Skip to content

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Aug 8, 2025

Bumps the npm_and_yarn group with 5 updates in the / directory:

Package From To
is-my-json-valid 2.20.5 2.20.6
mocha 8.1.1 11.7.1
standard 10.0.3 17.1.2
@babel/traverse 7.11.0 7.28.0
pathval 1.1.0 1.1.1

Updates is-my-json-valid from 2.20.5 to 2.20.6

Commits

Updates mocha from 8.1.1 to 11.7.1

Release notes

Sourced from mocha's releases.

v11.7.1

11.7.1 (2025-06-24)

🩹 Fixes

  • always fallback to import() if require() fails (#5384) (295c168)

🧹 Chores

v11.7.0

11.7.0 (2025-06-18)

🌟 Features

v11.6.0

11.6.0 (2025-06-09)

🌟 Features

v11.5.0

11.5.0 (2025-05-22)

🌟 Features

v11.4.0

11.4.0 (2025-05-19)

🌟 Features

📚 Documentation

  • added CHANGELOG.md note around 11.1 yargs-parser update (#5362) (618415d)

... (truncated)

Changelog

Sourced from mocha's changelog.

11.7.1 (2025-06-24)

🩹 Fixes

  • always fallback to import() if require() fails (#5384) (295c168)

🧹 Chores

11.7.0 (2025-06-18)

🌟 Features

11.6.0 (2025-06-09)

🌟 Features

11.5.0 (2025-05-22)

🌟 Features

11.4.0 (2025-05-19)

🌟 Features

📚 Documentation

  • added CHANGELOG.md note around 11.1 yargs-parser update (#5362) (618415d)

11.3.0 (2025-05-16)

🌟 Features

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by voxpelli, a new releaser for mocha since your current version.


Updates standard from 10.0.3 to 17.1.2

Release notes

Sourced from standard's releases.

v17.1.2

  • Unpin and bump eslint-plugin-react(#1976) 004e63b

standard/standard@v17.1.1...v17.1.2

v17.1.1

  • Pin eslint-plugin-react to 7.35.2 (#1976) d535d98

standard/standard@v17.1.0...v17.1.1

v17.1.0

  • Update dependencies and prepare release 17.1.0 (#1908) a4049f8
  • Add version-guard to silent failure on old node (#1829) 7dc2ab0 85316d1 26efe34 f635e4e 6dd2162

standard/standard@v17.0.0...v17.1.0

v17.0.0

We're super excited to announce standard 17!

This major release fully focuses on getting in sync with the wider ESLint ecosystem and doesn't in itself introduce any new rules or features.

When you upgrade, consider running standard --fix to automatically format your code to match the current set of rules.

This is the first release by two of our standard co-maintainers @​theoludwig and @​voxpelli. Buy them a cake if you run into them, thanks for getting this release out!

Major changes

  • eslint-config-node has been replaced with the up to date fork eslint-config-n. If you have used comments like // eslint-disable-line node/no-deprecated-api you now have to reference the n/ rules instead.
  • object-shorthand rule (as warning)
  • Use of ESLint 8, which allows for support for all of the latest syntax that ESLint 8 includes, such as top level await #1548 #1775
  • --verbose by default

Changed features

  • Update eslint from ~7.18.0 to ^8.13.0
  • Update eslint-config-standard from 16.0.3 to 17.0.0 to adapt to ESLint 8
  • Update eslint-config-standard-jsx from 10.0.0 to ^11.0.0 to adapt to ESLint 8
  • Update standard-engine from ^14 to ^15.0.0 to adapt to ESLint 8, see its CHANGELOG
  • Move from eslint-plugin-node@~11.1.0 to eslint-plugin-n@^15.1.0 to adapt to ESLint 8
  • Update eslint-plugin-import from ~2.24.2 to ^2.26.0
  • Update eslint-plugin-promise from ~5.1.0 to ^6.0.0
  • Update eslint-plugin-react from ~7.25.1 to ^7.28.0

standard/standard@v16.0.4...v17.0.0

v17.0.0-2

  • fix: update eslint-config-standard-jsx to fix #1548 (#1775) c120a60

... (truncated)

Changelog

Sourced from standard's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[17.1.0] - 2023-05-29

[17.0.0] - 2022-04-20

We're super excited to announce standard 17!

This major release fully focuses on getting in sync with the wider ESLint ecosystem and doesn't in itself introduce any new rules or features.

When you upgrade, consider running standard --fix to automatically format your code to match the current set of rules.

This is the first release by two of our standard co-maintainers @​Divlo and @​voxpelli. Buy them a cake if you run into them, thanks for getting this release out!

Major changes

  • eslint-config-node has been replaced with the up to date fork eslint-config-n. If you have used comments like // eslint-disable-line node/no-deprecated-api you now have to reference the n/ rules instead.
  • object-shorthand rule (as warning)
  • Use of ESLint 8, which allows for support for all of the latest syntax that ESLint 8 includes, such as top level await #1548 #1775
  • --verbose by default

Changed features

  • Update eslint from ~7.18.0 to ^8.13.0
  • Update eslint-config-standard from 16.0.3 to 17.0.0 to adapt to ESLint 8
  • Update eslint-config-standard-jsx from 10.0.0 to ^11.0.0 to adapt to ESLint 8
  • Update standard-engine from ^14 to ^15.0.0 to adapt to ESLint 8, see its CHANGELOG
  • Move from eslint-plugin-node@~11.1.0 to eslint-plugin-n@^15.1.0 to adapt to ESLint 8
  • Update eslint-plugin-import from ~2.24.2 to ^2.26.0
  • Update eslint-plugin-promise from ~5.1.0 to ^6.0.0
  • Update eslint-plugin-react from ~7.25.1 to ^7.28.0

[17.0.0-2] - 2022-02-03

  • Fix: Follow up to the fix of #1548 in 17.0.0-1 #1775

[17.0.0-1] - 2022-01-31

  • Fix: Ensure we support all of the latest syntax that ESLint 8 includes, such as top level await #1548

[17.0.0-0] - 2022-01-31

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by voxpelli, a new releaser for standard since your current version.


Updates @babel/traverse from 7.11.0 to 7.28.0

Release notes

Sourced from @​babel/traverse's releases.

v7.28.0 (2025-07-02)

🚀 New Feature

  • babel-node
  • babel-types
  • babel-compat-data, babel-preset-env
  • babel-core, babel-parser
  • babel-generator, babel-parser
  • babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions, babel-plugin-transform-object-rest-spread, babel-traverse, babel-types
  • babel-parser, babel-traverse, babel-types
  • babel-generator, babel-plugin-proposal-destructuring-private, babel-plugin-proposal-discard-binding, babel-plugin-transform-destructuring, babel-plugin-transform-explicit-resource-management, babel-plugin-transform-react-display-name, babel-types
  • babel-generator, babel-parser, babel-plugin-proposal-destructuring-private, babel-plugin-transform-block-scoping, babel-plugin-transform-object-rest-spread, babel-plugin-transform-typescript, babel-traverse, babel-types

🐛 Bug Fix

🏠 Internal

  • babel-compat-data, babel-plugin-proposal-decorators, babel-plugin-transform-async-generator-functions, babel-plugin-transform-json-modules, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs3

Committers: 5

v7.27.7 (2025-06-26)

Thanks @​arthur-mountain and @​evankanderson for your first PRs!

👓 Spec Compliance

  • babel-parser, babel-plugin-transform-classes
  • babel-parser

🐛 Bug Fix

... (truncated)

Changelog

Sourced from @​babel/traverse's changelog.

v7.28.0 (2025-07-02)

🚀 New Feature

  • babel-node
  • babel-types
  • babel-compat-data, babel-preset-env
  • babel-core, babel-parser
  • babel-generator, babel-parser
  • babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions, babel-plugin-transform-object-rest-spread, babel-traverse, babel-types
  • babel-parser, babel-traverse, babel-types
  • babel-generator, babel-plugin-proposal-destructuring-private, babel-plugin-proposal-discard-binding, babel-plugin-transform-destructuring, babel-plugin-transform-explicit-resource-management, babel-plugin-transform-react-display-name, babel-types
  • babel-generator, babel-parser, babel-plugin-proposal-destructuring-private, babel-plugin-transform-block-scoping, babel-plugin-transform-object-rest-spread, babel-plugin-transform-typescript, babel-traverse, babel-types

🐛 Bug Fix

🏠 Internal

  • babel-compat-data, babel-plugin-proposal-decorators, babel-plugin-transform-async-generator-functions, babel-plugin-transform-json-modules, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs3

v7.27.7 (2025-06-26)

👓 Spec Compliance

  • babel-parser, babel-plugin-transform-classes
  • babel-parser

🐛 Bug Fix

🏠 Internal

  • babel-plugin-transform-destructuring, babel-plugin-transform-object-rest-spread
    • #17389 Use NodePath#splitExportDeclaration in destructuring transforms (@​JLHwung)

... (truncated)

Commits

Updates flat from 4.1.0 to 5.0.2

Commits
  • e5ffd66 Release 5.0.2
  • fdb79d5 Update dependencies, refresh lockfile, format with standard.
  • e52185d Test against node 14 in CI.
  • 0189cb1 Avoid arrow function syntax.
  • f25d3a1 Release 5.0.1
  • 54cc7ad use standard formatting
  • 779816e drop dependencies
  • 2eea6d3 Bump lodash from 4.17.15 to 4.17.19
  • a61a554 Bump acorn from 7.1.0 to 7.4.0
  • 20ef0ef Fix prototype pollution on unflatten
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by timoxley, a new releaser for flat since your current version.


Updates json5 from 2.1.3 to 1.0.2

Changelog

Sourced from json5's changelog.

Unreleased [code, diff]

v2.2.3 [code, diff]

  • Fix: json5@2.2.3 is now the 'latest' release according to npm instead of v1.0.2. (#299)

v2.2.2 [code, diff]

  • Fix: Properties with the name __proto__ are added to objects and arrays. (#199) This also fixes a prototype pollution vulnerability reported by Jonathan Gregson! (#295).

v2.2.1 [code, diff]

v2.2.0 [code, diff]

  • New: Accurate and documented TypeScript declarations are now included. There is no need to install @types/json5. (#236, #244)
Commits

Updates jsonpointer from 4.1.0 to 5.0.1

Release notes

Sourced from jsonpointer's releases.

Version 5.0.1

Changelog

v5.0.0

5.0.0 (2021-10-31)

Bug Fixes

  • Fix prototype pollution (#51)

    • The original, non-mutated objects are now returned if any of the keys __proto__, constructor or prototype are used in a json pointer.
    // returns the unmodified input {}
    jsonpointer.set({}, '/foo/__proto__/boo', 'polluted')
    • When passing non-string arrays to a .set operation, an error is thrown:
    // throws `new Error('Invalid JSON pointer. Must be of type string or number.')`
    jsonpointer.set({}, [['__proto__'], ['__proto__'], 'boo'], 'polluted')
Commits
  • 4a253c0 Adopt strictEqual changes and only return null when the get succeeded
  • bad4983 Fix null values throwing exception when traversing over while getting
  • a5706e8 test: Always use strictEqual to ensure null and undefined values are asserted...
  • b8e1e6a fix incorrect typings for compile get/set methods
  • c4de620 Merge pull request #53 from janl/release/5.0.0
  • 8dbf304 feat: v5
  • 84cf173 Merge pull request #52 from janl/fix/test
  • f716e5c chore: more rip travis
  • e2ae355 chore: remove comment
  • d23693b chore: update primary branch
  • Additional commits viewable in compare view

Updates minimist from 1.2.5 to 1.2.8

Changelog

Sourced from minimist's changelog.

v1.2.8 - 2023-02-09

Merged

Fixed

Commits

  • Merge tag 'v0.2.3' a026794
  • [eslint] fix indentation and whitespace 5368ca4
  • [eslint] fix indentation and whitespace e5f5067
  • [eslint] more cleanup 62fde7d
  • [eslint] more cleanup 36ac5d0
  • [meta] add auto-changelog 73923d2
  • [actions] add reusable workflows d80727d
  • [eslint] add eslint; rules to enable later are warnings 48bc06a
  • [eslint] fix indentation 34b0f1c
  • [readme] rename and add badges 5df0fe4
  • [Dev Deps] switch from covert to nyc a48b128
  • [Dev Deps] update covert, tape; remove unnecessary tap f0fb958
  • [meta] create FUNDING.yml; add funding in package.json 3639e0c
  • [meta] use npmignore to autogenerate an npmignore file be2e038
  • Only apps should have lockfiles 282b570
  • isConstructorOrProto adapted from PR ef9153f
  • [Dev Deps] update @ljharb/eslint-config, aud 098873c
  • [Dev Deps] update @ljharb/eslint-config, aud 3124ed3
  • [meta] add safe-publish-latest 4b927de
  • [Tests] add aud in posttest b32d9bd
  • [meta] update repo URLs f9fdfc0
  • [actions] Avoid 0.6 tests due to build failures ba92fe6
  • [Dev Deps] update tape 950eaa7
  • [Dev Deps] add missing npmignore dev dep 3226afa
  • Merge tag 'v0.2.2' 980d7ac

v1.2.7 - 2022-10-10

Commits

... (truncated)

Commits
  • 6901ee2 v1.2.8
  • a026794 Merge tag 'v0.2.3'
  • c0b2661 v0.2.3
  • 63b8fee [Fix] Fix long option followed by single dash (#17)
  • 72239e6 [Tests] Remove duplicate test (#12)
  • 34b0f1c [eslint] fix indentation
  • 3226afa [Dev Deps] add missing npmignore dev dep
  • 098873c [Dev Deps] update @ljharb/eslint-config, aud
  • 9ec4d27 [Fix] Fix long option followed by single dash
  • ba92fe6 [actions] Avoid 0.6 tests due to build failures
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by ljharb, a new releaser for minimist since your current version.


Updates pathval from 1.1.0 to 1.1.1

Release notes

Sourced from pathval's releases.

v1.1.1

Fixes a security issue around prototype pollution.

Commits
  • db6c3e3 chore: v1.1.1
  • 7859e0e Merge pull request #60 from deleonio/fix/vulnerability-prototype-pollution
  • 49ce1f4 style: correct rule in package.json
  • c77b9d2 fix: prototype pollution vulnerability + working tests
  • 49031e4 chore: remove very old nodejs
  • 57730a9 chore: update deps and tool configuration
  • a123018 Merge pull request #55 from chaijs/remove-lgtm
  • 07eb4a8 Delete MAINTAINERS
  • a0147cd Merge pull request #54 from astorije/patch-1
  • aebb278 Center repo name on README
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by chai, a new releaser for pathval since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the npm_and_yarn group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [is-my-json-valid](https://github.com/mafintosh/is-my-json-valid) | `2.20.5` | `2.20.6` |
| [mocha](https://github.com/mochajs/mocha) | `8.1.1` | `11.7.1` |
| [standard](https://github.com/standard/standard) | `10.0.3` | `17.1.2` |
| [@babel/traverse](https://github.com/babel/babel/tree/HEAD/packages/babel-traverse) | `7.11.0` | `7.28.0` |
| [pathval](https://github.com/chaijs/pathval) | `1.1.0` | `1.1.1` |



Updates `is-my-json-valid` from 2.20.5 to 2.20.6
- [Commits](mafintosh/is-my-json-valid@v2.20.5...v2.20.6)

Updates `mocha` from 8.1.1 to 11.7.1
- [Release notes](https://github.com/mochajs/mocha/releases)
- [Changelog](https://github.com/mochajs/mocha/blob/main/CHANGELOG.md)
- [Commits](mochajs/mocha@v8.1.1...v11.7.1)

Updates `standard` from 10.0.3 to 17.1.2
- [Release notes](https://github.com/standard/standard/releases)
- [Changelog](https://github.com/standard/standard/blob/master/CHANGELOG.md)
- [Commits](standard/standard@v10.0.3...v17.1.2)

Updates `@babel/traverse` from 7.11.0 to 7.28.0
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.28.0/packages/babel-traverse)

Updates `flat` from 4.1.0 to 5.0.2
- [Release notes](https://github.com/hughsk/flat/releases)
- [Commits](hughsk/flat@4.1.0...5.0.2)

Updates `json5` from 2.1.3 to 1.0.2
- [Release notes](https://github.com/json5/json5/releases)
- [Changelog](https://github.com/json5/json5/blob/main/CHANGELOG.md)
- [Commits](json5/json5@v2.1.3...v1.0.2)

Updates `jsonpointer` from 4.1.0 to 5.0.1
- [Release notes](https://github.com/janl/node-jsonpointer/releases)
- [Commits](janl/node-jsonpointer@v4.1.0...v5.0.1)

Updates `minimist` from 1.2.5 to 1.2.8
- [Changelog](https://github.com/minimistjs/minimist/blob/main/CHANGELOG.md)
- [Commits](minimistjs/minimist@v1.2.5...v1.2.8)

Updates `pathval` from 1.1.0 to 1.1.1
- [Release notes](https://github.com/chaijs/pathval/releases)
- [Changelog](https://github.com/chaijs/pathval/blob/master/CHANGELOG.md)
- [Commits](chaijs/pathval@v1.1.0...v1.1.1)

---
updated-dependencies:
- dependency-name: is-my-json-valid
  dependency-version: 2.20.6
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: mocha
  dependency-version: 11.7.1
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: standard
  dependency-version: 17.1.2
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: "@babel/traverse"
  dependency-version: 7.28.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: flat
  dependency-version: 5.0.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: json5
  dependency-version: 1.0.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: jsonpointer
  dependency-version: 5.0.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: minimist
  dependency-version: 1.2.8
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: pathval
  dependency-version: 1.1.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 8, 2025
@bijujoseph bijujoseph closed this Aug 11, 2025
@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Aug 11, 2025

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot dependabot bot deleted the dependabot/npm_and_yarn/npm_and_yarn-eb8afedefa branch August 11, 2025 13:54
@bijujoseph bijujoseph restored the dependabot/npm_and_yarn/npm_and_yarn-eb8afedefa branch August 11, 2025 14:01
@bijujoseph bijujoseph reopened this Aug 11, 2025
@bijujoseph bijujoseph merged commit ae44c90 into master Aug 11, 2025
0 of 2 checks passed
@dependabot dependabot bot deleted the dependabot/npm_and_yarn/npm_and_yarn-eb8afedefa branch August 11, 2025 14:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants