Skip to content

build(deps): bump the npm_and_yarn group across 1 directory with 9 updates - #19

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-7af7e5ba05
Closed

build(deps): bump the npm_and_yarn group across 1 directory with 9 updates#19
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-7af7e5ba05

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 7, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 9 updates in the / directory:

Package From To
@sigstore/core 3.0.0 3.2.1
brace-expansion 2.0.1 2.1.7
handlebars 4.7.8 4.7.10
ip-address 10.1.0 10.7.3
js-yaml 4.1.0 4.3.2
lodash-es 4.17.21 4.18.1
postcss-selector-parser 7.1.0 7.1.6
sigstore 4.0.0 4.1.1
tar 7.5.2 7.5.22

Updates @sigstore/core from 3.0.0 to 3.2.1

Release notes

Sourced from @​sigstore/core's releases.

@​sigstore/core@​3.2.1

Patch Changes

  • b5aa4f1: Apply UTF-8 encoding to payload type during PAE calculation

@​sigstore/core@​3.2.0

Minor Changes

  • 8f736ef: Update the createPublicKey function to support base64-encoded keys
Commits

Updates brace-expansion from 2.0.1 to 2.1.7

Release notes

Sourced from brace-expansion's releases.

v2.1.1

  • Backport v5.0.6 change to v2 (#109) c3a817c

juliangruber/brace-expansion@v2.1.0...v2.1.1

v2.0.2

  • pkg: publish on tag 2.x 14f1d91
  • fmt ed7780a
  • Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) 36603d5

juliangruber/brace-expansion@v2.0.1...v2.0.2

Commits

Updates handlebars from 4.7.8 to 4.7.10

Release notes

Sourced from handlebars's releases.

v4.7.10

  • security: Sanitize the source map URL when minifying - f37c599
  • security: Iterate lazily in #each and strip whitespace in linear time - 812c226
  • security: Escape <!-- and <script in precompiled output - 609d1b1 GHSA-xw65-4hp5-5hc7
  • security: Don't trust special properties on context data - ceec388 GHSA-p8wg-vrv2-v86f
  • security: Only compile partials that are template strings - c28ee7a
  • security: Only dispatch known node types in the Compiler and Visitor - 7d501a5
  • security: Validate AST values in the compiler instead of the parser - 703fdcc GHSA-8r5x-fm3f-whwj
  • Clarify that --root does not restrict filesystem access - 0fcf25c
  • Bump minimist to ^1.2.8 - ea8ed82
  • Fix Ruby component publishing documentation - d069c1c
  • Fix Composer component definition - 6714e07

Compatibility notes:

  • {{#each}} iterates iterables such as Map, Set and generators lazily, like for...of, instead of copying them into an array first. Values added to the iterable while the block renders are now visited too.

Commits

v4.7.9

Commits

Changelog

Sourced from handlebars's changelog.

v4.7.10 - October 5th, 2026

  • security: Sanitize the source map URL when minifying - f37c599
  • security: Iterate lazily in #each and strip whitespace in linear time - 812c226
  • security: Escape <!-- and <script in precompiled output - 609d1b1 GHSA-xw65-4hp5-5hc7
  • security: Don't trust special properties on context data - ceec388 GHSA-p8wg-vrv2-v86f
  • security: Only compile partials that are template strings - c28ee7a
  • security: Only dispatch known node types in the Compiler and Visitor - 7d501a5
  • security: Validate AST values in the compiler instead of the parser - 703fdcc GHSA-8r5x-fm3f-whwj
  • Clarify that --root does not restrict filesystem access - 0fcf25c
  • Bump minimist to ^1.2.8 - ea8ed82
  • Fix Ruby component publishing documentation - d069c1c
  • Fix Composer component definition - 6714e07

Compatibility notes:

  • {{#each}} iterates iterables such as Map, Set and generators lazily, like for...of, instead of copying them into an array first. Values added to the iterable while the block renders are now visited too.

Commits

v4.7.9 - March 26th, 2026

  • fix: enable shell mode for spawn to resolve Windows EINVAL issue - e0137c2
  • fix type "RuntimeOptions" also accepting string partials - eab1d14
  • feat(types): set hash to be a Record<string, any> - de4414d
  • fix non-contiguous program indices - 4512766
  • refactor: rename i to startPartIndex - e497a35
  • security: fix security issues - 68d8df5

Commits

Commits
  • 45ce152 v4.7.10
  • e47b236 Update release notes
  • f37c599 Sanitize the source map URL when minifying
  • 812c226 Iterate lazily in #each and strip whitespace in linear time
  • 609d1b1 Escape <!-- and <script in precompiled output
  • ceec388 Don't trust special properties on context data
  • c28ee7a Only compile partials that are template strings
  • 7d501a5 Only dispatch known node types in the Compiler and Visitor
  • 703fdcc Validate AST values in the compiler instead of the parser
  • 0fcf25c Clarify that --root does not restrict filesystem access
  • Additional commits viewable in compare view

Updates ip-address from 10.1.0 to 10.7.3

Release notes

Sourced from ip-address's releases.

v10.7.3

What's Changed

Full Changelog: beaugunderson/ip-address@v10.7.2...v10.7.3

v10.7.2

What's Changed

Full Changelog: beaugunderson/ip-address@v10.7.1...v10.7.2

v10.7.1

What's Changed

Full Changelog: beaugunderson/ip-address@v10.7.0...v10.7.1

v10.7.0

What's Changed

Full Changelog: beaugunderson/ip-address@v10.6.0...v10.7.0

v10.6.0

What's Changed

Full Changelog: beaugunderson/ip-address@v10.5.1...v10.6.0

v10.5.1

Full Changelog: beaugunderson/ip-address@v10.5.0...v10.5.1

v10.5.0

What's Changed

Full Changelog: beaugunderson/ip-address@v10.4.0...v10.5.0

v10.4.0

What's Changed

... (truncated)

Commits
  • c7f838e 10.7.3
  • 09b8072 Reject an in-addr.arpa name longer than 32 characters before splitting it (#228)
  • 974b48d 10.7.2
  • 4dfe8e5 Accept an arpa suffix in any case and without the root dot in fromArpa (#227)
  • f0c25df 10.7.1
  • 8b34a21 Merge commit from fork
  • 13b6155 Merge commit from fork
  • 469ead1 Reject an address longer than the family allows before parsing it
  • 1343629 Report an address of the other family as not contained
  • 4c2184a Bump js-yaml and brace-expansion in the lockfile (#226)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for ip-address since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates js-yaml from 4.1.0 to 4.3.2

Changelog

Sourced from js-yaml's changelog.

4.3.2 - 2026-08-26

Changed

  • [backport] Hard-limit merge sequence size to 100.

Security

  • [backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

4.3.1 - 2026-07-31

Security

  • [backport] Remove quadratic complexity from !!omap duplicate key detection.

4.3.0 - 2026-06-27

Added

  • [backport] Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.

Fixed

  • Restore umd builds back to es5.

Removed

  • [backport] maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

[4.2.0] - 2026-06-01

Added

  • Added docs/safety.md with notes about processing untrusted YAML.
  • Added maxDepth (100) loader option. Not a problem, but gives a better exception instead of RangeError on stack overflow.
  • Added maxMergeSeqLength (20) loader option. Not a problem after merge fix, but an additional restriction for safety.
  • Added sourcemaps to dist/ builds.

Changed

  • Stop resolving numbers with underscores as numeric scalars, #627.
  • Switched dev toolchains to Vite / neostandard.
  • Updated demo.
  • Reorganized tests.
  • dist/ files are no longer kept in the repository.

Fixed

  • Fix parsing of properties on the first implicit block mapping key, #62.
  • Fix trailing whitespace handling when folding flow scalar lines, #307.
  • Reject top-level block scalars without content indentation, #280.
  • Ensure numbers survive round-trip, #737.
  • Fix test coverage for issue #221.
  • Fix flow scalar trailing whitespace folding, #307.

... (truncated)

Commits
  • 79ca68d 4.3.2 released
  • d90b661 Backport merge limits from v5.4.1
  • 86e91b8 4.3.1 released
  • c3cc4b0 Backport quadratic complexity fix for !!omap
  • 33d05b5 4.3.0 released
  • 663bfab Drop demo publish, to not override new v5 one.
  • 1cb8c7b Add v4-legacy tag for publish
  • 02f27af Restore umd builds back to es5
  • 8be84ed Fix es5 compatibility
  • 59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
  • Additional commits viewable in compare view

Updates lodash-es from 4.17.21 to 4.18.1

Release notes

Sourced from lodash-es's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

  • Add security notice for _.template in threat model and API docs (#6099)
  • Document lower > upper behavior in _.random (#6115)
  • Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

Commits
  • cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
  • 75535f5 chore: prune stale advisory refs (#6170)
  • 62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
  • 59be2de release(minor): bump to 4.18.0 (#6161)
  • af63457 fix: broken tests for _.template 879aaa9
  • 1073a76 fix: linting issues
  • 879aaa9 fix: validate imports keys in _.template
  • fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
  • 18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
  • b819080 ci: add dist sync validation workflow (#6137)
  • Additional commits viewable in compare view

Updates postcss-selector-parser from 7.1.0 to 7.1.6

Release notes

Sourced from postcss-selector-parser's releases.

7.1.6

  • fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (GHSA-rj75-hqrm-r3gf, reported by Wayde Shi)

7.1.5

  • fix: don't treat a non-prefix token before | as a namespace (#324 by @​spokodev)
  • fix: preserve whitespace before a * namespace in attribute selectors (#325 by @​spokodev)
  • fix: TypeError on unclosed [, ( and trailing | (#330 by @​theRizwan)

7.1.4

  • fix: tolerate non-node children when serializing selectors

7.1.3

  • Improve fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (clone/walk)

7.1.2

v7.1.1

7.1.1

  • perf: replace startsWith with strict equality (#308)
  • fix(types): add walkUniversal declaration (#311)
Changelog

Sourced from postcss-selector-parser's changelog.

7.1.6 - 2026-09-03

  • fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (GHSA-rj75-hqrm-r3gf, reported by Wayde Shi)

7.1.5 - 2026-08-07

  • fix: don't treat a non-prefix token before | as a namespace (#324 by @​spokodev)
  • fix: preserve whitespace before a * namespace in attribute selectors (#325 by @​spokodev)
  • fix: TypeError on unclosed [, ( and trailing | (#330 by @​theRizwan)

7.1.4 - 2026-06-11

  • fix: tolerate non-node children when serializing selectors

7.1.3 - 2026-06-11

  • Improve fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (clone/walk)

7.1.2 - 2026-06-09

7.1.1

  • perf: replace startsWith with strict equality (#308)
  • fix(types): add walkUniversal declaration (#311)
Commits
  • 4eb3468 7.1.6
  • 62b1917 fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability
  • e33e9bc 7.1.5
  • 6f4e6c1 fix: TypeError on unclosed [, ( and trailing | (#330)
  • 4d8437f fix: preserve whitespace before a * namespace in attribute selectors (#325)
  • e2f9029 fix: don't treat a non-prefix token before | as a namespace (#324)
  • dd50ee1 chore(deps-dev): bump postcss from 8.5.18 to 8.5.23 (#331)
  • 7e3abb2 chore(deps-dev): bump postcss from 8.5.15 to 8.5.18 (#328)
  • 4a7e4e3 7.1.4
  • e2021c5 fix: tolerate non-node children when serializing selectors
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by moox, a new releaser for postcss-selector-parser since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates sigstore from 4.0.0 to 4.1.1

Release notes

Sourced from sigstore's releases.

sigstore@4.1.1

Patch Changes

  • 7845532: Verification of OID certificate extensions
  • f074710: Require inclusion promise in Rekor entry when used as timestamp source
  • Updated dependencies [b5aa4f1]
  • Updated dependencies [7845532]
  • Updated dependencies [f074710]
    • @​sigstore/core@​3.2.1
    • @​sigstore/verify@​3.1.1

sigstore@4.1.0

Minor Changes

  • eba6a52: verify(bundle[, payload][, options]) now returns a Signer object containing the public key and identity information from the verification.

Patch Changes

  • Updated dependencies [cee51c0]
  • Updated dependencies [2042aad]
  • Updated dependencies [018974e]
  • Updated dependencies [dea916f]
  • Updated dependencies [61a4f9e]
  • Updated dependencies [5ffadc0]
  • Updated dependencies [5ffadc0]
  • Updated dependencies [1663b3e]
    • @​sigstore/tuf@​4.0.1
    • @​sigstore/verify@​3.1.0
    • @​sigstore/sign@​4.1.0
    • @​sigstore/core@​3.1.0
Commits

Updates tar from 7.5.2 to 7.5.22

Commits
Maintainer changes

This version was pushed to npm by isaacs, a new releaser for tar since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
build(deps): bump the npm_and_yarn group across 1 directory with 9 up…
573f6a2 
…dates

Bumps the npm_and_yarn group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@sigstore/core](https://github.com/sigstore/sigstore-js) | `3.0.0` | `3.2.1` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `2.0.1` | `2.1.7` |
| [handlebars](https://github.com/handlebars-lang/handlebars.js) | `4.7.8` | `4.7.10` |
| [ip-address](https://github.com/beaugunderson/ip-address) | `10.1.0` | `10.7.3` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.0` | `4.3.2` |
| [lodash-es](https://github.com/lodash/lodash) | `4.17.21` | `4.18.1` |
| [postcss-selector-parser](https://github.com/postcss/postcss-selector-parser) | `7.1.0` | `7.1.6` |
| [sigstore](https://github.com/sigstore/sigstore-js) | `4.0.0` | `4.1.1` |
| [tar](https://github.com/isaacs/node-tar) | `7.5.2` | `7.5.22` |



Updates `@sigstore/core` from 3.0.0 to 3.2.1
- [Release notes](https://github.com/sigstore/sigstore-js/releases)
- [Commits](https://github.com/sigstore/sigstore-js/compare/@sigstore/core@3.0.0...@sigstore/core@3.2.1)

Updates `brace-expansion` from 2.0.1 to 2.1.7
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v2.0.1...v2.1.7)

Updates `handlebars` from 4.7.8 to 4.7.10
- [Release notes](https://github.com/handlebars-lang/handlebars.js/releases)
- [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/v4.7.10/release-notes.md)
- [Commits](handlebars-lang/handlebars.js@v4.7.8...v4.7.10)

Updates `ip-address` from 10.1.0 to 10.7.3
- [Release notes](https://github.com/beaugunderson/ip-address/releases)
- [Commits](beaugunderson/ip-address@v10.1.0...v10.7.3)

Updates `js-yaml` from 4.1.0 to 4.3.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.3.2)

Updates `lodash-es` from 4.17.21 to 4.18.1
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.18.1)

Updates `postcss-selector-parser` from 7.1.0 to 7.1.6
- [Release notes](https://github.com/postcss/postcss-selector-parser/releases)
- [Changelog](https://github.com/postcss/postcss-selector-parser/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss-selector-parser@v7.1.0...7.1.6)

Updates `sigstore` from 4.0.0 to 4.1.1
- [Release notes](https://github.com/sigstore/sigstore-js/releases)
- [Commits](https://github.com/sigstore/sigstore-js/compare/sigstore@4.0.0...sigstore@4.1.1)

Updates `tar` from 7.5.2 to 7.5.22
- [Release notes](https://github.com/isaacs/node-tar/releases)
- [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md)
- [Commits](isaacs/node-tar@v7.5.2...v7.5.22)

---
updated-dependencies:
- dependency-name: "@sigstore/core"
  dependency-version: 3.2.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 2.1.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: handlebars
  dependency-version: 4.7.10
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ip-address
  dependency-version: 10.7.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 4.3.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: lodash-es
  dependency-version: 4.18.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: postcss-selector-parser
  dependency-version: 7.1.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: sigstore
  dependency-version: 4.1.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: tar
  dependency-version: 7.5.22
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 7, 2026
This was referenced Oct 7, 2026
Closed
Closed
@dependabot @github

dependabot Bot commented on behalf of github Oct 8, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are no longer being updated by Dependabot, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 8, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/npm_and_yarn-7af7e5ba05 branch October 8, 2026 05:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants