Skip to content

Bump the npm_and_yarn group across 1 directory with 7 updates#25

Closed
dependabot[bot] wants to merge 34 commits intomainfrom
dependabot/npm_and_yarn/npm_and_yarn-d9f5b0ece4
Closed

Bump the npm_and_yarn group across 1 directory with 7 updates#25
dependabot[bot] wants to merge 34 commits intomainfrom
dependabot/npm_and_yarn/npm_and_yarn-d9f5b0ece4

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Feb 14, 2026 •
edited
Loading

Bumps the npm_and_yarn group with 6 updates in the / directory:

Package From To
pnpm 9.15.9 10.28.2
@remix-run/express 2.15.3 2.16.3
@remix-run/node 2.15.3 2.17.2
react-router 6.29.0 6.30.2
vite-plugin-static-copy 1.0.6 2.3.2
vite 5.4.14 5.4.21

Updates pnpm from 9.15.9 to 10.28.2

Release notes

Sourced from pnpm's releases.

pnpm 10.28.2

Patch Changes

  • Security fix: prevent path traversal in directories.bin field.

  • When pnpm installs a file: or git: dependency, it now validates that symlinks point within the package directory. Symlinks to paths outside the package root are skipped to prevent local data from being leaked into node_modules.

    This fixes a security issue where a malicious package could create symlinks to sensitive files (e.g., /etc/passwd, ~/.ssh/id_rsa) and have their contents copied when the package is installed.

    Note: This only affects file: and git: dependencies. Registry packages (npm) have symlinks stripped during publish and are not affected.

  • Fixed optional dependencies to request full metadata from the registry to get the libc field, which is required for proper platform compatibility checks #9950.

Platinum Sponsors

Gold Sponsors

... (truncated)

Changelog

Sourced from pnpm's changelog.

10.28.2

Patch Changes

  • Security fix: prevent path traversal in directories.bin field.

  • When pnpm installs a file: or git: dependency, it now validates that symlinks point within the package directory. Symlinks to paths outside the package root are skipped to prevent local data from being leaked into node_modules.

    This fixes a security issue where a malicious package could create symlinks to sensitive files (e.g., /etc/passwd, ~/.ssh/id_rsa) and have their contents copied when the package is installed.

    Note: This only affects file: and git: dependencies. Registry packages (npm) have symlinks stripped during publish and are not affected.

  • Fixed optional dependencies to request full metadata from the registry to get the libc field, which is required for proper platform compatibility checks #9950.

10.28.1

Patch Changes

  • Fixed installation of config dependencies from private registries.

    Added support for object type in configDependencies when the tarball URL returned from package metadata differs from the computed URL #10431.

  • Fix path traversal vulnerability in binary fetcher ZIP extraction

    • Validate ZIP entry paths before extraction to prevent writing files outside target directory
    • Validate BinaryResolution.prefix (basename) to prevent directory escape via crafted prefix
    • Both attack vectors now throw ERR_PNPM_PATH_TRAVERSAL error

  • Support plain http:// and https:// URLs ending with .git as git repository dependencies.

    Previously, URLs like https://gitea.example.org/user/repo.git#commit were not recognized as git repositories because they lacked the git+ prefix (e.g., git+https://). This caused issues when installing dependencies from self-hosted git servers like Gitea or Forgejo that don't provide tarball downloads.

    Changes:

    • The git resolver now runs before the tarball resolver, ensuring git URLs are handled by the correct resolver
    • The git resolver now recognizes plain http:// and https:// URLs ending in .git as git repositories
    • Removed the isRepository check from the tarball resolver since it's no longer needed with the new resolver order

    Fixes #10468

  • pnpm run -r and pnpm run --filter now fail with a non-zero exit code when no packages have the specified script. Previously, this only failed when all packages were selected. Use --if-present to suppress this error #6844.

  • Fixed a path traversal vulnerability in tarball extraction on Windows. The path normalization was only checking for ./ but not .\. Since backslashes are directory separators on Windows, malicious packages could use paths like foo\..\..\.npmrc to write files outside the package directory.

  • When running "pnpm exec" from a subdirectory of a project, don't change the current working directory to the root of the project #5759.

  • Fixed a path traversal vulnerability in pnpm's bin linking. Bin names starting with @ bypassed validation, and after scope normalization, path traversal sequences like ../../ remained intact.

  • Revert Try to avoid making network calls with preferOffline #10334.

  • Fix --save-peer to write valid semver ranges to peerDependencies for protocol-based installs (e.g. jsr:) by deriving from resolved versions when available and falling back to * if none is available #10417.

  • Do not exclude the root workspace project, when it is explicitly selected via a filter #10465.

10.28.0

Minor Changes

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for pnpm since your current version.


Updates @remix-run/express from 2.15.3 to 2.16.3

Changelog

Sourced from @​remix-run/express's changelog.

2.16.3

Patch Changes

  • Better validation of x-forwarded-host header to preent potential security issues. (#10553)
  • Updated dependencies:
    • @remix-run/node@2.16.3

2.16.2

Patch Changes

  • Updated dependencies:
    • @remix-run/node@2.16.2

2.16.1

Patch Changes

  • Updated dependencies:
    • @remix-run/node@2.16.1

2.16.0

Patch Changes

  • Updated dependencies:
    • @remix-run/node@2.16.0
Commits

Updates @remix-run/node from 2.15.3 to 2.17.2

Commits

Updates react-router from 6.29.0 to 6.30.2

Release notes

Sourced from react-router's releases.

v6.30.2

See the changelog for release notes: https://github.com/remix-run/react-router/blob/v6/CHANGELOG.md#v6302

v6.30.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v6301

v6.30.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v6300

Changelog

Sourced from react-router's changelog.

v6.30.2

Date: 2025-11-13

Security Notice

This release addresses 1 security vulnerability:

Patch Changes

  • Normalize double-slashes in resolvePath (#14537)

Full Changelog: v6.30.1...v6.30.2

v6.30.1

Date: 2025-05-20

Patch Changes

  • Partially revert optimization added in 6.29.0 to reduce calls to matchRoutes because it surfaced other issues (#13623)
  • Stop logging invalid warning when v7_relativeSplatPath is set to false (#13502)

Full Changelog: v6.30.0...v6.30.1

v6.30.0

Date: 2025-02-27

Minor Changes

  • Add fetcherKey as a parameter to patchRoutesOnNavigation (#13109)

Patch Changes

  • Fix regression introduced in 6.29.0 via #12169 that caused issues navigating to hash routes inside splat routes for applications using Lazy Route Discovery (patchRoutesOnNavigation) (#13108)

Full Changelog: v6.29.0...v6.30.0

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for react-router since your current version.


Updates vite-plugin-static-copy from 1.0.6 to 2.3.2

Release notes

Sourced from vite-plugin-static-copy's releases.

vite-plugin-static-copy@2.3.2

Patch Changes

vite-plugin-static-copy@2.3.1

Patch Changes

vite-plugin-static-copy@2.3.0

Minor Changes

Patch Changes

vite-plugin-static-copy@2.2.0

Minor Changes

vite-plugin-static-copy@2.1.0

Minor Changes

  • #133 b9c09bd Thanks @​rschristian! - Allows user to optionally configure when the plugin is ran by passing in a Rollup hook name

vite-plugin-static-copy@2.0.0

Major Changes

Changelog

Sourced from vite-plugin-static-copy's changelog.

2.3.2

Patch Changes

2.3.1

Patch Changes

2.3.0

Minor Changes

Patch Changes

2.2.0

Minor Changes

2.1.0

Minor Changes

  • #133 b9c09bd Thanks @​rschristian! - Allows user to optionally configure when the plugin is ran by passing in a Rollup hook name

2.0.0

Major Changes

Commits

Updates vite from 5.4.14 to 5.4.21

Release notes

Sourced from vite's releases.

v5.4.21

Please refer to CHANGELOG.md for details.

v5.4.20

Please refer to CHANGELOG.md for details.

v5.4.19

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

5.4.21 (2025-10-20)

5.4.20 (2025-09-08)

5.4.19 (2025-04-30)

5.4.18 (2025-04-10)

5.4.17 (2025-04-03)

5.4.16 (2025-03-31)

5.4.15 (2025-03-24)

Commits

Updates undici from 6.21.1 to 6.23.0

Release notes

Sourced from undici's releases.

v6.23.0

⚠️ Security Release

This fixes GHSA-g9mf-h72j-4rw9 and CVE-2026-22036.

Full Changelog: nodejs/undici@v6.22.0...v6.23.0

v6.22.0

What's Changed

Full Changelog: nodejs/undici@v6.21.3...v6.22.0

v6.21.3

What's Changed

Full Changelog: nodejs/undici@v6.21.2...v6.21.3

v6.21.2

What's Changed

New Contributors

Full Changelog: nodejs/undici@v6.21.1...v6.21.2

Commits
  • fbc31e2 Bumped v6.23.0
  • 3477c94 chore: release flow using provenance
  • d3aafea fix: limit Content-Encoding chain to 5 to prevent resource exhaustion
  • f9c9185 Bumped v6.22.0
  • f670f2a feat: make UndiciErrors reliable to instanceof (#4472) (#4480)
  • 422e397 feat(ProxyAgent) improve Curl-y behavior in HTTP->HTTP Proxy connections (#41...
  • 4a06ffe feat(ProxyAgent): match Curl behavior in HTTP->HTTP Proxy connections (#4180)...
  • 4cb3974 fix: fix EnvHttpProxyAgent for the Node.js bundle (#4064) (#4432)
  • 44c23e5 fix: fix wrong stream canceled up after cloning (v6) (#4414)
  • da0e823 Bumped v6.21.4
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for undici since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

skullcrushercmd and others added 30 commits October 18, 2024 21:29
@skullcrushercmd
almost done, move to desktop
67281d9
@skullcrushercmd
latest but still not working
cd30beb
@skullcrushercmd
working!!
47f300d
@skullcrushercmd
guh
25d8ae8
@skullcmd
testing out firebase
0bcc4ae
@skullcmd
fixed logging, should be a release
e32dd21
@skullcrushercmd
rate limits added
12fd604
@skullcrushercmd
redis + filesystem implemented, redis not tested
8a1cb24
@skullcrushercmd
switch to github
4c10d9c
@skullcrushercmd
tryna get coder auth to work
66746a2
@skullcrushercmd
added routes
836cba3
@skullcrushercmd
not fully tested but added user friendly startup
7155e99
@skullcrushercmd
redis and filesys sync
5426e52
@skullcrushercmd
superb quality from copilot pull req, fixed final issues i believe
a577835 
* Initial plan

* Fix critical API issues - server now starts and passes tests

Co-authored-by: skullcrushercmd <93234024+skullcrushercmd@users.noreply.github.com>

* Fix models endpoint path issue - all critical functionality now working

Co-authored-by: skullcrushercmd <93234024+skullcrushercmd@users.noreply.github.com>

* Fix critical API issues preventing server startup and functionality

Co-authored-by: skullcrushercmd <93234024+skullcrushercmd@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: skullcrushercmd <93234024+skullcrushercmd@users.noreply.github.com>
@skullcrushercmd
production ready
41c33eb
@skullcrushercmd
Merge pull request #2 from skullcrushercmd/copilot/vscode1756610388575
ff93653 
Copilot/vscode1756610388575
@skullcrushercmd
added websocket support and easier testing utils
d311a08
@skullcrushercmd
Merge pull request #3 from AnyVM-Tech/copilot/vscode1756610388575
7129b31 
added websocket support and hardened testing
Fix Gemini image data URLs
24f5b01
Updates build configuration and dependencies
02ff2e9
Enhances core data management and server infrastructure
e027ae2
Adds shared modules for rate limiting and key validation
ac2d489
Refactors providers with enhanced handling and passthrough
b2d21d8
Standardizes API routes and adds new endpoints
6c3fe1e
Enables Realtime API and WebSocket broadcasting
f50604d
Updates developer scripts for key management
d71f5c6
Updates model definitions
58ad068
Update gitignore and stop tracking log files
6e00521
@dependabot
Bump pnpm from 10.5.2 to 10.28.2
0c0ab74 
Bumps [pnpm](https://github.com/pnpm/pnpm/tree/HEAD/pnpm) from 10.5.2 to 10.28.2.
- [Release notes](https://github.com/pnpm/pnpm/releases)
- [Changelog](https://github.com/pnpm/pnpm/blob/v10.28.2/pnpm/CHANGELOG.md)
- [Commits](https://github.com/pnpm/pnpm/commits/v10.28.2/pnpm)

---
updated-dependencies:
- dependency-name: pnpm
  dependency-version: 10.28.2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump axios from 1.8.1 to 1.13.5
8d7e053 
Bumps [axios](https://github.com/axios/axios) from 1.8.1 to 1.13.5.
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.8.1...v1.13.5)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 1.13.5
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
skullcrushercmd and others added 4 commits February 14, 2026 01:55
@skullcrushercmd
Configure Dependabot for npm updates
9a2edcf 
Added npm package ecosystem updates for api and ui directories.
@skullcrushercmd
Merge pull request #4 from AnyVM-Tech/dependabot/npm_and_yarn/pnpm-10…
a37a4a8 
….28.2

Bump pnpm from 10.5.2 to 10.28.2
@skullcrushercmd
Merge pull request #5 from AnyVM-Tech/dependabot/npm_and_yarn/axios-1…
4043638 
….13.5

Bump axios from 1.8.1 to 1.13.5
@dependabot
Bump the npm_and_yarn group across 1 directory with 7 updates
78bc7a3 
Bumps the npm_and_yarn group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [pnpm](https://github.com/pnpm/pnpm/tree/HEAD/pnpm) | `9.15.9` | `10.28.2` |
| [@remix-run/express](https://github.com/remix-run/remix/tree/HEAD/packages/remix-express) | `2.15.3` | `2.16.3` |
| [@remix-run/node](https://github.com/remix-run/remix/tree/HEAD/packages/remix-node) | `2.15.3` | `2.17.2` |
| [react-router](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router) | `6.29.0` | `6.30.2` |
| [vite-plugin-static-copy](https://github.com/sapphi-red/vite-plugin-static-copy) | `1.0.6` | `2.3.2` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `5.4.14` | `5.4.21` |



Updates `pnpm` from 9.15.9 to 10.28.2
- [Release notes](https://github.com/pnpm/pnpm/releases)
- [Changelog](https://github.com/pnpm/pnpm/blob/v10.28.2/pnpm/CHANGELOG.md)
- [Commits](https://github.com/pnpm/pnpm/commits/v10.28.2/pnpm)

Updates `@remix-run/express` from 2.15.3 to 2.16.3
- [Release notes](https://github.com/remix-run/remix/releases)
- [Changelog](https://github.com/remix-run/remix/blob/@remix-run/express@2.16.3/packages/remix-express/CHANGELOG.md)
- [Commits](https://github.com/remix-run/remix/commits/@remix-run/express@2.16.3/packages/remix-express)

Updates `@remix-run/node` from 2.15.3 to 2.17.2
- [Release notes](https://github.com/remix-run/remix/releases)
- [Commits](https://github.com/remix-run/remix/commits/remix@2.17.2/packages/remix-node)

Updates `react-router` from 6.29.0 to 6.30.2
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/main/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/react-router@6.30.2/packages/react-router)

Updates `vite-plugin-static-copy` from 1.0.6 to 2.3.2
- [Release notes](https://github.com/sapphi-red/vite-plugin-static-copy/releases)
- [Changelog](https://github.com/sapphi-red/vite-plugin-static-copy/blob/vite-plugin-static-copy@2.3.2/CHANGELOG.md)
- [Commits](https://github.com/sapphi-red/vite-plugin-static-copy/compare/vite-plugin-static-copy@1.0.6...vite-plugin-static-copy@2.3.2)

Updates `vite` from 5.4.14 to 5.4.21
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v5.4.21/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v5.4.21/packages/vite)

Updates `undici` from 6.21.1 to 6.23.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.21.1...v6.23.0)

---
updated-dependencies:
- dependency-name: pnpm
  dependency-version: 10.28.2
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@remix-run/express"
  dependency-version: 2.16.3
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@remix-run/node"
  dependency-version: 2.17.2
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: react-router
  dependency-version: 6.30.2
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: vite-plugin-static-copy
  dependency-version: 2.3.2
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 5.4.21
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 6.23.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Feb 14, 2026
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github Feb 18, 2026

Looks like these dependencies are no longer updatable, so this is no longer needed.

@dependabot dependabot Bot closed this Feb 18, 2026
@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/npm_and_yarn-d9f5b0ece4 branch February 18, 2026 23:32
@skullcrushercmd skullcrushercmd mentioned this pull request Apr 27, 2026
Merged
3 tasks
skullcrushercmd added a commit that referenced this pull request Apr 27, 2026
@skullcrushercmd
chore: bump apps/anyscan submodule pointer to ef60f6f (#73)
f26ad0f 
Pulls in AnyScan PRs #14 through #30:

- #14 bbe4cf2 fix: triage and fix the 11 baseline test failures
- #15 d43d05f feat(followon): stream port-scan results into host-scan tasks
- #16 0918271 feat: GraphQL endpoint and introspection discovery rules
- #17 f2eb2d7 feat: dependency-manifests path profile
- #18 feat: container-orchestration path profile
- #19 feat: build-artifacts path profile
- #20 feat: cicd-configs path profile
- #21 feat: mobile-artifacts path profile
- #22 feat: cloud-storage-listing path profile
- #23 feat: MLOps tech fingerprints
- #24 feat: modern JS framework tech fingerprints
- #25 feat: verbose stack-trace disclosure detector
- #26 feat: modern credential-token detectors (GH PAT v2 / JWT alg:none / Cloudflare / Datadog)
- #27 feat: HTTP header-policy detectors (CORS/HSTS/CSP)
- #28 e97012f9 fix(worker): reserve egress bandwidth for agentd via tc/qdisc + safety rate cap
- #29 d4986a7 feat(operator): shared shell + /app/overview page (pilot)
- #30 ef60f6f1 feat(worker): fetch inventory policy from control plane at agentd startup

Co-authored-by: skullcmd <skullcmd@anyvm.tech>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@skullcrushercmd @skullcmd