Skip to content

chore(deps): bump the npm_and_yarn group across 1 directory with 14 updates#308

Closed
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm_and_yarn-e1a4704ffc
Closed

chore(deps): bump the npm_and_yarn group across 1 directory with 14 updates#308
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm_and_yarn-e1a4704ffc

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jan 12, 2026 •
edited
Loading

Bumps the npm_and_yarn group with 11 updates in the / directory:

Package From To
storybook 7.6.16 7.6.21
vite 5.4.0 5.4.21
braces 3.0.2 3.0.3
ejs 3.1.9 3.1.10
express 4.18.2 4.22.1
js-yaml 3.14.1 3.14.2
markdown-to-jsx 7.3.2 7.7.17
rollup 3.28.0 3.29.5
store2 2.14.2 2.14.4
tar-fs 2.1.1 2.1.4
ws 6.2.2 6.2.3

Updates storybook from 7.6.16 to 7.6.21

Release notes

Sourced from storybook's releases.

v7.6.21

7.6.21

Changelog

Sourced from storybook's changelog.

10.1.11

10.1.10

10.1.9

10.1.8

10.1.7

10.1.6

  • Manager: Do not display non-existing shortcuts in the settings page - #32711, thanks @​DKER2!
  • Preview: Enforce inert body if manager is focus-trapped - #33186, thanks @​Sidnioulz!
  • Telemetry: Await pending operations in getLastEvents to prevent race conditions - #33285, thanks @​valentinpalkovic!
  • UI: Fix keyboard navigation bug for "reset" option in Select - #33268, thanks @​Sidnioulz!

10.1.5

10.1.4

10.1.3

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by storybook-bot, a new releaser for storybook since your current version.


Updates vite from 5.4.0 to 5.4.21

Release notes

Sourced from vite's releases.

v5.4.21

Please refer to CHANGELOG.md for details.

v5.4.20

Please refer to CHANGELOG.md for details.

v5.4.19

Please refer to CHANGELOG.md for details.

v5.4.18

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

5.4.21 (2025-10-20)

5.4.20 (2025-09-08)

5.4.19 (2025-04-30)

5.4.18 (2025-04-10)

5.4.17 (2025-04-03)

5.4.16 (2025-03-31)

5.4.15 (2025-03-24)

5.4.14 (2025-01-21)

... (truncated)

Commits

Updates braces from 3.0.2 to 3.0.3

Commits

Updates ejs from 3.1.9 to 3.1.10

Release notes

Sourced from ejs's releases.

v3.1.10

Version 3.1.10

Commits

Updates express from 4.18.2 to 4.22.1

Release notes

Sourced from express's releases.

v4.22.1

What's Changed

[!IMPORTANT]
The prior release (4.22.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

Full Changelog: expressjs/express@4.22.0...v4.22.1

4.22.0

Important: Security

What's Changed

Full Changelog: expressjs/express@4.21.2...4.22.0

4.21.2

What's Changed

Full Changelog: expressjs/express@4.21.1...4.21.2

4.21.1

What's Changed

Full Changelog: expressjs/express@4.21.0...4.21.1

... (truncated)

Changelog

Sourced from express's changelog.

4.22.1 / 2025-12-01

4.22.0 / 2025-12-01

4.21.2 / 2024-11-06

  • deps: path-to-regexp@0.1.12
    • Fix backtracking protection
  • deps: path-to-regexp@0.1.11
    • Throws an error on invalid path values

4.21.1 / 2024-10-08

4.21.0 / 2024-09-11

  • Deprecate res.location("back") and res.redirect("back") magic string
  • deps: serve-static@1.16.2
    • includes send@0.19.0
  • deps: finalhandler@1.3.1
  • deps: qs@6.13.0

4.20.0 / 2024-09-10

  • deps: serve-static@0.16.0
    • Remove link renderization in html while redirecting
  • deps: send@0.19.0
    • Remove link renderization in html while redirecting
  • deps: body-parser@0.6.0
    • add depth option to customize the depth level in the parser
    • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)
  • Remove link renderization in html while using res.redirect
  • deps: path-to-regexp@0.1.10
    • Adds support for named matching groups in the routes using a regex
    • Adds backtracking protection to parameters without regexes defined
  • deps: encodeurl@~2.0.0
    • Removes encoding of \, |, and ^ to align better with URL spec
  • Deprecate passing options.maxAge and options.expires to res.clearCookie

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by jonchurch, a new releaser for express since your current version.


Updates js-yaml from 3.14.1 to 3.14.2

Changelog

Sourced from js-yaml's changelog.

[3.14.2] - 2025-11-15

Security

  • Backported v4.1.1 fix to v3

[4.1.1] - 2025-11-12

Security

  • Fix prototype pollution issue in yaml merge (<<) operator.

[4.1.0] - 2021-04-15

Added

  • Types are now exported as yaml.types.XXX.
  • Every type now has options property with original arguments kept as they were (see yaml.types.int.options as an example).

Changed

  • Schema.extend() now keeps old type order in case of conflicts (e.g. Schema.extend([ a, b, c ]).extend([ b, a, d ]) is now ordered as abcd instead of cbad).

[4.0.0] - 2021-01-03

Changed

  • Check migration guide to see details for all breaking changes.
  • Breaking: "unsafe" tags !!js/function, !!js/regexp, !!js/undefined are moved to js-yaml-js-types package.
  • Breaking: removed safe* functions. Use load, loadAll, dump instead which are all now safe by default.
  • yaml.DEFAULT_SAFE_SCHEMA and yaml.DEFAULT_FULL_SCHEMA are removed, use yaml.DEFAULT_SCHEMA instead.
  • yaml.Schema.create(schema, tags) is removed, use schema.extend(tags) instead.
  • !!binary now always mapped to Uint8Array on load.
  • Reduced nesting of /lib folder.
  • Parse numbers according to YAML 1.2 instead of YAML 1.1 (01234 is now decimal, 0o1234 is octal, 1:23 is parsed as string instead of base60).
  • dump() no longer quotes :, [, ], (, ) except when necessary, #470, #557.
  • Line and column in exceptions are now formatted as (X:Y) instead of at line X, column Y (also present in compact format), #332.
  • Code snippet created in exceptions now contains multiple lines with line numbers.
  • dump() now serializes undefined as null in collections and removes keys with undefined in mappings, #571.
  • dump() with skipInvalid=true now serializes invalid items in collections as null.
  • Custom tags starting with ! are now dumped as !tag instead of !<!tag>, #576.
  • Custom tags starting with tag:yaml.org,2002: are now shorthanded using !!, #258.

Added

  • Added .mjs (es modules) support.
  • Added quotingType and forceQuotes options for dumper to configure string literal style, #290, #529.
  • Added styles: { '!!null': 'empty' } option for dumper (serializes { foo: null } as "foo: "), #570.

... (truncated)

Commits

Updates markdown-to-jsx from 7.3.2 to 7.7.17

Release notes

Sourced from markdown-to-jsx's releases.

v7.7.17

Patch Changes

  • acc11ad: Fix null children crashing app in production

    When null is passed as children to the <Markdown> component, it would previously crash the app in production. This fix handles this case by converting it to empty string.

    Usage Example

    Before this fix, the following code would crash in production:

    <Markdown>{null}</Markdown>

    After this fix, this case is handled gracefully and renders nothing.

v7.7.16

Patch Changes

  • 7e487bd: Fix the issue where YAML frontmatter in code blocks doesn't render properly.

    This is done by lowering the parsing priority of Setext headings to match ATX headings; both are now prioritized lower than code blocks.

v7.7.15

Patch Changes

  • 8e4c270: Mark react as an optional peer dependency as when passing createElement, you don't need React

v7.7.14

+--------------------------+------------------------+-----------------------+
|                          │ simple markdown string │ large markdown string |
+--------------------------+------------------------+-----------------------+
| markdown-to-jsx (next)   │ 107,013 ops/sec        │ 709 ops/sec           |
+--------------------------+------------------------+-----------------------+
| markdown-to-jsx (7.7.13) │ 102,934 ops/sec        │ 396 ops/sec           |
+--------------------------+------------------------+-----------------------+

Patch Changes

  • 73d4398: Cut down on unnecessary matching operations by improving qualifiers. Also improved the matching speed of paragraphs, which led to a roughly 2x boost in throughput for larger input strings.

v7.7.13

Patch Changes

  • da003e4: Fix exponential backtracking issue for unpaired inline delimiter sequences.

v7.7.12

... (truncated)

Changelog

Sourced from markdown-to-jsx's changelog.

7.7.17

Patch Changes

  • acc11ad: Fix null children crashing app in production

    When null is passed as children to the <Markdown> component, it would previously crash the app in production. This fix handles this case by converting it to empty string.

    Usage Example

    Before this fix, the following code would crash in production:

    <Markdown>{null}</Markdown>

    After this fix, this case is handled gracefully and renders nothing.

7.7.16

Patch Changes

  • 7e487bd: Fix the issue where YAML frontmatter in code blocks doesn't render properly.

    This is done by lowering the parsing priority of Setext headings to match ATX headings; both are now prioritized lower than code blocks.

7.7.15

Patch Changes

  • 8e4c270: Mark react as an optional peer dependency as when passing createElement, you don't need React

7.7.14

Patch Changes

  • 73d4398: Cut down on unnecessary matching operations by improving qualifiers. Also improved the matching speed of paragraphs, which led to a roughly 2x boost in throughput for larger input strings.

7.7.13

Patch Changes

  • da003e4: Fix exponential backtracking issue for unpaired inline delimiter sequences.

7.7.12

Patch Changes

  • 4351ef5: Adjust text parsing to not split on double spaces unless followed by a newline.
  • 4351ef5: Special case detection of :shortcode: so the text processor doesn't break it into chunks, enables shortcode replacement via renderRule.

... (truncated)

Commits

Updates qs from 6.11.0 to 6.11.2

Changelog

Sourced from qs's changelog.

6.11.2

  • [Fix] parse: Fix parsing when the global Object prototype is frozen (#473)
  • [Tests] add passing test cases with empty keys (#473)

6.11.1

  • [Fix] stringify: encode comma values more consistently (#463)
  • [readme] add usage of filter option for injecting custom serialization, i.e. of custom types (#447)
  • [meta] remove extraneous code backticks (#457)
  • [meta] fix changelog markdown
  • [actions] update checkout action
  • [actions] restrict action permissions
  • [Dev Deps] update @ljharb/eslint-config, aud, object-inspect, tape
Commits
  • 410bdd3 v6.11.2
  • a5609c7 [Tests] add passing test cases with empty keys
  • 7895b94 [Fix] parse: Fix parsing when the global Object prototype is frozen
  • 9dca37f v6.11.1
  • 4c4b23d [Fix] stringify: encode comma values more consistently
  • 1778ed4 [Dev Deps] update @ljharb/eslint-config, object-inspect, tape
  • 20820fa [Dev Deps] update aud
  • 2048fa5 [meta] remove extraneous code backticks
  • 7e937fa [actions] update checkout action
  • 6ce7665 [Dev Deps] update aud, tape
  • Additional commits viewable in compare view

Updates rollup from 3.28.0 to 3.29.5

Release notes

Sourced from rollup's releases.

v3.29.5

3.29.5

2024-09-21

Bug Fixes

  • Fix a vulnerability in generated code that affects IIFE, UMD and CJS bundles when run in a browser context (#5671)

Pull Requests

Changelog

Sourced from rollup's changelog.

rollup changelog

3.29.4

2023-09-28

Bug Fixes

  • Fix static analysis when an exported function uses callbacks (#5158)

Pull Requests

3.29.3

2023-09-24

Bug Fixes

  • Fix a bug where code was wrongly tree-shaken after mutating function parameters (#5153)

Pull Requests

  • #5145: docs: improve the docs repl appearance in the light mode ( @​TrickyPi)
  • #5148: chore(deps): update dependency @​vue/eslint-config-typescript to v12 (@​renovate[bot])
  • #5149: chore(deps): lock file maintenance minor/patch updates ( @​renovate[bot])
  • #5153: Fully deoptimize first level path when deoptimizing nested parameter paths (@​lukastaegert)

3.29.2

2023-09-15

Bug Fixes

  • Export TreeshakingPreset type (#5131)

Pull Requests

3.29.1

2023-09-10

Bug Fixes

  • Fix time measurement of plugin hooks in watch mode (#5114)

... (truncated)

Commits
  • dfd233d 3.29.5
  • 2ef77c0 Fix DOM Clobbering CVE
  • a6448b9 3.29.4
  • 4e92d60 Deoptimize all parameters when losing track of a function (#5158)
  • 801ffd1 3.29.3
  • 353e462 Fully deoptimize first level path when deoptimizing nested parameter paths (#...
  • a1a89e7 chore(deps): update dependency @​vue/eslint-config-typescript to v12 (#5148)
  • cc14f70 chore(deps): lock file maintenance minor/patch updates (#5149)
  • 1e8355b docs: improve the docs repl appearance in the light mode (#5145)
  • 5950fc8 Adapt branches in REPL workflow
  • Additional commits viewable in compare view

Updates send from 0.18.0 to 0.19.2

Release notes

Sourced from send's releases.

0.19.2

What's Changed

Full Changelog: pillarjs/send@0.19.1...0.19.2

0.19.1

What's Changed

Full Changelog: pillarjs/send@0.19.0...0.19.1

0.19.0

What's Changed

New Contributors

Full Changelog: pillarjs/send@0.18.0...0.19.0

Changelog

Sourced from send's changelog.

0.19.2 / 2025-12-15

  • deps: use tilde notation for dependencies
  • deps: http-errors@~2.0.1
  • deps: statuses@~2.0.2

0.19.1 / 2024-10-09

  • deps: encodeurl@~2.0.0

0.19.0 / 2024-09-10

  • Remove link renderization in html while redirecting
Commits
Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for send since your current version.


Updates serve-static from 1.15.0 to 1.16.3

Release notes

Sourced from serve-static's releases.

v1.16.3

What's Changed

Full Changelog: expressjs/serve-static@v1.16.2...v1.16.3

v1.16.2

What's Changed

Full Changelog: expressjs/serve-static@v1.16.1...v1.16.2

v1.16.1

What's Changed

New Contributors

Full Changelog: expressjs/serve-static@1.16.0...v1.16.1

1.16.0

What's Changed

New Contributors

Full Changelog: expressjs/serve-static@v1.15.0...1.16.0

Changelog

Sourced from serve-static's changelog.

1.16.3 / 2024-12-15

  • deps: send@~0.19.1
    • deps: encodeurl@~2.0.0

1.16.2 / 2024-09-11

  • deps: encodeurl@~2.0.0

1.16.1 / 2024-09-11

  • deps: send@0.19.0

1.16.0 / 2024-09-10

  • Remove link renderization in html while redirecting
Commits
Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for serve-static since your current version.


Updates store2 from 2.14.2 to 2.14.4

Commits

Updates tar-fs from 2.1.1 to 2.1.4

Commits

Updates ws from 6.2.2 to 6.2.3

Release notes

Sourced from ws's releases.

6.2.3

Bug fixes

  • Backported e55e5106 to the 6.x release line (eeb76d31).
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
Description has been truncated

@dependabot dependabot bot added dependencies Dependabot identified a package with a vulnerability javascript Pull requests that update javascript code labels Jan 12, 2026
@jsos3-cms jsos3-cms requested a review from danielbowne January 14, 2026 20:28
@dependabot
chore(deps): bump the npm_and_yarn group across 1 directory with 14 u…
365283f 
…pdates

Bumps the npm_and_yarn group with 11 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [storybook](https://github.com/storybookjs/storybook/tree/HEAD/code/core) | `7.6.16` | `7.6.21` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `5.4.0` | `5.4.21` |
| [braces](https://github.com/micromatch/braces) | `3.0.2` | `3.0.3` |
| [ejs](https://github.com/mde/ejs) | `3.1.9` | `3.1.10` |
| [express](https://github.com/expressjs/express) | `4.18.2` | `4.22.1` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `3.14.1` | `3.14.2` |
| [markdown-to-jsx](https://github.com/quantizor/markdown-to-jsx) | `7.3.2` | `7.7.17` |
| [rollup](https://github.com/rollup/rollup) | `3.28.0` | `3.29.5` |
| [store2](https://github.com/nbubna/store) | `2.14.2` | `2.14.4` |
| [tar-fs](https://github.com/mafintosh/tar-fs) | `2.1.1` | `2.1.4` |
| [ws](https://github.com/websockets/ws) | `6.2.2` | `6.2.3` |



Updates `storybook` from 7.6.16 to 7.6.21
- [Release notes](https://github.com/storybookjs/storybook/releases)
- [Changelog](https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md)
- [Commits](https://github.com/storybookjs/storybook/commits/v7.6.21/code/core)

Updates `vite` from 5.4.0 to 5.4.21
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v5.4.21/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v5.4.21/packages/vite)

Updates `braces` from 3.0.2 to 3.0.3
- [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md)
- [Commits](micromatch/braces@3.0.2...3.0.3)

Updates `ejs` from 3.1.9 to 3.1.10
- [Release notes](https://github.com/mde/ejs/releases)
- [Commits](mde/ejs@v3.1.9...v3.1.10)

Updates `express` from 4.18.2 to 4.22.1
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/v4.22.1/History.md)
- [Commits](expressjs/express@4.18.2...v4.22.1)

Updates `js-yaml` from 3.14.1 to 3.14.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@3.14.1...3.14.2)

Updates `markdown-to-jsx` from 7.3.2 to 7.7.17
- [Release notes](https://github.com/quantizor/markdown-to-jsx/releases)
- [Changelog](https://github.com/quantizor/markdown-to-jsx/blob/main/CHANGELOG.md)
- [Commits](quantizor/markdown-to-jsx@v7.3.2...v7.7.17)

Updates `qs` from 6.11.0 to 6.11.2
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.11.0...v6.11.2)

Updates `rollup` from 3.28.0 to 3.29.5
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG-3.md)
- [Commits](rollup/rollup@v3.28.0...v3.29.5)

Updates `send` from 0.18.0 to 0.19.2
- [Release notes](https://github.com/pillarjs/send/releases)
- [Changelog](https://github.com/pillarjs/send/blob/master/HISTORY.md)
- [Commits](pillarjs/send@0.18.0...0.19.2)

Updates `serve-static` from 1.15.0 to 1.16.3
- [Release notes](https://github.com/expressjs/serve-static/releases)
- [Changelog](https://github.com/expressjs/serve-static/blob/master/HISTORY.md)
- [Commits](expressjs/serve-static@v1.15.0...v1.16.3)

Updates `store2` from 2.14.2 to 2.14.4
- [Commits](nbubna/store@2.14.2...2.14.4)

Updates `tar-fs` from 2.1.1 to 2.1.4
- [Commits](mafintosh/tar-fs@v2.1.1...v2.1.4)

Updates `ws` from 6.2.2 to 6.2.3
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@6.2.2...6.2.3)

---
updated-dependencies:
- dependency-name: storybook
  dependency-version: 7.6.21
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 5.4.21
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: braces
  dependency-version: 3.0.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ejs
  dependency-version: 3.1.10
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: express
  dependency-version: 4.22.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 3.14.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: markdown-to-jsx
  dependency-version: 7.7.17
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.11.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: rollup
  dependency-version: 3.29.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: send
  dependency-version: 0.19.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: serve-static
  dependency-version: 1.16.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: store2
  dependency-version: 2.14.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: tar-fs
  dependency-version: 2.1.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-version: 6.2.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/npm_and_yarn-e1a4704ffc branch from e1d7795 to 365283f Compare January 27, 2026 15:48
@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Jan 27, 2026

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot bot closed this Jan 27, 2026
@dependabot dependabot bot deleted the dependabot/npm_and_yarn/npm_and_yarn-e1a4704ffc branch January 27, 2026 15:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@danielbowne danielbowne Awaiting requested review from danielbowne

Assignees

No one assigned

Labels

dependencies Dependabot identified a package with a vulnerability javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants