Skip to content

Conversation

dependabot[bot]
Copy link

@dependabot dependabot bot commented on behalf of github Sep 13, 2025

Bumps the npm_and_yarn group with 7 updates in the / directory:

Package From To
axios 1.8.2 1.12.0
pbkdf2 3.1.2 3.1.3
koa 2.14.2 3.0.1
cipher-base 1.0.4 1.0.6
lockfile-lint-api 5.9.1 5.9.2
ses 1.2.0 1.14.0
sha.js 2.4.11 2.4.12

Bumps the npm_and_yarn group with 3 updates in the /.github/scripts directory: axios, brace-expansion and debug.

Updates axios from 1.8.2 to 1.12.0

Release notes

Sourced from axios's releases.

Release v1.12.0

Release notes:

Bug Fixes

Features

  • adapter: surface low‑level network error details; attach original error via cause (#6982) (78b290c)
  • fetch: add fetch, Request, Response env config variables for the adapter; (#7003) (c959ff2)
  • support reviver on JSON.parse (#5926) (2a97634), closes #5924
  • types: extend AxiosResponse interface to include custom headers type (#6782) (7960d34)

Contributors to this release

Release v1.11.0

Release notes:

Bug Fixes

  • form-data npm pakcage (#6970) (e72c193)
  • prevent RangeError when using large Buffers (#6961) (a2214ca)
  • types: resolve type discrepancies between ESM and CJS TypeScript declaration files (#6956) (8517aa1)

Contributors to this release

... (truncated)

Changelog

Sourced from axios's changelog.

1.12.0 (2025-09-11)

Bug Fixes

Features

  • adapter: surface low‑level network error details; attach original error via cause (#6982) (78b290c)
  • fetch: add fetch, Request, Response env config variables for the adapter; (#7003) (c959ff2)
  • support reviver on JSON.parse (#5926) (2a97634), closes #5924
  • types: extend AxiosResponse interface to include custom headers type (#6782) (7960d34)

Contributors to this release

1.11.0 (2025-07-22)

Bug Fixes

  • form-data npm pakcage (#6970) (e72c193)
  • prevent RangeError when using large Buffers (#6961) (a2214ca)
  • types: resolve type discrepancies between ESM and CJS TypeScript declaration files (#6956) (8517aa1)

Contributors to this release

... (truncated)

Commits
  • 0d8ad6e chore(release): v1.12.0 (#7013)
  • fd7f404 fix: release pr run
  • a2edc36 fix: dont add dist on release
  • 9ec86de fix: adding build artifacts
  • 945435f fix(node): enforce maxContentLength for data: URLs (#7011)
  • 28e5e30 chore(sponsor): update sponsor block (#7005)
  • d03f245 chore(CI): fixed release info script to use npm registry instead of git as fi...
  • a0bc911 chore: removing dist files from src (#7002)
  • c959ff2 feat(fetch): add fetch, Request, Response env config variables for the adapte...
  • a9f47af fix(fetch-adapter): set correct Content-Type for Node FormData (#6998)
  • Additional commits viewable in compare view

Updates pbkdf2 from 3.1.2 to 3.1.3

Changelog

Sourced from pbkdf2's changelog.

v3.1.3 - 2025-06-20

Commits

  • Only apps should have lockfiles 8b06730
  • [lint] fix whitespace 9a76e2f
  • [lint] fix parens/curlies/semis/etc 6fd84bf
  • [meta] add auto-changelog 796c38d
  • [Tests] fix tests in node 17 3661fb0
  • Revert "[Tests] fix tests in node < 3" 7431b57
  • [Tests] fix tests in node < 3 eb9f97a
  • [Fix] ensure unknown algorithms throw + known ones match node 26d4fd3
  • [Tests] add GHA, always run nyc 513906a
  • [lint] fix a few more rules ab04da8
  • [lint] switch to eslint 89694cf
  • [Tests] add coverage d0d534b
  • [Refactor] use to-buffer e3102a8
  • [readme] improve badges fca0c9d
  • [Tests] remove unused travis file a2c7d93
  • [meta] switch from files to npmignore 7f31fbc
  • [Tests] use .nycrc 8d628e8
  • [Refactor] minor tweaks fc61005
  • [Deps] update create-hmac, safe-buffer, sha.js ae2a7d0
  • [Fix] pin create-hash, ripemd160 due to breaking changes e079968
  • [Tests] fix tests in node 3 45fbcf3
  • [meta] skip publishing benchmarks 19ea57b
  • [Dev Deps] add missing peer dep 645e252
Commits
Maintainer changes

This version was pushed to npm by ljharb, a new releaser for pbkdf2 since your current version.


Updates koa from 2.14.2 to 3.0.1

Release notes

Sourced from koa's releases.

v3.0.1

What's Changed

Full Changelog: koajs/koa@v3.0.0...v3.0.1

v3.0.0

This is a major release.

Breaking

  • Minimum node v18
  • Removes .redirect('back'), adds .back(fallback_url) @​fl0w koajs/koa#1115
  • For .redirect(), don't render redirect values in anchor ref koajs/koa@ff25eb4
  • req.origin should display the origin header if it exists, not the current hostname koajs/koa#1008. origin now aligns with the Origin header as used in CORS.
  • .body=<json> should not overwrite type if type already json koajs/koa#1120
  • Remove special ENOENT support koajs/koa#1861 - this is a big change and will require any file servers to adapt to this change for handling 404s / files not found
  • Removes generator deprecation messages. Generators are no longer supported. Koa no longer asserts if generators are used. Set content-length: 0 if body is explicitly set to null @​ognjenjevremovic #1528 Remove obsolete createAsyncCtxStorageMiddleware koajs/koa#1817
  • ctx.throw now requires a format of ctx.throw(status, error, properties). See: https://www.npmjs.com/package/http-errors

New

Fixes

... (truncated)

Changelog

Sourced from koa's changelog.

[!IMPORTANT] Moving forwards we are using the GitHub releases page at https://github.com/koajs/koa/releases in combination with np for publishing releases and their changelogs.


3.0.0-alpha.3 / 2025-02-11

fixes

  • Avoid redos on host and protocol getter

3.0.0-alpha.2 / 2024-11-04

breaking changes

  • Update http-errors to v2.0.0 #1486
  • Remove res.redirect('back'), add back() method to ctx #1115
  • Replace node querystring with URLSearchParams #1828
  • Remove obsolete createAsyncCtxStorageMiddleware #1817

features

  • Add support for web WHATWG #1830

updates

  • Update cookies to ~0.9.1 #1846
  • Update statuses to ^2.0.1
  • Update supertest to ^7.0.0 #1841

fixes

  • Fix exports.defaults in package.json #1630
  • Fix leaky handles in tests #1838
  • Fix body null checks #1814
  • Fix reformatting redirect URLs #1805 #1804
  • Fix passing ctx in error handler #1758

migrations

  • Migrate from jest to the native node test runner #1845

3.0.0-alpha.1 / 2023-04-12

fixes

3.0.0-alpha.0 / 2023-01-02

Breaking Changes

... (truncated)

Commits
  • 1ddb048 3.0.1
  • 422c551 Merge commit from fork
  • 6e51eb1 build(deps-dev): bump form-data from 4.0.3 to 4.0.4 (#1894)
  • d378e5c build(deps-dev): bump supertest from 7.1.1 to 7.1.4 (#1895)
  • cb22d8d build(deps): bump statuses from 2.0.1 to 2.0.2 (#1888)
  • 0acad8f feat: replace cache-content-type with mime-types directly (#1886)
  • 2f6e814 feat: replace debug module with pure node:util::debuglog (#1885)
  • 8620ced build(deps): bump debug from 4.4.0 to 4.4.1 (#1880)
  • dec1ffc build(deps-dev): bump supertest from 7.1.0 to 7.1.1 (#1879)
  • 9057541 chore: removes done callbacks in tests [CHORE-1870] (#1875)
  • Additional commits viewable in compare view

Updates cipher-base from 1.0.4 to 1.0.6

Changelog

Sourced from cipher-base's changelog.

v1.0.6 - 2024-11-26

Commits

  • [Fix] io.js 3.0 - Node.js 5.3 typed array support b7ddd2a

v1.0.5 - 2024-11-17

Commits

  • [Tests] standard -> eslint, make test dir, etc ae02fd6
  • [Tests] migrate from travis to GHA 66387d7
  • [meta] fix package.json indentation 5c02918
  • [Fix] return valid values on multi-byte-wide TypedArray input 8fd1364
  • [meta] add auto-changelog 88dc806
  • [meta] add npmignore and safe-publish-latest 7a137d7
  • Only apps should have lockfiles 42528f2
  • [Deps] update inherits, safe-buffer 0e7a2d9
  • [meta] add missing engines.node f2dc13e
Commits
  • f5249f9 v1.0.6
  • b7ddd2a [Fix] io.js 3.0 - Node.js 5.3 typed array support
  • f03cebf v1.0.5
  • 88dc806 [meta] add auto-changelog
  • 7a137d7 [meta] add npmignore and safe-publish-latest
  • 5c02918 [meta] fix package.json indentation
  • 8fd1364 [Fix] return valid values on multi-byte-wide TypedArray input
  • 66387d7 [Tests] migrate from travis to GHA
  • f2dc13e [meta] add missing engines.node
  • 0e7a2d9 [Deps] update inherits, safe-buffer
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by ljharb, a new releaser for cipher-base since your current version.


Updates lockfile-lint-api from 5.9.1 to 5.9.2

Release notes

Sourced from lockfile-lint-api's releases.

[email protected]

Patch Changes

Changelog

Sourced from lockfile-lint-api's changelog.

5.9.2

Patch Changes

Commits

Updates ses from 1.2.0 to 1.14.0

Release notes

Sourced from ses's releases.

2025-07-11

@endo/immutable-arraybuffer 1.1.2

  • Removes @endo/immutable-arraybufer/shim-hermes.js and absorbs the necessary features into @endo/immutable-arraybuffer/shim.js. We are not qualifying this as a breaking change since the feature did not exist long enough to become relied upon.

@endo/marshal 1.8.0

  • Introduces an environment variable config option ENDO_RANK_STRINGS to change the rank ordering of strings from the current (incorrect) ordering by UTF-16 code unit used by JavaScript's < and .sort() operations to (correct and OCapN-conformant) ordering by Unicode code point. It currently defaults to "utf16-code-unit-order", matching the previously-unconditional behavior.

@endo/pass-style 1.6.3

  • The exported function name isObject is ambiguous. It is unclear whether it includes functions or not. (It does.) To avoid this confusion, we're deprecating isObject and suggesting to use the new export isPrimitive instead, that has the opposite answer. IOW, for all x, isObject(x) === !isPrimitive(x)

@endo/patterns 1.7.0

  • @endo/marshal introduces an environment variable config option ENDO_RANK_STRINGS to change the rank ordering of strings from the current (incorrect) ordering by UTF-16 code unit used by JavaScript's < and .sort() operations to (correct and OCapN-conformant) ordering by Unicode code point. It currently defaults to "utf16-code-unit-order", matching the previously-unconditional behavior.
    • @endo/patterns provides a compareKeys partial order that delegates some ordering, including strings, to the rank ordering provided by @endo/marshal. So when the ENDO_RANK_STRINGS default is not overridden, then compareKeys also follows the (incorrect) UTF-16 code unit order. But when it is overridden, then compareKeys also follows the (correct) Unicode code-point order.
  • In errors explaining why a specimen does not match a pattern, sometimes the error message contains a quoted form of a nested pattern. This quoting was done with q, producing an uninformative rendering of these nested patterns. Now this quoting is done with qp, which renders these nested patterns into readable Justin source code.

2025-06-02 Releases

@endo/pass-style v1.6.0

BROKEN BUT PATCHED in 1.6.1, this version introduced a dependence on the underlying platform supporting ArrayBuffer.prototype.transferToImmutable. The patch restores the ability to use pass-style on older platforms without the immutable ArrayBuffer shim (as entrained by ses).

  • Introduces support for byteArray.

ses v1.13.0

  • Two new stackFiltering: options are added

    • 'omit-frames' -- Only omit likely uninteresting frames. Keep original paths.
    • 'shorten-paths' -- Only shorten paths to text likely clickable in an IDE

    This fills out the matrix of what should have been orthogonal options. The existing 'concise' setting both omits likely uninteresting frames and shortens their paths. The existing 'verbose' setting does neither.

  • Uses the @endo/immutable-arraybuffer shim to add ArrayBuffer.p.immutable, ArrayBuffer.p.transferToImmutable, and ArrayBuffer.p.sliceToImmutable to ses, in order to emulate the Immutable ArrayBuffer proposal. These make an ArrayBuffer-like object whose contents cannot be mutated. However, due to limitations of the shim

    • Unlike ArrayBuffer and SharedArrayBuffer this shim's ArrayBuffer-like object cannot be transfered or cloned between JS threads.
    • Unlike ArrayBuffer and SharedArrayBuffer, this shim's ArrayBuffer-like object cannot be used as the backing store of TypeArrays or DataViews.
    • The shim depends on the platform providing either structuredClone or Array.prototype.transfer. Node <= 16 and provides neither, causing the shim to fail to initialize, and therefore SES to fail to initialize on such platforms.
    • Current Hermes has even stronger constraints, lacking structuredClone, transfer, private fields, and even class syntax. This requires other coping strategies. See endojs/endo#2785
    • Even after the upcoming transferToImmutable proposal is implemented by the platform, the current code will still replace it with the shim implementation, in accord with shim best practices. See endojs/endo#2311 . It will require a later manual step to delete the shim or have it avoid overriting a platform implementation, after manual analysis of the compat implications.
  • The evalTaming option 'safe-eval' now can only throw error SES_DIRECT_EVAL. This allows SES to initialize with 'unsafe-eval' or 'no-eval' on hosts with no direct eval available such as Hermes for a successful lockdown that tolerates it's language features.

    The module name ses/hermes can now be required to call lockdown and repairIntrinsics only, Compartment is not yet available.

    It is currently compatible with Hermes v0.12.0, we plan to support v0.13.0 then subsequent Hermes tags or side-by-side versions built for React Native depending on ecosystem usage and official support, then Static Hermes when released.

... (truncated)

Changelog

Sourced from ses's changelog.

1.14.0 (2025-07-12)

Features

  • cache-map: Promote makeLRUCacheMap into a new package (a39db9e)
  • cache-map: Return a kit for exposing metrics (f513ebd)
  • ses: add noAggregateLoadErrors flag (#2832) (b222f9f)

Bug Fixes

1.13.1 (2025-06-17)

Bug Fixes

1.13.0 (2025-06-02)

Features

  • ses: ArrayBuffer.prototype.sliceToImmutable on Hermes (e432b14)
  • ses: ArrayBuffer.prototype.transferToImmutable (#2400) (d714d1d)
  • ses: Include ses-ava in stack frame filtering (bdbdb01)
  • ses: init SES with evalTaming unsafe-eval or no-eval (0dfaa8d)

Bug Fixes

  • ses,lockdown: make filenames in stacktraces clickable (#2747) (178e253), closes #2359 #2359
  • ses: avoid depth-first loading sequence in loadNow to prevent getting stuck in cycles (#2804) (37bfad6)

1.12.0 (2025-03-24)

Features

  • ses: add AsyncGeneratorFunctionInstance to commons (07516f5)
  • ses: bundle and export shim compatible with Hermes compiler (cafc398)

... (truncated)

Commits
  • 9815aea chore(release): publish
  • f513ebd feat(cache-map): Return a kit for exposing metrics
  • d899bcd refactor(cache-map): Relax "LRU" specificity
  • a39db9e feat(cache-map): Promote makeLRUCacheMap into a new package
  • ade5bc1 refactor: hasOwn rather than hasOwnPropertyOf or objectHasOwnProperty (...
  • b222f9f feat(ses): add noAggregateLoadErrors flag (#2832)
  • 75f4887 refactor(ses): Adopt ses eslint configuration
  • 5efcf7d refactor(pass-style): faster isObject (#2860)
  • 25039f5 fix(immutable-arraybuffer): unify shim to work on more platforms (#2855)
  • 03b92fc chore(release): publish
  • Additional commits viewable in compare view

Updates sha.js from 2.4.11 to 2.4.12

Changelog

Sourced from sha.js's changelog.

v2.4.12 - 2025-07-01

Commits

  • [eslint] switch to eslint 7acadfb
  • [meta] add auto-changelog b46e711
  • [eslint] fix package.json indentation df9d521
  • [Tests] migrate from travis to GHA c43c64a
  • [Fix] support multi-byte wide typed arrays f2a258e
  • [meta] reorder package.json d8d77c0
  • [meta] add npmignore 35aec35
  • [Tests] avoid console logs 73e33ae
  • [Tests] fix tests run in batch 2629130
  • [Tests] drop node requirement to 0.10 00c7f23
  • [Dev Deps] update buffer, hash-test-vectors, standard, tape, typedarray 92b5de5
  • [Tests] drop node requirement to v3 9b5eca8
  • [meta] set engines to &gt;= 4 807084c
  • Only apps should have lockfiles c72789c
  • [Deps] update inherits, safe-buffer 5428cfc
  • [Dev Deps] update @ljharb/eslint-config 2dbe0aa
  • update README to reflect LICENSE 8938256
  • [Dev Deps] add missing peer dep d528896
  • [Dev Deps] remove unused buffer dep 94ca724
Commits
  • eb4ea2f v2.4.12
  • d8d77c0 [meta] reorder package.json
  • df9d521 [eslint] fix package.json indentation
  • 35aec35 [meta] add npmignore
  • d528896 [Dev Deps] add missing peer dep
  • b46e711 [meta] add auto-changelog
  • 94ca724 [Dev Deps] remove unused buffer dep
  • 2dbe0aa [Dev Deps] update @ljharb/eslint-config
  • 73e33ae [Tests] avoid console logs
  • f2a258e [Fix] support multi-byte wide typed arrays
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by ljharb, a new releaser for sha.js since your current version.


Updates axios from 1.8.2 to 1.12.0

Release notes

Sourced from axios's releases.

Release v1.12.0

Release notes:

Bug Fixes

Features

  • adapter: surface low‑level network error details; attach original error via cause (#6982) (78b290c)
  • fetch: add fetch, Request, Response env config variables for the adapter; (#7003) (c959ff2)
  • support reviver on JSON.parse (#5926) (2a97634), closes #5924
  • types: extend AxiosResponse interface to include custom headers type (#6782) (7960d34)

Contributors to this release

… updates

Bumps the npm_and_yarn group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [axios](https://github.com/axios/axios) | `1.8.2` | `1.12.0` |
| [pbkdf2](https://github.com/crypto-browserify/pbkdf2) | `3.1.2` | `3.1.3` |
| [koa](https://github.com/koajs/koa) | `2.14.2` | `3.0.1` |
| [cipher-base](https://github.com/crypto-browserify/cipher-base) | `1.0.4` | `1.0.6` |
| [lockfile-lint-api](https://github.com/lirantal/lockfile-lint/tree/HEAD/packages/lockfile-lint-api) | `5.9.1` | `5.9.2` |
| [ses](https://github.com/endojs/endo/tree/HEAD/packages/ses) | `1.2.0` | `1.14.0` |
| [sha.js](https://github.com/crypto-browserify/sha.js) | `2.4.11` | `2.4.12` |

Bumps the npm_and_yarn group with 3 updates in the /.github/scripts directory: [axios](https://github.com/axios/axios), [brace-expansion](https://github.com/juliangruber/brace-expansion) and [debug](https://github.com/debug-js/debug).


Updates `axios` from 1.8.2 to 1.12.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.8.2...v1.12.0)

Updates `pbkdf2` from 3.1.2 to 3.1.3
- [Changelog](https://github.com/browserify/pbkdf2/blob/master/CHANGELOG.md)
- [Commits](browserify/pbkdf2@v3.1.2...v3.1.3)

Updates `koa` from 2.14.2 to 3.0.1
- [Release notes](https://github.com/koajs/koa/releases)
- [Changelog](https://github.com/koajs/koa/blob/master/History.md)
- [Commits](koajs/koa@2.14.2...v3.0.1)

Updates `cipher-base` from 1.0.4 to 1.0.6
- [Changelog](https://github.com/browserify/cipher-base/blob/master/CHANGELOG.md)
- [Commits](browserify/cipher-base@v1.0.4...v1.0.6)

Updates `lockfile-lint-api` from 5.9.1 to 5.9.2
- [Release notes](https://github.com/lirantal/lockfile-lint/releases)
- [Changelog](https://github.com/lirantal/lockfile-lint/blob/main/packages/lockfile-lint-api/CHANGELOG.md)
- [Commits](https://github.com/lirantal/lockfile-lint/commits/[email protected]/packages/lockfile-lint-api)

Updates `ses` from 1.2.0 to 1.14.0
- [Release notes](https://github.com/endojs/endo/releases)
- [Changelog](https://github.com/endojs/endo/blob/master/packages/ses/CHANGELOG.md)
- [Commits](https://github.com/endojs/endo/commits/[email protected]/packages/ses)

Updates `sha.js` from 2.4.11 to 2.4.12
- [Changelog](https://github.com/browserify/sha.js/blob/master/CHANGELOG.md)
- [Commits](browserify/sha.js@v2.4.11...v2.4.12)

Updates `axios` from 1.8.2 to 1.12.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.8.2...v1.12.0)

Updates `brace-expansion` from 2.0.1 to 2.0.2
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v2.0.1...v2.0.2)

Updates `debug` from 4.4.0 to 4.4.1
- [Release notes](https://github.com/debug-js/debug/releases)
- [Commits](debug-js/debug@4.4.0...4.4.1)

Updates `form-data` from 4.0.0 to 4.0.4
- [Release notes](https://github.com/form-data/form-data/releases)
- [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md)
- [Commits](form-data/form-data@v4.0.0...v4.0.4)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 1.12.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: pbkdf2
  dependency-version: 3.1.3
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: koa
  dependency-version: 3.0.1
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: cipher-base
  dependency-version: 1.0.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: lockfile-lint-api
  dependency-version: 5.9.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ses
  dependency-version: 1.14.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: sha.js
  dependency-version: 2.4.12
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: axios
  dependency-version: 1.12.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 2.0.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: debug
  dependency-version: 4.4.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: form-data
  dependency-version: 4.0.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 13, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants