Skip to content

build(deps): bump the npm_and_yarn group across 1 directory with 9 updates - #1

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/npm_and_yarn-9916e0584a
Open

build(deps): bump the npm_and_yarn group across 1 directory with 9 updates#1
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/npm_and_yarn-9916e0584a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 6, 2026

Copy link
Copy Markdown

Bumps the npm_and_yarn group with 9 updates in the / directory:

Package From To
lodash 4.17.4 4.18.1
simple-git 1.89.0 4.0.1
@babel/traverse 7.0.0-beta.44 7.29.13
braces 1.8.5 removed
cross-spawn 5.1.0 7.0.6
react-devtools-core 3.1.0 6.1.5
send 0.16.2 0.19.2
serve-static 1.13.2 1.16.3
ws 1.1.5 7.5.13

Updates lodash from 4.17.4 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

  • Add security notice for _.template in threat model and API docs (#6099)
  • Document lower > upper behavior in _.random (#6115)
  • Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

Commits
  • cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
  • 75535f5 chore: prune stale advisory refs (#6170)
  • 62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
  • 59be2de release(minor): bump to 4.18.0 (#6161)
  • af63457 fix: broken tests for _.template 879aaa9
  • 1073a76 fix: linting issues
  • 879aaa9 fix: validate imports keys in _.template
  • fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
  • 18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
  • b819080 ci: add dist sync validation workflow (#6137)
  • Additional commits viewable in compare view

Updates simple-git from 1.89.0 to 4.0.1

Release notes

Sourced from simple-git's releases.

simple-git@4.0.1

Patch Changes

  • 365f52d: Prepare package.json before publishing.

simple-git@4.0.0

Major Changes

  • 98864c6: Major upgrade to v4. In this version:

    • Removed previously available default export, now uses a consistently named simpleGit export.
    • Removed previously deprecated import simple-git/promise (change to using the main simple-git import).
    • Removed legacy gitP export (change to using the main simpleGit export).
    // v3 - previously supported imports
import simpleGit from "simple-git";
import { gitP } from "simple-git";
import simpleGit from "simple-git/promise";
const simpleGit = require("simple-git");
// v4 - consolidates to a single supported import
import { simpleGit } from "simple-git";
const { simpleGit } = require("simple-git");

    • Prevents the use of abbreviated long-form git options:
    // v3 - allowed the use of unambiguous long-form options
git.raw("clone", "--conf=user.name=me", "...");
// v4 - requires full option names, abbreviated option names will now throw a GitConfigurationError
git.raw("fetch", "--config=user.name=me", "...");

    • Ambient environment variables are filtered before passing into the git child process.
    // v3
process.env.FOO = "bar";
process.env.GIT_TEMPLATE_DIR = "./some/path";
simpleGit().raw("clone"); // git child process can see both environment variables
// v4
process.env.FOO = "bar";
process.env.GIT_TEMPLATE_DIR = "./some/path";
simpleGit().raw("clone"); // git child process now sees only FOO
simpleGit({

... (truncated)

Changelog

Sourced from simple-git's changelog.

4.0.1

Patch Changes

  • 365f52d: Prepare package.json before publishing.

4.0.0

Major Changes

  • 98864c6: Major upgrade to v4. In this version:

    • Removed previously available default export, now uses a consistently named simpleGit export.
    • Removed previously deprecated import simple-git/promise (change to using the main simple-git import).
    • Removed legacy gitP export (change to using the main simpleGit export).
    // v3 - previously supported imports
import simpleGit from "simple-git";
import { gitP } from "simple-git";
import simpleGit from "simple-git/promise";
const simpleGit = require("simple-git");
// v4 - consolidates to a single supported import
import { simpleGit } from "simple-git";
const { simpleGit } = require("simple-git");

    • Prevents the use of abbreviated long-form git options:
    // v3 - allowed the use of unambiguous long-form options
git.raw("clone", "--conf=user.name=me", "...");
// v4 - requires full option names, abbreviated option names will now throw a GitConfigurationError
git.raw("fetch", "--config=user.name=me", "...");

    Thanks to @​anir0y, @​CFionaBF, @​Leeziao, @​internetteletubbie, @​idisdi, @​the-vibe-dev, @​D7EAD, @​dellalibera, @​gdegrange, @​bilguunbicktivism, @​cruzryan, @​b1ue0ceanRun, @​oss-security-shopify for identifying the vulnerability.

    • Ambient environment variables are filtered before passing into the git child process.
    // v3
process.env.FOO = "bar";
process.env.GIT_TEMPLATE_DIR = "./some/path";
simpleGit().raw("clone"); // git child process can see both environment variables

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for simple-git since your current version.


Updates @babel/traverse from 7.0.0-beta.44 to 7.29.13

Release notes

Sourced from @​babel/traverse's releases.

v7.29.13 (2026-11-04)

🐛 Bug Fix

  • babel-generator, babel-parser
  • babel-parser
  • babel-generator
  • babel-plugin-transform-block-scoping
  • babel-helper-module-transforms, babel-plugin-transform-modules-commonjs
  • babel-helper-skip-transparent-expression-wrappers, babel-plugin-transform-optional-chaining
    • #18482 Fix optional call losing the receiver through a TS instantiation expression (@​babel-bot)
  • babel-plugin-proposal-partial-application
  • babel-register
  • babel-helper-create-class-features-plugin, babel-plugin-transform-private-property-in-object
  • babel-traverse
    • #18480 fix(babel-traverse): check variable shadowing for global object callees (@​babel-bot)
  • babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators
  • babel-core
  • babel-plugin-bugfix-safari-rest-destructuring-rhs-array
  • Other
  • babel-plugin-transform-destructuring
    • #18460 fix: only collapse the empty-object check when it targets the declared binding (@​babel-bot)
  • babel-helpers, babel-plugin-transform-async-generator-functions, babel-runtime-corejs3

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​babel/traverse since your current version.


Removes braces

Updates cross-spawn from 5.1.0 to 7.0.6

Changelog

Sourced from cross-spawn's changelog.

7.0.6 (2024-11-18)

Bug Fixes

  • update cross-spawn version to 7.0.5 in package-lock.json (f700743)

7.0.5 (2024-11-07)

Bug Fixes

  • fix escaping bug introduced by backtracking (640d391)

7.0.4 (2024-11-07)

Bug Fixes

7.0.3 (2020-05-25)

Bug Fixes

  • detect path key based on correct environment (#133) (159e7e9)

7.0.2 (2020-04-04)

Bug Fixes

  • fix worker threads in Node >=11.10.0 (#132) (6c5b4f0)

7.0.1 (2019-10-07)

Bug Fixes

7.0.0 (2019-09-03)

⚠ BREAKING CHANGES

  • drop support for Node.js < 8

  • drop support for versions below Node.js 8 (#125) (16feb53)

... (truncated)

Commits
  • 77cd97f chore(release): 7.0.6
  • 6717de4 chore: upgrade standard-version
  • f700743 fix: update cross-spawn version to 7.0.5 in package-lock.json
  • 9a7e3b2 chore: fix build status badge
  • 0852683 chore(release): 7.0.5
  • 640d391 fix: fix escaping bug introduced by backtracking
  • bff0c87 chore: remove codecov
  • a7c6abc chore: replace travis with github workflows
  • 9b9246e chore(release): 7.0.4
  • 5ff3a07 fix: disable regexp backtracking (#160)
  • Additional commits viewable in compare view

Updates react-devtools-core from 3.1.0 to 6.1.5

Release notes

Sourced from react-devtools-core's releases.

eslint-plugin-react-hooks@5.0.0 (Oct 11, 2024)

This release only contains eslint-plugin-react-hooks. Notably, new violations and support for ESLint v9 were added.

eslint-plugin-react-hooks

  • New Violations: Component names now need to start with an uppercase letter instead of a non-lowercase letter. This means _Button or _component are no longer valid. (@​kassens) in #25162 For example, in 
    function _Component() {
  useState()
  ^^^^^^^^ A React Hook "useState" is called in function "_Component" which is neither a Component nor a custom React Hook function.
}
    _Component should be renamed to Component.
Commits
Maintainer changes

This version was pushed to npm by hoxyq, a new releaser for react-devtools-core since your current version.

Install script changes

This version modifies prepublish script that runs during installation. Review the package contents before updating.


Updates send from 0.16.2 to 0.19.2

Release notes

Sourced from send's releases.

0.19.2

What's Changed

Full Changelog: pillarjs/send@0.19.1...0.19.2

0.19.1

What's Changed

Full Changelog: pillarjs/send@0.19.0...0.19.1

0.19.0

What's Changed

New Contributors

Full Changelog: pillarjs/send@0.18.0...0.19.0

Changelog

Sourced from send's changelog.

0.19.2 / 2025-12-15

  • deps: use tilde notation for dependencies
  • deps: http-errors@~2.0.1
  • deps: statuses@~2.0.2

0.19.1 / 2024-10-09

  • deps: encodeurl@~2.0.0

0.19.0 / 2024-09-10

  • Remove link renderization in html while redirecting

0.18.0 / 2022-03-23

  • Fix emitted 416 error missing headers property
  • Limit the headers removed for 304 response
  • deps: depd@2.0.0
    • Replace internal eval usage with Function constructor
    • Use instance methods on process to check for listeners
  • deps: destroy@1.2.0
  • deps: http-errors@2.0.0
    • deps: depd@2.0.0
    • deps: statuses@2.0.1
  • deps: on-finished@2.4.1
  • deps: statuses@2.0.1

0.17.2 / 2021-12-11

  • pref: ignore empty http tokens
  • deps: http-errors@1.8.1
    • deps: inherits@2.0.4
    • deps: toidentifier@1.0.1
    • deps: setprototypeof@1.2.0
  • deps: ms@2.1.3

0.17.1 / 2019-05-10

  • Set stricter CSP header in redirect & error responses
  • deps: range-parser@~1.2.1

0.17.0 / 2019-05-03

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for send since your current version.


Updates serve-static from 1.13.2 to 1.16.3

Release notes

Sourced from serve-static's releases.

v1.16.3

What's Changed

Full Changelog: expressjs/serve-static@v1.16.2...v1.16.3

v1.16.2

What's Changed

Full Changelog: expressjs/serve-static@v1.16.1...v1.16.2

v1.16.1

What's Changed

New Contributors

Full Changelog: expressjs/serve-static@1.16.0...v1.16.1

1.16.0

What's Changed

New Contributors

Full Changelog: expressjs/serve-static@v1.15.0...1.16.0

1.15.0

  • deps: send@0.18.0
    • Fix emitted 416 error missing headers property
    • Limit the headers removed for 304 response
    • deps: depd@2.0.0
    • deps: destroy@1.2.0
    • deps: http-errors@2.0.0
    • deps: on-finished@2.4.1
    • deps: statuses@2.0.1

1.14.2

  • deps: send@0.17.2
    • deps: http-errors@1.8.1
    • deps: ms@2.1.3
    • pref: ignore empty http tokens

... (truncated)

Changelog

Sourced from serve-static's changelog.

1.16.3 / 2024-12-15

  • deps: send@~0.19.1
    • deps: encodeurl@~2.0.0

1.16.2 / 2024-09-11

  • deps: encodeurl@~2.0.0

1.16.1 / 2024-09-11

  • deps: send@0.19.0

1.16.0 / 2024-09-10

  • Remove link renderization in html while redirecting

1.15.0 / 2022-03-24

  • deps: send@0.18.0
    • Fix emitted 416 error missing headers property
    • Limit the headers removed for 304 response
    • deps: depd@2.0.0
    • deps: destroy@1.2.0
    • deps: http-errors@2.0.0
    • deps: on-finished@2.4.1
    • deps: statuses@2.0.1

1.14.2 / 2021-12-15

  • deps: send@0.17.2
    • deps: http-errors@1.8.1
    • deps: ms@2.1.3
    • pref: ignore empty http tokens

1.14.1 / 2019-05-10

  • Set stricter CSP header in redirect response
  • deps: send@0.17.1
    • deps: range-parser@~1.2.1

1.14.0 / 2019-05-07

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for serve-static since your current version.


Updates ws from 1.1.5 to 7.5.13

Release notes

Sourced from ws's releases.

7.5.13

Bug fixes

  • Fixed a bug introduced in version 7.5.12 that prevented the fragment counter from resetting (18bcb11a).

7.5.12

Bug fixes

  • Backported a2f4e7c0 and f197ac65 to the v7.x release line (fb8a1935, deec2114).

7.5.11

Bug fixes

  • Backported 2b2abd45 to the 7.x release line (e14c4586).

7.5.10

Bug fixes

  • Backported e55e5106 to the 7.x release line (22c28763).

7.5.9

Bug fixes

  • Backported bc8bd34e to the 7.x release line (0435e6e1).

7.5.8

Bug fixes

  • Backported 0fdcc0af to the 7.x release line (2758ed35).
  • Backported d68ba9e1 to the 7.x release line (dc1781bc).

7.5.7

Bug fixes

  • Backported 6946f5fe to the 7.x release line (1f72e2e1).

7.5.6

Bug fixes

  • Backported b8186dd1 to the 7.x release line (73dec34b).
  • Backported ed2b8039 to the 7.x release line (22a26afb).

7.5.5

Bug fixes

  • Backported ec9377ca to the 7.x release line (0e274acd).

7.5.4

Bug fixes

... (truncated)

Commits
  • 1680801 [dist] 7.5.13
  • 18bcb11 [fix] Reset the fragment counter when the message is complete
  • 98fce81 [dist] 7.5.12
  • deec211 [fix] Lower default values of maxBufferedChunks and maxFragments
  • fb8a193 [fix] Count empty fragments toward the limit (#2329)
  • fd36cd8 [dist] 7.5.11
  • e14c458 [security] Limit retained message parts
  • d962d70 [dist] 7.5.10
  • 22c2876 [security] Fix crash when the Upgrade header cannot be read (#2231)
  • 8a78f87 [dist] 7.5.9
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
build(deps): bump the npm_and_yarn group across 1 directory with 9 up…
f576e65 
…dates

Bumps the npm_and_yarn group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [lodash](https://github.com/lodash/lodash) | `4.17.4` | `4.18.1` |
| [simple-git](https://github.com/steveukx/git-js/tree/HEAD/simple-git) | `1.89.0` | `4.0.1` |
| [@babel/traverse](https://github.com/babel/babel/tree/HEAD/packages/babel-traverse) | `7.0.0-beta.44` | `7.29.13` |
| [braces](https://github.com/micromatch/braces) | `1.8.5` | `removed` |
| [cross-spawn](https://github.com/moxystudio/node-cross-spawn) | `5.1.0` | `7.0.6` |
| [react-devtools-core](https://github.com/react/react/tree/HEAD/packages/react-devtools-core) | `3.1.0` | `6.1.5` |
| [send](https://github.com/pillarjs/send) | `0.16.2` | `0.19.2` |
| [serve-static](https://github.com/expressjs/serve-static) | `1.13.2` | `1.16.3` |
| [ws](https://github.com/websockets/ws) | `1.1.5` | `7.5.13` |



Updates `lodash` from 4.17.4 to 4.18.1
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.4...4.18.1)

Updates `simple-git` from 1.89.0 to 4.0.1
- [Release notes](https://github.com/steveukx/git-js/releases)
- [Changelog](https://github.com/steveukx/git-js/blob/main/simple-git/CHANGELOG.md)
- [Commits](https://github.com/steveukx/git-js/commits/simple-git@4.0.1/simple-git)

Updates `@babel/traverse` from 7.0.0-beta.44 to 7.29.13
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.29.13/packages/babel-traverse)

Removes `braces`

Updates `cross-spawn` from 5.1.0 to 7.0.6
- [Changelog](https://github.com/moxystudio/node-cross-spawn/blob/master/CHANGELOG.md)
- [Commits](moxystudio/node-cross-spawn@5.1.0...v7.0.6)

Updates `react-devtools-core` from 3.1.0 to 6.1.5
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/HEAD/packages/react-devtools-core)

Updates `send` from 0.16.2 to 0.19.2
- [Release notes](https://github.com/pillarjs/send/releases)
- [Changelog](https://github.com/pillarjs/send/blob/master/HISTORY.md)
- [Commits](pillarjs/send@0.16.2...0.19.2)

Updates `serve-static` from 1.13.2 to 1.16.3
- [Release notes](https://github.com/expressjs/serve-static/releases)
- [Changelog](https://github.com/expressjs/serve-static/blob/master/HISTORY.md)
- [Commits](expressjs/serve-static@v1.13.2...v1.16.3)

Updates `ws` from 1.1.5 to 7.5.13
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@1.1.5...7.5.13)

---
updated-dependencies:
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: simple-git
  dependency-version: 4.0.1
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: "@babel/traverse"
  dependency-version: 7.29.13
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: braces
  dependency-version:
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: cross-spawn
  dependency-version: 7.0.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: react-devtools-core
  dependency-version: 6.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: send
  dependency-version: 0.19.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: serve-static
  dependency-version: 1.16.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-version: 7.5.13
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants