build(deps): bump the npm_and_yarn group across 2 directories with 15 updates by dependabot[bot] · Pull Request #249 · speedandfunction/website

dependabot · 2026-02-20T01:54:47Z

Bumps the npm_and_yarn group with 10 updates in the /website directory:

Package	From	To
lodash	`4.17.21`	`4.17.23`
js-yaml	`3.14.1`	`3.14.2`
glob	`10.4.5`	`10.5.0`
qs	`6.14.0`	`6.15.0`
axios	`1.8.4`	`1.13.5`
jws	`4.0.0`	`4.0.1`
linkifyjs	`4.2.0`	`4.3.2`
markdown-it	`14.1.0`	`14.1.1`
undici	`6.21.2`	`6.23.0`
webpack	`5.99.6`	`5.105.2`

Bumps the npm_and_yarn group with 1 update in the /website/e2e directory: playwright.

Updates lodash from 4.17.21 to 4.17.23

Commits

dec55b7 Bump main to v4.17.23 (#6088)
19c9251 fix: setCacheHas JSDoc return type should be boolean (#6071)
b5e6729 jsdoc: Add -0 and BigInt zeros to _.compact falsey values list (#6062)
edadd45 Prevent prototype pollution on baseUnset function
4879a7a doc: fix autoLink function, conversion of source links (#6056)
9648f69 chore: remove yarn.lock file (#6053)
dfa407d ci: remove legacy configuration files (#6052)
156e196 feat: add renovate setup (#6039)
933e106 ci: add pipeline for Bun (#6023)
072a807 docs: update links related to Open JS Foundation (#5968)
Additional commits viewable in compare view

Updates js-yaml from 3.14.1 to 3.14.2

Changelog

Sourced from js-yaml's changelog.

[3.14.2] - 2025-11-15

Security

Backported v4.1.1 fix to v3

[4.1.1] - 2025-11-12

Security

Fix prototype pollution issue in yaml merge (<<) operator.

[4.1.0] - 2021-04-15

Added

Types are now exported as yaml.types.XXX.

Every type now has options property with original arguments kept as they were (see yaml.types.int.options as an example).

Changed

Schema.extend() now keeps old type order in case of conflicts (e.g. Schema.extend([ a, b, c ]).extend([ b, a, d ]) is now ordered as abcd instead of cbad).

[4.0.0] - 2021-01-03

Changed

Check migration guide to see details for all breaking changes.

Breaking: "unsafe" tags !!js/function, !!js/regexp, !!js/undefined are moved to js-yaml-js-types package.

Breaking: removed safe* functions. Use load, loadAll, dump instead which are all now safe by default.

yaml.DEFAULT_SAFE_SCHEMA and yaml.DEFAULT_FULL_SCHEMA are removed, use yaml.DEFAULT_SCHEMA instead.

yaml.Schema.create(schema, tags) is removed, use schema.extend(tags) instead.

!!binary now always mapped to Uint8Array on load.

Reduced nesting of /lib folder.

Parse numbers according to YAML 1.2 instead of YAML 1.1 (01234 is now decimal, 0o1234 is octal, 1:23 is parsed as string instead of base60).

dump() no longer quotes :, [, ], (, ) except when necessary, #470, #557.

Line and column in exceptions are now formatted as (X:Y) instead of at line X, column Y (also present in compact format), #332.

Code snippet created in exceptions now contains multiple lines with line numbers.

dump() now serializes undefined as null in collections and removes keys with undefined in mappings, #571.

dump() with skipInvalid=true now serializes invalid items in collections as null.

Custom tags starting with ! are now dumped as !tag instead of !<!tag>, #576.

Custom tags starting with tag:yaml.org,2002: are now shorthanded using !!, #258.

Added

Added .mjs (es modules) support.

Added quotingType and forceQuotes options for dumper to configure string literal style, #290, #529.

Added styles: { '!!null': 'empty' } option for dumper (serializes { foo: null } as "foo: "), #570.

... (truncated)

Commits

9963d36 3.14.2 released
10d3c8e dist rebuild
5278870 fix prototype pollution in merge (<<) (#731)
See full diff in compare view

Updates glob from 10.4.5 to 10.5.0

Commits

56774ef 10.5.0
1e4e297 bin: Do not expose filenames to shell expansion
See full diff in compare view

Updates qs from 6.14.0 to 6.15.0

Changelog

Sourced from qs's changelog.

6.15.0

[New] parse: add strictMerge option to wrap object/primitive conflicts in an array (#425, #122)

[Fix] duplicates option should not apply to bracket notation keys (#514)

6.14.2

[Fix] parse: mark overflow objects for indexed notation exceeding arrayLimit (#546)

[Fix] arrayLimit means max count, not max index, in combine/merge/parseArrayValue

[Fix] parse: throw on arrayLimit exceeded with indexed notation when throwOnLimitExceeded is true (#529)

[Fix] parse: enforce arrayLimit on comma-parsed values

[Fix] parse: fix error message to reflect arrayLimit as max index; remove extraneous comments (#545)

[Robustness] avoid .push, use void

[readme] document that addQueryPrefix does not add ? to empty output (#418)

[readme] clarify parseArrays and arrayLimit documentation (#543)

[readme] replace runkit CI badge with shields.io check-runs badge

[meta] fix changelog typo (arrayLength → arrayLimit)

[actions] fix rebase workflow permissions

6.14.1

[Fix] ensure arrayLimit applies to [] notation as well

[Fix] parse: when a custom decoder returns null for a key, ignore that key

[Refactor] parse: extract key segment splitting helper

[meta] add threat model

[actions] add workflow permissions

[Tests] stringify: increase coverage

[Dev Deps] update eslint, @ljharb/eslint-config, npmignore, es-value-fixtures, for-each, object-inspect

Commits

d9b4c66 v6.15.0
cb41a54 [New] parse: add strictMerge option to wrap object/primitive conflicts in...
88e1563 [Fix] duplicates option should not apply to bracket notation keys
9d441d2 Merge backport release tags v6.0.6–v6.13.3 into main
85cc8ca v6.12.5
ffc12aa v6.11.4
0506b11 [actions] update reusable workflows
6a37faf [actions] update reusable workflows
8e8df5a [Fix] fix regressions from robustness refactor
d60bab3 v6.10.7
Additional commits viewable in compare view

Updates axios from 1.8.4 to 1.13.5

Release notes

Sourced from axios's releases.

v1.13.5

Release 1.13.5

Highlights

Security: Fixed a potential Denial of Service issue involving the __proto__ key in mergeConfig. (PR #7369)

Bug fix: Resolved an issue where AxiosError could be missing the status field on and after v1.13.3. (PR #7368)

Changes

Security

Fix Denial of Service via __proto__ key in mergeConfig. (PR #7369)

Fixes

Fix/5657. (PR #7313)

Ensure status is present in AxiosError on and after v1.13.3. (PR #7368)

Features / Improvements

Add input validation to isAbsoluteURL. (PR #7326)

Refactor: bump minor package versions. (PR #7356)

Documentation

Clarify object-check comment. (PR #7323)

Fix deprecated Buffer constructor usage and README formatting. (PR #7371)

CI / Maintenance

Chore: fix issues with YAML. (PR #7355)

CI: update workflow YAMLs. (PR #7372)

CI: fix run condition. (PR #7373)

Dev deps: bump karma-sourcemap-loader from 0.3.8 to 0.4.0. (PR #7360)

Chore(release): prepare release 1.13.5. (PR #7379)

New Contributors

@sachin11063 (first contribution — PR #7323)

@asmitha-16 (first contribution — PR #7326)

Full Changelog: axios/axios@v1.13.4...v1.13.5

v1.13.4

Overview

The release addresses issues discovered in v1.13.3 and includes significant CI/CD improvements.

Full Changelog: v1.13.3...v1.13.4

What's New in v1.13.4

Bug Fixes

fix: issues with version 1.13.3 (#7352) (ee90dfc)

Fixed issues discovered in v1.13.3 release

... (truncated)

Changelog

Sourced from axios's changelog.

Changelog

1.13.3 (2026-01-20)

Bug Fixes

http2: Use port 443 for HTTPS connections by default. (#7256) (d7e6065)

interceptor: handle the error in the same interceptor (#6269) (5945e40)

main field in package.json should correspond to cjs artifacts (#5756) (7373fbf)

package.json: add 'bun' package.json 'exports' condition. Load the Node.js build in Bun instead of the browser build (#5754) (b89217e)

silentJSONParsing=false should throw on invalid JSON (#7253) (#7257) (7d19335)

turn AxiosError into a native error (#5394) (#5558) (1c6a86d)

types: add handlers to AxiosInterceptorManager interface (#5551) (8d1271b)

types: restore AxiosError.cause type from unknown to Error (#7327) (d8233d9)

unclear error message is thrown when specifying an empty proxy authorization (#6314) (6ef867e)

Features

add undefined as a value in AxiosRequestConfig (#5560) (095033c)

add automatic minor and patch upgrades to dependabot (#6053) (65a7584)

add Node.js coverage script using c8 (closes #7289) (#7294) (ec9d94e)

added copilot instructions (3f83143)

compatibility with frozen prototypes (#6265) (860e033)

enhance pipeFileToResponse with error handling (#7169) (88d7884)

types: Intellisense for string literals in a widened union (#6134) (f73474d), closes microsoft/TypeScript#33471

Reverts

Revert "fix: silentJSONParsing=false should throw on invalid JSON (#7253) (#7…" (#7298) (a4230f5), closes #7253 #7 #7298

deps: bump peter-evans/create-pull-request from 7 to 8 in the github-actions group (#7334) (2d6ad5e)

Contributors to this release

Ashvin Tiwari

Nikunj Mochi

Anchal Singh

jasonsaayman

Julian Dax

Akash Dhar Dubey

Madhumita

Tackoil

Justin Dhillon

Rudransh

WuMingDao

codenomnom

Nandan Acharya

Eric Dubé

Tibor Pilz

Gabriel Quaresma

Turadg Aleahmad

... (truncated)

Commits

29f7542 chore(release): prepare release 1.13.5 (#7379)
431c3a3 ci: fix run condition (#7373)
9ff3a78 ci: update ymls (#7372)
265b712 docs: fix deprecated Buffer constructor and formatting issues in README (#7371)
475e75a feat: add input validation to isAbsoluteURL (#7326)
28c7215 fix: Denial of Service via proto Key in mergeConfig (#7369)
04cf019 docs: clarify object check comment (#7323)
696fa75 fix: status is missing in AxiosError on and after v1.13.3 (#7368)
569f028 fix: added a option to choose between legacy and the new request/response int...
44b7c9f chore(deps-dev): bump karma-sourcemap-loader (#7360)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for axios since your current version.

Updates form-data from 4.0.2 to 2.5.5

Changelog

Sourced from form-data's changelog.

v4.0.2 - 2025-02-14

Merged

[Fix] set Symbol.toStringTag when available [#573](https://github.com/form-data/form-data/issues/573)

[Fix] set Symbol.toStringTag when available [#573](https://github.com/form-data/form-data/issues/573)

fix (npmignore): ignore temporary build files [#532](https://github.com/form-data/form-data/issues/532)

fix (npmignore): ignore temporary build files [#532](https://github.com/form-data/form-data/issues/532)

Fixed

[Fix] set Symbol.toStringTag when available (#573) [#396](https://github.com/form-data/form-data/issues/396)

[Fix] set Symbol.toStringTag when available (#573) [#396](https://github.com/form-data/form-data/issues/396)

[Fix] set Symbol.toStringTag when available [#396](https://github.com/form-data/form-data/issues/396)

Commits

Merge tags v2.5.3 and v3.0.3 92613b9

[Tests] migrate from travis to GHA 806eda7

[Tests] migrate from travis to GHA 8fdb3bc

[Refactor] use Object.prototype.hasOwnProperty.call 7fecefe

[Refactor] use Object.prototype.hasOwnProperty.call 6e682d4

[Refactor] use Object.prototype.hasOwnProperty.call df3c1e6

[Dev Deps] update @types/node, browserify, coveralls, cross-spawn, eslint, formidable, in-publish, pkgfiles, pre-commit, puppeteer, request, tape, typescript 8261fcb

[Dev Deps] update @types/node, browserify, coveralls, cross-spawn, eslint, formidable, in-publish, pkgfiles, pre-commit, puppeteer, request, tape, typescript fb66cb7

[Dev Deps] update @types/node, browserify, coveralls, eslint, formidable, in-publish, phantomjs-prebuilt, pkgfiles, pre-commit, request, tape, typescript 819f6b7

[eslint] clean up ignores 3217b3d

[eslint] clean up ignores 3a9d480

[Fix] Buffer.from and Buffer.alloc require node 4+ c499f76

Only apps should have lockfiles b82f590

Only apps should have lockfiles b170ee2

[Deps] update combined-stream, mime-types 6b1ca1d

[Dev Deps] pin request which via tough-cookie ^2.4 depends on psl e5df7f2

[Deps] update mime-types 5a5bafe

Bumped version 2.5.3 9457283

[Dev Deps] pin request which via tough-cookie ^2.4 depends on psl 9dbe192

Merge tags v2.5.2 and v3.0.2 d53265d

Bumped version 2.5.2 7020dd4

[Dev Deps] downgrade cross-spawn 3fc1a9b

fix: move util.isArray to Array.isArray (#564) edb555a

fix: move util.isArray to Array.isArray (#564) 10418d1

v4.0.1 - 2024-10-10

Commits

[Tests] migrate from travis to GHA 757b4e3

[eslint] clean up ignores e8f0d80

fix (npmignore): ignore temporary build files 335ad19

fix: move util.isArray to Array.isArray 440d3be

... (truncated)

Commits

40de5a7 v2.5.5
026abe5 [Fix] use proper dependency
10626c0 [meta] actually ensure the readme backup isn’t published
efe6c26 v2.5.4
c97cfbe [Tests] Switch to newer v8 prediction library; enable node 24 testing
0e93122 [Tests] handle predict-v8-randomness failures in node < 17 and node > 23
b88316c [Fix] Switch to using crypto random for boundary values
b70869d [Fix] append: avoid a crash on nullish values
131ae5e [Fix] validate boundary type in setBoundary() method
8bf2492 [eslint] update linting config
Additional commits viewable in compare view

Install script changes

This version modifies prepublish script that runs during installation. Review the package contents before updating.

Updates jws from 4.0.0 to 4.0.1

Release notes

Sourced from jws's releases.

v4.0.1

Changed

Fix advisory GHSA-869p-cjfg-cm3x: createSign and createVerify now require that a non empty secret is provided (via opts.secret, opts.privateKey or opts.key) when using HMAC algorithms.

Upgrading JWA version to 2.0.1, addressing a compatibility issue for Node >= 25.

Changelog

Sourced from jws's changelog.

[4.0.1]

Changed

Fix advisory GHSA-869p-cjfg-cm3x: createSign and createVerify now require that a non empty secret is provided (via opts.secret, opts.privateKey or opts.key) when using HMAC algorithms.

Upgrading JWA version to 2.0.1, adressing a compatibility issue for Node >= 25.

[3.2.3]

Changed

Fix advisory GHSA-869p-cjfg-cm3x: createSign and createVerify now require that a non empty secret is provided (via opts.secret, opts.privateKey or opts.key) when using HMAC algorithms.

Upgrading JWA version to 1.4.2, adressing a compatibility issue for Node >= 25.

[3.0.0]

Changed

BREAKING: jwt.verify now requires an algorithm parameter, and jws.createVerify requires an algorithm option. The "alg" field signature headers is ignored. This mitigates a critical security flaw in the library which would allow an attacker to generate signatures with arbitrary contents that would be accepted by jwt.verify. See https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/ for details.

2.0.0 - 2015-01-30

Changed

BREAKING: Default payload encoding changed from binary to utf8. utf8 is a is a more sensible default than binary because many payloads, as far as I can tell, will contain user-facing strings that could be in any language. ([6b6de48])

Code reorganization, thanks [@fearphage]! (7880050)

Added

Option in all relevant methods for encoding. For those few users that might be depending on a binary encoding of the messages, this is for them. ([6b6de48])

... (truncated)

Commits

34c45b2 Merge commit from fork
49bc39b version 4.0.1
d42350c Enhance tests for HMAC streaming sign and verify
5cb007c Improve secretOrKey initialization in VerifyStream
f9a2e1c Improve secret handling in SignStream
b9fb8d3 Merge pull request #102 from auth0/SRE-57-Upload-opslevel-yaml
95b75ee Upload OpsLevel YAML
8857ee7 test: remove unused variable (#96)
See full diff in compare view

Maintainer changes

This version was pushed to npm by julien.wollscheid, a new releaser for jws since your current version.

Updates linkifyjs from 4.2.0 to 4.3.2

Release notes

Sourced from linkifyjs's releases.

v4.3.2

What's Changed

Use Object.assign instead of custom assign function by @nfrasser in nfrasser/linkifyjs#518

Full Changelog: nfrasser/linkifyjs@v4.3.1...v4.3.2

v4.3.1

What's Changed

Use correct simple-html-tokenizer version for linkify-html

Full Changelog: nfrasser/linkifyjs@v4.3.0...v4.3.1

v4.3.0

What's Changed

Fix: allow apostrophe in URL by @patrickReiis in nfrasser/linkifyjs#504

Fix tokenizing of comments starting or ending with more than two -- by @hrb-hub in nfrasser/simple-html-tokenizer#1

Update dependencies by @nfrasser in nfrasser/linkifyjs#513

Rename dist file .cjs.js and .es.js extensions to .cjs and .mjs, respectively

Full Changelog: nfrasser/linkifyjs@v4.2.0...v4.3.0

Changelog

Sourced from linkifyjs's changelog.

v4.3.2

Replace assign helper with Object.assign to avoid prototype pollution

v4.3.1

Use correct simple-html-tokenizer version for linkify-html

v4.3.0

HTML comments opened or closed with 3 dashes tokenized correctly

Restore support for delimiter apostrophes in URLs

Rename dist file .cjs.js and .es.js extensions to .cjs and .mjs, respectively

Commits

3abe9ab v4.3.2
931d3e2 Use Object.assign instead of custom assign function (#518)
45bc27e v4.3.1
251a5c6 v4.3.0
359ed4e Update dependencies (#513)
c4bdf85 Revert "Don't allow apostrophe in URLs (#499)" (#504)
See full diff in compare view

Updates markdown-it from 14.1.0 to 14.1.1

Changelog

Sourced from markdown-it's changelog.

[14.1.1] - 2026-01-11

Security

Fixed regression from v13 in linkify inline rule. Specific patterns could cause high CPU use. Thanks to @ltduc147 for report.

Commits

b4a9b65 14.1.1 released
4b4bbca Fixed perf regression in linkify-it wrapper
d2782d8 Add supplementary example-driven documentation (#1092)
See full diff in compare view

Updates nodemailer from 6.10.1 to 7.0.13

Release notes

Sourced from nodemailer's releases.

v7.0.13

7.0.13 (2026-01-27)

Bug Fixes

downgrade transient connection error logs to warn level (4c041db)

v7.0.12

7.0.12 (2025-12-22)

Bug Fixes

added support for REQUIRETLS (#1793) (053ce6a)

use 8bit encoding for message/rfc822 attachments (adf8611)

v7.0.11

7.0.11 (2025-11-26)

Bug Fixes

prevent stack overflow DoS in addressparser with deeply nested groups (b61b9c0)

v7.0.10

7.0.10 (2025-10-23)

Bug Fixes

Increase data URI size limit from 100KB to 50MB and preserve content type (28dbf3f)

v7.0.9

7.0.9 (2025-10-07)

Bug Fixes

release: Trying to fix release proecess by upgrading Node version in runner (579fce4)

v7.0.8

7.0.8 (2025-10-07)

Bug Fixes

addressparser: flatten nested groups per RFC 5322 (8f8a77c)

v7.0.7

... (truncated)

Changelog

Sourced from nodemailer's changelog.

7.0.13 (2026-01-27)

Bug Fixes

downgrade transient connection error logs to warn level (4c041db)

7.0.12 (2025-12-22)

Bug Fixes

added support for REQUIRETLS (#1793) (053ce6a)

use 8bit encoding for message/rfc822 attachments (adf8611)

7.0.11 (2025-11-26)

Bug Fixes

prevent stack overflow DoS in addressparser with deeply nested groups (b61b9c0)

7.0.10 (2025-10-23)

Bug Fixes

Increase data URI size limit from 100KB to 50MB and preserve content type (28dbf3f)

7.0.9 (2025-10-07)

Bug Fixes

release: Trying to fix release proecess by upgrading Node version in runner (579fce4)

7.0.8 (2025-10-07)

Bug Fixes

addressparser: flatten nested groups per RFC 5322 (8f8a77c)

7.0.7 (2025-10-05)

Bug Fixes

addressparser: Fixed addressparser handling of quoted nested email addresses (1150d99)

dns: add memory leak prevention for DNS cache (0240d67)

linter: Updated eslint and created prettier formatting task (df13b74)

... (truncated)

Commits

8931195 chore(master): release 7.0.13 (#1798)
9398d63 Bumped deps
4c041db fix: downgrade transient connection error logs to warn level
a208a0b chore(master): release 7.0.12 (#1785)
053ce6a fix: added support for REQUIRETLS (#1793)
adf8611 fix: use 8bit encoding for message/rfc822 attachments
3d17dbe chore(master): release 7.0.11 (#1783)
15879f8 Bumped dev dependencies
b61b9c0 fix: prevent stack overflow DoS in addressparser with deeply nested groups
4175e4b chore(master): release 7.0.10 (#1776)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for nodemailer since your current version.

Updates on-headers from 1.0.2 to 1.1.0

Release notes

Sourced from on-headers's releases.

1.1.0

Important

Fix CVE-2025-7339 (GHSA-76c9-3jph-rj3q)

What's Changed

Migrate CI pipeline to GitHub actions by @carpasse in jshttp/on-headers#12

fix README.md badges by @carpasse in jshttp/on-headers#13

add OSSF scorecard action by @carpasse in jshttp/on-headers#14

fix: use ubuntu-latest as ci runner by @UlisesGascon in jshttp/on-headers#19

ci: apply OSSF Scorecard security best practices by @UlisesGascon in jshttp/on-headers#20

👷 add upstream change detection by @ctcpip in jshttp/on-headers#31

✨ add script to update known hashes by @ctcpip in jshttp/on-headers#32

💚 update CI - add newer node versions by @ctcpip in jshttp/on-headers#33

New Contributors

@carpasse made their first contribution in jshttp/on-headers#12

@UlisesGascon made their first contribution in jshttp/on-headers#19

@ctcpip made their first contribution in jshttp/on-headers#31

Full Changelog: jshttp/on-headers@v1.0.2...v1.1.0

Changelog

Sourced from on-headers's changelog.

1.1.0 / 2025-07-17

Fix CVE-2025-7339 (GHSA-76c9-3jph-rj3q)

Commits

4b017af 1.1.0
b636f2d ♻️ refactor header array code
3e2c2d4 ✨ ignore falsy header keys, matching node behavior
172eb41 ✨ support duplicate headers
c6e3849 🔒️ fix array handling
6893518 💚 update CI - add newer node versions
56a345d ✨ add script to update known hashes
175ab21 👷 add upstream change detection (#31)
ce0b2c8 ci: apply OSSF Scorecard security best practices (#20)
1a38c54 fix: use ubuntu-latest as ci runner (#19)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for on-headers since your current version.

Updates tar-fs from 2.1.3 to 2.1.4

Commits

f421a23 2.1.4
c412fa1 refactor to same pattern as v3
See full diff in compare view

Updates undici from 6.21.2 to 6.23.0

Release notes

Sourced from undici's releases.

v6.23.0

⚠️ Security Release

This fixes GHSA-g9mf-h72j-4rw9 and CVE-2026-22036.

Full Changelog: nodejs/undici@v6.22.0...v6.23.0

v6.22.0

What's Changed

fix: fix wrong stream canceled up after cloning (v6) by @snyamathi in nodejs/undici#4414

[Backport v6.x] fix: fix EnvHttpProxyAgent for the Node.js bundle by

… updates Bumps the npm_and_yarn group with 10 updates in the /website directory: | Package | From | To | | --- | --- | --- | | [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.17.23` | | [js-yaml](https://github.com/nodeca/js-yaml) | `3.14.1` | `3.14.2` | | [glob](https://github.com/isaacs/node-glob) | `10.4.5` | `10.5.0` | | [qs](https://github.com/ljharb/qs) | `6.14.0` | `6.15.0` | | [axios](https://github.com/axios/axios) | `1.8.4` | `1.13.5` | | [jws](https://github.com/brianloveswords/node-jws) | `4.0.0` | `4.0.1` | | [linkifyjs](https://github.com/nfrasser/linkifyjs/tree/HEAD/packages/linkifyjs) | `4.2.0` | `4.3.2` | | [markdown-it](https://github.com/markdown-it/markdown-it) | `14.1.0` | `14.1.1` | | [undici](https://github.com/nodejs/undici) | `6.21.2` | `6.23.0` | | [webpack](https://github.com/webpack/webpack) | `5.99.6` | `5.105.2` | Bumps the npm_and_yarn group with 1 update in the /website/e2e directory: [playwright](https://github.com/microsoft/playwright). Updates `lodash` from 4.17.21 to 4.17.23 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.17.23) Updates `js-yaml` from 3.14.1 to 3.14.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.14.1...3.14.2) Updates `glob` from 10.4.5 to 10.5.0 - [Changelog](https://github.com/isaacs/node-glob/blob/main/changelog.md) - [Commits](isaacs/node-glob@v10.4.5...v10.5.0) Updates `qs` from 6.14.0 to 6.15.0 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.14.0...v6.15.0) Updates `axios` from 1.8.4 to 1.13.5 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.8.4...v1.13.5) Updates `form-data` from 4.0.2 to 2.5.5 - [Release notes](https://github.com/form-data/form-data/releases) - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v4.0.2...v2.5.5) Updates `jws` from 4.0.0 to 4.0.1 - [Release notes](https://github.com/brianloveswords/node-jws/releases) - [Changelog](https://github.com/auth0/node-jws/blob/master/CHANGELOG.md) - [Commits](auth0/node-jws@v4.0.0...v4.0.1) Updates `linkifyjs` from 4.2.0 to 4.3.2 - [Release notes](https://github.com/nfrasser/linkifyjs/releases) - [Changelog](https://github.com/nfrasser/linkifyjs/blob/main/CHANGELOG.md) - [Commits](https://github.com/nfrasser/linkifyjs/commits/v4.3.2/packages/linkifyjs) Updates `markdown-it` from 14.1.0 to 14.1.1 - [Changelog](https://github.com/markdown-it/markdown-it/blob/master/CHANGELOG.md) - [Commits](markdown-it/markdown-it@14.1.0...14.1.1) Updates `nodemailer` from 6.10.1 to 7.0.13 - [Release notes](https://github.com/nodemailer/nodemailer/releases) - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](nodemailer/nodemailer@v6.10.1...v7.0.13) Updates `on-headers` from 1.0.2 to 1.1.0 - [Release notes](https://github.com/jshttp/on-headers/releases) - [Changelog](https://github.com/jshttp/on-headers/blob/master/HISTORY.md) - [Commits](jshttp/on-headers@v1.0.2...v1.1.0) Updates `tar-fs` from 2.1.3 to 2.1.4 - [Commits](mafintosh/tar-fs@v2.1.3...v2.1.4) Updates `undici` from 6.21.2 to 6.23.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v6.21.2...v6.23.0) Updates `webpack` from 5.99.6 to 5.105.2 - [Release notes](https://github.com/webpack/webpack/releases) - [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md) - [Commits](webpack/webpack@v5.99.6...v5.105.2) Updates `playwright` from 1.52.0 to 1.58.2 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.52.0...v1.58.2) --- updated-dependencies: - dependency-name: lodash dependency-version: 4.17.23 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 3.14.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: glob dependency-version: 10.5.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.15.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: axios dependency-version: 1.13.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: form-data dependency-version: 2.5.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: jws dependency-version: 4.0.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: linkifyjs dependency-version: 4.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: markdown-it dependency-version: 14.1.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: nodemailer dependency-version: 7.0.13 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: on-headers dependency-version: 1.1.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tar-fs dependency-version: 2.1.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 6.23.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: webpack dependency-version: 5.105.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: playwright dependency-version: 1.58.2 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot bot requested a review from killev as a code owner February 20, 2026 01:54

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Feb 20, 2026

dependabot bot requested a review from vasilyyaremchuk as a code owner February 20, 2026 01:54

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build(deps): bump the npm_and_yarn group across 2 directories with 15 updates#249

build(deps): bump the npm_and_yarn group across 2 directories with 15 updates#249
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/website/npm_and_yarn-533f9d1f17

dependabot bot commented on behalf of github Feb 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot bot commented on behalf of github Feb 20, 2026

[3.14.2] - 2025-11-15

Security

[4.1.1] - 2025-11-12

Security

[4.1.0] - 2021-04-15

Added

Changed

[4.0.0] - 2021-01-03

Changed

Added

6.15.0

6.14.2

6.14.1

v1.13.5

Release 1.13.5

Highlights

Changes

Security

Fixes

Features / Improvements

Documentation

CI / Maintenance

New Contributors

v1.13.4

Overview

What's New in v1.13.4

Bug Fixes

Changelog

1.13.3 (2026-01-20)

Bug Fixes

Features

Reverts

Contributors to this release

v4.0.2 - 2025-02-14

Merged

Fixed

Commits

v4.0.1 - 2024-10-10

Commits

v4.0.1

Changed

[4.0.1]

Changed

[3.2.3]

Changed

[3.0.0]

Changed

2.0.0 - 2015-01-30

Changed

Added

v4.3.2

What's Changed

v4.3.1

What's Changed

v4.3.0

What's Changed

v4.3.2

v4.3.1

v4.3.0

[14.1.1] - 2026-01-11

Security

v7.0.13

7.0.13 (2026-01-27)

Bug Fixes

v7.0.12

7.0.12 (2025-12-22)

Bug Fixes

v7.0.11

7.0.11 (2025-11-26)

Bug Fixes

v7.0.10

7.0.10 (2025-10-23)

Bug Fixes

v7.0.9

7.0.9 (2025-10-07)

Bug Fixes

v7.0.8

7.0.8 (2025-10-07)