build(deps): bump the npm_and_yarn group across 2 directories with 16 updates #96

dependabot · 2025-02-04T04:16:47Z

Bumps the npm_and_yarn group with 10 updates in the / directory:

Package	From	To
express	`4.18.2`	`4.20.0`
cross-fetch	`3.1.4`	`3.1.5`
debug	`4.1.1`	`4.4.0`
@types/debug	`4.1.5`	`4.1.12`
handlebars	`4.7.6`	`4.7.7`
json5	`2.2.0`	`2.2.2`
sqlite3	`5.1.1`	`5.1.5`
ws	`8.11.0`	`8.17.1`
yaml	`2.1.3`	`2.2.2`
webpack	`4.41.2`	`4.41.3`

Bumps the npm_and_yarn group with 4 updates in the /packages/vckit-oa-renderers directory: debug, @types/debug, handlebars and webpack.

Updates express from 4.18.2 to 4.20.0

Release notes

Sourced from express's releases.

4.20.0

What's Changed

Important

IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)

Remove link renderization in html while using res.redirect

Other Changes

4.19.2 Staging by @wesleytodd in expressjs/express#5561

remove duplicate location test for data uri by @wesleytodd in expressjs/express#5562

feat: document beta releases expectations by @marco-ippolito in expressjs/express#5565

Cut down on duplicated CI runs by @jonchurch in expressjs/express#5564

Add a Threat Model by @UlisesGascon in expressjs/express#5526

Assign captain of encodeurl by @blakeembrey in expressjs/express#5579

Nominate jonchurch as repo captain for http-errors, expressjs.com, morgan, cors, body-parser by @jonchurch in expressjs/express#5587

docs: update Security.md by @inigomarquinez in expressjs/express#5590

docs: update triage nomination policy by @UlisesGascon in expressjs/express#5600

Add CodeQL (SAST) by @UlisesGascon in expressjs/express#5433

docs: add UlisesGascon as triage initiative captain by @UlisesGascon in expressjs/express#5605

deps: encodeurl@~2.0.0 by @blakeembrey in expressjs/express#5569

skip QUERY method test by @jonchurch in expressjs/express#5628

ignore ETAG query test on 21 and 22, reuse skip util by @jonchurch in expressjs/express#5639

add support Node.js@22 in the CI by @mertcanaltin in expressjs/express#5627

doc: add table of contents, tc/triager lists to readme by @mertcanaltin in expressjs/express#5619

List and sort all projects, add captains by @blakeembrey in expressjs/express#5653

docs: add @UlisesGascon as captain for cookie-parser by @UlisesGascon in expressjs/express#5666

✨ bring back query tests for node 21 by @ctcpip in expressjs/express#5690

[v4] Deprecate res.clearCookie accepting options.maxAge and options.expires by @jonchurch in expressjs/express#5672

skip QUERY tests for Node 21 only, still not supported by @jonchurch in expressjs/express#5695

📝 update people, add ctcpip to TC by @ctcpip in expressjs/express#5683

remove minor version pinning from ci by @jonchurch in expressjs/express#5722

Fix link variable use in attribution section of CODE OF CONDUCT by @IamLizu in expressjs/express#5762

Replace Appveyor windows testing with GHA by @jonchurch in expressjs/express#5599

Add OSSF Scorecard badge by @UlisesGascon in expressjs/express#5436

update scorecard link by @bjohansebas in expressjs/express#5814

Nominate @IamLizu to the triage team by @UlisesGascon in expressjs/express#5836

deps: [email protected] by @blakeembrey in expressjs/express#5603

docs: specify new instructions for question and discuss by @IamLizu in expressjs/express#5835

4.x: Upgrade merge-descriptors dependency by @RobinTail in expressjs/express#5781

[email protected] by @blakeembrey in expressjs/express#5902

New Contributors

@marco-ippolito made their first contribution in expressjs/express#5565

@inigomarquinez made their first contribution in expressjs/express#5590

@mertcanaltin made their first contribution in expressjs/express#5627

@ctcpip made their first contribution in expressjs/express#5690

@bjohansebas made their first contribution in expressjs/express#5814

Full Changelog: expressjs/express@4.19.1...4.20.0

... (truncated)

Changelog

Sourced from express's changelog.

4.20.0 / 2024-09-10

deps: [email protected]

Remove link renderization in html while redirecting

deps: [email protected]

Remove link renderization in html while redirecting

deps: [email protected]

add depth option to customize the depth level in the parser

IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)

Remove link renderization in html while using res.redirect

deps: [email protected]

Adds support for named matching groups in the routes using a regex

Adds backtracking protection to parameters without regexes defined

deps: encodeurl@~2.0.0

Removes encoding of \, |, and ^ to align better with URL spec

Deprecate passing options.maxAge and options.expires to res.clearCookie

Will be ignored in v5, clearCookie will set a cookie with an expires in the past to instruct clients to delete the cookie

4.19.2 / 2024-03-25

Improved fix for open redirect allow list bypass

4.19.1 / 2024-03-20

Allow passing non-strings to res.location with new encoding handling checks

4.19.0 / 2024-03-20

Prevent open redirect allow list bypass due to encodeurl

deps: [email protected]

4.18.3 / 2024-02-29

Fix routing requests without method

deps: [email protected]

Fix strict json error message on Node.js 19+

deps: content-type@~1.0.5

deps: [email protected]

deps: [email protected]

Add partitioned option

Commits

21df421 4.20.0
4c9ddc1 feat: upgrade to [email protected]
9ebe5d5 feat: upgrade to [email protected] (#5928)
ec4a01b feat: upgrade to [email protected] (#5926)
54271f6 fix: don't render redirect values in anchor href
125bb74 [email protected] (#5902)
2a980ad [email protected] (#5781)
a3e7e05 docs: specify new instructions for question and discuss
c5addb9 deps: [email protected] (#5603)
e35380a docs: add @IamLizu to the triage team (#5836)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for express since your current version.

Updates cross-fetch from 3.1.4 to 3.1.5

Release notes

Sourced from cross-fetch's releases.

v3.1.5

What's Changed

chore: updated node-fetch version to 2.6.7 by @dlafreniere in lquixada/cross-fetch#124

New Contributors

@dlafreniere made their first contribution in lquixada/cross-fetch#124

Full Changelog: lquixada/cross-fetch@v3.1.4...v3.1.5

Commits

c6089df chore(release): 3.1.5
a3b3a94 chore: updated node-fetch version to 2.6.7 (#124)
efed703 chore: updated node-fetch version to 2.6.5
694ff77 refactor: removed ora from dependencies
efc5956 refactor: added .vscode to .gitignore
da605d5 refactor: renamed test/fetch/ to test/fetch-api/ and test/module/ to test/mod...
0f0d51d chore: updated minor and patch versions of dev dependencies
c6e34ea refactor: removed sinon.js
f524a52 fix: yargs was incompatible with node 10
7906fcf chore: updated dev dependencies
Additional commits viewable in compare view

Updates debug from 4.1.1 to 4.4.0

Release notes

Sourced from debug's releases.

4.4.0

Fixes (hopefully) the inefficient regex warnings in .enable().

Minor version as this is invariably going to break certain users who misuse the .enable() API and expected it to work with regexes, which was never supported nor documented. That's on you, sorry - that functionality won't be added back.

Full Changelog: debug-js/debug@4.3.7...4.4.0

4.3.7

What's Changed

Upgrade ms to version 2.1.3 by @realityking in debug-js/debug#819

Full Changelog: debug-js/debug@4.3.6...4.3.7

4.3.6

What's Changed

Avoid using deprecated RegExp.$1 by @bluwy in debug-js/debug#969

New Contributors

@bluwy made their first contribution in debug-js/debug#969

Full Changelog: debug-js/debug@4.3.5...4.3.6

4.3.5

Patch

cac39b1c5b018b0fe93a53a05f084eee543d17f5 Fix/debug depth (#926)

Thank you @calvintwr for the fix.

4.3.4

What's Changed

Add section about configuring JS console to show debug messages by @gitname in debug-js/debug#866

Replace deprecated String.prototype.substr() by @CommanderRoot in debug-js/debug#876

New Contributors

@gitname made their first contribution in debug-js/debug#866

@CommanderRoot made their first contribution in debug-js/debug#876

Full Changelog: debug-js/debug@4.3.3...4.3.4

4.3.3

Patch Release 4.3.3

This is a documentation-only release. Further, the repository was transferred. Please see notes below.

Migrates repository from https://github.com/visionmedia/debug to https://github.com/debug-js/debug. Please see notes below as to why this change was made.

Updates repository maintainership information

Updates the copyright (no license terms change has been made)

Removes accidental epizeuxis (#828)

Adds README section regarding usage in child procs (#850)

... (truncated)

Commits

7e3814c 4.4.0
d2d6bf0 fix inefficient .enable() regex and .enabled() test
bc60914 4.3.7
c63e96e Upgrade ms to version 2.1.3 (#819)
382864a remove archaic badges from readme
c33b464 4.3.6
7956a45 Avoid using deprecated RegExp.$1
5464bdd 4.3.5
f244ada update authorship contact info
cac39b1 Fix/debug depth (#926)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by qix, a new releaser for debug since your current version.

Updates @types/debug from 4.1.5 to 4.1.12

Commits

See full diff in compare view

Updates handlebars from 4.7.6 to 4.7.7

Changelog

Sourced from handlebars's changelog.

v4.7.7 - February 15th, 2021

fix weird error in integration tests - eb860c0

fix: check prototype property access in strict-mode (#1736) - b6d3de7

fix: escape property names in compat mode (#1736) - f058970

refactor: In spec tests, use expectTemplate over equals and shouldThrow (#1683) - 77825f8

chore: start testing on Node.js 12 and 13 - 3789a30

(POSSIBLY) BREAKING CHANGES:

the changes from version 4.6.0 now also apply in when using the compile-option "strict: true". Access to prototype properties is forbidden completely by default, specific properties or methods can be allowed via runtime-options. See #1633 for details. If you are using Handlebars as documented, you should not be accessing prototype properties from your template anyway, so the changes should not be a problem for you. Only the use of undocumented features can break your build.

That is why we only bump the patch version despite mentioning breaking changes.

Commits

Commits

a9a8e40 v4.7.7
e66aed5 Update release notes
7d4d170 disable IE in Saucelabs tests
eb860c0 fix weird error in integration tests
b6d3de7 fix: check prototype property access in strict-mode (#1736)
f058970 fix: escape property names in compat mode (#1736)
77825f8 refator: In spec tests, use expectTemplate over equals and shouldThrow (#1683)
3789a30 chore: start testing on Node.js 12 and 13
See full diff in compare view

Updates json5 from 2.2.0 to 2.2.2

Release notes

Sourced from json5's releases.

v2.2.2

Fix: Properties with the name __proto__ are added to objects and arrays. (#199) This also fixes a prototype pollution vulnerability reported by Jonathan Gregson! (#295).

v2.2.1

Fix: Removed dependence on minimist to patch CVE-2021-44906. (#266)

Changelog

Sourced from json5's changelog.

v2.2.2 [code, diff]

Fix: Properties with the name __proto__ are added to objects and arrays. (#199) This also fixes a prototype pollution vulnerability reported by Jonathan Gregson! (#295).

v2.2.1 [code, diff]

Fix: Removed dependence on minimist to patch CVE-2021-44906. (#266)

Commits

14f8cb1 2.2.2
10cc7ca docs: update CHANGELOG for v2.2.2
7774c10 fix: add proto to objects and arrays
edde30a Readme: slight tweak to intro
97286f8 Improve example in readme
d720b4f Improve readme (e.g. explain JSON5 better!) (#291)
910ce25 docs: fix spelling of Aseem
2aab4dd test: require tap as t in cli tests
6d42686 test: remove mocha syntax from tests
4798b9d docs: update installation and usage for modules
Additional commits viewable in compare view

Updates sqlite3 from 5.1.1 to 5.1.5

Release notes

Sourced from sqlite3's releases.

v5.1.5

What's Changed

🔒 Fixed code execution vulnerability due to Object coercion by @daniellockyer

Updated bundled SQLite to v3.41.1 by @daniellockyer

Fixed rpath linker option when using a custom sqlite by @jeromew in TryGhost/node-sqlite3#1654

Full Changelog: TryGhost/node-sqlite3@v5.1.4...v5.1.5

v5.1.4

What's Changed

Fixed glibc compatibility by downgrading CI to Ubuntu 20 by @daniellockyer in TryGhost/node-sqlite3#1664

Full Changelog: TryGhost/node-sqlite3@v5.1.3...v5.1.4

v5.1.3

What's Changed

Updated bundled SQLite to v3.40.0 by @daniellockyer

Full Changelog: TryGhost/node-sqlite3@v5.1.2...v5.1.3

v5.1.2

What's Changed

Updated bundled SQLite to v3.39.4 by @daniellockyer

Full Changelog: TryGhost/node-sqlite3@v5.1.1...v5.1.2

Commits

6a806f8 v5.1.5
edb1934 Fixed code execution vulnerability due to Object coercion
3a48888 Updated bundled SQLite to v3.41.1
c1440bd Fixed rpath linker option when using a custom sqlite (#1654)
93affa4 Update microsoft/setup-msbuild action to v1.3
6f6318e v5.1.4
aeafe25 Revert "Renamed master references to main"
57ce2d4 Fixed glib compatibility by downgrading to Ubuntu 20
af8e567 Renamed master references to main
8fd18a3 Extracted function checking code into macro
Additional commits viewable in compare view

Updates ws from 8.11.0 to 8.17.1

Release notes

Sourced from ws's releases.

8.17.1

Bug fixes

Fixed a DoS vulnerability (#2231).

A request with a number of headers exceeding the[server.maxHeadersCount][] threshold could be used to crash a ws server.
const http = require('http');
const WebSocket = require('ws');
const wss = new WebSocket.Server({ port: 0 }, function () {
const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
const headers = {};
let count = 0;
for (let i = 0; i < chars.length; i++) {
if (count === 2000) break;
for (let j = 0; j &lt; chars.length; j++) {
  const key = chars[i] + chars[j];
  headers[key] = 'x';
if (++count === 2000) break;
}

}
headers.Connection = 'Upgrade';
headers.Upgrade = 'websocket';
headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';
headers['Sec-WebSocket-Version'] = '13';
const request = http.request({
headers: headers,
host: '127.0.0.1',
port: wss.address().port
});
request.end();
});
The vulnerability was reported by Ryan LaPointe in websockets/ws#2230.

In vulnerable versions of ws, the issue can be mitigated in the following ways:

Reduce the maximum allowed length of the request headers using the [--max-http-header-size=size][] and/or the [maxHeaderSize][] options so that no more headers than the server.maxHeadersCount limit can be sent.

... (truncated)

Commits

3c56601 [dist] 8.17.1
e55e510 [security] Fix crash when the Upgrade header cannot be read (#2231)
6a00029 [test] Increase code coverage
ddfe4a8 [perf] Reduce the amount of crypto.randomFillSync() calls
b73b118 [dist] 8.17.0
29694a5 [test] Use the highWaterMark variable
934c9d6 [ci] Test on node 22
1817bac [ci] Do not test on node 21
96c9b3d [major] Flip the default value of allowSynchronousEvents (#2221)
e5f32c7 [fix] Emit at most one event per event loop iteration (#2218)
Additional commits viewable in compare view

Updates yaml from 2.1.3 to 2.2.2

Release notes

Sourced from yaml's releases.

v2.2.2

This patch release includes a fix for an error that could be thrown in parseDocument for degenerate input. Otherwise, it's a patch release uplifting a few fixes from the ongoing v2.3 work to v2.2:

Corner case failure in error pretty-printer (CVE-2023-2251)

Use correct argument order when stringifying flow collection comments (#443)

First-line folding for block scalars (#422)

v2.2.1

Quote top-level map keys containing document markers (#431)

v2.2.0

New Features

Add flowCollectionPadding toString option (#420)

Use indicator line for props on block collection values of mappings (#425)

Bugfixes

Minor relaxation of types for custom tags (#429)

Commits

f21fa45 2.2.2
984f578 fix: Corner case failure in error pretty-printer
443e3aa fix: First-line folding for block scalars (fixes #422)
5af5d3d fix: Use correct argument order when stringifying flow collection comments (f...
c914dcc 2.2.1
c8551eb fix: Quote top-level map keys containing document markers (fixes #431)
3576408 2.2.0
ab52daa ci: Remove all @types except for node when testing types on old TS
85be08d chore: Explicitly set supported types in tsconfig.json
4732502 ci: Uninstall @jest/types before testing types on TS 4.2
Additional commits viewable in compare view

Updates webpack from 4.41.2 to 4.41.3

Commits

df9f3eb 4.41.3
fe71d68 Merge pull request #10010 from webpack/funding
b396d96 Merge pull request #10123 from pustovalov/webpack-4-serialize
29b2bdd Update terser-webpack-plugin to ^1.4.3
bedb566 chore: funding field
See full diff in compare view

Updates body-parser from 1.20.1 to 1.20.3

Release notes

Sourced from body-parser's releases.

1.20.3

What's Changed

Important

deps: [email protected]

add depth option to customize the depth level in the parser

IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity). Documentation

Other changes

chore: add support for OSSF scorecard reporting by @inigomarquinez in expressjs/body-parser#522

ci: fix errors in ci github action for node 8 and 9 by @inigomarquinez in expressjs/body-parser#523

fix: pin to [email protected] by @wesleytodd in expressjs/body-parser#527

deps: [email protected] by @melikhov-dev in expressjs/body-parser#521

Add OSSF Scorecard badge by @bjohansebas in expressjs/body-parser#531

Linter by @UlisesGascon in expressjs/body-parser#534

Release: 1.20.3 by @UlisesGascon in expressjs/body-parser#535

New Contributors

@inigomarquinez made their first contribution in expressjs/body-parser#522

@melikhov-dev made their first contribution in expressjs/body-parser#521

@bjohansebas made their first contribution in expressjs/body-parser#531

@UlisesGascon made their first contribution in expressjs/body-parser#534

Full Changelog: expressjs/body-parser@1.20.2...1.20.3

1.20.2

Fix strict json error message on Node.js 19+

deps: content-type@~1.0.5

perf: skip value escaping when unnecessary

deps: [email protected]

Changelog

Sourced from body-parser's changelog.

1.20.3 / 2024-09-10

deps: [email protected]

add depth option to customize the depth level in the parser

IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)

1.20.2 / 2023-02-21

Fix strict json error message on Node.js 19+

deps: content-type@~1.0.5

perf: skip value escaping when unnecessary

deps: [email protected]

Commits

1752951 1.20.3
39744cf chore: linter (#534)
b2695c4 Merge commit from fork
ade0f3f add scorecard to readme (#531)
99a1bd6 deps: [email protected] (#521)
9478591 fix: pin to [email protected]
83db46a ci: fix errors in ci github action for node 8 and 9 (#523)
9d4e212 chore: add support for OSSF scorecard reporting (#522)
ee91374 1.20.2
368a93a Fix strict json error message on Node.js 19+
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for body-parser since your current version.

Updates cookie from 0.5.0 to 0.6.0

Release notes

Sourced from cookie's releases.

0.6.0

Add partitioned option

Changelog

Sourced from cookie's changelog.

0.6.0 / 2023-11-06

Add partitioned option

Commits

38323ba 0.6.0
7560154 build: [email protected]
c45b52d docs: switch badges to badgen
84a1567 Add partitioned option
c67a478 docs: fix typos in HISTORY
52a76c1 docs: fix typo in HISTORY
5f22857 Fix typo in JSDoc
da7e44e build: [email protected]
936036a build: [email protected]
197f670 build: [email protected]
Additional commits viewable in compare view

Updates node-fetch from 2.6.1 to 2.6.7

Release notes

Sourced from node-fetch's releases.

v2.6.7

Security patch release

Recommended to upgrade, to not leak sensitive cookie and authentication header information to 3th party host while a redirect occurred

What's Changed

fix: don't forward secure headers to 3th party by @jimmywarting in node-fetch/node-fetch#1453

Full Changelog: node-fetch/node-fetch@v2.6.6...v2.6.7

v2.6.6

What's Changed

fix(URL): prefer built in URL version when available and fallback to whatwg by @jimmywarting in node-fetch/node-fetch#1352

Full Changelog: node-fetch/node-fetch@v2.6.5...v2.6.6

v2.6.2

fixed main path in package.json

Commits

1ef4b56 backport of #1449 (#1453)
8fe5c4e 2.x: Specify encoding as an optional peer dependency in package.json (#1310)
f56b0c6 fix(URL): prefer built in URL version when available and fallback to whatwg (...
b5417ae fix: import whatwg-url in a way compatible with ESM Node (#1303)
18193c5 fix v2.6.3 that did not sending query params (#1301)
ace7536 fix: properly encode url with unicode characters (#1291)
152214c Fix(package.json): Corrected main file path in package.json (#1274)
See full diff in compare view

Maintainer changes

This version was pushed to npm by endless, a new releaser for node-fetch since your current version.

Updates path-to-regexp from 0.1.7 to 0.1.10

Release notes

Sourced from path-to-regexp's releases.

Backtrack protection

Fixed

Add backtrack protection to parameters 29b96b4

This will break some edge cases but should improve performance

pillarjs/path-to-regexp@v0.1.9...v0.1.10

Support non-lookahead regex output

Added

Allow a non-lookahead regex (#312) c4272e4

component/path-to-regexp@v0.1.8...v0.1.9

Support named matching groups in RegExp

Added

Add support for named matching groups (#301) 114f62d

pillarjs/path-to-regexp@v0.1.7...v0.1.8

Commits

c827fce 0.1.10
29b96b4 Add backtrack protection to parameters
ac4c234 Update repo url (#314)
bdb6635 0.1.9
c4272e4 Allow a non-lookahead regex (#312)
51a1955 0.1.8
114f62d Add support for named matching groups (#301)
See full diff in compare view

Updates serve-static from 1.15.0 to 1.16.0

Release notes

Sourced from serve-static's releases.

1.16.0

What's Changed

Remove link renderization in html while redirecting (expressjs/serve-static#173)

New Contributors

@UlisesGascon made their first contribution in expressjs/serve-static#173

Full Changelog: expressjs/serve-static@v1.15.0...1.16.0

Changelog

Sourced from serve-static's changelog.

1.16.0 / 2024-09-10

Remove link renderization in html while redirecting

Commits

48c7397 1.16.0
0c11fad Merge commit from fork
See full diff in compare view

Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for serve-static since your current version.

Updates tar from 6.2.0 to 6.2.1

Commits

bef7b1e 6.2.1
fe8cd57 prevent extraction in excessively deep subfolders
fe7ebfd remove security.md
See full diff in compare view

Updates debug from 4.1.1 to 4.4.0

Release notes

Sourced from debug's releases.

4.4.0

Fixes (hopefully) the inefficient regex warnings in .enable().

Minor version as this is invariably going to break certain users who misuse the .enable() API and expected it to work with regexes, which was never supported nor documented. That's on you, sorry - that functionality won't be added back.

Full Changelog: debug-js/debug@4.3.7...4.4.0

4.3.7

What's Changed

Upgrade ms to version 2.1.3 by @realityking in debug-js/debug#819

Full Changelog: debug-js/debug@4.3.6...4.3.7

4.3.6

What's Changed

Avoid using deprecated RegExp.$1 by @bluwy in debug-js/debug#969

New Contributors

@bluwy made their first contribution in debug-js/debug#969

Full Changelog: debug-js/debug@4.3.5...4.3.6

4.3.5

Patch

cac39b1c5b018b0fe93a53a05f084eee543d17f5 Fix/debug depth (#926)

Thank you @calvintwr for the fix.

4.3.4

What's Changed

Add section about configuring JS console to show debug messages by @gitname in debug-js/debug#866

Replace deprecated String.prototype.substr() by @CommanderRoot in debug-js/debug#876

New Contributors

@gitname made their first contribution in

… updates Bumps the npm_and_yarn group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [express](https://github.com/expressjs/express) | `4.18.2` | `4.20.0` | | [cross-fetch](https://github.com/lquixada/cross-fetch) | `3.1.4` | `3.1.5` | | [debug](https://github.com/debug-js/debug) | `4.1.1` | `4.4.0` | | [@types/debug](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/debug) | `4.1.5` | `4.1.12` | | [handlebars](https://github.com/handlebars-lang/handlebars.js) | `4.7.6` | `4.7.7` | | [json5](https://github.com/json5/json5) | `2.2.0` | `2.2.2` | | [sqlite3](https://github.com/TryGhost/node-sqlite3) | `5.1.1` | `5.1.5` | | [ws](https://github.com/websockets/ws) | `8.11.0` | `8.17.1` | | [yaml](https://github.com/eemeli/yaml) | `2.1.3` | `2.2.2` | | [webpack](https://github.com/webpack/webpack) | `4.41.2` | `4.41.3` | Bumps the npm_and_yarn group with 4 updates in the /packages/vckit-oa-renderers directory: [debug](https://github.com/debug-js/debug), [@types/debug](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/debug), [handlebars](https://github.com/handlebars-lang/handlebars.js) and [webpack](https://github.com/webpack/webpack). Updates `express` from 4.18.2 to 4.20.0 - [Release notes](https://github.com/expressjs/express/releases) - [Changelog](https://github.com/expressjs/express/blob/master/History.md) - [Commits](expressjs/express@4.18.2...4.20.0) Updates `cross-fetch` from 3.1.4 to 3.1.5 - [Release notes](https://github.com/lquixada/cross-fetch/releases) - [Changelog](https://github.com/lquixada/cross-fetch/blob/v4.x/CHANGELOG.md) - [Commits](lquixada/cross-fetch@v3.1.4...v3.1.5) Updates `debug` from 4.1.1 to 4.4.0 - [Release notes](https://github.com/debug-js/debug/releases) - [Commits](debug-js/debug@4.1.1...4.4.0) Updates `@types/debug` from 4.1.5 to 4.1.12 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/debug) Updates `handlebars` from 4.7.6 to 4.7.7 - [Release notes](https://github.com/handlebars-lang/handlebars.js/releases) - [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/master/release-notes.md) - [Commits](handlebars-lang/handlebars.js@v4.7.6...v4.7.7) Updates `json5` from 2.2.0 to 2.2.2 - [Release notes](https://github.com/json5/json5/releases) - [Changelog](https://github.com/json5/json5/blob/main/CHANGELOG.md) - [Commits](json5/json5@v2.2.0...v2.2.2) Updates `sqlite3` from 5.1.1 to 5.1.5 - [Release notes](https://github.com/TryGhost/node-sqlite3/releases) - [Commits](TryGhost/node-sqlite3@v5.1.1...v5.1.5) Updates `ws` from 8.11.0 to 8.17.1 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.11.0...8.17.1) Updates `yaml` from 2.1.3 to 2.2.2 - [Release notes](https://github.com/eemeli/yaml/releases) - [Commits](eemeli/yaml@v2.1.3...v2.2.2) Updates `webpack` from 4.41.2 to 4.41.3 - [Release notes](https://github.com/webpack/webpack/releases) - [Commits](webpack/webpack@v4.41.2...v4.41.3) Updates `body-parser` from 1.20.1 to 1.20.3 - [Release notes](https://github.com/expressjs/body-parser/releases) - [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md) - [Commits](expressjs/body-parser@1.20.1...1.20.3) Updates `cookie` from 0.5.0 to 0.6.0 - [Release notes](https://github.com/jshttp/cookie/releases) - [Changelog](https://github.com/jshttp/cookie/blob/v0.6.0/HISTORY.md) - [Commits](jshttp/cookie@v0.5.0...v0.6.0) Updates `node-fetch` from 2.6.1 to 2.6.7 - [Release notes](https://github.com/node-fetch/node-fetch/releases) - [Commits](node-fetch/node-fetch@v2.6.1...v2.6.7) Updates `path-to-regexp` from 0.1.7 to 0.1.10 - [Release notes](https://github.com/pillarjs/path-to-regexp/releases) - [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md) - [Commits](pillarjs/path-to-regexp@v0.1.7...v0.1.10) Updates `serve-static` from 1.15.0 to 1.16.0 - [Release notes](https://github.com/expressjs/serve-static/releases) - [Changelog](https://github.com/expressjs/serve-static/blob/master/HISTORY.md) - [Commits](expressjs/serve-static@v1.15.0...1.16.0) Updates `tar` from 6.2.0 to 6.2.1 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v6.2.0...v6.2.1) Updates `debug` from 4.1.1 to 4.4.0 - [Release notes](https://github.com/debug-js/debug/releases) - [Commits](debug-js/debug@4.1.1...4.4.0) Updates `@types/debug` from 4.1.5 to 4.1.12 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/debug) Updates `handlebars` from 4.7.6 to 4.7.7 - [Release notes](https://github.com/handlebars-lang/handlebars.js/releases) - [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/master/release-notes.md) - [Commits](handlebars-lang/handlebars.js@v4.7.6...v4.7.7) Updates `webpack` from 4.41.2 to 4.41.3 - [Release notes](https://github.com/webpack/webpack/releases) - [Commits](webpack/webpack@v4.41.2...v4.41.3) --- updated-dependencies: - dependency-name: express dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: cross-fetch dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: debug dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@types/debug" dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: handlebars dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: json5 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: sqlite3 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: ws dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: yaml dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: webpack dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: body-parser dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: cookie dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: node-fetch dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: path-to-regexp dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: serve-static dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tar dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: debug dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@types/debug" dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: handlebars dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: webpack dependency-type: direct:development dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot bot added the dependencies Pull requests that update a dependency file label Feb 4, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build(deps): bump the npm_and_yarn group across 2 directories with 16 updates #96

build(deps): bump the npm_and_yarn group across 2 directories with 16 updates #96

dependabot bot commented on behalf of github Feb 4, 2025

build(deps): bump the npm_and_yarn group across 2 directories with 16 updates #96

Are you sure you want to change the base?

build(deps): bump the npm_and_yarn group across 2 directories with 16 updates #96

Conversation

dependabot bot commented on behalf of github Feb 4, 2025

4.20.0

What's Changed

Important

Other Changes

New Contributors

4.20.0 / 2024-09-10

4.19.2 / 2024-03-25

4.19.1 / 2024-03-20

4.19.0 / 2024-03-20

4.18.3 / 2024-02-29

v3.1.5

What's Changed

New Contributors

4.4.0

4.3.7

What's Changed

4.3.6

What's Changed

New Contributors

4.3.5

Patch

4.3.4

What's Changed

New Contributors

4.3.3

Patch Release 4.3.3

v4.7.7 - February 15th, 2021

v2.2.2

v2.2.1

v2.2.2 [code, diff]

v2.2.1 [code, diff]

v5.1.5

What's Changed

v5.1.4

What's Changed

v5.1.3

What's Changed

v5.1.2

What's Changed

8.17.1

Bug fixes

v2.2.2

v2.2.1

v2.2.0

New Features

Bugfixes

1.20.3

What's Changed

Important

Other changes

New Contributors

1.20.2

1.20.3 / 2024-09-10

1.20.2 / 2023-02-21

0.6.0

0.6.0 / 2023-11-06

v2.6.7

Security patch release

What's Changed

v2.6.6

What's Changed

v2.6.2

Backtrack protection

Support non-lookahead regex output

Support named matching groups in RegExp

1.16.0

What's Changed

New Contributors

1.16.0 / 2024-09-10

4.4.0

4.3.7

What's Changed

4.3.6

What's Changed

New Contributors

Support named matching groups in `RegExp`