Skip to content

chore(deps): bump the npm_and_yarn group across 8 directories with 5 updates#149

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/examples/astro/npm_and_yarn-be2d3a5c92
Open

chore(deps): bump the npm_and_yarn group across 8 directories with 5 updates#149
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/examples/astro/npm_and_yarn-be2d3a5c92

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot bot commented on behalf of github Mar 28, 2026

Bumps the npm_and_yarn group with 1 update in the /examples/astro directory: picomatch.
Bumps the npm_and_yarn group with 1 update in the /examples/expressjs directory: path-to-regexp.
Bumps the npm_and_yarn group with 4 updates in the /examples/firebase-functions directory: picomatch, yaml, path-to-regexp and brace-expansion.
Bumps the npm_and_yarn group with 1 update in the /examples/nestjs directory: brace-expansion.
Bumps the npm_and_yarn group with 4 updates in the /examples/nuxt directory: picomatch, yaml, brace-expansion and srvx.
Bumps the npm_and_yarn group with 3 updates in the /examples/react-router directory: picomatch, path-to-regexp and brace-expansion.
Bumps the npm_and_yarn group with 1 update in the /examples/sveltekit directory: picomatch.
Bumps the npm_and_yarn group with 2 updates in the /examples/tanstack-start directory: picomatch and srvx.

Updates picomatch from 4.0.3 to 4.0.4

Release notes

Sourced from picomatch's releases.

4.0.4

This is a security release fixing several security relevant issues.

What's Changed

Full Changelog: micromatch/picomatch@4.0.3...4.0.4

Commits

Updates picomatch from 2.3.1 to 2.3.2

Release notes

Sourced from picomatch's releases.

4.0.4

This is a security release fixing several security relevant issues.

What's Changed

Full Changelog: micromatch/picomatch@4.0.3...4.0.4

Commits

Updates path-to-regexp from 8.2.0 to 8.4.0

Release notes

Sourced from path-to-regexp's releases.

8.4.0

Important

Fixed

Changed

  • Dedupes regex prefixes (pillarjs/path-to-regexp#422)
    • This will result in shorter regular expressions for some cases using optional groups
  • Rejects large optional route combinations (pillarjs/path-to-regexp#424)
    • When using groups such as /users{/delete} it will restrict the number of generated combinations to < 256, equivalent to 8 top-level optional groups and unlikely to occur in a real world application, but avoids exploding the regex size for applications that accept user created routes

8.3.0

Changed

  • Add custom error class (#398) 2a7f2a4
  • Allow plain objects for TokenData (#391) 687a9bb
  • Escape text should escape backslash (#390) a4a8552
  • Improved error messages and stack size (#363) a6bdf40

Other

  • Minifying the parser
    • PR (#401) 9df2448
    • PR (#395) 4a91505
    • Shaving some bytes d63f44b
    • Remove optional operator 973d15c

pillarjs/path-to-regexp@v8.2.0...v8.3.0

Commits

Updates picomatch from 2.3.1 to 2.3.2

Release notes

Sourced from picomatch's releases.

4.0.4

This is a security release fixing several security relevant issues.

What's Changed

Full Changelog: micromatch/picomatch@4.0.3...4.0.4

Commits

Updates yaml from 2.8.2 to 2.8.3

Release notes

Sourced from yaml's releases.

v2.8.3

  • Add trailingComma ToString option for multiline flow formatting (#670)
  • Catch stack overflow during node composition (1e84ebb)
Commits
  • ce14587 2.8.3
  • 1e84ebb fix: Catch stack overflow during node composition
  • 6b24090 ci: Include Prettier check in lint action
  • 9424dee chore: Refresh lockfile
  • d1aca82 Add trailingComma ToString option for multiline flow formatting (#670)
  • 4321509 ci: Drop the branch filter from GitHub PR actions
  • 47207d0 chore: Update docs-slate
  • 5212fae chore: Update docs-slate
  • See full diff in compare view

Updates path-to-regexp from 0.1.12 to 0.1.13

Release notes

Sourced from path-to-regexp's releases.

8.4.0

Important

Fixed

Changed

  • Dedupes regex prefixes (pillarjs/path-to-regexp#422)
    • This will result in shorter regular expressions for some cases using optional groups
  • Rejects large optional route combinations (pillarjs/path-to-regexp#424)
    • When using groups such as /users{/delete} it will restrict the number of generated combinations to < 256, equivalent to 8 top-level optional groups and unlikely to occur in a real world application, but avoids exploding the regex size for applications that accept user created routes

8.3.0

Changed

  • Add custom error class (#398) 2a7f2a4
  • Allow plain objects for TokenData (#391) 687a9bb
  • Escape text should escape backslash (#390) a4a8552
  • Improved error messages and stack size (#363) a6bdf40

Other

  • Minifying the parser
    • PR (#401) 9df2448
    • PR (#395) 4a91505
    • Shaving some bytes d63f44b
    • Remove optional operator 973d15c

pillarjs/path-to-regexp@v8.2.0...v8.3.0

Commits

Updates path-to-regexp from 8.3.0 to 8.4.0

Release notes

Sourced from path-to-regexp's releases.

8.4.0

Important

Fixed

Changed

  • Dedupes regex prefixes (pillarjs/path-to-regexp#422)
    • This will result in shorter regular expressions for some cases using optional groups
  • Rejects large optional route combinations (pillarjs/path-to-regexp#424)
    • When using groups such as /users{/delete} it will restrict the number of generated combinations to < 256, equivalent to 8 top-level optional groups and unlikely to occur in a real world application, but avoids exploding the regex size for applications that accept user created routes

8.3.0

Changed

  • Add custom error class (#398) 2a7f2a4
  • Allow plain objects for TokenData (#391) 687a9bb
  • Escape text should escape backslash (#390) a4a8552
  • Improved error messages and stack size (#363) a6bdf40

Other

  • Minifying the parser
    • PR (#401) 9df2448
    • PR (#395) 4a91505
    • Shaving some bytes d63f44b
    • Remove optional operator 973d15c

pillarjs/path-to-regexp@v8.2.0...v8.3.0

Commits

Updates brace-expansion from 1.1.12 to 1.1.13

Commits

Updates brace-expansion from 2.0.2 to 2.0.3

Commits

Updates brace-expansion from 1.1.12 to 1.1.13

Commits

Updates brace-expansion from 5.0.4 to 5.0.5

Commits

Updates picomatch from 2.3.1 to 2.3.2

Release notes

Sourced from picomatch's releases.

4.0.4

This is a security release fixing several security relevant issues.

What's Changed

Full Changelog: micromatch/picomatch@4.0.3...4.0.4

Commits

Updates yaml from 2.8.2 to 2.8.3

Release notes

Sourced from yaml's releases.

v2.8.3

  • Add trailingComma ToString option for multiline flow formatting (#670)
  • Catch stack overflow during node composition (1e84ebb)
Commits
  • ce14587 2.8.3
  • 1e84ebb fix: Catch stack overflow during node composition
  • 6b24090 ci: Include Prettier check in lint action
  • 9424dee chore: Refresh lockfile
  • d1aca82 Add trailingComma ToString option for multiline flow formatting (#670)
  • 4321509 ci: Drop the branch filter from GitHub PR actions
  • 47207d0 chore: Update docs-slate
  • 5212fae chore: Update docs-slate
  • See full diff in compare view

Updates brace-expansion from 2.0.2 to 2.0.3

Commits

Updates srvx from 0.11.9 to 0.11.13

Release notes

Sourced from srvx's releases.

v0.11.13

compare changes

🩹 Fixes

  • url: Deopt absolute URIs in FastURL (de0d699)

v0.11.12

compare changes

🩹 Fixes

  • node: Improve pipeBody stability and performance (4051f22)

v0.11.11

compare changes

🩹 Fixes

v0.11.10

compare changes

🩹 Fixes

  • node: Handle error and abort propagation for piped Node.js streams (77f879b)
  • node: Fallback to socket address on invalid Host header (#192)
  • node: Combine duplicate headers in entries() iterator (4ed7453)

❤️ Contributors

Changelog

Sourced from srvx's changelog.

v0.11.13

compare changes

🩹 Fixes

  • url: Deopt absolute URIs in FastURL (de0d699)

🏡 Chore

❤️ Contributors

v0.11.12

compare changes

🩹 Fixes

  • node: Improve pipeBody stability and performance (4051f22)

❤️ Contributors

v0.11.11

compare changes

🩹 Fixes

  • node: Handle duck-typed pipe objects in pipeBody (5e731ef)

✅ Tests

  • node: Add duck-typed pipe object test for pipeBody (f746e79)

❤️ Contributors

v0.11.10

... (truncated)

Commits

Updates picomatch from 4.0.3 to 4.0.4

Release notes

Sourced from picomatch's releases.

4.0.4

This is a security release fixing several security relevant issues.

What's Changed

Full Changelog: micromatch/picomatch@4.0.3...4.0.4

Commits

Updates path-to-regexp from 0.1.12 to 0.1.13

Release notes

Sourced from path-to-regexp's releases.

8.4.0

Important

Fixed

Changed

  • Dedupes regex prefixes (pillarjs/path-to-regexp#422)
    • This will result in shorter regular expressions for some cases using optional groups
  • Rejects large optional route combinations (pillarjs/path-to-regexp#424)
    • When using groups such as /users{/delete} it will restrict the number of generated combinations to < 256, equivalent to 8 top-level optional groups and unlikely to occur in a real world application, but avoids exploding the regex size for applications that accept user created routes

8.3.0

Changed

  • Add custom error class (#398) 2a7f2a4
  • Allow plain objects for TokenData (#391) 687a9bb
  • Escape text should escape backslash (#390) a4a8552
  • Improved error messages and stack size (#363) a6bdf40

Other

  • Minifying the parser
    • PR (#401) 9df2448
    • PR (#395) 4a91505
    • Shaving some bytes d63f44b
    • Remove optional operator 973d15c

pillarjs/path-to-regexp@v8.2.0...v8.3.0

Commits

Updates brace-expansion from 2.0.2 to 2.0.3

Commits

Updates picomatch from 4.0.3 to 4.0.4

Release notes

Sourced from picomatch's releases.

4.0.4

This is a security release fixing several security relevant issues.

What's Changed

Full Changelog: micromatch/picomatch@4.0.3...4.0.4

Commits

Updates picomatch from 4.0.3 to 4.0.4

Release notes

Sourced from picomatch's releases.

4.0.4

This is a security release fixing several security relevant issues.

What's Changed

Full Changelog: micromatch/picomatch@4.0.3...4.0.4

Commits

Updates picomatch from 2.3.1 to 2.3.2

Release notes

Sourced from picomatch's releases.

4.0.4

This is a security release fixing several security relevant issues.

What's Changed

Full Changelog: micromatch/picomatch@4.0.3...4.0.4

Commits

Updates srvx from 0.11.12 to 0.11.13

Release notes

Sourced from srvx's releases.

v0.11.13

compare changes

🩹 Fixes

  • url: Deopt absolute URIs in FastURL (de0d699)

v0.11.12

compare changes

🩹 Fixes

  • node: Improve pipeBody stability and performance (4051f22)

v0.11.11

compare changes

🩹 Fixes

v0.11.10

compare changes

🩹 Fixes

  • node: Handle error and abort propagation for piped Node.js streams (77f879b)
  • node: Fallback to socket address on invalid Host header (#192)
  • node: Combine duplicate headers in entries() iterator (4ed7453)

❤️ Contributors

Changelog

Sourced from srvx's changelog.

v0.11.13

compare changes

🩹 Fixes

  • url: Deopt absolute URIs in FastURL (de0d699)

🏡 Chore

❤️ Contributors

v0.11.12

compare changes

🩹 Fixes

  • node: Improve pipeBody stabili...

    Description has been truncated

@dependabot
chore(deps): bump the npm_and_yarn group across 8 directories with 5 …
a10f4bf 
…updates

Bumps the npm_and_yarn group with 1 update in the /examples/astro directory: [picomatch](https://github.com/micromatch/picomatch).
Bumps the npm_and_yarn group with 1 update in the /examples/expressjs directory: [path-to-regexp](https://github.com/pillarjs/path-to-regexp).
Bumps the npm_and_yarn group with 4 updates in the /examples/firebase-functions directory: [picomatch](https://github.com/micromatch/picomatch), [yaml](https://github.com/eemeli/yaml), [path-to-regexp](https://github.com/pillarjs/path-to-regexp) and [brace-expansion](https://github.com/juliangruber/brace-expansion).
Bumps the npm_and_yarn group with 1 update in the /examples/nestjs directory: [brace-expansion](https://github.com/juliangruber/brace-expansion).
Bumps the npm_and_yarn group with 4 updates in the /examples/nuxt directory: [picomatch](https://github.com/micromatch/picomatch), [yaml](https://github.com/eemeli/yaml), [brace-expansion](https://github.com/juliangruber/brace-expansion) and [srvx](https://github.com/h3js/srvx).
Bumps the npm_and_yarn group with 3 updates in the /examples/react-router directory: [picomatch](https://github.com/micromatch/picomatch), [path-to-regexp](https://github.com/pillarjs/path-to-regexp) and [brace-expansion](https://github.com/juliangruber/brace-expansion).
Bumps the npm_and_yarn group with 1 update in the /examples/sveltekit directory: [picomatch](https://github.com/micromatch/picomatch).
Bumps the npm_and_yarn group with 2 updates in the /examples/tanstack-start directory: [picomatch](https://github.com/micromatch/picomatch) and [srvx](https://github.com/h3js/srvx).


Updates `picomatch` from 4.0.3 to 4.0.4
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@4.0.3...4.0.4)

Updates `picomatch` from 2.3.1 to 2.3.2
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@4.0.3...4.0.4)

Updates `path-to-regexp` from 8.2.0 to 8.4.0
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v8.2.0...v8.4.0)

Updates `picomatch` from 2.3.1 to 2.3.2
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@4.0.3...4.0.4)

Updates `yaml` from 2.8.2 to 2.8.3
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.8.2...v2.8.3)

Updates `path-to-regexp` from 0.1.12 to 0.1.13
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v8.2.0...v8.4.0)

Updates `path-to-regexp` from 8.3.0 to 8.4.0
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v8.2.0...v8.4.0)

Updates `brace-expansion` from 1.1.12 to 1.1.13
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.13)

Updates `brace-expansion` from 2.0.2 to 2.0.3
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.13)

Updates `brace-expansion` from 1.1.12 to 1.1.13
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.13)

Updates `brace-expansion` from 5.0.4 to 5.0.5
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.13)

Updates `picomatch` from 2.3.1 to 2.3.2
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@4.0.3...4.0.4)

Updates `yaml` from 2.8.2 to 2.8.3
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.8.2...v2.8.3)

Updates `brace-expansion` from 2.0.2 to 2.0.3
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.13)

Updates `srvx` from 0.11.9 to 0.11.13
- [Release notes](https://github.com/h3js/srvx/releases)
- [Changelog](https://github.com/h3js/srvx/blob/main/CHANGELOG.md)
- [Commits](h3js/srvx@v0.11.9...v0.11.13)

Updates `picomatch` from 4.0.3 to 4.0.4
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@4.0.3...4.0.4)

Updates `path-to-regexp` from 0.1.12 to 0.1.13
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v8.2.0...v8.4.0)

Updates `brace-expansion` from 2.0.2 to 2.0.3
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.13)

Updates `picomatch` from 4.0.3 to 4.0.4
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@4.0.3...4.0.4)

Updates `picomatch` from 4.0.3 to 4.0.4
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@4.0.3...4.0.4)

Updates `picomatch` from 2.3.1 to 2.3.2
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@4.0.3...4.0.4)

Updates `srvx` from 0.11.12 to 0.11.13
- [Release notes](https://github.com/h3js/srvx/releases)
- [Changelog](https://github.com/h3js/srvx/blob/main/CHANGELOG.md)
- [Commits](h3js/srvx@v0.11.9...v0.11.13)

---
updated-dependencies:
- dependency-name: picomatch
  dependency-version: 4.0.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: picomatch
  dependency-version: 2.3.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: path-to-regexp
  dependency-version: 8.4.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: picomatch
  dependency-version: 2.3.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: yaml
  dependency-version: 2.8.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: path-to-regexp
  dependency-version: 0.1.13
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: path-to-regexp
  dependency-version: 8.4.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 1.1.13
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 2.0.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 1.1.13
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 5.0.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: picomatch
  dependency-version: 2.3.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: yaml
  dependency-version: 2.8.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 2.0.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: srvx
  dependency-version: 0.11.13
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: picomatch
  dependency-version: 4.0.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: path-to-regexp
  dependency-version: 0.1.13
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 2.0.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: picomatch
  dependency-version: 4.0.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: picomatch
  dependency-version: 4.0.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: picomatch
  dependency-version: 2.3.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: srvx
  dependency-version: 0.11.13
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 28, 2026
@dependabot dependabot bot mentioned this pull request Mar 28, 2026
Closed
@socket-security
Copy link
Copy Markdown

socket-security bot commented Mar 28, 2026

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. It is recommended to resolve "Warn" alerts too. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Block Low
Potential code anomaly (AI signal): npm yaml is 100.0% likely to have a medium risk anomaly

Notes: The code presents a standard, non-malicious NodeBase component used in YAML/JS conversion. The primary risk surface is the optional reviver and onAnchor callbacks provided by the user: if untrusted, these can execute arbitrary code or influence the transformed representation via applyReviver or the reviver itself. This is expected behavior for extensible YAML libraries; ensure callbacks come from trusted sources and sandbox or validate revivers where possible.

Confidence: 1.00

Severity: 0.60

From: examples/nuxt/package-lock.json → npm/nuxt@4.4.2 → npm/yaml@2.8.3

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/yaml@2.8.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Publisher changed: npm path-to-regexp is now published by ulisesgascon

Author: ulisesgascon

From: examples/react-router/package-lock.json → npm/@react-router/serve@7.13.0 → npm/path-to-regexp@0.1.13

ℹ Read more on: This package | This alert | What is unstable ownership?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/path-to-regexp@0.1.13. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Low
Publisher changed: npm path-to-regexp is now published by ulisesgascon instead of blakeembrey

New Author: ulisesgascon

Previous Author: blakeembrey

From: examples/react-router/package-lock.json → npm/@react-router/serve@7.13.0 → npm/path-to-regexp@0.1.13

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/path-to-regexp@0.1.13. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants