chore(deps): bump the npm_and_yarn group across 1 directory with 26 updates by dependabot[bot] · Pull Request #1 · peniakoff/nodejs

dependabot · 2025-11-18T14:20:51Z

Bumps the npm_and_yarn group with 26 updates in the / directory:

Package	From	To
codecov	`3.7.0`	`3.7.1`
rollup	`2.18.0`	`2.79.2`
csvtojson	`2.0.10`	`2.0.11`
node-fetch	`2.6.0`	`2.6.7`
tmp	`0.2.1`	`0.2.4`
flat	`5.0.0`	`5.0.1`
lodash	`4.17.15`	`4.17.21`
object-path	`0.11.4`	`0.11.8`
fast-csv	`4.3.0`	`4.3.6`
jsondiffpatch	`0.4.1`	`0.7.2`
@babel/traverse	`7.10.3`	`7.28.5`
@npmcli/git	`2.0.2`	`2.1.0`
ajv	`6.12.2`	`6.12.6`
bl	`4.0.2`	`4.1.0`
decode-uri-component	`0.2.0`	`0.2.2`
handlebars	`4.7.6`	`4.7.8`
ini	`1.3.5`	`1.3.8`
jszip	`3.5.0`	`3.10.1`
node-notifier	`7.0.1`	`7.0.2`
npm-user-validate	`1.0.0`	`1.0.1`
path-to-regexp	`1.8.0`	`1.9.0`
prismjs	`1.20.0`	`1.30.0`
qs	`6.5.2`	`6.5.3`
set-getter	`0.1.0`	`0.1.1`
tmpl	`1.0.4`	`1.0.5`
ws	`7.3.0`	`7.5.10`

Updates codecov from 3.7.0 to 3.7.1

Changelog

Sourced from codecov's changelog.

3.7.1

Move to execFileSync and security fixes

Commits

29dd5b6 3.7.1
c0711c6 Switch from execSync to execFileSync (#180)
5f6cc62 Bump lodash from 4.17.15 to 4.17.19 (#183)
0c4d7f3 Merge pull request #182 from codecov/update-readme-badges
cc5e121 Update depstat image and urls
b44b44e Update readme with 400 error info (#181)
bb79335 V3.7.0 (#179)
See full diff in compare view

Updates rollup from 2.18.0 to 2.79.2

Release notes

Sourced from rollup's releases.

v.2.79.2

2.79.2

2024-09-26

Bug Fixes

Fix a vulnerability in generated code that affects IIFE, UMD and CJS bundles when run in a browser context (#5671)

Pull Requests

#5671: Fix DOM Clobbering CVE (@lukastaegert)

Changelog

Sourced from rollup's changelog.

rollup changelog

2.79.1

2022-09-22

Bug Fixes

Avoid massive performance degradation when creating thousands of chunks (#4643)

Pull Requests

#4639: fix: typo docs and contributors link in CONTRIBUTING.md ( @takurinton)

#4641: Update type definition of resolveId (@ivanjonas)

#4643: Improve performance of chunk naming collision check ( @lukastaegert)

2.79.0

2022-08-31

Features

Add amd.forceJsExtensionForImports to enforce using .js extensions for relative AMD imports (#4607)

Pull Requests

#4607: add option to keep extensions for amd (@wh1tevs)

2.78.1

2022-08-19

Bug Fixes

Avoid inferring "arguments" as name for a default export placeholder variable (#4613)

Pull Requests

#4613: Prevent using arguments for generated variable names ( @lukastaegert)

2.78.0

2022-08-14

Features

Support writing plugin hooks as objects with a "handler" property (#4600)

Allow changing execution order per plugin hook (#4600)

Add flag to execute plugins in async parallel hooks sequentially (#4600)

... (truncated)

Commits

c9bd03d 2.79.2
48aef33 fix: resolve DOM Clobbering CVE-2024-43788 (backport to v2) (#5677)
69ff418 2.79.1
04dce1b Update changelog
159137e fix: typo docs and contributors link in CONTRIBUTING.md (#4639)
e1392b3 Update type definition of resolveId (#4641)
7836357 Improve performance of chunk naming collision check (#4643)
71d20c9 Reduce permissions for repl-artefacts.yml workflow (#4630)
8193ea5 Adapt workflow to use Node 14 sub-version to work with branch protection
8477f8f 2.79.0
Additional commits viewable in compare view

Updates csvtojson from 2.0.10 to 2.0.11

Release notes

Sourced from csvtojson's releases.

v2.0.11

Release Note - Version 2.0.11

Optimized the package's internal dependencies and removed unnecessary code, resulting in a significant reduction in bundle size. Keyang/node-csvtojson@75a154d

Updated critical dependencies to their latest versions, addressing known security vulnerabilities.

Removed deprecated code and refactored outdated modules, enhancing code quality and maintainability. Keyang/node-csvtojson@99616e4

Commits

89a9a36 Updated package to 2.0.11
3e7999d Merge pull request #469 from Keyang/update-library
e5b60c8 fix: removed unnessesary lines
7264211 feat: updated .gitignore
99616e4 feat: updated deprecated code
3fb3a71 feat: updated deprecated code
1535bcf Merge pull request #406 from abramsimon/abramsimon/add-test-coverage-fromfile...
1aee76f Merge pull request #457 from Keyang/dependabot/npm_and_yarn/loader-utils-1.4.2
3f0c24a Bump loader-utils from 1.1.0 to 1.4.2
6720684 Merge pull request #411 from kriscarle/patch-1
Additional commits viewable in compare view

Updates node-fetch from 2.6.0 to 2.6.7

Release notes

Sourced from node-fetch's releases.

v2.6.7

Security patch release

Recommended to upgrade, to not leak sensitive cookie and authentication header information to 3th party host while a redirect occurred

What's Changed

fix: don't forward secure headers to 3th party by @jimmywarting in node-fetch/node-fetch#1453

Full Changelog: node-fetch/node-fetch@v2.6.6...v2.6.7

v2.6.6

What's Changed

fix(URL): prefer built in URL version when available and fallback to whatwg by @jimmywarting in node-fetch/node-fetch#1352

Full Changelog: node-fetch/node-fetch@v2.6.5...v2.6.6

v2.6.2

fixed main path in package.json

v2.6.1

This is an important security release. It is strongly recommended to update as soon as possible.

See CHANGELOG for details.

Commits

1ef4b56 backport of #1449 (#1453)
8fe5c4e 2.x: Specify encoding as an optional peer dependency in package.json (#1310)
f56b0c6 fix(URL): prefer built in URL version when available and fallback to whatwg (...
b5417ae fix: import whatwg-url in a way compatible with ESM Node (#1303)
18193c5 fix v2.6.3 that did not sending query params (#1301)
ace7536 fix: properly encode url with unicode characters (#1291)
152214c Fix(package.json): Corrected main file path in package.json (#1274)
b5e2e41 update version number
2358a6c Honor the size option after following a redirect and revert data uri support
8c197f8 docs: Fix typos and grammatical errors in README.md (#686)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by endless, a new releaser for node-fetch since your current version.

Updates tmp from 0.2.1 to 0.2.4

Changelog

Sourced from tmp's changelog.

v0.2.2 (2024-02-28)

🐛 Bug Fix

#278 Closes #268: Revert "fix #246: remove any double quotes or single quotes… (@mbargiel)

📝 Documentation

#279 Closes #266: move paragraph on graceful cleanup to the head of the documentation (@silkentrance)

Committers: 5

Carsten Klein (@silkentrance)

Dave Nicolson (@dnicolson)

KARASZI István (@raszi)

Maxime Bargiel (@mbargiel)

@robertoaceves

Commits

08fa3ab Update version
1cf4ec5 Merge commit from fork
188b25e Fix GHSA-52f5-9888-hmc6
73b9fe4 Add test case for GHSA-52f5-9888-hmc6
b8e2f29 Remove broken tests
2892a02 Remove outdated URL
f592318 Reformat package.json
995ac8c Merge pull request #301 from raszi/dependabot/npm_and_yarn/braces-3.0.3
caa758d Bump braces from 3.0.2 to 3.0.3
5f0b252 Merge pull request #297 from raszi/feat/release-v0.2.3
Additional commits viewable in compare view

Updates flat from 5.0.0 to 5.0.1

Commits

f25d3a1 Release 5.0.1
54cc7ad use standard formatting
779816e drop dependencies
2eea6d3 Bump lodash from 4.17.15 to 4.17.19
a61a554 Bump acorn from 7.1.0 to 7.4.0
20ef0ef Fix prototype pollution on unflatten
e8fb281 Test prototype pollution on unflatten
6e95c43 Add node 10 & 12 to travis config.
See full diff in compare view

Maintainer changes

This version was pushed to npm by timoxley, a new releaser for flat since your current version.

Updates lodash from 4.17.15 to 4.17.21

Commits

f299b52 Bump to v4.17.21
c4847eb Improve performance of toNumber, trim and trimEnd on large input strings
3469357 Prevent command injection through _.template's variable option
ded9bc6 Bump to v4.17.20.
63150ef Documentation fixes.
00f0f62 test.js: Remove trailing comma.
846e434 Temporarily use a custom fork of lodash-cli.
5d046f3 Re-enable Travis tests on 4.17 branch.
aa816b3 Remove /npm-package.
d7fbc52 Bump to v4.17.19
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by bnjmnt4n, a new releaser for lodash since your current version.

Updates object-path from 0.11.4 to 0.11.8

Commits

See full diff in compare view

Updates fast-csv from 4.3.0 to 4.3.6

Release notes

Sourced from fast-csv's releases.

v4.3.6

4.3.6 (2020-12-04)

Bug Fixes

Simplify empty row check by removing complex regex (4bbd39f)

deps: update dependency @types/yargs to v15.0.10 (9af7a41)

deps: update dependency yargs to v16.1.1 (057a4da)

v4.3.5

4.3.5 (2020-11-03)

Bug Fixes

formatting,#446: Do not quote fields that do not contain a quote (13e688c), closes #446

v4.3.4

4.3.4 (2020-11-03)

Bug Fixes

formatter,#503: Do not ignore rows when headers is false (1560564), closes #503

v4.3.3

4.3.3 (2020-10-30)

Bug Fixes

deps: update dependency @docusaurus/core to v2.0.0-alpha.66 (8afdd1e)

deps: update dependency @docusaurus/preset-classic to v2.0.0-alpha.66 (4a854a1)

deps: update dependency @types/yargs to v15.0.9 (a46ac39)

deps: update dependency yargs to v16 (b28b662)

deps: update react monorepo to v17 (93d3450)

v4.3.2

4.3.2 (2020-09-02)

Bug Fixes

deps: update dependency yargs to v15.4.1 (74fd72f)

parsing, #423: Prevent callback from being called multiple times (040febe), closes #423

release command (79ec47f)

v4.3.1

4.3.1 (2020-06-23)

... (truncated)

Changelog

Sourced from fast-csv's changelog.

4.3.6 (2020-12-04)

Note: Version bump only for package fast-csv

4.3.5 (2020-11-03)

Note: Version bump only for package fast-csv

4.3.4 (2020-11-03)

Note: Version bump only for package fast-csv

4.3.3 (2020-10-30)

Note: Version bump only for package fast-csv

4.3.2 (2020-09-02)

Note: Version bump only for package fast-csv

4.3.1 (2020-06-23)

Note: Version bump only for package fast-csv

Commits

3dc859e chore(release): publish v4.3.6
b908170 chore(release): publish v4.3.5
6969d3e chore(release): publish v4.3.4
096bb87 chore(release): publish v4.3.3
fa749f4 chore(): move @types/node to the parse and format package
4769d9e chore(): Update eslint libraries
bbb783b chore(release): publish v4.3.2
23bf809 chore(release): publish v4.3.1
0de3d0a chore(): Fix renovatebot
See full diff in compare view

Updates jsondiffpatch from 0.4.1 to 0.7.2

Release notes

Sourced from jsondiffpatch's releases.

v0.6.0

Breaking changes

This package is now pure ESM. For more info, please read Sindre Sorhus's FAQ (#350).

Supported Node versions are ^18.0.0 || >=20.0.0 (#350).

Requires ES6 support (#350).

There is no longer a default export. Import this package by using import * as jsondiffpatch from 'jsondiffpatch' or by importing individual methods (#350).

Formatters are no longer exported from the main entry-point and must be imported from subpaths (#350):

import * as annotatedFormatter from 'jsondiffpatch/formatters/annotated'

import * as baseFormatter from 'jsondiffpatch/formatters/base'

import * as consoleFormatter from 'jsondiffpatch/formatters/console'

import * as htmlFormatter from 'jsondiffpatch/formatters/html'

import * as jsonpatchFormatter from 'jsondiffpatch/formatters/jsonpatch'

Updated CSS imports (#350):

import 'jsondiffpatch/formatters/styles/html.css'

import 'jsondiffpatch/formatters/styles/annotated.css'

The main entry-point no longer includes text diffing by default. Either pass in the diff-match-patch library via the textDiff.diffMatchPatch option, or use the jsondiffpatch/with-text-diffs entry point that is included for convenience (#352).

Context.switchTo() has been removed (#345).

BaseFormatter.typeFormattterErrorFormatter() now throws an error instead of returning a string (#345).

The UMD browser bundle has been removed. If you were using a script tag to include jsondiffpatch in your project, you can now import it inside of your main script tag as show below. For a more complete example, see the Visual Diff example before and after this change.
<!doctype html>
<html>
  <head>
    <link
      rel="stylesheet"
      href="https://esm.sh/jsondiffpatch@0.6.0/lib/formatters/styles/html.css"
      type="text/css"
    />
    <link
      rel="stylesheet"
      href="https://esm.sh/jsondiffpatch@0.6.0/lib/formatters/styles/annotated.css"
      type="text/css"
    />
  </head>
  <body>
    <script type="module">
      import * as jsondiffpatch from 'https://esm.sh/jsondiffpatch@0.6.0';
      import * as annotatedFormatter from 'https://esm.sh/jsondiffpatch@0.6.0/formatters/annotated';
      import * as htmlFormatter from 'https://esm.sh/jsondiffpatch@0.6.0/formatters/html';
  ...
&lt;/script&gt;

</body>
</html>
Other changes

Fix demo link in formatters doc by @johnrees in benjamine/jsondiffpatch#311

... (truncated)

Commits

See full diff in compare view

Updates @babel/traverse from 7.10.3 to 7.28.5

Release notes

Sourced from @babel/traverse's releases.

v7.28.5 (2025-10-23)

Thank you @CO0Ki3, @Olexandr88, and @youthfulhps for your first PRs!

👓 Spec Compliance

babel-parser

#17446 Allow Runtime Errors for Function Call Assignment Targets (@liuxingbaoyu)

babel-helper-validator-identifier

#17501 fix: update identifier to unicode 17 (@fisker)

🐛 Bug Fix

babel-plugin-proposal-destructuring-private

#17534 Allow mixing private destructuring and rest (@CO0Ki3)

babel-parser

#17521 Improve @babel/parser error typing (@JLHwung)

#17491 fix: improve ts-only declaration parsing (@JLHwung)

babel-plugin-proposal-discard-binding, babel-plugin-transform-destructuring

#17519 fix: rest correctly returns plain array (@liuxingbaoyu)

babel-helper-create-class-features-plugin, babel-helper-member-expression-to-functions, babel-plugin-transform-block-scoping, babel-plugin-transform-optional-chaining, babel-traverse, babel-types

#17503 Fix JSXIdentifier handling in isReferencedIdentifier (@JLHwung)

babel-traverse

#17504 fix: ensure scope.push register in anonymous fn (@JLHwung)

🏠 Internal

babel-types

#17494 Type checking babel-types scripts (@JLHwung)

🏃‍♀️ Performance

babel-core

#17490 Faster finding of locations in buildCodeFrameError (@liuxingbaoyu)

Committers: 8

Babel Bot (@babel-bot)

Byeongho Yoo (@youthfulhps)

Huáng Jùnliàng (@JLHwung)

Hyeon Dokko (@CO0Ki3)

Nicolò Ribaudo (@nicolo-ribaudo)

@Olexandr88

@liuxingbaoyu

fisker Cheung (@fisker)

v7.28.4 (2025-09-05)

Thanks @gwillen and @mrginglymus for your first PRs!

🏠 Internal

babel-core, babel-helper-check-duplicate-nodes, babel-traverse, babel-types

#17493 Update Jest to v30.1.1 (@JLHwung)

babel-plugin-transform-regenerator

#17455 chore: Clean up transform-regenerator (@liuxingbaoyu)

... (truncated)

Changelog

Sourced from @babel/traverse's changelog.

v7.28.5 (2025-10-23)

👓 Spec Compliance

babel-parser

#17446 Allow Runtime Errors for Function Call Assignment Targets (@liuxingbaoyu)

babel-helper-validator-identifier

#17501 fix: update identifier to unicode 17 (@fisker)

🐛 Bug Fix

babel-plugin-proposal-destructuring-private

#17534 Allow mixing private destructuring and rest (@CO0Ki3)

babel-parser

#17521 Improve @babel/parser error typing (@JLHwung)

#17491 fix: improve ts-only declaration parsing (@JLHwung)

babel-plugin-proposal-discard-binding, babel-plugin-transform-destructuring

#17519 fix: rest correctly returns plain array (@liuxingbaoyu)

babel-helper-create-class-features-plugin, babel-helper-member-expression-to-functions, babel-plugin-transform-block-scoping, babel-plugin-transform-optional-chaining, babel-traverse, babel-types

#17503 Fix JSXIdentifier handling in isReferencedIdentifier (@JLHwung)

babel-traverse

#17504 fix: ensure scope.push register in anonymous fn (@JLHwung)

🏠 Internal

babel-types

#17494 Type checking babel-types scripts (@JLHwung)

🏃‍♀️ Performance

babel-core

#17490 Faster finding of locations in buildCodeFrameError (@liuxingbaoyu)

v7.28.4 (2025-09-05)

🏠 Internal

babel-core, babel-helper-check-duplicate-nodes, babel-traverse, babel-types

#17493 Update Jest to v30.1.1 (@JLHwung)

babel-plugin-transform-regenerator

#17455 chore: Clean up transform-regenerator (@liuxingbaoyu)

babel-core

#17474 Switch to @jridgewell/remapping (@mrginglymus)

v7.28.3 (2025-08-14)

👓 Spec Compliance

babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators, babel-plugin-transform-class-static-block, babel-preset-env

#17443 [static blocks] Do not inject new static fields after static code (@nicolo-ribaudo)

🐛 Bug Fix

babel-parser

#17465 fix(parser/typescript): parse import("./a", {with:{},}) (@easrng)

#17478 fix(parser): stop subscript parsing on async arrow (@JLHwung)

💅 Polish

babel-plugin-transform-regenerator, babel-plugin-transform-runtime

... (truncated)

Commits

61647ae v7.28.5
e579cb0 Enable strictNullChecks for traverse (#17499)
7385eae [Babel 8] Improve scope information collection performance (#17043)
26bc651 [Babel 8] Better node type definitions for computed (#17500)
e626523 Fix JSXIdentifier handling in isReferencedIdentifier (#17503)
19c9126 fix: ensure scope.push register in anonymous fn (#17504)
35055e3 v7.28.4
b41f8cd Update Jest to v30.1.1 (#17493)
22493b6 Improve @babel/traverse typings (#17485)
18d88b8 Improve @babel/core typings (#17471)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @babel/traverse since your current version.

Updates @npmcli/git from 2.0.2 to 2.1.0

Changelog

Sourced from @npmcli/git's changelog.

Changelog

7.0.1 (2025-11-13)

Dependencies

68705a9 #229 which@6.0.0

317b3c9 #229 @npmcli/promise-spawn@9.0.0

76bf30d #229 ini@6.0.0

935a4d0 #229 proc-log@6.0.0

7.0.0 (2025-09-17)

⚠️ BREAKING CHANGES

@npmcli/git now supports node ^20.17.0 || >=22.9.0

Bug Fixes

586a99b #227 align to npm 11 node engine range (@owlstronaut)

Dependencies

836bcd0 #227 npm-pick-manifest@11.0.1

3dfd4a7 #227 lru-cache@11.2.1

Chores

7c14300 #227 npm-package-arg@13.0.0 (@owlstronaut)

6.0.3 (2025-02-18)

Dependencies

4d688db #225 remove promise-inflight (#225)

6.0.2 (2025-02-18)

Dependencies

618c70c #223 remove promise-inflight (#223)

Chores

29dfb33 #222 ensure tests correctly mock environment variables before loading opts.js (#222) (@owlstronaut)

0fc4208 #220 bump npm-package-arg from 11.0.3 to 12.0.1 (#220) (@dependabot[bot])

52d8b0e #221 bump @npmcli/template-oss from 4.23.3 to 4.24.1 (#221) (@dependabot[bot], @npm-cli-bot)

6.0.1 (2024-10-02)

Dependencies

a4c2c21 #216 bump which@5.0.0

3bbfa2c #216 bump npm-pick-manifest@10.0.0

6.0.0 (2024-09-26)

⚠️ BREAKING CHANGES

@npmcli/git now supports node ^18.17.0 || >=20.5.0

Bug Fixes

a405d65 #211 align to npm 10 node engine range (@reggi)

Dependencies

68c31f0 #211 proc-log@5.0.0

917a535 #211 ini@5.0.0

e192bea #211 @npmcli/promise-spawn@8.0.0

Chores

e989fa1 #211 run template-oss-apply (@reggi)

dbfdd90 #205 bump @npmcli/eslint-config from 4.0.5 to 5.0.0 (@dependabot[bot])

4d33150 #206 postinstall for dependabot template-oss PR (@hashtagchris)

... (truncated)

Commits

101abac 2.1.0
766de2f Throw custom errors from spawn (#32)
ef5cfcc 2.0.9
ab646cf Do not allow git replacement objects by default (#30)
94e2543 update tap, test on node 16
1ce7b97 2.0.8
9fab115 Merge pull request #29 from npm/nlf/no-shell
f48dc34 chore: run lint as posttest
e69549f fix: remove path escaping since we do not need it when not using a shell
766bfbe fix: do not use a shell for git commands
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by lukekarrys, a new releaser for @npmcli/git since your current version.

Updates ajv from 6.12.2 to 6.12.6

Release notes

Sourced from ajv's releases.

v6.12.6

Fix performance issue of "url" format.

v6.12.5

Fix uri scheme validation (@ChALkeR). Fix boolean schemas with strictKeywords option (#1270)

v6.12.4

Fix: coercion of one-item arrays to scalar that should fail validation (failing example).

v6.12.3

Pass schema object to processCode function Option for strictNumbers (@issacgerges, #1128) Fixed vulnerability related to untrusted schemas (CVE-2020-15366)

Commits

fe59143 6.12.6
d580d3e Merge pull request #1298 from ajv-validator/fix-url
fd36389 fix: regular expression for "url" format
490e34c docs: link to v7-beta branch
9cd93a1 docs: note about v7 in readme
877d286 Merge pull request #1262 from b4h0-c4t/refactor-opt-object-type
f1c8e45 6.12.5
764035e Merge branch 'ChALkeR-chalker/fix-comma'
3798160 Merge branch 'chalker/fix-comma' of git://github.com/ChALkeR/ajv into ChALkeR...
a3c7eba Merge branch 'refactor-opt-object-type' of github.com:b4h0-c4t/ajv into refac...
Additional commits viewable in compare view

Updates bl from 4.0.2 to 4.1.0

Release notes

Sourced from bl's releases.

v4.0.3

Fix unintialized memory access

Changelog

Sourced from bl's changelog.

6.1.4 (2025-10-15)

Trivial Changes

deps: bump actions/setup-node from 5.0.0 to 6.0.0 (#161) (4f23fa9)

6.1.3 (2025-09-05)

Trivial Changes

deps: bump actions/setup-node from 4.2.0 to 5.0.0 (#159) (530e36f)

6.1.2 (2025-08-12)

Trivial Changes

deps: bump actions/checkout from 4 to 5 (#158) (28a3852)

6.1.1 (2025-08-01)

Trivial Changes

deps-dev: bump typescript from 5.8.3 to 5.9.2 (#157) (70f4e16)

6.1.0 (2025-03-11)

Features

Added prepend and getBuffers methods. (#154) (e9eda95)

6.0.20 (2025-03-03)

Trivial Changes

deps-dev: bump typescript from 5.7.3 to 5.8.2 (#153) (9291cf9)

6.0.19 (2025-01-28)

Trivial Changes

deps: bump actions/setup-node from 4.1.0 to 4.2.0 (

…pdates Bumps the npm_and_yarn group with 26 updates in the / directory: | Package | From | To | | --- | --- | --- | | [codecov](https://github.com/codecov/codecov-node) | `3.7.0` | `3.7.1` | | [rollup](https://github.com/rollup/rollup) | `2.18.0` | `2.79.2` | | [csvtojson](https://github.com/Keyang/node-csvtojson) | `2.0.10` | `2.0.11` | | [node-fetch](https://github.com/node-fetch/node-fetch) | `2.6.0` | `2.6.7` | | [tmp](https://github.com/raszi/node-tmp) | `0.2.1` | `0.2.4` | | [flat](https://github.com/hughsk/flat) | `5.0.0` | `5.0.1` | | [lodash](https://github.com/lodash/lodash) | `4.17.15` | `4.17.21` | | [object-path](https://github.com/mariocasciaro/object-path) | `0.11.4` | `0.11.8` | | [fast-csv](https://github.com/C2FO/fast-csv/tree/HEAD/packages/fast-csv) | `4.3.0` | `4.3.6` | | [jsondiffpatch](https://github.com/benjamine/jsondiffpatch) | `0.4.1` | `0.7.2` | | [@babel/traverse](https://github.com/babel/babel/tree/HEAD/packages/babel-traverse) | `7.10.3` | `7.28.5` | | [@npmcli/git](https://github.com/npm/git) | `2.0.2` | `2.1.0` | | [ajv](https://github.com/ajv-validator/ajv) | `6.12.2` | `6.12.6` | | [bl](https://github.com/rvagg/bl) | `4.0.2` | `4.1.0` | | [decode-uri-component](https://github.com/SamVerschueren/decode-uri-component) | `0.2.0` | `0.2.2` | | [handlebars](https://github.com/handlebars-lang/handlebars.js) | `4.7.6` | `4.7.8` | | [ini](https://github.com/npm/ini) | `1.3.5` | `1.3.8` | | [jszip](https://github.com/Stuk/jszip) | `3.5.0` | `3.10.1` | | [node-notifier](https://github.com/mikaelbr/node-notifier) | `7.0.1` | `7.0.2` | | [npm-user-validate](https://github.com/npm/npm-user-validate) | `1.0.0` | `1.0.1` | | [path-to-regexp](https://github.com/pillarjs/path-to-regexp) | `1.8.0` | `1.9.0` | | [prismjs](https://github.com/PrismJS/prism) | `1.20.0` | `1.30.0` | | [qs](https://github.com/ljharb/qs) | `6.5.2` | `6.5.3` | | [set-getter](https://github.com/doowb/set-getter) | `0.1.0` | `0.1.1` | | [tmpl](https://github.com/daaku/nodejs-tmpl) | `1.0.4` | `1.0.5` | | [ws](https://github.com/websockets/ws) | `7.3.0` | `7.5.10` | Updates `codecov` from 3.7.0 to 3.7.1 - [Release notes](https://github.com/codecov/codecov-node/releases) - [Changelog](https://github.com/codecov/codecov-node/blob/master/CHANGELOG.md) - [Commits](codecov/codecov-node@v3.7.0...v3.7.1) Updates `rollup` from 2.18.0 to 2.79.2 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG-2.md) - [Commits](rollup/rollup@v2.18.0...v2.79.2) Updates `csvtojson` from 2.0.10 to 2.0.11 - [Release notes](https://github.com/Keyang/node-csvtojson/releases) - [Commits](Keyang/node-csvtojson@v2.0.10...v2.0.11) Updates `node-fetch` from 2.6.0 to 2.6.7 - [Release notes](https://github.com/node-fetch/node-fetch/releases) - [Commits](node-fetch/node-fetch@v2.6.0...v2.6.7) Updates `tmp` from 0.2.1 to 0.2.4 - [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md) - [Commits](raszi/node-tmp@v0.2.1...v0.2.4) Updates `flat` from 5.0.0 to 5.0.1 - [Release notes](https://github.com/hughsk/flat/releases) - [Commits](hughsk/flat@5.0.0...5.0.1) Updates `lodash` from 4.17.15 to 4.17.21 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.15...4.17.21) Updates `object-path` from 0.11.4 to 0.11.8 - [Commits](https://github.com/mariocasciaro/object-path/commits/v0.11.8) Updates `fast-csv` from 4.3.0 to 4.3.6 - [Release notes](https://github.com/C2FO/fast-csv/releases) - [Changelog](https://github.com/C2FO/fast-csv/blob/main/packages/fast-csv/CHANGELOG.md) - [Commits](https://github.com/C2FO/fast-csv/commits/v4.3.6/packages/fast-csv) Updates `jsondiffpatch` from 0.4.1 to 0.7.2 - [Release notes](https://github.com/benjamine/jsondiffpatch/releases) - [Commits](https://github.com/benjamine/jsondiffpatch/commits) Updates `@babel/traverse` from 7.10.3 to 7.28.5 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.28.5/packages/babel-traverse) Updates `@npmcli/git` from 2.0.2 to 2.1.0 - [Release notes](https://github.com/npm/git/releases) - [Changelog](https://github.com/npm/git/blob/main/CHANGELOG.md) - [Commits](npm/git@v2.0.2...v2.1.0) Updates `ajv` from 6.12.2 to 6.12.6 - [Release notes](https://github.com/ajv-validator/ajv/releases) - [Commits](ajv-validator/ajv@v6.12.2...v6.12.6) Updates `bl` from 4.0.2 to 4.1.0 - [Release notes](https://github.com/rvagg/bl/releases) - [Changelog](https://github.com/rvagg/bl/blob/master/CHANGELOG.md) - [Commits](rvagg/bl@v4.0.2...v4.1.0) Updates `decode-uri-component` from 0.2.0 to 0.2.2 - [Release notes](https://github.com/SamVerschueren/decode-uri-component/releases) - [Commits](SamVerschueren/decode-uri-component@v0.2.0...v0.2.2) Updates `handlebars` from 4.7.6 to 4.7.8 - [Release notes](https://github.com/handlebars-lang/handlebars.js/releases) - [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/v4.7.8/release-notes.md) - [Commits](handlebars-lang/handlebars.js@v4.7.6...v4.7.8) Updates `ini` from 1.3.5 to 1.3.8 - [Release notes](https://github.com/npm/ini/releases) - [Changelog](https://github.com/npm/ini/blob/main/CHANGELOG.md) - [Commits](npm/ini@v1.3.5...v1.3.8) Updates `jszip` from 3.5.0 to 3.10.1 - [Changelog](https://github.com/Stuk/jszip/blob/main/CHANGES.md) - [Commits](Stuk/jszip@v3.5.0...v3.10.1) Updates `node-notifier` from 7.0.1 to 7.0.2 - [Changelog](https://github.com/mikaelbr/node-notifier/blob/master/CHANGELOG.md) - [Commits](mikaelbr/node-notifier@v7.0.1...v7.0.2) Updates `npm-user-validate` from 1.0.0 to 1.0.1 - [Release notes](https://github.com/npm/npm-user-validate/releases) - [Changelog](https://github.com/npm/npm-user-validate/blob/main/CHANGELOG.md) - [Commits](npm/npm-user-validate@v1.0.0...v1.0.1) Updates `path-to-regexp` from 1.8.0 to 1.9.0 - [Release notes](https://github.com/pillarjs/path-to-regexp/releases) - [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md) - [Commits](pillarjs/path-to-regexp@v1.8.0...v1.9.0) Updates `prismjs` from 1.20.0 to 1.30.0 - [Release notes](https://github.com/PrismJS/prism/releases) - [Changelog](https://github.com/PrismJS/prism/blob/v2/CHANGELOG.md) - [Commits](PrismJS/prism@v1.20.0...v1.30.0) Updates `qs` from 6.5.2 to 6.5.3 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.5.2...v6.5.3) Updates `set-getter` from 0.1.0 to 0.1.1 - [Commits](https://github.com/doowb/set-getter/commits/0.1.1) Updates `tmpl` from 1.0.4 to 1.0.5 - [Commits](https://github.com/daaku/nodejs-tmpl/commits/v1.0.5) Updates `ws` from 7.3.0 to 7.5.10 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@7.3.0...7.5.10) --- updated-dependencies: - dependency-name: codecov dependency-version: 3.7.1 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: rollup dependency-version: 2.79.2 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: csvtojson dependency-version: 2.0.11 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: node-fetch dependency-version: 2.6.7 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: tmp dependency-version: 0.2.4 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: flat dependency-version: 5.0.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.17.21 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: object-path dependency-version: 0.11.8 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: fast-csv dependency-version: 4.3.6 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: jsondiffpatch dependency-version: 0.7.2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@babel/traverse" dependency-version: 7.28.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@npmcli/git" dependency-version: 2.1.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ajv dependency-version: 6.12.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: bl dependency-version: 4.1.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: decode-uri-component dependency-version: 0.2.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: handlebars dependency-version: 4.7.8 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ini dependency-version: 1.3.8 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: jszip dependency-version: 3.10.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: node-notifier dependency-version: 7.0.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: npm-user-validate dependency-version: 1.0.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: path-to-regexp dependency-version: 1.9.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: prismjs dependency-version: 1.30.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.5.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: set-getter dependency-version: 0.1.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tmpl dependency-version: 1.0.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 7.5.10 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 18, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the npm_and_yarn group across 1 directory with 26 updates#1

chore(deps): bump the npm_and_yarn group across 1 directory with 26 updates#1
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/npm_and_yarn/npm_and_yarn-d19e26f6f1

dependabot bot commented on behalf of github Nov 18, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot bot commented on behalf of github Nov 18, 2025

3.7.1

v.2.79.2

2.79.2

Bug Fixes

Pull Requests

rollup changelog

2.79.1

Bug Fixes

Pull Requests

2.79.0

Features

Pull Requests

2.78.1

Bug Fixes

Pull Requests

2.78.0

Features

v2.0.11

v2.6.7

Security patch release

What's Changed

v2.6.6

What's Changed

v2.6.2

v2.6.1

v0.2.2 (2024-02-28)

🐛 Bug Fix

📝 Documentation

Committers: 5

v4.3.6

4.3.6 (2020-12-04)

Bug Fixes

v4.3.5

4.3.5 (2020-11-03)

Bug Fixes

v4.3.4

4.3.4 (2020-11-03)

Bug Fixes

v4.3.3

4.3.3 (2020-10-30)

Bug Fixes

v4.3.2

4.3.2 (2020-09-02)

Bug Fixes

v4.3.1

4.3.1 (2020-06-23)

4.3.6 (2020-12-04)

4.3.5 (2020-11-03)

4.3.4 (2020-11-03)

4.3.3 (2020-10-30)

4.3.2 (2020-09-02)

4.3.1 (2020-06-23)

v0.6.0

Breaking changes

Other changes

v7.28.5 (2025-10-23)

👓 Spec Compliance

🐛 Bug Fix

🏠 Internal

🏃‍♀️ Performance

Committers: 8

v7.28.4 (2025-09-05)

🏠 Internal

v7.28.5 (2025-10-23)

👓 Spec Compliance

🐛 Bug Fix

🏠 Internal

🏃‍♀️ Performance

v7.28.4 (2025-09-05)

🏠 Internal

v7.28.3 (2025-08-14)

👓 Spec Compliance

🐛 Bug Fix

💅 Polish

Changelog

7.0.1 (2025-11-13)

Dependencies

7.0.0 (2025-09-17)