chore(deps): bump the frontend-security group across 1 directory with 10 updates by dependabot[bot] · Pull Request #100 · githubdoramon/digital-brain

dependabot · 2026-10-29T20:47:04Z

Bumps the frontend-security group with 10 updates in the /frontend/web directory:

Package	From	To
next	`15.5.18`	`15.5.28`
@humanfs/node	`0.16.7`	`0.16.8`
minimatch	`9.0.5`	`9.0.9`
flatted	`3.3.3`	`3.4.4`
mdast-util-to-hast	`13.2.0`	`13.2.1`
nanoid	`3.3.11`	`3.3.20`
picomatch	`2.3.1`	`2.3.2`
picomatch	`4.0.3`	`4.0.7`
postcss	`8.4.31`	`8.5.23`
preact	`10.27.2`	`10.29.8`
sharp	`0.34.4`	`0.35.5`

Updates next from 15.5.18 to 15.5.28

Release notes

Sourced from next's releases.

v15.5.28

This release contains security fixes for the following advisories:

Critical:

Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

High:

Denial of Service in App Router using Server Actions

v15.5.27

This release contains security fixes for the following advisories:

Medium:

Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass

Cache poisoning of SSG and ISR pages in self-hosted Next.js applications

Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service

v15.5.26

This release contains additional security hardening for next/og. For more information, check out https://nextjs.org/blog/nextjs-security-update-september-22-2026

v15.5.25

Follow-up release to v15.5.24 re-enabling AVIF Image Optimization when newer versions of sharp are installed (#97954).

Commits

195cd6a v15.5.28
1b53604 [cd] Allow branch to get published
5e3b687 [lts-maintenance][next/image] Bump sharp (#232)
a2021b3 [lts-maintenance][react] Improve Server Component transport protocol (#194)
a836b53 [lts-maintenance] Fix google tag manager e2e test, assume GTM 200s instead of...
9c1c1b1 [lts-maintenance][ci] Wire preview builds variables consistently (#99325)
def7eff v15.5.27
52c94ab [lts-maintenance] Scope response cache keys to their source route (#219)
785f4c2 [lts-maintenance] Match Next data paths case-sensitively (#197)
7217d63 [lts-maintenance][webpack] Ensure dynamicParams is respected in `opengraph-...
Additional commits viewable in compare view

Updates @humanfs/node from 0.16.7 to 0.16.8

Release notes

Sourced from @humanfs/node's releases.

node: v0.16.8

0.16.8 (2026-04-17)

Bug Fixes

Include type dependencies at runtime (956ce7a), closes #145

Dependencies

The following workspace dependencies were updated

dependencies

@humanfs/core bumped from ^0.19.1 to ^0.19.2

Changelog

Sourced from @humanfs/node's changelog.

0.16.8 (2026-04-17)

Bug Fixes

Ensure symlinks are copied as symlinks in copy() and copyAll() (22bbaa44)

Include type dependencies at runtime (956ce7a), closes #145

Dependencies

The following workspace dependencies were updated

dependencies

@humanfs/core bumped from ^0.19.1 to ^0.19.2

Commits

e96070e chore: release main (#146)
22bbaa4 Merge commit from fork
956ce7a fix: Include type dependencies at runtime
See full diff in compare view

Updates minimatch from 9.0.5 to 9.0.9

Commits

8a10e47 9.0.9
c6f1806 brace-expansion@2
446cfa3 9.0.8
8fa151a docs: add warning about ReDoS
71b78a2 fix partial matching of globstar patterns
2de496f 9.0.7
0d4616d limit nested extglob recursion, flatten extglobs
7117ef3 9.0.6
2418458 update deps, do not checkin dist
1d1f531 update deps
Additional commits viewable in compare view

Updates flatted from 3.3.3 to 3.4.4

Commits

e6f5ca7 3.4.4
47f14fa removed E_STRICT from PHP
4050568 fixced go-lang issues in CI
4303f4d Merge pull request #101 from mfinelli/gocriticfixes
106735b updated package-lock.json
670a1bd 3.4.3
50a61a9 Fix #104 - allow null as replacer value
8aa64f4 solved crytical errors over dependencies
b85577f Fix go-critic errors
bb8c63c Merge pull request #100 from WebReflection/WebReflection-patch-1
Additional commits viewable in compare view

Updates mdast-util-to-hast from 13.2.0 to 13.2.1

Release notes

Sourced from mdast-util-to-hast's releases.

13.2.1

Fix

ab3a795 Fix support for spaces in class names

Types

efb5312 Refactor to use @imports

a5bc210 Add declaration maps

Full Changelog: syntax-tree/mdast-util-to-hast@13.2.0...13.2.1

Commits

174795b 13.2.1
3d05b3a Update Node in Actions
ab3a795 Fix support for spaces in class names
efb5312 Refactor to use @imports
a5bc210 Add declaration maps
b54955d Add .tsbuildinfo to .gitignore
See full diff in compare view

Updates nanoid from 3.3.11 to 3.3.20

Release notes

Sourced from nanoid's releases.

3.3.20

Fixed types (by @johnemau).

3.3.19

Fixed killing the app by setting huge user ID.

3.3.18

Fixed infinite loop on async for React Native (by @OvergrowthBeards-JB).

3.3.17

Fixed infinite loop on zero size.

3.3.16

Fixed infinite loop on negative size (by @greymoth-jp).

3.3.15

Fixed npm provenance error.

3.3.14

Fixed random pool corruption on big ID sizes.

3.3.13

Reduced npm package size.

3.3.12

Fixed breaking Nano ID by requesting big ID.

Changelog

Sourced from nanoid's changelog.

3.3.20

Fixed types (by @johnemau).

3.3.19

Fixed killing the app by setting huge user ID (by @geoffrey-diederichs).

3.3.18

Fixed infinite loop on async for React Native (by @OvergrowthBeards-JB).

3.3.17

Fixed infinite loop on zero size.

3.3.16

Fixed infinite loop on negative size (by @greymoth-jp).

3.3.15

Fixed npm provenance error.

3.3.14

Fixed random pool corruption on big ID sizes.

3.3.13

Reduced npm package size.

3.3.12

Fixed breaking Nano ID by requesting big ID.

Commits

d76f633 Release 3.3.20 version
ac09ff6 Fix: async return types are synchronous in v3 (#615)
eb63bd6 Release 3.3.19 version
9067e03 Sync CJS and ESM
9ad9805 Release 3.3.18 version
55e50a0 Update CI action
e10f8d4 Update index.native.js (#606)
73d6716 Release 3.3.17 version
f9d13f1 Sync 0 size behaviour with PostCSS 5
9760e11 Release 3.3.16 version
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nanoid since your current version.

Updates picomatch from 2.3.1 to 2.3.2

Release notes

Sourced from picomatch's releases.

2.3.2

This is a security release fixing several security relevant issues.

What's Changed

fix: exception when glob pattern contains constructor by @Jason3S in micromatch/picomatch#144

Fix for CVE-2026-33671

Fix for CVE-2026-33672

Full Changelog: micromatch/picomatch@2.3.1...2.3.2

Changelog

Sourced from picomatch's changelog.

2.3.2 (2026-03-23)

Fixed

Avoided an exception when a glob pattern contains constructor (#144, 3f4f10e).

Security

Backported the extglob-quantifier ReDoS fix from 4.0.4. Risky repeated extglobs are now safely rewritten or treated as literals by default; positive numeric maxExtglobRecursion values allow limited nesting, while false disables the safeguard (CVE-2026-33671, eec17ae).

Prevented inherited object properties from being interpreted as POSIX character classes (CVE-2026-33672, fc1f6b6).

Commits

81cba8d Publish 2.3.2
fc1f6b6 Merge commit from fork
eec17ae Merge commit from fork
78f8ca4 Merge pull request #156 from micromatch/backport-144
3f4f10e Merge pull request #144 from Jason3S/jdent-object-properties
See full diff in compare view

Updates picomatch from 4.0.3 to 4.0.7

Release notes

Sourced from picomatch's releases.

2.3.2

This is a security release fixing several security relevant issues.

What's Changed

fix: exception when glob pattern contains constructor by @Jason3S in micromatch/picomatch#144

Fix for CVE-2026-33671

Fix for CVE-2026-33672

Full Changelog: micromatch/picomatch@2.3.1...2.3.2

Changelog

Sourced from picomatch's changelog.

2.3.2 (2026-03-23)

Fixed

Avoided an exception when a glob pattern contains constructor (#144, 3f4f10e).

Security

Backported the extglob-quantifier ReDoS fix from 4.0.4. Risky repeated extglobs are now safely rewritten or treated as literals by default; positive numeric maxExtglobRecursion values allow limited nesting, while false disables the safeguard (CVE-2026-33671, eec17ae).

Prevented inherited object properties from being interpreted as POSIX character classes (CVE-2026-33672, fc1f6b6).

Commits

81cba8d Publish 2.3.2
fc1f6b6 Merge commit from fork
eec17ae Merge commit from fork
78f8ca4 Merge pull request #156 from micromatch/backport-144
3f4f10e Merge pull request #144 from Jason3S/jdent-object-properties
See full diff in compare view

Updates postcss from 8.4.31 to 8.5.23

Release notes

Sourced from postcss's releases.

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

Fixed declaration parsing performance (by @homanp).

8.5.14

Fixed custom syntax regression (by @43081j).

8.5.13

Fixed postcss-scss commend regression.

8.5.12

Fixed reading any file via user-generated CSS.

Added opts.unsafeMap to disable checks.

8.5.11

Fixed nested brackets parsing performance (by @offset).

8.5.10

Fixed XSS via unescaped </style> in non-bundler cases (by @TharVid).

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

Fixed declaration parsing performance (by @homanp).

8.5.14

Fixed custom syntax regression (by @43081j).

8.5.13

... (truncated)

Commits

eb9e1fe Release 8.5.23 version
9d19c78 Update dependencies
7beca13 Does no load source map file without opts.from
decea51 Typo
c18e30d Update EM banner
98a39ad Update EM banner
a3e48c4 Release 8.5.22 version
f49d691 Fix custom property losing its semicolon before a comment (#2117)
28e0daf Release 8.5.21 version
3d2b4e4 Update dependencies
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates preact from 10.27.2 to 10.29.8

Release notes

Sourced from preact's releases.

10.29.8

Performance

Batch updates in flushSync (#5173, thanks @JoviDeCroock)

Avoid traversing retained subtrees (#5182, thanks @JoviDeCroock)

10.29.7

Maintenance

Make RTS optional peer dep (#5150, thanks @JoviDeCroock)

10.29.6

We had to revert preactjs/preact#5055 due to an incompatibility with useSignalEffect

10.29.5

Fixes

Compat Suspense hydration children recovery (#5144, thanks @JoviDeCroock)

10.29.4

Fixes

Fix hydration-suspense crashing due to sCU bail (#5134, thanks @JoviDeCroock)

Revert "Fix useId stability across async Suspense (#5108)" (#5135, thanks @JoviDeCroock)

10.29.3

Fixes

Fix error recovery for partially rendered subtrees (#5120, thanks @JoviDeCroock)

Fix useId stability across async Suspense (#5108, thanks @JoviDeCroock)

Flush subtree effects when rendering a pending node (#5055, thanks @JoviDeCroock)

Fix hydrate recovery with null excess DOM children (#5112, thanks @JoviDeCroock)

Performance

Address and guard memory leak hotspots (#5116, thanks @JoviDeCroock)

Avoid redundant allocations and writes (#5115, thanks @JoviDeCroock)

Types

Accept Signalish for input DOM-type (#5096, thanks @JoviDeCroock)

Maintenance

Use npm staged publishing (#5101, thanks @JoviDeCroock)

Add tier 3 sponsor logos (#5098, thanks @JoviDeCroock)

10.29.2

Fixes

... (truncated)

Commits

389c7bc Merge pull request #5189 from preactjs/10.29.8
39edabf 10.29.8
f27f3ec Merge pull request #5173 from preactjs/flush-sync-batch
84778ce Merge pull request #5182 from preactjs/perf/v10-retained-subtree-bailout
8623721 Golf retained-subtree bailout
1ab8135 Optimize retained subtree bailouts
3393c0b Batch updates in flushSync
d7421ad Merge pull request #5152 from preactjs/10.29.7
ce79b96 10.29.7
a2418b8 Merge pull request #5150 from preactjs/preact-rts
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for preact since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates sharp from 0.34.4 to 0.35.5

Release notes

Sourced from sharp's releases.

v0.35.5

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4

Add upper bounds check on length of linear and GIF delay arrays.

Improve error handing when WebAssembly fallback also fails. #4593 @lazerg

TypeScript: Allow multi-frame options for JXL output. #4602 @ramin-010

TypeScript: Remove non-existent named export. #4604

Increase accepted dimensions when extending an image. #4605

Improve gain map support for extract and rotate operations. #4606

Tests: Ensure composite tests pass on big endian platforms. #4609

v0.35.5-rc.1

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4-rc.1

Add upper bounds check on length of linear and GIF delay arrays.

Improve error handing when WebAssembly fallback also fails. #4593 @lazerg

TypeScript: Allow multi-frame options for JXL output. #4602 @ramin-010

TypeScript: Remove non-existent named export. #4604

Increase accepted dimensions when extending an image. #4605

Improve gain map support for extract operation. #4606

... (truncated)

Commits

51a990f Release v0.35.5
96de105 Upgrade to sharp-libvips v1.3.4
3a61390 CI: Configure Dependabot with all package.json locations
4940c50 Improve gain map support for rotate/flip/flop ops
20654aa Prerelease v0.35.5-rc.1
ef4f934 CI: Upgrade to Ubuntu 26.04
358df95 Upgrade to libvips v8.18.7
49f4903 Improve gain map support for rotate-then-extract #4606
0e2e55e Silence a couple of compiler/static analysis warnings
cef3b8c Improve gain map support for extract operation #4606
Additional commits viewable in compare view

githubdoramon · 2026-10-30T13:16:12Z

@dependabot recreate

… 10 updates Bumps the frontend-security group with 10 updates in the /frontend/web directory: | Package | From | To | | --- | --- | --- | | [next](https://github.com/vercel/next.js) | `15.5.18` | `15.5.28` | | [@humanfs/node](https://github.com/humanwhocodes/humanfs/tree/HEAD/packages/node) | `0.16.7` | `0.16.8` | | [minimatch](https://github.com/isaacs/minimatch) | `9.0.5` | `9.0.9` | | [flatted](https://github.com/WebReflection/flatted) | `3.3.3` | `3.4.4` | | [mdast-util-to-hast](https://github.com/syntax-tree/mdast-util-to-hast) | `13.2.0` | `13.2.1` | | [nanoid](https://github.com/ai/nanoid) | `3.3.11` | `3.3.20` | | [picomatch](https://github.com/micromatch/picomatch) | `2.3.1` | `2.3.2` | | [picomatch](https://github.com/micromatch/picomatch) | `4.0.3` | `4.0.7` | | [postcss](https://github.com/postcss/postcss) | `8.4.31` | `8.5.23` | | [preact](https://github.com/preactjs/preact) | `10.27.2` | `10.29.8` | | [sharp](https://github.com/lovell/sharp) | `0.34.4` | `0.35.5` | Updates `next` from 15.5.18 to 15.5.28 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v15.5.18...v15.5.28) Updates `@humanfs/node` from 0.16.7 to 0.16.8 - [Release notes](https://github.com/humanwhocodes/humanfs/releases) - [Changelog](https://github.com/humanwhocodes/humanfs/blob/main/packages/node/CHANGELOG.md) - [Commits](https://github.com/humanwhocodes/humanfs/commits/node-v0.16.8/packages/node) Updates `minimatch` from 9.0.5 to 9.0.9 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v9.0.5...v9.0.9) Updates `flatted` from 3.3.3 to 3.4.4 - [Commits](WebReflection/flatted@v3.3.3...v3.4.4) Updates `mdast-util-to-hast` from 13.2.0 to 13.2.1 - [Release notes](https://github.com/syntax-tree/mdast-util-to-hast/releases) - [Commits](syntax-tree/mdast-util-to-hast@13.2.0...13.2.1) Updates `nanoid` from 3.3.11 to 3.3.20 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](ai/nanoid@3.3.11...3.3.20) Updates `picomatch` from 2.3.1 to 2.3.2 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@2.3.1...2.3.2) Updates `picomatch` from 4.0.3 to 4.0.7 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@2.3.1...2.3.2) Updates `postcss` from 8.4.31 to 8.5.23 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.4.31...8.5.23) Updates `preact` from 10.27.2 to 10.29.8 - [Release notes](https://github.com/preactjs/preact/releases) - [Commits](preactjs/preact@10.27.2...10.29.8) Updates `sharp` from 0.34.4 to 0.35.5 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](lovell/sharp@v0.34.4...v0.35.5) --- updated-dependencies: - dependency-name: "@humanfs/node" dependency-version: 0.16.8 dependency-type: indirect dependency-group: frontend-security - dependency-name: flatted dependency-version: 3.4.4 dependency-type: indirect dependency-group: frontend-security - dependency-name: mdast-util-to-hast dependency-version: 13.2.1 dependency-type: indirect dependency-group: frontend-security - dependency-name: minimatch dependency-version: 9.0.9 dependency-type: indirect dependency-group: frontend-security - dependency-name: nanoid dependency-version: 3.3.20 dependency-type: indirect dependency-group: frontend-security - dependency-name: next dependency-version: 15.5.28 dependency-type: direct:production dependency-group: frontend-security - dependency-name: picomatch dependency-version: 2.3.2 dependency-type: indirect dependency-group: frontend-security - dependency-name: picomatch dependency-version: 4.0.7 dependency-type: indirect dependency-group: frontend-security - dependency-name: postcss dependency-version: 8.5.23 dependency-type: indirect dependency-group: frontend-security - dependency-name: preact dependency-version: 10.29.8 dependency-type: indirect dependency-group: frontend-security - dependency-name: sharp dependency-version: 0.35.5 dependency-type: indirect dependency-group: frontend-security ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 29, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/frontend/web/frontend-security-83f460d9e0 branch from 946c8dc to a621a2f Compare October 30, 2026 13:19

Navigation Menu

Repository navigation

chore(deps): bump the frontend-security group across 1 directory with 10 updates - #100

chore(deps): bump the frontend-security group across 1 directory with 10 updates#100
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/frontend/web/frontend-security-83f460d9e0

dependabot Bot commented on behalf of github Oct 29, 2026 •

edited

Loading

Uh oh!

githubdoramon commented Oct 30, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v15.5.28

v15.5.27

v15.5.26

v15.5.25

node: v0.16.8

0.16.8 (2026-04-17)

Bug Fixes

Dependencies

0.16.8 (2026-04-17)

Bug Fixes

Dependencies

13.2.1

Fix

Types

3.3.20

3.3.19

3.3.18

3.3.17

3.3.16

3.3.15

3.3.14

3.3.13

3.3.12

3.3.20

3.3.19

3.3.18

3.3.17

3.3.16

3.3.15

3.3.14

3.3.13

3.3.12

2.3.2

What's Changed

2.3.2 (2026-03-23)

Fixed

Security

2.3.2

What's Changed

2.3.2 (2026-03-23)

Fixed

Security

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.17

8.5.16

8.5.15

8.5.14

8.5.13

8.5.12

8.5.11

8.5.10

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.17

8.5.16

8.5.15

8.5.14

8.5.13

10.29.8

Performance

10.29.7

Maintenance

10.29.6

10.29.5

Fixes

10.29.4

Fixes

10.29.3

dependabot Bot commented on behalf of github Oct 29, 2026 •

edited

Loading