build(deps): bump the npm_and_yarn group across 1 directory with 12 updates by dependabot[bot] · Pull Request #121 · bestreads/Frontend

dependabot · 2026-09-16T22:24:44Z

Bumps the npm_and_yarn group with 12 updates in the / directory:

Package	From	To
axios	`1.15.0`	`1.18.0`
react-router	`7.13.1`	`7.18.2`
vite	`7.3.2`	`7.3.6`
@babel/core	`7.29.0`	`7.29.7`
@humanfs/node	`0.16.7`	`0.16.8`
baseline-browser-mapping	`2.10.0`	`2.11.24`
brace-expansion	`5.0.3`	`5.0.12`
browserslist	`4.28.1`	`4.29.0`
esbuild	`0.27.3`	`0.28.2`
form-data	`4.0.5`	`4.0.6`
nanoid	`3.3.11`	`3.3.19`
postcss	`8.5.6`	`8.5.28`

Updates axios from 1.15.0 to 1.18.0

Release notes

Sourced from axios's releases.

v1.18.0 — June 13, 2026

This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.

🔒 Security Fixes

Redirect Header Safety: Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (#10892)

URL And Request Hardening: Rejects malformed http: and https: URLs that omit // with ERR_INVALID_URL, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local NO_PROXY matching. (#11000)

🐛 Bug Fixes

Status Validation: Added transitional.validateStatusUndefinedResolves so applications can opt in to treating validateStatus: undefined like the option was omitted, while validateStatus: null remains the explicit way to accept every status. (#10899)

🔧 Maintenance & Chores

Documentation: Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the proxy request config as Node.js-only in the advanced docs. (#10984, #10988, #10992, #10995)

Dependencies: Bumped @babel/core, @babel/preset-env, @commitlint/cli, @commitlint/config-conventional, @rollup/plugin-babel, @rollup/plugin-commonjs, @vitest/browser, @vitest/browser-playwright, eslint, lint-staged, rollup, vitest, and actions/checkout. (#10989, #10996, #10997)

Release Metadata: Prepared the 1.18.0 release by updating package metadata and the runtime VERSION value. (#11003)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

@drori12 (#10984)

@eyupcanakman (#10899)

@Adi-Beker (#10995)

Full Changelog

v1.17.0 — June 1, 2026

This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.

🔒 Security Fixes

Config Hardening: Guarded socketPath, params, and paramsSerializer reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (#10901, #10922)

Release Publishing: Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (#10926)

🚀 New Features

HTTP Compression: Added Node HTTP adapter support for zstd response decompression, with transitional.advertiseZstdAcceptEncoding controlling whether zstd is advertised in Accept-Encoding. (#6792, #10920)

🐛 Bug Fixes

Authentication Handling: Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (#10929, #10896)

Proxy TLS: Preserved user httpsAgent TLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (#10957)

React Native FormData: Cleared default Content-Type for React Native FormData so multipart boundaries can be generated correctly. (#10898)

... (truncated)

Changelog

Sourced from axios's changelog.

v1.18.0 — June 13, 2026

This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.

🔒 Security Fixes

Redirect Header Safety: Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (#10892)

URL And Request Hardening: Rejects malformed http: and https: URLs that omit // with ERR_INVALID_URL, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local NO_PROXY matching. (#11000)

🐛 Bug Fixes

Status Validation: Added transitional.validateStatusUndefinedResolves so applications can opt in to treating validateStatus: undefined like the option was omitted, while validateStatus: null remains the explicit way to accept every status. (#10899)

🔧 Maintenance & Chores

Documentation: Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the proxy request config as Node.js-only in the advanced docs. (#10984, #10988, #10992, #10995)

Dependencies: Bumped @babel/core, @babel/preset-env, @commitlint/cli, @commitlint/config-conventional, @rollup/plugin-babel, @rollup/plugin-commonjs, @vitest/browser, @vitest/browser-playwright, eslint, lint-staged, rollup, vitest, and actions/checkout. (#10989, #10996, #10997)

Release Metadata: Prepared the 1.18.0 release by updating package metadata and the runtime VERSION value. (#11003)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

@drori12 (#10984)

@eyupcanakman (#10899)

@Adi-Beker (#10995)

Full Changelog

v1.17.0 — June 1, 2026

This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.

🔒 Security Fixes

Config Hardening: Guarded socketPath, params, and paramsSerializer reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (#10901, #10922)

Release Publishing: Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (#10926)

🚀 New Features

HTTP Compression: Added Node HTTP adapter support for zstd response decompression, with transitional.advertiseZstdAcceptEncoding controlling whether zstd is advertised in Accept-Encoding. (#6792, #10920)

🐛 Bug Fixes

Authentication Handling: Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (#10929, #10896)

Proxy TLS: Preserved user httpsAgent TLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (#10957)

React Native FormData: Cleared default Content-Type for React Native FormData so multipart boundaries can be generated correctly. (#10898)

... (truncated)

Commits

2d06f96 chore(release): prepare release 1.18.0 (#11003)
32fc489 fix: malformed http urls (#11000)
b40ce49 chore(deps-dev): bump the development_dependencies group with 10 updates (#10...
fe964f9 docs: mark proxy config as Node.js only (#10995)
5f229d2 chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions ...
fae9d4e docs: clarify package update PR policy (#10992)
28ab2ce chore(deps-dev): bump the development_dependencies group with 2 updates (#10989)
a8e4f13 fix(core): keep default validateStatus when request passes undefined (#10899)
614f455 docs: publish v1.17.0 release notes (#10988)
6bb12c1 fix: custom auth headers not stripped on cross-origin redirects (#10892)
Additional commits viewable in compare view

Updates react-router from 7.13.1 to 7.18.2

Release notes

Sourced from react-router's releases.

v7.18.2

See the changelog for release notes: https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7182

v7.18.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7181

v7.18.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180

v7.17.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7170

v7.16.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7160

v7.15.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7151

v7.15.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7150

v7.14.2

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7142

v7.14.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7141

v7.14.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7140

v7.13.2

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7132

Changelog

Sourced from react-router's changelog.

v7.18.2

Patch Changes

Harden RSC CSRF codepaths. (#15353)

v7.18.1

Patch Changes

No changes

v7.18.0

Patch Changes

Fix server handler prerender responses when using ssr: false and future.v8_trailingSlashAwareDataRequests: true. Avoids false positive "SPA Mode" detection when serving prerendered paths (#15173)

Use the ServerRouter nonce for nonce-aware SSR components when they don't provide their own value so strict CSP pages can load them. (#15170)

Use turbo-stream to serialize and deserialize Framework Mode hydration errors (#15175)

Precompute route branch matchers to avoid recompiling route path regexes during matching (#15186)

Use the constructed request URL host when validating action request origins. (#15185)

Remove the un-documented custom error serialization logic from Data Mode SSR built-in hydration flows (#15175)

Validate protocols in RSC render redirects (#15177)

Consolidate url normalization logic and better handle mixed slashes (#15176)

v7.17.0

Minor Changes

Ship a subset of the official documentation inside the react-router package (#15121)

Markdown docs are now available in node_modules/react-router/docs, letting AI coding agents and the React Router agent skills read official docs locally

Excludes auto-generated API docs (api/), community/ content, and tutorials (tutorials/)

v7.16.0

Minor Changes

Stabilize future.unstable_trailingSlashAwareDataRequests as future.v8_trailingSlashAwareDataRequests (#15098)

Patch Changes

Disable manifest path when lazy route dicovery is disabled (#15068)

Fix browser URL creation to use the configured history window instead of the global window. (#15066)

Pass the history/router window through to createBrowserURLImpl so custom window contexts keep the correct URL origin.

Fix useNavigation() return type to preserve discriminated union across navigation states (#15095)

Widen MetaDescriptor script:ld+json type from LdJsonObject to LdJsonObject | LdJsonObject[] to permit multiple JSON-LD schemas in a single <script type="application/ld+json"> tag emitted by <Meta /> (#15082)

... (truncated)

Commits

69a653e Release v7.18.2 (#15354)
8ebd5df Harden RSC CSRF codepaths (backport of #15311) (#15353)
afdf85d Release v7.18.1 (#15253)
6fb1e79 Release v7.18.0 (#15187)
09e6020 Optimize route matching internals (#15186)
5b57f5f Request Host derivation + CSRF check simplifications (#15185)
ce596e8 Validate RSC redirect protocols (#15177)
1cebd2a chore: format
9d22943 Use turbo stream for framework hydration errors (#15175)
bf63729 Consolidate url normalization logic (#15176)
Additional commits viewable in compare view

Updates vite from 7.3.2 to 7.3.6

Release notes

Sourced from vite's releases.

v7.3.6

Please refer to CHANGELOG.md for details.

v7.3.5

Please refer to CHANGELOG.md for details.

v7.3.3

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

7.3.6 (2026-06-25)

Features

allow esbuild 0.28 (#22743) (a24931e)

7.3.5 (2026-06-01)

Bug Fixes

backport #22572, reject windows alternate paths (#22574) (8c18556)

deps: backport #22571, reject UNC paths for launch-editor-middleware (#22573) (f20d64b)

Miscellaneous Chores

skip v7.3.4 release (8a6a0c9)

7.3.4 (2026-06-01)

Bug Fixes

backport #22572, reject windows alternate paths (#22574) (8c18556)

deps: backport #22571, reject UNC paths for launch-editor-middleware (#22573) (f20d64b)

7.3.3 (2026-05-07)

Bug Fixes

avoid destructure lowering for newer safari (#22346) (5ab51c0)

Commits

0a7b53b release: v7.3.6
a24931e feat: allow esbuild 0.28 (#22743)
077945c release: v7.3.5
8a6a0c9 chore: skip v7.3.4 release
8c18556 fix: backport #22572, reject windows alternate paths (#22574)
f20d64b fix(deps): backport #22571, reject UNC paths for launch-editor-middleware (#2...
ca31424 release: v7.3.3
5ab51c0 fix: avoid destructure lowering for newer safari (#22346)
See full diff in compare view

Updates @babel/core from 7.29.0 to 7.29.7

Release notes

Sourced from @babel/core's releases.

v7.29.7 (2026-05-25)

Re-release all packages with npm provenance attestations

v7.29.6 (2026-05-25)

🐛 Bug Fix

babel-generator

#18014 Catchup source map position in preserveFormat (@nicolo-ribaudo)

babel-core

#18001 [7.x packport]Improve input source map handling (@JLHwung)

babel-core, babel-generator

#17998 Preserve original identifier names from input sourcemaps (#17992) (@Andarist)

Committers: 3

Huáng Jùnliàng (@JLHwung)

Mateusz Burzyński (@Andarist)

Nicolò Ribaudo (@nicolo-ribaudo)

v7.29.5 (2026-05-05)

🏠 Internal

babel-preset-env

Update @babel/* dependencies

v7.29.4 (2026-05-05)

🐛 Bug Fix

babel-plugin-transform-modules-systemjs

#17974 [7.x backport]fix(systemjs): improve module string name support (@JLHwung)

Committers: 1

Huáng Jùnliàng (@JLHwung)

v7.29.3 (2026-04-30)

👓 Spec Compliance

babel-parser

#17923 Support flow extends bound (@JLHwung)

🐛 Bug Fix

babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators

#17931 fix(decorators): replace super within all removed static elements (@JLHwung)

babel-register

#17915 Fix thread synchronization issues in @babel/register (@liuxingbaoyu)

babel-compat-data, babel-plugin-bugfix-safari-rest-destructuring-rhs-array, babel-preset-env

#17788 Add bugfix plugin for Safari array rest destructuring bug (@JLHwung)

💅 Polish

babel-parser

... (truncated)

Commits

4fba754 v7.29.7
04ea6b2 v7.29.6
99f498a [7.x packport]Improve input source map handling (#18001)
feba0a3 Preserve original identifier names from input sourcemaps (#17992) (#17998)
See full diff in compare view

Updates @humanfs/node from 0.16.7 to 0.16.8

Release notes

Sourced from @humanfs/node's releases.

node: v0.16.8

0.16.8 (2026-04-17)

Bug Fixes

Include type dependencies at runtime (956ce7a), closes #145

Dependencies

The following workspace dependencies were updated

dependencies

@humanfs/core bumped from ^0.19.1 to ^0.19.2

Changelog

Sourced from @humanfs/node's changelog.

0.16.8 (2026-04-17)

Bug Fixes

Ensure symlinks are copied as symlinks in copy() and copyAll() (22bbaa44)

Include type dependencies at runtime (956ce7a), closes #145

Dependencies

The following workspace dependencies were updated

dependencies

@humanfs/core bumped from ^0.19.1 to ^0.19.2

Commits

e96070e chore: release main (#146)
22bbaa4 Merge commit from fork
956ce7a fix: Include type dependencies at runtime
See full diff in compare view

Updates baseline-browser-mapping from 2.10.0 to 2.11.24

Release notes

Sourced from baseline-browser-mapping's releases.

v2.11.0

What's Changed in 2.11.0

feat: Adds a new getTimeline() method for getting the series of minimum browser changes, either grouped by date or by browser.

refactor: Substantial refactoring of the data compression process that replaces the full list of browsers from @mdn/browser-compat-data and downstream-browsers.json and features from web-features (in their very pared down form) with a change-list timeline that reflects which versions supported Baseline (newly available) on a given date. Thanks to @swwind for the idea!

refactor: Some common functions have been moved to a util.ts module for use in other scripts.

fix: Removes process.exit() calls when unsupported option combinations are passed to getCompatibleVersions() and getAllVersions() in favour of throwing an Error. There is a small security risk with process.exit() calls that sites accepting unsanitised inputs could be the subject of attacks. Unsupported config options now throw and Error which should allow for more graceful handling. Thanks to @bnbdr for flagging this as vulnerability CVE-2026-45819 .

Fixes #134

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.10.44...v2.11.0

Commits

0d33c4a Patch to 2.11.24 because browser or feature data changed
1dac891 Browser or feature data changed
aff3369 Updating static site
ebdc72f Patch to 2.11.23 because browser or feature data changed
55fa3a1 Browser or feature data changed
5ac60db Updating static site
af7c3c4 Patch to 2.11.22 because browser or feature data changed
7e10cad Browser or feature data changed
ebb9702 Updating static site
ecc57a3 Updating static site
Additional commits viewable in compare view

Updates brace-expansion from 5.0.3 to 5.0.12

Commits

f341015 5.0.12
33a5ef1 Merge commit from fork
8247927 5.0.11
935d78f Merge commit from fork
df7682f 5.0.10
1ade9de npm run format
6735c94 Merge commit from fork
4e70465 chore: ensure prettier formatting (#154)
fd7a5e3 Bump ip-address from 10.2.0 to 10.4.0 (#152)
1790143 Bump uuid and @tapjs/processinfo (#120)
Additional commits viewable in compare view

Updates browserslist from 4.28.1 to 4.29.0

Release notes

Sourced from browserslist's releases.

4.29.0

Added query continuations across lines and array entries (by @fzlzjerry).

4.28.9

Improve or parsing performance (by @NotAFlightRisk).

4.28.8

Fixed including kaios in baseline queries (by @Jaybhade).

4.28.7

Improved parsing performance.

Fixed unbounded memory growth (by @alanturing881).

Fixed prototype write issue (by @alanturing881).

4.28.6

Fixed Electron version queries (by @spokodev).

4.28.5

Fixed > and >= queries (by @spokodev).

4.28.4

Fixed SyntaxError regression of 4.28.3.

4.28.3

Fixed baseline query case-insensitivity (by @swwind).

4.28.2

Fix prototype pollution (by @chluo1997).

Changelog

Sourced from browserslist's changelog.

4.29.0

Added query continuations across lines and array entries (by @fzlzjerry).

4.28.9

Improved or parsing performance (by @NotAFlightRisk).

4.28.8

Fixed including kaios in baseline queries (by @Jaybhade).

4.28.7

Improved parsing performance.

Fixed unbounded memory growth (by @alanturing881).

Fixed prototype write issue (by @alanturing881).

4.28.6

Fixed Electron version queries (by @spokodev).

4.28.5

Fixed > and >= queries (by @spokodev).

4.28.4

Fixed SyntaxError regression of 4.28.3.

4.28.3

Fixed baseline query case-insensitivity (by @swwind).

4.28.2

Fix prototype pollution (by @chluo1997).

Commits

e6dd578 Release 4.29.0 version
8987b7d Typo
47fefe6 Move from actions-up to pnpm
17b1e23 Update dependencies
df16b26 Merge pull request #944 from fzlzjerry/fix/757-query-continuations
a2673d7 Support query continuations across entries
f46a5b7 Merge pull request #942 from agilgur5/fix-docs-typo-security-table
989c8c9 docs: fix typo in table rendering for SECURITY.md
12ed525 Release 4.28.9 version
b1d8cf9 Update dependencies
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for browserslist since your current version.

Updates esbuild from 0.27.3 to 0.28.2

Release notes

Sourced from esbuild's releases.

v0.28.2
Fix tree shaking bug due to TypeScript import alias (#4507)

This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:
import Base from './dep.js';
import Alias = Base.SomeType;
Fix CSS minification bug involving & (#4497)

This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:
/* Original code */
.a .b {
 & .b:not(& .c) {
 color: red;
 }
}
/* Old output (with --minify) */
.a .b{.b:not(& .c){color:red}}
/* New output (with --minify) */
.a .b{& .b:not(& .c){color:red}}
This should match yes but not no. The old output incorrectly matched both.
Avoid overwriting input files without --allow-overwrite (#4484)

For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

Fix incorrect code generated when using top-level await (#4498)

Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.
Fix a minification bug with lowered logical assignment operators (#4508)

This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:
// Original code
function foo() {
 let x
 bar(x ||= {})

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.2
Fix tree shaking bug due to TypeScript import alias (#4507)

This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:
import Base from './dep.js';
import Alias = Base.SomeType;
Fix CSS minification bug involving & (#4497)

This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:
/* Original code */
.a .b {
 & .b:not(& .c) {
 color: red;
 }
}
/* Old output (with --minify) */
.a .b{.b:not(& .c){color:red}}
/* New output (with --minify) */
.a .b{& .b:not(& .c){color:red}}
This should match yes but not no. The old output incorrectly matched both.
Avoid overwriting input files without --allow-overwrite (#4484)

For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

Fix incorrect code generated when using top-level await (#4498)

Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.
Fix a minification bug with lowered logical assignment operators (#4508)

This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:
// Original code
function foo() {
 let x

... (truncated)

Commits

609683d publish 0.28.2 to npm
11b1fe4 add to release notes
ab50d91 css: fix green/blue channel swap in oklch gamut mapping (#4488)
04627b6 fix #4498: async TLA checks need a worklist
5c15177 disable gopls in the go folder
fc2ee9b css: adjust parser to allow --foo: {...}
209db54 release notes for css nesting bugfix
c625d31 fix #4497: preserve nested ampersands during minification (#4500)
34474e2 better isolation of current part in js parser
07f6e8c fix #4507: import assignment tree-shaking bug
Additional commits viewable in compare view

Updates form-data from 4.0.5 to 4.0.6

Changelog

Sourced from form-data's changelog.

v4.0.6 - 2026-06-12

Commits

[Fix] escape CR, LF, and " in field names and filenames 8dff42c

[Dev Deps] update @ljharb/eslint-config, auto-changelog, tape f31d21e

[Deps] update hasown, mime-types 92ae0eb

[Dev Deps] update js-randomness-predictor 67b0f65

Commits

64190db v4.0.6
92ae0eb [Deps] update hasown, mime-types
f31d21e [Dev Deps] update @ljharb/eslint-config, auto-changelog, tape
8dff42c [Fix] escape CR, LF, and " in field names and filenames
67b0f65 [Dev Deps] update js-randomness-predictor
See full diff in compare view

Updates nanoid from 3.3.11 to 3.3.19

Release notes

Sourced from nanoid's releases.

3.3.19

Fixed killing the app by setting huge user ID.

3.3.18

Fixed infinite loop on async for React Native (by @OvergrowthBeards-JB).

3.3.17

Fixed infinite loop on zero size.

3.3.16

Fixed infinite loop on negative size (by @greymoth-jp).

3.3.15

Fixed npm provenance error.

3.3.14

Fixed random pool corruption on big ID sizes.

3.3.13

Reduced npm package size.

3.3.12

Fixed breaking Nano ID by requesting big ID.

Changelog

Sourced from nanoid's changelog.

3.3.19

Fixed killing the app by setting huge user ID (by @geoffrey-diederichs).

3.3.18

Fixed infinite loop on async for React Native (by @OvergrowthBeards-JB).

3.3.17

Fixed infinite loop on zero size.

3.3.16

Fixed infinite loop on negative size (by

…pdates Bumps the npm_and_yarn group with 12 updates in the / directory: | Package | From | To | | --- | --- | --- | | [axios](https://github.com/axios/axios) | `1.15.0` | `1.18.0` | | [react-router](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router) | `7.13.1` | `7.18.2` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `7.3.2` | `7.3.6` | | [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) | `7.29.0` | `7.29.7` | | [@humanfs/node](https://github.com/humanwhocodes/humanfs/tree/HEAD/packages/node) | `0.16.7` | `0.16.8` | | [baseline-browser-mapping](https://github.com/web-platform-dx/baseline-browser-mapping) | `2.10.0` | `2.11.24` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `5.0.3` | `5.0.12` | | [browserslist](https://github.com/browserslist/browserslist) | `4.28.1` | `4.29.0` | | [esbuild](https://github.com/evanw/esbuild) | `0.27.3` | `0.28.2` | | [form-data](https://github.com/form-data/form-data) | `4.0.5` | `4.0.6` | | [nanoid](https://github.com/ai/nanoid) | `3.3.11` | `3.3.19` | | [postcss](https://github.com/postcss/postcss) | `8.5.6` | `8.5.28` | Updates `axios` from 1.15.0 to 1.18.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.15.0...v1.18.0) Updates `react-router` from 7.13.1 to 7.18.2 - [Release notes](https://github.com/remix-run/react-router/releases) - [Changelog](https://github.com/remix-run/react-router/blob/react-router@7.18.2/packages/react-router/CHANGELOG.md) - [Commits](https://github.com/remix-run/react-router/commits/react-router@7.18.2/packages/react-router) Updates `vite` from 7.3.2 to 7.3.6 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v7.3.6/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v7.3.6/packages/vite) Updates `@babel/core` from 7.29.0 to 7.29.7 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.7/packages/babel-core) Updates `@humanfs/node` from 0.16.7 to 0.16.8 - [Release notes](https://github.com/humanwhocodes/humanfs/releases) - [Changelog](https://github.com/humanwhocodes/humanfs/blob/main/packages/node/CHANGELOG.md) - [Commits](https://github.com/humanwhocodes/humanfs/commits/node-v0.16.8/packages/node) Updates `baseline-browser-mapping` from 2.10.0 to 2.11.24 - [Release notes](https://github.com/web-platform-dx/baseline-browser-mapping/releases) - [Commits](web-platform-dx/baseline-browser-mapping@v2.10.0...v2.11.24) Updates `brace-expansion` from 5.0.3 to 5.0.12 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v5.0.3...v5.0.12) Updates `browserslist` from 4.28.1 to 4.29.0 - [Release notes](https://github.com/browserslist/browserslist/releases) - [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md) - [Commits](browserslist/browserslist@4.28.1...4.29.0) Updates `esbuild` from 0.27.3 to 0.28.2 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md) - [Commits](evanw/esbuild@v0.27.3...v0.28.2) Updates `form-data` from 4.0.5 to 4.0.6 - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v4.0.5...v4.0.6) Updates `nanoid` from 3.3.11 to 3.3.19 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](ai/nanoid@3.3.11...3.3.19) Updates `postcss` from 8.5.6 to 8.5.28 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.6...8.5.28) --- updated-dependencies: - dependency-name: axios dependency-version: 1.18.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: react-router dependency-version: 7.18.2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 7.3.6 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: "@babel/core" dependency-version: 7.29.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@humanfs/node" dependency-version: 0.16.8 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: baseline-browser-mapping dependency-version: 2.11.24 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 5.0.12 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: browserslist dependency-version: 4.29.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: esbuild dependency-version: 0.28.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: form-data dependency-version: 4.0.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: nanoid dependency-version: 3.3.19 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.28 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 16, 2026

davidclarafigueiredo approved these changes Sep 16, 2026

View reviewed changes

davidclarafigueiredo merged commit ef32ae9 into main Sep 16, 2026
2 checks passed

dependabot Bot deleted the dependabot/npm_and_yarn/npm_and_yarn-111f14ae29 branch September 16, 2026 22:33

Navigation Menu

Repository navigation

build(deps): bump the npm_and_yarn group across 1 directory with 12 updates - #121

build(deps): bump the npm_and_yarn group across 1 directory with 12 updates#121
davidclarafigueiredo merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-111f14ae29

dependabot Bot commented on behalf of github Sep 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Sep 16, 2026

v1.18.0 — June 13, 2026

🔒 Security Fixes

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

v1.17.0 — June 1, 2026

🔒 Security Fixes

🚀 New Features

🐛 Bug Fixes

v1.18.0 — June 13, 2026

🔒 Security Fixes

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

v1.17.0 — June 1, 2026

🔒 Security Fixes

🚀 New Features

🐛 Bug Fixes

v7.18.2

v7.18.1

v7.18.0

v7.17.0

v7.16.0

v7.15.1

v7.15.0

v7.14.2

v7.14.1

v7.14.0

v7.13.2

v7.18.2

Patch Changes

v7.18.1

Patch Changes

v7.18.0

Patch Changes

v7.17.0

Minor Changes

v7.16.0

Minor Changes

Patch Changes

v7.3.6

v7.3.5

v7.3.3

7.3.6 (2026-06-25)

Features

7.3.5 (2026-06-01)

Bug Fixes

Miscellaneous Chores

7.3.4 (2026-06-01)

Bug Fixes

7.3.3 (2026-05-07)

Bug Fixes

v7.29.7 (2026-05-25)

v7.29.6 (2026-05-25)

🐛 Bug Fix

Committers: 3

v7.29.5 (2026-05-05)

🏠 Internal

v7.29.4 (2026-05-05)

🐛 Bug Fix

Committers: 1

v7.29.3 (2026-04-30)

👓 Spec Compliance

🐛 Bug Fix

💅 Polish

node: v0.16.8

0.16.8 (2026-04-17)

Bug Fixes

Dependencies

0.16.8 (2026-04-17)

Bug Fixes

Dependencies

v2.11.0

What's Changed in 2.11.0

4.29.0

4.28.9

4.28.8

4.28.7