Skip to content

chore(deps-dev): bump the dev-dependencies-security group across 1 directory with 9 updates - #337

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-security-0ed0146950
Closed

chore(deps-dev): bump the dev-dependencies-security group across 1 directory with 9 updates#337
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-security-0ed0146950

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 1, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the dev-dependencies-security group with 9 updates in the / directory:

Package From To
@cyclonedx/cyclonedx-npm 4.2.1 6.0.0
@faker-js/faker 10.4.0 10.5.0
@sveltejs/kit 2.53.2 2.70.3
@humanfs/node 0.16.7 0.16.8
brace-expansion 1.1.12 1.1.21
fast-uri 3.1.0 3.1.8
joi 17.13.3 17.13.8
js-yaml 4.1.1 4.3.2
tar 7.5.11 7.5.22

Updates @cyclonedx/cyclonedx-npm from 4.2.1 to 6.0.0

Release notes

Sourced from @​cyclonedx/cyclonedx-npm's releases.

6.0.0

[!IMPORTANT]
This release includes a fix for a known security vulnerability.

BREAKING Changes

  • Reworked npm detection and handling.
    The behavior when npm_execpath is present remains unchanged.

Fixed

  • Eliminated a potential shell‑injection vulnerability in the --workspace argument on Windows (via #1489)
    See GHSA-q69g-4hcv-6jg4
  • Properly closing output file (via #1484)

Tests

  • Added more regression test for shell injections (via #1488)

#1484: CycloneDX/cyclonedx-node-npm#1484 #1488: CycloneDX/cyclonedx-node-npm#1488 #1489: CycloneDX/cyclonedx-node-npm#1489

What's Changed

Full Changelog: CycloneDX/cyclonedx-node-npm@v5.0.0...v6.0.0

5.0.0

[!IMPORTANT]
This release includes a fix for a known security vulnerability.

BREAKING Changes

  • Reworked npm handling – npm is now executed explicitly rather than through a subshell.
    The behavior when npm_execpath is present remains unchanged.

Fixed

  • Eliminated a potential shell‑injection vulnerability in the --workspace argument (via #1476)
    See GHSA-v75r-vx73-82pj

#1476: CycloneDX/cyclonedx-node-npm#1476

... (truncated)

Changelog

Sourced from @​cyclonedx/cyclonedx-npm's changelog.

6.0.0 - 2026-07-07

  • BREAKING Changes
    • Reworked npm detection and handling.
      The behavior when npm_execpath is present remains unchanged.
  • Fixed
    • Eliminated a potential shell‑injection vulnerability in the --workspace argument on Windows (via #1489)
      See GHSA-q69g-4hcv-6jg4
    • Properly closing output file (via #1484)
  • Tests
    • Added more regression test for shell injections (via #1488)

#1484: CycloneDX/cyclonedx-node-npm#1484 #1488: CycloneDX/cyclonedx-node-npm#1488 #1489: CycloneDX/cyclonedx-node-npm#1489

5.0.0 - 2026-06-16

  • BREAKING Changes
    • Reworked npm handling - npm is now executed explicitly rather than through a subshell.
      The behavior when npm_execpath is present remains unchanged.
  • Fixed
    • Eliminated a potential shell‑injection vulnerability in the --workspace argument (via #1476)
      See GHSA-v75r-vx73-82pj
  • Tests
    • Added regression test for shell injections (via #1476)

#1476: CycloneDX/cyclonedx-node-npm#1476

Commits

Updates @faker-js/faker from 10.4.0 to 10.5.0

Release notes

Sourced from @​faker-js/faker's releases.

v10.5.0

What's Changed

... (truncated)

Changelog

Sourced from @​faker-js/faker's changelog.

10.5.0 (2026-06-17)

New Locales

  • locale: add color to cy (#3816) (5a6379f)
  • locale: add Farsi airline module locale (#3789) (f4a1c3e)
  • locale: add mn_MN_cyrl (Mongolian) locale (#3796) (d17c0f1)
  • locale: Add more realistic Greek address data (#3792) (6153eb7)
  • locale: Add postal_address and improved secondary_address for es (#3798) (6c2a0ab)
  • locale: add sl_SI locale, location module (#3652) (28d4f7c)
  • locale: add Welsh (cy) animal type definitions (#3842) (50a5ec9)
  • locale: add Welsh (cy) book format definitions (#3846) (#3846) (2b32d6e)
  • locale: add Welsh (cy) building numbers definition (#3892) (4996a2b)
  • locale: add Welsh (cy) city name definitions (#3884) (ac36c22)
  • locale: add Welsh (cy) continents definitions (#3880) (03a1682)
  • locale: add Welsh (cy) county definitions (#3849) (f51d28a)
  • locale: add Welsh (cy) direction definitions (#3840) (d862071)
  • locale: add Welsh (cy) internet domain suffix definitions (#3865) (#3865) (fb2e2cb)
  • locale: add Welsh (cy) phone number definitions (#3878) (70994db)
  • locale: add Welsh (cy) postal address definitions (#3850) (e72fd7c)
  • locale: add Welsh (cy) postcode definitions (#3851) (1afbd59)
  • locale: add Welsh (cy) sex definitions (#3824) (6f29eb7)
  • locale: add Welsh (cy) state definitions (#3891) (#3891) (606d47c)
  • locale: add Welsh (cy) street name definitions (#3889) (143789e)
  • locale: add Welsh (cy) vehicle fuel definitions (#3845) (29c918a)
  • locale: extend tr person last names (#3839) (f433771)
  • locale: improved en_GB postcodes (#3864) (a4e5039)
  • locale: improved en_IE postal_address (#3797) (fb3ffd3)

Features

  • add first standalone module functions (#3818) (5d4f5de)
  • date: add ability to provide date range for recent and soon (#3844) (0bc038d)
  • date: add ability to provide year range for past and future (#3783) (237e7dc)
  • food: expand plant-based dish and pattern variety (#3887) (5eaf729)
  • introduce FakerCore (#2838) (68e15d7)
  • location: add postal address generation (#3760) (753bec6)
  • number: add distributor functions (#3375) (325e402)
  • phone: mobile style for phone.number (#3583) (cd5953b)

Bug Fixes

  • date: incorrect date boundary in past and future (#3827) (0446411)
  • finance: routingNumber now uses real FederalReserveRoutingSymbol from lookup table. (#3429) (c53c1fe)
  • food: correct fruit and vegetable locale data (#3800) (30a812a)
  • handle single-character fromRegExp patterns (#3877) (ec6cc3b)
  • helpers: ignore wrapper characters in fromRegExp (#3795) (9e2c0e3)

... (truncated)

Commits

Updates @sveltejs/kit from 2.53.2 to 2.70.3

Release notes

Sourced from @​sveltejs/kit's releases.

@​sveltejs/kit@​2.70.3

Patch Changes

  • fix: avoid eagerly reading $app/state dependencies during module initialization (b61018d)

@​sveltejs/kit@​2.70.2

Patch Changes

  • fix: prevent quadratic backtracking in Accept header content negotiation (#1)

@​sveltejs/kit@​2.70.1

Patch Changes

  • docs: update links to hooks documentation (#16417)

@​sveltejs/kit@​2.70.0

Minor Changes

  • feat: move defineEnvVars to @sveltejs/kit/env (#16378)

Patch Changes

  • fix: enable CSRF protection in builds with a non-production NODE_ENV value (#16313)

@​sveltejs/kit@​2.69.3

Patch Changes

  • fix: detect destructured load and actions exports during type generation (#16329)

  • fix: ensure CSS URL references are absolute when paths.relative is false (#16315)

  • fix: align MAX_COOKIE_SIZE with RFC 6265bis (#16322)

@​sveltejs/kit@​2.69.2

Patch Changes

  • fix: set define values on globalThis when running Vitest (#16246)

@​sveltejs/kit@​2.69.1

Patch Changes

  • fix: prevent prototype pollution when deleting file inputs (#16218)

  • fix: prevent unhandled promise rejection (#16219)

@​sveltejs/kit@​2.69.0

Minor Changes

... (truncated)

Changelog

Sourced from @​sveltejs/kit's changelog.

2.70.3

Patch Changes

  • fix: avoid eagerly reading $app/state dependencies during module initialization (b61018d)

2.70.2

Patch Changes

  • fix: prevent quadratic backtracking in Accept header content negotiation (82712fc)

2.70.1

Patch Changes

  • docs: update links to hooks documentation (#16417)

2.70.0

Minor Changes

  • feat: move defineEnvVars to @sveltejs/kit/env (#16378)

Patch Changes

  • fix: enable CSRF protection in builds with a non-production NODE_ENV value (#16313)

2.69.3

Patch Changes

  • fix: detect destructured load and actions exports during type generation (#16329)

  • fix: ensure CSS URL references are absolute when paths.relative is false (#16315)

  • fix: align MAX_COOKIE_SIZE with RFC 6265bis (#16322)

3.0.0-next.7

Major Changes

  • breaking: change form.error type from any to App.Error | undefined (#16245)

  • feat: allow adapters to provide additional Vite plugins (#16206)

  • breaking: move tracing out of the experimental namespace and remove the instrumentation flag (#16260)

  • breaking: remove $app/stores (#15499)

... (truncated)

Commits

Updates @humanfs/node from 0.16.7 to 0.16.8

Release notes

Sourced from @​humanfs/node's releases.

node: v0.16.8

0.16.8 (2026-04-17)

Bug Fixes

  • Include type dependencies at runtime (956ce7a), closes #145

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • @​humanfs/core bumped from ^0.19.1 to ^0.19.2
Changelog

Sourced from @​humanfs/node's changelog.

0.16.8 (2026-04-17)

Bug Fixes

  • Ensure symlinks are copied as symlinks in copy() and copyAll() (22bbaa44)
  • Include type dependencies at runtime (956ce7a), closes #145

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • @​humanfs/core bumped from ^0.19.1 to ^0.19.2
Commits

Updates brace-expansion from 1.1.12 to 1.1.21

Release notes

Sourced from brace-expansion's releases.

v1.1.15

  • Backport v5.0.6 change to v1 (#111) 0b09384

juliangruber/brace-expansion@v1.1.14...v1.1.15

Commits

Updates fast-uri from 3.1.0 to 3.1.8

Release notes

Sourced from fast-uri's releases.

v3.1.8

⚠️ Security Warning

This security release fixes the following medium-severity security advisory:

Users of the v3.x release line should upgrade to v3.1.8.

Full Changelog: fastify/fast-uri@v3.1.7...v3.1.8

v3.1.7

⚠️ Security Warning

This is a security release that fixes the following high-severity security advisories:

Users of the v3.x release line should upgrade to v3.1.7.

Full Changelog: fastify/fast-uri@v3.1.6...v3.1.7

v3.1.6

⚠️ Security Warning

This release addresses the following high-severity security advisories:

Users of the v3.x release line should upgrade to v3.1.6.

Full Changelog: fastify/fast-uri@v3.1.5...v3.1.6

v3.1.5

⚠️ Security Warning

Fix for GHSA-7p8r-x3mc-p8w7

Full Changelog: fastify/fast-uri@v3.1.4...v3.1.5

v3.1.4

⚠️ Security Release

Fix for GHSA-v2hh-gcrm-f6hx

Full Changelog: fastify/fast-uri@v3.1.3...v3.1.4

... (truncated)

Commits
  • ead3ab7 Bumped v3.1.8
  • c88b59e fix: normalize decoded reg-name case
  • 412e40a Bumped v3.1.7
  • 9f4c943 fix: backport port and IP-literal validation to v3.x (#216)
  • 1eb3ce4 fix: treat unterminated bracket hosts as reg-names again (#214)
  • 6f970b2 Bumped v3.1.6
  • d941579 fix: never run IDN canonicalization on bracketed IP literals
  • c0f0279 test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)
  • 37f3417 Merge commit from fork
  • 607bfbe Merge commit from fork
  • Additional commits viewable in compare view

Updates joi from 17.13.3 to 17.13.8

Commits

Updates js-yaml from 4.1.1 to 4.3.2

Changelog

Sourced from js-yaml's changelog.

4.3.2 - 2026-08-26

Changed

  • [backport] Hard-limit merge sequence size to 100.

Security

  • [backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

4.3.1 - 2026-07-31

Security

  • [backport] Remove quadratic complexity from !!omap duplicate key detection.

4.3.0 - 2026-06-27

Added

  • [backport] Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.

Fixed

  • Restore umd builds back to es5.

Removed

  • [backport] maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

[4.2.0] - 2026-06-01

Added

  • Added docs/safety.md with notes about processing untrusted YAML.
  • Added maxDepth (100) loader option. Not a problem, but gives a better exception instead of RangeError on stack overflow.
  • Added maxMergeSeqLength (20) loader option. Not a problem after merge fix, but an additional restriction for safety.
  • Added sourcemaps to dist/ builds.

Changed

  • Stop resolving numbers with underscores as numeric scalars, #627.
  • Switched dev toolchains to Vite / neostandard.
  • Updated demo.
  • Reorganized tests.
  • dist/ files are no longer kept in the repository.

Fixed

  • Fix parsing of properties on the first implicit block mapping key, #62.
  • Fix trailing whitespace handling when folding flow scalar lines, #307.
  • Reject top-level block scalars without content indentation, #280.
  • Ensure numbers survive round-trip, #737.
  • Fix test coverage for issue #221.
  • Fix flow scalar trailing whitespace folding, #307.

... (truncated)

Commits
  • 79ca68d 4.3.2 released
  • d90b661 Backport merge limits from v5.4.1
  • 86e91b8 4.3.1 released
  • c3cc4b0 Backport quadratic complexity fix for !!omap
  • 33d05b5 4.3.0 released
  • 663bfab Drop demo publish, to not override new v5 one.
  • 1cb8c7b Add v4-legacy tag for publish
  • 02f27af Restore umd builds back to es5
  • 8be84ed Fix es5 compatibility
  • 59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
  • Additional commits viewable in compare view

Updates tar from 7.5.11 to 7.5.22

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file type/security labels Oct 1, 2026
This was referenced Oct 1, 2026
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
@Bohreromir

Bohreromir commented Oct 1, 2026

Copy link
Copy Markdown
Contributor

@dependabot recreate

@dependabot
chore(deps-dev): bump the dev-dependencies-security group across 1 di…
e3ca044 
…rectory with 9 updates

Bumps the dev-dependencies-security group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@cyclonedx/cyclonedx-npm](https://github.com/CycloneDX/cyclonedx-node-npm) | `4.2.1` | `6.0.0` |
| [@faker-js/faker](https://github.com/faker-js/faker) | `10.4.0` | `10.5.0` |
| [@sveltejs/kit](https://github.com/sveltejs/kit/tree/HEAD/packages/kit) | `2.53.2` | `2.70.3` |
| [@humanfs/node](https://github.com/humanwhocodes/humanfs/tree/HEAD/packages/node) | `0.16.7` | `0.16.8` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.12` | `1.1.21` |
| [fast-uri](https://github.com/fastify/fast-uri) | `3.1.0` | `3.1.8` |
| [joi](https://github.com/hapijs/joi) | `17.13.3` | `17.13.8` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.1` | `4.3.2` |
| [tar](https://github.com/isaacs/node-tar) | `7.5.11` | `7.5.22` |



Updates `@cyclonedx/cyclonedx-npm` from 4.2.1 to 6.0.0
- [Release notes](https://github.com/CycloneDX/cyclonedx-node-npm/releases)
- [Changelog](https://github.com/CycloneDX/cyclonedx-node-npm/blob/main/HISTORY.md)
- [Commits](CycloneDX/cyclonedx-node-npm@v4.2.1...v6.0.0)

Updates `@faker-js/faker` from 10.4.0 to 10.5.0
- [Release notes](https://github.com/faker-js/faker/releases)
- [Changelog](https://github.com/faker-js/faker/blob/next/CHANGELOG.md)
- [Commits](faker-js/faker@v10.4.0...v10.5.0)

Updates `@sveltejs/kit` from 2.53.2 to 2.70.3
- [Release notes](https://github.com/sveltejs/kit/releases)
- [Changelog](https://github.com/sveltejs/kit/blob/version-3/packages/kit/CHANGELOG.md)
- [Commits](https://github.com/sveltejs/kit/commits/@sveltejs/kit@2.70.3/packages/kit)

Updates `@humanfs/node` from 0.16.7 to 0.16.8
- [Release notes](https://github.com/humanwhocodes/humanfs/releases)
- [Changelog](https://github.com/humanwhocodes/humanfs/blob/main/packages/node/CHANGELOG.md)
- [Commits](https://github.com/humanwhocodes/humanfs/commits/node-v0.16.8/packages/node)

Updates `brace-expansion` from 1.1.12 to 1.1.21
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.21)

Updates `fast-uri` from 3.1.0 to 3.1.8
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.0...v3.1.8)

Updates `joi` from 17.13.3 to 17.13.8
- [Commits](hapijs/joi@v17.13.3...v17.13.8)

Updates `js-yaml` from 4.1.1 to 4.3.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.1...4.3.2)

Updates `tar` from 7.5.11 to 7.5.22
- [Release notes](https://github.com/isaacs/node-tar/releases)
- [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md)
- [Commits](isaacs/node-tar@v7.5.11...v7.5.22)

---
updated-dependencies:
- dependency-name: "@cyclonedx/cyclonedx-npm"
  dependency-version: 6.0.0
  dependency-type: direct:development
  dependency-group: dev-dependencies-security
- dependency-name: "@faker-js/faker"
  dependency-version: 10.5.0
  dependency-type: direct:development
  dependency-group: dev-dependencies-security
- dependency-name: "@humanfs/node"
  dependency-version: 0.16.8
  dependency-type: indirect
  dependency-group: dev-dependencies-security
- dependency-name: "@sveltejs/kit"
  dependency-version: 2.70.3
  dependency-type: direct:development
  dependency-group: dev-dependencies-security
- dependency-name: brace-expansion
  dependency-version: 1.1.21
  dependency-type: indirect
  dependency-group: dev-dependencies-security
- dependency-name: fast-uri
  dependency-version: 3.1.8
  dependency-type: indirect
  dependency-group: dev-dependencies-security
- dependency-name: joi
  dependency-version: 17.13.8
  dependency-type: indirect
  dependency-group: dev-dependencies-security
- dependency-name: js-yaml
  dependency-version: 4.3.2
  dependency-type: indirect
  dependency-group: dev-dependencies-security
- dependency-name: tar
  dependency-version: 7.5.22
  dependency-type: indirect
  dependency-group: dev-dependencies-security
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/dev-dependencies-security-0ed0146950 branch from 0baafe0 to e3ca044 Compare October 1, 2026 14:01
@Bohreromir

Bohreromir commented Oct 2, 2026

Copy link
Copy Markdown
Contributor

@dependabot recreate

@dependabot @github

dependabot Bot commented on behalf of github Oct 2, 2026

Copy link
Copy Markdown
Author

Looks like these dependencies are no longer updatable, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 2, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/dev-dependencies-security-0ed0146950 branch October 2, 2026 08:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file type/security

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Bohreromir