Bump the npm_and_yarn group across 1 directory with 4 updates by dependabot[bot] · Pull Request #7 · lightward/aura

dependabot · 2025-10-11T20:12:35Z

Bumps the npm_and_yarn group with 4 updates in the / directory: rollup, fastify, json5 and minimist.

Updates rollup from 2.66.0 to 2.79.2

Release notes

v.2.79.2

2.79.2

2024-09-26

Bug Fixes

Fix a vulnerability in generated code that affects IIFE, UMD and CJS bundles when run in a browser context (#5671)

Pull Requests

#5671: Fix DOM Clobbering CVE (@lukastaegert)

Changelog

Sourced from rollup's changelog.

rollup changelog

2.79.1

2022-09-22

Bug Fixes

Avoid massive performance degradation when creating thousands of chunks (#4643)

Pull Requests

#4639: fix: typo docs and contributors link in CONTRIBUTING.md ( @takurinton)

#4641: Update type definition of resolveId (@ivanjonas)

#4643: Improve performance of chunk naming collision check ( @lukastaegert)

2.79.0

2022-08-31

Features

Add amd.forceJsExtensionForImports to enforce using .js extensions for relative AMD imports (#4607)

Pull Requests

#4607: add option to keep extensions for amd (@wh1tevs)

2.78.1

2022-08-19

Bug Fixes

Avoid inferring "arguments" as name for a default export placeholder variable (#4613)

Pull Requests

#4613: Prevent using arguments for generated variable names ( @lukastaegert)

2.78.0

2022-08-14

Features

Support writing plugin hooks as objects with a "handler" property (#4600)

Allow changing execution order per plugin hook (#4600)

Add flag to execute plugins in async parallel hooks sequentially (#4600)

... (truncated)

Commits

c9bd03d 2.79.2
48aef33 fix: resolve DOM Clobbering CVE-2024-43788 (backport to v2) (#5677)
69ff418 2.79.1
04dce1b Update changelog
159137e fix: typo docs and contributors link in CONTRIBUTING.md (#4639)
e1392b3 Update type definition of resolveId (#4641)
7836357 Improve performance of chunk naming collision check (#4643)
71d20c9 Reduce permissions for repl-artefacts.yml workflow (#4630)
8193ea5 Adapt workflow to use Node 14 sub-version to work with branch protection
8477f8f 2.79.0
Additional commits viewable in compare view

Updates fastify from 3.26.0 to 3.29.5

Release notes

Sourced from fastify's releases.

v3.29.5

What's Changed

(v3.x) Replace pem dependency (#3711) by @climba03003 in fastify/fastify#4500

[Backport v3.x] fix: content-type parserRegExpList when plugin override by @github-actions in fastify/fastify#4498

(v3.x) perf: only check for isEssence once in RegExp for content-type-parser (#4481) by @climba03003 in fastify/fastify#4497

(v3.x) replace content-type with fast-content-type-parse (#4505) by @climba03003 in fastify/fastify#4507

Full Changelog: fastify/fastify@v3.29.4...v3.29.5

v3.29.4

⚠️ Security Release ⚠️

Fix for "Incorrect Content-Type parsing can lead to CSRF attack" and CVE-2022-41919

Full Changelog: fastify/fastify@v3.29.3...v3.29.4

v3.29.3

⚠️ ~~Security Release~~ ⚠️

This release backport the fixes of GHSA-455w-c45v-86rg for the v3.x line. While not being a vulnerability for this line, a backport is still welcome due to the problems highlighted in the report.

Full Changelog: fastify/fastify@v3.29.2...v3.29.3

v3.29.2

What's Changed

fix: backport reused connection fix by @salzhrani in fastify/fastify#4217

New Contributors

@salzhrani made their first contribution in fastify/fastify#4217

Full Changelog: fastify/fastify@v3.29.1...v3.29.2

v3.29.1

What's Changed

docs: reference new @fastify/* modules by @Fdawgs in fastify/fastify#3860

Child log level in bindings is deprecated by @orov-io in fastify/fastify#3896

Handle aborted requests (#215) by @TimotejR in fastify/fastify#4103

New Contributors

@orov-io made their first contribution in fastify/fastify#3896

@TimotejR made their first contribution in fastify/fastify#4103

Full Changelog: fastify/fastify@v3.29.0...v3.29.1

v3.29.0

What's Changed

Update fastify-error dependency by @jsumners in fastify/fastify#3859

... (truncated)

Commits

30ad4f3 Bumped v3.29.5
fcc931e replace content-type with fast-content-type-parse (#4505) (#4507)
e4e8393 (v3.x) perf: only check for isEssence once in RegExp for content-type-parser...
c172cae fix: content-type parserRegExpList when plugin override (#4496) (#4498)
6453645 Replace pem dependency (#3711) (#4500)
6053031 Bumped v3.29.4
cdba37d Merge pull request from GHSA-3fjj-p79j-c9hh
5df7665 Bumped v3.29.3
9a55126 Merge pull request from GHSA-455w-c45v-86rg
596c8c3 Bumped v3.29.2
Additional commits viewable in compare view

Updates json5 from 1.0.1 to 1.0.2

Release notes

Sourced from json5's releases.

v1.0.2

Fix: Properties with the name __proto__ are added to objects and arrays. (#199) This also fixes a prototype pollution vulnerability reported by Jonathan Gregson! (#295). This has been backported to v1. (#298)

Changelog

Sourced from json5's changelog.

Unreleased [code, diff]

v2.2.3 [code, diff]

Fix: json5@2.2.3 is now the 'latest' release according to npm instead of v1.0.2. (#299)

v2.2.2 [code, diff]

Fix: Properties with the name __proto__ are added to objects and arrays. (#199) This also fixes a prototype pollution vulnerability reported by Jonathan Gregson! (#295).

v2.2.1 [code, diff]

Fix: Removed dependence on minimist to patch CVE-2021-44906. (#266)

v2.2.0 [code, diff]

New: Accurate and documented TypeScript declarations are now included. There is no need to install @types/json5. (#236, #244)

v2.1.3 [code, diff]

Fix: An out of memory bug when parsing numbers has been fixed. (#228, #229)

v2.1.2 [code, diff]

... (truncated)

Commits

a62db1e 1.0.2
e0c23fe docs: update CHANGELOG for v1.0.2
62a6540 fix: add proto to objects and arrays
See full diff in compare view

Updates minimist from 1.2.5 to 1.2.8

Changelog

Sourced from minimist's changelog.

v1.2.8 - 2023-02-09

Merged

[Fix] Fix long option followed by single dash [#17](https://github.com/minimistjs/minimist/issues/17)

[Tests] Remove duplicate test [#12](https://github.com/minimistjs/minimist/issues/12)

[Fix] opt.string works with multiple aliases [#10](https://github.com/minimistjs/minimist/issues/10)

Fixed

[Fix] Fix long option followed by single dash (#17) [#15](https://github.com/minimistjs/minimist/issues/15)

[Tests] Remove duplicate test (#12) [#8](https://github.com/minimistjs/minimist/issues/8)

[Fix] Fix long option followed by single dash [#15](https://github.com/minimistjs/minimist/issues/15)

[Fix] opt.string works with multiple aliases (#10) [#9](https://github.com/minimistjs/minimist/issues/9)

[Fix] Fix handling of short option with non-trivial equals [#5](https://github.com/minimistjs/minimist/issues/5)

[Tests] Remove duplicate test [#8](https://github.com/minimistjs/minimist/issues/8)

[Fix] opt.string works with multiple aliases [#9](https://github.com/minimistjs/minimist/issues/9)

Commits

Merge tag 'v0.2.3' a026794

[eslint] fix indentation and whitespace 5368ca4

[eslint] fix indentation and whitespace e5f5067

[eslint] more cleanup 62fde7d

[eslint] more cleanup 36ac5d0

[meta] add auto-changelog 73923d2

[actions] add reusable workflows d80727d

[eslint] add eslint; rules to enable later are warnings 48bc06a

[eslint] fix indentation 34b0f1c

[readme] rename and add badges 5df0fe4

[Dev Deps] switch from covert to nyc a48b128

[Dev Deps] update covert, tape; remove unnecessary tap f0fb958

[meta] create FUNDING.yml; add funding in package.json 3639e0c

[meta] use npmignore to autogenerate an npmignore file be2e038

Only apps should have lockfiles 282b570

isConstructorOrProto adapted from PR ef9153f

[Dev Deps] update @ljharb/eslint-config, aud 098873c

[Dev Deps] update @ljharb/eslint-config, aud 3124ed3

[meta] add safe-publish-latest 4b927de

[Tests] add aud in posttest b32d9bd

[meta] update repo URLs f9fdfc0

[actions] Avoid 0.6 tests due to build failures ba92fe6

[Dev Deps] update tape 950eaa7

[Dev Deps] add missing npmignore dev dep 3226afa

Merge tag 'v0.2.2' 980d7ac

v1.2.7 - 2022-10-10

Commits

... (truncated)

Commits

6901ee2 v1.2.8
a026794 Merge tag 'v0.2.3'
c0b2661 v0.2.3
63b8fee [Fix] Fix long option followed by single dash (#17)
72239e6 [Tests] Remove duplicate test (#12)
34b0f1c [eslint] fix indentation
3226afa [Dev Deps] add missing npmignore dev dep
098873c [Dev Deps] update @ljharb/eslint-config, aud
9ec4d27 [Fix] Fix long option followed by single dash
ba92fe6 [actions] Avoid 0.6 tests due to build failures
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by ljharb, a new releaser for minimist since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the npm_and_yarn group with 4 updates in the / directory: [rollup](https://github.com/rollup/rollup), [fastify](https://github.com/fastify/fastify), [json5](https://github.com/json5/json5) and [minimist](https://github.com/minimistjs/minimist). Updates `rollup` from 2.66.0 to 2.79.2 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG-2.md) - [Commits](rollup/rollup@v2.66.0...v2.79.2) Updates `fastify` from 3.26.0 to 3.29.5 - [Release notes](https://github.com/fastify/fastify/releases) - [Commits](fastify/fastify@v3.26.0...v3.29.5) Updates `json5` from 1.0.1 to 1.0.2 - [Release notes](https://github.com/json5/json5/releases) - [Changelog](https://github.com/json5/json5/blob/main/CHANGELOG.md) - [Commits](json5/json5@v1.0.1...v1.0.2) Updates `minimist` from 1.2.5 to 1.2.8 - [Changelog](https://github.com/minimistjs/minimist/blob/main/CHANGELOG.md) - [Commits](minimistjs/minimist@v1.2.5...v1.2.8) --- updated-dependencies: - dependency-name: rollup dependency-version: 2.79.2 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: fastify dependency-version: 3.29.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: json5 dependency-version: 1.0.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: minimist dependency-version: 1.2.8 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 11, 2025

isaacbowen merged commit 959f407 into main Oct 11, 2025
1 check passed

isaacbowen deleted the dependabot/npm_and_yarn/npm_and_yarn-27ae4440b4 branch October 11, 2025 20:19

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the npm_and_yarn group across 1 directory with 4 updates#7

Bump the npm_and_yarn group across 1 directory with 4 updates#7
isaacbowen merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-27ae4440b4

dependabot Bot commented on behalf of github Oct 11, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 11, 2025

v.2.79.2

2.79.2

Bug Fixes

Pull Requests

rollup changelog

2.79.1

Bug Fixes

Pull Requests

2.79.0

Features

Pull Requests

2.78.1

Bug Fixes

Pull Requests

2.78.0

Features

v3.29.5

What's Changed

v3.29.4

⚠️ Security Release ⚠️

v3.29.3

⚠️ Security Release ⚠️

v3.29.2

What's Changed

New Contributors

v3.29.1

What's Changed

New Contributors

v3.29.0

What's Changed

v1.0.2

Unreleased [code, diff]

v2.2.3 [code, diff]

v2.2.2 [code, diff]

v2.2.1 [code, diff]

v2.2.0 [code, diff]

v2.1.3 [code, diff]

v2.1.2 [code, diff]

v1.2.8 - 2023-02-09

Merged

Fixed

Commits

v1.2.7 - 2022-10-10

Commits

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant