build(deps): bump the npm_and_yarn group across 2 directories with 16 updates#806
Merged
Merged
Conversation
… updates Bumps the npm_and_yarn group with 13 updates in the / directory: | Package | From | To | | --- | --- | --- | | [dompurify](https://github.com/cure53/DOMPurify) | `3.2.7` | `3.4.0` | | [axios](https://github.com/axios/axios) | `1.6.2` | `1.15.2` | | [next](https://github.com/vercel/next.js) | `15.5.15` | `15.5.18` | | [uuid](https://github.com/uuidjs/uuid) | `9.0.1` | `14.0.0` | | [postcss](https://github.com/postcss/postcss) | `8.5.6` | `8.5.10` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `5.4.6` | `6.4.2` | | [@xmldom/xmldom](https://github.com/xmldom/xmldom) | `0.9.8` | `0.9.10` | | [@babel/plugin-transform-modules-systemjs](https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-modules-systemjs) | `7.27.1` | `7.29.4` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.1.0` | `3.1.2` | | [flatted](https://github.com/WebReflection/flatted) | `3.3.3` | `3.4.2` | | [immutable](https://github.com/immutable-js/immutable-js) | `5.1.3` | `5.1.5` | | [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.18.1` | | [minimatch](https://github.com/isaacs/minimatch) | `3.1.2` | `10.2.5` | Bumps the npm_and_yarn group with 5 updates in the /apps/web directory: | Package | From | To | | --- | --- | --- | | [dompurify](https://github.com/cure53/DOMPurify) | `3.2.7` | `3.4.0` | | [axios](https://github.com/axios/axios) | `1.6.2` | `1.15.2` | | [next](https://github.com/vercel/next.js) | `15.5.15` | `15.5.18` | | [uuid](https://github.com/uuidjs/uuid) | `9.0.1` | `14.0.0` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `5.4.6` | `6.4.2` | Updates `dompurify` from 3.2.7 to 3.4.0 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.2.7...3.4.0) Updates `axios` from 1.6.2 to 1.15.2 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.6.2...v1.15.2) Updates `next` from 15.5.15 to 15.5.18 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v15.5.15...v15.5.18) Updates `uuid` from 9.0.1 to 14.0.0 - [Release notes](https://github.com/uuidjs/uuid/releases) - [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md) - [Commits](uuidjs/uuid@v9.0.1...v14.0.0) Updates `postcss` from 8.5.6 to 8.5.10 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.6...8.5.10) Updates `vite` from 5.4.6 to 6.4.2 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v6.4.2/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v6.4.2/packages/vite) Updates `@xmldom/xmldom` from 0.9.8 to 0.9.10 - [Release notes](https://github.com/xmldom/xmldom/releases) - [Changelog](https://github.com/xmldom/xmldom/blob/master/CHANGELOG.md) - [Commits](xmldom/xmldom@0.9.8...0.9.10) Updates `@babel/plugin-transform-modules-systemjs` from 7.27.1 to 7.29.4 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.4/packages/babel-plugin-transform-modules-systemjs) Updates `fast-uri` from 3.1.0 to 3.1.2 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.0...v3.1.2) Updates `flatted` from 3.3.3 to 3.4.2 - [Commits](WebReflection/flatted@v3.3.3...v3.4.2) Updates `follow-redirects` from 1.15.11 to 1.16.0 - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.15.11...v1.16.0) Updates `immutable` from 5.1.3 to 5.1.5 - [Release notes](https://github.com/immutable-js/immutable-js/releases) - [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md) - [Commits](immutable-js/immutable-js@v5.1.3...v5.1.5) Updates `lodash` from 4.17.21 to 4.18.1 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.18.1) Updates `minimatch` from 3.1.2 to 10.2.5 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v3.1.2...v10.2.5) Updates `picomatch` from 2.3.1 to 2.3.2 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@2.3.1...2.3.2) Updates `rollup` from 2.79.2 to 2.80.0 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/v2.80.0/CHANGELOG.md) - [Commits](rollup/rollup@v2.79.2...v2.80.0) Updates `dompurify` from 3.2.7 to 3.4.0 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.2.7...3.4.0) Updates `axios` from 1.6.2 to 1.15.2 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.6.2...v1.15.2) Updates `next` from 15.5.15 to 15.5.18 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v15.5.15...v15.5.18) Updates `uuid` from 9.0.1 to 14.0.0 - [Release notes](https://github.com/uuidjs/uuid/releases) - [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md) - [Commits](uuidjs/uuid@v9.0.1...v14.0.0) Updates `vite` from 5.4.6 to 6.4.2 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v6.4.2/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v6.4.2/packages/vite) --- updated-dependencies: - dependency-name: dompurify dependency-version: 3.4.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: axios dependency-version: 1.15.2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.18 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: uuid dependency-version: 14.0.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.10 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 6.4.2 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: "@xmldom/xmldom" dependency-version: 0.9.10 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@babel/plugin-transform-modules-systemjs" dependency-version: 7.29.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: flatted dependency-version: 3.4.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: follow-redirects dependency-version: 1.16.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: immutable dependency-version: 5.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.18.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: minimatch dependency-version: 10.2.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 2.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: rollup dependency-version: 2.80.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: dompurify dependency-version: 3.4.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: axios dependency-version: 1.15.2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.18 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: uuid dependency-version: 14.0.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 6.4.2 dependency-type: direct:development dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Greptile SummaryThis dependabot PR bumps 16 npm packages across the root and
Confidence Score: 5/5Safe to merge — all changes are dependency version bumps with no application logic modifications, and the security-critical updates are well-targeted. Every package updated carries either security fixes or compatibility improvements. The uuid 9→14 jump drops CommonJS, but all 12 call-sites in the codebase use ESM import syntax, so there is no compatibility gap. The vite 5→6 / vitest 2→3 co-upgrade resolves the peer-dependency conflict noted in the prior review round. The render-helper version bump is correctly a patch (2.5.5), not a major, consistent with the dependency-only change. No files require special attention. The pnpm-lock.yaml resolved versions are consistent with the package.json specifiers. Important Files Changed
Flowchart%%{init: {'theme': 'neutral'}}%%
flowchart TD
subgraph Security["Security-critical updates"]
A["dompurify 3.2.7 → 3.4.0\nmXSS, prototype pollution fixes"]
B["axios 1.6.2 → 1.15.2\nHeader injection, XSRF, SSRF fixes"]
C["next 15.5.15 → 15.5.18\n7 high-severity advisories"]
D["postcss 8.5.6 → 8.5.10\nXSS fix"]
E["@xmldom/xmldom 0.9.8 → 0.9.10\nXML injection, stack DoS fixes"]
end
subgraph Major["Major version jumps"]
F["uuid 9.0.1 → 14.0.0\nESM-only, Node 20+ required\n✓ All usages use ESM imports"]
G["vite 5 → 6\n+ vitest 2 → 3 co-upgraded\n✓ Peer conflict resolved"]
end
subgraph Patch["Patch updates"]
H["@ecency/render-helper\n2.5.4 → 2.5.5"]
I["Other transitive deps\nbabel, fast-uri, flatted,\nimmutable, lodash, minimatch"]
end
apps_web["apps/web"] --> Security
apps_web --> Major
apps_web --> Patch
apps_self["apps/self-hosted"] --> A
render["packages/render-helper"] --> E
render --> H
Reviews (3): Last reviewed commit: "chore: apply changeset versioning for PR..." | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
This reverts commit f6b3020.
vitest@2 declares vite ^5.0.0 as a hard dep; with vite 6 in this PR the test runner would silently install a mismatched vite 5 alongside vite 6. Aligns apps/web with apps/self-hosted (already on vitest@3). @vitejs/plugin-react@4.5.0 already supports vite ^6.
uuid v14 includes built-in TypeScript declarations via the "types" field, making @types/uuid redundant as a direct devDep. Other deps that still need it pull it in transitively.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the npm_and_yarn group with 13 updates in the / directory:
3.2.73.4.01.6.21.15.215.5.1515.5.189.0.114.0.08.5.68.5.105.4.66.4.20.9.80.9.107.27.17.29.43.1.03.1.23.3.33.4.25.1.35.1.54.17.214.18.13.1.210.2.5Bumps the npm_and_yarn group with 5 updates in the /apps/web directory:
3.2.73.4.01.6.21.15.215.5.1515.5.189.0.114.0.05.4.66.4.2Updates
dompurifyfrom 3.2.7 to 3.4.0Release notes
Sourced from dompurify's releases.
Commits
5b16e0bGetting 3.x branch ready for 3.4.0 release (#1250)8bcbf73chore: Preparing 3.3.3 release5faddd6fix: engine requirement (#1210)0f91e3aUpdate README.mdd5ff1a8Merge branch 'main' of github.com:cure53/DOMPurifyc3efd48fix: moved back from jsdom 28 to jsdom 20988b888fix: moved back from jsdom 28 to jsdom 202726c74chore: Preparing 3.3.2 release6202c7ebuild(deps): bump@tootallnate/onceand jsdom (#1204)302b51dfix: Expanded the regex ever so slightly to also cover scriptUpdates
axiosfrom 1.6.2 to 1.15.2Release notes
Sourced from axios's releases.
... (truncated)
Changelog
Sourced from axios's changelog.
... (truncated)
Commits
5829343chore(release): prepare release 1.15.2 (#10789)4709a48fix: added fix for memory leak in sockets (#10788)be33360chore: update changelog (#10781)4791514fix: more header pollutions (#10779)6feafcffix: socket issue (#10777)302e273docs: update docs, add a couple actions etc (#10776)ac42446chore(release): prepare release 1.15.1 (#10767)908f220docs: update threatmodel (#10765)f93f815docs: added docs around potential decompressions bomb (#10763)1728aa1fix: short-circuits on any truthy non-boolean in withXSRFToken (#10762)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for axios since your current version.
Install script changes
This version modifies
preparescript that runs during installation. Review the package contents before updating.Updates
nextfrom 15.5.15 to 15.5.18Release notes
Sourced from next's releases.
Commits
9ff92cev15.5.1800ebe23[backport] Disable build caches for production/staging/force-preview deploys ...62c97abv15.5.17423623aTurbopack: Match proxy matchers with webpack implementation (#93594)fa78739Turbopack: Fix middleware matcher suffix (#93590)36e62c6[backport] Turbopack: more strict vergen setup (#93588)36589b5[backport][test] Pin package manager to patch versions (#93596)ad6fd4ev15.5.1679d7dffIgnore malformed CSP nonce headers (#103)c4f6908router-server: guard upgrade proxy against absolute-url SSRF (#77) (#102)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.
Updates
uuidfrom 9.0.1 to 14.0.0Release notes
Sourced from uuid's releases.
... (truncated)
Changelog
Sourced from uuid's changelog.
... (truncated)
Commits
7c1ea08chore(main): release 14.0.0 (#926)3d2c5b0Merge commit from forkf2c235ffix!: expectcryptoto be global everywhere (requires node@20+) (#935)529ef08chore: upgrade TypeScript and fixup types (#927)086fd79chore: update dependencies (#933)dc4ddb8feat!: drop node@18 support (#934)0f1f9c9chore: switch to Biome for parsing and linting (#932)e2879e6chore: use maintained version of npm-run-all (#930)ffa3138fix: Use GITHUB_TOKEN for release-please and enable npm provenance (#925)0423d49docs: remove obsolete v1 option notes (#915)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for uuid since your current version.
Install script changes
This version adds
preparescript that runs during installation. Review the package contents before updating.Updates
postcssfrom 8.5.6 to 8.5.10Release notes
Sourced from postcss's releases.
Changelog
Sourced from postcss's changelog.
Commits
33b9790Release 8.5.10 version536c79eEscape </style> in CSS output (#2074)afa96b2Update dependencies (#2073)effe88bTypo (#2072)3ee79a2Thread model (#2071)2e0683dCreate incident response docs (#2070)fe88ac2Release 8.5.9 versionc551632Avoid RegExp when we can use simple JS89a6b74Move SECURITY.txt for docs folder to keep GitHub page cleaner6ceb8a4Create SECURITY.mdUpdates
vitefrom 5.4.6 to 6.4.2Release notes
Sourced from vite's releases.
Changelog
Sourced from vite's changelog.
... (truncated)
Commits
6b3fad0release: v6.4.2ca4da5dfix: avoid path traversal with optimize deps sourcemap handler (#22161)fe28e47fix: apply server.fs check to env transport (#22159) (#22163)5487f4frelease: v6.4.11114b5dfix(dev): trim trailing slash beforeserver.fs.denycheck (#20968) (#20969)f12697crelease: v6.4.0ca6455efeat: allow passing down resolved config to vite's createServer (#20932)0e173d8release: v6.3.7c59a222fix(esbuild): inject esbuild helpers correctly for esbuild 0.25.9+ (#20940)3f337c5release: v6.3.6Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for vite since your current version.
Updates
@xmldom/xmldomfrom 0.9.8 to 0.9.10Release notes
Sourced from @xmldom/xmldom's releases.
... (truncated)
Changelog
Sourced from @xmldom/xmldom's changelog.