Bump the npm_and_yarn group across 1 directory with 19 updates by dependabot[bot] · Pull Request #2 · bodnar-dev/omnivore

dependabot · 2026-07-15T04:03:25Z

Bumps the npm_and_yarn group with 18 updates in the / directory:

Package	From	To
@opentelemetry/core	`1.30.1`	`2.8.0`
axios	`0.30.0`	`0.32.0`
dompurify	`2.5.8`	`3.4.11`
nodemailer	`6.10.1`	`9.0.1`
typeorm	`0.3.25`	`0.3.29`
uuid	`8.3.2`	`14.0.0`
@babel/core	`7.28.0`	`7.29.6`
webpack-dev-server	`4.15.2`	`5.2.5`
markdown-it	`13.0.2`	`14.2.0`
next	`14.2.30`	`15.5.18`
@babel/plugin-transform-modules-systemjs	`7.27.1`	`7.29.7`
basic-ftp	`5.0.5`	`5.3.1`
fast-uri	`3.0.6`	`3.1.3`
http-proxy-middleware	`2.0.9`	`2.0.10`
js-cookie	`3.0.5`	`3.0.8`
launch-editor	`2.11.0`	`2.14.1`
mongoose	`8.16.5`	`8.24.1`
shell-quote	`1.8.3`	`1.10.0`

Updates @opentelemetry/core from 1.30.1 to 2.8.0

Release notes

Sourced from @opentelemetry/core's releases.

v2.8.0

2.8.0

🚀 Features

feat(sdk-trace-base): pretty-print SpanImpl, Tracer, and BasicTracerProvider via util.inspect so they render through diag and console.log #6690 @mcollina

feat(sdk-metrics): implement metric reader self-observability metrics #6449 @anuraaga

feat(core): add hrTimeToSeconds #6449 @anuraaga

🐛 Bug Fixes

fix(core): limit processing of incoming "baggage" header to 8192 bytes @pichlermarc

v2.7.1

2.7.1

🐛 Bug Fixes

fix(core, api): defer trace state validation. Deprecate trace state implementation in api #6459 @david-luna

important: this bug fix may be breaking for certain uses of TraceState

set now returns the same TraceState instance if key/value are invalid or makes the while trace state invalid.

unset now returns the same TraceState instance if key is not present.

best-effort parsing of invalid TraceStates has changed: when multiple keys with the same name are present, the most recent one will win.

🏠 Internal

perf(sdk-trace-base): optimize TraceIdRatioBasedSampler performance #6284 @AbhiPrasad

perf(sdk-metrics): reduce loop overhead in sdk hot paths #6593 @mcollina

v2.7.0

2.7.0

🚀 Features

feat(sdk-logs): implement log creation metrics #6433 @anuraaga

feat(sdk-metrics): add the cardinalitySelector argument to PeriodicExportingMetricReaders #6460 @starzlocker

feat(opentelemetry-core): add extra checks on internal merge function for safety #6587 @maryliag

🐛 Bug Fixes

fix(opentelemetry-resources): do not discard OTEL_RESOURCE_ATTRIBUTES when it contains empty kv pairs

🏠 Internal

test(exporter-zipkin): fix broken browser test assertions and add missing coverage #6566 @overbalance

fix(sdk-metrics): repair ExponentialHistogram tests #6565 @overbalance

... (truncated)

Changelog

Sourced from @opentelemetry/core's changelog.

2.8.0

🚀 Features

feat(sdk-trace-base): pretty-print SpanImpl, Tracer, and BasicTracerProvider via util.inspect so they render through diag and console.log #6690 @mcollina

feat(sdk-metrics): implement metric reader self-observability metrics #6449 @anuraaga

feat(core): add hrTimeToSeconds #6449 @anuraaga

🐛 Bug Fixes

fix(core): limit processing of incoming "baggage" header to 8192 bytes @pichlermarc

2.7.1

🐛 Bug Fixes

fix(core, api): defer trace state validation. Deprecate trace state implementation in api #6459 @david-luna

important: this bug fix may be breaking for certain uses of TraceState

set now returns the same TraceState instance if key/value are invalid or makes the while trace state invalid.

unset now returns the same TraceState instance if key is not present.

best-effort parsing of invalid TraceStates has changed: when multiple keys with the same name are present, the most recent one will win.

🏠 Internal

perf(sdk-trace-base): optimize TraceIdRatioBasedSampler performance #6284 @AbhiPrasad

test: test Node.js 26 in CI #6671 @cjihrig

2.7.0

🚀 Features

feat(sdk-logs): implement log creation metrics #6433 @anuraaga

feat(sdk-metrics): add the cardinalitySelector argument to PeriodicExportingMetricReaders #6460 @starzlocker

feat(opentelemetry-core): add extra checks on internal merge function for safety #6587 @maryliag

🐛 Bug Fixes

fix(opentelemetry-resources): do not discard OTEL_RESOURCE_ATTRIBUTES when it contains empty kv pairs

🏠 Internal

test(exporter-zipkin): fix broken browser test assertions and add missing coverage #6566 @overbalance

fix(sdk-metrics): repair ExponentialHistogram tests #6565 @overbalance

perf(sdk-metrics): reduce loop overhead in sdk hot paths #6593 @mcollina

2.6.1

🐛 Bug Fixes

... (truncated)

Commits

13a035b chore: prepare next release (#6756)
4b13587 Merge commit from fork
71d195c chore(renovate): set minimumReleaseAge to 3 days (#6792)
555fca6 Update renovate.json to use matchManagers (#6141)
b711a81 docs(otlp-exporter-base): add typedoc entry points so public API is indexed a...
da70402 fix(ci): supply-chain sec: disable caching in release-related workflow (#6790)
002267b chore: complete the move to the smaller SPDX license header (#6791)
056ef9c feat(sdk-metrics): implement metric reader metrics (#6449)
3bd69ce fix(configuration): improve environment variable substitution to handle all t...
bfbda7c docs(exporter-trace-otlp-grpc): import CompressionAlgorithm from otlp-exporte...
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @opentelemetry/core since your current version.

Updates axios from 0.30.0 to 0.32.0

Release notes

Sourced from axios's releases.

v0.32.0 — May 4, 2026

This release backports a comprehensive set of security and hardening fixes from the v1.x branch into v0.x, covering prototype-pollution protections, default error redaction, stricter proxy/cookie/socket handling, and one breaking change to merged config and header object prototypes.

⚠️ Breaking Changes & Deprecations

Null-prototype merged objects: mergeConfig and header merging now return objects with a null prototype to block prototype-pollution gadgets. Consumers must use Object.prototype.hasOwnProperty.call(obj, key) and avoid implicit string coercion against merged config or header objects. (#10838)

🔒 Security Fixes

Default error redaction: AxiosError.toJSON() now redacts sensitive keys by default to prevent credential leaks in logs. The behavior is configurable via config.redact, with defaults exposed on defaults.redact. (#10838)

Cookie & XSRF handling: Cookie names are read literally rather than via regex, and only own properties are respected when evaluating withXSRFToken. (#10838)

Proxy bypass IPv6 parity: NO_PROXY matching now handles canonical IPv4-mapped IPv6 forms such as ::ffff:127.0.0.1 and ::ffff:7f00:1. (#10838)

Node http adapter hardening: Strips Proxy-Authorization when no proxy is in use and gates socketPath behind a new allowedSocketPaths allowlist (string or array, normalized) to reduce accidental Unix socket exposure. (#10838)

Browser xhr adapter: Stricter own-property checks when reading config and headers. (#10838)

URL parameters: AxiosURLSearchParams keeps %00 encoded and applies consistent encoding throughout. (#10838)

Public type surface: Adds formDataHeaderPolicy, redact, and allowedSocketPaths to the TypeScript declarations alongside their runtime defaults. (#10838)

🔧 Maintenance & Chores

Repo hygiene: Updates README.md and CHANGELOG.md, adds AGENTS.md, and refreshes the issue and PR templates. (#10838)

Full Changelog

v0.31.1

This release backports a broad set of security hardenings from the v1 line — covering prototype-pollution defences, stream size enforcement, XSRF handling, URL null-byte encoding, and bounded FormData recursion — and drops committed dist/ artefacts along with Bower support.

⚠️ Breaking Changes & Deprecations

Bower & Committed dist/ Removed: dist/ bundles are no longer committed to the repo, and bower.json plus the Grunt package2bower task have been removed. CI still builds bundles before publish, so npm/yarn/pnpm consumers are unaffected; installs via Bower or directly from the git tree must migrate to npm or a CDN. (#10747)

🔒 Security Fixes

Prototype Pollution in Header Merge (GHSA-6chq-wfr3-2hj9): Tightened isFormData to reject plain/null-prototype objects and require append, and guarded the Node HTTP adapter so data.getHeaders() is only merged when it is not inherited from Object.prototype. Blocks injected headers via polluted getHeaders. (#10750)

Prototype Pollution in Config Merging (GHSA-pf86-5x62-jrwf): mergeConfig, defaults resolution, and the HTTP adapter now uses own-property checks for transport, env, Blob, formSerializer, and transforms arrays, and merged configs are returned as null-prototype objects. Prevents hijacking of the request flow through polluted prototypes. (#10752)

FormData / Params Recursion DoS: Added a configurable maxDepth (default 100, Infinity disables) to toFormData and params serialisation, throwing AxiosError with code ERR_FORM_DATA_DEPTH_EXCEEDED when exceeded. Circular-reference detection is preserved. (#10728)

Null-Byte Injection in Query Strings: Removed the unsafe %00 → null-byte substitution from AxiosURLSearchParams.encode so %00 is preserved as-is. Other encoding behaviour (including %20 → +) unchanged. (#10737)

Consolidated v1 Security Backport: Rolls up remaining v1 hardenings into v0.x: maxContentLength enforcement for responseType: 'stream' via a guarded transform with deferred piping, maxBodyLength enforcement for streamed uploads on native http/https with maxRedirects: 0, and stricter withXSRFToken handling so only own boolean true enables cross-origin XSRF headers. (#10764)

🔧 Maintenance & Chores

CODEOWNERS: Added .github/CODEOWNERS with * @jasonsaayman to set a default reviewer for all paths. (#10740)

Full Changelog

v0.31.0

This release backports security fixes from v1.x, hardens the CI/CD supply chain with OIDC publishing and zizmor scanning, resolves TypeScript typing issues in AxiosInstance, and fixes a performance regression in isEmptyObject().

🔒 Security Fixes

... (truncated)

Commits

8db2d44 chore: bump version to v0.32.0 (#10840)
2af6116 chore: backport fixes from the v1x branch (#10838)
a589dc5 chore: bump version to v0.31.1 (#10766)
b0c632f fix: backport security issues (#10764)
b52187f fix: harden config merging (#10752)
e3ddeb4 fix: header security issues (#10750)
f4f2d76 chore: stop committing dist/ and remove bower (#10747)
1f2f644 chore: add CODEOWNERS (#10740)
44bca90 fix: improve regex in AxiosURLSearchParams (#10737)
4c4f07f fix: form data recursion (#10728)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for axios since your current version.

Updates dompurify from 2.5.8 to 3.4.11

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.11

Fixed an issue with a leaky config for hooks via setConfig, thanks @trace37labs

Bumped vulnerable development dependencies to arrive at plain 0 with npm audit

Updated the osv-scanner suppression list as no vulnerable dependencies are left for now

Updated up the linting tool-chain and removed now-redundant lint directives

Updated the documentation is several spots, README, wiki, etc.

Bumped several dependencies where possible

DOMPurify 3.4.10

Refactored codebase for clarity: extracted the public type declarations into types.ts

Decomposed the three largest sanitizer functions into focused helpers

Removed duplicated defaults and dead branches, consolidated SAFE_FOR_TEMPLATES scrubbing into single shared path

Improved per-node performance by hoisting the mXSS probe regexes and testing textContent before innerHTML

Added a deterministic micro-benchmark harness (npm run bench) with a --compare mode

Reduced CI cost by running the full three-engine browser suite once per PR

Refreshed the demos/ folder so every demo runs again, and added a SVG-via-<img> demo

Documented the bench and test:happydom scripts in the README

Completed the Attack Classes & Bypass History wiki page

Bumped several dependencies where possible

DOMPurify 3.4.9

Further improved the handling of Trusted Types config options, thanks @offset

Further improved the handling of IN_PLACE sanitization, thanks @mozfreddyb

Added more test coverage for IN_PLACE and Trusted Types related usage

Bumped several dependencies where possible

Updated README and wiki with more accurate documentation & attack samples

DOMPurify 3.4.8

Cleaned up the repository root, renamed some and removed unneeded files

Fixed an issue with handling of Trusted Types policies, thanks @fulstadev

Fixed the node iterator for better template scrubbing, thanks @IamLeandrooooo

Included formerly missing LICENSE-MPL in published npm package, thanks @asamuzaK

Bumped several dependencies where possible

DOMPurify 3.4.7

Hardened the handling of Shadow Roots when using IN_PLACE, thanks @GameZoneHacker

Removed a problem leading to permanent hook pollution, thanks @offset

Refactored the test suite and expanded test coverage significantly

DOMPurify 3.4.6

Fixed several issues with DOM Clobbering in IN_PLACE mode, thanks @offset & @Bankde

Hardened the checks for cross-realm IN_PLACE and Shadow DOM sanitization, thanks @offset & @Bankde

Added more test coverage for IN_PLACE and general DOM Clobbering attacks

Bumped several dependencies where possible

DOMPurify 3.4.5

Fixed a bypass caused by the new HTML element selectedcontent added in 3.4.4, thanks @KabirAcharya

Note that this is a security release for an issue introduced in 3.4.4 and should be upgraded to immediately.

... (truncated)

Commits

0cae518 release: 3.4.11 (#1494)
6ee5716 release: 3.4.10 (#1478)
5210247 release: 3.4.9 (#1459)
bcdd828 release: 3.4.8 (#1439)
ca30f07 release: 3.4.7 (#1414)
bb7739e release: 3.4.6 (#1394)
011b0c7 release: 3.4.5 (#1382)
5817ad9 release: 3.4.4 (#1374)
520edb0 release: 3.4.3 (#1352)
6f67fd3 Sync/3.4.2 (#1322)
Additional commits viewable in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates nodemailer from 6.10.1 to 9.0.1

Release notes

Sourced from nodemailer's releases.

v9.0.1

9.0.1 (2026-06-17)

Bug Fixes

enforce disableFileAccess/disableUrlAccess for raw message option (a82e060)

v9.0.0

9.0.0 (2026-06-14)

⚠ BREAKING CHANGES

HTTPS requests made while fetching remote content (attachment href/path URLs, OAuth2 token endpoints, HTTP/HTTPS proxy CONNECT) now validate the server's TLS certificate by default. Requests to hosts with self-signed, expired, or hostname-mismatched certificates that previously succeeded will now fail. Opt back out per request with tls.rejectUnauthorized=false (transport options, or a per-attachment tls option).

Bug Fixes

replace deprecated url.parse with a WHATWG URL wrapper (0c080fb)

validate TLS certificates by default when fetching remote content (6a947ac)

v8.0.11

8.0.11 (2026-06-10)

Bug Fixes

apply the transport-level newline option in stream and sendmail transports (cb4f904)

include icalEvent path/href content in the application/ics attachment (b801c48)

parse Ethereal response props without polynomial regex backtracking (067aebe)

resolve oauth2_provision_cb at send time for non-pooled SMTP transports (203c8ec)

return the promise from every resolveContent branch (07ffe8c)

strip the url scheme from List-ID header values (77e5885)

tag AWS SES transport errors with the ESES code (efa647a)

v8.0.10

8.0.10 (2026-05-29)

Bug Fixes

fall back to lower-severity handler when custom logger lacks a level method (6d849df)

v8.0.9

8.0.9 (2026-05-26)

Bug Fixes

two pending security advisories (jsonTransport access bypass, List-* CRLF injection) (#1820) (5f69497)

... (truncated)

Changelog

Sourced from nodemailer's changelog.

9.0.1 (2026-06-17)

Bug Fixes

enforce disableFileAccess/disableUrlAccess for raw message option (a82e060)

9.0.0 (2026-06-14)

⚠ BREAKING CHANGES

HTTPS requests made while fetching remote content (attachment href/path URLs, OAuth2 token endpoints, HTTP/HTTPS proxy CONNECT) now validate the server's TLS certificate by default. Requests to hosts with self-signed, expired, or hostname-mismatched certificates that previously succeeded will now fail. Opt back out per request with tls.rejectUnauthorized=false (transport options, or a per-attachment tls option).

Bug Fixes

replace deprecated url.parse with a WHATWG URL wrapper (0c080fb)

validate TLS certificates by default when fetching remote content (6a947ac)

8.0.11 (2026-06-10)

Bug Fixes

apply the transport-level newline option in stream and sendmail transports (cb4f904)

include icalEvent path/href content in the application/ics attachment (b801c48)

parse Ethereal response props without polynomial regex backtracking (067aebe)

resolve oauth2_provision_cb at send time for non-pooled SMTP transports (203c8ec)

return the promise from every resolveContent branch (07ffe8c)

strip the url scheme from List-ID header values (77e5885)

tag AWS SES transport errors with the ESES code (efa647a)

8.0.10 (2026-05-29)

Bug Fixes

fall back to lower-severity handler when custom logger lacks a level method (6d849df)

8.0.9 (2026-05-26)

Bug Fixes

two pending security advisories (jsonTransport access bypass, List-* CRLF injection) (#1820) (5f69497)

8.0.8 (2026-05-23)

Bug Fixes

... (truncated)

Commits

69cf625 chore(master): release 9.0.1 (#1828)
a82e060 fix: enforce disableFileAccess/disableUrlAccess for raw message option
4e58450 chore: update dev dependencies
541f5fd chore(master): release 9.0.0 (#1827)
0c080fb fix: replace deprecated url.parse with a WHATWG URL wrapper
6a947ac fix!: validate TLS certificates by default when fetching remote content
e3b1bda chore(master): release 8.0.11 (#1826)
4358caf refactor: remove dead checks flagged by Code Quality analysis
cf5195c chore: harden workflow token permissions and update GitHub Actions
067aebe fix: parse Ethereal response props without polynomial regex backtracking
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nodemailer since your current version.

Updates typeorm from 0.3.25 to 0.3.29

Release notes

Sourced from typeorm's releases.

0.3.29

What's Changed

fix: fix up aggregate methods ambiguous column by @Cprakhar in typeorm/typeorm#11822

fix: prevent eager-loaded entities from overwriting manual relations by @LeviHeber in typeorm/typeorm#11267

fix: release query runner when there is no migration to revert by @mjr128 in typeorm/typeorm#11232

fix: add async to the method using setFindOptions() by @bindon in typeorm/typeorm#10787

chore: disable eslint errors for chai assertions by @alumni in typeorm/typeorm#11833

ci(tests): Remove limitation of branches to run on by @OSA413 in typeorm/typeorm#11794

ci: upgrade actions to v6 by @pkuczynski in typeorm/typeorm#11844

docs(v0.3): add version dropdown (stable/dev) by @naorpeled in typeorm/typeorm#11863

fix(sap): QueryBuilder parameter of type JS Date not escaped correctly by @alumni in typeorm/typeorm#11867

feat(sap): add pool timeout by @alumni in typeorm/typeorm#11868

feat(qodo): enable new review experience in v0.3 by @naorpeled in typeorm/typeorm#11910

feat: add returning option to update/upsert operations by @naorpeled in typeorm/typeorm#11782

test: enable repository-returning test by @gioboa in typeorm/typeorm#11913

chore(qodo): disable in progress notification in v0.3 by @naorpeled in typeorm/typeorm#11928

ci(docs): add deploy Github Action to v0.3 branch by @naorpeled in typeorm/typeorm#11929

chore(qodo): disable persistent comments and inline code suggestions in v0.3 by @naorpeled in typeorm/typeorm#11989

chore(deps): update all dependencies to the latest minor version by @alumni in typeorm/typeorm#12015

fix(redis): redis cache version detection by @mguida22 in typeorm/typeorm#11936

ci: remove summary comments location policy by @naorpeled in typeorm/typeorm#12117

ci(qodo): remove /improve from pr and push commands by @naorpeled in typeorm/typeorm#12129

ci: migrate from npm to pnpm by @pkuczynski in typeorm/typeorm#12193

ci(qodo): sync qodo pr agent config from master by @naorpeled in typeorm/typeorm#12265

ci: remove docs indexing by @alumni in typeorm/typeorm#12435

fix(security): validate limit() in Update/SoftDelete query builders by @smith-xyz in typeorm/typeorm#12437

chore(deps): update all minor by @alumni in typeorm/typeorm#12443

chore(release): release 0.3.29 by @michaelbromley in typeorm/typeorm#12442

New Contributors

@LeviHeber made their first contribution in typeorm/typeorm#11267

@mjr128 made their first contribution in typeorm/typeorm#11232

@bindon made their first contribution in typeorm/typeorm#10787

Full Changelog: typeorm/typeorm@0.3.28...0.3.29

0.3.28

What's Changed

build(deps): bump brace-expansion from 2.0.1 to 2.0.2 in /sample/playground by @dependabot[bot] in typeorm/typeorm#11522

chore: update dependencies by @alumni in typeorm/typeorm#11666

chore: fix package preview by @alumni in typeorm/typeorm#11542

fix: add multiSubnetFailover to mssql driver option types by @isaru66 in typeorm/typeorm#10804

ci: introduce jsdoc eslint plugin (warnings only) by @pkuczynski in typeorm/typeorm#11681

feat: add support for jsonpath column type in PostgreSQL by @pkuczynski in typeorm/typeorm#11684

feat: entity schema support trees by @wszgrcy in typeorm/typeorm#11606

ci: remove close stale issues GH action by @gioboa in typeorm/typeorm#11696

docs: remove unused docs example file by @pkuczynski in typeorm/typeorm#11675

docs: updated jsdoc link to PostgreSQL documentation for data types by @pkuczynski in typeorm/typeorm#11680

ci: bump actions/setup-node to v5 and benefit from automatic caching by @pkuczynski in typeorm/typeorm#11709

feat(cli/init): pick dependencies versions from our own package.json by @pkuczynski in typeorm/typeorm#11705

... (truncated)

Changelog

Sourced from typeorm's changelog.

0.3.29 (2026-05-08)

Bug Fixes

add async to the method using setFindOptions() (#10787) (cc07c90)

change import for process dependency (#11248) (1c67c3b)

cli: init command loading non-existing package.json (#11947) (4d9d1a6)

fix up aggregate methods ambiguous column (#11822) (6e34756)

fix up limit with joins (#11987) (3657db8)

getPendingMigrations unnecessarily creating migrations table (#11672) (1dbc224)

postgres: execute queries sequentially to avoid pg 8.19.0 deprecation warning (#12105) (79829a0)

prevent columns with select false from being returned (#11944) (6b20831)

prevent eager-loaded entities from overwriting manual relations (#11267) (2d8c515)

propagate schema and database to closure junction table (#12110) (58b403f)

redis: redis cache version detection (#11936) (f22c7a2)

release query runner when there is no migration to revert (#11232) (a46eb0a)

sap: QueryBuilder parameter of type JS Date not escaped correctly (#11867) (5153436)

security: validate limit() in Update/SoftDelete query builders (#12437) (0d7991a)

virtual property handling in schema builder (#11000) (5bd3255)

Features

add returning option to update/upsert operations (#11782) (11d9767)

sap: add pool timeout (#11868) (b4e2ad2)

sap: support locking in select (#11996) (86a9e3e)

0.3.28 (2025-12-02)

Bug Fixes

add multiSubnetFailover option for mssql (#10804) (83e3a8a)

circular import in SapDriver.ts (#11750) (bed7913)

cli: init command reading package.json from two folders up (#11789) (dd55218)

deps: upgrade glob to fix CVE-2025-64756 (#11784) (dc74f53)

mongodb: add missing findBy method to MongoEntityManager (#11814) (38715bb)

redis: version detection logic (#11815) (6f486e5)

typesense doc sync (#11807) (d0b5454)

Features

add support for jsonpath column type in PostgreSQL (#11684) (4f05718)

cli/init: pick dependencies versions from our own package.json (#11705) (b930909)

entity schema support trees (#11606) (925dee0)

export QueryPartialEntity and QueryDeepPartialEntity types (#11748) (ade198c)

init version in postgres driver only if not set (#11373) (cb1284c)

manage MongoDB SOCKS5 proxy settings (#11731) (d7867eb)

mssql: support 'vector' type for MS SQL Server (#11732) (2681051)

mysql: add pool size options for each connection (#11810) (67f793f)

mysql: add support for vector columns on MariaDB and MySQL (#11670) (cfb3d6c)

... (truncated)

Commits

0ed009a ci: add npm environment to publish job for trusted publishing
6ede38b chore: enable trusted publishing in publish workflow
578d9e9 chore: fix pnpm publish for v0.3
253f060 chore: disable git check on pnpm publish for v0.3
1b5476f chore: set pnpm publish branch for v0.3
17c6ec2 chore(release): release 0.3.29 (#12442)
0ac8092 chore(deps): update all minor (#12443)
0d7991a fix(security): validate limit() in Update/SoftDelete query builders (#12437)
c38c754 ci: remove docs indexing (#12435)
1b66c44 Merge commit from fork
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for typeorm since your current version.

Updates uuid from 8.3.2 to 14.0.0

Release notes

Sourced from uuid's releases.

v14.0.0

14.0.0 (2026-04-19)

⚠ BREAKING CHANGES

expect crypto to be global everywhere (requires node@20+) (#935)

drop node@18 support (#934)

Features

drop node@18 support (#934) (dc4ddb8)

Bug Fixes

expect crypto to be global everywhere (requires node@20+) (#935) (f2c235f)

Use GITHUB_TOKEN for release-please and enable npm provenance (#925) (ffa3138)

v13.0.2

13.0.2 (2026-05-04)

Bug Fixes

rerelease to fix provenance. (49ccb35)

v13.0.1

13.0.1 (2026-04-27)

Bug Fixes

backport fix for GHSA-w5hq-g745-h8pq (9d27ddf)

v13.0.0

13.0.0 (2025-09-08)

⚠ BREAKING CHANGES

make browser exports the default (#901)

Bug Fixes

make browser exports the default (#901) (bce9d72)

v12.0.1

12.0.1 (2026-04-29)

... (truncated)

Changelog

Sourced from uuid's changelog.

14.0.0 (2026-04-19)

Security

Fixes GHSA-w5hq-g745-h8pq: v3(), v5(), and v6() did not validate that writes would remain within the bounds of a caller-supplied buffer, allowing out-of-bounds writes when an invalid offset was provided. A RangeError is now thrown if offset < 0 or offset + 16 > buf.length.

⚠ BREAKING CHANGES

crypto is now expected to be globally defined (requires node@20+) (#935)

drop node@18 support (#934)

upgrade minimum supported TypeScript version to 5.4.3, in keeping with the project's ...
Description has been truncated

Bumps the npm_and_yarn group with 18 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@opentelemetry/core](https://github.com/open-telemetry/opentelemetry-js) | `1.30.1` | `2.8.0` | | [axios](https://github.com/axios/axios) | `0.30.0` | `0.32.0` | | [dompurify](https://github.com/cure53/DOMPurify) | `2.5.8` | `3.4.11` | | [nodemailer](https://github.com/nodemailer/nodemailer) | `6.10.1` | `9.0.1` | | [typeorm](https://github.com/typeorm/typeorm) | `0.3.25` | `0.3.29` | | [uuid](https://github.com/uuidjs/uuid) | `8.3.2` | `14.0.0` | | [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) | `7.28.0` | `7.29.6` | | [webpack-dev-server](https://github.com/webpack/webpack-dev-server) | `4.15.2` | `5.2.5` | | [markdown-it](https://github.com/markdown-it/markdown-it) | `13.0.2` | `14.2.0` | | [next](https://github.com/vercel/next.js) | `14.2.30` | `15.5.18` | | [@babel/plugin-transform-modules-systemjs](https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-modules-systemjs) | `7.27.1` | `7.29.7` | | [basic-ftp](https://github.com/patrickjuchli/basic-ftp) | `5.0.5` | `5.3.1` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.0.6` | `3.1.3` | | [http-proxy-middleware](https://github.com/chimurai/http-proxy-middleware) | `2.0.9` | `2.0.10` | | [js-cookie](https://github.com/js-cookie/js-cookie) | `3.0.5` | `3.0.8` | | [launch-editor](https://github.com/vitejs/launch-editor) | `2.11.0` | `2.14.1` | | [mongoose](https://github.com/Automattic/mongoose) | `8.16.5` | `8.24.1` | | [shell-quote](https://github.com/ljharb/shell-quote) | `1.8.3` | `1.10.0` | Updates `@opentelemetry/core` from 1.30.1 to 2.8.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@v1.30.1...v2.8.0) Updates `axios` from 0.30.0 to 0.32.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v0.30.0...v0.32.0) Updates `dompurify` from 2.5.8 to 3.4.11 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@2.5.8...3.4.11) Updates `nodemailer` from 6.10.1 to 9.0.1 - [Release notes](https://github.com/nodemailer/nodemailer/releases) - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](nodemailer/nodemailer@v6.10.1...v9.0.1) Updates `typeorm` from 0.3.25 to 0.3.29 - [Release notes](https://github.com/typeorm/typeorm/releases) - [Changelog](https://github.com/typeorm/typeorm/blob/master/CHANGELOG.md) - [Commits](typeorm/typeorm@0.3.25...0.3.29) Updates `uuid` from 8.3.2 to 14.0.0 - [Release notes](https://github.com/uuidjs/uuid/releases) - [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md) - [Commits](uuidjs/uuid@v8.3.2...v14.0.0) Updates `@babel/core` from 7.28.0 to 7.29.6 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.6/packages/babel-core) Updates `webpack-dev-server` from 4.15.2 to 5.2.5 - [Release notes](https://github.com/webpack/webpack-dev-server/releases) - [Changelog](https://github.com/webpack/webpack-dev-server/blob/main/CHANGELOG.md) - [Commits](webpack/webpack-dev-server@v4.15.2...v5.2.5) Updates `markdown-it` from 13.0.2 to 14.2.0 - [Changelog](https://github.com/markdown-it/markdown-it/blob/master/CHANGELOG.md) - [Commits](markdown-it/markdown-it@13.0.2...14.2.0) Updates `next` from 14.2.30 to 15.5.18 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v14.2.30...v15.5.18) Updates `@babel/plugin-transform-modules-systemjs` from 7.27.1 to 7.29.7 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.7/packages/babel-plugin-transform-modules-systemjs) Updates `basic-ftp` from 5.0.5 to 5.3.1 - [Release notes](https://github.com/patrickjuchli/basic-ftp/releases) - [Changelog](https://github.com/patrickjuchli/basic-ftp/blob/master/CHANGELOG.md) - [Commits](patrickjuchli/basic-ftp@v5.0.5...v5.3.1) Updates `fast-uri` from 3.0.6 to 3.1.3 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.0.6...v3.1.3) Updates `http-proxy-middleware` from 2.0.9 to 2.0.10 - [Release notes](https://github.com/chimurai/http-proxy-middleware/releases) - [Changelog](https://github.com/chimurai/http-proxy-middleware/blob/v2.0.10/CHANGELOG.md) - [Commits](chimurai/http-proxy-middleware@v2.0.9...v2.0.10) Updates `js-cookie` from 3.0.5 to 3.0.8 - [Release notes](https://github.com/js-cookie/js-cookie/releases) - [Commits](js-cookie/js-cookie@v3.0.5...v3.0.8) Updates `launch-editor` from 2.11.0 to 2.14.1 - [Commits](vitejs/launch-editor@v2.11.0...v2.14.1) Updates `linkify-it` from 4.0.1 to 5.0.0 - [Changelog](https://github.com/markdown-it/linkify-it/blob/master/CHANGELOG.md) - [Commits](markdown-it/linkify-it@4.0.1...5.0.0) Updates `mongoose` from 8.16.5 to 8.24.1 - [Release notes](https://github.com/Automattic/mongoose/releases) - [Changelog](https://github.com/Automattic/mongoose/blob/8.24.1/CHANGELOG.md) - [Commits](Automattic/mongoose@8.16.5...8.24.1) Updates `shell-quote` from 1.8.3 to 1.10.0 - [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md) - [Commits](ljharb/shell-quote@v1.8.3...v1.10.0) --- updated-dependencies: - dependency-name: "@opentelemetry/core" dependency-version: 2.8.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: axios dependency-version: 0.32.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: dompurify dependency-version: 3.4.11 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: nodemailer dependency-version: 9.0.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: typeorm dependency-version: 0.3.29 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: uuid dependency-version: 14.0.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@babel/core" dependency-version: 7.29.6 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: webpack-dev-server dependency-version: 5.2.5 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: markdown-it dependency-version: 14.2.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.18 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@babel/plugin-transform-modules-systemjs" dependency-version: 7.29.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: basic-ftp dependency-version: 5.3.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: http-proxy-middleware dependency-version: 2.0.10 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-cookie dependency-version: 3.0.8 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: launch-editor dependency-version: 2.14.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: linkify-it dependency-version: 5.0.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: mongoose dependency-version: 8.24.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: shell-quote dependency-version: 1.10.0 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

socket-security · 2026-07-15T04:04:49Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
npm/next@14.2.30 ⏵ 15.5.18	^-1	⁺⁷⁰	^-3	⁺⁴⁹
npm/dompurify@2.5.8 ⏵ 3.4.11	⁺¹	⁺⁵⁰			^-20
npm/@types/express@4.17.23 ⏵ 4.17.25
npm/@babel/core@7.28.0 ⏵ 7.29.6		⁺¹	⁺¹	⁺¹
npm/typeorm@0.3.25 ⏵ 0.3.29	^-16	⁺¹⁸	⁺¹
npm/dayjs@1.11.13 ⏵ 1.11.21			⁺¹
npm/markdown-it@13.0.2 ⏵ 14.2.0	^-12	⁺³	⁺¹	⁺⁴
npm/express@4.21.2 ⏵ 4.22.2	⁺¹			^-1
npm/uuid@11.1.0 ⏵ 14.0.0	⁺¹	⁺²
npm/webpack-dev-server@4.15.2 ⏵ 5.2.5	⁺¹	⁺⁶		⁺²
npm/@opentelemetry/core@2.8.0
npm/nodemailer@6.10.1 ⏵ 9.0.1	⁺³	⁺²⁹	⁺¹	⁺¹
npm/@opentelemetry/semantic-conventions@1.36.0 ⏵ 1.43.0	⁺¹			⁺⁵
npm/axios@1.12.0 ⏵ 0.32.0	⁺²	⁺⁷⁵		⁺²

View full report

socket-security · 2026-07-15T04:04:51Z

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. It is recommended to resolve "Warn" alerts too. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Block		Publisher changed: npm `@mongodb-js/saslprep` is now published by gribnoysup Author: gribnoysup From: yarn.lock → `npm/natural@6.12.0` → `npm/@mongodb-js/saslprep@1.4.12` ℹ Read more on: This package \| This alert \| What is unstable ownership? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@mongodb-js/saslprep@1.4.12`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Potential vulnerability: npm `next` with risk level "medium" Location: Package overview From: packages/web/package.json → `npm/next@15.5.18` ℹ Read more on: This package \| This alert \| Navigating potential vulnerabilities Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: It is advisable to proceed with caution. Engage in a review of the package's security aspects and consider reaching out to the package maintainer for the latest information or patches. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/next@15.5.18`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `mongoose` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: yarn.lock → `npm/natural@6.12.0` → `npm/mongoose@8.24.1` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/mongoose@8.24.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `next` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: packages/web/package.json → `npm/next@15.5.18` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/next@15.5.18`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `typeorm` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: packages/api/package.json → `npm/typeorm@0.3.29` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/typeorm@0.3.29`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `typeorm` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: packages/api/package.json → `npm/typeorm@0.3.29` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/typeorm@0.3.29`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Recently published: npm `@opentelemetry/semantic-conventions` published 5 days ago Location: Package overview From: packages/api/package.json → `npm/@opentelemetry/semantic-conventions@1.43.0` ℹ Read more on: This package \| This alert \| What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@opentelemetry/semantic-conventions@1.43.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Recently published: npm `body-parser` published 6 days ago Location: Package overview From: yarn.lock → `npm/express@4.22.2` → `npm/body-parser@1.20.6` ℹ Read more on: This package \| This alert \| What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/body-parser@1.20.6`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Install-time scripts: npm `sharp` during install Install script: install Source: `node install/check.js \|\| npm run build` From: yarn.lock → `npm/next@15.5.18` → `npm/sharp@0.34.5` ℹ Read more on: This package \| This alert \| What is an install script? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/sharp@0.34.5`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Recently published: npm `shell-quote` published 4 days ago Location: Package overview From: yarn.lock → `npm/webpack-dev-server@5.2.5` → `npm/concurrently@7.6.0` → `npm/@graphql-codegen/cli@2.16.5` → `npm/shell-quote@1.10.0` ℹ Read more on: This package \| This alert \| What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/shell-quote@1.10.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Publisher changed: npm `@mongodb-js/saslprep` is now published by gribnoysup instead of devtoolsbot New Author: gribnoysup Previous Author: devtoolsbot From: yarn.lock → `npm/natural@6.12.0` → `npm/@mongodb-js/saslprep@1.4.12` ℹ Read more on: This package \| This alert \| What is new author? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@mongodb-js/saslprep@1.4.12`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Publisher changed: npm `finalhandler` is now published by ulisesgascon instead of wesleytodd New Author: ulisesgascon Previous Author: wesleytodd From: yarn.lock → `npm/express@4.22.2` → `npm/finalhandler@1.3.2` ℹ Read more on: This package \| This alert \| What is new author? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/finalhandler@1.3.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Publisher changed: npm `http-errors` is now published by ulisesgascon instead of dougwilson New Author: ulisesgascon Previous Author: dougwilson From: yarn.lock → `npm/express@4.22.2` → `npm/http-errors@2.0.1` ℹ Read more on: This package \| This alert \| What is new author? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/http-errors@2.0.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Publisher changed: npm `path-to-regexp` is now published by ulisesgascon instead of blakeembrey New Author: ulisesgascon Previous Author: blakeembrey From: yarn.lock → `npm/express@4.22.2` → `npm/path-to-regexp@0.1.13` ℹ Read more on: This package \| This alert \| What is new author? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/path-to-regexp@0.1.13`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Publisher changed: npm `statuses` is now published by ulisesgascon instead of dougwilson New Author: ulisesgascon Previous Author: dougwilson From: yarn.lock → `npm/express@4.22.2` → `npm/statuses@2.0.2` ℹ Read more on: This package \| This alert \| What is new author? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/statuses@2.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 15, 2026

Navigation Menu

Uh oh!

Bump the npm_and_yarn group across 1 directory with 19 updates - #2

Bump the npm_and_yarn group across 1 directory with 19 updates#2
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-8581f66e9c

dependabot Bot commented on behalf of github Jul 15, 2026

Uh oh!

socket-security Bot commented Jul 15, 2026

Uh oh!

socket-security Bot commented Jul 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 15, 2026

v2.8.0

2.8.0

🚀 Features

🐛 Bug Fixes

v2.7.1

2.7.1

🐛 Bug Fixes

🏠 Internal

v2.7.0

2.7.0

🚀 Features

🐛 Bug Fixes

🏠 Internal

2.8.0

🚀 Features

🐛 Bug Fixes

2.7.1

🐛 Bug Fixes

🏠 Internal

2.7.0

🚀 Features

🐛 Bug Fixes

🏠 Internal

2.6.1

🐛 Bug Fixes

v0.32.0 — May 4, 2026

⚠️ Breaking Changes & Deprecations

🔒 Security Fixes

🔧 Maintenance & Chores

v0.31.1

⚠️ Breaking Changes & Deprecations

🔒 Security Fixes

🔧 Maintenance & Chores

v0.31.0

🔒 Security Fixes

DOMPurify 3.4.11

DOMPurify 3.4.10

DOMPurify 3.4.9

DOMPurify 3.4.8

DOMPurify 3.4.7

DOMPurify 3.4.6

DOMPurify 3.4.5

v9.0.1

9.0.1 (2026-06-17)

Bug Fixes

v9.0.0

9.0.0 (2026-06-14)

⚠ BREAKING CHANGES

Bug Fixes

v8.0.11

8.0.11 (2026-06-10)

Bug Fixes

v8.0.10

8.0.10 (2026-05-29)

Bug Fixes

v8.0.9

8.0.9 (2026-05-26)

Bug Fixes

9.0.1 (2026-06-17)

Bug Fixes

9.0.0 (2026-06-14)

⚠ BREAKING CHANGES

Bug Fixes

8.0.11 (2026-06-10)

Bug Fixes

8.0.10 (2026-05-29)

Bug Fixes

8.0.9 (2026-05-26)

Bug Fixes

8.0.8 (2026-05-23)

Bug Fixes

0.3.29

What's Changed

New Contributors

0.3.28

What's Changed

0.3.29 (2026-05-08)