chore(deps): Bump the npm_and_yarn group across 2 directories with 10 updates by dependabot[bot] · Pull Request #105 · echohello-dev/backstage

dependabot · 2026-10-03T05:56:42Z

Bumps the npm_and_yarn group with 9 updates in the / directory:

Package	From	To
@grpc/grpc-js	`1.11.2`	`1.14.5`
baseline-browser-mapping	`2.10.33`	`2.11.27`
basic-ftp	`5.0.5`	`5.3.1`
browserslist	`4.23.3`	`4.29.3`
colord	`2.9.3`	`2.10.0`
http-proxy-middleware	`2.0.9`	`2.0.10`
undici	`6.28.0`	`6.29.0`
webpack-dev-middleware	`7.4.2`	`7.4.6`
websocket-driver	`0.7.4`	`0.7.5`

Bumps the npm_and_yarn group with 1 update in the /packages/app directory: react-router.

Updates @grpc/grpc-js from 1.11.2 to 1.14.5

Release notes

Sourced from @grpc/grpc-js's releases.

@grpc/grpc-js 1.14.5

Fix a bug that caused clients to automatically transmit excessive error details to clients by default (advisory GHSA-f596-whhp-79r4)

Fix a bug that caused getAuthContext to return unverified certificates as though they were verified in some configurations (advisory GHSA-m9gg-hp2v-232j)

Fix a bug that could cause stale call data to accumulate if a channel failed to connect for a long period of time (#3078)

Fix a bug that could cause call status to be reported with expected fields missing (#3079)

Avoid redundant end() calls on completed HTTP/2 streams (#3082 contributed by @olavloite)

Unify call numbers and avoid disabled trace allocations (#3084 contributed by @olavloite)

@grpc/grpc-js 1.14.4

Fix a bug that could cause servers to crash when handling malformed requests (advisory GHSA-5375-pq7m-f5r2)

Fix a bug that could cause clients and servers to crash when handling malformed compressed messages (advisory GHSA-99f4-grh7-6pcq)

@grpc/grpc-js 1.14.3

Send halfClose immediately after messages to prevent late halfClose issues with Envoy (#3031 contributed by @serkanerip)

@grpc/grpc-js 1.14.2

Fix server keep alive timeout not properly destroying connections (#3022 contributed by @mattias-wiberg)

@grpc/grpc-js 1.14.1

Fix a regression of the settings used internally for HTTP/2 sessions (#3023)

@grpc/grpc-js-xds 1.14.1

Fix a bug in RBAC that caused exact path matchers in case insensitive mode to behave as a prefix matcher (advisory GHSA-88h9-xgvx-hvf2)

Fix weighted cluster total calculation (#3070 contributed by @gunsch)

@grpc/grpc-js-xds 1.14.0

Implement RBAC support (gRFC A41) (#2939, #2945)

Add weighted_round_robin to LB policy registry (#3001) (currently experimental, enabled by the environment variable GRPC_EXPERIMENTAL_XDS_WRR_LB)

Add wrr_locality to LB policy registry (#3003)

@grpc/grpc-js 1.14.0

Changelog

Add getAuthContext method to client and server call classes (more details can be found in gRFC L35) (#2920)

Implement custom backend metrics support (gRFC A51) (#2978, #2983, #2985, #2986, #2999)

Add getConnectionInfo method to the ServerInterceptingCall class (#2922)

Implement the weighted_round_robin load balancing policy (#2998)

Fix jitter behavior for client retries (#2960 contributed by @ekscentrysytet)

Start connecting from a random index in the round_robin LB policy (#2979)

Send connection-level WINDOW_UPDATE at session start (#2971 contributed by @KoenRijpstra)

Experimental API Changes

Added:

CHANNEL_ARGS_CONFIG_SELECTOR_KEY

StatusOr<T>

CallStream

statusOrFromValue

statusOrFromError

... (truncated)

Commits

56567d9 Merge pull request #3086 from murgatroid99/grpc-js_1.14.5
748ae86 Merge pull request #3088 from murgatroid99/grpc-js_perf_improvement_backport
526702d test(grpc-js): fix type errors in client stream lifecycle tests
26a8d3d fix(grpc-js): avoid redundant end() calls on completed HTTP/2 streams
152eebd chore(grpc-js): unify call numbers and avoid disabled trace allocations
c5ae750 grpc-js(-xds): Increment version numbers (1.14.x)
735a09a Merge commit from fork
af9b140 Merge commit from fork
45ac33e Merge commit from fork
9df49e3 Merge pull request #3081 from murgatroid99/grpc-js-xds_weighted_target_fix_ba...
Additional commits viewable in compare view

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates baseline-browser-mapping from 2.10.33 to 2.11.27

Release notes

Sourced from baseline-browser-mapping's releases.

v2.11.0

What's Changed in 2.11.0

feat: Adds a new getTimeline() method for getting the series of minimum browser changes, either grouped by date or by browser.

refactor: Substantial refactoring of the data compression process that replaces the full list of browsers from @mdn/browser-compat-data and downstream-browsers.json and features from web-features (in their very pared down form) with a change-list timeline that reflects which versions supported Baseline (newly available) on a given date. Thanks to @swwind for the idea!

refactor: Some common functions have been moved to a util.ts module for use in other scripts.

fix: Removes process.exit() calls when unsupported option combinations are passed to getCompatibleVersions() and getAllVersions() in favour of throwing an Error. There is a small security risk with process.exit() calls that sites accepting unsanitised inputs could be the subject of attacks. Unsupported config options now throw and Error which should allow for more graceful handling. Thanks to @bnbdr for flagging this as vulnerability CVE-2026-45819 .

Fixes #134

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.10.44...v2.11.0

Commits

6141d06 Patch to 2.11.27 because browser or feature data changed
e1d166b Browser or feature data changed
42972a7 Updating static site
c1934c6 Patch to 2.11.26 because browser or feature data changed
4873684 Browser or feature data changed
9030798 Updating static site
a5df351 Updating static site
ecc5b54 Updating static site
719bf7a Patch to 2.11.25 because browser or feature data changed
c4f5b49 Browser or feature data changed
Additional commits viewable in compare view

Updates basic-ftp from 5.0.5 to 5.3.1

Release notes

Sourced from basic-ftp's releases.

5.3.1

Fixed: Protect against unbounded control response, fixes GHSA-rpmf-866q-6p89.

5.3.0

Changed: Introduced an upper bound for total bytes of directory listing, fixes GHSA-rp42-5vxx-qpwr.

Added: Option to increase the upper bound for total bytes of directory listing in Client constructor.

5.2.2

Fixed: Improve control character rejection, fixes GHSA-6v7q-wjvx-w8wg.

5.2.1

Fixed: Reject control character injection attempts using paths. See GHSA-chqc-8p9q-pq6q.

5.2.0

Changed: Skip files with invalid name in downloadToDir.

5.1.0

Added: Add the option to prevent the use of separate transfer host IPs when using PASV. (#259)

Changelog

Sourced from basic-ftp's changelog.

5.3.1

Fixed: Protect against unbounded control response, fixes GHSA-rpmf-866q-6p89.

5.3.0

Changed: Introduced an upper bound for total bytes of directory listing, fixes GHSA-rp42-5vxx-qpwr.

Added: Option to increase the upper bound for total bytes of directory listing in Client constructor.

5.2.2

Fixed: Improve control character rejection, fixes GHSA-6v7q-wjvx-w8wg.

5.2.1

Fixed: Reject control character injection attempts using paths. See GHSA-chqc-8p9q-pq6q.

5.2.0

Changed: Skip files with invalid name in downloadToDir. Fixes security vulnerability CVE-2026-27699, see GHSA-5rq4-664w-9x2c.

5.1.0

Added: Add the option to prevent the use of separate transfer host IPs when using PASV. (#259)

Commits

980371b Guard against unbounded control response
50827c7 Adjust changelog to match release notes
c9378a8 Fix test
22abe43 Update Github Actions
0feaaec Fix test
6629d7d Improve error message
9c3bf4f Set higher default value for max size of directory listing
acd3942 Bump version
1304429 Offer maxListingBytes as an option
5cb5367 Add bounded StringWriter
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by patrickjuchli, a new releaser for basic-ftp since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates browserslist from 4.23.3 to 4.29.3

Release notes

Sourced from browserslist's releases.

4.29.3

Updated Firefox ESR.

4.29.2

Fixed ignoring null usage in cover X in Y query (by @wahidrizka).

4.29.1

Fixed config name loading protection on Windows (by @oss-security-shop).

Fixed case-insensitive negation queries (by @jakezwang).

Fixed percentage and supports queries case-insensitive (by @wahidrizka).

Fixed old Node.js tests (by @aaron-belenky).

Reduced code (by @charmander).

4.29.0

Added query continuations across lines and array entries (by @fzlzjerry).

4.28.9

Improve or parsing performance (by @NotAFlightRisk).

4.28.8

Fixed including kaios in baseline queries (by @Jaybhade).

4.28.7

Improved parsing performance.

Fixed unbounded memory growth (by @alanturing881).

Fixed prototype write issue (by @alanturing881).

4.28.6

Fixed Electron version queries (by @spokodev).

4.28.5

Fixed > and >= queries (by @spokodev).

4.28.4

Fixed SyntaxError regression of 4.28.3.

4.28.3

Fixed baseline query case-insensitivity (by @swwind).

4.28.2

Fix prototype pollution (by @chluo1997).

4.28.1

Removed Baseline warning since we have it own warning.

4.27.0

Added BROWSERSLIST_TRACE_WARNING environment variable.

4.26.3

Fixed throwOnMissing with extends query (by @alexander-akait).

... (truncated)

Changelog

Sourced from browserslist's changelog.

4.29.3

Updated Firefox ESR.

4.29.2

Fixed ignoring null usage in cover X in Y query (by @wahidrizka).

4.29.1

Fixed config name loading protection on Windows (by @oss-security-shop).

Fixed case-insensitive negation queries (by @jakezwang).

Fixed percentage and supports queries case-insensitive (by @wahidrizka).

Fixed old Node.js tests (by @aaron-belenky).

Reduced code (by @charmander).

4.29.0

Added query continuations across lines and array entries (by @fzlzjerry).

4.28.9

Improved or parsing performance (by @NotAFlightRisk).

4.28.8

Fixed including kaios in baseline queries (by @Jaybhade).

4.28.7

Improved parsing performance.

Fixed unbounded memory growth (by @alanturing881).

Fixed prototype write issue (by @alanturing881).

4.28.6

Fixed Electron version queries (by @spokodev).

4.28.5

Fixed > and >= queries (by @spokodev).

4.28.4

Fixed SyntaxError regression of 4.28.3.

4.28.3

Fixed baseline query case-insensitivity (by @swwind).

... (truncated)

Commits

b4809dd Release 4.29.3 version
9d844f8 Update Firefox ESR
0033f34 Update dependencies
906d329 Release 4.29.2 version
ff8c83f Update dependencies
067f4a1 Merge pull request #952 from wahidrizka/fix-cover-null-usage
f760921 Do not add versions without usage data to cover queries
5be63f5 Merge pull request #953 from wahidrizka/docs-android-latest-version
1e5356f Note that Android version queries return only the latest version
5b7e941 Add missed changes to ChangeLog
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for browserslist since your current version.

Updates colord from 2.9.3 to 2.10.0

Release notes

Sourced from colord's releases.

v2.10 (RGB color mixing)

mix, tints, shades and tones (mix plugin) now accept an optional interpolation color space. LAB stays the default; pass "rgb" to interpolate RGB channels instead — the way browsers and design tools (such as Figma) composite translucent layers.
import { colord, extend } from "colord";
import mixPlugin from "colord/plugins/mix";
extend([mixPlugin]);
colord("#ff0000").mix("#ffffff", 0.5, "rgb").toHex(); // "#ff8080"
colord("#f0f3f1").mix("#007d40", 0.14, "rgb").toHex(); // "#cee2d8" — same as compositing rgba(0, 125, 64, 0.14) over #f0f3f1
colord("#ff0000").tints(3, "rgb").map((c) => c.toHex()); // ["#ff0000", "#ff8080", "#ffffff"]

Changelog

Sourced from colord's changelog.

2.10.0

Improve mix plugin by adding an optional "rgb" interpolation mode to mix, tints, tones and shades

2.9.7

Make HEX parsing and serialization more than 2x faster

2.9.6

Fix: Rotate the unrounded hue so rotate and harmonies preserve the original color

Fix: Normalize HWB whiteness + blackness over 100% to gray ❤️ @spokodev

2.9.5

Fix: Use adjusted chroma for the CIEDE2000 rotation term ❤️ @maximilliangrand

Fix: Keep the hue within [0, 360) in every color model ❤️ @sarathfrancis90

Both fixes change returned numbers for a small set of colors; toHex() output is unchanged. Snapshots holding h: 360, "hsl(360, …)" or a delta() value may need updating.

2.9.4

Fix: Reject malformed color strings in linear time ❤️ @GAP-dev

Commits

See full diff in compare view

Updates http-proxy-middleware from 2.0.9 to 2.0.10

Release notes

Sourced from http-proxy-middleware's releases.

v2.0.10

What's Changed

fix: harden proxy-table matching to prevent routing bypass by @G-Rath in chimurai/http-proxy-middleware#1268

ci(github-actions): update publish.yml by @chimurai in chimurai/http-proxy-middleware#1270

chore(package.json): v2.0.10 by @chimurai in chimurai/http-proxy-middleware#1271

New Contributors

@G-Rath made their first contribution in chimurai/http-proxy-middleware#1268

Full Changelog: chimurai/http-proxy-middleware@v2.0.9...v2.0.10

v2.0.10-beta.0

What's Changed

fix: harden proxy-table matching to prevent routing bypass by @G-Rath in chimurai/http-proxy-middleware#1268

ci(github-actions): update publish.yml by @chimurai in chimurai/http-proxy-middleware#1270

New Contributors

@G-Rath made their first contribution in chimurai/http-proxy-middleware#1268

Full Changelog: chimurai/http-proxy-middleware@v2.0.9...v2.0.10-beta.0

Changelog

Sourced from http-proxy-middleware's changelog.

v2.0.10

fix(router): harden proxy-table matching (exact host for host+path keys, prefix-only path matching) to prevent routing bypass

Commits

f0be839 chore(package.json): v2.0.10 (#1271)
19c860d ci(github-actions): update publish.yml (#1270)
d0f7d63 fix: harden proxy-table matching to prevent routing bypass (#1268)
See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for http-proxy-middleware since your current version.

Updates undici from 6.28.0 to 6.29.0

Release notes

Sourced from undici's releases.

v6.29.0

What's Changed

[v6.x] fix(retry): settle exposed body on terminal failure by @mcollina in nodejs/undici#5778

Backport upgrade diagnostics lifecycle fixes to v6.x by @BridgeAR in nodejs/undici#5833

test: synchronize the issue-3356 body timeout by @BridgeAR in nodejs/undici#5834

Full Changelog: nodejs/undici@v6.28.1...v6.29.0

v6.28.1

⚠️ Security fixes

High severity

GHSA-rfgv-xxqx-mfg5: a WebSocket server could select a subprotocol when none was requested, causing an uncaught TypeError that could terminate the process. Undici now rejects the handshake with protocol error 1002. Fixed by 2af0faf8.

Medium severity

GHSA-3wwx-pv8p-q78v: a malformed permessage-deflate payload exceeding the configured decompression limit could emit an unhandled zlib error and terminate the process. Undici now destroys the inflater after reaching the limit. Fixed by 07c60d9c.

Low severity

GHSA-r53p-7pc4-xj5r: the retry interceptor could concatenate a resumed response with inconsistent framing into downstream output, enabling response splitting or corruption. Undici now validates Content-Range against the original response framing before resuming. Fixed by ce31bc82.

What's Changed

perf: reduce EventSourceStream parser allocations (#5032) by @mcollina in nodejs/undici#5647

[v6.x] perf(h1): drop idle-socket timer floor with a ref'd setImmediate (#5707) by @mcollina in nodejs/undici#5770

Full Changelog: nodejs/undici@v6.28.0...v6.28.1

Commits

e1d0501 Bumped v6.29.0 (#5888)
57ac4de test: synchronize the issue-3356 body timeout (#5834)
6d44174 Backport upgrade diagnostics lifecycle fixes to v6.x (#5833)
2a91fc8 fix(retry): settle exposed body on terminal failure (#5778)
ffc8aa0 Bumped v6.28.1 (#5773)
3866a3b perf(h1): drop idle-socket timer floor with a ref'd setImmediate (#5707) (#5770)
ce31bc8 fix(retry): validate resumed response framing
2af0faf fix(websocket): reject unrequested subprotocols
07c60d9 fix(websocket): destroy inflater after decompression limit
bd90fff perf: reduce EventSourceStream parser allocations (#5032) (#5647)
See full diff in compare view

Updates webpack-dev-middleware from 7.4.2 to 7.4.6

Release notes

Sourced from webpack-dev-middleware's releases.

v7.4.6

7.4.6 (2026-09-03)

Bug Fixes

reject requests that resolve outside the output directory

v7.4.5

7.4.5 (2025-09-24)

Bug Fixes

unpin memfs (#2176) (c9a0e68)

v7.4.4

7.4.4 (2025-09-23)

Bug Fixes

pin memfs version (#2174) (044d691)

v7.4.3

7.4.3 (2025-09-05)

Bug Fixes

do not call the next middleware for 304 responses (#2155) (c26a326)

do not call the next middleware when request is finished or errored (#2156) (116c680)

Changelog

Sourced from webpack-dev-middleware's changelog.

7.4.6 (2026-09-03)

Bug Fixes

reject requests that resolve outside the output directory

7.4.5 (2025-09-24)

Bug Fixes

unpin memfs (#2176) (c9a0e68)

7.4.4 (2025-09-23)

Bug Fixes

pin memfs version (#2174) (044d691)

7.4.3 (2025-09-05)

Bug Fixes

do not call the next middleware for 304 responses (#2155) (c26a326)

do not call the next middleware when request is finished or errored (#2156) (116c680)

Commits

70b3c33 chore(release): 7.4.6
cefccba Merge commit from fork
ec97e06 chore(release): 7.4.5
c9a0e68 fix: unpin memfs (#2176)
0c87e95 chore(deps-dev): bump the dependencies group across 1 directory with 6 update...
8f40f5f chore(release): 7.4.4
044d691 fix: pin memfs version (#2174)
253c7e1 chore(deps-dev): bump the dependencies group with 3 updates (#2170)
2535262 chore(deps): bump the dependencies group across 1 directory with 5 updates (#...
6b7531e chore: remove CODEOWNERS, too spammy (#2167)
Additional commits viewable in compare view

Updates websocket-driver from 0.7.4 to 0.7.5

Changelog

Sourced from websocket-driver's changelog.

0.7.5 / 2026-06-04

Close a draft-75/76 connection if a length header grows to exceed the configured max length

Fail the connection if a message is larger than the configured max length after extension processing

Commits

5d6a9aa Bump version to 0.7.5
c55679a Fail the connection if a message is larger than the configured max length aft...
5b197ca Close a draft-75/76 connection if a length header grows to exceed the configu...
fc93a48 Test on Node v22, v24, and v26
2e82d34 Test on recent versions of Node
e4962db Switch from Travis CI to GitHub Actions
3f2f9b7 Travis update: cache npm modules, remove sudo, run on Node 15
See full diff in compare view

Updates react-router from 6.30.6 to 8.4.0

Release notes

Sourced from react-router's releases.

v8.4.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v840

v8.3.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v831

v8.3.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v830

v8.2.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v820

v8.1.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v810

v8.0.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v801

v8.0.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v800

v7.18.4

See the changelog for release notes: https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7184

v7.18.3

See the changelog for release notes: https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7183

v7.18.2

See the changelog for release notes: https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7182

v7.18.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7181

v7.18.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180

v7.17.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7170

v7.16.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7160

v7.15.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7151

v7.15.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7150

v7.14.2

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7142

... (truncated)

Changelog

Sourced from react-router's changelog.

v8.4.0

Minor Changes

Deprecate the createStaticRouter({ branches }) option (#15297)

createStaticRouter now caches route branches internally, ignores branches, and logs a deprecation warning when the option is provided

The deprecated EntryContext.branches property remains available for compatibility but is always an empty array

Patch Changes

Prevent stale route discovery during manifest version-mismatch recovery (#15489)

Keep concurrent manifest responses pending while a document reload is in progress

Report a discovery error when a previous reload failed to resolve a version mismatch instead of loading a stale route or reloading repeatedly

Fail pending requests if a document reload does not complete within five seconds or the document is restored from the back-forward cache, allowing subsequent requests to recover

Preserve lazy route module import errors during SPA navigations instead of replacing them with a missing dataStrategy result error (#15464)

Switch to more granular internal router contexts to avoid unnecessary route component re-renders when unrelated data router state changes (#15376)

⚠️ This contains some breaking changes to exported UNSAFE_ contexts, so please review carefully if you are using those unsafe exports

Correctly escape streamed RSC redirect locations in meta tag attributes (#15491)

Avoid unintended document.startViewTransition calls during initial hydration and router.revalidate() calls (#15484)

Fix SingleFetchNoResultError thrown when a fetcher revalidates against a splat route during lazy route discovery (#15395)

Track discovery per fetcher load so revalidation waits for the current load's discovery, even when the fetcher key is reused, while still restarting interrupted loaders after discovery completes

Preserve the underlying decode failure as the cause of the Unable to decode turbo-stream response error (#15450)

Unstable Changes

⚠️ Unstable features are not recommended for production use

Add a Data Mode future.unstable_routePatternMatching flag for more efficient route matching powered by @remix-run/route-pattern (#15298)

Add an unstable_validateParams route field to reject invalid parameter values and continue matching

Document access control requirements for RSC Server Functions (#15490)

Treat every Server Function as a public endpoint that must perform all of its own access control checks

Recommend route actions when access control should be provided by route middleware

v8.3.1

Patch Changes

Fix Expected fetcher: <key> error thrown on navigation when a fetcher is aborted during its post-action revalidation (#15365)

Fix lazy route discovery caching a path as discovered when the triggering navigation was aborted after the manifest response settled but before the route tree was patched, which permanently (for the session) shadowed the real route behind a catch-all or produced 404s on every subsequent visit (#15399)

Improve route matching performance for long paths (#15417)

Improve validation of action request origins (#15419)

Fix <ScrollRestoration> leaving history.scrollRestoration set to "auto" after a bfcache restore, which let the browser restore scroll on subsequent history traversals before the destination route had rendered (#15397)

Properly respect the relative option in useSubmit/fetcher.submit when resolivng the action path (#15400)

Add additional URL validation on client side navigations/redirects (#15445)

v8.3.0

Patch Changes

Encode path params in href/generatePath per RFC 3986 path-segment rules instead of encodeURIComponent (#15310)

... (truncated)

Commits

7ccdcec Release v8.4.0 (#15496)
dc95459 Prepare v8.4.0 release notes
5fe40ed Fix change file
f329d4b Skip view transitions on revalidation and initial hydration (#15484)
34ffffb Preload the route-pattern matcher before opting in (#15506)
4091c34 Document RSC server function access control (#15490)
6f2a0e0 Restore upstream route-pattern dependency (#15505)
10908b2 docs: fix router comment spelling (#15495)
acf1f20 Fix empty terminating splats with route-pattern matching (#15499)
c58d715 Fix HTML attribute escaping for RSC redirects (#15491)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Applies dependabot's security updates for @grpc/grpc-js 1.14.5, baseline-browser-mapping 2.11.27, basic-ftp 5.3.1, browserslist 4.29.3, colord 2.10.0, http-proxy-middleware 2.0.10, undici 6.29.0/7.30.0, webpack-dev-middleware 7.4.6 and websocket-driver 0.7.5. Excludes the grouped react-router / react-router-dom major bumps: @backstage/core-components, core-app-api and app-defaults peer-require react-router-dom ^6.30.2 with react ^17||^18, so v7/v8 cannot land here. Ranges stay at v6; net diff is yarn.lock only. Co-authored-by: opencode-agent[bot] <219766164+opencode-agent[bot]@users.noreply.github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 3, 2026

johnnyhuy force-pushed the dependabot/npm_and_yarn/npm_and_yarn-8574dbff05 branch from a5ab775 to e2b5c7f Compare October 3, 2026 08:24

johnnyhuy merged commit 1315338 into main Oct 3, 2026
5 checks passed

johnnyhuy deleted the dependabot/npm_and_yarn/npm_and_yarn-8574dbff05 branch October 3, 2026 08:30

Navigation Menu

Repository navigation

chore(deps): Bump the npm_and_yarn group across 2 directories with 10 updates - #105

chore(deps): Bump the npm_and_yarn group across 2 directories with 10 updates#105
johnnyhuy merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-8574dbff05

dependabot Bot commented on behalf of github Oct 3, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 3, 2026

@​grpc/grpc-js 1.14.5

@​grpc/grpc-js 1.14.4

@​grpc/grpc-js 1.14.3

@​grpc/grpc-js 1.14.2

@​grpc/grpc-js 1.14.1

@​grpc/grpc-js-xds 1.14.1

@​grpc/grpc-js-xds 1.14.0

@​grpc/grpc-js 1.14.0

Changelog

Experimental API Changes

v2.11.0

What's Changed in 2.11.0

5.3.1

5.3.0

5.2.2

5.2.1

5.2.0

5.1.0

5.3.1

5.3.0

5.2.2

5.2.1

5.2.0

5.1.0

4.29.3

4.29.2

4.29.1

4.29.0

4.28.9

4.28.8

4.28.7

4.28.6

4.28.5

4.28.4

4.28.3

4.28.2

4.28.1

4.27.0

4.26.3

4.29.3

4.29.2

4.29.1

4.29.0

4.28.9

4.28.8

4.28.7

4.28.6

4.28.5

4.28.4

4.28.3

v2.10 (RGB color mixing)

2.10.0

2.9.7

2.9.6

2.9.5

2.9.4

v2.0.10

What's Changed

New Contributors

v2.0.10-beta.0

What's Changed

New Contributors

v2.0.10

v6.29.0

What's Changed

v6.28.1

⚠️ Security fixes

High severity

Medium severity

Low severity

What's Changed

v7.4.6

7.4.6 (2026-09-03)

Bug Fixes

v7.4.5

7.4.5 (2025-09-24)

Bug Fixes

v7.4.4

`@grpc/grpc-js` 1.14.5

`@grpc/grpc-js` 1.14.4

`@grpc/grpc-js` 1.14.3

`@grpc/grpc-js` 1.14.2

`@grpc/grpc-js` 1.14.1

`@grpc/grpc-js-xds` 1.14.1

`@grpc/grpc-js-xds` 1.14.0

`@grpc/grpc-js` 1.14.0