chore(deps): bump js-yaml from 4.2.0 to removed in /frontend in the npm_and_yarn group across 1 directory - #144
Merged
overwrite00 merged 1 commit intoJul 30, 2026
Conversation
Bumps the npm_and_yarn group with 1 update in the /frontend directory: [js-yaml](https://github.com/nodeca/js-yaml). Removes `js-yaml` --- updated-dependencies: - dependency-name: js-yaml dependency-version: dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
deleted the
dependabot/npm_and_yarn/frontend/npm_and_yarn-670587bf58
branch
July 30, 2026 18:19
overwrite00
added a commit
that referenced
this pull request
Jul 30, 2026
PR #144 (Dependabot security update) bumped eslint 9.39.5 -> 10.8.0 directly on main to fix 2 high-severity transitive vulnerabilities (js-yaml quadratic CPU DoS, brace-expansion DoS), bypassing the configured develop target-branch as GitHub always does for security-only Dependabot PRs. Backporting the same eslint bump here to keep develop and main in sync and avoid drift. Build and lint verified clean; only the pre-existing react-router CSRF advisory remains (no fix available without a breaking downgrade, tracked separately).
overwrite00
added a commit
that referenced
this pull request
Jul 30, 2026
…n fix) - fix: correct broken project-automation.yml (wrong --assignee flag, wrong --add-project usage/missing checkout) - replaced with direct GraphQL addProjectV2ItemById mutation - Bump fastapi 0.139.0 -> 0.139.2, uvicorn 0.50.0 -> 0.51.0, coverage 7.15.0 -> 7.15.2 (#136) - Bump nltk >=3.9.4 -> >=3.10.0 (#137) - Bump actions/setup-python v6 -> v7, actions/setup-node v6 -> v7 (#140, #141) - Bump lucide-react 1.23 -> 1.27, react/react-dom 19.2.7 -> 19.2.8 (#142) - Bump vite 8.1.4 -> 8.1.5, @vitejs/plugin-react 6.0.3 -> 6.0.4, globals 17.7 -> 17.8 (#143) - Backport eslint 9 -> 10 security fix (already on main via #144) to keep branches in sync 122/122 backend tests passing, frontend build/lint clean.
overwrite00
added a commit
that referenced
this pull request
Jul 30, 2026
#146) * chore(deps-backend)(deps): bump the minor-and-patch group across 1 directory with 4 updates (#127) Bumps the minor-and-patch group with 4 updates in the /backend directory: [fastapi](https://github.com/fastapi/fastapi), [beautifulsoup4](https://www.crummy.com/software/BeautifulSoup/bs4/), [slowapi](https://github.com/laurents/slowapi) and [coverage](https://github.com/coveragepy/coveragepy). Updates `fastapi` from 0.138.0 to 0.139.0 - [Release notes](https://github.com/fastapi/fastapi/releases) - [Commits](fastapi/fastapi@0.138.0...0.139.0) Updates `beautifulsoup4` from 4.14.0 to 4.15.0 Updates `slowapi` from 0.1.9 to 0.1.10 - [Release notes](https://github.com/laurents/slowapi/releases) - [Changelog](https://github.com/laurentS/slowapi/blob/master/CHANGELOG.md) - [Commits](laurentS/slowapi@v0.1.9...v0.1.10) Updates `coverage` from 7.6.1 to 7.14.3 - [Release notes](https://github.com/coveragepy/coveragepy/releases) - [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst) - [Commits](coveragepy/coveragepy@7.6.1...7.14.3) --- updated-dependencies: - dependency-name: fastapi dependency-version: 0.139.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: beautifulsoup4 dependency-version: 4.15.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: slowapi dependency-version: 0.1.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: coverage dependency-version: 7.14.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-backend)(deps): bump the minor-and-patch group (#130) Bumps the minor-and-patch group in /backend with 2 updates: [uvicorn](https://github.com/Kludex/uvicorn) and [coverage](https://github.com/coveragepy/coveragepy). Updates `uvicorn` from 0.49.0 to 0.50.0 - [Release notes](https://github.com/Kludex/uvicorn/releases) - [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md) - [Commits](Kludex/uvicorn@0.49.0...0.50.0) Updates `coverage` from 7.14.3 to 7.15.0 - [Release notes](https://github.com/coveragepy/coveragepy/releases) - [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst) - [Commits](coveragepy/coveragepy@7.14.3...7.15.0) --- updated-dependencies: - dependency-name: uvicorn dependency-version: 0.50.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: coverage dependency-version: 7.15.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-frontend)(deps): bump the minor-and-patch group (#131) Bumps the minor-and-patch group in /frontend with 2 updates: [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) and [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom). Updates `lucide-react` from 1.22.0 to 1.23.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.23.0/packages/lucide-react) Updates `react-router-dom` from 7.18.0 to 7.18.1 - [Release notes](https://github.com/remix-run/react-router/releases) - [Changelog](https://github.com/remix-run/react-router/blob/react-router-dom@7.18.1/packages/react-router-dom/CHANGELOG.md) - [Commits](https://github.com/remix-run/react-router/commits/react-router-dom@7.18.1/packages/react-router-dom) --- updated-dependencies: - dependency-name: lucide-react dependency-version: 1.23.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: react-router-dom dependency-version: 7.18.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-frontend)(deps-dev): bump the development-updates group across 1 directory with 3 updates (#133) Bumps the development-updates group with 3 updates in the /frontend directory: [@eslint/js](https://github.com/eslint/eslint/tree/HEAD/packages/js), [eslint](https://github.com/eslint/eslint) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). Updates `@eslint/js` from 9.39.4 to 9.39.5 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](https://github.com/eslint/eslint/commits/v9.39.5/packages/js) Updates `eslint` from 9.39.4 to 9.39.5 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v9.39.4...v9.39.5) Updates `vite` from 8.1.0 to 8.1.4 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.1.4/packages/vite) --- updated-dependencies: - dependency-name: "@eslint/js" dependency-version: 9.39.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-updates - dependency-name: eslint dependency-version: 9.39.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-updates - dependency-name: vite dependency-version: 8.1.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix: prevent stack trace exposure in URLScan.io health check endpoint CodeQL alert #15 (py/stack-trace-exposure, CWE-209/497): GET /api/reputation/test-urlscan is a public unauthenticated endpoint that returned raw exception messages and type names to the caller. Exception details are now logged server-side only; the client receives a generic error message. * fix: correct broken PR/issue project automation workflow Two bugs prevented every PR and issue from being assigned to the project: - '--assignee' is not a valid gh pr/issue edit flag (correct: --add-assignee) - '--add-project <title>' requires a git checkout to resolve repo context, which this workflow never performed, and expects a project title rather than the configured node ID Replaced project assignment with a direct addProjectV2ItemById GraphQL mutation using the known project node ID, removing the checkout dependency entirely. * chore(deps-backend)(deps): bump the minor-and-patch group (#136) Bumps the minor-and-patch group in /backend with 3 updates: [fastapi](https://github.com/fastapi/fastapi), [uvicorn](https://github.com/Kludex/uvicorn) and [coverage](https://github.com/coveragepy/coveragepy). Updates `fastapi` from 0.139.0 to 0.139.2 - [Release notes](https://github.com/fastapi/fastapi/releases) - [Commits](fastapi/fastapi@0.139.0...0.139.2) Updates `uvicorn` from 0.50.0 to 0.51.0 - [Release notes](https://github.com/Kludex/uvicorn/releases) - [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md) - [Commits](Kludex/uvicorn@0.50.0...0.51.0) Updates `coverage` from 7.15.0 to 7.15.2 - [Release notes](https://github.com/coveragepy/coveragepy/releases) - [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst) - [Commits](coveragepy/coveragepy@7.15.0...7.15.2) --- updated-dependencies: - dependency-name: fastapi dependency-version: 0.139.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: uvicorn dependency-version: 0.51.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: coverage dependency-version: 7.15.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-backend)(deps): update nltk requirement in /backend (#137) Updates the requirements on [nltk](https://github.com/nltk/nltk) to permit the latest version. - [Release notes](https://github.com/nltk/nltk/releases) - [Changelog](https://github.com/nltk/nltk/blob/develop/ChangeLog) - [Commits](nltk/nltk@3.9.4...v3.10.0) --- updated-dependencies: - dependency-name: nltk dependency-version: 3.10.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(ci)(deps): bump actions/setup-python from 6 to 7 (#140) Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6 to 7. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@v6...v7) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(ci)(deps): bump actions/setup-node from 6 to 7 (#141) Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6 to 7. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@v6...v7) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-frontend)(deps): bump the minor-and-patch group across 1 directory with 3 updates (#142) Bumps the minor-and-patch group with 3 updates in the /frontend directory: [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react), [react](https://github.com/react/react/tree/HEAD/packages/react) and [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom). Updates `lucide-react` from 1.23.0 to 1.27.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.27.0/packages/lucide-react) Updates `react` from 19.2.7 to 19.2.8 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.2.8/packages/react) Updates `react-dom` from 19.2.7 to 19.2.8 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom) --- updated-dependencies: - dependency-name: lucide-react dependency-version: 1.27.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: react dependency-version: 19.2.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: react-dom dependency-version: 19.2.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-frontend)(deps-dev): bump the development-updates group across 1 directory with 3 updates (#143) Bumps the development-updates group with 3 updates in the /frontend directory: [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react), [globals](https://github.com/sindresorhus/globals) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). Updates `@vitejs/plugin-react` from 6.0.3 to 6.0.4 - [Release notes](https://github.com/vitejs/vite-plugin-react/releases) - [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.0.4/packages/plugin-react) Updates `globals` from 17.7.0 to 17.8.0 - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](sindresorhus/globals@v17.7.0...v17.8.0) Updates `vite` from 8.1.4 to 8.1.5 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.1.5/packages/vite) --- updated-dependencies: - dependency-name: "@vitejs/plugin-react" dependency-version: 6.0.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-updates - dependency-name: globals dependency-version: 17.8.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-updates - dependency-name: vite dependency-version: 8.1.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix: backport ESLint 10 security bump from main (PR #144) PR #144 (Dependabot security update) bumped eslint 9.39.5 -> 10.8.0 directly on main to fix 2 high-severity transitive vulnerabilities (js-yaml quadratic CPU DoS, brace-expansion DoS), bypassing the configured develop target-branch as GitHub always does for security-only Dependabot PRs. Backporting the same eslint bump here to keep develop and main in sync and avoid drift. Build and lint verified clean; only the pre-existing react-router CSRF advisory remains (no fix available without a breaking downgrade, tracked separately). --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the npm_and_yarn group with 1 update in the /frontend directory: js-yaml.
Removes
js-yamlDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.