odo chore(deps): Bump on-headers and compression in /ui

Bumps on-headers and compression. These dependencies needed to be updated together. Updates on-headers from 1.0.2 to 1.1.0

Release notes

Sourced from on-headers's releases.

1.1.0

Important

Fix CVE-2025-7339 (GHSA-76c9-3jph-rj3q)

What's Changed

Migrate CI pipeline to GitHub actions by @carpasse in jshttp/on-headers#12

fix README.md badges by @carpasse in jshttp/on-headers#13

add OSSF scorecard action by @carpasse in jshttp/on-headers#14

fix: use ubuntu-latest as ci runner by @UlisesGascon in jshttp/on-headers#19

ci: apply OSSF Scorecard security best practices by @UlisesGascon in jshttp/on-headers#20

👷 add upstream change detection by @ctcpip in jshttp/on-headers#31

✨ add script to update known hashes by @ctcpip in jshttp/on-headers#32

💚 update CI - add newer node versions by @ctcpip in jshttp/on-headers#33

New Contributors

@carpasse made their first contribution in jshttp/on-headers#12

@UlisesGascon made their first contribution in jshttp/on-headers#19

@ctcpip made their first contribution in jshttp/on-headers#31

Full Changelog: https://github.com/jshttp/on-headers/compare/v1.0.2...v1.1.0

Changelog

Sourced from on-headers's changelog.

1.1.0 / 2025-07-17

Fix CVE-2025-7339 (GHSA-76c9-3jph-rj3q)

Commits

4b017af 1.1.0
b636f2d ♻️ refactor header array code
3e2c2d4 ✨ ignore falsy header keys, matching node behavior
172eb41 ✨ support duplicate headers
c6e3849 🔒️ fix array handling
6893518 💚 update CI - add newer node versions
56a345d ✨ add script to update known hashes
175ab21 👷 add upstream change detection (#31)
ce0b2c8 ci: apply OSSF Scorecard security best practices (#20)
1a38c54 fix: use ubuntu-latest as ci runner (#19)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for on-headers since your current version.

Updates compression from 1.7.4 to 1.8.1

Release notes

Sourced from compression's releases.

v1.8.1

What's Changed

fix(docs): update multiple links from http to https by @Phillip9587 in expressjs/compression#222

ci: add dependabot for github actions by @bjohansebas in expressjs/compression#207

build(deps): bump github/codeql-action from 2.23.2 to 3.28.15 by @dependabot[bot] in expressjs/compression#228

build(deps): bump ossf/scorecard-action from 2.3.1 to 2.4.1 by @dependabot[bot] in expressjs/compression#229

build(deps-dev): bump eslint-plugin-import from 2.26.0 to 2.31.0 by @dependabot[bot] in expressjs/compression#230

build(deps-dev): bump supertest from 6.2.3 to 6.3.4 by @dependabot[bot] in expressjs/compression#231

[StepSecurity] ci: Harden GitHub Actions by @step-security-bot in expressjs/compression#235

build(deps): bump github/codeql-action from 3.28.15 to 3.29.2 by @dependabot[bot] in expressjs/compression#243

build(deps): bump actions/upload-artifact from 4.3.1 to 4.6.2 by @dependabot[bot] in expressjs/compression#239

build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by @dependabot[bot] in expressjs/compression#240

build(deps): bump actions/checkout from 4.1.1 to 4.2.2 by @dependabot[bot] in expressjs/compression#241

build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0 by @dependabot[bot] in expressjs/compression#244

deps: [email protected] by @UlisesGascon in expressjs/compression#246

Release: 1.8.1 by @UlisesGascon in expressjs/compression#247

New Contributors

@dependabot[bot] made their first contribution in expressjs/compression#228

@step-security-bot made their first contribution in expressjs/compression#235

Full Changelog: https://github.com/expressjs/compression/compare/1.8.0...v1.8.1

v1.8.0

What's Changed

Refactor chunkLength function for improved readability and consistency by @Ayoub-Mabrouk in expressjs/compression#203

Refactor toBuffer function to simplify buffer check logic by @Ayoub-Mabrouk in expressjs/compression#201

ci: add CodeQL (SAST) by @bjohansebas in expressjs/compression#204

Use headersSent instead of _header by @maritz in expressjs/compression#129

Bugfix/use write head instead of implicit header by @Icehunter in expressjs/compression#170

feat: add default option by @bjohansebas in expressjs/compression#191

ci: update ci workflow by @bjohansebas in expressjs/compression#206

feat: support for brotli by @bjohansebas in expressjs/compression#194

docs: improve readme by @bjohansebas in expressjs/compression#209

docs: keywords field by @bjohansebas in expressjs/compression#210

refactor: simplify encoding negotiation logic by @bjohansebas in expressjs/compression#213

New Contributors

@Ayoub-Mabrouk made their first contribution in expressjs/compression#203

@maritz made their first contribution in expressjs/compression#129

@Icehunter made their first contribution in expressjs/compression#170

Full Changelog: https://github.com/expressjs/compression/compare/1.7.5...v1.8.0

1.7.5

What's Changed

chore: add support for OSSF scorecard reporting by @inigomarquinez in expressjs/compression#186

ci: fix errors in ci github action for node 8 and 9 by @inigomarquinez in expressjs/compression#187

docs: fix spelling by @dijonkitchen in expressjs/compression#174

deps: [email protected] by @bjohansebas in expressjs/compression#192

... (truncated)

Changelog

Sourced from compression's changelog.

1.8.1 / 2025-07-17

deps: on-headers@~1.1.0

Fix CVE-2025-7339 (GHSA-76c9-3jph-rj3q)

1.8.0 / 2025-02-10

Use res.headersSent when available

Replace _implicitHeader with writeHead property

add brotli support for versions of node that support it

Add the enforceEncoding option for requests without Accept-Encoding header

1.7.5 / 2024-10-31

deps: Replace accepts with negotiator@~0.6.4

Add preference option

deps: [email protected]

Add petabyte (pb) support

Fix "thousandsSeparator" incorrecting formatting fractional part

Fix return value for un-parsable strings

deps: compressible@~2.0.18

Mark font/ttf as compressible

Remove compressible from multipart/mixed

deps: mime-db@'>= 1.43.0 < 2'

deps: [email protected]

Commits

83a0c45 1.8.1
ce62713 deps: [email protected] (#246)
f4acb23 build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0 (#244)
6eaebe6 build(deps): bump actions/checkout from 4.1.1 to 4.2.2 (#241)
37e0623 build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 (#240)
bc436b2 build(deps): bump actions/upload-artifact from 4.3.1 to 4.6.2 (#239)
2f9f572 build(deps): bump github/codeql-action from 3.28.15 to 3.29.2 (#243)
5f13b14 [StepSecurity] ci: Harden GitHub Actions (#235)
76e0945 build(deps-dev): bump supertest from 6.2.3 to 6.3.4 (#231)
ae6ee80 build(deps-dev): bump eslint-plugin-import from 2.26.0 to 2.31.0 (#230)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for compression since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the Security Alerts page.

Jul 17 '25 21:07 dependabot[bot]

Deploy Preview for odo-docusaurus-preview canceled.

Name	Link
Latest commit	bd3cd30300a45d27aa1d10d90eb61fdeadb4280f
Latest deploy log	https://app.netlify.com/projects/odo-docusaurus-preview/deploys/68fb5300e819f30008938399

Jul 17 '25 21:07 netlify[bot]

Hi @dependabot[bot]. Thanks for your PR.

I'm waiting for a redhat-developer member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.