chore(deps): bump the npm_and_yarn group across 1 directory with 14 updates by dependabot[bot] · Pull Request #1 · spxcevoid/refine

dependabot · 2026-07-29T01:55:13Z

Bumps the npm_and_yarn group with 13 updates in the / directory:

Package	From	To
vitest	`2.1.9`	`3.2.6`
postcss	`8.4.38`	`8.5.18`
react-router	`7.0.2`	`8.3.0`
tar	`6.2.1`	`7.5.21`
body-parser	`1.20.2`	`1.20.6`
http-proxy-middleware	`3.0.0`	`3.0.7`
ws	`8.16.0`	`8.21.0`
vite	`5.4.15`	`6.4.3`
axios	`1.11.0`	`1.18.0`
next	`14.2.26`	`15.5.21`
@babel/core	`7.24.4`	`7.29.6`
mongoose	`6.12.8`	`6.13.10`
next-auth	`4.24.7`	`4.24.15`

Updates vitest from 2.1.9 to 3.2.6

Release notes

Sourced from vitest's releases.

v3.2.6

   🐞 Bug Fixes

Pin last supported vite-node version - by @sheremet-va (16f12)

    View changes on GitHub

v3.2.5

   🚀 Features

api: Add allowWrite and allowExec options to api [backport to v3] - by @hi-ogawa and Codex in vitest-dev/vitest#10445 (af88b)

   🐞 Bug Fixes

browser: Disable client cdp API when allowWrite/allowExec: false [backport to v3] - by @hi-ogawa and Codex in vitest-dev/vitest#10456 (385a1)

    View changes on GitHub

v3.2.4

   🐞 Bug Fixes

Use correct path for optimisation of strip-literal - by @mrginglymus in vitest-dev/vitest#8139 (44940)

Print uint and buffer as a simple string - by @sheremet-va in vitest-dev/vitest#8141 (b86bf)

browser:

Show a helpful error when spying on an export - by @sheremet-va in vitest-dev/vitest#8178 (56007)

cli:

vitest run --watch should be watch-mode - by @AriPerkkio in vitest-dev/vitest#8128 (657e8)

Use absolute path environment on Windows - by @colinaaa in vitest-dev/vitest#8105 (85dc0)

Throw error when --shard x/<count> exceeds count of test files - by @AriPerkkio in vitest-dev/vitest#8112 (8a18c)

coverage:

Ignore SCSS in browser mode - by @sheremet-va in vitest-dev/vitest#8161 (0c3be)

deps:

Update all non-major dependencies - in vitest-dev/vitest#8123 (93f32)

expect:

Handle async errors in expect.soft - by @lzl0304 in vitest-dev/vitest#8145 (68699)

pool:

Auto-adjust minWorkers when only maxWorkers specified - by @AriPerkkio in vitest-dev/vitest#8110 (14dc0)

reporter:

task.meta should be available in custom reporter's errors - by @AriPerkkio in vitest-dev/vitest#8115 (27df6)

runner:

Preserve handler wrapping on extend - by @pengooseDev in vitest-dev/vitest#8153 (a9281)

ui:

Ensure ui config option works correctly - by @lzl0304 in vitest-dev/vitest#8147 (42eeb)

    View changes on GitHub

v3.2.3

   🚀 Features

browser: Use base url instead of vitest - by @sheremet-va in vitest-dev/vitest#8126 (1d8eb)

... (truncated)

Commits

b6d56f8 chore: release v3.2.6
16f120d fix: pin last supported vite-node version
2cbad0a chore: release v3.2.5
385a1ae fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
af88b1f feat(api): add allowWrite and allowExec options to api [backport to v3]...
c666d14 chore: release v3.2.4
8a18c8e fix(cli): throw error when --shard x/\<count> exceeds count of test files (#...
8abd7cc chore(deps): update tinypool (#8174)
93f3200 fix(deps): update all non-major dependencies (#8123)
0c3be6f fix(coverage): ignore SCSS in browser mode (#8161)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for vitest since your current version.

Updates postcss from 8.4.38 to 8.5.18

Release notes

Sourced from postcss's releases.

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

Fixed declaration parsing performance (by @homanp).

8.5.14

Fixed custom syntax regression (by @43081j).

8.5.13

Fixed postcss-scss commend regression.

8.5.12

Fixed reading any file via user-generated CSS.

Added opts.unsafeMap to disable checks.

8.5.11

Fixed nested brackets parsing performance (by @offset).

8.5.10

Fixed XSS via unescaped </style> in non-bundler cases (by @TharVid).

8.5.9

Speed up source map encoding paring in case of the error.

8.5.8

Fixed Processor#version.

8.5.7

Improved source map annotation cleaning performance (by CodeAnt AI).

8.5.6

Fixed ContainerWithChildren type discriminating (by @Goodwine).

8.5.5

Fixed package.json→exports compatibility with some tools (by @JounQin).

8.5.4

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

Fixed declaration parsing performance (by @homanp).

8.5.14

Fixed custom syntax regression (by @43081j).

8.5.13

Fixed postcss-scss commend regression.

8.5.12

Fixed reading any file via user-generated CSS.

Added opts.unsafeMap to disable checks.

8.5.11

Fixed nested brackets parsing performance (by @offset).

8.5.10

Fixed XSS via unescaped </style> in non-bundler cases (by @TharVid).

8.5.9

Speed up source map encoding paring in case of the error.

8.5.8

Fixed Processor#version.

... (truncated)

Commits

4c0d194 Release 8.5.18 version
92b4e78 Update dependencies
95663d3 Limit where source map can be loaded for security reasons
74e25ae Release 8.5.17 version
d1518af Fix Maximum call stack size exceeded error
2421312 Fix linter
a50352c Fix CI
33948f0 Prevent prototype hijacking in fromJSON
2131909 Update dependencies
93440ab Fix non-closed \<div align="center"> in README (#2110)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates react-router from 7.0.2 to 8.3.0

Release notes

Sourced from react-router's releases.

v8.3.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v830

v8.2.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v820

v8.1.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v810

v8.0.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v801

v8.0.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v800

v7.18.2

See the changelog for release notes: https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7182

v7.18.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7181

v7.18.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180

v7.17.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7170

v7.16.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7160

v7.15.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7151

v7.15.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7150

v7.14.2

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7142

v7.14.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7141

v7.14.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7140

v7.13.2

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7132

v7.13.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7131

... (truncated)

Changelog

Sourced from react-router's changelog.

v8.3.0

Patch Changes

Encode path params in href/generatePath per RFC 3986 path-segment rules instead of encodeURIComponent (#15310)

Characters that are valid literally in a path segment ($ & + , ; = : @ — RFC 3986 pchar) are no longer percent-encoded, so values like a semver build 1.0.0+1 interpolate unchanged instead of becoming 1.0.0%2B1

Structural/unsafe characters (/ ? # %, whitespace, non-ASCII) are still escaped exactly as before

Use crypto.randomUUID() for createMemorySessionStorage session ids (#15302)

createMemorySessionStorage is only intended for local development and testing - sessions are lost when the server restarts

Fix NavLink not applying its pending state when to has a trailing slash (#15300)

Preserve RSC route component metadata so routes with a clientLoader can skip unnecessary server requests once their components have rendered while still fetching missing server-rendered elements (#15323)

Harden RSC CSRF code paths (#15311)

Fix server crash (TypeError: Invalid state: Unable to enqueue) when a request is aborted while the RSC HTML stream has a pending flush (#15286)

Handle cancellation of the injectRSCPayload readable side, clear the pending flush, and cancel the underlying RSC payload stream

Unstable Changes

⚠️ Unstable features are not recommended for production use
Detect stale RSC clients during lazy route discovery and reload the destination document (#15318)

Migration

Apps using the default RSC Framework entry do not need to make any changes. Apps with a custom entry.rsc.tsx should import the generated client version and pass it to unstable_matchRSCServerRequest:
import clientVersion from "virtual:react-router/unstable_rsc/client-version";
return unstable_matchRSCServerRequest({
// ...
clientVersion,
});
Add CSP nonce support to RSC document rendering (#15320)

Add nonce options to unstable_routeRSCServerRequest and unstable_RSCStaticRouter

Forward the nonce to the HTML renderer and apply it to injected RSC payload scripts and nonce-aware framework components

To adopt nonce-based CSP, update your entry.ssr.tsx (run react-router reveal entry.ssr first in RSC Framework Mode) to generate a fresh nonce for each request. Pass it to routeRSCServerRequest, spread the renderHTML options into React's HTML renderer, pass options.nonce to RSCStaticRouter, and use the same nonce in the Content-Security-Policy response header:
const nonce = crypto.randomUUID();
const response = await routeRSCServerRequest({
  request,
  serverResponse,
  createFromReadableStream,
  nonce,
  async renderHTML(getPayload, options) {
    const payload = getPayload();
    return renderHTMLToReadableStream(

... (truncated)

Commits

2edaca7 Release v8.3.0 (#15294)
687ab72 Prep release notes
d2f1f1b update changes files to use h4 instead of h3 (#15334)
8186207 fix(rsc): preserve component metadata for client loader revalidation (#15323)
c26e431 feat(rsc): support CSP nonces in document rendering (#15320)
6286f90 feat(rsc): reload stale clients after new deployments (#15318)
3d83ad4 docs: fix useLinkClickHandler defaultShouldRevalidate default description (#1...
f75c89f Update docs links to v8 API reference (#15316)
baa9ba6 fix: encode path params per RFC 3986 path-segment rules in href/generatePath ...
69debd1 fix: apply NavLink pending state when the to prop has a trailing slash (#15300)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react-router since your current version.

Updates tar from 6.2.1 to 7.5.21

Changelog

Sourced from tar's changelog.

Changelog

7.5

Added zstd compression support.

Consistent TOCTOU behavior in sync t.list

Only read from ustar block if not specified in Pax

Fix sync tar.list when file size reduces while reading

Sanitize absolute linkpaths properly

Prevent writing hardlink entries to the archive ahead of their file target

7.4

Deprecate onentry in favor of onReadEntry for clarity.

7.3

Add onWriteEntry option

7.2

DRY the command definitions into a single makeCommand method, and update the type signatures to more appropriately infer the return type from the options and arguments provided.

7.1

Update minipass to v7.1.0

Update the type definitions of write() and end() methods on Unpack and Parser classes to be compatible with the NodeJS.WritableStream type in the latest versions of @types/node.

7.0

Drop support for node <18

Rewrite in TypeScript, provide ESM and CommonJS hybrid interface

Add tree-shake friendly exports, like import('tar/create') and import('tar/read-entry') to get individual functions or classes.

Add chmod option that defaults to false, and deprecate noChmod. That is, reverse the default option regarding explicitly setting file system modes to match tar entry settings.

Add processUmask option to avoid having to call process.umask() when chmod: true (or noChmod: false) is set.

... (truncated)

Commits

0cd9cc3 7.5.21
631ae59 list: prevent unbounded recursion
ebbb720 7.5.20
2f27196 fix: fully disable and dispose of unzip when aborting parser
be440da 7.5.19
2812e93 add maxDecompressionRatio guard against explosive decompression
9ecd4d2 7.5.18
9e78bf0 refuse to let header size be less than 0
e02a4e9 pax: parse values according to known types
9cbdb31 7.5.17
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by isaacs, a new releaser for tar since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates body-parser from 1.20.2 to 1.20.6

Release notes

Sourced from body-parser's releases.

1.20.6

Important: Security

Security fix for CVE-2026-12590 (GHSA-v422-hmwv-36x6)

What's Changed

fix: improve limit option validation by @Phillip9587 in expressjs/body-parser#741

Full Changelog: expressjs/body-parser@1.20.5...1.20.6

v1.20.5

What's Changed

The reason for this release is a fix to the extended urlencoded parser returning objects instead of arrays for large array inputs (> 100) on qs@6.14.2+. (expressjs/body-parser#716)

refactor(json): simplify strict mode error string construction by @jonchurch in expressjs/body-parser#692

fix: correct off-by-one error in parameterCount by @abhu85 in expressjs/body-parser#716

deps(qs): bump qs to 6.15.1 by @jonchurch in expressjs/body-parser#722

Release: 1.20.5 by @jonchurch in expressjs/body-parser#721

New Contributors

@abhu85 made their first contribution in expressjs/body-parser#716

Special thanks to triager @krzysdz for keeping this on our radar and effectively triaging the specific issue!

Full Changelog: expressjs/body-parser@1.20.4...1.20.5

1.20.4

What's Changed

Remove redundant depth check by @blakeembrey in expressjs/body-parser#538

ci: add support for Node.js v23 by @Phillip9587 in expressjs/body-parser#553

ci: restore CI for 1.x branch by @bjohansebas in expressjs/body-parser#665

deps: qs@^6.14.0 by @bjohansebas in expressjs/body-parser#664

deps: use tilde notation and update certain dependencies by @Phillip9587 in expressjs/body-parser#668

chore: remove SECURITY.md by @Phillip9587 in expressjs/body-parser#669

ci: add CodeQL (SAST) by @Phillip9587 in expressjs/body-parser#670

Release: 1.20.4 by @UlisesGascon in expressjs/body-parser#672

Full Changelog: expressjs/body-parser@1.20.3...1.20.4

1.20.3

What's Changed

Important

deps: qs@6.13.0

add depth option to customize the depth level in the parser

IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity). Documentation

... (truncated)

Changelog

Sourced from body-parser's changelog.

1.20.6 / 2026-07-09

Security fix for GHSA-v422-hmwv-36x6

fix: improve limit option validation (#698)

Invalid limit values (e.g. unparseable strings or NaN) now throw instead of being silently ignored, which previously disabled size limit enforcement

null and undefined fall back to the default 100kb limit

1.20.5 / 2026-04-24

refactor(json): simplify strict mode error string construction

fix: extended urlencoded parsing of arrays with >100 elements (#716)

deps: qs@~6.15.1

1.20.4 / 2025-12-01

deps: qs@~6.14.0

deps: use tilde notation for dependencies

deps: http-errors@~2.0.1

deps: raw-body@~2.5.3

1.20.3 / 2024-09-10

deps: qs@6.13.0

add depth option to customize the depth level in the parser

IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)

Commits

5cc4fb8 1.20.6 (#746)
3492672 fix: improve limit option validation (#741)
0defdbe release(patch): 1.20.5
cd0e7a0 deps(qs): bump qs to 6.15.1
6f24d7e fix: correct off-by-one error in parameterCount (#716)
b849bd5 deps: qs@~6.14.1 (#690)
2c55e2f refactor(json): simplify strict mode error string construction (#692)
7db202c 1.20.4 (#672)
d8f8adb ci: add CodeQL (SAST) (#670)
6d133c1 chore: remove SECURITY.md (#669)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for body-parser since your current version.

Updates http-proxy-middleware from 3.0.0 to 3.0.7

Release notes

Sourced from http-proxy-middleware's releases.

v3.0.7

What's Changed

fix(fixRequestBody): harden form-data stringification by @chimurai in chimurai/http-proxy-middleware#1259

chore(package.json): v3.0.7 by @chimurai in chimurai/http-proxy-middleware#1261

Full Changelog: chimurai/http-proxy-middleware@v3.0.6...v3.0.7

v3.0.6

What's Changed

fix(types): fix Logger type by @chimurai in chimurai/http-proxy-middleware#1104

fix(fixRequestBody): support text/plain by @knudtty in chimurai/http-proxy-middleware#1103

chore(examples): bump deps by @chimurai in chimurai/http-proxy-middleware#1105

build(prettier): improve prettier setup by @chimurai in chimurai/http-proxy-middleware#1108

chore(deps): fix punycode node deprecation warning by @chimurai in chimurai/http-proxy-middleware#1109

chore(examples): bump deps by @chimurai in chimurai/http-proxy-middleware#1110

build(codespaces): add devcontainer.json by @chimurai in chimurai/http-proxy-middleware#1112

chore(package): bump dev dependencies by @chimurai in chimurai/http-proxy-middleware#1116

ci(github-action): ci.yml add node v24 by @chimurai in chimurai/http-proxy-middleware#1117

chore(package): bump dev dependencies by @chimurai in chimurai/http-proxy-middleware#1118

chore(package): upgrade to jest v30 by @chimurai in chimurai/http-proxy-middleware#1122

chore(examples): upgrade deps by @chimurai in chimurai/http-proxy-middleware#1124

chore(package): update dev deps by @chimurai in chimurai/http-proxy-middleware#1125

test(websocket): fix ws import by @chimurai in chimurai/http-proxy-middleware#1126

chore(refactor): use node: protocol imports by @chimurai in chimurai/http-proxy-middleware#1127

ci(node24): pin node24 due to TLS issue with mockttp by @chimurai in chimurai/http-proxy-middleware#1137

docs(recipes/pathRewrite.md): fix comment by @DEBargha2004 in chimurai/http-proxy-middleware#1135

chore(package): bump dev deps by @chimurai in chimurai/http-proxy-middleware#1138

chore(deps): update actions/checkout action to v5 by @chimurai in chimurai/http-proxy-middleware#1140

fix(error-response-plugin): sanitize input by @chimurai in chimurai/http-proxy-middleware#1141

chore(package.json): update dev deps by @chimurai in chimurai/http-proxy-middleware#1143

chore: add context7.json by @chimurai in chimurai/http-proxy-middleware#1144

build(eslint): update eslint.config.mjs by @chimurai in chimurai/http-proxy-middleware#1145

ci(github workflow): harden github workflows by @chimurai in chimurai/http-proxy-middleware#1146

chore(package): bump dev deps by @chimurai in chimurai/http-proxy-middleware#1147

ci(ci.yml): unpin node 24 by @chimurai in chimurai/http-proxy-middleware#1148

docs(recipes): fix servers.md http.createServer example by @hacklschorsch in chimurai/http-proxy-middleware#1150

ci: publish with oidc by @chimurai in chimurai/http-proxy-middleware#1152

chore(package.json): bump dev deps by @chimurai in chimurai/http-proxy-middleware#1153

chore(package.json): bump dev deps by @chimurai in chimurai/http-proxy-middleware#1155

chore(package.json): bump dev deps by @chimurai in chimurai/http-proxy-middleware#1158

test(types.spec.ts): add type check when req or res are 'any' by @chimurai in chimurai/http-proxy-middleware#1161

chore(package.json): bump deps by @chimurai in chimurai/http-proxy-middleware#1164

chore(package.json): eslint v10 by @chimurai in chimurai/http-proxy-middleware#1165

chore(package.json): bump dev deps by @chimurai in chimurai/http-proxy-middleware#1166

chore(package.json): bump dev-deps by @chimurai in chimurai/http-proxy-middleware#1171

docs(examples): fix websocket example by @chimurai in chimurai/http-proxy-middleware#1170

build(vscode): use workspace version of TypeScript by @chimurai in chimurai/http-proxy-middleware#1173

fix(router): harden proxy-table matching by @chimurai in chimurai/http-proxy-middleware#1254

chore(package.json): v3.0.6 by @chimurai in chimurai/http-proxy-middleware#1256

... (truncated)

Changelog

Sourced from http-proxy-middleware's changelog.

v3.0.7

fix(fixRequestBody): harden form-data stringification

v3.0.6

fix(types): fix Logger type

fix(error-response-plugin): sanitize input

fix(router): harden proxy-table matching (exact host for host+path keys, prefix-only path matching) to prevent routing bypass

v3.0.5

fix(fixRequestBody): check readableLength (#1096)

v3.0.4

fix(fixRequestBody): handle invalid request (#1092)

fix(fixRequestBody): prevent multiple .write() calls (#1089)

fix(websocket): handle errors in handleUpgrade (#823)

ci(package): patch http-proxy (#1084)

fix(fixRequestBody): support multipart/form-data (#896)

feat(types): export Plugin type (#1071)

v3.0.3

fix(pathFilter): handle errors

v3.0.2

refactor(dependency): replace is-plain-obj with is-plain-object (#1031)

chore(package): upgrade to eslint v9 (#1032)

fix(logger-plugin): handle undefined protocol and hostname (#1036)

v3.0.1

fix(type): fix RequestHandler return type (#980)

refactor(errors): improve pathFilter error message (#987)

fix(logger-plugin): fix missing target port (#989)

ci(package): npm package provenance (#991)

fix(logger-plugin): log target port when router option is used (#1001)

refactor: fix circular dependencies (#1010)

fix(fix-request-body): support '+json' content-type suffix (#1015)

Commits

8cc4eba chore(package.json): v3.0.7 (#1261)
c13a99c fix(fixRequestBody): harden form-data stringification (#1259)
ea0bb98 chore(package.json): v3.0.6 (#1256)
f377520 fix(router): harden proxy-table matching (#1254)
f6be2c6 chore(yarn.lock): bump to follow-redirects 1.16.0
a36f009 ci(publish.yml): npm stage publish
3471790 ci(github actions): update publish.yml for 3.x branch
bcf1864 build(vscode): use workspace version of TypeScript (#1173)
48ed092 docs(examples): fix websocket example (#1170)
0fe7c24 chore(package.json): bump dev-deps (#1171)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for http-proxy-middleware since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates ws from 8.16.0 to 8.21.0

Release notes

Sourced from ws's releases.

8.21.0

Features

Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.
import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(client close - code: ${code} reason: ${reason.toString()});
});
});
wss.on('connection', function (ws) {
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(server close - code: ${code} reason: ${reason.toString()});
});
});
The vulnerability was responsibly disclosed and fixed by Nadav Magier.

In vulnerable versions, the issue can be mitigated by lowering the value of the maxPayload option if possible.

8.20.1

... (truncated)

Commits

bca91ad [dist] 8.21.0
2b2abd4 [security] Limit retained message parts
78eabe2 [security] Add latest vulnerability to SECURITY.md
5d9b316 [dist] 8.20.1
c0327ec [security] Fix uninitialized memory disclosure in websocket.close()
ce2a3d6 [ci] Test on node 26
58e45b8 [ci] Do not test on node 25
5f26c24 [ci] Run the lint step on node 24
8439255 [dist] 8.20.0
d3503c1 [minor] Export the PerMessageDeflate class and header utils
Additional commits viewable in compare view

Updates vite from 5.4.15 to 6.4.3

Release notes

Sourced from vite's releases.

v6.4.3

Please refer to CHANG...
Description has been truncated

…pdates Bumps the npm_and_yarn group with 13 updates in the / directory: | Package | From | To | | --- | --- | --- | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `2.1.9` | `3.2.6` | | [postcss](https://github.com/postcss/postcss) | `8.4.38` | `8.5.18` | | [react-router](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router) | `7.0.2` | `8.3.0` | | [tar](https://github.com/isaacs/node-tar) | `6.2.1` | `7.5.21` | | [body-parser](https://github.com/expressjs/body-parser) | `1.20.2` | `1.20.6` | | [http-proxy-middleware](https://github.com/chimurai/http-proxy-middleware) | `3.0.0` | `3.0.7` | | [ws](https://github.com/websockets/ws) | `8.16.0` | `8.21.0` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `5.4.15` | `6.4.3` | | [axios](https://github.com/axios/axios) | `1.11.0` | `1.18.0` | | [next](https://github.com/vercel/next.js) | `14.2.26` | `15.5.21` | | [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) | `7.24.4` | `7.29.6` | | [mongoose](https://github.com/Automattic/mongoose) | `6.12.8` | `6.13.10` | | [next-auth](https://github.com/nextauthjs/next-auth) | `4.24.7` | `4.24.15` | Updates `vitest` from 2.1.9 to 3.2.6 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v3.2.6/packages/vitest) Updates `postcss` from 8.4.38 to 8.5.18 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.4.38...8.5.18) Updates `react-router` from 7.0.2 to 8.3.0 - [Release notes](https://github.com/remix-run/react-router/releases) - [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router/CHANGELOG.md) - [Commits](https://github.com/remix-run/react-router/commits/react-router@8.3.0/packages/react-router) Updates `tar` from 6.2.1 to 7.5.21 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v6.2.1...v7.5.21) Updates `body-parser` from 1.20.2 to 1.20.6 - [Release notes](https://github.com/expressjs/body-parser/releases) - [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md) - [Commits](expressjs/body-parser@1.20.2...1.20.6) Updates `http-proxy-middleware` from 3.0.0 to 3.0.7 - [Release notes](https://github.com/chimurai/http-proxy-middleware/releases) - [Changelog](https://github.com/chimurai/http-proxy-middleware/blob/v3.0.7/CHANGELOG.md) - [Commits](chimurai/http-proxy-middleware@v3.0.0...v3.0.7) Updates `ws` from 8.16.0 to 8.21.0 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.16.0...8.21.0) Updates `vite` from 5.4.15 to 6.4.3 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v6.4.3/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v6.4.3/packages/vite) Updates `axios` from 1.11.0 to 1.18.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.11.0...v1.18.0) Updates `next` from 14.2.26 to 15.5.21 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v14.2.26...v15.5.21) Updates `@babel/core` from 7.24.4 to 7.29.6 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.6/packages/babel-core) Updates `mongoose` from 6.12.8 to 6.13.10 - [Release notes](https://github.com/Automattic/mongoose/releases) - [Changelog](https://github.com/Automattic/mongoose/blob/6.13.10/CHANGELOG.md) - [Commits](Automattic/mongoose@6.12.8...6.13.10) Updates `next-auth` from 4.24.7 to 4.24.15 - [Release notes](https://github.com/nextauthjs/next-auth/releases) - [Commits](https://github.com/nextauthjs/next-auth/compare/next-auth@4.24.7...next-auth@4.24.15) Updates `sharp` from 0.34.3 to 0.34.5 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](lovell/sharp@v0.34.3...v0.34.5) --- updated-dependencies: - dependency-name: vitest dependency-version: 3.2.6 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.18 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: react-router dependency-version: 8.3.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: tar dependency-version: 7.5.21 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: body-parser dependency-version: 1.20.6 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: http-proxy-middleware dependency-version: 3.0.7 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 8.21.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 6.4.3 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: axios dependency-version: 1.18.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.21 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@babel/core" dependency-version: 7.29.6 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: mongoose dependency-version: 6.13.10 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next-auth dependency-version: 4.24.15 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: sharp dependency-version: 0.34.5 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

sonarqubecloud · 2026-07-29T01:56:39Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 29, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the npm_and_yarn group across 1 directory with 14 updates - #1

chore(deps): bump the npm_and_yarn group across 1 directory with 14 updates#1
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-8685c32da0

dependabot Bot commented on behalf of github Jul 29, 2026

Migration

Uh oh!

sonarqubecloud Bot commented Jul 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Jul 29, 2026

v3.2.6

🐞 Bug Fixes

v3.2.5

🚀 Features

🐞 Bug Fixes

v3.2.4

🐞 Bug Fixes

v3.2.3

🚀 Features

8.5.18

8.5.17

8.5.16

8.5.15

8.5.14

8.5.13

8.5.12

8.5.11

8.5.10

8.5.9

8.5.8

8.5.7

8.5.6

8.5.5

8.5.4

8.5.18

8.5.17

8.5.16

8.5.15

8.5.14

8.5.13

8.5.12

8.5.11

8.5.10

8.5.9

8.5.8

v8.3.0

v8.2.0

v8.1.0

v8.0.1

v8.0.0

v7.18.2

v7.18.1

v7.18.0

v7.17.0

v7.16.0

v7.15.1

v7.15.0

v7.14.2

v7.14.1

v7.14.0

v7.13.2

v7.13.1

v8.3.0

Patch Changes

Unstable Changes

Migration

Changelog

7.5

7.4

7.3

7.2

7.1

7.0

1.20.6

Important: Security

What's Changed

v1.20.5

What's Changed

New Contributors

1.20.4

What's Changed

1.20.3

What's Changed

Important

1.20.6 / 2026-07-09

1.20.5 / 2026-04-24

1.20.4 / 2025-12-01

1.20.3 / 2024-09-10