Bump the npm_and_yarn group across 1 directory with 21 updates

Open dependabot[bot] opened this issue 6 months ago • 0 comments

Bumps the npm_and_yarn group with 14 updates in the / directory:

Package	From	To
astro	`4.5.6`	`4.16.18`
vitest	`1.3.1`	`1.6.1`
@babel/runtime	`7.23.9`	`7.27.6`
cookie	`0.5.0`	`0.7.2`
@bundled-es-modules/cookie	`2.0.0`	`2.0.1`
express	`4.18.2`	`4.21.2`
cross-spawn	`7.0.3`	`7.0.6`
esbuild	`0.19.12`	`0.25.5`
@astrojs/mdx	`2.1.1`	`4.3.0`
@preact/preset-vite	`2.8.2`	`2.10.1`
@astrojs/tailwind	`5.1.0`	`5.1.5`
astro	`4.16.18`	`5.9.0`
vitest	`1.6.1`	`3.2.2`
tsx	`4.7.1`	`4.19.4`
rollup	`2.79.1`	`4.41.1`
ws	`8.16.0`	`8.18.2`

Updates astro from 4.5.6 to 4.16.18

Changelog

Sourced from astro's changelog.

4.16.18

Patch Changes

#12757 d0aaac3 Thanks @matthewp! - Remove all assets created from the server build

#12757 d0aaac3 Thanks @matthewp! - Clean server sourcemaps from static output

4.16.17

Patch Changes

#12632 e7d14c3 Thanks @ematipico! - Fixes an issue where the checkOrigin feature wasn't correctly checking the content-type header

4.16.16

Patch Changes

#12542 65e50eb Thanks @kadykov! - Fix JPEG image size determination

#12525 cf0d8b0 Thanks @ematipico! - Fixes an issue where with i18n enabled, Astro couldn't render the 404.astro component for non-existent routes.

4.16.15

Patch Changes

#12498 b140a3f Thanks @ematipico! - Fixes a regression where Astro was trying to access Request.headers

4.16.14

Patch Changes

#12480 c3b7e7c Thanks @matthewp! - Removes the default throw behavior in astro:env

#12444 28dd3ce Thanks @ematipico! - Fixes an issue where a server island hydration script might fail case the island ID misses from the DOM.

#12476 80a9a52 Thanks @florian-lefebvre! - Fixes a case where the Content Layer glob() loader would not update when renaming or deleting an entry

#12418 25baa4e Thanks @oliverlynch! - Fix cached image redownloading if it is the first asset

#12477 46f6b38 Thanks @ematipico! - Fixes an issue where the SSR build was emitting the dist/server/entry.mjs file with an incorrect import at the top of the file/

#12365 a23985b Thanks @apatel369! - Fixes an issue where Astro.currentLocale was not correctly returning the locale for 404 and 500 pages.

4.16.13

Patch Changes

#12436 453ec6b Thanks @martrapp! - Fixes a potential null access in the clientside router

... (truncated)

Commits

84190aa [ci] release (#12774)
d0aaac3 Prevent server sourcemaps from being part of client output (#12757)
ba4aac1 [ci] release (#12648)
e7d14c3 fix: checkOrigin headers check (#12632)
6eac6ba [ci] release (#12536)
65e50eb Fix JPEG image size determination (#12542)
6fc29e3 fix(deps): update all non-major dependencies (#12410)
cf0d8b0 fix(i18n): render 404.astro when i18n is enabled (#12525)
36d8d92 [ci] release (#12501)
b140a3f fix(routing): don't access Request headers (#12498)
Additional commits viewable in compare view

Updates vitest from 1.3.1 to 1.6.1

Release notes

Sourced from vitest's releases.

v1.6.1

This release includes security patches for:

Remote Code Execution when accessing a malicious website while Vitest API server is listening | CVE-2025-24964

   🐞 Bug Fixes

backport vitest-dev/vitest#7317 to v1 - by @hi-ogawa in vitest-dev/vitest#7319

    View changes on GitHub

v1.6.0

   🚀 Features

Support standalone mode - by @sheremet-va in vitest-dev/vitest#5565 (bdce0)

Custom "snapshotEnvironment" option - by @sheremet-va in vitest-dev/vitest#5449 (30f72)

benchmark: Support comparing benchmark result - by @hi-ogawa and @sheremet-va in vitest-dev/vitest#5398 (f8d3d)

browser: Allow injecting scripts - by @sheremet-va in vitest-dev/vitest#5656 (21e58)

reporter: Support includeConsoleOutput and addFileAttribute in junit - by @hi-ogawa in vitest-dev/vitest#5659 (2f913)

ui: Sort items by file name - by @btea in vitest-dev/vitest#5652 (1f726)

   🐞 Bug Fixes

Keep order of arguments for .each in custom task collectors - by @sheremet-va in vitest-dev/vitest#5640 (7d57c)

Call resolveId('vitest') after buildStart - by @hi-ogawa in vitest-dev/vitest#5646 (f5faf)

Hash the name of the file when caching - by @sheremet-va in vitest-dev/vitest#5654 (c9e68)

Don't panic on empty files in node_modules - by @sheremet-va (40c29)

Use toJSON for error serialization - by @hi-ogawa in vitest-dev/vitest#5526 (19a21)

coverage:

Exclude *.test-d.* by default - by @MindfulPol in vitest-dev/vitest#5634 (bfe8a)

Apply vite-node's wrapper only to executed files - by @AriPerkkio in vitest-dev/vitest#5642 (c9883)

vm:

Support network imports - by @sheremet-va in vitest-dev/vitest#5610 (103a6)

   🏎 Performance

Improve performance of forks pool - by @sheremet-va in vitest-dev/vitest#5592 (d8304)

Unnecessary rpc call when coverage is disabled - by @AriPerkkio in vitest-dev/vitest#5658 (c5712)

    View changes on GitHub

v1.5.3

   🐞 Bug Fixes

Use package.json name for a workspace project if not provided - by @sheremet-va in vitest-dev/vitest#5608 (48fba)

Backport jest iterable equality within object - by @sukovanej in vitest-dev/vitest#5621 (30e5d)

browser: Support benchmark - by @hi-ogawa in vitest-dev/vitest#5622 (becab)

reporter: Use default error formatter for JUnit - by @hi-ogawa in vitest-dev/vitest#5629 (20060)

... (truncated)

Commits

017e1ee chore: release v1.6.1
7ce9fbb fix: backport #7317 to v1 (#7319)
6b29f3d chore: release v1.6.0
f8d3d22 feat(benchmark): support comparing benchmark result (#5398)
21e58bd feat(browser): allow injecting scripts (#5656)
30f728b feat: custom "snapshotEnvironment" option (#5449)
2f91322 feat(reporter): support includeConsoleOutput and addFileAttribute in juni...
c571276 perf: unnecessary rpc call when coverage is disabled (#5658)
bdce0a2 feat: support standalone mode (#5565)
40c299f fix: don't panic on empty files in node_modules
Additional commits viewable in compare view

Updates @babel/runtime from 7.23.9 to 7.27.6

Release notes

Sourced from @babel/runtime's releases.

v7.27.6 (2025-06-05)

:bug: Bug Fix

babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-regenerator, babel-preset-env, babel-runtime-corejs3

#17366 fix: finally causes unexpected return value (@liuxingbaoyu)

babel-generator, babel-parser, babel-types

#17357 Ensure syntactic ordering when visiting array-type AST nodes (@JLHwung)

Committers: 3

Huáng Jùnliàng (@JLHwung)

Ingvar Stepanyan (@RReverser)

@liuxingbaoyu

v7.27.5 (2025-06-03)

Thanks @NullVoxPopuli for your first PR!

:bug: Bug Fix

babel-plugin-transform-regenerator

#17359 fix: Unexpected infinite loop with regenerator for try (@liuxingbaoyu)

Other

#17349 Map ESLint's sourceType: commonjs to script (@JLHwung)

:nail_care: Polish

babel-parser

#17333 Improve using declaration errors (@JLHwung)

Committers: 4

Babel Bot (@babel-bot)

Huáng Jùnliàng (@JLHwung)

@NullVoxPopuli

@liuxingbaoyu

v7.27.4 (2025-05-30)

:eyeglasses: Spec Compliance

babel-parser, babel-plugin-proposal-explicit-resource-management

#17323 Disallow using in bare case statement (@JLHwung)

:nail_care: Polish

babel-parser

#17311 Improve parseExpression error messages (@JLHwung)

:microscope: Output optimization

babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-block-scoping, babel-plugin-transform-classes, babel-plugin-transform-destructuring, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime

#17287 Reduce regenerator size more (@liuxingbaoyu)

babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-block-scoping, babel-plugin-transform-classes, babel-plugin-transform-destructuring, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs3

#17334 Use shorter method names for regenerator context (@nicolo-ribaudo)

#17268 Reduce regenerator helper size (@liuxingbaoyu)

babel-core, babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-block-scoping, babel-plugin-transform-classes, babel-plugin-transform-destructuring, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime, babel-standalone

... (truncated)

Changelog

Sourced from @babel/runtime's changelog.

v7.27.6 (2025-06-05)

:bug: Bug Fix

babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-regenerator, babel-preset-env, babel-runtime-corejs3

#17366 fix: finally causes unexpected return value (@liuxingbaoyu)

babel-generator, babel-parser, babel-types

#17357 Ensure syntactic ordering when visiting array-type AST nodes (@JLHwung)

v7.27.5 (2025-06-03)

:bug: Bug Fix

babel-plugin-transform-regenerator

#17359 fix: Unexpected infinite loop with regenerator for try (@liuxingbaoyu)

Other

#17349 Map ESLint's sourceType: commonjs to script (@JLHwung)

:nail_care: Polish

babel-parser

#17333 Improve using declaration errors (@JLHwung)

v7.27.4 (2025-05-30)

:eyeglasses: Spec Compliance

babel-parser, babel-plugin-proposal-explicit-resource-management

#17323 Disallow using in bare case statement (@JLHwung)

:nail_care: Polish

babel-parser

#17311 Improve parseExpression error messages (@JLHwung)

:microscope: Output optimization

babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-block-scoping, babel-plugin-transform-classes, babel-plugin-transform-destructuring, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime

#17287 Reduce regenerator size more (@liuxingbaoyu)

babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-block-scoping, babel-plugin-transform-classes, babel-plugin-transform-destructuring, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs3

#17334 Use shorter method names for regenerator context (@nicolo-ribaudo)

#17268 Reduce regenerator helper size (@liuxingbaoyu)

babel-core, babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-block-scoping, babel-plugin-transform-classes, babel-plugin-transform-destructuring, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime, babel-standalone

#17238 Split regeneratorRuntime into multiple helpers (@nicolo-ribaudo)

v7.27.3 (2025-05-27)

:bug: Bug Fix

babel-generator

#17324 Improve multiline comments handling in yield/await expression (@JLHwung)

babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-regenerator, babel-preset-env, babel-runtime-corejs3

#17328 Correctly set .displayName on GeneratorFunction (@nicolo-ribaudo)

babel-plugin-proposal-explicit-resource-management

#17319 fix: handle shadowed binding in for using of body (@JLHwung)

#17317 fix: support named evaluation for using declaration (@JLHwung)

babel-plugin-proposal-decorators, babel-types

#17321 fix(converter): Remove abstract modifiers in class declaration to expression conversion (@magic-akari)

babel-helper-module-transforms, babel-plugin-proposal-explicit-resource-management, babel-plugin-transform-modules-amd, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-umd

#17257 Preserve class id when transforming using declarations with exported class (@JLHwung)

... (truncated)

Commits

baa4cb8 v7.27.6
7d06930 v7.27.4
5b9468d Reduce regenerator size more (#17287)
cb78b5b [babel 8] Do not replace global regeneratorRuntime references in regenerato...
a0690e3 Split regeneratorRuntime into multiple helpers (#17238)
da5e371 v7.27.3
eebd3a0 v7.27.1
296cdc5 Remove unused regenerator-runtime dep in @babel/runtime (#17263)
fdc0fb5 [Babel 8] Bump nodejs requirements to ^20.19.0 || >= 22.12.0 (#17204)
5c350ea v7.27.0
Additional commits viewable in compare view

Updates cookie from 0.5.0 to 0.7.2

Release notes

Sourced from cookie's releases.

v0.7.2

Fixed

Fix object assignment of hasOwnProperty (#177) bc38ffd

https://github.com/jshttp/cookie/compare/v0.7.1...v0.7.2

0.7.1

Fixed

Allow leading dot for domain (#174)

Although not permitted in the spec, some users expect this to work and user agents ignore the leading dot according to spec

Add fast path for serialize without options, use obj.hasOwnProperty when parsing (#172)

https://github.com/jshttp/cookie/compare/v0.7.0...v0.7.1

0.7.0

perf: parse cookies ~10% faster (#144 by @kurtextrem and #170)

fix: narrow the validation of cookies to match RFC6265 (#167 by @bewinsnw)

fix: add main to package.json for rspack (#166 by @proudparrot2)

https://github.com/jshttp/cookie/compare/v0.6.0...v0.7.0

0.6.0

Add partitioned option

Commits

d19eaa1 0.7.2
bc38ffd Fix object assignment of hasOwnProperty (#177)
cf4658f 0.7.1
6a8b8f5 Allow leading dot for domain (#174)
58015c0 Remove more code and perf wins (#172)
ab057d6 0.7.0
5f02ca8 Migrate history to GitHub releases
a5d591c Migrate history to GitHub releases
51968f9 Skip isNaN
9e7ca51 perf(parse): cache length, return early (#144)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by blakeembrey, a new releaser for cookie since your current version.

Updates @bundled-es-modules/cookie from 2.0.0 to 2.0.1

Commits

See full diff in compare view

Maintainer changes

This version was pushed to npm by bashmish, a new releaser for @bundled-es-modules/cookie since your current version.

Updates express from 4.18.2 to 4.21.2

Release notes

Sourced from express's releases.

4.21.2

What's Changed

Add funding field (v4) by @bjohansebas in expressjs/express#6065

deps: [email protected] by @blakeembrey in expressjs/express#5956

deps: bump [email protected] by @jonchurch in expressjs/express#6209

Release: 4.21.2 by @UlisesGascon in expressjs/express#6094

Full Changelog: https://github.com/expressjs/express/compare/4.21.1...4.21.2

4.21.1

What's Changed

Backport a fix for CVE-2024-47764 to the 4.x branch by @joshbuker in expressjs/express#6029

Release: 4.21.1 by @UlisesGascon in expressjs/express#6031

Full Changelog: https://github.com/expressjs/express/compare/4.21.0...4.21.1

4.21.0

What's Changed

Deprecate "back" magic string in redirects by @blakeembrey in expressjs/express#5935

[email protected] by @wesleytodd in expressjs/express#5954

fix(deps): [email protected] by @wesleytodd in expressjs/express#5951

Upgraded dependency qs to 6.13.0 to match qs in body-parser by @agadzinski93 in expressjs/express#5946

New Contributors

@agadzinski93 made their first contribution in expressjs/express#5946

Full Changelog: https://github.com/expressjs/express/compare/4.20.0...4.21.0

4.20.0

What's Changed

Important

IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)

Remove link renderization in html while using res.redirect

Other Changes

4.19.2 Staging by @wesleytodd in expressjs/express#5561

remove duplicate location test for data uri by @wesleytodd in expressjs/express#5562

feat: document beta releases expectations by @marco-ippolito in expressjs/express#5565

Cut down on duplicated CI runs by @jonchurch in expressjs/express#5564

Add a Threat Model by @UlisesGascon in expressjs/express#5526

Assign captain of encodeurl by @blakeembrey in expressjs/express#5579

Nominate jonchurch as repo captain for http-errors, expressjs.com, morgan, cors, body-parser by @jonchurch in expressjs/express#5587

docs: update Security.md by @inigomarquinez in expressjs/express#5590

docs: update triage nomination policy by @UlisesGascon in expressjs/express#5600

Add CodeQL (SAST) by @UlisesGascon in expressjs/express#5433

docs: add UlisesGascon as triage initiative captain by @UlisesGascon in expressjs/express#5605

... (truncated)

Changelog

Sourced from express's changelog.

4.21.2 / 2024-11-06

deps: [email protected]

Fix backtracking protection

deps: [email protected]

Throws an error on invalid path values

4.21.1 / 2024-10-08

Backported a fix for CVE-2024-47764

4.21.0 / 2024-09-11

Deprecate res.location("back") and res.redirect("back") magic string

deps: [email protected]

includes [email protected]

deps: [email protected]

deps: [email protected]

4.20.0 / 2024-09-10

deps: [email protected]

Remove link renderization in html while redirecting

deps: [email protected]

Remove link renderization in html while redirecting

deps: [email protected]

add depth option to customize the depth level in the parser

IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)

Remove link renderization in html while using res.redirect

deps: [email protected]

Adds support for named matching groups in the routes using a regex

Adds backtracking protection to parameters without regexes defined

deps: encodeurl@~2.0.0

Removes encoding of \, |, and ^ to align better with URL spec

Deprecate passing options.maxAge and options.expires to res.clearCookie

Will be ignored in v5, clearCookie will set a cookie with an expires in the past to instruct clients to delete the cookie

4.19.2 / 2024-03-25

Improved fix for open redirect allow list bypass

4.19.1 / 2024-03-20

Allow passing non-strings to res.location with new encoding handling checks

... (truncated)

Commits

1faf228 4.21.2
2e0fb64 deps: bump [email protected] (#6209)
59fc270 deps: [email protected] (#5956)
51fc39c docs: add funding (#6065)
8e229f9 4.21.1
a024c8a fix(deps): [email protected]
7e562c6 4.21.0
1bcde96 fix(deps): [email protected] (#5946)
7d36477 fix(deps): [email protected] (#5951)
40d2d8f fix(deps): [email protected]
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by jonchurch, a new releaser for express since your current version.

Updates body-parser from 1.20.1 to 1.20.3

Release notes

Sourced from body-parser's releases.

1.20.3

What's Changed

Important

deps: [email protected]

add depth option to customize the depth level in the parser

IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity). Documentation

Other changes

chore: add support for OSSF scorecard reporting by @inigomarquinez in expressjs/body-parser#522

ci: fix errors in ci github action for node 8 and 9 by @inigomarquinez in expressjs/body-parser#523

fix: pin to [email protected] by @wesleytodd in expressjs/body-parser#527

deps: [email protected] by @melikhov-dev in expressjs/body-parser#521

Add OSSF Scorecard badge by @bjohansebas in expressjs/body-parser#531

Linter by @UlisesGascon in expressjs/body-parser#534

Release: 1.20.3 by @UlisesGascon in expressjs/body-parser#535

New Contributors

@inigomarquinez made their first contribution in expressjs/body-parser#522

@melikhov-dev made their first contribution in expressjs/body-parser#521

@bjohansebas made their first contribution in expressjs/body-parser#531

@UlisesGascon made their first contribution in expressjs/body-parser#534

Full Changelog: https://github.com/expressjs/body-parser/compare/1.20.2...1.20.3

1.20.2

Fix strict json error message on Node.js 19+

deps: content-type@~1.0.5

perf: skip value escaping when unnecessary

deps: [email protected]

Changelog

Sourced from body-parser's changelog.

1.20.3 / 2024-09-10

deps: [email protected]

add depth option to customize the depth level in the parser

IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)

1.20.2 / 2023-02-21

Fix strict json error message on Node.js 19+

deps: content-type@~1.0.5

perf: skip value escaping when unnecessary

deps: [email protected]

Commits

1752951 1.20.3
39744cf chore: linter (#534)
b2695c4 Merge commit from fork
ade0f3f add scorecard to readme (#531)
99a1bd6 deps: [email protected] (#521)
9478591 fix: pin to [email protected]
83db46a ci: fix errors in ci github action for node 8 and 9 (#523)
9d4e212 chore: add support for OSSF scorecard reporting (#522)
ee91374 1.20.2
368a93a Fix strict json error message on Node.js 19+
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for body-parser since your current version.

Updates braces from 3.0.2 to 3.0.3

Commits

74b2db2 3.0.3
88f1429 update eslint. lint, fix unit tests.
415d660 Snyk js braces 6838727 (#40)
190510f fix tests, skip 1 test in test/braces.expand
716eb9f readme bump
a5851e5 Merge pull request #37 from coderaiser/fix/vulnerability
2092bd1 feature: braces: add maxSymbols (https://github.com/micromatch/braces/issues/...
9f5b4cf fix: vulnerability (https://security.snyk.io/vuln/SNYK-JS-BRACES-6838727)
98414f9 remove funding file
665ab5d update keepEscaping doc (#27)
Additional commits viewable in compare view

Updates cross-spawn from 7.0.3 to 7.0.6

Changelog

Sourced from cross-spawn's changelog.

7.0.6 (2024-11-18)

Bug Fixes

update cross-spawn version to 7.0.5 in package-lock.json (f700743)

7.0.5 (2024-11-07)

Bug Fixes

fix escaping bug introduced by backtracking (640d391)

7.0.4 (2024-11-07)

Bug Fixes

disable regexp backtracking (#160) (5ff3a07)

Commits

77cd97f chore(release): 7.0.6
6717de4 chore: upgrade standard-version
f700743 fix: update cross-spawn version to 7.0.5 in package-lock.json
9a7e3b2 chore: fix build status badge
0852683 chore(release): 7.0.5
640d391 fix: fix escaping bug introduced by backtracking
bff0c87 chore: remove codecov
a7c6abc chore: replace travis with github workflows
9b9246e chore(release): 7.0.4
5ff3a07 fix: disable regexp backtracking (#160)
Additional commits viewable in compare view

Updates dset from 3.1.3 to 3.1.4

Commits

05b1ec0 3.1.4
16d6154 fix: prevent proto assignment via implicit string
See full diff in compare view

Updates esbuild from 0.19.12 to 0.25.5

Release notes

Sourced from esbuild's releases.

v0.25.5

Fix a regression with browser in package.json (#4187)

The fix to #4144 in version 0.25.3 introduced a regression that caused browser overrides specified in package.json to fail to override relative path names that end in a trailing slash. That behavior change affected the [email protected] package. This regression has been fixed, and now has test coverage.

Add support for certain keywords as TypeScript tuple labels (#4192)

Previously esbuild could incorrectly fail to parse certain keywords as TypeScript tuple labels...
Description has been truncated

Note Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

Jun 07 '25 07:06 dependabot[bot]