Skip to content

Bump the npm_and_yarn group across 1 directory with 8 updates - #356

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-26888b42fa
Open

Bump the npm_and_yarn group across 1 directory with 8 updates#356
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-26888b42fa

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 16, 2026

Copy link
Copy Markdown

Bumps the npm_and_yarn group with 8 updates in the / directory:

Package From To
@stablelib/ed25519 2.0.2 2.1.0
@ensdomains/ens-contracts 1.5.2 1.7.0
@babel/plugin-transform-modules-systemjs 7.27.1 7.29.8
@tootallnate/once 2.0.0 2.0.1
defu 6.1.4 6.1.7
flatted 3.3.3 3.4.4
h3 1.15.5 1.15.11
handlebars 4.7.8 4.7.9

Updates @stablelib/ed25519 from 2.0.2 to 2.1.0

Release notes

Sourced from @​stablelib/ed25519's releases.

v2.1

@​stablelib/ed25519 v2.1.0 contains changes to align it with RFC 8032:

Commits

Updates @ensdomains/ens-contracts from 1.5.2 to 1.7.0

Release notes

Sourced from @​ensdomains/ens-contracts's releases.

v1.7.0 Release Notes

Base: v1.6.0 Head: staging (9b03493)

For reference: v1.6.0 deployed contracts

Newly Deployed Contracts

Mainnet (L1)

Contract Networks
ArbitrumReverseResolver mainnet
BaseReverseResolver mainnet
LineaReverseResolver mainnet
OptimismReverseResolver mainnet
ScrollReverseResolver mainnet
DefaultReverseRegistrar mainnet, sepolia, holesky
DefaultReverseResolver sepolia, holesky
BatchGatewayProvider mainnet, sepolia, holesky
MigrationHelper (deploy utility) mainnet, sepolia, holesky

L2 ChainsL2ReverseRegistrar

Network Testnet
Arbitrum Arbitrum Sepolia
Base Base Sepolia
Optimism Optimism Sepolia
Linea Linea Sepolia
Scroll Scroll Sepolia

Redeployed Contracts (modified source)

Contract Networks
ETHRegistrarController mainnet, sepolia, holesky
PublicResolver mainnet, sepolia, holesky
UniversalResolver mainnet, sepolia, holesky
DefaultReverseResolver mainnet (modified)
StaticBulkRenewal mainnet, sepolia, holesky
ExponentialPremiumPriceOracle holesky
StaticMetadataService sepolia, holesky
TestUnwrap (test contract) sepolia, holesky

v1.7.0 Changes

... (truncated)

Commits
  • 9b03493 ENSIP-24 Resolver Profile for Arbitrary Data Resolution (#503)
  • 69f27d2 Synchronize UniversalResolver docstrings with ENSIP-23 (#466)
  • 25466af Deploy RegistrarSecurityController and RootSecurityController (#526)
  • 1ab8c90 Stale (#532)
  • b246374 Fix typos in comments and docs (#533)
  • c76c5ad Merge commit from fork
  • 5106b24 Merge pull request #518 from ensdomains/feat/security-controller-migrations
  • 7f19557 Update deployments for RootSecurityController and `RegistrarSecurityControl...
  • 0884dc5 Merge pull request #517 from ensdomains/feat/security-council
  • d98b158 Changes in response to review
  • Additional commits viewable in compare view

Updates @babel/plugin-transform-modules-systemjs from 7.27.1 to 7.29.8

Release notes

Sourced from @​babel/plugin-transform-modules-systemjs's releases.

v7.29.8 (2026-07-31)

👓 Spec Compliance

  • babel-generator, babel-parser, babel-plugin-transform-spread, babel-traverse, babel-types

🐛 Bug Fix

  • babel-generator
  • babel-node, babel-plugin-transform-modules-systemjs

Committers: 2

v7.29.7 (2026-05-25)

Re-release all packages with npm provenance attestations

v7.29.6 (2026-05-25)

🐛 Bug Fix

Committers: 3

v7.29.5 (2026-05-05)

🏠 Internal

  • babel-preset-env
    • Update @babel/* dependencies

v7.29.4 (2026-05-05)

🐛 Bug Fix

  • babel-plugin-transform-modules-systemjs
    • #17974 [7.x backport]fix(systemjs): improve module string name support (@​JLHwung)

Committers: 1

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​babel/plugin-transform-modules-systemjs since your current version.


Updates @tootallnate/once from 2.0.0 to 2.0.1

Release notes

Sourced from @​tootallnate/once's releases.

v2.0.1

Patch Changes

  • a1e5e2d: Fix promise hang when AbortSignal is aborted
Changelog

Sourced from @​tootallnate/once's changelog.

2.0.1

Patch Changes

  • a1e5e2d: Fix promise hang when AbortSignal is aborted
Commits
  • bcbb21d ci: fix OIDC publishing — Node 24, npm latest, provenance
  • dc24387 Version Packages (2.x) (#12)
  • b8a6f80 CI: test all Node versions on Linux only
  • dabcc0f ci: drop EOL Node.js 14.x/16.x, add 22.x
  • b464efc Update CI: modern Node versions, fix macOS ARM64 compat
  • a1e5e2d Fix promise hang when AbortSignal is aborted
  • See full diff in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​tootallnate/once since your current version.


Updates defu from 6.1.4 to 6.1.7

Release notes

Sourced from defu's releases.

v6.1.7

compare changes

📦 Build

  • Correct the types export entry (#160)
  • Export Defu types (#157)

❤️ Contributors

v6.1.6

compare changes

📦 Build

v6.1.5

compare changes

🩹 Fixes

  • Prevent prototype pollution via __proto__ in defaults (#156)
  • Ignore inherited enumerable properties (11ba022)

✅ Tests

  • Add more tests for plain objects (b65f603)

❤️ Contributors

Changelog

Sourced from defu's changelog.

v6.1.7

compare changes

🩹 Fixes

  • defu.d.cts: Export Defu types (#157)

📦 Build

  • Correct the types export entry (#160)

❤️ Contributors

v6.1.6

compare changes

📦 Build

❤️ Contributors

v6.1.5

compare changes

🩹 Fixes

  • Prevent prototype pollution via __proto__ in defaults (#156)
  • Ignore inherited enumerable properties (11ba022)

🏡 Chore

✅ Tests

  • Add more tests for plain objects (b65f603)

🤖 CI

... (truncated)

Commits
  • 80c0146 chore(release): v6.1.7
  • 40d7ef4 fix(defu.d.cts): export Defu types (#157)
  • 3d3a7c8 build: correct the types export entry (#160)
  • 001c290 chore(release): v6.1.6
  • 407b516 build: fix mixed types
  • 23e59e6 chore(release): v6.1.5
  • 11ba022 fix: ignore inherited enumerable properties
  • 3942bfb fix: prevent prototype pollution via __proto__ in defaults (#156)
  • d3ef16d chore(deps): update actions/checkout action to v6 (#151)
  • 869a053 chore(deps): update actions/setup-node action to v6 (#149)
  • Additional commits viewable in compare view

Updates flatted from 3.3.3 to 3.4.4

Commits

Updates h3 from 1.15.5 to 1.15.11

Release notes

Sourced from h3's releases.

v1.15.11

compare changes

🏡 Chore

v1.15.10

compare changes

🩹 Fixes

  • Preserve percent-encoded req.url in app event handler (#1355)

❤️ Contributors

v1.15.9

compare changes

🩹 Fixes

  • Preserve %25 in pathname (1103df6)
  • static: Prevent path traversal via double-encoded dot segments (%252e%252e) (c56683d)
  • sse: Sanitize carriage returns in event stream data and comments (ba3c3fe)

v1.15.8

compare changes

🩹 Fixes

  • Preserve %25 in pathname (1103df6)

v1.15.7

compare changes

🩹 Fixes

  • static: Narrow path traversal check to match .. as a path segment only (c049dc0)
  • app: Decode percent-encoded path segments to prevent auth bypass (313ea52)

💅 Refactors

  • Remove implicit event handler conversion warning (#1340)

❤️ Contributors

... (truncated)

Changelog

Sourced from h3's changelog.

v1.15.11

compare changes

🏡 Chore

❤️ Contributors

v1.15.10

compare changes

🩹 Fixes

  • Preserve percent-encoded req.url in app event handler (#1355)

🏡 Chore

❤️ Contributors

v1.15.9

compare changes

🩹 Fixes

  • Preserve %25 in pathname (1103df6)
  • static: Prevent path traversal via double-encoded dot segments (%252e%252e) (c56683d)
  • sse: Sanitize carriage returns in event stream data and comments (ba3c3fe)

🏡 Chore

❤️ Contributors

... (truncated)

Commits

Updates handlebars from 4.7.8 to 4.7.9

Release notes

Sourced from handlebars's releases.

v4.7.9

Commits

Changelog

Sourced from handlebars's changelog.

v4.7.9 - March 26th, 2026

  • fix: enable shell mode for spawn to resolve Windows EINVAL issue - e0137c2
  • fix type "RuntimeOptions" also accepting string partials - eab1d14
  • feat(types): set hash to be a Record<string, any> - de4414d
  • fix non-contiguous program indices - 4512766
  • refactor: rename i to startPartIndex - e497a35
  • security: fix security issues - 68d8df5

Commits

Commits
  • dce542c v4.7.9
  • 8a41389 Update release notes
  • 68d8df5 Fix security issues
  • b2a0831 Fix browser tests
  • 9f98c16 Fix release script
  • 45443b4 Revert "Improve partial indenting performance"
  • 8841a5f Fix CI errors with linting
  • e0137c2 fix: enable shell mode for spawn to resolve Windows EINVAL issue
  • e914d60 Improve rendering performance
  • 7de4b41 Upgrade GitHub Actions checkout and setup-node on 4.x branch
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the npm_and_yarn group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@stablelib/ed25519](https://github.com/StableLib/stablelib) | `2.0.2` | `2.1.0` |
| [@ensdomains/ens-contracts](https://github.com/ensdomains/ens-contracts) | `1.5.2` | `1.7.0` |
| [@babel/plugin-transform-modules-systemjs](https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-modules-systemjs) | `7.27.1` | `7.29.8` |
| [@tootallnate/once](https://github.com/TooTallNate/once) | `2.0.0` | `2.0.1` |
| [defu](https://github.com/unjs/defu) | `6.1.4` | `6.1.7` |
| [flatted](https://github.com/WebReflection/flatted) | `3.3.3` | `3.4.4` |
| [h3](https://github.com/h3js/h3) | `1.15.5` | `1.15.11` |
| [handlebars](https://github.com/handlebars-lang/handlebars.js) | `4.7.8` | `4.7.9` |



Updates `@stablelib/ed25519` from 2.0.2 to 2.1.0
- [Release notes](https://github.com/StableLib/stablelib/releases)
- [Commits](https://github.com/StableLib/stablelib/compare/@stablelib/ed25519@2.0.2...@stablelib/ed25519@2.1.0)

Updates `@ensdomains/ens-contracts` from 1.5.2 to 1.7.0
- [Release notes](https://github.com/ensdomains/ens-contracts/releases)
- [Commits](ensdomains/ens-contracts@v1.5.2...v1.7.0)

Updates `@babel/plugin-transform-modules-systemjs` from 7.27.1 to 7.29.8
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.29.8/packages/babel-plugin-transform-modules-systemjs)

Updates `@tootallnate/once` from 2.0.0 to 2.0.1
- [Release notes](https://github.com/TooTallNate/once/releases)
- [Changelog](https://github.com/TooTallNate/once/blob/v2.0.1/CHANGELOG.md)
- [Commits](TooTallNate/once@2.0.0...v2.0.1)

Updates `defu` from 6.1.4 to 6.1.7
- [Release notes](https://github.com/unjs/defu/releases)
- [Changelog](https://github.com/unjs/defu/blob/main/CHANGELOG.md)
- [Commits](unjs/defu@v6.1.4...v6.1.7)

Updates `flatted` from 3.3.3 to 3.4.4
- [Commits](WebReflection/flatted@v3.3.3...v3.4.4)

Updates `h3` from 1.15.5 to 1.15.11
- [Release notes](https://github.com/h3js/h3/releases)
- [Changelog](https://github.com/h3js/h3/blob/v1.15.11/CHANGELOG.md)
- [Commits](h3js/h3@v1.15.5...v1.15.11)

Updates `handlebars` from 4.7.8 to 4.7.9
- [Release notes](https://github.com/handlebars-lang/handlebars.js/releases)
- [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/v4.7.9/release-notes.md)
- [Commits](handlebars-lang/handlebars.js@v4.7.8...v4.7.9)

---
updated-dependencies:
- dependency-name: "@stablelib/ed25519"
  dependency-version: 2.1.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@ensdomains/ens-contracts"
  dependency-version: 1.7.0
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: "@babel/plugin-transform-modules-systemjs"
  dependency-version: 7.29.8
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@tootallnate/once"
  dependency-version: 2.0.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: defu
  dependency-version: 6.1.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: flatted
  dependency-version: 3.4.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: h3
  dependency-version: 1.15.11
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: handlebars
  dependency-version: 4.7.9
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 16, 2026
@vercel

vercel Bot commented Aug 16, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
mission-enrollment Error Error Aug 16, 2026 6:26am

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updated@​stablelib/​ed25519@​2.0.2 ⏵ 2.1.0100 +1100 +275 +18180
Updated@​ensdomains/​ens-contracts@​1.5.2 ⏵ 1.7.081 -5100 +110089 +1100
Updatedpostcss@​8.5.23 ⏵ 8.5.24100 +110081 +195 +2100
Updatedundici@​7.29.0 ⏵ 8.9.093100100 +198 +2100

View full report

@socket-security

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
GitHub dependency: npm @ensdomains/ens-contracts depends on Arachnid/clones-with-immutable-args

Dependency: clones-with-immutable-args@Arachnid/clones-with-immutable-args@#featur

Location: Package overview

From: package.jsonnpm/@ensdomains/ens-contracts@1.7.0

ℹ Read more on: This package | This alert | What are GitHub dependencies?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Publish the GitHub dependency to a public or private package repository and consume it from there.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@ensdomains/ens-contracts@1.7.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm @unruggable/gateways is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: yarn.locknpm/@ensdomains/ens-contracts@1.7.0npm/@unruggable/gateways@1.3.5

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@unruggable/gateways@1.3.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants