Skip to content

Bump the npm_and_yarn group across 1 directory with 16 updates#1

Open
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/npm_and_yarn/npm_and_yarn-a3760e98d1
Open

Bump the npm_and_yarn group across 1 directory with 16 updates#1
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/npm_and_yarn/npm_and_yarn-a3760e98d1

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot bot commented on behalf of github Mar 31, 2026

Bumps the npm_and_yarn group with 10 updates in the / directory:

Package From To
sharp 0.17.3 0.32.6
braces 1.8.5 removed
follow-redirects 0.0.7 removed
growl 1.9.2 removed
hoek 2.16.3 removed
request 2.81.0 2.88.2
js-yaml 3.9.0 3.14.2
jsonpointer 4.0.1 5.0.1
minimatch 3.0.4 3.1.5
shelljs 0.7.8 removed

Updates sharp from 0.17.3 to 0.32.6

Changelog

Sourced from sharp's changelog.

v0.32.6 - 18th September 2023

  • Upgrade to libvips v8.14.5 for upstream bug fixes.

  • Ensure composite tile images are fully decoded (regression in 0.32.0). #3767

  • Ensure withMetadata can add ICC profiles to RGB16 output. #3773

  • Ensure withMetadata does not reduce 16-bit images to 8-bit (regression in 0.32.5). #3773

  • TypeScript: Add definitions for block and unblock. #3799 @​ldrick

v0.32.5 - 15th August 2023

  • Upgrade to libvips v8.14.4 for upstream bug fixes.

  • TypeScript: Add missing WebpPresetEnum to definitions. #3748 @​pilotso11

  • Ensure compilation using musl v1.2.4. #3755 @​kleisauke

  • Ensure resize with a fit of inside respects 90/270 degree rotation. #3756

  • TypeScript: Ensure minSize property of WebpOptions is boolean. #3758 @​sho-xizz

  • Ensure withMetadata adds default sRGB profile. #3761

v0.32.4 - 21st July 2023

  • Upgrade to libvips v8.14.3 for upstream bug fixes.

  • Expose ability to (un)block low-level libvips operations by name.

  • Prebuilt binaries: restore support for tile-based output. #3581

v0.32.3 - 14th July 2023

... (truncated)

Commits
Install script changes

This version modifies install script that runs during installation. Review the package contents before updating.


Removes braces

Updates tunnel-agent from 0.4.3 to 0.6.0

Commits

Updates deep-extend from 0.4.2 to 0.6.0

Changelog

Sourced from deep-extend's changelog.

v0.6.0

  • Updated "devDependencies" versions to fix vulnerability alerts
  • Dropped support of io.js and node.js v0.12.x and lower since new versions of "devDependencies" couldn't work with those old node.js versions (minimal supported version of node.js now is v4.0.0)

v0.5.1

  • Fix prototype pollution vulnerability (thanks to @​mwakerman for the PR)
  • Avoid using deprecated Buffer API (thanks to @​ChALkeR for the PR)

v0.5.0

  • Auto-testing provided by Travis CI;
  • Support older Node.JS versions (v0.11.x and v0.10.x);
  • Removed tests files from npm package.
Commits
  • f3f2b4f more versions of node.js to test by travis-ci
  • 3d85253 package.json: updated "engines"
  • 8b8aef9 dropped support of old node.js versions
  • 120fd97 increased "devDependencies" (mocha) up enough to fix vulnerability
  • 235821a decreasing versions of "devDependencies" to fix tests for older node versions
  • a1eb0eb README: removed "download" stats badge
  • 7bebe75 CHANGELOG: info for 0.5.2 version
  • 16b328f 0.5.2
  • 0402225 updated "devDependencies" to fix vulnerability alerts
  • 2e0110e prepared v0.5.1 release
  • Additional commits viewable in compare view

Removes follow-redirects

Removes growl

Removes hoek

Updates request from 2.81.0 to 2.88.2

Changelog

Sourced from request's changelog.

Change Log

v2.88.0 (2018/08/10)

v2.87.0 (2018/05/21)

v2.86.0 (2018/05/15)

v2.85.0 (2018/03/12)

v2.84.0 (2018/03/12)

v2.83.0 (2017/09/27)

v2.82.0 (2017/09/19)

Commits

Updates ini from 1.3.4 to 1.3.8

Commits
  • a2c5da8 1.3.8
  • af5c6bb Do not use Object.create(null)
  • 8b648a1 don't test where our devdeps don't even work
  • c74c8af 1.3.7
  • 024b8b5 update deps, add linting
  • 032fbaf Use Object.create(null) to avoid default object property hazards
  • 2da9039 1.3.6
  • cfea636 better git push script, before publish instead of after
  • 56d2805 do not allow invalid hazardous string as section name
  • 738eca5 v1.3.5
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by isaacs, a new releaser for ini since your current version.


Updates js-yaml from 3.9.0 to 3.14.2

Changelog

Sourced from js-yaml's changelog.

[3.14.2] - 2025-11-15

Security

  • Backported v4.1.1 fix to v3

[4.1.1] - 2025-11-12

Security

  • Fix prototype pollution issue in yaml merge (<<) operator.

[4.1.0] - 2021-04-15

Added

  • Types are now exported as yaml.types.XXX.
  • Every type now has options property with original arguments kept as they were (see yaml.types.int.options as an example).

Changed

  • Schema.extend() now keeps old type order in case of conflicts (e.g. Schema.extend([ a, b, c ]).extend([ b, a, d ]) is now ordered as abcd instead of cbad).

[4.0.0] - 2021-01-03

Changed

  • Check migration guide to see details for all breaking changes.
  • Breaking: "unsafe" tags !!js/function, !!js/regexp, !!js/undefined are moved to js-yaml-js-types package.
  • Breaking: removed safe* functions. Use load, loadAll, dump instead which are all now safe by default.
  • yaml.DEFAULT_SAFE_SCHEMA and yaml.DEFAULT_FULL_SCHEMA are removed, use yaml.DEFAULT_SCHEMA instead.
  • yaml.Schema.create(schema, tags) is removed, use schema.extend(tags) instead.
  • !!binary now always mapped to Uint8Array on load.
  • Reduced nesting of /lib folder.
  • Parse numbers according to YAML 1.2 instead of YAML 1.1 (01234 is now decimal, 0o1234 is octal, 1:23 is parsed as string instead of base60).
  • dump() no longer quotes :, [, ], (, ) except when necessary, #470, #557.
  • Line and column in exceptions are now formatted as (X:Y) instead of at line X, column Y (also present in compact format), #332.
  • Code snippet created in exceptions now contains multiple lines with line numbers.
  • dump() now serializes undefined as null in collections and removes keys with undefined in mappings, #571.
  • dump() with skipInvalid=true now serializes invalid items in collections as null.
  • Custom tags starting with ! are now dumped as !tag instead of !<!tag>, #576.
  • Custom tags starting with tag:yaml.org,2002: are now shorthanded using !!, #258.

Added

  • Added .mjs (es modules) support.
  • Added quotingType and forceQuotes options for dumper to configure string literal style, #290, #529.
  • Added styles: { '!!null': 'empty' } option for dumper (serializes { foo: null } as "foo: "), #570.

... (truncated)

Commits

Updates json-schema from 0.2.3 to 0.4.0

Commits
  • f6f6a3b Use a little more robust method of checking instances
  • ef60987 Update version
  • b62f1da Protect against constructor modification, #84
  • fb427cd Link to json-schema-org repository in addition to site, fixes #54
  • 22f1461 Don't allow proto property to be used for schema default/coerce, fixes #84
  • c52a27c Get basic test to pass
  • b3f42b3 Add security policy
  • 3b0cec3 Update version
  • c28470f Update readme to acknowledge the state of the package
  • 7dff9cd Merge pull request #81 from hodovani/patch-1
  • Additional commits viewable in compare view

Updates jsonpointer from 4.0.1 to 5.0.1

Release notes

Sourced from jsonpointer's releases.

Version 5.0.1

Changelog

v5.0.0

5.0.0 (2021-10-31)

Bug Fixes

  • Fix prototype pollution (#51)

    • The original, non-mutated objects are now returned if any of the keys __proto__, constructor or prototype are used in a json pointer.
    // returns the unmodified input {}
jsonpointer.set({}, '/foo/__proto__/boo', 'polluted')
    • When passing non-string arrays to a .set operation, an error is thrown:
    // throws `new Error('Invalid JSON pointer. Must be of type string or number.')`
jsonpointer.set({}, [['__proto__'], ['__proto__'], 'boo'], 'polluted')

v4.1.0

4.1.0 (2020-07-03)

Bug Fixes

Features

Commits
  • 4a253c0 Adopt strictEqual changes and only return null when the get succeeded
  • bad4983 Fix null values throwing exception when traversing over while getting
  • a5706e8 test: Always use strictEqual to ensure null and undefined values are asserted...
  • b8e1e6a fix incorrect typings for compile get/set methods
  • c4de620 Merge pull request #53 from janl/release/5.0.0
  • 8dbf304 feat: v5
  • 84cf173 Merge pull request #52 from janl/fix/test
  • f716e5c chore: more rip travis
  • e2ae355 chore: remove comment
  • d23693b chore: update primary branch
  • Additional commits viewable in compare view

Updates minimatch from 3.0.4 to 3.1.5

Commits

Updates qs from 6.4.0 to 6.5.5

Changelog

Sourced from qs's changelog.

6.5.5

  • [Fix] fix regressions from robustness refactor
  • [meta] add npmignore to autogenerate an npmignore file
  • [actions] update reusable workflows

6.5.4

  • [Robustness] avoid .push, use void
  • [readme] clarify parseArrays and arrayLimit documentation (#543)
  • [readme] document that addQueryPrefix does not add ? to empty output (#418)
  • [readme] replace runkit CI badge with shields.io check-runs badge
  • [actions] fix rebase workflow permissions

6.5.3

  • [Fix] parse: ignore __proto__ keys (#428)
  • [Fix] utils.merge: avoid a crash with a null target and a truthy non-array source
  • [Fix] correctly parse nested arrays
  • [Fix] stringify: fix a crash with strictNullHandling and a custom filter/serializeDate (#279)
  • [Fix] utils: merge: fix crash when source is a truthy primitive & no options are provided
  • [Fix] when parseArrays is false, properly handle keys ending in []
  • [Fix] fix for an impossible situation: when the formatter is called with a non-string value
  • [Fix] utils.merge: avoid a crash with a null target and an array source
  • [Refactor] utils: reduce observable [[Get]]s
  • [Refactor] use cached Array.isArray
  • [Refactor] stringify: Avoid arr = arr.concat(...), push to the existing instance (#269)
  • [Refactor] parse: only need to reassign the var once
  • [Robustness] stringify: avoid relying on a global undefined (#427)
  • [readme] remove travis badge; add github actions/codecov badges; update URLs
  • [Docs] Clean up license text so it’s properly detected as BSD-3-Clause
  • [Docs] Clarify the need for "arrayLimit" option
  • [meta] fix README.md (#399)
  • [meta] add FUNDING.yml
  • [actions] backport actions from main
  • [Tests] always use String(x) over x.toString()
  • [Tests] remove nonexistent tape option
  • [Dev Deps] backport from main

6.5.2

  • [Fix] use safer-buffer instead of Buffer constructor
  • [Refactor] utils: module.exports one thing, instead of mutating exports (#230)
  • [Dev Deps] update browserify, eslint, iconv-lite, safer-buffer, tape, browserify

6.5.1

  • [Fix] Fix parsing & compacting very deep objects (#224)
  • [Refactor] name utils functions
  • [Dev Deps] update eslint, @ljharb/eslint-config, tape
  • [Tests] up to node v8.4; use nvm install-latest-npm so newer npm doesn’t break older node
  • [Tests] Use precise dist for Node.js 0.6 runtime (#225)
  • [Tests] make 0.6 required, now that it’s passing
  • [Tests] on node v8.2; fix npm on node 0.6

... (truncated)

Commits
  • 3a6d9f8 v6.5.5
  • 48160e7 [actions] update reusable workflows
  • 2fc004a [meta] add npmignore to autogenerate an npmignore file
  • ddcc5d5 [Fix] fix regressions from robustness refactor
  • c190488 v6.5.4
  • 40b77c3 [actions] fix rebase workflow permissions
  • 6e39e92 [readme] document that addQueryPrefix does not add ? to empty output
  • 4e393de [readme] replace runkit CI badge with shields.io check-runs badge
  • dbb0346 [readme] clarify parseArrays and arrayLimit documentation
  • 6b8b4d8 [Robustness] avoid .push, use void
  • Additional commits viewable in compare view
Install script changes

This version modifies prepublish script that runs during installation. Review the package contents before updating.


Updates request from 2.81.0 to 2.88.2

Changelog

Sourced from request's changelog.

Change Log

v2.88.0 (2018/08/10)

v2.87.0 (2018/05/21)

v2.86.0 (2018/05/15)

v2.85.0 (2018/03/12)

v2.84.0 (2018/03/12)

v2.83.0 (2017/09/27)

v2.82.0 (2017/09/19)

Commits

Removes shelljs

Updates tough-cookie from 2.3.2 to 2.5.0

Commits
  • 7c1fdf1 2.5.0
  • 9ff4ba5 Qualify the store.removeAllCookies documentation
  • 1855bf3 Additional documentation for removeAllCookies
  • 5cc9bd2 Extract tests, cover multiple error path
  • 28f0808 Only call removeAllCookies if actually implemented
  • 62802ef remove all cookies from cookie jar at once (#115)
  • 8783d46 Remove left-over mention of MPL from README
  • 8302ebc Merge pull request #121 from salesforce/punycode-2.1
  • d6ea115 Merge pull request #120 from salesforce/no-package-lock
  • b897b49 Merge pull request #119 from salesforce/inline-version
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump the npm_and_yarn group across 1 directory with 16 updates
f39ce2a 
Bumps the npm_and_yarn group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [sharp](https://github.com/lovell/sharp) | `0.17.3` | `0.32.6` |
| [braces](https://github.com/micromatch/braces) | `1.8.5` | `removed` |
| [follow-redirects](https://github.com/follow-redirects/follow-redirects) | `0.0.7` | `removed` |
| [growl](https://github.com/tj/node-growl) | `1.9.2` | `removed` |
| [hoek](https://github.com/hapijs/hoek) | `2.16.3` | `removed` |
| [request](https://github.com/request/request) | `2.81.0` | `2.88.2` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `3.9.0` | `3.14.2` |
| [jsonpointer](https://github.com/janl/node-jsonpointer) | `4.0.1` | `5.0.1` |
| [minimatch](https://github.com/isaacs/minimatch) | `3.0.4` | `3.1.5` |
| [shelljs](https://github.com/shelljs/shelljs) | `0.7.8` | `removed` |



Updates `sharp` from 0.17.3 to 0.32.6
- [Release notes](https://github.com/lovell/sharp/releases)
- [Changelog](https://github.com/lovell/sharp/blob/v0.32.6/docs/changelog.md)
- [Commits](lovell/sharp@v0.17.3...v0.32.6)

Removes `braces`

Updates `tunnel-agent` from 0.4.3 to 0.6.0
- [Commits](request/tunnel-agent@v0.4.3...v0.6.0)

Updates `deep-extend` from 0.4.2 to 0.6.0
- [Changelog](https://github.com/unclechu/node-deep-extend/blob/master/CHANGELOG.md)
- [Commits](unclechu/node-deep-extend@v0.4.2...v0.6.0)

Removes `follow-redirects`

Removes `growl`

Removes `hoek`

Updates `request` from 2.81.0 to 2.88.2
- [Changelog](https://github.com/request/request/blob/master/CHANGELOG.md)
- [Commits](https://github.com/request/request/commits)

Updates `ini` from 1.3.4 to 1.3.8
- [Release notes](https://github.com/npm/ini/releases)
- [Changelog](https://github.com/npm/ini/blob/main/CHANGELOG.md)
- [Commits](npm/ini@v1.3.4...v1.3.8)

Updates `js-yaml` from 3.9.0 to 3.14.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@3.9.0...3.14.2)

Updates `json-schema` from 0.2.3 to 0.4.0
- [Commits](kriszyp/json-schema@v0.2.3...v0.4.0)

Updates `jsonpointer` from 4.0.1 to 5.0.1
- [Release notes](https://github.com/janl/node-jsonpointer/releases)
- [Commits](janl/node-jsonpointer@4.0.1...v5.0.1)

Updates `minimatch` from 3.0.4 to 3.1.5
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v3.0.4...v3.1.5)

Updates `qs` from 6.4.0 to 6.5.5
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.4.0...v6.5.5)

Updates `request` from 2.81.0 to 2.88.2
- [Changelog](https://github.com/request/request/blob/master/CHANGELOG.md)
- [Commits](https://github.com/request/request/commits)

Removes `shelljs`

Updates `tough-cookie` from 2.3.2 to 2.5.0
- [Release notes](https://github.com/salesforce/tough-cookie/releases)
- [Changelog](https://github.com/salesforce/tough-cookie/blob/master/CHANGELOG.md)
- [Commits](salesforce/tough-cookie@v2.3.2...v2.5.0)

---
updated-dependencies:
- dependency-name: sharp
  dependency-version: 0.32.6
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: braces
  dependency-version: 
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: tunnel-agent
  dependency-version: 0.6.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: deep-extend
  dependency-version: 0.6.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: follow-redirects
  dependency-version: 
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: growl
  dependency-version: 
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: hoek
  dependency-version: 
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: request
  dependency-version: 2.88.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ini
  dependency-version: 1.3.8
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 3.14.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: json-schema
  dependency-version: 0.4.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: jsonpointer
  dependency-version: 5.0.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: minimatch
  dependency-version: 3.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.5.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: request
  dependency-version: 2.88.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: shelljs
  dependency-version: 
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: tough-cookie
  dependency-version: 2.5.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 31, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants