Skip to content

Bump the npm_and_yarn group across 12 directories with 22 updates#32

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/compiler/internal/vm/foundation/test/npm_and_yarn-47fc9024b6
Open

Bump the npm_and_yarn group across 12 directories with 22 updates#32
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/compiler/internal/vm/foundation/test/npm_and_yarn-47fc9024b6

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Mar 20, 2026

Bumps the npm_and_yarn group with 15 updates in the /compiler/internal/vm/foundation/test directory:

Package From To
@astrojs/node 9.1.3 9.5.4
@remix-run/node 2.16.8 2.17.2
@remix-run/react 2.10.3 2.17.3
astro 5.5.5 5.15.9
axios 1.6.8 1.13.5
devalue 5.1.1 5.6.4
fastify 5.2.2 5.8.1
hono 4.7.2 4.12.7
jws 4.0.0 4.0.1
lodash 4.17.21 4.17.23
nodemailer 6.9.3 7.0.11
rollup 4.4.1 4.59.0
typeorm 0.3.20 0.3.26
undici 5.20.0 6.24.0
webpack 5.88.0 5.104.1

Bumps the npm_and_yarn group with 3 updates in the /compiler/internal/vm/foundation/test/cli/install/migration/contoso-test directory: minimatch, fastify and next.
Bumps the npm_and_yarn group with 1 update in the /compiler/internal/vm/foundation/test/cli/install/migration/contoso-test/blog directory: next.
Bumps the npm_and_yarn group with 1 update in the /compiler/internal/vm/foundation/test/cli/install/migration/contoso-test/packages/blog directory: next.
Bumps the npm_and_yarn group with 3 updates in the /compiler/internal/vm/foundation/test/integration/vite-build/the-test-app directory: nodemailer, kysely and svelte.
Bumps the npm_and_yarn group with 4 updates in the /compiler/internal/vm/libconsepts/dynamic_bitset/doc directory: js-yaml, minimatch, axios and fast-xml-parser.
Bumps the npm_and_yarn group with 3 updates in the /compiler/internal/vm/libconsepts/msm/doc directory: js-yaml, axios and fast-xml-parser.
Bumps the npm_and_yarn group with 4 updates in the /compiler/internal/vm/libconsepts/openmethod/doc directory: js-yaml, minimatch, axios and fast-xml-parser.
Bumps the npm_and_yarn group with 4 updates in the /compiler/internal/vm/libconsepts/redis/doc directory: js-yaml, minimatch, axios and sha.js.
Bumps the npm_and_yarn group with 2 updates in the /compiler/internal/vm/libconsepts/unordered/doc directory: js-yaml and minimatch.
Bumps the npm_and_yarn group with 4 updates in the /compiler/internal/vm/libconsepts/url/doc directory: js-yaml, minimatch, axios and fast-xml-parser.
Bumps the npm_and_yarn group with 1 update in the /compiler/internal/vm/static_core/plugins/ets/tools/declgen_ts2sts directory: webpack.

Updates @astrojs/node from 9.1.3 to 9.5.4

Changelog

Sourced from @​astrojs/node's changelog.

9.5.4

Patch Changes

  • #15564 522f880 Thanks @​matthewp! - Add a default body size limit for server actions to prevent oversized requests from exhausting memory.

  • #15572 ef851bf Thanks @​matthewp! - Upgrade astro package support

    astro@5.17.3 includes a fix to prevent Action payloads from exhausting memory. @​astrojs/node now depends on this version of Astro as a minimum requirement.

9.5.3

Patch Changes

  • c13b536 Thanks @​matthewp! - Improves error page loading to read from disk first before falling back to configured host

9.5.2

Patch Changes

  • #15196 a8317c1 Thanks @​ematipico! - Fixes an issue where some prendered pages weren't correctly rendered when using the Node.js adapter in middleware mode.

  • #15169 b803d8b Thanks @​rururux! - fix: fix image 500 error when moving dist directory in standalone Node

9.5.1

Patch Changes

9.5.0

Minor Changes

  • #14441 62ec8ea Thanks @​upsuper! - Updates redirect handling to be consistent across static and server output, aligning with the behavior of other adapters.

    Previously, the Node.js adapter used default HTML files with meta refresh tags when in static output. This often resulted in an extra flash of the page on redirect, while also not applying the proper status code for redirections. It's also likely less friendly to search engines.

    This update ensures that configured redirects are always handled as HTTP redirects regardless of output mode, and the default HTML files for the redirects are no longer generated in static output. It makes the Node.js adapter more consistent with the other official adapters.

    No change to your project is required to take advantage of this new adapter functionality. It is not expected to cause any breaking changes. However, if you relied on the previous redirecting behavior, you may need to handle your redirects differently now. Otherwise you should notice smoother redirects, with more accurate HTTP status codes, and may potentially see some SEO gains.

9.4.6

Patch Changes

  • #14514 66a26d7 Thanks @​matthewp! - Fixes compatibility issue with older versions of Astro by making getAllowedDomains() call optional and updating peer dependency to require astro@^5.14.3

9.4.5

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @​astrojs/node since your current version.


Updates @remix-run/node from 2.16.8 to 2.17.2

Release notes

Sourced from @​remix-run/node's releases.

file-storage-s3 v0.1.0

Minor Changes

  • Unreleased

    Initial release of @remix-run/file-storage-s3.

Patch Changes

Commits

Updates @remix-run/react from 2.10.3 to 2.17.3

Release notes

Sourced from @​remix-run/react's releases.

remix v2.17.3

See the changelog for the release notes: https://github.com/remix-run/remix/blob/v2/CHANGELOG.md#v2173

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @​remix-run/react since your current version.


Updates astro from 5.5.5 to 5.15.9

Changelog

Sourced from astro's changelog.

5.15.9

Patch Changes

  • #14786 758a891 Thanks @​mef! - Add handling of invalid encrypted props and slots in server islands.

  • #14783 504958f Thanks @​florian-lefebvre! - Improves the experimental Fonts API build log to show the number of downloaded files. This can help spotting excessive downloading because of misconfiguration

  • #14791 9e9c528 Thanks @​Princesseuh! - Changes the remote protocol checks for images to require explicit authorization in order to use data URIs.

    In order to allow data URIs for remote images, you will need to update your astro.config.mjs file to include the following configuration:

    // astro.config.mjs
import { defineConfig } from 'astro/config';
export default defineConfig({
images: {
remotePatterns: [
{
protocol: 'data',
},
],
},
});

  • #14787 0f75f6b Thanks @​matthewp! - Fixes wildcard hostname pattern matching to correctly reject hostnames without dots

    Previously, hostnames like localhost or other single-part names would incorrectly match patterns like *.example.com. The wildcard matching logic has been corrected to ensure that only valid subdomains matching the pattern are accepted.

  • #14776 3537876 Thanks @​ktym4a! - Fixes the behavior of passthroughImageService so it does not generate webp.

  • Updated dependencies [9e9c528, 0f75f6b]:

    • @​astrojs/internal-helpers@​0.7.5
    • @​astrojs/markdown-remark@​6.3.9

5.15.8

Patch Changes

  • #14772 00c579a Thanks @​matthewp! - Improves the security of Server Islands slots by encrypting them before transmission to the browser, matching the security model used for props. This improves the integrity of slot content and prevents injection attacks, even when component templates don't explicitly support slots.

    Slots continue to work as expected for normal usage—this change has no breaking changes for legitimate requests.

  • #14771 6f80081 Thanks @​matthewp! - Fix middleware pathname matching by normalizing URL-encoded paths

    Middleware now receives normalized pathname values, ensuring that encoded paths like /%61dmin are properly decoded to /admin before middleware checks. This prevents potential security issues where middleware checks might be bypassed through URL encoding.

5.15.7

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for astro since your current version.


Updates axios from 1.6.8 to 1.13.5

Release notes

Sourced from axios's releases.

v1.13.5

Release 1.13.5

Highlights

  • Security: Fixed a potential Denial of Service issue involving the __proto__ key in mergeConfig. (PR #7369)
  • Bug fix: Resolved an issue where AxiosError could be missing the status field on and after v1.13.3. (PR #7368)

Changes

Security

  • Fix Denial of Service via __proto__ key in mergeConfig. (PR #7369)

Fixes

  • Fix/5657. (PR #7313)
  • Ensure status is present in AxiosError on and after v1.13.3. (PR #7368)

Features / Improvements

  • Add input validation to isAbsoluteURL. (PR #7326)
  • Refactor: bump minor package versions. (PR #7356)

Documentation

  • Clarify object-check comment. (PR #7323)
  • Fix deprecated Buffer constructor usage and README formatting. (PR #7371)

CI / Maintenance

  • Chore: fix issues with YAML. (PR #7355)
  • CI: update workflow YAMLs. (PR #7372)
  • CI: fix run condition. (PR #7373)
  • Dev deps: bump karma-sourcemap-loader from 0.3.8 to 0.4.0. (PR #7360)
  • Chore(release): prepare release 1.13.5. (PR #7379)

New Contributors

Full Changelog: axios/axios@v1.13.4...v1.13.5

v1.13.4

Overview

The release addresses issues discovered in v1.13.3 and includes significant CI/CD improvements.

Full Changelog: v1.13.3...v1.13.4

What's New in v1.13.4

Bug Fixes

  • fix: issues with version 1.13.3 (#7352) (ee90dfc)
    • Fixed issues discovered in v1.13.3 release

... (truncated)

Changelog

Sourced from axios's changelog.

Changelog

1.13.3 (2026-01-20)

Bug Fixes

  • http2: Use port 443 for HTTPS connections by default. (#7256) (d7e6065)
  • interceptor: handle the error in the same interceptor (#6269) (5945e40)
  • main field in package.json should correspond to cjs artifacts (#5756) (7373fbf)
  • package.json: add 'bun' package.json 'exports' condition. Load the Node.js build in Bun instead of the browser build (#5754) (b89217e)
  • silentJSONParsing=false should throw on invalid JSON (#7253) (#7257) (7d19335)
  • turn AxiosError into a native error (#5394) (#5558) (1c6a86d)
  • types: add handlers to AxiosInterceptorManager interface (#5551) (8d1271b)
  • types: restore AxiosError.cause type from unknown to Error (#7327) (d8233d9)
  • unclear error message is thrown when specifying an empty proxy authorization (#6314) (6ef867e)

Features

Reverts

  • Revert "fix: silentJSONParsing=false should throw on invalid JSON (#7253) (#7…" (#7298) (a4230f5), closes #7253 #7 #7298
  • deps: bump peter-evans/create-pull-request from 7 to 8 in the github-actions group (#7334) (2d6ad5e)

Contributors to this release

... (truncated)

Commits
  • 29f7542 chore(release): prepare release 1.13.5 (#7379)
  • 431c3a3 ci: fix run condition (#7373)
  • 9ff3a78 ci: update ymls (#7372)
  • 265b712 docs: fix deprecated Buffer constructor and formatting issues in README (#7371)
  • 475e75a feat: add input validation to isAbsoluteURL (#7326)
  • 28c7215 fix: Denial of Service via proto Key in mergeConfig (#7369)
  • 04cf019 docs: clarify object check comment (#7323)
  • 696fa75 fix: status is missing in AxiosError on and after v1.13.3 (#7368)
  • 569f028 fix: added a option to choose between legacy and the new request/response int...
  • 44b7c9f chore(deps-dev): bump karma-sourcemap-loader (#7360)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for axios since your current version.


Updates devalue from 5.1.1 to 5.6.4

Release notes

Sourced from devalue's releases.

v5.6.4

Patch Changes

  • 87c1f3c: fix: reject __proto__ keys in malformed Object wrapper payloads

    This validates the "Object" parse path and throws when the wrapped value has an own __proto__ key.

  • 40f1db1: fix: ensure sparse array indices are integers

  • 87c1f3c: fix: disallow __proto__ keys in null-prototype object parsing

    This disallows __proto__ keys in the "null" parse path so null-prototype object hydration cannot carry that key through parse/unflatten.

v5.6.3

Patch Changes

  • 0f04d4d: fix: Properly handle __proto__
  • 819f1ac: fix: better encoding for sparse arrays

v5.6.2

Patch Changes

  • 1175584: fix: validate input for ArrayBuffer parsing
  • e46afa6: fix: validate input for typed arrays
  • 1175584: fix: more helpful errors for inputs causing stack overflows

v5.6.1

Patch Changes

  • 2161d44: fix: add hasOwn check before calling reviver

v5.6.0

Minor Changes

  • a3d09d4: feat: expose DevalueError for instanceof checks in catch clauses
  • a3d09d4: feat: add value and root properties in DevalueError instances

v5.5.0

Minor Changes

  • 828fa1c: Enable support for custom reducer/reviver for "function" values

v5.4.2

Patch Changes

  • 5c26c0d: fix: allow custom revivers to revive things serialized by builtin reducers

v5.4.1

Patch Changes

... (truncated)

Changelog

Sourced from devalue's changelog.

5.6.4

Patch Changes

  • 87c1f3c: fix: reject __proto__ keys in malformed Object wrapper payloads

    This validates the "Object" parse path and throws when the wrapped value has an own __proto__ key.

  • 40f1db1: fix: ensure sparse array indices are integers

  • 87c1f3c: fix: disallow __proto__ keys in null-prototype object parsing

    This disallows __proto__ keys in the "null" parse path so null-prototype object hydration cannot carry that key through parse/unflatten.

5.6.3

Patch Changes

  • 0f04d4d: fix: Properly handle __proto__
  • 819f1ac: fix: better encoding for sparse arrays

5.6.2

Patch Changes

  • 1175584: fix: validate input for ArrayBuffer parsing
  • e46afa6: fix: validate input for typed arrays
  • 1175584: fix: more helpful errors for inputs causing stack overflows

5.6.1

Patch Changes

  • 2161d44: fix: add hasOwn check before calling reviver

5.6.0

Minor Changes

  • a3d09d4: feat: expose DevalueError for instanceof checks in catch clauses
  • a3d09d4: feat: add value and root properties in DevalueError instances

5.5.0

Minor Changes

  • 828fa1c: Enable support for custom reducer/reviver for "function" values

5.4.2

Patch Changes

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for devalue since your current version.


Updates fastify from 5.2.2 to 5.8.1

Release notes

Sourced from fastify's releases.

v5.8.1

⚠️ Security Release

Fixes "Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validation": GHSA-573f-x89g-hqp9.

CVE-2026-3419

Full Changelog: fastify/fastify@v5.8.0...v5.8.1

v5.8.0

What's Changed

New Contributors

Full Changelog: fastify/fastify@v5.7.4...v5.8.0

... (truncated)

Commits
  • 073ff81 Bumped v5.8.1
  • 67f6c9b Merge commit from fork
  • 161578a chore: sync version
  • 9b06a78 Bumped v5.8.0
  • bbdfe82 style: remove trailing whitespace (#6543)
  • cd58ed4 ci(validate-ecoystem-links): add job level permission (#6545)
  • 2590592 ci: remove broken links and add ecosystem link validator (#6421)
  • 09b55b6 chore: Bump markdownlint-cli2 from 0.20.0 to 0.21.0 (#6542)
  • 43c4e38 chore: Bump actions/dependency-review-action from 4.8.2 to 4.8.3 (#6540)
  • 3b40573 chore: Bump lycheeverse/lychee-action from 2.7.0 to 2.8.0 (#6539)
  • Additional commits viewable in compare view

Updates hono from 4.7.2 to 4.12.7

Release notes

Sourced from hono's releases.

v4.12.7

Security hardening

Ignore __proto__ path segments in parseBody({ dot: true }) to prevent potential prototype pollution when merged with unsafe patterns.

Full Changelog: honojs/hono@v4.12.6...v4.12.7

v4.12.6

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.12.5...v4.12.6

v4.12.5

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.12.4...v4.12.5

v4.12.4

Security fixes

This release includes fixes for the following security issues:

SSE Control Field Injection

Affects: streamSSE() in Streaming Helper. Fixes injection of unintended SSE fields by rejecting CR/LF characters in event, id, and retry. GHSA-p6xx-57qc-3wxr

Cookie Attribute Injection in setCookie()

Affects: setCookie() from hono/cookie. Fixes cookie attribute manipulation by rejecting ;, \r, and \n in domain and path options. GHSA-5pq2-9x2x-5p6w

... (truncated)

Commits

Updates jws from 4.0.0 to 4.0.1

Release notes

Sourced from jws's releases.

v4.0.1

Changed

  • Fix advisory GHSA-869p-cjfg-cm3x: createSign and createVerify now require that a non empty secret is provided (via opts.secret, opts.privateKey or opts.key) when using HMAC algorithms.
  • Upgrading JWA version to 2.0.1, addressing a compatibility issue for Node >= 25.
Details Description has been truncated

@dependabot
Bump the npm_and_yarn group across 12 directories with 22 updates
37565f0 
Bumps the npm_and_yarn group with 15 updates in the /compiler/internal/vm/foundation/test directory:

| Package | From | To |
| --- | --- | --- |
| [@astrojs/node](https://github.com/withastro/astro/tree/HEAD/packages/integrations/node) | `9.1.3` | `9.5.4` |
| [@remix-run/node](https://github.com/remix-run/remix/tree/HEAD/packages/remix-node) | `2.16.8` | `2.17.2` |
| [@remix-run/react](https://github.com/remix-run/remix/tree/HEAD/packages/remix-react) | `2.10.3` | `2.17.3` |
| [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `5.5.5` | `5.15.9` |
| [axios](https://github.com/axios/axios) | `1.6.8` | `1.13.5` |
| [devalue](https://github.com/sveltejs/devalue) | `5.1.1` | `5.6.4` |
| [fastify](https://github.com/fastify/fastify) | `5.2.2` | `5.8.1` |
| [hono](https://github.com/honojs/hono) | `4.7.2` | `4.12.7` |
| [jws](https://github.com/brianloveswords/node-jws) | `4.0.0` | `4.0.1` |
| [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.17.23` |
| [nodemailer](https://github.com/nodemailer/nodemailer) | `6.9.3` | `7.0.11` |
| [rollup](https://github.com/rollup/rollup) | `4.4.1` | `4.59.0` |
| [typeorm](https://github.com/typeorm/typeorm) | `0.3.20` | `0.3.26` |
| [undici](https://github.com/nodejs/undici) | `5.20.0` | `6.24.0` |
| [webpack](https://github.com/webpack/webpack) | `5.88.0` | `5.104.1` |

Bumps the npm_and_yarn group with 3 updates in the /compiler/internal/vm/foundation/test/cli/install/migration/contoso-test directory: [minimatch](https://github.com/isaacs/minimatch), [fastify](https://github.com/fastify/fastify) and [next](https://github.com/vercel/next.js).
Bumps the npm_and_yarn group with 1 update in the /compiler/internal/vm/foundation/test/cli/install/migration/contoso-test/blog directory: [next](https://github.com/vercel/next.js).
Bumps the npm_and_yarn group with 1 update in the /compiler/internal/vm/foundation/test/cli/install/migration/contoso-test/packages/blog directory: [next](https://github.com/vercel/next.js).
Bumps the npm_and_yarn group with 3 updates in the /compiler/internal/vm/foundation/test/integration/vite-build/the-test-app directory: [nodemailer](https://github.com/nodemailer/nodemailer), [kysely](https://github.com/kysely-org/kysely) and [svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte).
Bumps the npm_and_yarn group with 4 updates in the /compiler/internal/vm/libconsepts/dynamic_bitset/doc directory: [js-yaml](https://github.com/nodeca/js-yaml), [minimatch](https://github.com/isaacs/minimatch), [axios](https://github.com/axios/axios) and [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser).
Bumps the npm_and_yarn group with 3 updates in the /compiler/internal/vm/libconsepts/msm/doc directory: [js-yaml](https://github.com/nodeca/js-yaml), [axios](https://github.com/axios/axios) and [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser).
Bumps the npm_and_yarn group with 4 updates in the /compiler/internal/vm/libconsepts/openmethod/doc directory: [js-yaml](https://github.com/nodeca/js-yaml), [minimatch](https://github.com/isaacs/minimatch), [axios](https://github.com/axios/axios) and [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser).
Bumps the npm_and_yarn group with 4 updates in the /compiler/internal/vm/libconsepts/redis/doc directory: [js-yaml](https://github.com/nodeca/js-yaml), [minimatch](https://github.com/isaacs/minimatch), [axios](https://github.com/axios/axios) and [sha.js](https://github.com/crypto-browserify/sha.js).
Bumps the npm_and_yarn group with 2 updates in the /compiler/internal/vm/libconsepts/unordered/doc directory: [js-yaml](https://github.com/nodeca/js-yaml) and [minimatch](https://github.com/isaacs/minimatch).
Bumps the npm_and_yarn group with 4 updates in the /compiler/internal/vm/libconsepts/url/doc directory: [js-yaml](https://github.com/nodeca/js-yaml), [minimatch](https://github.com/isaacs/minimatch), [axios](https://github.com/axios/axios) and [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser).
Bumps the npm_and_yarn group with 1 update in the /compiler/internal/vm/static_core/plugins/ets/tools/declgen_ts2sts directory: [webpack](https://github.com/webpack/webpack).


Updates `@astrojs/node` from 9.1.3 to 9.5.4
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/@astrojs/node@9.5.4/packages/integrations/node/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/node@9.5.4/packages/integrations/node)

Updates `@remix-run/node` from 2.16.8 to 2.17.2
- [Release notes](https://github.com/remix-run/remix/releases)
- [Commits](https://github.com/remix-run/remix/commits/remix@2.17.2/packages/remix-node)

Updates `@remix-run/react` from 2.10.3 to 2.17.3
- [Release notes](https://github.com/remix-run/remix/releases)
- [Commits](https://github.com/remix-run/remix/commits/remix@2.17.3/packages/remix-react)

Updates `astro` from 5.5.5 to 5.15.9
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@5.15.9/packages/astro)

Updates `axios` from 1.6.8 to 1.13.5
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.6.8...v1.13.5)

Updates `devalue` from 5.1.1 to 5.6.4
- [Release notes](https://github.com/sveltejs/devalue/releases)
- [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md)
- [Commits](sveltejs/devalue@v5.1.1...v5.6.4)

Updates `fastify` from 5.2.2 to 5.8.1
- [Release notes](https://github.com/fastify/fastify/releases)
- [Commits](fastify/fastify@v5.2.2...v5.8.1)

Updates `hono` from 4.7.2 to 4.12.7
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.7.2...v4.12.7)

Updates `jws` from 4.0.0 to 4.0.1
- [Release notes](https://github.com/brianloveswords/node-jws/releases)
- [Changelog](https://github.com/auth0/node-jws/blob/master/CHANGELOG.md)
- [Commits](auth0/node-jws@v4.0.0...v4.0.1)

Updates `lodash` from 4.17.21 to 4.17.23
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.17.23)

Updates `nodemailer` from 6.9.3 to 7.0.11
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](nodemailer/nodemailer@v6.9.3...v7.0.11)

Updates `rollup` from 4.4.1 to 4.59.0
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.4.1...v4.59.0)

Updates `typeorm` from 0.3.20 to 0.3.26
- [Release notes](https://github.com/typeorm/typeorm/releases)
- [Changelog](https://github.com/typeorm/typeorm/blob/master/CHANGELOG.md)
- [Commits](typeorm/typeorm@0.3.20...0.3.26)

Updates `undici` from 5.20.0 to 6.24.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v5.20.0...v6.24.0)

Updates `webpack` from 5.88.0 to 5.104.1
- [Release notes](https://github.com/webpack/webpack/releases)
- [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md)
- [Commits](webpack/webpack@v5.88.0...v5.104.1)

Updates `minimatch` from 8.0.4 to 8.0.7
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v8.0.4...v8.0.7)

Updates `fastify` from 4.23.2 to 5.8.1
- [Release notes](https://github.com/fastify/fastify/releases)
- [Commits](fastify/fastify@v5.2.2...v5.8.1)

Updates `next` from 13.5.3 to 15.5.14
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v13.5.3...v15.5.14)

Updates `next` from 13.5.11 to 16.2.0
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v13.5.3...v15.5.14)

Updates `next` from 13.5.11 to 16.2.0
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v13.5.3...v15.5.14)

Updates `nodemailer` from 6.10.1 to 8.0.3
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](nodemailer/nodemailer@v6.9.3...v7.0.11)

Updates `kysely` from 0.27.6 to 0.28.14
- [Release notes](https://github.com/kysely-org/kysely/releases)
- [Commits](kysely-org/kysely@0.27.6...v0.28.14)

Updates `svelte` from 4.2.20 to 5.54.0
- [Release notes](https://github.com/sveltejs/svelte/releases)
- [Changelog](https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG.md)
- [Commits](https://github.com/sveltejs/svelte/commits/svelte@5.54.0/packages/svelte)

Updates `js-yaml` from 4.1.0 to 4.1.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.1.1)

Updates `minimatch` from 3.1.2 to 3.1.5
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v8.0.4...v8.0.7)

Updates `axios` from 1.12.2 to 1.13.6
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.6.8...v1.13.5)

Updates `fast-xml-parser` from 4.5.3 to 5.5.8
- [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases)
- [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md)
- [Commits](NaturalIntelligence/fast-xml-parser@v4.5.3...v5.5.8)

Updates `js-yaml` from 4.1.0 to 4.1.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.1.1)

Updates `axios` from 1.13.1 to 1.13.6
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.6.8...v1.13.5)

Updates `fast-xml-parser` from 4.4.1 to 5.5.8
- [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases)
- [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md)
- [Commits](NaturalIntelligence/fast-xml-parser@v4.5.3...v5.5.8)

Updates `js-yaml` from 4.1.0 to 4.1.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.1.1)

Updates `minimatch` from 3.1.2 to 3.1.5
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v8.0.4...v8.0.7)

Updates `axios` from 1.13.2 to 1.13.6
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.6.8...v1.13.5)

Updates `fast-xml-parser` from 5.3.2 to 5.5.8
- [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases)
- [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md)
- [Commits](NaturalIntelligence/fast-xml-parser@v4.5.3...v5.5.8)

Updates `js-yaml` from 4.1.0 to 4.1.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.1.1)

Updates `minimatch` from 3.1.2 to 3.1.5
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v8.0.4...v8.0.7)

Updates `axios` from 1.10.0 to 1.13.6
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.6.8...v1.13.5)

Updates `sha.js` from 2.4.11 to 2.4.12
- [Changelog](https://github.com/browserify/sha.js/blob/master/CHANGELOG.md)
- [Commits](browserify/sha.js@v2.4.11...v2.4.12)

Updates `js-yaml` from 4.1.0 to 4.1.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.1.1)

Updates `minimatch` from 3.1.2 to 3.1.5
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v8.0.4...v8.0.7)

Updates `js-yaml` from 4.1.0 to 4.1.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.1.1)

Updates `minimatch` from 3.1.2 to 3.1.5
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v8.0.4...v8.0.7)

Updates `axios` from 1.12.2 to 1.13.6
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.6.8...v1.13.5)

Updates `fast-xml-parser` from 4.5.3 to 5.5.8
- [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases)
- [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md)
- [Commits](NaturalIntelligence/fast-xml-parser@v4.5.3...v5.5.8)

Updates `webpack` from 5.72.1 to 5.104.1
- [Release notes](https://github.com/webpack/webpack/releases)
- [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md)
- [Commits](webpack/webpack@v5.88.0...v5.104.1)

---
updated-dependencies:
- dependency-name: "@astrojs/node"
  dependency-version: 9.5.4
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@remix-run/node"
  dependency-version: 2.17.2
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@remix-run/react"
  dependency-version: 2.17.3
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: astro
  dependency-version: 5.15.9
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: axios
  dependency-version: 1.13.5
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: devalue
  dependency-version: 5.6.4
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: fastify
  dependency-version: 5.8.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: hono
  dependency-version: 4.12.7
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: jws
  dependency-version: 4.0.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: lodash
  dependency-version: 4.17.23
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: nodemailer
  dependency-version: 7.0.11
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: rollup
  dependency-version: 4.59.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: typeorm
  dependency-version: 0.3.26
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 6.24.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: webpack
  dependency-version: 5.104.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: minimatch
  dependency-version: 8.0.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fastify
  dependency-version: 5.8.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: next
  dependency-version: 15.5.14
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: next
  dependency-version: 16.2.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: next
  dependency-version: 16.2.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: nodemailer
  dependency-version: 8.0.3
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: kysely
  dependency-version: 0.28.14
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: svelte
  dependency-version: 5.54.0
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 4.1.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: minimatch
  dependency-version: 3.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: axios
  dependency-version: 1.13.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fast-xml-parser
  dependency-version: 5.5.8
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 4.1.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: axios
  dependency-version: 1.13.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fast-xml-parser
  dependency-version: 5.5.8
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 4.1.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: minimatch
  dependency-version: 3.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: axios
  dependency-version: 1.13.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fast-xml-parser
  dependency-version: 5.5.8
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 4.1.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: minimatch
  dependency-version: 3.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: axios
  dependency-version: 1.13.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: sha.js
  dependency-version: 2.4.12
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 4.1.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: minimatch
  dependency-version: 3.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 4.1.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: minimatch
  dependency-version: 3.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: axios
  dependency-version: 1.13.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fast-xml-parser
  dependency-version: 5.5.8
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: webpack
  dependency-version: 5.104.1
  dependency-type: direct:development
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Mar 20, 2026
@dependabot dependabot bot mentioned this pull request Mar 20, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants