Skip to content

chore(deps): bump the npm_and_yarn group across 1 directory with 10 updates - #508

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/docs/npm_and_yarn-d06b9b48c4
Open

chore(deps): bump the npm_and_yarn group across 1 directory with 10 updates#508
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/docs/npm_and_yarn-d06b9b48c4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 21, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 10 updates in the /docs directory:

Package From To
baseline-browser-mapping 2.10.10 2.11.30
browserslist 4.28.1 4.29.4
immutable 5.1.5 5.1.9
js-yaml 3.14.2 3.15.2
linkify-it 5.0.0 5.0.2
markdown-it 14.1.1 14.3.3
nanoid 3.3.11 3.3.20
postcss 8.5.14 8.5.31
source-map-js 1.2.1 1.2.2
undici 7.24.6 7.30.1

Updates baseline-browser-mapping from 2.10.10 to 2.11.30

Release notes

Sourced from baseline-browser-mapping's releases.

v2.11.0

What's Changed in 2.11.0

  • feat: Adds a new getTimeline() method for getting the series of minimum browser changes, either grouped by date or by browser.
  • refactor: Substantial refactoring of the data compression process that replaces the full list of browsers from @mdn/browser-compat-data and downstream-browsers.json and features from web-features (in their very pared down form) with a change-list timeline that reflects which versions supported Baseline (newly available) on a given date. Thanks to @​swwind for the idea!
  • refactor: Some common functions have been moved to a util.ts module for use in other scripts.
  • fix: Removes process.exit() calls when unsupported option combinations are passed to getCompatibleVersions() and getAllVersions() in favour of throwing an Error. There is a small security risk with process.exit() calls that sites accepting unsanitised inputs could be the subject of attacks. Unsupported config options now throw and Error which should allow for more graceful handling. Thanks to @​bnbdr for flagging this as vulnerability CVE-2026-45819 .

Fixes #134

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.10.44...v2.11.0

Commits
  • 65822d6 Patch to 2.11.30 because browser or feature data changed
  • c074f56 Browser or feature data changed
  • 4517bea Updating static site
  • 4352208 Updating static site
  • 091495e build(deps-dev): Bump @​humanfs/node from 0.16.6 to 0.16.8 (#152)
  • c69aaba build(deps-dev): Bump js-yaml from 4.3.1 to 4.3.2 (#151)
  • 3fa5618 build(deps-dev): Bump proxy-addr from 2.0.7 to 2.0.8 (#150)
  • 2856b7b build(deps): Bump brace-expansion (#149)
  • 5f73d33 fix: the api key is passed as a command-line argumen... in... (#140)
  • 279dab4 Bump tmp from 0.2.5 to 0.2.7 (#132)
  • Additional commits viewable in compare view

Updates browserslist from 4.28.1 to 4.29.4

Release notes

Sourced from browserslist's releases.

4.29.4

  • Fixed joined version bounds in version ray and range queries (by @​ybai08).
  • Fixed whitespaces processing (by @​abhu85).

4.29.3

  • Updated Firefox ESR.

4.29.2

  • Fixed ignoring null usage in cover X in Y query (by @​wahidrizka).

4.29.1

4.29.0

  • Added query continuations across lines and array entries (by @​fzlzjerry).

4.28.9

4.28.8

  • Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

4.28.6

4.28.5

4.28.4

  • Fixed SyntaxError regression of 4.28.3.

4.28.3

  • Fixed baseline query case-insensitivity (by @​swwind).

4.28.2

Changelog

Sourced from browserslist's changelog.

4.29.4

  • Fixed joined version bounds in version ray and range queries (by @​ybai08).
  • Fixed whitespaces processing (by @​abhu85).

4.29.3

  • Updated Firefox ESR.

4.29.2

  • Fixed ignoring null usage in cover X in Y query (by @​wahidrizka).

4.29.1

4.29.0

  • Added query continuations across lines and array entries (by @​fzlzjerry).

4.28.9

4.28.8

  • Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

4.28.6

4.28.5

4.28.4

  • Fixed SyntaxError regression of 4.28.3.

... (truncated)

Commits
  • f7a99b9 Release 4.29.4 version
  • 03fc702 Update dependencies
  • efe07e1 Merge pull request #956 from ybai08/fix-joined-range-bounds
  • ef50f5b Fix joined version bounds in version ray and range queries
  • 8219dd7 Merge pull request #954 from abhu85/fix-since-extends-whitespace
  • 893120b Allow arbitrary whitespaces in since, extends, config and not queries
  • b4809dd Release 4.29.3 version
  • 9d844f8 Update Firefox ESR
  • 0033f34 Update dependencies
  • 906d329 Release 4.29.2 version
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for browserslist since your current version.


Updates immutable from 5.1.5 to 5.1.9

Release notes

Sourced from immutable's releases.

v5.1.9

What's Changed

Full Changelog: immutable-js/immutable-js@v5.1.8...v5.1.9

v5.1.8

What's Changed

Full Changelog: immutable-js/immutable-js@v5.1.7...v5.1.8

v5.1.7

What's Changed

internal

New Contributors

Full Changelog: immutable-js/immutable-js@v5.1.6...v5.1.7

v5.1.6

What's Changed

... (truncated)

Changelog

Sourced from immutable's changelog.

5.1.9

  • fix(List): a List grown past 32 elements while all its values are undefined no longer reads those values back as null (affected get, iteration, toArray, equals and hashCode)

5.1.8

4.3.9

5.1.7

  • fix(Repeat): lastIndexOf returned size instead of size - 1 by @​chatman-media in immutable-js/immutable-js#2227. Fixes CVE CVE-2026-29063
  • fix(IndexedCollection): has(index) on a lazy Seq of unknown size now checks index existence instead of searching for a value equal to the index #2203
  • [TypeScript]: reduce/reduceRight without an initial value now infer the result type from the collection's values when the reducer returns a value (e.g. list.reduce((a, b) => a + b) infers number), matching Array#reduce. Previously an explicit type argument was required. #2205

5.1.6

  • fix(reverseFactory): read reversedSequence.size in __iterator instead of this #2196
Commits
  • 329f7a6 5.1.9
  • 21fabd9 changelog
  • 009164f Merge pull request #2235 from immutable-js/fix/avoid-null-when-setsize33
  • 5b65bfb fix(List): preserve undefined values when grown past 32 elements
  • 50bf39e Update CHANGELOG.md for versions 5.1.8 and 4.3.9
  • 6496539 5.1.8
  • 808a83a Merge commit from fork
  • e51d49f perf(Map): index large hash-collision buckets for faster lookups
  • 25c58b0 fix typescript in tests
  • a1a1ee4 Merge commit from fork
  • Additional commits viewable in compare view

Updates js-yaml from 3.14.2 to 3.15.2

Changelog

Sourced from js-yaml's changelog.

3.15.2 - 2026-08-26

Changed

  • [backport] Hard-limit merge sequence size to 100.

Security

  • [backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

3.15.1 - 2026-07-31

Security

  • [backport] Remove quadratic complexity from !!omap duplicate key detection.

3.15.0 - 2026-06-27

Added

  • Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one safeLoad() / safeLoadAll() call.
Commits

Updates linkify-it from 5.0.0 to 5.0.2

Changelog

Sourced from linkify-it's changelog.

5.0.2 / 2026-07-02

  • Fixed DoS in mailto: links (restrict user name to 64 chars).
  • Restricted user/pass part length in links.

5.0.1 / 2026-05-23

  • Fixed DoS in fuzzy links/emails search.
  • Reworked search logic - check each pattern separate, use g regexes instead of slice.
  • Removed internal cache - useless overcomplication.
Commits

Updates markdown-it from 14.1.1 to 14.3.3

Changelog

Sourced from markdown-it's changelog.

[14.3.3] - 2026-10-16

Security

  • Backported 15.0.3 fixes.

[14.3.2] - 2026-09-12

Security

  • Backported 15.0.2 fixes.

[14.3.1] - 2026-08-27

Security

  • Backported 15.0.1 fixes.

[14.3.0] - 2026-07-02

Changed

  • Reworked build pipeline & tools.
  • Added source maps.
  • Bumped linkify-it to 5.0.2.

Fixed

  • Preserve backslash-space hard line breaks, matching CommonMark 6.7, #1185.

[14.2.0] - 2026-05-24

Added

  • isPunctCharCode to utilities.

Fixed

  • Don't end HTML comment blocks on a blank line, #1155.
  • Properly recognize astral chars (surrogates) in delimiter scans for emphasis-like markers, #1072. Big thanks to @​tats-u for his global efforts with improving CJK support.
  • Preserve unicode whitespaces when trimm headings/paragraphs, #1074.
  • More strict entities decode to avoid false positives ;, #1096.
  • Restore block parser state on fail in lheading rule, #1131.

Security

  • Fixed poor smartquotes perfomance on > 70k quotes in single block
  • Bumped linkify-it to 5.0.1 with fixed potential perfomance issues.
Commits
  • d372f0d 14.3.3 released
  • d99f488 Backported 15.0.3 fixes
  • efb9993 14.3.2 released
  • daf5a3c Backported 15.0.2 fixes
  • a855f10 14.3.1 released
  • ad70f6b Backported 15.0.1 fixes
  • b407f3b Ignore generated API docs in lint
  • bf025ad Prepare package.json for v14 backports
  • 2d9bbea fix: recognize lowercase declarations as HTML blocks (CommonMark 4.6) (#1189)
  • a311cfb fix: keep literal backslash before space in link destination (CommonMark 6.3)...
  • Additional commits viewable in compare view

Updates nanoid from 3.3.11 to 3.3.20

Release notes

Sourced from nanoid's releases.

3.3.20

3.3.19

  • Fixed killing the app by setting huge user ID.

3.3.18

3.3.17

  • Fixed infinite loop on zero size.

3.3.16

3.3.15

  • Fixed npm provenance error.

3.3.14

  • Fixed random pool corruption on big ID sizes.

3.3.13

  • Reduced npm package size.

3.3.12

  • Fixed breaking Nano ID by requesting big ID.
Changelog

Sourced from nanoid's changelog.

3.3.20

3.3.19

3.3.18

3.3.17

  • Fixed infinite loop on zero size.

3.3.16

3.3.15

  • Fixed npm provenance error.

3.3.14

  • Fixed random pool corruption on big ID sizes.

3.3.13

  • Reduced npm package size.

3.3.12

  • Fixed breaking Nano ID by requesting big ID.
Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nanoid since your current version.


Updates postcss from 8.5.14 to 8.5.31

Release notes

Sourced from postcss's releases.

8.5.31

8.5.30

  • Fix broken map on </style> escaping (by @​Rufflet).

8.5.29

8.5.28

  • Fixes types regression.

8.5.27

8.5.26

  • Fixed list.split() regression (by @​lazerg).
  • Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

  • Fixed 8.5.17 visitor regression.
  • Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

  • Preserve the BOM after the processing (by @​hdimer).

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

8.5.19

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.31

8.5.30

  • Fix broken map on </style> escaping (by @​Rufflet).

8.5.29

8.5.28

  • Fixes types regression.

8.5.27

8.5.26

  • Fixed list.split() regression (by @​lazerg).
  • Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

  • Fixed 8.5.17 visitor regression.
  • Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

  • Preserve the BOM after the processing (by @​hdimer).

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.


Updates source-map-js from 1.2.1 to 1.2.2

Release notes

Sourced from source-map-js's releases.

v1.2.2

Changelog

Sourced from source-map-js's changelog.

1.2.2

Commits

Updates undici from 7.24.6 to 7.30.1

Release notes

Sourced from undici's releases.

v7.30.1

Security fixes

High severity

Denial of service via TLS 1.2 certificate-changing renegotiation

CVE-2026-87018 · GHSA-qrxm-fqhp-jwvm

A malicious or compromised HTTPS server could crash the Node.js process by initiating TLS 1.2 renegotiation and presenting a different, CA-trusted certificate whose hostname did not match the requested host. The resulting socket error reached an assertion in undici's HTTP/1.1 and HTTP/2 connection handling. This release handles post-connect certificate errors without terminating the process.

TLS certificate validation bypass through dropped Agent options

CVE-2026-109383 · GHSA-2m5v-pch6-74hx

Agent used a JSON-based clone for constructor options, which silently removed function-valued TLS options such as checkServerIdentity. Applications relying on custom certificate or public-key verification could therefore accept a certificate that the callback was intended to reject. This release preserves TLS options when creating per-origin dispatchers.

Cache poisoning and cross-user disclosure through cross-origin redirects

CVE-2026-109829 · GHSA-4w7w-5xrc-9h26

When an originless Agent combined redirect and shared-cache interceptors as compose(redirect(), cache()), a response from a cross-origin redirect could be stored under the original URL. This could allow persistent cache poisoning or disclosure of user-specific responses to later callers. This release verifies the response origin before caching and preserves redirect-hop cache-control policy.

Denial of service through excessive Content-Encoding values

CVE-2026-109869 · GHSA-xjj6-f33q-929c

A malicious HTTP server could crash the Node.js process by returning more than five content codings and closing the connection before sending the body. Although fetch() rejected the response, an error from an orphaned internal stream could remain unhandled. This release validates the content-encoding chain before creating the body stream and aborts oversized chains safely.

Medium severity

Denial of service through the decompress interceptor

CVE-2026-87029 · GHSA-55wc-3pg8-jfw6

An exception thrown by a downstream response handler from an asynchronous decompression callback could escape as an uncaught exception. A server could trigger this when decompress was composed with a handler such as dump with a size limit. This release converts downstream handler exceptions into per-request errors.

Subresource Integrity bypass with non-lowercase algorithm tokens

CVE-2026-109841 · GHSA-f72v-6w45-q472

fetch() treated valid mixed-case or uppercase SRI algorithm tokens, such as SHA256, as unknown and could accept a response whose body did not match the configured digest. This release normalizes algorithm tokens before validation and digest selection.

Denial of service through unbounded EventSource parser state

CVE-2026-109924 · GHSA-4qv8-2p9j-2685

A malicious Server-Sent Events endpoint could exhaust process memory by sending many tiny data: fields without completing an event, or by splitting an unfinished line across many chunks. This release bounds retained EventSource parser state, including field counts, buffered chunks, unfinished-line length, and retained field data.

Denial of service through unbounded automatic WebSocket PONG buffering

... (truncated)

Commits
  • 7507102 Bumped v7.30.1 (#6022)
  • 7d60c7b [v7.x] fix(cookies): backport #5663, #5808 and #5832 (#6019)
  • 0227d5d fix: avoid unbounded recursion in Set-Cookie attribute parser (#5757) (#5997)
  • 5394462 fix(websocket): bound automatic PONG writes under backpressure
  • 2991627 fix(eventsource): bound retained SSE parser state
  • 18bc8a1 fix(sri): accept non-lowercase algorithm tokens
  • 63cba77 fix(decompress): converge downstream handler throws to per-request errors
  • 07ded49 fix(fetch): abort excessive content encoding responses
  • b20b82a fix(cache): prevent cross-origin redirect cache confusion
  • 04cb74b fix: preserve Agent connection options
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump the npm_and_yarn group across 1 directory with 10 u…
ace4d4e 
…pdates

Bumps the npm_and_yarn group with 10 updates in the /docs directory:

| Package | From | To |
| --- | --- | --- |
| [baseline-browser-mapping](https://github.com/web-platform-dx/baseline-browser-mapping) | `2.10.10` | `2.11.30` |
| [browserslist](https://github.com/browserslist/browserslist) | `4.28.1` | `4.29.4` |
| [immutable](https://github.com/immutable-js/immutable-js) | `5.1.5` | `5.1.9` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `3.14.2` | `3.15.2` |
| [linkify-it](https://github.com/markdown-it/linkify-it) | `5.0.0` | `5.0.2` |
| [markdown-it](https://github.com/markdown-it/markdown-it) | `14.1.1` | `14.3.3` |
| [nanoid](https://github.com/ai/nanoid) | `3.3.11` | `3.3.20` |
| [postcss](https://github.com/postcss/postcss) | `8.5.14` | `8.5.31` |
| [source-map-js](https://github.com/7rulnik/source-map-js) | `1.2.1` | `1.2.2` |
| [undici](https://github.com/nodejs/undici) | `7.24.6` | `7.30.1` |



Updates `baseline-browser-mapping` from 2.10.10 to 2.11.30
- [Release notes](https://github.com/web-platform-dx/baseline-browser-mapping/releases)
- [Commits](web-platform-dx/baseline-browser-mapping@v2.10.10...v2.11.30)

Updates `browserslist` from 4.28.1 to 4.29.4
- [Release notes](https://github.com/browserslist/browserslist/releases)
- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md)
- [Commits](browserslist/browserslist@4.28.1...4.29.4)

Updates `immutable` from 5.1.5 to 5.1.9
- [Release notes](https://github.com/immutable-js/immutable-js/releases)
- [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md)
- [Commits](immutable-js/immutable-js@v5.1.5...v5.1.9)

Updates `js-yaml` from 3.14.2 to 3.15.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/3.15.2/CHANGELOG.md)
- [Commits](nodeca/js-yaml@3.14.2...3.15.2)

Updates `linkify-it` from 5.0.0 to 5.0.2
- [Changelog](https://github.com/markdown-it/linkify-it/blob/master/CHANGELOG.md)
- [Commits](markdown-it/linkify-it@5.0.0...5.0.2)

Updates `markdown-it` from 14.1.1 to 14.3.3
- [Changelog](https://github.com/markdown-it/markdown-it/blob/14.3.3/CHANGELOG.md)
- [Commits](markdown-it/markdown-it@14.1.1...14.3.3)

Updates `nanoid` from 3.3.11 to 3.3.20
- [Release notes](https://github.com/ai/nanoid/releases)
- [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md)
- [Commits](ai/nanoid@3.3.11...3.3.20)

Updates `postcss` from 8.5.14 to 8.5.31
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.14...8.5.31)

Updates `source-map-js` from 1.2.1 to 1.2.2
- [Release notes](https://github.com/7rulnik/source-map-js/releases)
- [Changelog](https://github.com/7rulnik/source-map-js/blob/main/CHANGELOG.md)
- [Commits](7rulnik/source-map-js@v1.2.1...v1.2.2)

Updates `undici` from 7.24.6 to 7.30.1
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.24.6...v7.30.1)

---
updated-dependencies:
- dependency-name: baseline-browser-mapping
  dependency-version: 2.11.30
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: browserslist
  dependency-version: 4.29.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: immutable
  dependency-version: 5.1.9
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 3.15.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: linkify-it
  dependency-version: 5.0.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: markdown-it
  dependency-version: 14.3.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: nanoid
  dependency-version: 3.3.20
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: postcss
  dependency-version: 8.5.31
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: source-map-js
  dependency-version: 1.2.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 7.30.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 21, 2026
@vercel

vercel Bot commented Oct 21, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
jzero Ready Ready Preview Oct 21, 2026 1:28am UTC

@dependabot dependabot Bot added the javascript Pull requests that update Javascript code label Oct 21, 2026

This branch was successfully deployed

1 active deployment
Preview — ace4d4e1 Deployed Oct 21, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants