Bump the npm_and_yarn group across 1 directory with 6 updates by dependabot[bot] · Pull Request #293 · Type-Style/LOREX

dependabot · 2025-12-26T18:37:26Z

Bumps the npm_and_yarn group with 6 updates in the / directory:

Package	From	To
vite	`6.3.6`	`6.4.1`
js-yaml	`3.14.1`	`3.14.2`
glob	`10.4.5`	`10.5.0`
body-parser	`2.2.0`	`2.2.1`
jws	`3.2.2`	`3.2.3`
validator	`13.15.20`	`13.15.26`

Updates vite from 6.3.6 to 6.4.1

Release notes

Sourced from vite's releases.

create-vite@6.4.1

Please refer to CHANGELOG.md for details.

v6.4.1

Please refer to CHANGELOG.md for details.

create-vite@6.4.0

Please refer to CHANGELOG.md for details.

v6.4.0

Please refer to CHANGELOG.md for details.

v6.3.7

Please refer to CHANGELOG.md for details.

Commits

5003434 fix(preview): use host url to open browser (#19836)
bf9728e release: v6.3.0-beta.2
380c10e fix(hmr): run HMR handler sequentially (#19793)
8bed1de fix: addWatchFile doesn't work if base is specified (fixes #19792) (#19794)
0a0c50a refactor: simplify pluginFilter implementation (#19828)
59d0b35 perf(css): avoid constructing renderedModules (#19775)
175a839 fix: reject requests with # in request-target (#19830)
e2e11b1 fix(module-runner): allow already resolved id as entry (#19768)
7200dee fix: correct the behavior when multiple transform filter options are specifie...
b125172 fix(css): remove empty chunk imports correctly when chunk file name contained...
Additional commits viewable in compare view

Updates js-yaml from 3.14.1 to 3.14.2

Changelog

Sourced from js-yaml's changelog.

[3.14.2] - 2025-11-15

Security

Backported v4.1.1 fix to v3

[4.1.1] - 2025-11-12

Security

Fix prototype pollution issue in yaml merge (<<) operator.

[4.1.0] - 2021-04-15

Added

Types are now exported as yaml.types.XXX.

Every type now has options property with original arguments kept as they were (see yaml.types.int.options as an example).

Changed

Schema.extend() now keeps old type order in case of conflicts (e.g. Schema.extend([ a, b, c ]).extend([ b, a, d ]) is now ordered as abcd instead of cbad).

[4.0.0] - 2021-01-03

Changed

Check migration guide to see details for all breaking changes.

Breaking: "unsafe" tags !!js/function, !!js/regexp, !!js/undefined are moved to js-yaml-js-types package.

Breaking: removed safe* functions. Use load, loadAll, dump instead which are all now safe by default.

yaml.DEFAULT_SAFE_SCHEMA and yaml.DEFAULT_FULL_SCHEMA are removed, use yaml.DEFAULT_SCHEMA instead.

yaml.Schema.create(schema, tags) is removed, use schema.extend(tags) instead.

!!binary now always mapped to Uint8Array on load.

Reduced nesting of /lib folder.

Parse numbers according to YAML 1.2 instead of YAML 1.1 (01234 is now decimal, 0o1234 is octal, 1:23 is parsed as string instead of base60).

dump() no longer quotes :, [, ], (, ) except when necessary, #470, #557.

Line and column in exceptions are now formatted as (X:Y) instead of at line X, column Y (also present in compact format), #332.

Code snippet created in exceptions now contains multiple lines with line numbers.

dump() now serializes undefined as null in collections and removes keys with undefined in mappings, #571.

dump() with skipInvalid=true now serializes invalid items in collections as null.

Custom tags starting with ! are now dumped as !tag instead of !<!tag>, #576.

Custom tags starting with tag:yaml.org,2002: are now shorthanded using !!, #258.

Added

Added .mjs (es modules) support.

Added quotingType and forceQuotes options for dumper to configure string literal style, #290, #529.

Added styles: { '!!null': 'empty' } option for dumper (serializes { foo: null } as "foo: "), #570.

... (truncated)

Commits

9963d36 3.14.2 released
10d3c8e dist rebuild
5278870 fix prototype pollution in merge (<<) (#731)
See full diff in compare view

Updates glob from 10.4.5 to 10.5.0

Commits

56774ef 10.5.0
1e4e297 bin: Do not expose filenames to shell expansion
See full diff in compare view

Updates body-parser from 2.2.0 to 2.2.1

Release notes

Sourced from body-parser's releases.

v2.2.1

Important: Security

Security fix for CVE-2025-13466 (GHSA-wqch-xfxh-vrr4)

What's Changed

ci: add dependabot by @Phillip9587 in expressjs/body-parser#593

ci: use full SHAs for github action versions by @Phillip9587 in expressjs/body-parser#594

deps: type-is@^2.0.1 by @Phillip9587 in expressjs/body-parser#599

build(deps): bump actions/setup-node from 4.3.0 to 4.4.0 by @dependabot[bot] in expressjs/body-parser#609

build(deps): bump github/codeql-action from 3.28.13 to 3.28.15 by @dependabot[bot] in expressjs/body-parser#610

build(deps-dev): bump eslint-plugin-promise from 6.1.1 to 6.6.0 by @dependabot[bot] in expressjs/body-parser#611

build(deps-dev): bump eslint-plugin-import from 2.27.5 to 2.31.0 by @dependabot[bot] in expressjs/body-parser#613

build(deps-dev): bump eslint-plugin-markdown from 3.0.0 to 3.0.1 by @dependabot[bot] in expressjs/body-parser#612

ci: add codeql github workflows scanning by @Phillip9587 in expressjs/body-parser#614

ci: update CodeQL config to ignore the test directory by @Phillip9587 in expressjs/body-parser#615

build(deps): bump actions/download-artifact from 4.2.1 to 4.3.0 by @dependabot[bot] in expressjs/body-parser#620

build(deps): bump github/codeql-action from 3.28.15 to 3.28.16 by @dependabot[bot] in expressjs/body-parser#619

chore(deps): unpin devDependencies by @Phillip9587 in expressjs/body-parser#616

ci: add node.js 24 to test matrix by @Phillip9587 in expressjs/body-parser#621

build(deps): bump github/codeql-action from 3.28.16 to 3.28.18 by @dependabot[bot] in expressjs/body-parser#623

build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by @dependabot[bot] in expressjs/body-parser#624

chore: add funding to package.json by @Phillip9587 in expressjs/body-parser#617

build(deps): bump github/codeql-action from 3.28.18 to 3.29.2 by @dependabot[bot] in expressjs/body-parser#625

build(deps): bump github/codeql-action from 3.29.2 to 3.29.5 by @dependabot[bot] in expressjs/body-parser#630

refactor: move common request validation to read function by @Phillip9587 in expressjs/body-parser#600

deps: bump iconv-lite by @bjohansebas in expressjs/body-parser#631

doc: pull beta changelog forward into 2.0.0 by @jonchurch in expressjs/body-parser#629

refactor: optimize raw and text parsers with shared passthrough function by @Phillip9587 in expressjs/body-parser#634

build(deps): bump actions/checkout from 4.2.2 to 5.0.0 by @dependabot[bot] in expressjs/body-parser#640

build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 by @dependabot[bot] in expressjs/body-parser#639

build(deps): bump actions/setup-node from 4.4.0 to 5.0.0 by @dependabot[bot] in expressjs/body-parser#636

build(deps): bump actions/download-artifact from 4.3.0 to 5.0.0 by @dependabot[bot] in expressjs/body-parser#637

build(deps): bump github/codeql-action from 3.29.7 to 3.30.5 by @dependabot[bot] in expressjs/body-parser#638

deps: raw-body@^3.0.1 by @Phillip9587 in expressjs/body-parser#641

deps: debug@^4.4.3 by @Phillip9587 in expressjs/body-parser#642

docs: add iconv-lite 0.7.0 changes to history entry by @Phillip9587 in expressjs/body-parser#645

ci: add node.js 25 to test matrix by @Phillip9587 in expressjs/body-parser#650

perf: move read options outside parser middlewares by @Phillip9587 in expressjs/body-parser#648

test(json): add RFC 7159 whitespace edge cases by @Ayoub-Mabrouk in expressjs/body-parser#653

test: add test for urlencoded invalid defaultCharset by @Phillip9587 in expressjs/body-parser#643

build(deps): bump actions/download-artifact from 5.0.0 to 6.0.0 by @dependabot[bot] in expressjs/body-parser#657

build(deps): bump github/codeql-action from 3.30.5 to 4.31.2 by @dependabot[bot] in expressjs/body-parser#656

build(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 by @dependabot[bot] in expressjs/body-parser#655

build(deps): bump actions/setup-node from 5.0.0 to 6.0.0 by @dependabot[bot] in expressjs/body-parser#654

ci: also test on first supported node.js version by @Phillip9587 in expressjs/body-parser#646

chore: switch badges from badgen.net to shields.io by @Phillip9587 in expressjs/body-parser#661

Remove history.md from being packaged on publish by @bjohansebas in expressjs/body-parser#660

Release: 2.2.1 by @UlisesGascon in expressjs/body-parser#659

... (truncated)

Changelog

Sourced from body-parser's changelog.

2.2.1 / 2025-11-24

Security fix for GHSA-wqch-xfxh-vrr4

deps:

type-is@^2.0.1

iconv-lite@^0.7.0

Handle split surrogate pairs when encoding UTF-8

Avoid false positives in encodingExists by using prototype-less objects

raw-body@^3.0.1

debug@^4.4.3

Commits

d96b63d 2.2.1 (#659)
b204886 sec: security patch for CVE-2025-13466
e20e351 feat: remove history.md from being packaged on publish (#660)
0d7ce71 docs: switch badges from badgen.net to shields.io (#661)
168afff ci: also test on first supported node.js version (#646)
e539a71 build(deps): bump actions/setup-node from 5.0.0 to 6.0.0 (#654)
9391612 build(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 (#655)
57baafb build(deps): bump github/codeql-action from 3.30.5 to 4.31.2 (#656)
a6a088e build(deps): bump actions/download-artifact from 5.0.0 to 6.0.0 (#657)
10a114d test: add test for urlencoded invalid defaultCharset (#643)
Additional commits viewable in compare view

Updates jws from 3.2.2 to 3.2.3

Release notes

Sourced from jws's releases.

v3.2.3

Changed

Fix advisory GHSA-869p-cjfg-cm3x: createSign and createVerify now require that a non empty secret is provided (via opts.secret, opts.privateKey or opts.key) when using HMAC algorithms.

Upgrading JWA version to 1.4.2, addressing a compatibility issue for Node >= 25.

Changelog

Sourced from jws's changelog.

[3.2.3]

Changed

Fix advisory GHSA-869p-cjfg-cm3x: createSign and createVerify now require that a non empty secret is provided (via opts.secret, opts.privateKey or opts.key) when using HMAC algorithms.

Upgrading JWA version to 1.4.2, adressing a compatibility issue for Node >= 25.

[3.0.0]

Changed

BREAKING: jwt.verify now requires an algorithm parameter, and jws.createVerify requires an algorithm option. The "alg" field signature headers is ignored. This mitigates a critical security flaw in the library which would allow an attacker to generate signatures with arbitrary contents that would be accepted by jwt.verify. See https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/ for details.

2.0.0 - 2015-01-30

Changed

BREAKING: Default payload encoding changed from binary to utf8. utf8 is a is a more sensible default than binary because many payloads, as far as I can tell, will contain user-facing strings that could be in any language. (6b6de48)

Code reorganization, thanks @fearphage! (7880050)

Added

Option in all relevant methods for encoding. For those few users that might be depending on a binary encoding of the messages, this is for them. (6b6de48)

Commits

4f6e73f Merge commit from fork
bd0fea5 version 3.2.3
7c3b4b4 Enhance tests for HMAC streaming sign and verify
a9b8ed9 Improve secretOrKey initialization in VerifyStream
6707fde Improve secret handling in SignStream
See full diff in compare view

Maintainer changes

This version was pushed to npm by julien.wollscheid, a new releaser for jws since your current version.

Updates validator from 13.15.20 to 13.15.26

Release notes

Sourced from validator's releases.

13.15.26

Fixes, New Locales and Enhancements

#2535 isHexColor: add require_hashtag option @Numbers0689

#2633 isURL: handle possible bypass with URL-encoded content @WikiRik

#2634 isIBAN: improve IR locale @ds1371dani

Doc fixes and others:

#2640 @WikiRik

New Contributors

@ds1371dani made their first contribution in validatorjs/validator.js#2634

@Numbers0689 made their first contribution in validatorjs/validator.js#2535

Full Changelog: validatorjs/validator.js@13.15.23...13.15.26

13.15.23

Fixes, New Locales and Enhancements

Doc fixes and others:

#2631 @WikiRik

Full Changelog: validatorjs/validator.js@13.15.22...13.15.23

13.15.22

Fixes, New Locales and Enhancements

#2622 isURL: fix regression with hostnames with ports @mbtools

#2616 isLength: improve handling Unicode variation selectors @koral--

Doc fixes and others:

#2621 @mbtools

New Contributors

@mbtools made their first contribution in validatorjs/validator.js#2622

@koral-- made their first contribution in validatorjs/validator.js#2616

Full Changelog: validatorjs/validator.js@13.15.20...13.15.22

Changelog

Sourced from validator's changelog.

13.15.26

Fixes, New Locales and Enhancements

#2535 isHexColor: add require_hashtag option @Numbers0689

#2633 isURL: handle possible bypass with URL-encoded content @WikiRik

#2634 isIBAN: improve IR locale @ds1371dani

Doc fixes and others:

#2640 @WikiRik

13.15.23

Fixes, New Locales and Enhancements

Doc fixes and others:

#2631 @WikiRik

13.15.22

Fixes, New Locales and Enhancements

#2622 isURL: fix regression with hostnames with ports @mbtools

#2616 isLength: improve handling Unicode variation selectors @koral--

Doc fixes and others:

#2621 @mbtools

Commits

784e52a docs(matches): add ReDoS note to README (#2640)
6531047 fix(isHexColor): add require_hashtag option (#2535)
f605a9c fix(isURL): handle possible bypass with URL-encoded content (#2633)
a165ebe fix(isIBAN): improve IR locale (#2634)
9113304 fix(build): move to trusted publishing (#2631)
f2b5c17 maintenance: 2511 release (#2627)
d457eca fix(isLength): correctly handle Unicode variation selectors (#2616)
f2e3633 docs: add install instructions to contibution guide (#2621)
cf40145 fix: URL validation for hostnames with ports (no protocol) (#2622)
4af6124 maintenance: 2510 release (#2585)
See full diff in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for validator since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the npm_and_yarn group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `6.3.6` | `6.4.1` | | [js-yaml](https://github.com/nodeca/js-yaml) | `3.14.1` | `3.14.2` | | [glob](https://github.com/isaacs/node-glob) | `10.4.5` | `10.5.0` | | [body-parser](https://github.com/expressjs/body-parser) | `2.2.0` | `2.2.1` | | [jws](https://github.com/brianloveswords/node-jws) | `3.2.2` | `3.2.3` | | [validator](https://github.com/validatorjs/validator.js) | `13.15.20` | `13.15.26` | Updates `vite` from 6.3.6 to 6.4.1 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/create-vite@6.4.1/packages/vite) Updates `js-yaml` from 3.14.1 to 3.14.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.14.1...3.14.2) Updates `glob` from 10.4.5 to 10.5.0 - [Changelog](https://github.com/isaacs/node-glob/blob/main/changelog.md) - [Commits](isaacs/node-glob@v10.4.5...v10.5.0) Updates `body-parser` from 2.2.0 to 2.2.1 - [Release notes](https://github.com/expressjs/body-parser/releases) - [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md) - [Commits](expressjs/body-parser@v2.2.0...v2.2.1) Updates `jws` from 3.2.2 to 3.2.3 - [Release notes](https://github.com/brianloveswords/node-jws/releases) - [Changelog](https://github.com/auth0/node-jws/blob/master/CHANGELOG.md) - [Commits](auth0/node-jws@v3.2.2...v3.2.3) Updates `validator` from 13.15.20 to 13.15.26 - [Release notes](https://github.com/validatorjs/validator.js/releases) - [Changelog](https://github.com/validatorjs/validator.js/blob/master/CHANGELOG.md) - [Commits](validatorjs/validator.js@13.15.20...13.15.26) --- updated-dependencies: - dependency-name: vite dependency-version: 6.4.1 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 3.14.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: glob dependency-version: 10.5.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: body-parser dependency-version: 2.2.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: jws dependency-version: 3.2.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: validator dependency-version: 13.15.26 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Dec 26, 2025

Merge branch 'dev' into dependabot/npm_and_yarn/npm_and_yarn-ead939c1b5

7a3a5a2

Type-Style merged commit 11858d2 into dev Dec 26, 2025
6 of 8 checks passed

Type-Style deleted the dependabot/npm_and_yarn/npm_and_yarn-ead939c1b5 branch December 26, 2025 18:39

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the npm_and_yarn group across 1 directory with 6 updates#293

Bump the npm_and_yarn group across 1 directory with 6 updates#293
Type-Style merged 2 commits into
devfrom
dependabot/npm_and_yarn/npm_and_yarn-ead939c1b5

dependabot Bot commented on behalf of github Dec 26, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Dec 26, 2025

create-vite@6.4.1

v6.4.1

create-vite@6.4.0

v6.4.0

v6.3.7

[3.14.2] - 2025-11-15

Security

[4.1.1] - 2025-11-12

Security

[4.1.0] - 2021-04-15

Added

Changed

[4.0.0] - 2021-01-03

Changed

Added

v2.2.1

Important: Security

What's Changed

2.2.1 / 2025-11-24

v3.2.3

Changed

[3.2.3]

Changed

[3.0.0]

Changed

2.0.0 - 2015-01-30

Changed

Added

13.15.26

Fixes, New Locales and Enhancements

New Contributors

13.15.23

Fixes, New Locales and Enhancements

13.15.22

Fixes, New Locales and Enhancements

New Contributors

13.15.26

Fixes, New Locales and Enhancements

13.15.23

Fixes, New Locales and Enhancements

13.15.22

Fixes, New Locales and Enhancements

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant