Repository navigation
chore(deps): bump the npm_and_yarn group across 6 directories with 5 updates - #16088
Closed
dependabot[bot] wants to merge 2 commits into
Closed
dependabot[bot] wants to merge 2 commits into
dependabot[bot] wants to merge 2 commits into
Conversation
release: promote Dev_new_gui to main (activates the parked-branch schedule, #15306)
dependabot
Bot
added
dependencies
Contributor
|
Retargeted to |
2 of 5 tasks
Owner
Stale by 9 days, and
|
3 tasks
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/dot-mcp/npm_and_yarn-2ccd40383e
branch
from
September 8, 2026 23:51
5e03ba2 to
c2600cf
Compare
mrveiss
pushed a commit
that referenced
this pull request
Sep 9, 2026
The previous commit allowed js-yaml on the reading that its fix was 5.x and therefore a major nobody could take. That was wrong, and the evidence was in the advisory line the whole time: - `js-yaml` [high] 4.0.0 - 4.3.1 4.3.1 is the last AFFECTED version, not the last released one. 4.3.2 sits outside the range and IS the fix. I read the upper bound of an affected range as though it were the newest release, concluded no patch existed, and reached for an allowance. What surfaced it was not rereading. It was dependabot #16088, whose npm_and_yarn group carries js-yaml 4.3.1 -> 4.3.2 -- a bump that cannot exist if the fix is 5.x. The contradiction came from a second source that had done the same lookup independently. So js-yaml comes off the list. Its remedy is the lockfile bump, and this step stays red on js-yaml until that lands. THAT IS THE CORRECT RED: a gate reporting a fixable vulnerability is doing its job, and the allowance would have silenced it for as long as the entry sat there. Only @redocly/openapi-core is allowed, where 1.34.19 is genuinely the newest 1.x and the range covers it. The bad direction here is worth naming, because it is not symmetric. An allowance that is too narrow produces a red and gets fixed within the hour. An allowance that is too broad produces a green and is never revisited -- and this one would have been permanent, because the self-cleaning check only fires when the scanner STOPS reporting a package. js-yaml would have kept being reported, the allowance would have kept matching, and nothing in the system would ever have asked whether a fix had shipped. Re-verified in all four states rather than only the one I wanted: today, both reported exit 1 FAIL -- 1 unallowed (js-yaml), 1 allowance after the js-yaml bump exit 0 PASS -- 0 unallowed, 1 allowance a new third advisory exit 1 FAIL -- 1 unallowed redocly fixed upstream exit 1 FAIL + stale-allowance error The fourth is the one that matters for the entry that remains: when upstream ships a redocly fix, the gate refuses to pass until the allowance is removed.
Owner
|
This PR carries the fix half of #16089, and it is the reason a wrong call on that issue got caught.
I had proposed allowing js-yaml on the reading that its fix was 5.x. This PR's existence contradicted that directly: a 4.3.1 → 4.3.2 security bump cannot exist if the fix is a major. Corrected on #16103. Current blockers here:
Rebasing to clear the conflicts and pick up current base. Ordering: #16103 and this PR are independent and both are needed to clear #16089 — either can land first. #16103 alone narrows base's red from two findings to one; this alone leaves redocly. Together they make base green. @dependabot rebase |
…updates Bumps the npm_and_yarn group with 2 updates in the /.mcp directory: [fast-uri](https://github.com/fastify/fast-uri) and [qs](https://github.com/ljharb/qs). Bumps the npm_and_yarn group with 5 updates in the /autobot-frontend directory: | Package | From | To | | --- | --- | --- | | [fast-uri](https://github.com/fastify/fast-uri) | `3.1.5` | `3.1.7` | | [qs](https://github.com/ljharb/qs) | `6.15.3` | `6.16.0` | | [baseline-browser-mapping](https://github.com/web-platform-dx/baseline-browser-mapping) | `2.10.40` | `2.11.21` | | [browserslist](https://github.com/browserslist/browserslist) | `4.28.4` | `4.28.9` | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.3.1` | `4.3.2` | Bumps the npm_and_yarn group with 2 updates in the /autobot-infrastructure/shared/mcp/tools/mcp-autobot-tracker directory: [fast-uri](https://github.com/fastify/fast-uri) and [qs](https://github.com/ljharb/qs). Bumps the npm_and_yarn group with 3 updates in the /autobot-infrastructure/shared/mcp/tools/mcp-structured-thinking directory: [fast-uri](https://github.com/fastify/fast-uri), [qs](https://github.com/ljharb/qs) and [js-yaml](https://github.com/nodeca/js-yaml). Bumps the npm_and_yarn group with 1 update in the /autobot-slm-frontend directory: [fast-uri](https://github.com/fastify/fast-uri). Bumps the npm_and_yarn group with 3 updates in the /libs/autobot-sdk-ts directory: [baseline-browser-mapping](https://github.com/web-platform-dx/baseline-browser-mapping), [browserslist](https://github.com/browserslist/browserslist) and [js-yaml](https://github.com/nodeca/js-yaml). Updates `fast-uri` from 3.1.5 to 3.1.7 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.5...v3.1.7) Updates `qs` from 6.15.2 to 6.16.0 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.15.2...v6.16.0) Updates `fast-uri` from 3.1.5 to 3.1.7 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.5...v3.1.7) Updates `qs` from 6.15.2 to 6.16.0 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.15.2...v6.16.0) Updates `fast-uri` from 3.1.5 to 3.1.7 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.5...v3.1.7) Updates `qs` from 6.15.2 to 6.16.0 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.15.2...v6.16.0) Updates `fast-uri` from 3.1.5 to 3.1.7 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.5...v3.1.7) Updates `qs` from 6.15.2 to 6.16.0 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.15.2...v6.16.0) Updates `fast-uri` from 3.1.5 to 3.1.7 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.5...v3.1.7) Updates `fast-uri` from 3.1.5 to 3.1.7 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.5...v3.1.7) Updates `qs` from 6.15.3 to 6.16.0 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.15.2...v6.16.0) Updates `baseline-browser-mapping` from 2.10.40 to 2.11.21 - [Release notes](https://github.com/web-platform-dx/baseline-browser-mapping/releases) - [Commits](web-platform-dx/baseline-browser-mapping@v2.10.40...v2.11.21) Updates `browserslist` from 4.28.4 to 4.28.9 - [Release notes](https://github.com/browserslist/browserslist/releases) - [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md) - [Commits](browserslist/browserslist@4.28.4...4.28.9) Updates `fast-uri` from 3.1.5 to 3.1.7 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.5...v3.1.7) Updates `js-yaml` from 4.3.1 to 4.3.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.1...4.3.2) Updates `qs` from 6.15.3 to 6.16.0 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.15.2...v6.16.0) Updates `fast-uri` from 3.1.5 to 3.1.7 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.5...v3.1.7) Updates `qs` from 6.15.3 to 6.16.0 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.15.2...v6.16.0) Updates `baseline-browser-mapping` from 2.10.40 to 2.11.21 - [Release notes](https://github.com/web-platform-dx/baseline-browser-mapping/releases) - [Commits](web-platform-dx/baseline-browser-mapping@v2.10.40...v2.11.21) Updates `browserslist` from 4.28.4 to 4.28.9 - [Release notes](https://github.com/browserslist/browserslist/releases) - [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md) - [Commits](browserslist/browserslist@4.28.4...4.28.9) Updates `fast-uri` from 3.1.5 to 3.1.7 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.5...v3.1.7) Updates `js-yaml` from 4.3.1 to 4.3.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.1...4.3.2) Updates `qs` from 6.15.3 to 6.16.0 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.15.2...v6.16.0) Updates `fast-uri` from 3.1.5 to 3.1.7 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.5...v3.1.7) Updates `js-yaml` from 4.3.1 to 4.3.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.1...4.3.2) Updates `baseline-browser-mapping` from 2.10.40 to 2.11.21 - [Release notes](https://github.com/web-platform-dx/baseline-browser-mapping/releases) - [Commits](web-platform-dx/baseline-browser-mapping@v2.10.40...v2.11.21) Updates `browserslist` from 4.28.4 to 4.28.9 - [Release notes](https://github.com/browserslist/browserslist/releases) - [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md) - [Commits](browserslist/browserslist@4.28.4...4.28.9) Updates `js-yaml` from 4.3.1 to 4.3.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.1...4.3.2) Updates `fast-uri` from 3.1.5 to 3.1.7 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.5...v3.1.7) Updates `qs` from 6.15.2 to 6.16.0 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.15.2...v6.16.0) Updates `fast-uri` from 3.1.5 to 3.1.7 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.5...v3.1.7) Updates `qs` from 6.15.2 to 6.16.0 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.15.2...v6.16.0) Updates `fast-uri` from 3.1.5 to 3.1.7 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.5...v3.1.7) Updates `qs` from 6.15.2 to 6.16.0 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.15.2...v6.16.0) Updates `fast-uri` from 3.1.5 to 3.1.7 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.5...v3.1.7) Updates `qs` from 6.15.2 to 6.16.0 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.15.2...v6.16.0) Updates `fast-uri` from 3.1.5 to 3.1.7 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.5...v3.1.7) Updates `fast-uri` from 3.1.5 to 3.1.7 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.5...v3.1.7) Updates `qs` from 6.15.2 to 6.16.0 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.15.2...v6.16.0) Updates `fast-uri` from 3.1.5 to 3.1.7 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.5...v3.1.7) Updates `js-yaml` from 3.15.1 to 3.15.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.1...4.3.2) Updates `qs` from 6.15.2 to 6.16.0 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.15.2...v6.16.0) Updates `fast-uri` from 3.1.5 to 3.1.7 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.5...v3.1.7) Updates `qs` from 6.15.2 to 6.16.0 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.15.2...v6.16.0) Updates `fast-uri` from 3.1.5 to 3.1.7 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.5...v3.1.7) Updates `js-yaml` from 3.15.1 to 3.15.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.1...4.3.2) Updates `qs` from 6.15.2 to 6.16.0 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.15.2...v6.16.0) Updates `fast-uri` from 3.1.5 to 3.1.7 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.5...v3.1.7) Updates `js-yaml` from 3.15.1 to 3.15.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.1...4.3.2) Updates `js-yaml` from 3.15.1 to 3.15.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.1...4.3.2) Updates `fast-uri` from 3.1.5 to 3.1.7 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.5...v3.1.7) Updates `fast-uri` from 3.1.5 to 3.1.7 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.5...v3.1.7) Updates `fast-uri` from 3.1.5 to 3.1.7 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.5...v3.1.7) Updates `fast-uri` from 3.1.5 to 3.1.7 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.5...v3.1.7) Updates `fast-uri` from 3.1.5 to 3.1.7 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.5...v3.1.7) Updates `baseline-browser-mapping` from 2.10.32 to 2.11.21 - [Release notes](https://github.com/web-platform-dx/baseline-browser-mapping/releases) - [Commits](web-platform-dx/baseline-browser-mapping@v2.10.40...v2.11.21) Updates `browserslist` from 4.28.2 to 4.28.9 - [Release notes](https://github.com/browserslist/browserslist/releases) - [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md) - [Commits](browserslist/browserslist@4.28.4...4.28.9) Updates `js-yaml` from 3.15.0 to 3.15.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.1...4.3.2) Updates `baseline-browser-mapping` from 2.10.32 to 2.11.21 - [Release notes](https://github.com/web-platform-dx/baseline-browser-mapping/releases) - [Commits](web-platform-dx/baseline-browser-mapping@v2.10.40...v2.11.21) Updates `browserslist` from 4.28.2 to 4.28.9 - [Release notes](https://github.com/browserslist/browserslist/releases) - [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md) - [Commits](browserslist/browserslist@4.28.4...4.28.9) Updates `js-yaml` from 3.15.0 to 3.15.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.1...4.3.2) Updates `js-yaml` from 3.15.0 to 3.15.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.1...4.3.2) Updates `baseline-browser-mapping` from 2.10.32 to 2.11.21 - [Release notes](https://github.com/web-platform-dx/baseline-browser-mapping/releases) - [Commits](web-platform-dx/baseline-browser-mapping@v2.10.40...v2.11.21) Updates `browserslist` from 4.28.2 to 4.28.9 - [Release notes](https://github.com/browserslist/browserslist/releases) - [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md) - [Commits](browserslist/browserslist@4.28.4...4.28.9) Updates `js-yaml` from 3.15.0 to 3.15.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.1...4.3.2) --- updated-dependencies: - dependency-name: baseline-browser-mapping dependency-version: 2.11.21 dependency-type: indirect - dependency-name: baseline-browser-mapping dependency-version: 2.11.21 dependency-type: indirect - dependency-name: baseline-browser-mapping dependency-version: 2.11.21 dependency-type: indirect - dependency-name: baseline-browser-mapping dependency-version: 2.11.21 dependency-type: indirect - dependency-name: baseline-browser-mapping dependency-version: 2.11.21 dependency-type: indirect - dependency-name: baseline-browser-mapping dependency-version: 2.11.21 dependency-type: indirect - dependency-name: browserslist dependency-version: 4.28.9 dependency-type: indirect - dependency-name: browserslist dependency-version: 4.28.9 dependency-type: indirect - dependency-name: browserslist dependency-version: 4.28.9 dependency-type: indirect - dependency-name: browserslist dependency-version: 4.28.9 dependency-type: indirect - dependency-name: browserslist dependency-version: 4.28.9 dependency-type: indirect - dependency-name: browserslist dependency-version: 4.28.9 dependency-type: indirect - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect - dependency-name: js-yaml dependency-version: 3.15.2 dependency-type: indirect - dependency-name: js-yaml dependency-version: 3.15.2 dependency-type: indirect - dependency-name: js-yaml dependency-version: 3.15.2 dependency-type: indirect - dependency-name: js-yaml dependency-version: 3.15.2 dependency-type: indirect - dependency-name: js-yaml dependency-version: 3.15.2 dependency-type: indirect - dependency-name: js-yaml dependency-version: 3.15.2 dependency-type: indirect - dependency-name: js-yaml dependency-version: 3.15.2 dependency-type: indirect - dependency-name: js-yaml dependency-version: 3.15.2 dependency-type: indirect - dependency-name: js-yaml dependency-version: 4.3.2 dependency-type: indirect - dependency-name: js-yaml dependency-version: 4.3.2 dependency-type: indirect - dependency-name: js-yaml dependency-version: 4.3.2 dependency-type: indirect - dependency-name: js-yaml dependency-version: 4.3.2 dependency-type: indirect - dependency-name: qs dependency-version: 6.16.0 dependency-type: indirect - dependency-name: qs dependency-version: 6.16.0 dependency-type: indirect - dependency-name: qs dependency-version: 6.16.0 dependency-type: indirect - dependency-name: qs dependency-version: 6.16.0 dependency-type: indirect - dependency-name: qs dependency-version: 6.16.0 dependency-type: indirect - dependency-name: qs dependency-version: 6.16.0 dependency-type: indirect - dependency-name: qs dependency-version: 6.16.0 dependency-type: indirect - dependency-name: qs dependency-version: 6.16.0 dependency-type: indirect - dependency-name: qs dependency-version: 6.16.0 dependency-type: indirect - dependency-name: qs dependency-version: 6.16.0 dependency-type: indirect - dependency-name: qs dependency-version: 6.16.0 dependency-type: indirect - dependency-name: qs dependency-version: 6.16.0 dependency-type: indirect - dependency-name: qs dependency-version: 6.16.0 dependency-type: indirect - dependency-name: qs dependency-version: 6.16.0 dependency-type: indirect - dependency-name: qs dependency-version: 6.16.0 dependency-type: indirect - dependency-name: qs dependency-version: 6.16.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/dot-mcp/npm_and_yarn-2ccd40383e
branch
from
September 9, 2026 06:51
c2600cf to
9378502
Compare
mrveiss
added a commit
that referenced
this pull request
Sep 9, 2026
…16103) * security: allow the two unfixable dev-only npm advisories (#16089) Base has been red on Dependency Security Scan since a published advisory landed mid-evening. The commit it turned red on touched only .claude/hooks and repo_tests -- no npm surface -- so nothing introduced it and no change reverts it. Every open PR inherits the red. I went looking for the bump first. There is not one. @redocly/openapi-core 1.34.8-1.34.19: 1.34.19 is the newest release on the 1.x line and the advisory range covers it, so there is NO patched 1.x. It arrives transitively under openapi-typescript, and openapi-typescript@latest is 7.13.0 -- the version already pinned -- which still requires ^1.34.6. No upgrade path exists until upstream moves to redocly 2.x. js-yaml <=4.3.1: fixed only in 5.x, a major. It is an `overrides` entry pinned to ~4.3.1, and its consumers ask for 4.x -- @redocly/openapi-core requires 4.3.0, cosmiconfig ^4.1.0. Forcing the override to 5.x pushes a major onto two packages that do not declare support for it. NEITHER SHIPS. Both are `dev: true` in package-lock.json: build tooling for gen:types, not runtime code. The exposure is a developer machine and a CI runner, not a deployed node. That is what makes an allowance the right answer rather than a deferral, and it is the same call security.yml already documents for PYSEC-2026-3740, allowed because its advisory records first_patched_version: null. Verified rather than asserted, with the control both ways: with allowances exit 0 PASS -- 0 unallowed, 2 recorded without (control) exit 1 FAIL -- 2 unallowed third advisory exit 1 FAIL -- 1 unallowed, 2 recorded The control matters: without it, a gate that passes proves nothing about whether the allowances are what is doing the work. And the third case is the property the list exists for -- a new advisory in a different package still reds the run. Two things recorded in the comment rather than left implicit. Granularity is coarser here than for pip-audit. parse_npm_audit (security_scan_gate.py:100) keys a Finding on the PACKAGE NAME, not the advisory id, so these entries admit any future advisory in those two packages. The pip-audit allowances name a CVE each and do not have that reach. Narrowing it means teaching the parser to emit via[].url, which is a change to the gate rather than to this list. The list is self-cleaning, and that is measured too: an allowance the scanner no longer reports fails the run -- "an allowance that matches nothing tolerates whatever appears next". So neither entry can outlive its justification; when upstream ships a fix, the gate demands the entry be removed. * security: drop the js-yaml allowance -- 4.3.2 is the fix (#16089) The previous commit allowed js-yaml on the reading that its fix was 5.x and therefore a major nobody could take. That was wrong, and the evidence was in the advisory line the whole time: - `js-yaml` [high] 4.0.0 - 4.3.1 4.3.1 is the last AFFECTED version, not the last released one. 4.3.2 sits outside the range and IS the fix. I read the upper bound of an affected range as though it were the newest release, concluded no patch existed, and reached for an allowance. What surfaced it was not rereading. It was dependabot #16088, whose npm_and_yarn group carries js-yaml 4.3.1 -> 4.3.2 -- a bump that cannot exist if the fix is 5.x. The contradiction came from a second source that had done the same lookup independently. So js-yaml comes off the list. Its remedy is the lockfile bump, and this step stays red on js-yaml until that lands. THAT IS THE CORRECT RED: a gate reporting a fixable vulnerability is doing its job, and the allowance would have silenced it for as long as the entry sat there. Only @redocly/openapi-core is allowed, where 1.34.19 is genuinely the newest 1.x and the range covers it. The bad direction here is worth naming, because it is not symmetric. An allowance that is too narrow produces a red and gets fixed within the hour. An allowance that is too broad produces a green and is never revisited -- and this one would have been permanent, because the self-cleaning check only fires when the scanner STOPS reporting a package. js-yaml would have kept being reported, the allowance would have kept matching, and nothing in the system would ever have asked whether a fix had shipped. Re-verified in all four states rather than only the one I wanted: today, both reported exit 1 FAIL -- 1 unallowed (js-yaml), 1 allowance after the js-yaml bump exit 0 PASS -- 0 unallowed, 1 allowance a new third advisory exit 1 FAIL -- 1 unallowed redocly fixed upstream exit 1 FAIL + stale-allowance error The fourth is the one that matters for the entry that remains: when upstream ships a redocly fix, the gate refuses to pass until the allowance is removed. --------- Co-authored-by: t <t@example.invalid>
mrveiss
added a commit
that referenced
this pull request
Sep 9, 2026
…16104, #16122) (#16129) * fix(ci): clear the three defects every open PR is inheriting (#16089, #16104, #16122) Eight red check-runs across nine PRs reduce to three causes, none of which any of those PRs introduced. Fixing them one per PR means three CI suites and three review passes to unblock a queue that is already blocked; fixing them together means one. 1. DEPENDENCY SECURITY SCAN -- js-yaml ~4.3.1 -> ~4.3.2. The advisory range is 4.0.0-4.3.1, so 4.3.2 is outside it and IS the fix. With the redocly allowance already on base, this is the half that clears the scan. Affects #15980, #16088, #16123. 2. PYTHON-SUITE SHARD 7/12 -- a comment citing a line number. comment_line_number_citations_test forbids it, and security.yml carried `security_scan_gate.py:100` from a merge earlier today. Mine. A line number is invalidated by edits to code it does not describe and fails silently into whatever later occupies it -- and it was written inside a paragraph warning that the allowance is coarser than it looks. Symbol name only now. Affects #15980, #16106, #16107, #16117, #16125. 3. CHECK SAME-SCOPE BATCHING -- an ATX heading needs `#` followed by a space. check_pr_issue_batching.py treated any line starting with `#` as the next heading, so a rationale opening `#15961 alone...` made a FILLED section parse as empty. The message now also distinguishes "no section found" from "section found but empty", quoting the line that ended the parse -- because a red only self-corrects when it names its real cause, and every previous author here reworded until green, leaving no trace. Affects #16117, #16119, #16123, #16127. TAKING DEPENDABOT'S WHOLE package.json WOULD HAVE REGRESSED SIX PACKAGES, and that is the reason this is assembled by hand rather than merged from its branch. #16088 was cut before several upgrades landed, so adopting the file wholesale downgrades apexcharts 7.1.0->6.10.0, cytoscape 3.34.2->3.34.1, onnxruntime-web 1.29.0->1.26.0, vega-embed 7.2.0->7.1.0, vue-i18n 11.4.10->11.4.8 and vue-router 5.3.1->5.2.0. Caught by reading the diff rather than the intent. So the frontend change is exactly one line of package.json and three lines of the lockfile -- version, resolved and integrity for node_modules/js-yaml, copied verbatim from dependabot's verified entry rather than invented. The nine remaining `4.3.1` strings in the lockfile are debug, @types/esrecurse, ansis and polished; dependabot's own lockfile has the same nine. 44 tests pass: the batching parser's full suite including the four reproduction cases, and the citation guard that shard 7 was failing on. * security: drop the redocly allowance -- the scanner stopped reporting it (#16089) The gate failed on the allowance itself: allowance(s) ['@redocly/openapi-core'] name findings the scanner no longer reports. Remove them; an allowance that matches nothing tolerates whatever appears next. Not the advisory returning. The advisory GOING. This is the self-cleaning property that the allowance was justified against, arriving and doing exactly what it was described as doing -- and it is the third time today that a check I verified has then been right about my own work. Worth being precise about why an empty match is a failure rather than a shrug. An allowance keyed on a package name admits ANY future advisory in that package, so one that currently matches nothing is not inert -- it is a standing exemption for whatever appears there next, with nobody watching. Nothing else in this system asks whether an allowance is still needed, so without this check the entry sits until someone happens to reread the block. The npm gate now carries NO allowances, which is the state to defend. Adding one back needs the evidence the last one had: no reachable fix, checked against the REGISTRY rather than the advisory range -- a fix at a major behind a third party's dependency range is still a fix, which is the distinction that nearly made the js-yaml allowance permanent -- and the package does not ship. #16122's subject was pointing the allowance at a removal tracker. There is no allowance to track, so #16123 is now moot as well as superseded.
Owner
|
Do not close this as redundant. Two of its bumps are the only fix on the board for a live high advisory, and both are in workspaces I came here to close it and enumerate the residue for a successor issue. The enumeration reversed the decision: GHSA-2883-xcg3-v3hh has two ranges. Only the 4.x one has been discussed:
Both are transitive — neither Why it nearly went. This PR was being assessed by what had landed from it, and that was drawn from the bumps that had been discussed. The correct check runs the other way round: enumerate what the PR still changes against base, rather than confirming that the remembered parts have landed. This PR cannot merge as-is — 274 commits behind, and |
mrveiss
added a commit
that referenced
this pull request
Sep 9, 2026
…naudited workspaces (#16131) GHSA-2883-xcg3-v3hh has TWO ranges. We read one of them all day. >= 4.0.0, < 4.3.2 patched 4.3.2 <- the one we chased >= 3.0.0, < 3.15.2 patched 3.15.2 <- never read by anyone Measured on base: autobot-frontend 4.3.2 fixed, audited autobot-slm-frontend 4.3.0 fixed by this PR mcp-structured-thinking 3.15.1 VULNERABLE libs/autobot-sdk-ts 3.15.0 VULNERABLE Both 3.x instances are TRANSITIVE -- neither package.json declares js-yaml, so there is no pin to read and no override to trip over. They exist only in the lockfiles, in directories no gate inspects. Integrity hashes copied verbatim from dependabot's verified entries on #16088, not constructed. That PR is the only place these two bumps existed, which is why closing it would have discarded them into workspaces nothing would re-report. AND THE WORKSPACE COUNT IN THIS FILE WAS WRONG THREE TIMES, in a comment that exists specifically to stop a reader trusting a scope-less number. "Six workspaces" came from the top-level layout by eye, "eleven" and "twelve" from two different partial counts of package.json files. Measured: 14 tracked package.json (non-nested) 7 with a lockfile -- npm audit needs one 1 audited So SIX auditable workspaces are never audited. Stated with its denominator now, because the count without one is the defect the comment was written about.
mrveiss
added a commit
that referenced
this pull request
Sep 9, 2026
…#16131) (#16132) * security(slm): the js-yaml advisory is live in an unaudited workspace (#16131) We traced GHSA-2883-xcg3-v3hh through autobot-frontend for hours today, merged a fix in #16129, and watched it clear the transitive redocly finding -- while the SAME ADVISORY sat in a sibling workspace the whole time, unaudited. autobot-frontend/package.json "js-yaml": "~4.3.2" fixed by #16129 autobot-slm-frontend/package.json "js-yaml": "4.3.0" inside 4.0.0-4.3.1 4.3.0 is an EXACT PIN, not a range, so nothing resolves it upward. It was never going to age out. WHY IT READ AS CLEAN. security.yml runs `( cd autobot-frontend && npm audit )` -- one directory. There are TWELVE tracked package.json files. A green Dependency Security Scan means "autobot-frontend has no unallowed findings" and is read as "npm dependencies are clean". The summary header even reported "0 advisories across 1191 deps" with no scope named: one workspace's dependency count, phrased as the repository's. Same shape as #13044, where a duplication guard scanned two of five trees and reported nothing rather than a passing number over a partial population. A gate whose scope is narrower than its name is indistinguishable from a clean result. Two changes: The bump. js-yaml 4.3.0 -> 4.3.2 in autobot-slm-frontend, package.json override and lockfile. The integrity hash is copied verbatim from the entry #16129 landed in autobot-frontend's lockfile -- a value already verified against dependabot's, not constructed. An invented integrity hash fails at install time on someone else's machine with no obvious cause, which is worse than the advisory. The scope statement. The summary header now says autobot-frontend ONLY and names the eleven unaudited files, so the next reader cannot take that number for the repository's. This does not widen the audit -- #16131 tracks that -- it stops the gate claiming coverage it does not have. NEW PR BECAUSE NO OPEN PR COULD CARRY IT, which is worth stating since the standing rule is to append rather than open. #16088 is the only open PR touching autobot-slm-frontend, and it cannot merge: 274 commits behind, and `smoke-test` has never reported on it, so a required context can never arrive. A live vulnerability should not wait behind a PR that cannot land. Found by the session preparing #16088's closure -- looking at what closing it would DROP, rather than at whether it should close. * security(deps): the same advisory has a 3.x range, live in two more unaudited workspaces (#16131) GHSA-2883-xcg3-v3hh has TWO ranges. We read one of them all day. >= 4.0.0, < 4.3.2 patched 4.3.2 <- the one we chased >= 3.0.0, < 3.15.2 patched 3.15.2 <- never read by anyone Measured on base: autobot-frontend 4.3.2 fixed, audited autobot-slm-frontend 4.3.0 fixed by this PR mcp-structured-thinking 3.15.1 VULNERABLE libs/autobot-sdk-ts 3.15.0 VULNERABLE Both 3.x instances are TRANSITIVE -- neither package.json declares js-yaml, so there is no pin to read and no override to trip over. They exist only in the lockfiles, in directories no gate inspects. Integrity hashes copied verbatim from dependabot's verified entries on #16088, not constructed. That PR is the only place these two bumps existed, which is why closing it would have discarded them into workspaces nothing would re-report. AND THE WORKSPACE COUNT IN THIS FILE WAS WRONG THREE TIMES, in a comment that exists specifically to stop a reader trusting a scope-less number. "Six workspaces" came from the top-level layout by eye, "eleven" and "twelve" from two different partial counts of package.json files. Measured: 14 tracked package.json (non-nested) 7 with a lockfile -- npm audit needs one 1 audited So SIX auditable workspaces are never audited. Stated with its denominator now, because the count without one is the defect the comment was written about. * security: state the denominator that matters, not the one that is easy to count (#16131) The workspace total has now been stated four times by three sessions and been wrong three of them: 6, then 11/12, then 14, against a measured 13. Four different causes -- counted from the top-level layout by eye, two partial counts, and mine, where the glob `*package.json` matched browser-package.json, a filename that merely ENDS with it. Every one produced by someone looking straight at the number, immediately after watching the previous count fail. THE TELL IS THAT BEING WRONG NEVER CHANGED A CONCLUSION. 13 or 14 tracked package.json files was never the relevant denominator: libs/autobot-ui, autobot-plugins/* and autobot-browser-worker have no lockfile, so npm audit could not run in them whatever the total says. It kept being counted because it was the easiest thing to count. So the total comes out. The comment now says SEVEN workspaces can be audited and ONE is -- the two figures that were correct in every version, and the only two that bear on whether the gate's scope is honest. A number that keeps being wrong and never changes a conclusion does not belong in the sentence. Its presence is not neutral: it is the part a reader checks, and getting it right feels like having checked the claim.
Owner
|
Closing — on a per-directory, per-package enumeration against base, which is what I said this closure would require rather than a recollection of what landed. I compared every Every security bump has landed:
GHSA-2883-xcg3-v3hh is clear in every tracked lockfile — the 4.x range via #16129 and #16132, the 3.x range via #16132. The two 3.x instances existed only here, which is why this PR stayed open after it was declared redundant. The nine that did not land, in full: All three are browser-compatibility data packages with no advisory attached, and all three publish continuously — dependabot will re-open them at their then-current versions. Nothing is dropped by closing; these are superseded rather than lost. Why this PR could never carry them. 274 commits behind, and The record worth keepingThis PR was assessed as redundant twice and was not. The first assessment checked the bumps that had been discussed — A superseded PR's residue is invisible in exactly the proportion that it was never talked about. The check that works is the one run here — enumerate what the PR still changes against base, mechanically, and let the diff decide what is in the set rather than memory. That check takes one script and finds nine leftovers, two of which were live high advisories in directories no gate inspects. Closed against #16134, which tracks the remaining half: nothing yet asserts that no tracked lockfile resolves a vulnerable |
Contributor
Author
|
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests. To ignore these dependencies, configure ignore rules in dependabot.yml |
dependabot
Bot
deleted the
dependabot/npm_and_yarn/dot-mcp/npm_and_yarn-2ccd40383e
branch
September 9, 2026 13:37
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the npm_and_yarn group with 2 updates in the /.mcp directory: fast-uri and qs.
Bumps the npm_and_yarn group with 5 updates in the /autobot-frontend directory:
3.1.53.1.76.15.36.16.02.10.402.11.214.28.44.28.94.3.14.3.2Bumps the npm_and_yarn group with 2 updates in the /autobot-infrastructure/shared/mcp/tools/mcp-autobot-tracker directory: fast-uri and qs.
Bumps the npm_and_yarn group with 3 updates in the /autobot-infrastructure/shared/mcp/tools/mcp-structured-thinking directory: fast-uri, qs and js-yaml.
Bumps the npm_and_yarn group with 1 update in the /autobot-slm-frontend directory: fast-uri.
Bumps the npm_and_yarn group with 3 updates in the /libs/autobot-sdk-ts directory: baseline-browser-mapping, browserslist and js-yaml.
Updates
fast-urifrom 3.1.5 to 3.1.7Release notes
Sourced from fast-uri's releases.
Commits
412e40aBumped v3.1.79f4c943fix: backport port and IP-literal validation to v3.x (#216)1eb3ce4fix: treat unterminated bracket hosts as reg-names again (#214)6f970b2Bumped v3.1.6d941579fix: never run IDN canonicalization on bracketed IP literalsc0f0279test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)37f3417Merge commit from fork607bfbeMerge commit from forkae92a4cMerge commit from fork444ecdaMerge commit from forkUpdates
qsfrom 6.15.2 to 6.16.0Changelog
Sourced from qs's changelog.
Commits
bb9379ev6.16.062fd254[Fix] stringify: serialize Date values when a filter is provided8859c37[Fix]parse: enforcearrayLimiton comma groups under[]=when `throwOn...8079adc[Tests]parse: remove a test that pinned[]=comma groups escaping `array...d56f48c[Fix]parse: flatten a collection appended to an overflowed arraye83d321[Fix]utils:isBuffer: do not invoke a non-callableconstructor.isBuffer7e87a07[Dev Deps] update@ljharb/eslint-config,eslint9a76af2[Dev Deps] updateeslint,evalmd3a890d4[Dev Deps] updateeslint,evalmdb433a9b[Fix]stringify: do not letallowEmptyArraysskip cycle detection (or dro...Updates
fast-urifrom 3.1.5 to 3.1.7Release notes
Sourced from fast-uri's releases.
Commits
412e40aBumped v3.1.79f4c943fix: backport port and IP-literal validation to v3.x (#216)1eb3ce4fix: treat unterminated bracket hosts as reg-names again (#214)6f970b2Bumped v3.1.6d941579fix: never run IDN canonicalization on bracketed IP literalsc0f0279test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)37f3417Merge commit from fork607bfbeMerge commit from forkae92a4cMerge commit from fork444ecdaMerge commit from forkUpdates
qsfrom 6.15.2 to 6.16.0Changelog
Sourced from qs's changelog.
Commits
bb9379ev6.16.062fd254[Fix] stringify: serialize Date values when a filter is provided8859c37[Fix]parse: enforcearrayLimiton comma groups under[]=when `throwOn...8079adc[Tests]parse: remove a test that pinned[]=comma groups escaping `array...d56f48c[Fix]parse: flatten a collection appended to an overflowed arraye83d321[Fix]utils:isBuffer: do not invoke a non-callableconstructor.isBuffer7e87a07[Dev Deps] update@ljharb/eslint-config,eslint9a76af2[Dev Deps] updateeslint,evalmd3a890d4[Dev Deps] updateeslint,evalmdb433a9b[Fix]stringify: do not letallowEmptyArraysskip cycle detection (or dro...Updates
fast-urifrom 3.1.5 to 3.1.7Release notes
Sourced from fast-uri's releases.
Commits
412e40aBumped v3.1.79f4c943fix: backport port and IP-literal validation to v3.x (#216)1eb3ce4fix: treat unterminated bracket hosts as reg-names again (#214)6f970b2Bumped v3.1.6d941579fix: never run IDN canonicalization on bracketed IP literalsc0f0279test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)37f3417Merge commit from fork607bfbeMerge commit from forkae92a4cMerge commit from fork444ecdaMerge commit from forkUpdates
qsfrom 6.15.2 to 6.16.0Changelog
Sourced from qs's changelog.
Commits
bb9379ev6.16.062fd254[Fix] stringify: serialize Date values when a filter is provided8859c37[Fix]parse: enforcearrayLimiton comma groups under[]=when `throwOn...8079adc[Tests]parse: remove a test that pinned[]=comma groups escaping `array...d56f48c[Fix]parse: flatten a collection appended to an overflowed arraye83d321[Fix]utils:isBuffer: do not invoke a non-callableconstructor.isBuffer7e87a07[Dev Deps] update@ljharb/eslint-config,eslint9a76af2[Dev Deps] updateeslint,evalmd3a890d4[Dev Deps] updateeslint,evalmdb433a9b[Fix]stringify: do not letallowEmptyArraysskip cycle detection (or dro...Updates
fast-urifrom 3.1.5 to 3.1.7Release notes
Sourced from fast-uri's releases.
Commits
412e40aBumped v3.1.79f4c943fix: backport port and IP-literal validation to v3.x (#216)1eb3ce4fix: treat unterminated bracket hosts as reg-names again (#214)6f970b2Bumped v3.1.6d941579fix: never run IDN canonicalization on bracketed IP literalsc0f0279test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)37f3417Merge commit from fork607bfbeMerge commit from forkae92a4cMerge commit from fork444ecdaMerge commit from forkUpdates
qsfrom 6.15.2 to 6.16.0Changelog
Sourced from qs's changelog.
Commits
bb9379ev6.16.062fd254[Fix] stringify: serialize Date values when a filter is provided8859c37[Fix]parse: enforcearrayLimiton comma groups under[]=when `throwOn...8079adc[Tests]parse: remove a test that pinned[]=comma groups escaping `array...d56f48c[Fix]parse: flatten a collection appended to an overflowed arraye83d321[Fix]utils:isBuffer: do not invoke a non-callableconstructor.isBuffer7e87a07[Dev Deps] update@ljharb/eslint-config,eslint9a76af2[Dev Deps] updateeslint,evalmd3a890d4[Dev Deps] updateeslint,evalmdb433a9b[Fix]stringify: do not letallowEmptyArraysskip cycle detection (or dro...Updates
fast-urifrom 3.1.5 to 3.1.7Release notes
Sourced from fast-uri's releases.
Commits
412e40aBumped v3.1.79f4c943fix: backport port and IP-literal validation to v3.x (#216)1eb3ce4fix: treat unterminated bracket hosts as reg-names again (#214)6f970b2Bumped v3.1.6d941579fix: never run IDN canonicalization on bracketed IP literalsc0f0279test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)37f3417Merge commit from fork607bfbeMerge commit from forkae92a4cMerge commit from fork444ecdaMerge commit from forkUpdates
fast-urifrom 3.1.5 to 3.1.7Release notes
Sourced from fast-uri's releases.
Commits
412e40aBumped v3.1.79f4c943fix: backport port and IP-literal validation to v3.x (#216)1eb3ce4fix: treat unterminated bracket hosts as reg-names again (#214)6f970b2Bumped v3.1.6d941579fix: never run IDN canonicalization on bracketed IP literalsc0f0279test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)37f3417Merge commit from fork607bfbeMerge commit from forkae92a4cMerge commit from fork444ecdaMerge commit from forkUpdates
qsfrom 6.15.3 to 6.16.0Changelog
Sourced from qs's changelog.
Commits
bb9379ev6.16.062fd254[Fix] stringify: serialize Date values when a filter is provided8859c37[Fix]parse: enforcearrayLimiton comma groups under[]=when `throwOn...8079adc[Tests]parse: remove a test that pinned[]=comma groups escaping `array...d56f48c[Fix]parse: flatten a collection appended to an overflowed arraye83d321[Fix]utils:isBuffer: do not invoke a non-callableconstructor.isBuffer7e87a07[Dev Deps] update@ljharb/eslint-config,eslint9a76af2[Dev Deps] updateeslint,evalmd3a890d4[Dev Deps] updateeslint,evalmdb433a9b[Fix]stringify: do not letallowEmptyArraysskip cycle detection (or dro...Updates
baseline-browser-mappingfrom 2.10.40 to 2.11.21Release notes
Sourced from baseline-browser-mapping's releases.
Commits
0e5ed80Patch to 2.11.21 because browser or feature data changed11da0b6Browser or feature data changed69fcc81Updating static siteb964de0Patch to 2.11.20 because browser or feature data changed723099fBrowser or feature data changedf44163dUpdating static site8966043Patch to 2.11.19 because browser or feature data changede18601dBrowser or feature data changed28cb50aUpdating static sitecb33a83Patch to 2.11.18 because browser or feature data changedUpdates
browserslistfrom 4.28.4 to 4.28.9Release notes
Sourced from browserslist's releases.
Changelog
Sourced from browserslist's changelog.
Commits
12ed525Release 4.28.9 versionb1d8cf9Update dependencies21517b6Improveorparsing performancef2f2e6cRelease 4.28.8 versiond0787c8Update dependenciesfcf8fa9Merge pull request #939 from Jaybhade/fix/baseline-kaios-without-downstream57ecd64fix: support "including kaios" without downstream093a0f6Update EM bannerb637868Release 4.28.7 version313f465Update dependenciesUpdates
fast-urifrom 3.1.5 to 3.1.7Release notes
Sourced from fast-uri's releases.
Commits
412e40aBumped v3.1.79f4c943fix: backport port and IP-literal validation to v3.x (#216)1eb3ce4fix: treat unterminated bracket hosts as reg-names again (#214)6f970b2Bumped v3.1.6d941579fix: never run IDN canonicalization on bracketed IP literalsc0f0279test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)37f3417Merge commit from fork607bfbeMerge commit from forkae92a4cMerge commit from fork444ecdaMerge commit from forkUpdates
js-yamlfrom 4.3.1 to 4.3.2Changelog
Sourced from js-yaml's changelog.
Commits
79ca68d4.3.2 relea...Description has been truncated