Skip to content

Bump the npm_and_yarn group across 1 directory with 14 updates - #346

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-9a39f5f643
Open

Bump the npm_and_yarn group across 1 directory with 14 updates#346
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-9a39f5f643

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 30, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 14 updates in the / directory:

Package From To
axios 0.27.2 0.33.0
fast-xml-parser 4.5.3 5.7.0
lodash 4.17.21 4.18.1
uuid 8.3.2 14.0.2
brace-expansion 1.1.12 1.1.21
@nevware21/ts-utils 0.12.5 0.16.0
baseline-browser-mapping 2.8.13 2.11.26
browserslist 4.26.3 4.29.3
fast-uri 3.1.0 3.1.8
follow-redirects 1.15.11 1.16.0
form-data 4.0.4 4.0.6
handlebars 4.7.8 4.7.9
js-yaml 4.1.0 4.3.2
picomatch 2.3.1 2.3.2

Updates axios from 0.27.2 to 0.33.0

Release notes

Sourced from axios's releases.

v0.33.0 — June 13, 2026

This release hardens request config handling and form serialisation, adds Node.js 26 coverage for v0.x, and updates the v0.x release workflow.

🔒 Security Fixes

  • Request Config Hardening: Uses own-property reads for nested request options affecting auth, params, proxy, and data handling; adds bounded form serialisation depth checks; normalises nullish Basic Auth credentials; and treats 0.0.0.0 as local for proxy bypass. (#11001)

🚀 New Features

  • Node.js 26: Adds Node.js 26 to the v0.x CI and release/publish matrices. (#10937)

🔧 Maintenance & Chores

  • Release Publishing: Adopts npm staged publishing for v0.x releases and disables npm caching in CI to make installs and publish jobs more deterministic. (#10936, #10943)
  • Changelog: Backfills missing v0.x changelog entries for prior releases. (#10842)
  • Release Metadata: Bumps package and internal version metadata for v0.33.0. (#11002)

Full Changelog

v0.32.0 — May 4, 2026

This release backports a comprehensive set of security and hardening fixes from the v1.x branch into v0.x, covering prototype-pollution protections, default error redaction, stricter proxy/cookie/socket handling, and one breaking change to merged config and header object prototypes.

⚠️ Breaking Changes & Deprecations

  • Null-prototype merged objects: mergeConfig and header merging now return objects with a null prototype to block prototype-pollution gadgets. Consumers must use Object.prototype.hasOwnProperty.call(obj, key) and avoid implicit string coercion against merged config or header objects. (#10838)

🔒 Security Fixes

  • Default error redaction: AxiosError.toJSON() now redacts sensitive keys by default to prevent credential leaks in logs. The behavior is configurable via config.redact, with defaults exposed on defaults.redact. (#10838)
  • Cookie & XSRF handling: Cookie names are read literally rather than via regex, and only own properties are respected when evaluating withXSRFToken. (#10838)
  • Proxy bypass IPv6 parity: NO_PROXY matching now handles canonical IPv4-mapped IPv6 forms such as ::ffff:127.0.0.1 and ::ffff:7f00:1. (#10838)
  • Node http adapter hardening: Strips Proxy-Authorization when no proxy is in use and gates socketPath behind a new allowedSocketPaths allowlist (string or array, normalized) to reduce accidental Unix socket exposure. (#10838)
  • Browser xhr adapter: Stricter own-property checks when reading config and headers. (#10838)
  • URL parameters: AxiosURLSearchParams keeps %00 encoded and applies consistent encoding throughout. (#10838)
  • Public type surface: Adds formDataHeaderPolicy, redact, and allowedSocketPaths to the TypeScript declarations alongside their runtime defaults. (#10838)

🔧 Maintenance & Chores

  • Repo hygiene: Updates README.md and CHANGELOG.md, adds AGENTS.md, and refreshes the issue and PR templates. (#10838)

Full Changelog

v0.31.1

This release backports a broad set of security hardenings from the v1 line — covering prototype-pollution defences, stream size enforcement, XSRF handling, URL null-byte encoding, and bounded FormData recursion — and drops committed dist/ artefacts along with Bower support.

⚠️ Breaking Changes & Deprecations

  • Bower & Committed dist/ Removed: dist/ bundles are no longer committed to the repo, and bower.json plus the Grunt package2bower task have been removed. CI still builds bundles before publish, so npm/yarn/pnpm consumers are unaffected; installs via Bower or directly from the git tree must migrate to npm or a CDN. (#10747)

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for axios since your current version.


Updates fast-xml-parser from 4.5.3 to 5.7.0

Release notes

Sourced from fast-xml-parser's releases.

use @​nodable/entities to replace entities

  • No API change
  • No change in performance for basic usage
  • No typing change
  • No config change
  • new dependency
  • breaking: error messages for entities might have been changed.

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.5.12...v5.6.0

performance improvment, increase entity expansion default limit

  • increase default entity explansion limit as many projects demand for that
maxEntitySize: 10000,
maxExpansionDepth: 10000,
maxTotalExpansions: Infinity,
maxExpandedLength: 100000,
maxEntityCount: 1000,
  • performance improvement
    • reduce calls to toString
    • early return when entities are not present
    • prepare rawAttrsForMatcher only if user sets jPath: false

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.5.9...v5.5.10

fix typins and matcher instance in callbacks

combine typings file to avoid configuration changes pass readonly instance of matcher to the call backs to avoid accidental push/pop call

fix bugs of entity parsing and value parsing

fix: entity expansion limits update strnum package to 2.2.0

fix entity expansion and incorrect replacement and performance

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.5.5...v5.5.6

support onDangerousProperty

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.5.3...v5.5.5

update dependecies to fix typings

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.5.1...v5.5.2

integrate path-expression-matcher

  • support path-expression-matcher
  • fix: stopNode should not be parsed
  • performance improvement for stopNode checking

Separate Builder

XML Builder was the part of fast-xml-parser for years. But considering that any bug in builder may false-alarm the users who are only using parser and vice-versa, we have decided to split it into a separate package.

... (truncated)

Changelog

Sourced from fast-xml-parser's changelog.

Note: If you find missing information about particular minor version, that version must have been changed without any functional change in this library.

Note: Due to some last quick changes on v4, detail of v4.5.3 & v4.5.4 are not updated here. v4.5.4x is the last tag of v4 in github repository. I'm extremely sorry for the confusion

5.11.2 / 2026-09-29

  • fix (#875): decode Uint8Array XML input as UTF-8 (By emme1t)
  • fix (#880) :type EntityDecoderOptions.setXmlVersion's version as a number (By Yevhenii Kotyrlo)

5.11.1 / 2026-08-27

  • fix: validator; Replace regex with a single-pass scanner for attribute tokens, eliminating quadratic behavior on long whitespace runs.

5.11.0 / 2026-08-16

  • feat: support for endIndex in node metadata (#850) [By Pavel Dranichnikov]
  • fix: don't crash on a closing tag with no matching opening tag (#861) [By Haïm Dimer]
  • fix: DOCTYPE to read SYSTEM/PUBLIC
  • deps: strnum v2.4.2

5.10.1 / 2026-07-17

  • fix: multiple DOCTYPE declarations.
  • deps: @nodable/entities for treeshaking

5.10.0 / 2026-07-11

  • upgrade:
    • xml-naming v0.3.0: cache support
    • PEM v1.6.2: sibling bug fix
    • is-unsafe v2.0.0: tree shaking

*5.9.3 / 2026-06-19

  • update strnum

*5.9.2 / 2026-06-17

  • dummy release to test changes in github action

*5.9.1 / 2026-06-17

  • dummy release to test release from github action

*5.9.0 / 2026-06-15

  • update strnum to 2.3.0
    • you can set hex, binary, enotation, infinity, unicode
  • validate unsafe HTML or XML data in doctype entities unsing 'is-unsafe' library. User can override rules by overriding EntityDecoder.

*5.8.0 / 2026-05-12

  • integrate xml-naming to validate DOCTYPE entity name and notation name (using qname becaue of backward compatibility)
    • This will consider xml-version as well. '1.0' is default
  • update strnum to 2.3.0
    • You can set octal and binary parsing which is bydeault off
  • update fast-xml-builder to 1.2.0
    • can sanitize tag names if found invalid

... (truncated)

Commits
  • f529642 update to release v5.7.0
  • 52a8583 Revert "improve performance of attributes reading"
  • 8d187f9 update builder
  • e174168 improve performance of attributes reading
  • 79a8dde update docs
  • f5cd5a5 set xml version to decoder even if attributes are ignored
  • f44b923 remove unwanted tests
  • 869ec8b Use @​nodable/entities v2.1.0
  • 7cb49e5 update release detail
  • 1b14fa7 include currency entities in default list
  • Additional commits viewable in compare view

Updates lodash from 4.17.21 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

  • Add security notice for _.template in threat model and API docs (#6099)
  • Document lower > upper behavior in _.random (#6115)
  • Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

Commits
  • cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
  • 75535f5 chore: prune stale advisory refs (#6170)
  • 62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
  • 59be2de release(minor): bump to 4.18.0 (#6161)
  • af63457 fix: broken tests for _.template 879aaa9
  • 1073a76 fix: linting issues
  • 879aaa9 fix: validate imports keys in _.template
  • fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
  • 18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
  • b819080 ci: add dist sync validation workflow (#6137)
  • Additional commits viewable in compare view

Updates uuid from 8.3.2 to 14.0.2

Release notes

Sourced from uuid's releases.

v14.0.2

14.0.2 (2026-08-18)

Bug Fixes

  • v1: carry nsecs overflow into the timestamp's high bits (#972) (6adcc1d)
  • v1: set the multicast bit on v1Bytes's own randomly-generated node (#973) (b1da338)
  • v7: align default seq formula in v7Bytes with updateV7State (#965) (a67db57)

v14.0.1

14.0.1 (2026-06-20)

Bug Fixes

  • add types condition to node export for moduleResolution bundler (#961) (27ffae5)

v14.0.0

14.0.0 (2026-04-19)

⚠ BREAKING CHANGES

  • expect crypto to be global everywhere (requires node@20+) (#935)
  • drop node@18 support (#934)

Features

Bug Fixes

  • expect crypto to be global everywhere (requires node@20+) (#935) (f2c235f)
  • Use GITHUB_TOKEN for release-please and enable npm provenance (#925) (ffa3138)

v13.0.2

13.0.2 (2026-05-04)

Bug Fixes

  • rerelease to fix provenance. (49ccb35)

v13.0.1

13.0.1 (2026-04-27)

Bug Fixes

... (truncated)

Changelog

Sourced from uuid's changelog.

14.0.2 (2026-08-18)

Bug Fixes

  • v1: carry nsecs overflow into the timestamp's high bits (#972) (6adcc1d)
  • v1: set the multicast bit on v1Bytes's own randomly-generated node (#973) (b1da338)
  • v7: align default seq formula in v7Bytes with updateV7State (#965) (a67db57)

14.0.1 (2026-06-20)

Bug Fixes

  • add types condition to node export for moduleResolution bundler (#961) (27ffae5)

14.0.0 (2026-04-19)

Security

  • Fixes GHSA-w5hq-g745-h8pq: v3(), v5(), and v6() did not validate that writes would remain within the bounds of a caller-supplied buffer, allowing out-of-bounds writes when an invalid offset was provided. A RangeError is now thrown if offset < 0 or offset + 16 > buf.length.

⚠ BREAKING CHANGES

  • crypto is now expected to be globally defined (requires node@20+) (#935)
  • drop node@18 support (#934)
  • upgrade minimum supported TypeScript version to 5.4.3, in keeping with the project's policy of supporting TypeScript versions released within the last two years

13.0.0 (2025-09-08)

⚠ BREAKING CHANGES

  • make browser exports the default (#901)

Bug Fixes

12.0.0 (2025-09-05)

⚠ BREAKING CHANGES

  • update to typescript@5.2 (#887)
  • remove CommonJS support (#886)
  • drop node@16 support (#883)

... (truncated)

Commits
  • fd59f02 chore(main): release 14.0.2 (#967)
  • f3c564e docs: point the Node support permalink at the CI version matrix (#974)
  • b1da338 fix(v1): set the multicast bit on v1Bytes's own randomly-generated node (#973)
  • 6adcc1d fix(v1): carry nsecs overflow into the timestamp's high bits (#972)
  • ea83515 docs: cleanup API summary (#968)
  • ac36860 chore: pin publint version in CI (#966)
  • a67db57 fix(v7): align default seq formula in v7Bytes with updateV7State (#965)
  • 7017780 chore(main): release 14.0.1 (#964)
  • f2c3e4b chore: fix release-please workflow (#963)
  • 27ffae5 fix: add types condition to node export for moduleResolution bundler (#961)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for uuid since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates brace-expansion from 1.1.12 to 1.1.21

Release notes

Sourced from brace-expansion's releases.

v1.1.15

  • Backport v5.0.6 change to v1 (#111) 0b09384

juliangruber/brace-expansion@v1.1.14...v1.1.15

Commits

Updates @nevware21/ts-utils from 0.12.5 to 0.16.0

Release notes

Sourced from @​nevware21/ts-utils's releases.

0.16.0

Changelog

Features

  • #587 feat(errors): expose isOwnInstance to createCustomError's constructCb and skip redundant stack captures
    • constructCb now receives a 3rd argument, isOwnInstance, which is true when the class is the leaf-most type actually being instantiated and false when its constructor is only running as a base-class step for a subclass further down an inheritance chain
    • The internal Error.captureStackTrace call is now gated by the same check, so it only fires once per instance (at the leaf-most class) instead of redundantly at every level of a chain
    • Lets custom error hierarchies with their own per-level stack-capture logic skip that work except at the leaf
  • #589 feat(errors): bind constructCb's this to the new instance via fnCall
    • constructCb is now invoked with this bound to the constructed instance (the same value also passed as the self argument), so non-arrow callbacks can use this.prop = ... instead of requiring the self argument
    • constructCb's type signature now declares an explicit this: any parameter; existing callbacks (arrow functions, or plain functions that don't declare this) remain unaffected

Bug Fixes

  • #588 npm run package failed with ERR_REQUIRE_ESM after magic-string moved to an ESM-only release (v1.0.0)
    • lib/rollup.config.js's PURE-annotation normalization plugin now loads magic-string via a dynamic import() inside renderChunk instead of a static import, since --bundleConfigAsCjs rewrites static imports to require(), which throws on Node versions without require(esm) support (eg. Node 18)
    • Added skipLibCheck to the main build and test tsconfigs (lib/tsconfig.base.json and lib/test/tsconfig.*.json) to stop external @types/node type errors (IteratorObject, BuiltinIteratorReturn, etc., introduced by the @types/node v26 bump) from leaking into the build and test compiles
  • #585 Add skipLibCheck to the TypeDoc compiler options to fix the same @types/node v26 type errors when generating docs

Repository Improvements

  • #582 CI: switch Puppeteer loading to ESM import() in Karma configs (Puppeteer is ESM-only), pin Size tests to run only on Node 22, and make Codecov upload non-blocking

Full Changelog

0.15.0

Changelog

Features

  • #570 Add microtask scheduling helpers with native queueMicrotask, Promise, and timer-backed fallbacks
    • New functions: scheduleMicrotask, hasQueueMicrotask, getQueueMicrotask, setMicroTaskFallbackOptions
    • New public types: ScheduleMicrotaskFn, MicroTaskOptions
    • Extends microtask support by providing cancellable microtasks via ITimerHandler, plus fallback ordering to run microtasks before queued timers when using the timer-backed implementation
    • Provides runtime parity across all supported environments by using native queueMicrotask when present, Promise-backed scheduling when available, and a timer-backed microtask queue otherwise
  • #573 Add nextTick scheduling support and new helper exports
    • New timer/runtime functions: scheduleNextTick, getProcessNextTick, hasProcessNextTick, setNextTickFallbackOptions
    • Uses native process.nextTick in Node runtimes when available, while providing equivalent nextTick behavior in browser and worker runtimes via Promise and timer-backed fallbacks
    • Adds shared queue logic and callback-argument support across microtask and nextTick scheduling
    • Adds arrConcat as a dedicated array helper and fnBindArgs as a dedicated function helper
    • Improves function binding typing with exported BoundFunction and updated signatures for fnBind / fnBindArgs
  • #574 feat(iterator,array): add iterator collection helpers, split helper modules, and align collection membership semantics
    • Added new iterator helpers: iterMap, iterFilter, iterTake, iterReduce, iterSome, iterEvery, iterToArray, iterUnion, iterIntersection, iterDifference
    • Added arrToMap helper in the array module and moved callback/type declarations into iterator/types
    • Refactored iterator helper implementation/tests into per-function files and updated root exports
    • Added NaN regression coverage and switched iterator set-operation membership checks to arrIncludes semantics for parity with array helpers
  • #576 Refactor timer microtask/nextTick shared types and environment helpers, with expanded fallback coverage
    • Moved MicrotaskFn and ScheduleMicrotaskFn to helpers/types and updated timer internals to consume shared type definitions

... (truncated)

Changelog

Sourced from @​nevware21/ts-utils's changelog.

v0.16.0 July 18th, 2026

Changelog

Features

  • #587 feat(errors): expose isOwnInstance to createCustomError's constructCb and skip redundant stack captures
    • constructCb now receives a 3rd argument, isOwnInstance, which is true when the class is the leaf-most type actually being instantiated and false when its constructor is only running as a base-class step for a subclass further down an inheritance chain
    • The internal Error.captureStackTrace call is now gated by the same check, so it only fires once per instance (at the leaf-most class) instead of redundantly at every level of a chain
    • Lets custom error hierarchies with their own per-level stack-capture logic skip that work except at the leaf
  • #589 feat(errors): bind constructCb's this to the new instance via fnCall
    • constructCb is now invoked with this bound to the constructed instance (the same value also passed as the self argument), so non-arrow callbacks can use this.prop = ... instead of requiring the self argument
    • constructCb's type signature now declares an explicit this: any parameter; existing callbacks (arrow functions, or plain functions that don't declare this) remain unaffected

Bug Fixes

  • #588 npm run package failed with ERR_REQUIRE_ESM after magic-string moved to an ESM-only release (v1.0.0)
    • lib/rollup.config.js's PURE-annotation normalization plugin now loads magic-string via a dynamic import() inside renderChunk instead of a static import, since --bundleConfigAsCjs rewrites static imports to require(), which throws on Node versions without require(esm) support (eg. Node 18)
    • Added skipLibCheck to the main build and test tsconfigs (lib/tsconfig.base.json and lib/test/tsconfig.*.json) to stop external @types/node type errors (IteratorObject, BuiltinIteratorReturn, etc., introduced by the @types/node v26 bump) from leaking into the build and test compiles
  • #585 Add skipLibCheck to the TypeDoc compiler options to fix the same @types/node v26 type errors when generating docs

Repository Improvements

  • #582 CI: switch Puppeteer loading to ESM import() in Karma configs (Puppeteer is ESM-only), pin Size tests to run only on Node 22, and make Codecov upload non-blocking

Full Changelog

v0.15.0 May 29th, 2026

Changelog

Features

  • #570 Add microtask scheduling helpers with native queueMicrotask, Promise, and timer-backed fallbacks
    • New functions: scheduleMicrotask, hasQueueMicrotask, getQueueMicrotask, setMicroTaskFallbackOptions
    • New public types: ScheduleMicrotaskFn, MicroTaskOptions
    • Extends microtask support by providing cancellable microtasks via ITimerHandler, plus fallback ordering to run microtasks before queued timers when using the timer-backed implementation
    • Provides runtime parity across all supported environments by using native queueMicrotask when present, Promise-backed scheduling when available, and a timer-backed microtask queue otherwise
  • #573 Add nextTick scheduling support and new helper exports
    • New timer/runtime functions: scheduleNextTick, getProcessNextTick, hasProcessNextTick, setNextTickFallbackOptions
    • Uses native process.nextTick in Node runtimes when available, while providing equivalent nextTick behavior in browser and worker runtimes via Promise and timer-backed fallbacks
    • Adds shared queue logic and callback-argument support across microtask and nextTick scheduling
    • Adds arrConcat as a dedicated array helper and fnBindArgs as a dedicated function helper
    • Improves function binding typing with exported BoundFunction and updated signatures for fnBind / fnBindArgs
  • #574 feat(iterator,array): add iterator collection helpers, split helper modules, and align collection membership semantics
    • Added new iterator helpers: iterMap, iterFilter, iterTake, iterReduce, iterSome, iterEvery, iterToArray, iterUnion, iterIntersection, iterDifference
    • Added arrToMap helper in the array module and moved callback/type declarations into iterator/types
    • Refactored iterator helper implementation/tests into per-function files and updated root exports
    • Added NaN regression coverage and switched iterator set-operation membership checks to arrIncludes semantics for parity with array helpers
  • #576 Refactor timer microtask/nextTick shared types and environment helpers, with expanded fallback coverage

... (truncated)

Commits
  • af24320 [Release] Increase version to 0.16.0 (#590)
  • a066abc feat(errors): bind constructCb's this to the new instance via fnCall (#589)
  • efca6c5 chore(deps-dev): bump magic-string from 0.30.21 to 1.0.0 (#588)
  • e92818d feat(errors): expose isOwnInstance to createCustomError's constructCb and ski...
  • 4d61687 chore(deps-dev): bump @​types/node from 20.19.43 to 26.0.1 (#584)
  • 623e876 Add skipLibCheck to TypeDoc compiler options (#585)
  • d682e89 chore(deps-dev): bump @​types/sinon from 21.0.1 to 22.0.0 (#581)
  • 01c3fb1 chore(deps): bump actions/checkout from 6 to 7 (#580)
  • 8b0e7d3 CI: switch Puppeteer loading to ESM import, pin Size tests to Node 22, and ma...
  • 2def7d9 chore(deps): bump codecov/codecov-action from 6 to 7 (#579)
  • Additional commits viewable in compare view

Updates baseline-browser-mapping from 2.8.13 to 2.11.26

Release notes

Sourced from baseline-browser-mapping's releases.

v2.11.0

What's Changed in 2.11.0

  • feat: Adds a new getTimeline() method for getting the series of minimum browser changes, either grouped by date or by browser.
  • refactor: Substantial refactoring of the data compression process that replaces the full list of browsers from @mdn/browser-compat-data and downstream-browsers.json and features from web-features (in their very pared down form) with a change-list timeline that reflects which versions supported Baseline (newly available) on a given date. Thanks to @​swwind for the idea!
  • refactor: Some common functions have been moved to a util.ts module for use in other scripts.
  • fix: Removes process.exit() calls when unsupported option combinations are passed to getCompatibleVersions() and getAllVersions() in favour of throwing an Error. There is a small security risk with process.exit() calls that sites accepting unsanitised inputs could be the subject of attacks. Unsupported config options now throw and Error which should allow for more graceful handling. Thanks to @​bnbdr for flagging this as vulnerability CVE-2026-45819 .

Fixes #134

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.10.44...v2.11.0

v2.10.0

What's Changed

  • Introduces support for Node 6 by refactoring all Object.entries and Object.values instances and lowering ES target in Rollup to es2015.
  • Adds specified Node version support in package.json for >=6.0.0.
  • Refactors CLI code to avoid parseArgs which is not supported by versions of Node prior to 18, changes import to require and changes Rollup export to cjs to allow execution on older versions of Node.
  • Adds a new legacy-test.js file that allows basic testing on older versions of Node where current versions of Jasmine and ESLint are not supported.
  • Adds a test matrix to run tests on all even-numbered Node versions from 6 to 24.
  • refactor publish workflows to support NPM's new OIDC integration

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.9.24...v2.10.0

v2.9.3 - remove process.loadEnvFile()

What's Changed

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.9.2...v2.9.3

v2.9.2 - fix browser support bug

What's Changed

v2.9.0 - Reduce frequency of data staleness warnings

This version introduces a number of changes to data staleness warnings in response to #105 , #107 and #109

  • Data staleness warnings are now only shown if the getCompatibleVersions() or getAllVersions() functions are called - previously they were shown whenever the module was loaded, which meant many browserslist consumers were seeing the warning despite not targeting Baseline, especially those who were consuming browserslist in a pre-compiled format via next.js.
  • Adds new conditions for these warnings to be displayed which should only warn users for whom data freshness is critical:
    • The feature cut off data must be within the last two months, i.e. widelyAvailableOnDate: today + >2 years and 4 months or newly available in a browserslist query.
    • The module data must be more than 2 months old.
  • Introduces suppression options for these warning via the options objects and environment variables:
    • Adds a new suppressWarnings boolean to the getCompatibleVersions() and getAllVersions()
    • Respects the existing BROWSERSLIST_IGNORE_OLD_DATA environment variable.
    • Respects a new BASELINE_BROWSER_MAPPING_IGNORE_OLD_DATA environment variable.
  • Adds explanatory text to the README for how to avoid such warnings when reproducible builds are a requirement.
  • Change warning text to be package manager agnostic and mention the possibility of pre-compiled data.
Commits
  • c1934c6 Patch to 2.11.26 because browser or feature data changed
  • 4873684 Browser or feature data changed
  • 9030798 Updating static site
  • a5df351 Updating static site
  • ecc5b54 Updating static site
  • 719bf7a Patch to 2.11.25 because browser or feature data changed
  • c4f5b49 Browser or feature data changed
  • aa194af Updating static site
  • 0d33c4a Patch to 2.11.24 because browser or feature data changed
  • 1dac891 Browser or feature data changed
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for baseline-browser-mapping since your current version.


Updates browserslist from 4.26.3 to 4.29.3

Release notes

Sourced from browserslist's releases.

4.29.3

  • Updated Firefox ESR.

4.29.2

  • Fixed ignoring null usage in cover X in Y query (by @​wahidrizka).

4.29.1

4.29.0

  • Added query continuations across lines and array entries (by @​fzlzjerry).

4.28.9

4.28.8

  • Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

4.28.6

4.28.5

4.28.4

  • Fixed SyntaxError regression of 4.28.3.

4.28.3

@dependabot
Bump the npm_and_yarn group across 1 directory with 14 updates
f1a1f44 
Bumps the npm_and_yarn group with 14 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [axios](https://github.com/axios/axios) | `0.27.2` | `0.33.0` |
| [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) | `4.5.3` | `5.7.0` |
| [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.18.1` |
| [uuid](https://github.com/uuidjs/uuid) | `8.3.2` | `14.0.2` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.12` | `1.1.21` |
| [@nevware21/ts-utils](https://github.com/nevware21/ts-utils) | `0.12.5` | `0.16.0` |
| [baseline-browser-mapping](https://github.com/web-platform-dx/baseline-browser-mapping) | `2.8.13` | `2.11.26` |
| [browserslist](https://github.com/browserslist/browserslist) | `4.26.3` | `4.29.3` |
| [fast-uri](https://github.com/fastify/fast-uri) | `3.1.0` | `3.1.8` |
| [follow-redirects](https://github.com/follow-redirects/follow-redirects) | `1.15.11` | `1.16.0` |
| [form-data](https://github.com/form-data/form-data) | `4.0.4` | `4.0.6` |
| [handlebars](https://github.com/handlebars-lang/handlebars.js) | `4.7.8` | `4.7.9` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.0` | `4.3.2` |
| [picomatch](https://github.com/micromatch/picomatch) | `2.3.1` | `2.3.2` |



Updates `axios` from 0.27.2 to 0.33.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v0.27.2...v0.33.0)

Updates `fast-xml-parser` from 4.5.3 to 5.7.0
- [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases)
- [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md)
- [Commits](NaturalIntelligence/fast-xml-parser@v4.5.3...v5.7.0)

Updates `lodash` from 4.17.21 to 4.18.1
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.18.1)

Updates `uuid` from 8.3.2 to 14.0.2
- [Release notes](https://github.com/uuidjs/uuid/releases)
- [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md)
- [Commits](uuidjs/uuid@v8.3.2...v14.0.2)

Updates `brace-expansion` from 1.1.12 to 1.1.21
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.21)

Updates `@nevware21/ts-utils` from 0.12.5 to 0.16.0
- [Release notes](https://github.com/nevware21/ts-utils/releases)
- [Changelog](https://github.com/nevware21/ts-utils/blob/main/CHANGELOG.md)
- [Commits](nevware21/ts-utils@0.12.5...0.16.0)

Updates `baseline-browser-mapping` from 2.8.13 to 2.11.26
- [Release notes](https://github.com/web-platform-dx/baseline-browser-mapping/releases)
- [Commits](web-platform-dx/baseline-browser-mapping@v2.8.13...v2.11.26)

Updates `browserslist` from 4.26.3 to 4.29.3
- [Release notes](https://github.com/browserslist/browserslist/releases)
- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md)
- [Commits](browserslist/browserslist@4.26.3...4.29.3)

Updates `fast-uri` from 3.1.0 to 3.1.8
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.0...v3.1.8)

Updates `follow-redirects` from 1.15.11 to 1.16.0
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](follow-redirects/follow-redirects@v1.15.11...v1.16.0)

Updates `form-data` from 4.0.4 to 4.0.6
- [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md)
- [Commits](form-data/form-data@v4.0.4...v4.0.6)

Updates `handlebars` from 4.7.8 to 4.7.9
- [Release notes](https://github.com/handlebars-lang/handlebars.js/releases)
- [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/v4.7.9/release-notes.md)
- [Commits](handlebars-lang/handlebars.js@v4.7.8...v4.7.9)

Updates `js-yaml` from 4.1.0 to 4.3.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.3.2)

Updates `picomatch` from 2.3.1 to 2.3.2
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@2.3.1...2.3.2)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 0.33.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: fast-xml-parser
  dependency-version: 5.7.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: uuid
  dependency-version: 14.0.2
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 1.1.21
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@nevware21/ts-utils"
  dependency-version: 0.16.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: baseline-browser-mapping
  dependency-version: 2.11.26
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: browserslist
  dependency-version: 4.29.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fast-uri
  dependency-version: 3.1.8
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: follow-redirects
  dependency-version: 1.16.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: form-data
  dependency-version: 4.0.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: handlebars
  dependency-version: 4.7.9
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 4.3.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: picomatch
  dependency-version: 2.3.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants