Skip to content

Bump the npm_and_yarn group across 20 directories with 13 updates - #775

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-56b1f8209a
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-56b1f8209a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 1, 2026

Copy link
Copy Markdown

Bumps the npm_and_yarn group with 5 updates in the / directory:

Package From To
undici 5.28.4 6.28.1
electron 23.1.2 41.10.6
immutable 4.0.0-rc.12 4.3.9
adm-zip 0.4.13 0.4.16
browserslist 4.8.5 4.29.3

Bumps the npm_and_yarn group with 5 updates in the /compiler directory:

Package From To
undici 6.23.0 6.29.0
browserslist 4.24.4 4.29.3
js-yaml 3.14.1 3.15.2
qs 6.14.0 6.16.0
joi 17.13.1 17.13.8

Bumps the npm_and_yarn group with 5 updates in the /compiler/apps/playground directory:

Package From To
browserslist 4.24.0 4.29.3
js-yaml 4.1.0 4.3.2
joi 17.13.3 17.13.8
next 15.5.9 15.5.24
sharp 0.34.3 0.35.5

Bumps the npm_and_yarn group with 1 update in the /compiler/packages/react-forgive/server directory: browserslist.
Bumps the npm_and_yarn group with 1 update in the /fixtures/eslint-v6 directory: js-yaml.
Bumps the npm_and_yarn group with 2 updates in the /fixtures/eslint-v7 directory: js-yaml and fast-uri.
Bumps the npm_and_yarn group with 1 update in the /fixtures/eslint-v8 directory: js-yaml.
Bumps the npm_and_yarn group with 1 update in the /fixtures/eslint-v9 directory: js-yaml.
Bumps the npm_and_yarn group with 1 update in the /fixtures/fizz directory: browserslist.
Bumps the npm_and_yarn group with 4 updates in the /fixtures/flight directory: undici, browserslist, js-yaml and colord.
Bumps the npm_and_yarn group with 2 updates in the /fixtures/flight-parcel directory: browserslist and js-yaml.
Bumps the npm_and_yarn group with 3 updates in the /fixtures/flight-ssr-bench directory: browserslist, fast-uri and baseline-browser-mapping.
Bumps the npm_and_yarn group with 2 updates in the /fixtures/legacy-jsx-runtimes directory: browserslist and js-yaml.
Bumps the npm_and_yarn group with 3 updates in the /fixtures/owner-stacks directory: browserslist, fast-uri and colord.
Bumps the npm_and_yarn group with 1 update in the /fixtures/packaging/webpack-alias/dev directory: qs.
Bumps the npm_and_yarn group with 1 update in the /fixtures/packaging/webpack-alias/prod directory: qs.
Bumps the npm_and_yarn group with 1 update in the /fixtures/packaging/webpack/dev directory: qs.
Bumps the npm_and_yarn group with 1 update in the /fixtures/packaging/webpack/prod directory: qs.
Bumps the npm_and_yarn group with 2 updates in the /fixtures/ssr2 directory: browserslist and qs.
Bumps the npm_and_yarn group with 3 updates in the /fixtures/view-transition directory: browserslist, fast-uri and colord.

Updates undici from 5.28.4 to 6.28.1

Release notes

Sourced from undici's releases.

v6.28.1

⚠️ Security fixes

High severity

  • GHSA-rfgv-xxqx-mfg5: a WebSocket server could select a subprotocol when none was requested, causing an uncaught TypeError that could terminate the process. Undici now rejects the handshake with protocol error 1002. Fixed by 2af0faf8.

Medium severity

  • GHSA-3wwx-pv8p-q78v: a malformed permessage-deflate payload exceeding the configured decompression limit could emit an unhandled zlib error and terminate the process. Undici now destroys the inflater after reaching the limit. Fixed by 07c60d9c.

Low severity

  • GHSA-r53p-7pc4-xj5r: the retry interceptor could concatenate a resumed response with inconsistent framing into downstream output, enabling response splitting or corruption. Undici now validates Content-Range against the original response framing before resuming. Fixed by ce31bc82.

What's Changed

Full Changelog: nodejs/undici@v6.28.0...v6.28.1

v6.28.0

⚠️ Security fixes

  • GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 740a0b7c.
  • GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by cba3a52a, with corrected fixtures in 4fd5a0c6.
  • GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by af748404.

GHSA-4cwx-7wf7-3272 and GHSA-jr45-8vmc-qm54 affect the cache interceptor in Undici v7 and v8; Undici v6 is not in their affected version ranges.

Full Changelog: nodejs/undici@v6.27.0...v6.28.0

v6.27.0

⚠️ Security Release

This release line addresses 4 security advisories.

Action required: Upgrade to undici 6.27.0 or later.

npm install undici@^6.27.0

Note on patched version: the v6 fixes shipped in v6.27.0, not 6.26.0 — v6.26.0 contains only the chunked-EOF fix (#5308) and the version bump, none of the security fixes below.

... (truncated)

Commits
  • ffc8aa0 Bumped v6.28.1 (#5773)
  • 3866a3b perf(h1): drop idle-socket timer floor with a ref'd setImmediate (#5707) (#5770)
  • ce31bc8 fix(retry): validate resumed response framing
  • 2af0faf fix(websocket): reject unrequested subprotocols
  • 07c60d9 fix(websocket): destroy inflater after decompression limit
  • bd90fff perf: reduce EventSourceStream parser allocations (#5032) (#5647)
  • 01a912e Bumped v6.28.0 (#5591)
  • 481ecfc Use Node 22 and npm 11 to release
  • 740a0b7 fix: validate blob body content type
  • 2698e49 fix: validate coerced header values for CRLF (#5579)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for undici since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates electron from 23.1.2 to 41.10.6

Release notes

Sourced from electron's releases.

electron v41.10.6

Release Notes for v41.10.6

Fixes

  • Fixed registerFileProtocol and registerHttpProtocol returning readable responses to cross-origin no-cors fetches; they now return opaque responses like protocol.handle. #52854 (Also in 42, 43, 44)
  • Fixed an issue on Windows where the app process could fail to exit after app.quit() while a shell.openExternal() or shell.openPath() call was still waiting on a system "Open with" dialog. #52899 (Also in 43, 44)
  • Fixed windows opened by a sandboxed top-level frame not inheriting the opener's sandbox restrictions. #52849 (Also in 42, 43, 44)
  • <webview> and window.open now inherit nodeIntegrationInWorker from the embedder, consistent with the other Node and sandbox preferences. #52829 (Also in 42, 43, 44)

Other Changes

  • Backported fixes from upstream ANGLE, Chromium and Skia. #52707
  • Backported fixes from upstream Chromium and V8. #52775

electron v41.10.5

Release Notes for v41.10.5

Fixes

  • Fixed an issue where the Squirrel.Mac installer could resolve the target bundle path to different locations at different stages of an install. #50764 (Also in 39, 42)

Other Changes

  • Backported fixes from upstream ANGLE, Chromium, Skia and V8. #52702
  • No user-facing change; semver/none. #52734

electron v41.10.4

Release Notes for v41.10.4

Fixes

  • Fixed a UAF with protocol.registerStreamProtocol when an error is emitted during a read. #52513 (Also in 42, 43, 44)
  • Fixed a crash that could occur when closing DevTools while the host WebContents was being destroyed. #52512 (Also in 42, 43, 44)
  • Windows opened from links inside a sandboxed iframe now inherit the iframe's sandbox restrictions unless allow-popups-to-escape-sandbox is set. #52486 (Also in 42, 43)

electron v41.10.3

Release Notes for v41.10.3

Fixes

  • Fixed app.disableHardwareAcceleration() not fully disabling GPU hardware usage on Windows starting from Electron 38. #52368 (Also in 42, 43, 44)
  • Fixed unnecessary autofill popup creation for fields without datalist suggestions, which could cause input latency on macOS. #52320 (Also in 42, 43, 44)

Other Changes

  • Backported fixes from upstream Chromium and V8. #52396

electron v41.10.2

Release Notes for v41.10.2

Fixes

... (truncated)

Commits
  • 832e70a fix: don't let pending shell operations block app exit on Windows (#52899)
  • b8d49a4 chore: cherry-pick 39 changes from angle, chromium and skia (#52707)
  • 29fc130 fix: inherit sandbox flags in windows opened by a sandboxed top-level frame (...
  • c595b05 fix: return opaque responses from file and http protocol handlers for cross-o...
  • 6462a2e fix: inherit nodeIntegrationInWorker from the embedder for <webview> and wind...
  • d9c6215 chore: cherry-pick 4 changes from chromium and v8 (#52775)
  • a46a5af build: run the Windows builds on the VM runners (41-x-y) (#52770)
  • 5bff19c build: add release-assets.json expected-asset manifest (41-x-y) (#52734)
  • 15e2928 fix: resolve target bundle path once at start of install (#50764)
  • 2ba8050 chore: cherry-pick 33 changes from angle, chromium, skia and v8 (#52702)
  • Additional commits viewable in compare view

Updates immutable from 4.0.0-rc.12 to 4.3.9

Release notes

Sourced from immutable's releases.

v4.3.9

What's changed

Full Changelog: immutable-js/immutable-js@v4.3.8...v4.3.9

v4.3.8

Fix Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

v4.3.7

What's Changed

Full Changelog: immutable-js/immutable-js@v4.3.6...v4.3.7

v4.3.6

What's Changed

Internals

New Contributors

Full Changelog: immutable-js/immutable-js@v4.3.5...v4.3.6

v4.3.5

What's Changed

New Contributors

Full Changelog: immutable-js/immutable-js@v4.3.4...v4.3.5

4.3.4

What's Changed

... (truncated)

Changelog

Sourced from immutable's changelog.

4.3.9

5.1.7

  • fix(Repeat): lastIndexOf returned size instead of size - 1 by @​chatman-media in immutable-js/immutable-js#2227. Fixes CVE CVE-2026-29063
  • fix(IndexedCollection): has(index) on a lazy Seq of unknown size now checks index existence instead of searching for a value equal to the index #2203
  • [TypeScript]: reduce/reduceRight without an initial value now infer the result type from the collection's values when the reducer returns a value (e.g. list.reduce((a, b) => a + b) infers number), matching Array#reduce. Previously an explicit type argument was required. #2205

5.1.6

  • fix(reverseFactory): read reversedSequence.size in __iterator instead of this #2196

5.1.5

  • Fix Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

5.1.4

Documentation

Internal

5.1.3

TypeScript

Documentation

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for immutable since your current version.


Updates adm-zip from 0.4.13 to 0.4.16

Changelog

Sourced from adm-zip's changelog.

0.4.16 / 2020-06-23

  • Updated mocha version to fix vulnerability (cthackers)
  • Update project version (cthackers)
  • fix: throw real exception objects on error (Matthew Sainsbury)
  • Version number incremented (Saqib M)
  • Update zipFile.js (Saqib M)
  • Update README.md with the latest URLs (Takuya Noguchi)
  • Update Node.js version to use in CI tests (Takuya Noguchi)
  • process.versions is null when the library is used in browser (Emiliano Necciari)

0.4.14 / 2020-02-06

  • Version increment for npm publish (cthackers)
  • Iterate over entries without storing their metadata (Pierre Lehnen)
  • Add partial support for zip64 (larger number of entries) (Pierre Lehnen)
  • Escape $ sign for regex in addLocalFolder() (William)
  • fix accent filename (mart_-)
  • Removed improperly raised error while decompressing empty file asynchronously. (Nicolas Leclerc)
  • fix: CRC is unexpectedly changed after zip is re-created (teppeis)
Commits
  • 9d2eb0b Updated mocha version to fix vulnerability
  • 9bb5fb9 Update project version
  • 10a8c1c Merge pull request #250 from opichals/patch-1
  • c87b983 Merge pull request #279 from willjouo/master
  • de614ea Merge pull request #308 from tnir/copyedit-docs-with-https
  • b94b8e5 Merge pull request #307 from tnir/update-nodejs-for-testing
  • ff355f5 Merge pull request #313 from mattsains/master
  • a13f520 Merge pull request #312 from saqibmushtaq/master
  • 79c21ff fix: throw real exception objects on error
  • 235e7bf Version number incremented
  • Additional commits viewable in compare view

Updates browserslist from 4.8.5 to 4.29.3

Release notes

Sourced from browserslist's releases.

4.29.3

  • Updated Firefox ESR.

4.29.2

  • Fixed ignoring null usage in cover X in Y query (by @​wahidrizka).

4.29.1

4.29.0

  • Added query continuations across lines and array entries (by @​fzlzjerry).

4.28.9

4.28.8

  • Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

4.28.6

4.28.5

4.28.4

  • Fixed SyntaxError regression of 4.28.3.

4.28.3

  • Fixed baseline query case-insensitivity (by @​swwind).

4.28.2

4.28.1

  • Removed Baseline warning since we have it own warning.

4.27.0

  • Added BROWSERSLIST_TRACE_WARNING environment variable.

4.26.3

... (truncated)

Changelog

Sourced from browserslist's changelog.

4.29.3

  • Updated Firefox ESR.

4.29.2

  • Fixed ignoring null usage in cover X in Y query (by @​wahidrizka).

4.29.1

4.29.0

  • Added query continuations across lines and array entries (by @​fzlzjerry).

4.28.9

4.28.8

  • Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

4.28.6

4.28.5

4.28.4

  • Fixed SyntaxError regression of 4.28.3.

4.28.3

  • Fixed baseline query case-insensitivity (by @​swwind).

... (truncated)

Commits
  • b4809dd Release 4.29.3 version
  • 9d844f8 Update Firefox ESR
  • 0033f34 Update dependencies
  • 906d329 Release 4.29.2 version
  • ff8c83f Update dependencies
  • 067f4a1 Merge pull request #952 from wahidrizka/fix-cover-null-usage
  • f760921 Do not add versions without usage data to cover queries
  • 5be63f5 Merge pull request #953 from wahidrizka/docs-android-latest-version
  • 1e5356f Note that Android version queries return only the latest version
  • 5b7e941 Add missed changes to ChangeLog
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for browserslist since your current version.


Updates undici from 6.23.0 to 6.29.0

Release notes

Sourced from undici's releases.

v6.28.1

⚠️ Security fixes

High severity

  • GHSA-rfgv-xxqx-mfg5: a WebSocket server could select a subprotocol when none was requested, causing an uncaught TypeError that could terminate the process. Undici now rejects the handshake with protocol error 1002. Fixed by 2af0faf8.

Medium severity

  • GHSA-3wwx-pv8p-q78v: a malformed permessage-deflate payload exceeding the configured decompression limit could emit an unhandled zlib error and terminate the process. Undici now destroys the inflater after reaching the limit. Fixed by 07c60d9c.

Low severity

  • GHSA-r53p-7pc4-xj5r: the retry interceptor could concatenate a resumed response with inconsistent framing into downstream output, enabling response splitting or corruption. Undici now validates Content-Range against the original response framing before resuming. Fixed by ce31bc82.

What's Changed

Full Changelog: nodejs/undici@v6.28.0...v6.28.1

v6.28.0

⚠️ Security fixes

  • GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 740a0b7c.
  • GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by cba3a52a, with corrected fixtures in 4fd5a0c6.
  • GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by af748404.

GHSA-4cwx-7wf7-3272 and GHSA-jr45-8vmc-qm54 affect the cache interceptor in Undici v7 and v8; Undici v6 is not in their affected version ranges.

Full Changelog: nodejs/undici@v6.27.0...v6.28.0

v6.27.0

⚠️ Security Release

This release line addresses 4 security advisories.

Action required: Upgrade to undici 6.27.0 or later.

npm install undici@^6.27.0

Note on patched version: the v6 fixes shipped in v6.27.0, not 6.26.0 — v6.26.0 contains only the chunked-EOF fix (#5308) and the version bump, none of the security fixes below.

... (truncated)

Commits
  • ffc8aa0 Bumped v6.28.1 (#5773)
  • 3866a3b perf(h1): drop idle-socket timer floor with a ref'd setImmediate (#5707) (#5770)
  • ce31bc8 fix(retry): validate resumed response framing
  • 2af0faf fix(websocket): reject unrequested subprotocols
  • 07c60d9 fix(websocket): destroy inflater after decompression limit
  • bd90fff perf: reduce EventSourceStream parser allocations (#5032) (#5647)
  • 01a912e Bumped v6.28.0 (#5591)
  • 481ecfc Use Node 22 and npm 11 to release
  • 740a0b7 fix: validate blob body content type
  • 2698e49 fix: validate coerced header values for CRLF (#5579)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for undici since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates browserslist from 4.24.4 to 4.29.3

Release notes

Sourced from browserslist's releases.

4.29.3

  • Updated Firefox ESR.

4.29.2

  • Fixed ignoring null usage in cover X in Y query (by @​wahidrizka).

4.29.1

4.29.0

  • Added query continuations across lines and array entries (by @​fzlzjerry).

4.28.9

4.28.8

  • Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

4.28.6

4.28.5

4.28.4

  • Fixed SyntaxError regression of 4.28.3.

4.28.3

  • Fixed baseline query case-insensitivity (by @​swwind).

4.28.2

4.28.1

  • Removed Baseline warning since we have it own warning.

4.27.0

  • Added BROWSERSLIST_TRACE_WARNING environment variable.

4.26.3

... (truncated)

Changelog

Sourced from browserslist's changelog.

4.29.3

  • Updated Firefox ESR.

4.29.2

  • Fixed ignoring null usage in cover X in Y query (by @​wahidrizka).

4.29.1

4.29.0

  • Added query continuations across lines and array entries (by @​fzlzjerry).

4.28.9

4.28.8

  • Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

4.28.6

4.28.5

4.28.4

  • Fixed SyntaxError regression of 4.28.3.

4.28.3

  • Fixed baseline query case-insensitivity (by @​swwind).

... (truncated)

Commits
  • b4809dd Release 4.29.3 version
  • 9d844f8 Update Firefox ESR
  • 0033f34 Update dependencies
  • 906d329 Release 4.29.2 version
  • ff8c83f Update dependencies
  • 067f4a1 Merge pull request #952 from wahidrizka/fix-cover-null-usage
  • f760921 Do not add versions without usage data to cover queries
  • 5be63f5 Merge pull request #953 from wahidrizka/docs-android-latest-version
  • 1e5356f Note that Android version queries return only the latest version
  • 5b7e941 Add missed changes to ChangeLog
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for browserslist since your current version.


Updates js-yaml from 3.14.1 to 3.15.2

Changelog

Sourced from js-yaml's changelog.

3.15.2 - 2026-08-26

Changed

  • [backport] Hard-limit merge sequence size to 100.

Security

  • [backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

3.15.1 - 2026-07-31

Security

  • [backport] Remove quadratic complexity from !!omap duplicate key detection.

3.15.0 - 2026-06-27

Added

  • Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one safeLoad() / safeLoadAll() call.

[3.14.2] - 2025-11-15

Security

  • Fix prototype pollution in merge (<<).
Commits

Updates qs from 6.14.0 to 6.16.0

Changelog

Sourced from qs's changelog.

6.16.0

  • [New] stringify: add a depth option to bound recursion depth (default Infinity)
  • [Fix] stringify: serialize Date values when a filter is provided
  • [Fix] parse: enforce arrayLimit on comma groups under []= when throwOnLimitExceeded is set
  • [Fix] parse: flatten a collection appended to an overflowed array (#571)
  • [Fix] utils: isBuffer: do not invoke a non-callable constructor.isBuffer
  • [Fix] stringify: do not let allowEmptyArrays skip cycle detection (or drop own keys) on an empty array with own properties
  • [Fix] stringify: encode dots in a top-level key with a primitive value when encodeDotInKeys is set (#562)
  • [Docs] thre...

    Description has been truncated

Bumps the npm_and_yarn group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [undici](https://github.com/nodejs/undici) | `5.28.4` | `6.28.1` |
| [electron](https://github.com/electron/electron) | `23.1.2` | `41.10.6` |
| [immutable](https://github.com/immutable-js/immutable-js) | `4.0.0-rc.12` | `4.3.9` |
| [adm-zip](https://github.com/cthackers/adm-zip) | `0.4.13` | `0.4.16` |
| [browserslist](https://github.com/browserslist/browserslist) | `4.8.5` | `4.29.3` |

Bumps the npm_and_yarn group with 5 updates in the /compiler directory:

| Package | From | To |
| --- | --- | --- |
| [undici](https://github.com/nodejs/undici) | `6.23.0` | `6.29.0` |
| [browserslist](https://github.com/browserslist/browserslist) | `4.24.4` | `4.29.3` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `3.14.1` | `3.15.2` |
| [qs](https://github.com/ljharb/qs) | `6.14.0` | `6.16.0` |
| [joi](https://github.com/hapijs/joi) | `17.13.1` | `17.13.8` |

Bumps the npm_and_yarn group with 5 updates in the /compiler/apps/playground directory:

| Package | From | To |
| --- | --- | --- |
| [browserslist](https://github.com/browserslist/browserslist) | `4.24.0` | `4.29.3` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.0` | `4.3.2` |
| [joi](https://github.com/hapijs/joi) | `17.13.3` | `17.13.8` |
| [next](https://github.com/vercel/next.js) | `15.5.9` | `15.5.24` |
| [sharp](https://github.com/lovell/sharp) | `0.34.3` | `0.35.5` |

Bumps the npm_and_yarn group with 1 update in the /compiler/packages/react-forgive/server directory: [browserslist](https://github.com/browserslist/browserslist).
Bumps the npm_and_yarn group with 1 update in the /fixtures/eslint-v6 directory: [js-yaml](https://github.com/nodeca/js-yaml).
Bumps the npm_and_yarn group with 2 updates in the /fixtures/eslint-v7 directory: [js-yaml](https://github.com/nodeca/js-yaml) and [fast-uri](https://github.com/fastify/fast-uri).
Bumps the npm_and_yarn group with 1 update in the /fixtures/eslint-v8 directory: [js-yaml](https://github.com/nodeca/js-yaml).
Bumps the npm_and_yarn group with 1 update in the /fixtures/eslint-v9 directory: [js-yaml](https://github.com/nodeca/js-yaml).
Bumps the npm_and_yarn group with 1 update in the /fixtures/fizz directory: [browserslist](https://github.com/browserslist/browserslist).
Bumps the npm_and_yarn group with 4 updates in the /fixtures/flight directory: [undici](https://github.com/nodejs/undici), [browserslist](https://github.com/browserslist/browserslist), [js-yaml](https://github.com/nodeca/js-yaml) and [colord](https://github.com/omgovich/colord).
Bumps the npm_and_yarn group with 2 updates in the /fixtures/flight-parcel directory: [browserslist](https://github.com/browserslist/browserslist) and [js-yaml](https://github.com/nodeca/js-yaml).
Bumps the npm_and_yarn group with 3 updates in the /fixtures/flight-ssr-bench directory: [browserslist](https://github.com/browserslist/browserslist), [fast-uri](https://github.com/fastify/fast-uri) and [baseline-browser-mapping](https://github.com/web-platform-dx/baseline-browser-mapping).
Bumps the npm_and_yarn group with 2 updates in the /fixtures/legacy-jsx-runtimes directory: [browserslist](https://github.com/browserslist/browserslist) and [js-yaml](https://github.com/nodeca/js-yaml).
Bumps the npm_and_yarn group with 3 updates in the /fixtures/owner-stacks directory: [browserslist](https://github.com/browserslist/browserslist), [fast-uri](https://github.com/fastify/fast-uri) and [colord](https://github.com/omgovich/colord).
Bumps the npm_and_yarn group with 1 update in the /fixtures/packaging/webpack-alias/dev directory: [qs](https://github.com/ljharb/qs).
Bumps the npm_and_yarn group with 1 update in the /fixtures/packaging/webpack-alias/prod directory: [qs](https://github.com/ljharb/qs).
Bumps the npm_and_yarn group with 1 update in the /fixtures/packaging/webpack/dev directory: [qs](https://github.com/ljharb/qs).
Bumps the npm_and_yarn group with 1 update in the /fixtures/packaging/webpack/prod directory: [qs](https://github.com/ljharb/qs).
Bumps the npm_and_yarn group with 2 updates in the /fixtures/ssr2 directory: [browserslist](https://github.com/browserslist/browserslist) and [qs](https://github.com/ljharb/qs).
Bumps the npm_and_yarn group with 3 updates in the /fixtures/view-transition directory: [browserslist](https://github.com/browserslist/browserslist), [fast-uri](https://github.com/fastify/fast-uri) and [colord](https://github.com/omgovich/colord).


Updates `undici` from 5.28.4 to 6.28.1
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v5.28.4...v6.28.1)

Updates `electron` from 23.1.2 to 41.10.6
- [Release notes](https://github.com/electron/electron/releases)
- [Commits](electron/electron@v23.1.2...v41.10.6)

Updates `immutable` from 4.0.0-rc.12 to 4.3.9
- [Release notes](https://github.com/immutable-js/immutable-js/releases)
- [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md)
- [Commits](immutable-js/immutable-js@v4.0.0-rc.12...v4.3.9)

Updates `adm-zip` from 0.4.13 to 0.4.16
- [Release notes](https://github.com/cthackers/adm-zip/releases)
- [Changelog](https://github.com/cthackers/adm-zip/blob/master/history.md)
- [Commits](cthackers/adm-zip@v0.4.13...v0.4.16)

Updates `browserslist` from 4.8.5 to 4.29.3
- [Release notes](https://github.com/browserslist/browserslist/releases)
- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md)
- [Commits](browserslist/browserslist@4.8.5...4.29.3)

Updates `undici` from 6.23.0 to 6.29.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v5.28.4...v6.28.1)

Updates `browserslist` from 4.24.4 to 4.29.3
- [Release notes](https://github.com/browserslist/browserslist/releases)
- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md)
- [Commits](browserslist/browserslist@4.8.5...4.29.3)

Updates `js-yaml` from 3.14.1 to 3.15.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/3.15.2/CHANGELOG.md)
- [Commits](nodeca/js-yaml@3.14.1...3.15.2)

Updates `qs` from 6.14.0 to 6.16.0
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.14.0...v6.16.0)

Updates `joi` from 17.13.1 to 17.13.8
- [Commits](hapijs/joi@v17.13.1...v17.13.8)

Updates `browserslist` from 4.24.0 to 4.29.3
- [Release notes](https://github.com/browserslist/browserslist/releases)
- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md)
- [Commits](browserslist/browserslist@4.8.5...4.29.3)

Updates `js-yaml` from 4.1.0 to 4.3.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/3.15.2/CHANGELOG.md)
- [Commits](nodeca/js-yaml@3.14.1...3.15.2)

Updates `joi` from 17.13.3 to 17.13.8
- [Commits](hapijs/joi@v17.13.1...v17.13.8)

Updates `next` from 15.5.9 to 15.5.24
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v15.5.9...v15.5.24)

Updates `sharp` from 0.34.3 to 0.35.5
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](lovell/sharp@v0.34.3...v0.35.5)

Updates `browserslist` from 4.24.3 to 4.29.3
- [Release notes](https://github.com/browserslist/browserslist/releases)
- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md)
- [Commits](browserslist/browserslist@4.8.5...4.29.3)

Updates `js-yaml` from 3.14.1 to 3.15.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/3.15.2/CHANGELOG.md)
- [Commits](nodeca/js-yaml@3.14.1...3.15.2)

Updates `js-yaml` from 3.14.1 to 3.15.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/3.15.2/CHANGELOG.md)
- [Commits](nodeca/js-yaml@3.14.1...3.15.2)

Updates `fast-uri` from 3.0.6 to 3.1.8
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.0.6...v3.1.8)

Updates `js-yaml` from 4.1.0 to 4.3.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/3.15.2/CHANGELOG.md)
- [Commits](nodeca/js-yaml@3.14.1...3.15.2)

Updates `js-yaml` from 4.1.0 to 4.3.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/3.15.2/CHANGELOG.md)
- [Commits](nodeca/js-yaml@3.14.1...3.15.2)

Updates `browserslist` from 4.20.2 to 4.29.3
- [Release notes](https://github.com/browserslist/browserslist/releases)
- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md)
- [Commits](browserslist/browserslist@4.8.5...4.29.3)

Updates `undici` from 5.28.4 to 6.28.1
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v5.28.4...v6.28.1)

Updates `browserslist` from 4.21.3 to 4.28.7
- [Release notes](https://github.com/browserslist/browserslist/releases)
- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md)
- [Commits](browserslist/browserslist@4.8.5...4.29.3)

Updates `js-yaml` from 3.13.1 to 3.15.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/3.15.2/CHANGELOG.md)
- [Commits](nodeca/js-yaml@3.14.1...3.15.2)

Updates `colord` from 2.9.3 to 2.10.0
- [Release notes](https://github.com/omgovich/colord/releases)
- [Changelog](https://github.com/omgovich/colord/blob/master/CHANGELOG.md)
- [Commits](https://github.com/omgovich/colord/commits/v2.10)

Updates `browserslist` from 4.24.2 to 4.29.3
- [Release notes](https://github.com/browserslist/browserslist/releases)
- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md)
- [Commits](browserslist/browserslist@4.8.5...4.29.3)

Updates `js-yaml` from 4.1.0 to 4.3.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/3.15.2/CHANGELOG.md)
- [Commits](nodeca/js-yaml@3.14.1...3.15.2)

Updates `browserslist` from 4.28.1 to 4.29.3
- [Release notes](https://github.com/browserslist/browserslist/releases)
- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md)
- [Commits](browserslist/browserslist@4.8.5...4.29.3)

Updates `fast-uri` from 3.1.0 to 3.1.8
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.0.6...v3.1.8)

Updates `baseline-browser-mapping` from 2.10.10 to 2.11.26
- [Release notes](https://github.com/web-platform-dx/baseline-browser-mapping/releases)
- [Commits](web-platform-dx/baseline-browser-mapping@v2.10.10...v2.11.26)

Updates `browserslist` from 4.21.5 to 4.29.3
- [Release notes](https://github.com/browserslist/browserslist/releases)
- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md)
- [Commits](browserslist/browserslist@4.8.5...4.29.3)

Updates `js-yaml` from 3.14.1 to 3.15.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/3.15.2/CHANGELOG.md)
- [Commits](nodeca/js-yaml@3.14.1...3.15.2)

Updates `browserslist` from 4.24.4 to 4.29.3
- [Release notes](https://github.com/browserslist/browserslist/releases)
- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md)
- [Commits](browserslist/browserslist@4.8.5...4.29.3)

Updates `fast-uri` from 3.0.6 to 3.1.8
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.0.6...v3.1.8)

Updates `colord` from 2.9.3 to 2.10.0
- [Release notes](https://github.com/omgovich/colord/releases)
- [Changelog](https://github.com/omgovich/colord/blob/master/CHANGELOG.md)
- [Commits](https://github.com/omgovich/colord/commits/v2.10)

Updates `qs` from 6.4.1 to 6.4.3
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.14.0...v6.16.0)

Updates `qs` from 6.4.1 to 6.4.3
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.14.0...v6.16.0)

Updates `qs` from 6.4.1 to 6.4.3
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.14.0...v6.16.0)

Updates `qs` from 6.4.1 to 6.4.3
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.14.0...v6.16.0)

Updates `browserslist` from 4.16.6 to 4.29.3
- [Release notes](https://github.com/browserslist/browserslist/releases)
- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md)
- [Commits](browserslist/browserslist@4.8.5...4.29.3)

Updates `qs` from 6.7.0 to 6.16.0
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.14.0...v6.16.0)

Updates `browserslist` from 4.24.3 to 4.29.3
- [Release notes](https://github.com/browserslist/browserslist/releases)
- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md)
- [Commits](browserslist/browserslist@4.8.5...4.29.3)

Updates `fast-uri` from 3.0.5 to 3.1.8
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.0.6...v3.1.8)

Updates `colord` from 2.9.3 to 2.10.0
- [Release notes](https://github.com/omgovich/colord/releases)
- [Changelog](https://github.com/omgovich/colord/blob/master/CHANGELOG.md)
- [Commits](https://github.com/omgovich/colord/commits/v2.10)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 6.28.1
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: electron
  dependency-version: 41.10.6
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: immutable
  dependency-version: 4.3.9
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: adm-zip
  dependency-version: 0.4.16
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: browserslist
  dependency-version: 4.29.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 6.29.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: browserslist
  dependency-version: 4.29.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 3.15.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.16.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: joi
  dependency-version: 17.13.8
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: browserslist
  dependency-version: 4.29.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 4.3.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: joi
  dependency-version: 17.13.8
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: next
  dependency-version: 15.5.24
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: sharp
  dependency-version: 0.35.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: browserslist
  dependency-version: 4.29.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 3.15.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 3.15.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fast-uri
  dependency-version: 3.1.8
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 4.3.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 4.3.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: browserslist
  dependency-version: 4.29.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 6.28.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: browserslist
  dependency-version: 4.28.7
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 3.15.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: colord
  dependency-version: 2.10.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: browserslist
  dependency-version: 4.29.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 4.3.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: browserslist
  dependency-version: 4.29.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fast-uri
  dependency-version: 3.1.8
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: baseline-browser-mapping
  dependency-version: 2.11.26
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: browserslist
  dependency-version: 4.29.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 3.15.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: browserslist
  dependency-version: 4.29.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fast-uri
  dependency-version: 3.1.8
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: colord
  dependency-version: 2.10.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.4.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.4.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.4.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.4.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: browserslist
  dependency-version: 4.29.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.16.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: browserslist
  dependency-version: 4.29.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fast-uri
  dependency-version: 3.1.8
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: colord
  dependency-version: 2.10.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Oct 1, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants