chore(deps): bump the npm_and_yarn group across 4 directories with 11 updates by dependabot[bot] · Pull Request #2140 · a2ui-project/a2ui

dependabot · 2026-07-31T19:54:27Z

Bumps the npm_and_yarn group with 10 updates in the / directory:

Package	From	To
@vitest/browser	`4.1.8`	`4.1.10`
dompurify	`3.4.11`	`3.4.12`
hono	`4.12.25`	`4.12.27`
next	`16.2.9`	`16.2.11`
@hono/node-server	`1.19.14`	`1.19.17`
body-parser	`1.20.4`	`1.20.6`
brace-expansion	`1.1.16`	`1.1.18`
fast-uri	`3.1.2`	`3.1.5`
immutable	`5.1.5`	`5.1.9`
linkify-it	`5.0.1`	`5.0.2`

Bumps the npm_and_yarn group with 1 update in the /renderers/markdown/markdown-it directory: dompurify.
Bumps the npm_and_yarn group with 9 updates in the /samples/community directory:

Package	From	To
dompurify	`3.4.11`	`3.4.12`
hono	`4.12.25`	`4.12.33`
@hono/node-server	`1.19.14`	`1.19.17`
body-parser	`2.2.2`	`2.3.0`
brace-expansion	`1.1.16`	`1.1.18`
fast-uri	`3.1.2`	`3.1.5`
immutable	`5.1.6`	`5.1.9`
linkify-it	`5.0.1`	`5.0.2`
postcss	`8.5.15`	`8.5.25`

Bumps the npm_and_yarn group with 1 update in the /tools/composer directory: next.

Updates @vitest/browser from 4.1.8 to 4.1.10

Release notes

Sourced from @vitest/browser's releases.

v4.1.10

🐞 Bug Fixes

browser: Check fs access in builtin commands [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in vitest-dev/vitest#10680 (5c18d)

vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4] - by @SveLil and @hi-ogawa in vitest-dev/vitest#10661 (bae52)

View changes on GitHub

v4.1.9

🐞 Bug Fixes

Fix importOriginal with optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in vitest-dev/vitest#10546 (a5180)

browser:

Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10555 (7fb29)

Wait for iframe tester readiness before preparing [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10497 and vitest-dev/vitest#10556 (fbc62)

mocker:

Hoist vi.mock() for vite-plus/test imports [backport to v4] - by Hiroshi Ogawa, LongYinan, Claude Opus 4.8 and Vladimir in vitest-dev/vitest#10548 (2c955)

pool:

Prevent test run hang on worker crash [backport to v4] - by Ari Perkkiö and Jattioui Ismail in vitest-dev/vitest#10543 and vitest-dev/vitest#10564 (934b0)

View changes on GitHub

Commits

db616d2 chore: release v4.1.10 (#10718)
5c18dd2 fix(browser): check fs access in builtin commands [backport to v4] (#10680)
a7a61e7 chore: release v4.1.9 (#10598)
fbc626c fix(browser): wait for iframe tester readiness before preparing (#10497) [bac...
7fb2965 fix(browser): wait for orchestrator readiness before resolving browser sessio...
See full diff in compare view

Updates dompurify from 3.4.11 to 3.4.12

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.12

Fixed an issue where a hook would not get called for custom elements, thanks @Rikuxx0

Hardened the handling of hooks removing elements, @mkrause-bee360

Added support for a few new SVG attributes, thanks @cbn-falias & @Develop-KIM

Hardened the handling of declarative partial updates

Updated the documentation is several spots, README, wiki, etc.

Bumped several dependencies where possible

Commits

a9ca1e5 release: 3.4.12 (#1537)
See full diff in compare view

Updates hono from 4.12.25 to 4.12.27

Release notes

Sourced from hono's releases.

v4.12.27

Security fixes

This release includes fixes for the following security issues:

hono/jsx does not isolate context per request

Affects: hono/jsx, hono/jsx-renderer. During SSR, context was stored process-wide instead of per request, so useContext()/useRequestContext() read after an await in an async component could return another concurrent request's value — leading to cross-request data disclosure or authorization checks against the wrong request. GHSA-hvrm-45r6-mjfj

Server-Side XSS via JSX escaping bypass in cx()

Affects: hono/css. cx() marked its composed class name as already-escaped without escaping the input, so untrusted input passed as a class name could break out of the JSX class attribute during SSR and inject markup (XSS). GHSA-w62v-xxxg-mg59

API Gateway v1 adapter can drop a repeated request header value

Affects: hono/aws-lambda. The API Gateway v1 (and VPC Lattice) adapter de-duplicated repeated header values by substring instead of exact match, dropping a value that is a substring of another (e.g. 203.0.113.1 dropped when 203.0.113.10 is present) — affecting logic such as X-Forwarded-For-based IP restriction. GHSA-xgm2-5f3f-mvvc

Users of hono/jsx/hono/jsx-renderer, hono/css (cx()), or the hono/aws-lambda API Gateway v1 / VPC Lattice adapters are encouraged to upgrade.

v4.12.26

What's Changed

fix(lambda-edge): satisfy Deno lib types for Content-Length body encoding by @yusukebe in honojs/hono#5013

ci: publish to npm from CI with OIDC trusted publishing by @yusukebe in honojs/hono#5028

chore: remove unused devcontainer and gitpod configs by @yusukebe in honojs/hono#5029

chore: replace arg and glob with Bun native APIs in build script by @yusukebe in honojs/hono#5030

Full Changelog: honojs/hono@v4.12.25...v4.12.26

Commits

97c6fe1 4.12.27
aa92177 Merge commit from fork
cd3f6f7 Merge commit from fork
d4853a8 fix(jsx): make merged context-isolation tests pass tsc type check (#5037)
6735fea fix(jsx): cast awaitedFallback through unknown to fix Deno type check (#5036)
fab3b13 Merge commit from fork
9f0dadf ci: use npm Staged publishing (#5035)
27b7992 4.12.26
d29982c chore: replace arg and glob with Bun native APIs in build script
16215d5 chore: remove unused devcontainer and gitpod configs (#5029)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for hono since your current version.

Updates next from 16.2.9 to 16.2.11

Release notes

Sourced from next's releases.

v16.2.11

This release contains security fixes for the following advisories:

High:

Denial of Service in App Router using Server Actions

Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Server-Side Request Forgery in Server Actions on custom servers

Moderate:

Cache confusion of response bodies for requests with bodies

Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

Denial of Service in the Image Optimization API using SVGs

Unauthenticated disclosure of internal Server Function endpoints

Unbounded Server Action payload in Edge runtime

v16.2.10

Contains no changes except publishing @next/swc-wasm-web which was accidentally not published since 16.2.4.

Commits

9beca08 v16.2.11
3c48c7a [16.x] Fix Turbopack middleware matcher with i18n single locale
ac1eff3 [16.x] Improve performance of checking valid MPA form submissions
9a4651e [16.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
b512063 [16.x] Set correct origin for internal redirects in custom server
d303326 [16.x] Ensure exotic rewrite param values are properly encoded
73b9487 [16.x] fix(fetch-cache): key fetch(Request, init) by the effective request
bf9d17f [16.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies
fe28768 [16.x] fix(next/image): improve performance of detectContentType()
d8afb8d [16.x] Performance improvements when decoding React Server function payloads
Additional commits viewable in compare view

Updates @hono/node-server from 1.19.14 to 1.19.17

Commits

71941da 1.19.17
0208500 ci: add stage option for publishing (#386)
cbdf713 1.19.16
86e96c2 ci: add an action for trusted publisher (#385)
99c1a1a ci: run on v1.x branch pushes
84cb2ee Merge commit from fork
See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @hono/node-server since your current version.

Updates body-parser from 1.20.4 to 1.20.6

Release notes

Sourced from body-parser's releases.

1.20.6

Important: Security

Security fix for CVE-2026-12590 (GHSA-v422-hmwv-36x6)

What's Changed

fix: improve limit option validation by @Phillip9587 in expressjs/body-parser#741

Full Changelog: expressjs/body-parser@1.20.5...1.20.6

v1.20.5

What's Changed

The reason for this release is a fix to the extended urlencoded parser returning objects instead of arrays for large array inputs (> 100) on qs@6.14.2+. (expressjs/body-parser#716)

refactor(json): simplify strict mode error string construction by @jonchurch in expressjs/body-parser#692

fix: correct off-by-one error in parameterCount by @abhu85 in expressjs/body-parser#716

deps(qs): bump qs to 6.15.1 by @jonchurch in expressjs/body-parser#722

Release: 1.20.5 by @jonchurch in expressjs/body-parser#721

New Contributors

@abhu85 made their first contribution in expressjs/body-parser#716

Special thanks to triager @krzysdz for keeping this on our radar and effectively triaging the specific issue!

Full Changelog: expressjs/body-parser@1.20.4...1.20.5

Changelog

Sourced from body-parser's changelog.

1.20.6 / 2026-07-09

Security fix for GHSA-v422-hmwv-36x6

fix: improve limit option validation (#698)

Invalid limit values (e.g. unparseable strings or NaN) now throw instead of being silently ignored, which previously disabled size limit enforcement

null and undefined fall back to the default 100kb limit

1.20.5 / 2026-04-24

refactor(json): simplify strict mode error string construction

fix: extended urlencoded parsing of arrays with >100 elements (#716)

deps: qs@~6.15.1

Commits

5cc4fb8 1.20.6 (#746)
3492672 fix: improve limit option validation (#741)
0defdbe release(patch): 1.20.5
cd0e7a0 deps(qs): bump qs to 6.15.1
6f24d7e fix: correct off-by-one error in parameterCount (#716)
b849bd5 deps: qs@~6.14.1 (#690)
2c55e2f refactor(json): simplify strict mode error string construction (#692)
See full diff in compare view

Updates brace-expansion from 1.1.16 to 1.1.18

Commits

See full diff in compare view

Updates fast-uri from 3.1.2 to 3.1.5

Release notes

Sourced from fast-uri's releases.

v3.1.5

⚠️ Security Warning

Fix for GHSA-7p8r-x3mc-p8w7

Full Changelog: fastify/fast-uri@v3.1.4...v3.1.5

v3.1.4

⚠️ Security Release

Fix for GHSA-v2hh-gcrm-f6hx

Full Changelog: fastify/fast-uri@v3.1.3...v3.1.4

v3.1.3

⚠️ Security Release

Fixes: GHSA-4c8g-83qw-93j6

Full Changelog: fastify/fast-uri@v3.1.2...v3.1.3

Commits

5e179cb Bumped v3.1.5
2cad02d Merge commit from fork
6aeece6 Bumped v3.1.4
2d50fba fix: reject literal backslash in URI authority
0549fe3 Bumped v3.1.3
2a6d357 Merge commit from fork
See full diff in compare view

Updates immutable from 5.1.5 to 5.1.9

Release notes

Sourced from immutable's releases.

v5.1.9

What's Changed

fix(List): preserve undefined values when grown past 32 elements by @spokodev / @jdeniau in immutable-js/immutable-js#2235 (originated from immutable-js/immutable-js#2230 )

Full Changelog: immutable-js/immutable-js@v5.1.8...v5.1.9

v5.1.8

What's Changed

fix(List): guard oversized bounds in setListBounds. Fixes CVE GHSA-v56q-mh7h-f735

perf(Map): index large hash-collision buckets for faster lookups. Fixes CVE GHSA-xvcm-6775-5m9r

Full Changelog: immutable-js/immutable-js@v5.1.7...v5.1.8

v5.1.7

What's Changed

fix(Repeat): lastIndexOf returned size instead of size - 1 by @chatman-media in immutable-js/immutable-js#2227

internal

Backport tests from 6.x branch by @jdeniau in immutable-js/immutable-js#2199

fix(IndexedCollection): has(index) on a lazy Seq of unknown size now checks index existence instead of searching for a value equal to the index by @jdeniau in immutable-js/immutable-js#2203

Better type for reduce if not ininitial value is given by @jdeniau in immutable-js/immutable-js#2205

Backport test from #2193 by @jdeniau in immutable-js/immutable-js#2207

backport tests from 6.x by @jdeniau in immutable-js/immutable-js#2213

Firefox link to non-French page by @jdeniau in immutable-js/immutable-js#2219

Bump esbuild and @size-limit/preset-small-lib by @dependabot[bot] in immutable-js/immutable-js#2217

backport tests from #2210 by @jdeniau in immutable-js/immutable-js#2214

Bump shell-quote from 1.8.2 to 1.8.4 by @dependabot[bot] in immutable-js/immutable-js#2211

Bump @tootallnate/once from 2.0.0 to 2.0.1 by @dependabot[bot] in immutable-js/immutable-js#2190

Bump minimatch from 9.0.5 to 9.0.9 by @dependabot[bot] in immutable-js/immutable-js#2189

Bump @codemirror/theme-one-dark from 6.1.2 to 6.1.3 by @dependabot[bot] in immutable-js/immutable-js#2168

Bump form-data from 4.0.5 to 4.0.6 by @dependabot[bot] in immutable-js/immutable-js#2220

Bump typescript-eslint from 8.33.0 to 8.61.1 by @dependabot[bot] in immutable-js/immutable-js#2222

Bump @rollup/plugin-commonjs from 28.0.2 to 29.0.3 by @dependabot[bot] in immutable-js/immutable-js#2224

New Contributors

@chatman-media made their first contribution in immutable-js/immutable-js#2227

Full Changelog: immutable-js/immutable-js@v5.1.6...v5.1.7

v5.1.6

What's Changed

fix(reverseFactory): read reversedSequence.size in __iterator instead of this by @jdeniau in immutable-js/immutable-js#2196

... (truncated)

Changelog

Sourced from immutable's changelog.

5.1.9

fix(List): a List grown past 32 elements while all its values are undefined no longer reads those values back as null (affected get, iteration, toArray, equals and hashCode)

5.1.8

fix(List): guard oversized bounds in setListBounds. Fixes CVE GHSA-v56q-mh7h-f735

perf(Map): index large hash-collision buckets for faster lookups. Fixes CVE GHSA-xvcm-6775-5m9r

4.3.9

fix(List): guard oversized bounds in setListBounds. Fixes CVE GHSA-v56q-mh7h-f735

perf(Map): index large hash-collision buckets for faster lookups. Fixes CVE GHSA-xvcm-6775-5m9r

5.1.7

fix(Repeat): lastIndexOf returned size instead of size - 1 by @chatman-media in immutable-js/immutable-js#2227. Fixes CVE CVE-2026-29063

fix(IndexedCollection): has(index) on a lazy Seq of unknown size now checks index existence instead of searching for a value equal to the index #2203

[TypeScript]: reduce/reduceRight without an initial value now infer the result type from the collection's values when the reducer returns a value (e.g. list.reduce((a, b) => a + b) infers number), matching Array#reduce. Previously an explicit type argument was required. #2205

5.1.6

fix(reverseFactory): read reversedSequence.size in __iterator instead of this #2196

Commits

329f7a6 5.1.9
21fabd9 changelog
009164f Merge pull request #2235 from immutable-js/fix/avoid-null-when-setsize33
5b65bfb fix(List): preserve undefined values when grown past 32 elements
50bf39e Update CHANGELOG.md for versions 5.1.8 and 4.3.9
6496539 5.1.8
808a83a Merge commit from fork
e51d49f perf(Map): index large hash-collision buckets for faster lookups
25c58b0 fix typescript in tests
a1a1ee4 Merge commit from fork
Additional commits viewable in compare view

Updates linkify-it from 5.0.1 to 5.0.2

Changelog

Sourced from linkify-it's changelog.

5.0.2 / 2026-07-02

Fixed DoS in mailto: links (restrict user name to 64 chars).

Restricted user/pass part length in links.

Commits

50a0c91 5.0.2 released
de3b885 Update package hooks
13effaa Add package lock
39d748d Bump c8
00ce877 Drop tlds deps
ecde823 Update benchmark to mitata
23c62cd Refactor demo / doc build and publish
fd63f3b CI config update
f4ea5af demo: update bootstrap & layout
1454fb6 lint: dim warnings
Additional commits viewable in compare view

Updates dompurify from 3.4.11 to 3.4.12

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.12

Fixed an issue where a hook would not get called for custom elements, thanks @Rikuxx0

Hardened the handling of hooks removing elements, @mkrause-bee360

Added support for a few new SVG attributes, thanks @cbn-falias & @Develop-KIM

Hardened the handling of declarative partial updates

Updated the documentation is several spots, README, wiki, etc.

Bumped several dependencies where possible

Commits

a9ca1e5 release: 3.4.12 (#1537)
See full diff in compare view

Updates dompurify from 3.4.11 to 3.4.12

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.12

Fixed an issue where a hook would not get called for custom elements, thanks @Rikuxx0

Hardened the handling of hooks removing elements, @mkrause-bee360

Added support for a few new SVG attributes, thanks @cbn-falias & @Develop-KIM

Hardened the handling of declarative partial updates

Updated the documentation is several spots, README, wiki, etc.

Bumped several dependencies where possible

Commits

a9ca1e5 release: 3.4.12 (#1537)
See full diff in compare view

Updates hono from 4.12.25 to 4.12.33

Release notes

Sourced from hono's releases.

v4.12.27

Security fixes

This release includes fixes for the following security issues:

hono/jsx does not isolate context per request

Affects: hono/jsx, hono/jsx-renderer. During SSR, context was stored process-wide instead of per request, so useContext()/useRequestContext() read after an await in an async component could return another concurrent request's value — leading to cross-request data disclosure or authorization checks against the wrong request. GHSA-hvrm-45r6-mjfj

Server-Side XSS via JSX escaping bypass in cx()

Affects: hono/css. cx() marked its composed class name as already-escaped without escaping the input, so untrusted input passed as a class name could break out of the JSX class attribute during SSR and inject markup (XSS). GHSA-w62v-xxxg-mg59

API Gateway v1 adapter can drop a repeated request header value

Affects: hono/aws-lambda. The API Gateway v1 (and VPC Lattice) adapter de-duplicated repeated header values by substring instead of exact match, dropping a value that is a substring of another (e.g. 203.0.113.1 dropped when 203.0.113.10 is present) — affecting logic such as X-Forwarded-For-based IP restriction. GHSA-xgm2-5f3f-mvvc

Users of hono/jsx/hono/jsx-renderer, hono/css (cx()), or the hono/aws-lambda API Gateway v1 / VPC Lattice adapters are encouraged to upgrade.

v4.12.26

What's Changed

fix(lambda-edge): satisfy Deno lib types for Content-Length body encoding by @yusukebe in honojs/hono#5013

ci: publish to npm from CI with OIDC trusted publishing by @yusukebe in honojs/hono#5028

chore: remove unused devcontainer and gitpod configs by @yusukebe in honojs/hono#5029

chore: replace arg and glob with Bun native APIs in build script by @yusukebe in honojs/hono#5030

Full Changelog: honojs/hono@v4.12.25...v4.12.26

Commits

97c6fe1 4.12.27
aa92177 Merge commit from fork
cd3f6f7 Merge commit from fork
d4853a8 fix(jsx): make merged context-isolation tests pass tsc type check (#5037)
6735fea fix(jsx): cast awaitedFallback through unknown to fix Deno type check (#5036)
fab3b13 Merge commit from fork
9f0dadf ci: use npm Staged publishing (#5035)
27b7992 4.12.26
d29982c chore: replace arg and glob with Bun native APIs in build script
16215d5 chore: remove unused devcontainer and gitpod configs (#5029)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for hono since your current version.

Updates @hono/node-server from 1.19.14 to 1.19.17

Commits

71941da 1.19.17
0208500 ci: add stage option for publishing (#386)
cbdf713 1.19.16
86e96c2 ci: add an action for trusted publisher (#385)
99c1a1a ci: run on v1.x branch pushes
84cb2ee Merge commit from fork
See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @hono/node-server since your current version.

Updates body-parser from 2.2.2 to 2.3.0

Release notes

Sourced from body-parser's releases.

1.20.6

Important: Security

Security fix for CVE-2026-12590 (GHSA-v422-hmwv-36x6)

What's Changed

fix: improve limit option validation by @Phillip9587 in expressjs/body-parser#741

Full Changelog: expressjs/body-parser@1.20.5...1.20.6

v1.20.5

What's Changed

The reason for this release is a fix to the extended urlencoded parser returning objects instead of arrays for large array inputs (> 100) on qs@6.14.2+. (expressjs/body-parser#716)

refactor(json): simplify strict mode error string construction by @jonchurch in expressjs/body-parser#692

fix: correct off-by-one error in parameterCount by @abhu85 in expressjs/body-parser#716

deps(qs): bump qs to 6.15.1 by @jonchurch in expressjs/body-parser#722

Release: 1.20.5 by @jonchurch in expressjs/body-parser#721

New Contributors

@abhu85 made their first contribution in expressjs/body-parser#716

Special thanks to triager @krzysdz for keeping this on our radar and effectively triaging the specific issue!

Full Changelog: expressjs/body-parser@1.20.4...1.20.5

Changelog

Sourced from body-parser's changelog.

1.20.6 / 2026-07-09

Security fix for GHSA-v422-hmwv-36x6

fix: improve limit option validation (#698)

Invalid limit values (e.g. unparseable strings or NaN) now throw instead of being silently ignored, which previously disabled size limit enforcement

null and undefined fall back to the default 100kb limit

1.20.5 / 2026-04-24

refactor(json): simplify strict mode error string construction

fix: extended urlencoded parsing of arrays with >100 elements (#716)

deps: qs@~6.15.1

Commits

5cc4fb8 1.20.6 (#746)
3492672 fix: improve limit option validation (#741)
0defdbe release(patch): 1.20.5
cd0e7a0 deps(qs): bump qs to 6.15.1
6f24d7e fix: correct off-by-one error in parameterCount (#716)
b849bd5 deps: qs@~6.14.1 (#690)
2c55e2f refactor(json): simplify strict mode error string construction (#692)
See full diff in compare view

Updates brace-expansion from 1.1.16 to 1.1.18

Commits

See full diff in compare view

Updates fast-uri from 3.1.2 to 3.1.5

Release notes

Sourced from fast-uri's releases.

v3.1.5

⚠️ Security Warning

Fix for GHSA-7p8r-x3mc-p8w7

Full Changelog: fastify/fast-uri@v3.1.4...v3.1.5

v3.1.4

⚠️ Security Release

Fix for GHSA-v2hh-gcrm-f6hx

Full Changelog: fastify/fast-uri@v3.1.3...v3.1.4

v3.1.3

⚠️ Security Release

Fixes: GHSA-4c8g-83qw-93j6

Full Changelog: fastify/fast-uri@v3.1.2...v3.1.3

Commits

5e179cb Bumped v3.1.5
2cad02d Merge commit from fork
6aeece6 Bumped v3.1.4
2d50fba fix: reject literal backslash in URI authority
0549fe3 Bumped v3.1.3
2a6d357 Merge commit from fork
See full diff in compare view

Updates immutable from 5.1.6 to 5.1.9

Release notes

Sourced from immutable's releases.

v5.1.9

What's Changed

fix(List): preserve undefined values when grown past 32 elements by @spokodev / @jdeniau in immutable-js/immutable-js#2235 (originated from immutable-js/immutable-js#2230 )

Full Changelog: immutable-js/immutable-js@v5.1.8...v5.1.9

v5.1.8

What's Changed

fix(List): guard oversized bounds in setListBounds. Fixes CVE GHSA-v56q-mh7h-f735

perf(Map): index large hash-collision buckets for faster lookups. Fixes CVE GHSA-xvcm-6775-5m9r

Full Changelog: immutable-js/immutable-js@v5.1.7...v5.1.8

v5.1.7

What's Changed

fix(Repeat): lastIndexOf returned size instead of size - 1 by @chatman-media in immutable-js/immutable-js#2227

internal

Backport tests from 6.x branch by @jdeniau in immutable-js/immutable-js#2199

fix(IndexedCollection): has(index) on a lazy Seq of unknown size now checks index existence instead of searching for a value equal to the index by @jdeniau in immutable-js/immutable-js#2203

Better type for reduce if not ininitial value is given by @jdeniau in immutable-js/immutable-js#2205

Backport test from #2193 by @jdeniau in immutable-js/immutable-js#2207

backport tests from 6.x by @jdeniau in immutable-js/immutable-js#2213

Firefox link to non-French page by @jdeniau in immutable-js/immutable-js#2219

Bump esbuild and @size-limit/preset-small-lib by @dependabot[bot] in immutable-js/immutable-js#2217

backport tests from #2210 by @jdeniau in immutable-js/immutable-js#2214

Bump shell-quote from 1.8.2 to 1.8.4 by @dependabot[bot] in immutable-js/immutable-js#2211

Bump @tootallnate/once from 2.0.0 to 2.0.1 by @dependabot[bot] in immutable-js/immutable-js#2190

Bump minimatch from 9.0.5 to 9.0.9 by @dependabot[bot] in immutable-js/immutable-js#2189

Bump @codemirror/theme-one-dark from 6.1.2 to 6.1.3 by @dependabot[bot] in immutable-js/immutable-js#2168

Bump form-data from 4.0.5 to 4.0.6 by @dependabot[bot] in immutable-js/immutable-js#2220

Bump typescript-eslint from 8.33.0 to 8.61.1 by @dependabot[bot] in immutable-js/immutable-js#2222

Bump @rollup/plugin-commonjs from 28.0.2 to 29.0.3 by @dependabot[bo...
Description has been truncated

… updates Bumps the npm_and_yarn group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@vitest/browser](https://github.com/vitest-dev/vitest/tree/HEAD/packages/browser) | `4.1.8` | `4.1.10` | | [dompurify](https://github.com/cure53/DOMPurify) | `3.4.11` | `3.4.12` | | [hono](https://github.com/honojs/hono) | `4.12.25` | `4.12.27` | | [next](https://github.com/vercel/next.js) | `16.2.9` | `16.2.11` | | [@hono/node-server](https://github.com/honojs/node-server) | `1.19.14` | `1.19.17` | | [body-parser](https://github.com/expressjs/body-parser) | `1.20.4` | `1.20.6` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.16` | `1.1.18` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.1.2` | `3.1.5` | | [immutable](https://github.com/immutable-js/immutable-js) | `5.1.5` | `5.1.9` | | [linkify-it](https://github.com/markdown-it/linkify-it) | `5.0.1` | `5.0.2` | Bumps the npm_and_yarn group with 1 update in the /renderers/markdown/markdown-it directory: [dompurify](https://github.com/cure53/DOMPurify). Bumps the npm_and_yarn group with 9 updates in the /samples/community directory: | Package | From | To | | --- | --- | --- | | [dompurify](https://github.com/cure53/DOMPurify) | `3.4.11` | `3.4.12` | | [hono](https://github.com/honojs/hono) | `4.12.25` | `4.12.33` | | [@hono/node-server](https://github.com/honojs/node-server) | `1.19.14` | `1.19.17` | | [body-parser](https://github.com/expressjs/body-parser) | `2.2.2` | `2.3.0` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.16` | `1.1.18` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.1.2` | `3.1.5` | | [immutable](https://github.com/immutable-js/immutable-js) | `5.1.6` | `5.1.9` | | [linkify-it](https://github.com/markdown-it/linkify-it) | `5.0.1` | `5.0.2` | | [postcss](https://github.com/postcss/postcss) | `8.5.15` | `8.5.25` | Bumps the npm_and_yarn group with 1 update in the /tools/composer directory: [next](https://github.com/vercel/next.js). Updates `@vitest/browser` from 4.1.8 to 4.1.10 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/browser) Updates `dompurify` from 3.4.11 to 3.4.12 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.4.11...3.4.12) Updates `hono` from 4.12.25 to 4.12.27 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.25...v4.12.27) Updates `next` from 16.2.9 to 16.2.11 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.2.9...v16.2.11) Updates `@hono/node-server` from 1.19.14 to 1.19.17 - [Release notes](https://github.com/honojs/node-server/releases) - [Commits](honojs/node-server@v1.19.14...v1.19.17) Updates `body-parser` from 1.20.4 to 1.20.6 - [Release notes](https://github.com/expressjs/body-parser/releases) - [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md) - [Commits](expressjs/body-parser@1.20.4...1.20.6) Updates `brace-expansion` from 1.1.16 to 1.1.18 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](https://github.com/juliangruber/brace-expansion/commits) Updates `fast-uri` from 3.1.2 to 3.1.5 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.2...v3.1.5) Updates `immutable` from 5.1.5 to 5.1.9 - [Release notes](https://github.com/immutable-js/immutable-js/releases) - [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md) - [Commits](immutable-js/immutable-js@v5.1.5...v5.1.9) Updates `linkify-it` from 5.0.1 to 5.0.2 - [Changelog](https://github.com/markdown-it/linkify-it/blob/master/CHANGELOG.md) - [Commits](markdown-it/linkify-it@5.0.1...5.0.2) Updates `dompurify` from 3.4.11 to 3.4.12 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.4.11...3.4.12) Updates `dompurify` from 3.4.11 to 3.4.12 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.4.11...3.4.12) Updates `hono` from 4.12.25 to 4.12.33 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.25...v4.12.27) Updates `@hono/node-server` from 1.19.14 to 1.19.17 - [Release notes](https://github.com/honojs/node-server/releases) - [Commits](honojs/node-server@v1.19.14...v1.19.17) Updates `body-parser` from 2.2.2 to 2.3.0 - [Release notes](https://github.com/expressjs/body-parser/releases) - [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md) - [Commits](expressjs/body-parser@1.20.4...1.20.6) Updates `brace-expansion` from 1.1.16 to 1.1.18 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](https://github.com/juliangruber/brace-expansion/commits) Updates `fast-uri` from 3.1.2 to 3.1.5 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.2...v3.1.5) Updates `immutable` from 5.1.6 to 5.1.9 - [Release notes](https://github.com/immutable-js/immutable-js/releases) - [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md) - [Commits](immutable-js/immutable-js@v5.1.5...v5.1.9) Updates `linkify-it` from 5.0.1 to 5.0.2 - [Changelog](https://github.com/markdown-it/linkify-it/blob/master/CHANGELOG.md) - [Commits](markdown-it/linkify-it@5.0.1...5.0.2) Updates `postcss` from 8.5.15 to 8.5.25 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.15...8.5.25) Updates `next` from 16.2.9 to 16.2.11 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.2.9...v16.2.11) --- updated-dependencies: - dependency-name: "@vitest/browser" dependency-version: 4.1.10 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: dompurify dependency-version: 3.4.12 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.12.27 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 16.2.11 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@hono/node-server" dependency-version: 1.19.17 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: body-parser dependency-version: 1.20.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.18 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: immutable dependency-version: 5.1.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: linkify-it dependency-version: 5.0.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: dompurify dependency-version: 3.4.12 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: dompurify dependency-version: 3.4.12 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.12.33 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@hono/node-server" dependency-version: 1.19.17 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: body-parser dependency-version: 2.3.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.18 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: immutable dependency-version: 5.1.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: linkify-it dependency-version: 5.0.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.25 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: next dependency-version: 16.2.11 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-08-03T15:14:02Z

Superseded by #2154.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 31, 2026

github-project-automation Bot moved this to Todo in A2UI Jul 31, 2026

github-project-automation Bot added this to A2UI Jul 31, 2026

dependabot Bot closed this Aug 3, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/npm_and_yarn-5e3aa7b8fe branch August 3, 2026 15:14

github-project-automation Bot moved this from Todo to Done in A2UI Aug 3, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump the npm_and_yarn group across 4 directories with 11 updates - #2140

chore(deps): bump the npm_and_yarn group across 4 directories with 11 updates#2140
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-5e3aa7b8fe

dependabot Bot commented on behalf of github Jul 31, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Aug 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v4.1.10

🐞 Bug Fixes

View changes on GitHub

v4.1.9

🐞 Bug Fixes

View changes on GitHub

DOMPurify 3.4.12

v4.12.27

Security fixes

hono/jsx does not isolate context per request

Server-Side XSS via JSX escaping bypass in cx()

API Gateway v1 adapter can drop a repeated request header value

v4.12.26

What's Changed

v16.2.11

v16.2.10

1.20.6

Important: Security

What's Changed

v1.20.5

What's Changed

New Contributors

1.20.6 / 2026-07-09

1.20.5 / 2026-04-24

v3.1.5

⚠️ Security Warning

v3.1.4

⚠️ Security Release

v3.1.3

⚠️ Security Release

v5.1.9

What's Changed

v5.1.8

What's Changed

v5.1.7

What's Changed

internal

New Contributors

v5.1.6

What's Changed

5.1.9

5.1.8

4.3.9

5.1.7

5.1.6

5.0.2 / 2026-07-02

DOMPurify 3.4.12

DOMPurify 3.4.12

v4.12.27

Security fixes

hono/jsx does not isolate context per request

Server-Side XSS via JSX escaping bypass in cx()

API Gateway v1 adapter can drop a repeated request header value

v4.12.26

What's Changed

1.20.6

Important: Security

What's Changed

v1.20.5

What's Changed

New Contributors

1.20.6 / 2026-07-09

1.20.5 / 2026-04-24

v3.1.5

⚠️ Security Warning

v3.1.4

⚠️ Security Release

v3.1.3

⚠️ Security Release

v5.1.9

What's Changed

v5.1.8

What's Changed

v5.1.7

What's Changed

internal

dependabot Bot commented on behalf of github Jul 31, 2026 •

edited

Loading