawn	`7.0.3`	`7.0.6`
ejs	`3.1.9`	`3.1.10`
express	`4.18.2`	`4.21.2`
follow-redirects	`1.15.2`	`1.15.9`
markdown-to-jsx	`7.3.2`	`7.7.3`
micromatch	`4.0.5`	`4.0.8`
nanoid	`3.3.6`	`3.3.8`
postcss	`8.4.29`	`8.4.49`
rollup	`3.29.1`	`3.29.5`
tar	`6.2.0`	`6.2.1`
webpack-dev-middleware	`6.1.1`	`6.1.3`

Updates webpack from 5.88.2 to 5.94.0

Release notes

Sourced from webpack's releases.

v5.94.0

Bug Fixes

Added runtime condition for harmony reexport checked

Handle properly data/http/https protocols in source maps

Make bigint optimistic when browserslist not found

Move @types/eslint-scope to dev deps

Related in asset stats is now always an array when no related found

Handle ASI for export declarations

Mangle destruction incorrect with export named default properly

Fixed unexpected asi generation with sequence expression

Fixed a lot of types

New Features

Added new external type "module-import"

Support webpackIgnore for new URL() construction

[CSS] @import pathinfo support

Security

Fixed DOM clobbering in auto public path

v5.93.0

Bug Fixes

Generate correct relative path to runtime chunks

Makes DefinePlugin quieter under default log level

Fixed mangle destructuring default in namespace import

Fixed consumption of eager shared modules for module federation

Strip slash for pretty regexp

Calculate correct contenthash for CSS generator options

New Features

Added the binary generator option for asset modules to explicitly keep source maps produced by loaders

Added the modern-module library value for tree shakable output

Added the overrideStrict option to override strict or non-strict mode for javascript modules

v5.92.1

Bug Fixes

Doesn't crash with an error when the css experiment is enabled and contenthash is used

v5.92.0

Bug Fixes

Correct tidle range's comutation for module federation

Consider runtime for pure expression dependency update hash

Return value in the subtractRuntime function for runtime logic

... (truncated)

Commits

eabf85d chore(release): 5.94.0
955e057 security: fix DOM clobbering in auto public path
9822387 test: fix
cbb86ed test: fix
5ac3d7f fix: unexpected asi generation with sequence expression
2411661 security: fix DOM clobbering in auto public path
b8c03d4 fix: unexpected asi generation with sequence expression
f46a03c revert: do not use heuristic fallback for "module-import"
60f1898 fix: do not use heuristic fallback for "module-import"
66306aa Revert "fix: module-import get fallback from externalsPresets"
Additional commits viewable in compare view

Updates @adobe/css-tools from 4.3.1 to 4.4.1

Changelog

Sourced from @adobe/css-tools's changelog.

4.4.0 / 2024-06-05

add support for @starting-style #319

4.3.3 / 2024-01-24

Update export property #271

4.3.2 / 2023-11-28

Fix redos vulnerability with specific crafted css string - CVE-2023-48631

Fix Problem parsing with :is() and nested :nth-child() #211

Commits

See full diff in compare view

Updates @babel/traverse from 7.22.17 to 7.26.5

Release notes

Sourced from @babel/traverse's releases.

v7.26.5 (2025-01-10)

👓 Spec Compliance

babel-parser

#17011 Allow the dynamic import.defer() form of import defer (@babel-bot)

🐛 Bug Fix

babel-plugin-transform-block-scoped-functions

#17024 chore: Avoid calling isInStrictMode in Babel 7 (@liuxingbaoyu)

babel-plugin-transform-typescript

#17026 fix: Correctly generate exported const enums in namespace (@liuxingbaoyu)

babel-parser

#17045 [estree] Unify method type parameters handling (@JLHwung)

#17013 fix: Correctly set position for @(a.b)() (@liuxingbaoyu)

#16996 [estree] Adjust the start loc of class methods with type params (@nicolo-ribaudo)

babel-generator, babel-parser, babel-plugin-transform-flow-strip-types, babel-types

#17028 Support flow jsx opening element type arguments (@JLHwung)

babel-compat-data, babel-preset-env

#17031 fix: More accurate transform-typeof-symbol compat data (@liuxingbaoyu)

babel-generator, babel-parser, babel-types

#17019 Fix incomplete visitor keys (@JLHwung)

🔬 Output optimization

babel-plugin-transform-nullish-coalescing-operator

#16612 Improve nullish coalescing operator output (@liuxingbaoyu)

Committers: 5

Babel Bot (@babel-bot)

Huáng Jùnliàng (@JLHwung)

Nicolò Ribaudo (@nicolo-ribaudo)

@liuxingbaoyu

fisker Cheung (@fisker)

v7.26.4 (2024-12-05)

↩️ Revert

babel-traverse

#17005 Revert "perf: Improve scope information collection performance" (@JLHwung)

Committers: 2

Huáng Jùnliàng (@JLHwung)

Nicolò Ribaudo (@nicolo-ribaudo)

v7.26.3 (2024-12-04)

🐛 Bug Fix

babel-generator

#16958 [preserveFormat] force semicolons when invalidating ASI (@nicolo-ribaudo)

🏠 Internal

... (truncated)

Changelog

Sourced from @babel/traverse's changelog.

v7.26.5 (2025-01-10)

👓 Spec Compliance

babel-parser

#17011 Allow the dynamic import.defer() form of import defer (@babel-bot)

🐛 Bug Fix

babel-plugin-transform-block-scoped-functions

#17024 chore: Avoid calling isInStrictMode in Babel 7 (@liuxingbaoyu)

babel-plugin-transform-typescript

#17026 fix: Correctly generate exported const enums in namespace (@liuxingbaoyu)

babel-parser

#17045 [estree] Unify method type parameters handling (@JLHwung)

#17013 fix: Correctly set position for @(a.b)() (@liuxingbaoyu)

#16996 [estree] Adjust the start loc of class methods with type params (@nicolo-ribaudo)

babel-generator, babel-parser, babel-plugin-transform-flow-strip-types, babel-types

#17028 Support flow jsx opening element type arguments (@JLHwung)

babel-compat-data, babel-preset-env

#17031 fix: More accurate transform-typeof-symbol compat data (@liuxingbaoyu)

babel-generator, babel-parser, babel-types

#17019 Fix incomplete visitor keys (@JLHwung)

🔬 Output optimization

babel-plugin-transform-nullish-coalescing-operator

#16612 Improve nullish coalescing operator output (@liuxingbaoyu)

v7.26.4 (2024-12-05)

↩️ Revert

babel-traverse

#17005 Revert "perf: Improve scope information collection performance" (@JLHwung)

v7.26.3 (2024-12-04)

🐛 Bug Fix

babel-generator

#16958 [preserveFormat] force semicolons when invalidating ASI (@nicolo-ribaudo)

🏠 Internal

babel-helper-builder-binary-assignment-operator-visitor, babel-plugin-transform-exponentiation-operator

#16895 Remove helper-builder-binary-assignment-operator-visitor (@nicolo-ribaudo)

🏃‍♀️ Performance

babel-generator

#16959 perf: Reduce the use of temporary objects (@liuxingbaoyu)

babel-traverse

#16923 perf: Improve scope information collection performance (@liuxingbaoyu)

#16964 perf: Avoid repeated traversal when creating scope (@liuxingbaoyu)

babel-plugin-transform-modules-commonjs

#16954 perf: Remove use of simplifyAccess (@liuxingbaoyu)

v7.26.2 (2024-10-30)

... (truncated)

Commits

74181cf v7.26.5
d35794e [Babel 8] Create TSEnumBody for TSEnumDeclaration (#16979)
cd24cc0 chore: Update TS 5.7 (#17053)
cf7b9cd v7.26.4
f33704a Revert "perf: Improve scope information collection performance" (#17005)
36ca8fa v7.26.3
ded1571 perf: Improve scope information collection performance (#16923)
943bdfe perf: Avoid repeated traversal when creating scope (#16964)
b07957e v7.25.9
af91759 fix: Accidentally publishing useless files (#16917)
Additional commits viewable in compare view

Updates braces from 3.0.2 to 3.0.3

Commits

74b2db2 3.0.3
88f1429 update eslint. lint, fix unit tests.
415d660 Snyk js braces 6838727 (#40)
190510f fix tests, skip 1 test in test/braces.expand
716eb9f readme bump
a5851e5 Merge pull request #37 from coderaiser/fix/vulnerability
2092bd1 feature: braces: add maxSymbols (https://github.com/micromatch/braces/issues/...
9f5b4cf fix: vulnerability (https://security.snyk.io/vuln/SNYK-JS-BRACES-6838727)
98414f9 remove funding file
665ab5d update keepEscaping doc (#27)
Additional commits viewable in compare view

Updates cross-spawn from 7.0.3 to 7.0.6

Changelog

Sourced from cross-spawn's changelog.

7.0.6 (2024-11-18)

Bug Fixes

update cross-spawn version to 7.0.5 in package-lock.json (f700743)

7.0.5 (2024-11-07)

Bug Fixes

fix escaping bug introduced by backtracking (640d391)

7.0.4 (2024-11-07)

Bug Fixes

disable regexp backtracking (#160) (5ff3a07)

Commits

77cd97f chore(release): 7.0.6
6717de4 chore: upgrade standard-version
f700743 fix: update cross-spawn version to 7.0.5 in package-lock.json
9a7e3b2 chore: fix build status badge
0852683 chore(release): 7.0.5
640d391 fix: fix escaping bug introduced by backtracking
bff0c87 chore: remove codecov
a7c6abc chore: replace travis with github workflows
9b9246e chore(release): 7.0.4
5ff3a07 fix: disable regexp backtracking (#160)
Additional commits viewable in compare view

Updates ejs from 3.1.9 to 3.1.10

Release notes

Sourced from ejs's releases.

v3.1.10

Version 3.1.10

Commits

d3f807d Version 3.1.10
9ee26dd Mocha TDD
e469741 Basic pollution protection
715e950 Merge pull request #756 from Jeffrey-mu/main
cabe314 Include advanced usage examples
29b076c Added header
11503c7 Merge branch 'main' of github.com:mde/ejs into main
7690404 Added security banner to README
f47d7ae Update SECURITY.md
828cea1 Update SECURITY.md
Additional commits viewable in compare view

Updates express from 4.18.2 to 4.21.2

Release notes

Sourced from express's releases.

4.21.2

What's Changed

Add funding field (v4) by @bjohansebas in expressjs/express#6065

deps: [email protected] by @blakeembrey in expressjs/express#5956

deps: bump [email protected] by @jonchurch in expressjs/express#6209

Release: 4.21.2 by @UlisesGascon in expressjs/express#6094

Full Changelog: expressjs/express@4.21.1...4.21.2

4.21.1

What's Changed

Backport a fix for CVE-2024-47764 to the 4.x branch by @joshbuker in expressjs/express#6029

Release: 4.21.1 by @UlisesGascon in expressjs/express#6031

Full Changelog: expressjs/express@4.21.0...4.21.1

4.21.0

What's Changed

Deprecate "back" magic string in redirects by @blakeembrey in expressjs/express#5935

[email protected] by @wesleytodd in expressjs/express#5954

fix(deps): [email protected] by @wesleytodd in expressjs/express#5951

Upgraded dependency qs to 6.13.0 to match qs in body-parser by @agadzinski93 in expressjs/express#5946

New Contributors

@agadzinski93 made their first contribution in expressjs/express#5946

Full Changelog: expressjs/express@4.20.0...4.21.0

4.20.0

What's Changed

Important

IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)

Remove link renderization in html while using res.redirect

Other Changes

4.19.2 Staging by @wesleytodd in expressjs/express#5561

remove duplicate location test for data uri by @wesleytodd in expressjs/express#5562

feat: document beta releases expectations by @marco-ippolito in expressjs/express#5565

Cut down on duplicated CI runs by @jonchurch in expressjs/express#5564

Add a Threat Model by @UlisesGascon in expressjs/express#5526

Assign captain of encodeurl by @blakeembrey in expressjs/express#5579

Nominate jonchurch as repo captain for http-errors, expressjs.com, morgan, cors, body-parser by @jonchurch in expressjs/express#5587

docs: update Security.md by @inigomarquinez in expressjs/express#5590

docs: update triage nomination policy by @UlisesGascon in expressjs/express#5600

Add CodeQL (SAST) by @UlisesGascon in expressjs/express#5433

docs: add UlisesGascon as triage initiative captain by @UlisesGascon in expressjs/express#5605

... (truncated)

Changelog

Sourced from express's changelog.

4.21.2 / 2024-11-06

deps: [email protected]

Fix backtracking protection

deps: [email protected]

Throws an error on invalid path values

4.21.1 / 2024-10-08

Backported a fix for CVE-2024-47764

4.21.0 / 2024-09-11

Deprecate res.location("back") and res.redirect("back") magic string

deps: [email protected]

includes [email protected]

deps: [email protected]

deps: [email protected]

4.20.0 / 2024-09-10

deps: [email protected]

Remove link renderization in html while redirecting

deps: [email protected]

Remove link renderization in html while redirecting

deps: [email protected]

add depth option to customize the depth level in the parser

IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)

Remove link renderization in html while using res.redirect

deps: [email protected]

Adds support for named matching groups in the routes using a regex

Adds backtracking protection to parameters without regexes defined

deps: encodeurl@~2.0.0

Removes encoding of \, |, and ^ to align better with URL spec

Deprecate passing options.maxAge and options.expires to res.clearCookie

Will be ignored in v5, clearCookie will set a cookie with an expires in the past to instruct clients to delete the cookie

4.19.2 / 2024-03-25

Improved fix for open redirect allow list bypass

4.19.1 / 2024-03-20

Allow passing non-strings to res.location with new encoding handling checks

... (truncated)

Commits

1faf228 4.21.2
2e0fb64 deps: bump [email protected] (#6209)
59fc270 deps: [email protected] (#5956)
51fc39c docs: add funding (#6065)
8e229f9 4.21.1
a024c8a fix(deps): [email protected]
7e562c6 4.21.0
1bcde96 fix(deps): [email protected] (#5946)
7d36477 fix(deps): [email protected] (#5951)
40d2d8f fix(deps): [email protected]
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by jonchurch, a new releaser for express since your current version.

Updates follow-redirects from 1.15.2 to 1.15.9

Commits

e4e55c7 Release version 1.15.9 of the npm package.
31a1abf Attempt much more gentle detection.
d2aaa97 Fix url field.
62558f0 Release version 1.15.8 of the npm package.
a8d1cee Return subtlety.
458ca8e Fix native URL test for Node 20.
ca49e44 Handle KeepAlive connections in tests.
f3711d7 Test on Node 20 and 22.
fda0faf Fix typo.
760757f Release version 1.15.7 of the npm package.
Additional commits viewable in compare view

Updates markdown-to-jsx from 7.3.2 to 7.7.3

Release notes

Sourced from markdown-to-jsx's releases.

v7.7.3

Patch Changes

8026103: Handle paragraph splitting better, fixes #641.

1ea00bb: Adjust table row parsing to better handle inline syntaxes and improve performance.

v7.7.2

Patch Changes

52a727c: Use ReactNode instead of ReactChild for React 19 compatibility

4fa87d8: Bump ws from 8.11.0 to 8.18.0

v7.7.1

Patch Changes

9d42449: Factor out unnecessary element cloning.

8920038: Remove use of explicit React.createElement.

v7.7.0

Minor Changes
20777bf: Add support for GFM alert-style blockquotes.
> [!Note]
> This is a note-flavored alert blockquote. The "Note" text is injected as a `<header>` by
> default and the blockquote can be styled via the injected class `markdown-alert-note`
> for example.
Patch Changes

5d7900b: Adjust type signature for <Markdown> component to allow for easier composition.

918b44b: Use newer React.JSX.* namespace instead of JSX.* for React 19 compatibility.

91a5948: Arbitrary HTML no longer punches out pipes when parsing rows. If you absolutely need a pipe character that isn't a table separator, either escape it or enclose it in backticks to trigger inline code handling.

23caecb: Drop encountered ref attributes when processing inline HTML, React doesn't handle it well.

v7.6.2

Patch Changes

0274445: Fix false detection of tables in some scenarios.

69f815e: Handle class attribute from arbitrary HTML properly to avoid React warnings.

857809a: Fenced code blocks are now tolerant to a missing closing sequence; this improves use in LLM scenarios where the code block markdown is being streamed into the editor in chunks.

v7.6.1

Patch Changes

87d8bd3: Handle class attribute from arbitrary HTML properly to avoid React warnings.

v7.6.0

... (truncated)

Changelog

Sourced from markdown-to-jsx's changelog.

7.7.3

Patch Changes

8026103: Handle paragraph splitting better, fixes #641.

1ea00bb: Adjust table row parsing to better handle inline syntaxes and improve performance.

7.7.2

Patch Changes

52a727c: Use ReactNode instead of ReactChild for React 19 compatibility

4fa87d8: Bump ws from 8.11.0 to 8.18.0

7.7.1

Patch Changes

9d42449: Factor out unnecessary element cloning.

8920038: Remove use of explicit React.createElement.

7.7.0

Minor Changes
20777bf: Add support for GFM alert-style blockquotes.
> [!Note]
> This is a note-flavored alert blockquote. The "Note" text is injected as a `<header>` by
> default and the blockquote can be styled via the injected class `markdown-alert-note`
> for example.
Patch Changes

5d7900b: Adjust type signature for <Markdown> component to allow for easier composition.

918b44b: Use newer React.JSX.* namespace instead of JSX.* for React 19 compatibility.

91a5948: Arbitrary HTML no longer punches out pipes when parsing rows. If you absolutely need a pipe character that isn't a table separator, either escape it or enclose it in backticks to trigger inline code handling.

23caecb: Drop encountered ref attributes when processing inline HTML, React doesn't handle it well.

7.6.2

Patch Changes

0274445: Fix false detection of tables in some scenarios.

69f815e: Handle class attribute from arbitrary HTML properly to avoid React warnings.

857809a: Fenced code blocks are now tolerant to a missing closing sequence; this improves use in LLM scenarios where the code block markdown is being streamed into the editor in chunks.

7.6.1

... (truncated)

Commits

3cfd019 Version Packages (#647)
8026103 fix: #641 (#648)
02c883b chore: put const back
50ccf2e refactor: further simplify
1ea00bb chore: changeset
a271bb4 refactor: collapse loop handling for perf
420251e fix: #644 parsing issue inside table rows
b732c6f chore: add llm instructions
0441c71 chore: upgrade yarn
c2ec5aa Version Packages (#637)
Additional commits viewable in compare view

Updates micromatch from 4.0.5 to 4.0.8

Release notes

Sourced from micromatch's releases.

4.0.8

Ultimate release that fixes both CVE-2024-4067 and CVE-2024-4068. We consider the issues low-priority, so even if you see automated scanners saying otherwise, don't be scared.

Changelog

Sourced from micromatch's changelog.

[4.0.8] - 2024-08-22

backported CVE-2024-4067 fix (from v4.0.6) over to 4.x branch

[4.0.7] - 2024-05-22

this is basically v4.0.5, with some README updates

it is vulnerable to CVE-2024-4067

Updated braces to v3.0.3 to avoid CVE-2024-4068

does NOT break API compatibility

[4.0.6] - 2024-05-21

Added hasBraces to check if a pattern contains braces.

Fixes CVE-2024-4067

BREAKS API COMPATIBILITY

Should be labeled as a major release, but it's not.

Commits

8bd704e 4.0.8
a0e6841 run verb to generate README documentation
4ec2884 Merge branch 'v4' into hauserkristof-feature/v4.0.8
03aa805 Merge pull request #266 from hauserkristof/feature/v4.0.8
814f5f7 lint
67fcce6 fix: CHANGELOG about braces & CVE-2024-4068, v4.0.5
113f2e3 fix: CVE numbers in CHANGELOG
d9dbd9a feat: updated CHANGELOG
2ab1315 fix: use actions/setup-node@v4
1406ea3 feat: rework test to work on macos with node 10,12 and 14
Additional commits viewable in compare view

Updates nanoid from 3.3.6 to 3.3.8

Changelog

Sourced from nanoid's changelog.

3.3.8

Fixed a way to break Nano ID by passing non-integer size (by @myndzi).

3.3.7

Fixed node16 TypeScript support (by Saadi Myftija).

Commits

3044cd5 Release 3.3.8 version
4fe3495 Update size limit
d643045 Fix pool pollution, infinite loop (#510)
89d82d2 Release 3.3.7 version
5022c35 Update dual-publish
3e7a8e5 Remove benchmark from CI for v3
d356144 Fix CI for v3
37b25df Move to pnpm 8
See full diff in compare view

Updates path-to-regexp from 0.1.7 to 0.1.12

Release notes

Sourced from path-to-regexp's releases.

Fix backtracking (again)

Fixed

Improved backtracking protection for 0.1.x, will break some previously valid paths (see previous advisory: GHSA-9wv6-86v2-598j)

pillarjs/path-to-regexp@v0.1.11...v0.1.12

Error on bad input

Changed

Add error on bad input values 8f09549

pillarjs/path-to-regexp@v0.1.10...v0.1.11

Backtrack protection

Fixed

Add backtrack protection to parameters 29b96b4

This will break some edge cases but should improve performance

pillarjs/path-to-regexp@v0.1.9...v0.1.10

Support non-lookahead regex output

Added

Allow a non-lookahead regex (#312) c4272e4

component/path-to-regexp@v0.1.8...v0.1.9

Support named matching groups in RegExp

Added

Add support for named matching groups (#301) 114f62d

pillarjs/path-to-regexp@v0.1.7...v0.1.8

Commits

640e694 0.1.12
f01c26a Merge commit from fork
0c71192 0.1.11
8f09549 Add error on bad input values
c827fce 0.1.10
29b96b4 Add backtrack protection to parameters
ac4c234 Update repo url (#314)
bdb6635 0.1.9
c4272e4 Allow a non-lookahead regex (#312)
51a1955 0.1.8
Additional commits viewable in compare view

Updates postcss from 8.4.29 to 8.4.49

Release notes

Sourced from postcss's releases.

8.4.49

Fixed custom syntax without source.offset (by @romainmenke).

8.4.48

Fixed position calculation in error/warnings methods (by @romainmenke).

8.4.47

Removed debug code.

8.4.46

Fixed Cannot read properties of undefined (reading 'before').

8.4.45

Removed unnecessary fix which could lead to infinite loop.

8.4.44

Another way to fix markClean is not a function error.

8.4.43

Fixed markClean is not a function error.

8.4.42

Fixed CSS syntax error on long minified files (by @varpstar).

8.4.41

Fixed types (by @nex3 and @querkmachine).

Cleaned up RegExps (by @bluwy).

8.4.40

Moved to getter/setter in nodes types to help Sass team (by @nex3).

8.4.39

Fixed CssSyntaxError types (by @romainmenke).

8.4.38

Fixed endIndex: 0 in errors and warnings (by @romainmenke).

8.4.37

Fixed original.column are not numbers error in another case.

8.4.36

Fixed original.column are not numbers error on broken previous source map.

8.4.35

Avoid ! in node.parent.nodes type.

Allow to pass undefined to node adding method to simplify types.

8.4.34

Fixed AtRule#nodes type (by @tim-we).

Cleaned up code (by @DrKiraDmitry).

... (truncated)

Changelog

Sourced from postcss's changelog.

8.4.49

Fixed custom syntax without source.offset (by @romainmenke).

8.4.48

Fixed position calculation in error/warnings methods (by @romainmenke).

8.4.47

Removed debug code.

8.4.46

Fixed Cannot read properties of undefined (reading 'before').

8.4.45

Removed unnecessary fix which could lead to infinite loop.

8.4.44

Another way to fix markClean is not a function error.

8.4.43

Fixed markClean is not a function error.

8.4.42

Fixed CSS syntax error on long minified files (by @varpstar).

8.4.41

Fixed types (by @nex3 and @querkmachine).

Cleaned up RegExps (by @bluwy).

8.4.40

Moved to getter/setter in nodes types to help Sass team (by @nex3).

8.4.39

Fixed CssSyntaxError types (by @romainmenke).

8.4.38

Fixed endIndex: 0 in errors and warnings (by @romainmenke).

8.4.37

Fixed original.column are not numbers error in another case.

8.4.36

Fixed original.column are not numbers error on broken previous source map.

8.4.35

Avoid ! in node.parent.nodes type.

Allow to pass undefined to node adding method to simplify types.

8.4.34

Fixed AtRule#nodes type (by Tim Weißenfels).

Cleaned up code (by Dmitry Kirillov).

... (truncated)

Commits

aed8b89 Release 8.4.49 version
3450630 Fix position calculations when offset is missing (#1983)
77420d6 Release 8.4.48 version
341529f Update dependencies
66fa667 Add Node.js 23 to CI
1a8b261 fix inconsistent position calculations (#1980)
1cc6ac3 Clarify usage in docs
5e6fd13 Release 8.4.47 version
714bc10 Typo
439d20e Release 8.4.46 version
Additional commits viewable in compare view

Updates rollup from 3.29.1 to 3.29.5

Release notes

Sourced from rollup's releases.

v3.29.5

3.29.5

2024-09-21

Bug Fixes

Fix a vulnerability in generated code that affects IIFE, UMD and CJS bundles when run in a browser context (#5671)

Pull Requests

#5671: Fix DOM Clobbering CVE (@lukastaegert)

v3.29.4

3.29.4

2023-09-28

Bug Fixes

Fix static analysis when an exported function uses callbacks (#5158)

Pull Requests

#5158: Deoptimize all parameters when losing track of a function (@lukastaegert)

v3.29.3

3.29.3

2023-09-24

Bug Fixes

Fix a bug where code was wrongly tree-shaken after mutating function parameters (#5153)

Pull Requests

#5145: docs: improve the docs repl appearance in the light mode (@TrickyPi)

#5148: chore(deps): update dependency @vue/eslint-config-typescript to v12 (@renovate[bot])

#5149: chore(deps): lock file maintenance minor/patch updates (@renovate[bot])

#5153: Fully deoptimize first level path when deoptimizing nested parameter paths (@lukastaegert)

v3.29.2

3.29.2

2023-09-15

Bug Fixes

Export TreeshakingPreset type (#5131)

... (truncated)

Changelog

S...

Description has been truncated

Bumps the npm_and_yarn group with 15 updates in the / directory: | Package | From | To | | --- | --- | --- | | [webpack](https://github.com/webpack/webpack) | `5.88.2` | `5.94.0` | | [@adobe/css-tools](https://github.com/adobe/css-tools) | `4.3.1` | `4.4.1` | | [@babel/traverse](https://github.com/babel/babel/tree/HEAD/packages/babel-traverse) | `7.22.17` | `7.26.5` | | [braces](https://github.com/micromatch/braces) | `3.0.2` | `3.0.3` | | [cross-spawn](https://github.com/moxystudio/node-cross-spawn) | `7.0.3` | `7.0.6` | | [ejs](https://github.com/mde/ejs) | `3.1.9` | `3.1.10` | | [express](https://github.com/expressjs/express) | `4.18.2` | `4.21.2` | | [follow-redirects](https://github.com/follow-redirects/follow-redirects) | `1.15.2` | `1.15.9` | | [markdown-to-jsx](https://github.com/quantizor/markdown-to-jsx) | `7.3.2` | `7.7.3` | | [micromatch](https://github.com/micromatch/micromatch) | `4.0.5` | `4.0.8` | | [nanoid](https://github.com/ai/nanoid) | `3.3.6` | `3.3.8` | | [postcss](https://github.com/postcss/postcss) | `8.4.29` | `8.4.49` | | [rollup](https://github.com/rollup/rollup) | `3.29.1` | `3.29.5` | | [tar](https://github.com/isaacs/node-tar) | `6.2.0` | `6.2.1` | | [webpack-dev-middleware](https://github.com/webpack/webpack-dev-middleware) | `6.1.1` | `6.1.3` | Updates `webpack` from 5.88.2 to 5.94.0 - [Release notes](https://github.com/webpack/webpack/releases) - [Commits](webpack/webpack@v5.88.2...v5.94.0) Updates `@adobe/css-tools` from 4.3.1 to 4.4.1 - [Changelog](https://github.com/adobe/css-tools/blob/main/History.md) - [Commits](https://github.com/adobe/css-tools/commits) Updates `@babel/traverse` from 7.22.17 to 7.26.5 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.26.5/packages/babel-traverse) Updates `braces` from 3.0.2 to 3.0.3 - [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md) - [Commits](micromatch/braces@3.0.2...3.0.3) Updates `cross-spawn` from 7.0.3 to 7.0.6 - [Changelog](https://github.com/moxystudio/node-cross-spawn/blob/master/CHANGELOG.md) - [Commits](moxystudio/node-cross-spawn@v7.0.3...v7.0.6) Updates `ejs` from 3.1.9 to 3.1.10 - [Release notes](https://github.com/mde/ejs/releases) - [Commits](mde/ejs@v3.1.9...v3.1.10) Updates `express` from 4.18.2 to 4.21.2 - [Release notes](https://github.com/expressjs/express/releases) - [Changelog](https://github.com/expressjs/express/blob/4.21.2/History.md) - [Commits](expressjs/express@4.18.2...4.21.2) Updates `follow-redirects` from 1.15.2 to 1.15.9 - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.15.2...v1.15.9) Updates `markdown-to-jsx` from 7.3.2 to 7.7.3 - [Release notes](https://github.com/quantizor/markdown-to-jsx/releases) - [Changelog](https://github.com/quantizor/markdown-to-jsx/blob/main/CHANGELOG.md) - [Commits](quantizor/markdown-to-jsx@v7.3.2...v7.7.3) Updates `micromatch` from 4.0.5 to 4.0.8 - [Release notes](https://github.com/micromatch/micromatch/releases) - [Changelog](https://github.com/micromatch/micromatch/blob/master/CHANGELOG.md) - [Commits](micromatch/micromatch@4.0.5...4.0.8) Updates `nanoid` from 3.3.6 to 3.3.8 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](ai/nanoid@3.3.6...3.3.8) Updates `path-to-regexp` from 0.1.7 to 0.1.12 - [Release notes](https://github.com/pillarjs/path-to-regexp/releases) - [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md) - [Commits](pillarjs/path-to-regexp@v0.1.7...v0.1.12) Updates `postcss` from 8.4.29 to 8.4.49 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.4.29...8.4.49) Updates `rollup` from 3.29.1 to 3.29.5 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md) - [Commits](rollup/rollup@v3.29.1...v3.29.5) Updates `send` from 0.18.0 to 0.19.0 - [Release notes](https://github.com/pillarjs/send/releases) - [Changelog](https://github.com/pillarjs/send/blob/master/HISTORY.md) - [Commits](pillarjs/send@0.18.0...0.19.0) Updates `serve-static` from 1.15.0 to 1.16.2 - [Release notes](https://github.com/expressjs/serve-static/releases) - [Changelog](https://github.com/expressjs/serve-static/blob/v1.16.2/HISTORY.md) - [Commits](expressjs/serve-static@v1.15.0...v1.16.2) Updates `tar` from 6.2.0 to 6.2.1 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v6.2.0...v6.2.1) Updates `webpack-dev-middleware` from 6.1.1 to 6.1.3 - [Release notes](https://github.com/webpack/webpack-dev-middleware/releases) - [Changelog](https://github.com/webpack/webpack-dev-middleware/blob/v6.1.3/CHANGELOG.md) - [Commits](webpack/webpack-dev-middleware@v6.1.1...v6.1.3) --- updated-dependencies: - dependency-name: webpack dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: "@adobe/css-tools" dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@babel/traverse" dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: braces dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: cross-spawn dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ejs dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: express dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: follow-redirects dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: markdown-to-jsx dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: micromatch dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: nanoid dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: path-to-regexp dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: postcss dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: rollup dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: send dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: serve-static dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tar dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: webpack-dev-middleware dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot bot added the dependencies Pull requests that update a dependency file label Jan 13, 2025

Bump reactflow version to v12

5533a86

dependabot bot force-pushed the dependabot/npm_and_yarn/npm_and_yarn-3750fe7299 branch from 32364a6 to fa889b0 Compare January 13, 2025 14:06

dependabot bot force-pushed the dependabot/npm_and_yarn/npm_and_yarn-3750fe7299 branch from fa889b0 to c7ab800 Compare January 13, 2025 14:19

hmusovicCF force-pushed the main branch 6 times, most recently from 4841f57 to 84cb2ac Compare January 14, 2025 09:36

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the npm_and_yarn group across 1 directory with 18 updates #1

Bump the npm_and_yarn group across 1 directory with 18 updates #1

dependabot bot commented on behalf of github Jan 13, 2025 •

edited

Loading

Bump the npm_and_yarn group across 1 directory with 18 updates #1

Are you sure you want to change the base?

Bump the npm_and_yarn group across 1 directory with 18 updates #1

Conversation

dependabot bot commented on behalf of github Jan 13, 2025 • edited Loading

v5.94.0

Bug Fixes

New Features

Security

v5.93.0

Bug Fixes

New Features

v5.92.1

Bug Fixes

v5.92.0

Bug Fixes

4.4.0 / 2024-06-05

4.3.3 / 2024-01-24

4.3.2 / 2023-11-28

v7.26.5 (2025-01-10)

👓 Spec Compliance

🐛 Bug Fix

🔬 Output optimization

Committers: 5

v7.26.4 (2024-12-05)

↩️ Revert

Committers: 2

v7.26.3 (2024-12-04)

🐛 Bug Fix

🏠 Internal

v7.26.5 (2025-01-10)

👓 Spec Compliance

🐛 Bug Fix

🔬 Output optimization

v7.26.4 (2024-12-05)

↩️ Revert

v7.26.3 (2024-12-04)

🐛 Bug Fix

🏠 Internal

🏃‍♀️ Performance

v7.26.2 (2024-10-30)

7.0.6 (2024-11-18)

Bug Fixes

7.0.5 (2024-11-07)

Bug Fixes

7.0.4 (2024-11-07)

Bug Fixes

v3.1.10

4.21.2

What's Changed

4.21.1

What's Changed

4.21.0

What's Changed

New Contributors

4.20.0

What's Changed

Important

Other Changes

4.21.2 / 2024-11-06

4.21.1 / 2024-10-08

4.21.0 / 2024-09-11

4.20.0 / 2024-09-10

4.19.2 / 2024-03-25

4.19.1 / 2024-03-20

v7.7.3

Patch Changes

v7.7.2

Patch Changes

v7.7.1

Patch Changes

v7.7.0

Minor Changes

Patch Changes

v7.6.2

Patch Changes

v7.6.1

Patch Changes

v7.6.0

7.7.3

dependabot bot commented on behalf of github Jan 13, 2025 •

edited

Loading

Support named matching groups in `RegExp`