Skip to content

Bump the npm_and_yarn group across 2 directories with 10 updates - #334

Merged
pgajek2 merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-76881050ff
Oct 24, 2026
Merged

pgajek2 merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-76881050ff

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 24, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 1 update in the / directory: follow-redirects.
Bumps the npm_and_yarn group with 10 updates in the /website directory:

Package From To
follow-redirects 1.16.0 1.16.1
body-parser 1.20.8 1.20.9
compression 1.8.1 1.8.2
fast-uri 3.1.8 3.1.9
http-cache-semantics 4.1.1 4.3.0
katex 0.16.45 0.18.10
launch-editor 2.14.1 2.14.2
proxy-addr 2.0.7 2.0.8
shell-quote 1.10.0 1.12.0
source-map-js 1.2.1 1.2.2

Updates follow-redirects from 1.16.0 to 1.16.1

Commits

Updates follow-redirects from 1.16.0 to 1.16.1

Commits

Updates body-parser from 1.20.8 to 1.20.9

Release notes

Sourced from body-parser's releases.

1.20.9

Important: Security

What's Changed

Full Changelog: expressjs/body-parser@1.20.8...1.20.9

Changelog

Sourced from body-parser's changelog.

1.20.9

Commits

Updates compression from 1.8.1 to 1.8.2

Release notes

Sourced from compression's releases.

v1.8.2

Important

What's Changed

New Contributors

Full Changelog: expressjs/compression@v1.8.1...v1.8.2

Changelog

Sourced from compression's changelog.

1.8.2

Commits
  • 0f97074 1.8.2 (#287)
  • 151f63e fix: destroy compression stream on response close
  • 0a76495 fix: match Cache-Control no-transform directive case-insensitively (#286)
  • c17b6e5 docs: update outdated Brotli note and fix npm install docs URL (#276)
  • 112911a chore(ci): npm-publish via reusable workflows (#269)
  • 1bf5eb0 build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 (#267)
  • d8fe64d build(deps): bump actions/setup-node from 6.0.0 to 6.1.0 (#266)
  • b218ff5 build(deps): bump github/codeql-action from 4.31.5 to 4.31.9 (#265)
  • 8a1cf8e build(deps): bump actions/download-artifact from 6.0.0 to 7.0.0 (#268)
  • 4a19855 build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 (#257)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for compression since your current version.


Updates fast-uri from 3.1.8 to 3.1.9

Release notes

Sourced from fast-uri's releases.

v3.1.9

Security

This security release fixes four URI parsing and normalization vulnerabilities in fast-uri 3.x. Applications that process untrusted URI input should upgrade to v3.1.9.

  • Medium — URI scheme spoofing through percent-encoded schemes (GHSA-w74x-v6f9-j3xg, CVE-2026-110306): percent-encoded scheme input is now rejected instead of being decoded into a live scheme.
  • Medium — Host confusion during domain-host canonicalization (GHSA-wjr9-j795-jxcr, CVE-2026-110180): malformed domain hosts containing ambiguous delimiters or stripped control characters are now rejected instead of being silently rewritten.
  • Low — Incorrect relative-reference normalization (GHSA-xhq7-xmqj-769h, CVE-2026-110095): dot-segment removal now preserves the resolution semantics of relative references.
  • Low — Scheme injection in suffix references (GHSA-333x-w4r6-6crp, CVE-2026-110725): first-segment colons in path-only suffix references are now escaped so the output is not reparsed as a scheme.

Upgrade with:

npm install fast-uri@3.1.9

Thanks to @​zekth for reporting the scheme, host, and relative-reference issues, and to @​UlisesGascon for finding the suffix-reference issue and reviewing the remediations.

What's Changed

Full Changelog: fastify/fast-uri@v3.1.8...v3.1.9

Commits
  • 0def703 Bumped v3.1.9
  • a1d0da2 test: generate only relative path references
  • 9eb8759 fix: preserve relative paths in suffix and relative resolution
  • 54c30f7 docs: note suffix-reference authority ambiguity
  • 39e6493 fix: escape a first-segment colon in suffix references
  • 745183c test: cover first-segment colon in suffix references
  • ddfc6a5 fix(SEC-03): reject non reg-name characters in domain hosts
  • d86a8d2 fix: keep a colon-first segment behind "./" in relative normalization
  • eb483b5 test: cover colon-first relative references in normalization
  • b110a35 fix(SEC-02): preserve meaning of relative references during normalization
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for fast-uri since your current version.


Updates http-cache-semantics from 4.1.1 to 4.3.0

Commits

Updates katex from 0.16.45 to 0.18.10

Release notes

Sourced from katex's releases.

v0.18.10

0.18.10 (2026-09-30)

Features

  • make KaTeX fallback to browsr math font before Times New Roman (#4298) (a477b2e)

v0.18.9

0.18.9 (2026-09-23)

Features

v0.18.8

0.18.8 (2026-09-23)

Bug Fixes

v0.18.7

0.18.7 (2026-09-06)

Features

v0.18.6

0.18.6 (2026-09-05)

Bug Fixes

  • array: preserve tags on empty final rows (#4277) (02d552c)

v0.18.5

0.18.5 (2026-08-31)

Bug Fixes

v0.18.4

0.18.4 (2026-08-10)

... (truncated)

Changelog

Sourced from katex's changelog.

0.18.10 (2026-09-30)

Features

  • make KaTeX fallback to browsr math font before Times New Roman (#4298) (a477b2e)

0.18.9 (2026-09-23)

Features

0.18.8 (2026-09-23)

Bug Fixes

0.18.7 (2026-09-06)

Features

0.18.6 (2026-09-05)

Bug Fixes

  • array: preserve tags on empty final rows (#4277) (02d552c)

0.18.5 (2026-08-31)

Bug Fixes

0.18.4 (2026-08-10)

Bug Fixes

0.18.3 (2026-08-09)

... (truncated)

Commits
  • 411da70 chore(release): 0.18.10 [ci skip]
  • a477b2e feat: make KaTeX fallback to browsr math font before Times New Roman (#4298)
  • 5a6a8f8 chore(deps): bump github/codeql-action from 4.38.1 to 4.38.2 (#4297)
  • 71a7bc0 chore(release): 0.18.9 [ci skip]
  • aafa187 feat(types): add contrib module declarations (#4250)
  • e749fd1 chore(release): 0.18.8 [ci skip]
  • ddfcc29 fix(array): preserve trailing rows in align (#4283)
  • 96e751c chore(deps): bump github/codeql-action from 4.38.0 to 4.38.1 (#4292)
  • 726c2d4 chore(deps): bump github/codeql-action from 4.37.9 to 4.38.0 (#4287)
  • f71045d chore(deps): update dependency js-yaml to v4.3.2 [security] (#4286)
  • Additional commits viewable in compare view
Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates launch-editor from 2.14.1 to 2.14.2

Commits
  • b533489 v2.14.2
  • f13cd83 fix: check file existence after path resolution (#157)
  • f6e6701 fix: ensure filenames passed to editors are not considered as flags (#156)
  • 3c2f9bf fix: reject paths containing % on windows (#155)
  • ecdfce1 refactor: extract constructWindowsLaunchCommand (#154)
  • 24d5d84 fix: correctly show error when the third parameter is not passed (#153)
  • 7bae9bc refactor: merge statements
  • 571fe00 chore(deps): update actions/setup-node action to v7 (#149)
  • d8ed423 chore(deps): update actions/checkout action to v7 (#148)
  • 75b3e6c fix(deps): update all non-major dependencies (#146)
  • Additional commits viewable in compare view

Updates proxy-addr from 2.0.7 to 2.0.8

Release notes

Sourced from proxy-addr's releases.

2.0.8

Important

What's Changed

New Contributors

Full Changelog: jshttp/proxy-addr@v2.0.7...v2.0.8

Changelog

Sourced from proxy-addr's changelog.

2.0.8

Commits
  • a11ad82 2.0.8 (#70)
  • 780911d fix: reject IPv4 trust via mapped IPv6 subnets with a short prefix
  • 92e103e fix(ci): use publised as release trigger event (#71)
  • 3e5ac75 ci: merge coverage via artifacts, disable fail-fast, add Node.js 23-26 (#69)
  • 4b9db81 chore(ci): npm-publish via workflows (#54)
  • 655e895 build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0 (#39)
  • 50ce4d0 build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 (#45)
  • 0fd347f build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#63)
  • 6a517fa build(deps): bump github/codeql-action from 4.32.4 to 4.36.0 (#64)
  • 0d45e2a Fix "arugment" typo in README (#61)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for proxy-addr since your current version.


Updates shell-quote from 1.10.0 to 1.12.0

Changelog

Sourced from shell-quote's changelog.

v1.12.0 - 2026-10-02

Fixed

Commits

  • [New] parse: support tab-stripping here-documents (<<-) dbfac37
  • [New] parse: support output process substitution (>() 2053315
  • [New] parse: support the case test-next terminator (;;&) 7d688b9
  • [New] parse: support the case fall-through terminator (;&) f27010e
  • [New] parse: support redirecting output despite noclobber (>|) b78d19c
  • [New] parse: support opening a file for reading and writing (<>) 21cc333
  • [New] parse: support redirecting stdout and stderr (&>) 6ad6cd2
  • [New] parse: support appending stdout and stderr (&>>) 90cde9c
  • [Dev Deps] update @ljharb/eslint-config 3a7b4ae

v1.11.0 - 2026-09-29

Fixed

Commits

  • [Fix] quote: reject line terminators in tokens after a comment 6002b2e
  • [Fix] parse: preserve text after special shell parameters 81b08a5
  • [Fix] parse: an escaped backslash does not escape the character after it d708019
  • [Fix] quote: preserve ! in arguments that also contain ' ad39927
  • [Fix] parse: treat $_name as a variable name, not $_ followed by text 28f88cd
  • [Fix] quote: preserve empty glob patterns 35c9b97
  • [Fix] quote: escape ~ in glob patterns to prevent shell tilde-expansion 239d49c
  • [Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint, evalmd b1e406e
  • [meta] npmignore some files ebfc308
  • [actions] add permissions 3429b0d
  • [actions] set least-privilege cache-mode 36f2394
  • [Dev Deps] update eslint 6de9a41
Commits
  • 6ecb8aa v1.12.0
  • 3a7b4ae [Dev Deps] update @ljharb/eslint-config
  • 7d688b9 [New] parse: support the case test-next terminator (;;&)
  • f27010e [New] parse: support the case fall-through terminator (;&)
  • 90cde9c [New] parse: support appending stdout and stderr (&>>)
  • 6ad6cd2 [New] parse: support redirecting stdout and stderr (&>)
  • 2053315 [New] parse: support output process substitution (>()
  • b78d19c [New] parse: support redirecting output despite noclobber (>|)
  • 21cc333 [New] parse: support opening a file for reading and writing (\<>)
  • dbfac37 [New] parse: support tab-stripping here-documents (<<-)
  • Additional commits viewable in compare view

Updates source-map-js from 1.2.1 to 1.2.2

Release notes

Sourced from source-map-js's releases.

v1.2.2

Changelog

Sourced from source-map-js's changelog.

1.2.2

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the npm_and_yarn group with 1 update in the / directory: [follow-redirects](https://github.com/follow-redirects/follow-redirects).
Bumps the npm_and_yarn group with 10 updates in the /website directory:

| Package | From | To |
| --- | --- | --- |
| [follow-redirects](https://github.com/follow-redirects/follow-redirects) | `1.16.0` | `1.16.1` |
| [body-parser](https://github.com/expressjs/body-parser) | `1.20.8` | `1.20.9` |
| [compression](https://github.com/expressjs/compression) | `1.8.1` | `1.8.2` |
| [fast-uri](https://github.com/fastify/fast-uri) | `3.1.8` | `3.1.9` |
| [http-cache-semantics](https://github.com/kornelski/http-cache-semantics) | `4.1.1` | `4.3.0` |
| [katex](https://github.com/KaTeX/KaTeX) | `0.16.45` | `0.18.10` |
| [launch-editor](https://github.com/vitejs/launch-editor) | `2.14.1` | `2.14.2` |
| [proxy-addr](https://github.com/jshttp/proxy-addr) | `2.0.7` | `2.0.8` |
| [shell-quote](https://github.com/ljharb/shell-quote) | `1.10.0` | `1.12.0` |
| [source-map-js](https://github.com/7rulnik/source-map-js) | `1.2.1` | `1.2.2` |



Updates `follow-redirects` from 1.16.0 to 1.16.1
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](follow-redirects/follow-redirects@v1.16.0...v1.16.1)

Updates `follow-redirects` from 1.16.0 to 1.16.1
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](follow-redirects/follow-redirects@v1.16.0...v1.16.1)

Updates `body-parser` from 1.20.8 to 1.20.9
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/1.20.9/HISTORY.md)
- [Commits](expressjs/body-parser@1.20.8...1.20.9)

Updates `compression` from 1.8.1 to 1.8.2
- [Release notes](https://github.com/expressjs/compression/releases)
- [Changelog](https://github.com/expressjs/compression/blob/master/HISTORY.md)
- [Commits](expressjs/compression@v1.8.1...v1.8.2)

Updates `fast-uri` from 3.1.8 to 3.1.9
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.8...v3.1.9)

Updates `http-cache-semantics` from 4.1.1 to 4.3.0
- [Commits](https://github.com/kornelski/http-cache-semantics/commits)

Updates `katex` from 0.16.45 to 0.18.10
- [Release notes](https://github.com/KaTeX/KaTeX/releases)
- [Changelog](https://github.com/KaTeX/KaTeX/blob/main/CHANGELOG.md)
- [Commits](KaTeX/KaTeX@v0.16.45...v0.18.10)

Updates `launch-editor` from 2.14.1 to 2.14.2
- [Commits](vitejs/launch-editor@v2.14.1...v2.14.2)

Updates `proxy-addr` from 2.0.7 to 2.0.8
- [Release notes](https://github.com/jshttp/proxy-addr/releases)
- [Changelog](https://github.com/jshttp/proxy-addr/blob/master/HISTORY.md)
- [Commits](jshttp/proxy-addr@v2.0.7...v2.0.8)

Updates `shell-quote` from 1.10.0 to 1.12.0
- [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md)
- [Commits](ljharb/shell-quote@v1.10.0...v1.12.0)

Updates `source-map-js` from 1.2.1 to 1.2.2
- [Release notes](https://github.com/7rulnik/source-map-js/releases)
- [Changelog](https://github.com/7rulnik/source-map-js/blob/main/CHANGELOG.md)
- [Commits](7rulnik/source-map-js@v1.2.1...v1.2.2)

---
updated-dependencies:
- dependency-name: follow-redirects
  dependency-version: 1.16.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: follow-redirects
  dependency-version: 1.16.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: body-parser
  dependency-version: 1.20.9
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: compression
  dependency-version: 1.8.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fast-uri
  dependency-version: 3.1.9
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: http-cache-semantics
  dependency-version: 4.3.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: katex
  dependency-version: 0.18.10
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: launch-editor
  dependency-version: 2.14.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: proxy-addr
  dependency-version: 2.0.8
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: shell-quote
  dependency-version: 1.12.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: source-map-js
  dependency-version: 1.2.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@vercel

vercel Bot commented Oct 24, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
soql.beyondthecloud.dev Ready Ready Preview Oct 24, 2026 12:14pm UTC

Request Review

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 24, 2026
@github-actions

Copy link
Copy Markdown

🚀 Salesforce CI

⏭️ Deployment skipped

An earlier step failed (scratch org creation or Dev Hub authorization), so nothing was deployed. Check the workflow logs.

📦 Workflow run, logs and artifacts


🤖 Automated comment by Salesforce CI

@pgajek2
pgajek2 merged commit 0ff50dc into main Oct 24, 2026
2 of 3 checks passed
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/npm_and_yarn-76881050ff branch October 24, 2026 16:25

This branch was successfully deployed

1 active deployment
Preview — bedbdfd7 Deployed Oct 24, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant