Skip to content

chore(deps): bump the all-security-updates group across 2 directories with 17 updates - #673

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/projects/ai/agents/examples/deep-search/frontend/all-security-updates-f080898f21
Open

chore(deps): bump the all-security-updates group across 2 directories with 17 updates#673
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/projects/ai/agents/examples/deep-search/frontend/all-security-updates-f080898f21

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 12, 2026

Copy link
Copy Markdown
Contributor

Bumps the all-security-updates group with 4 updates in the /projects/ai/agents/examples/deep-search/frontend directory: brace-expansion, nanoid, postcss and react-router.
Bumps the all-security-updates group with 14 updates in the /projects/operational-ai-leap/demo_app/ui directory:

Package From To
brace-expansion 2.0.1 2.1.4
brace-expansion 1.1.11 1.1.18
brace-expansion 5.0.7 5.0.9
js-yaml 4.1.0 4.3.1
nanoid 3.3.11 3.3.18
@angular/common 20.3.26 20.3.27
@angular/compiler 20.3.26 20.3.27
axios 1.8.4 1.19.0
engine.io 6.6.4 6.6.9
ip-address 10.2.0 10.5.0
fast-uri 3.1.3 3.1.5
hono 4.12.30 4.13.1
undici 6.27.0 6.28.0
socket.io-parser 4.2.4 4.2.7
webpack-dev-server 5.2.5 5.2.6
ws 8.17.1 8.21.3

Updates brace-expansion from 1.1.13 to 1.1.18

Release notes

Sourced from brace-expansion's releases.

v1.1.15

  • Backport v5.0.6 change to v1 (#111) 0b09384

juliangruber/brace-expansion@v1.1.14...v1.1.15

Commits

Updates nanoid from 3.3.11 to 3.3.18

Release notes

Sourced from nanoid's releases.

3.3.18

3.3.17

  • Fixed infinite loop on zero size.

3.3.16

3.3.15

  • Fixed npm provenance error.

3.3.14

  • Fixed random pool corruption on big ID sizes.

3.3.13

  • Reduced npm package size.

3.3.12

  • Fixed breaking Nano ID by requesting big ID.
Changelog

Sourced from nanoid's changelog.

3.3.18

3.3.17

  • Fixed infinite loop on zero size.

3.3.16

3.3.15

  • Fixed npm provenance error.

3.3.14

  • Fixed random pool corruption on big ID sizes.

3.3.13

  • Reduced npm package size.

3.3.12

  • Fixed breaking Nano ID by requesting big ID.
Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nanoid since your current version.


Updates postcss from 8.5.10 to 8.5.26

Release notes

Sourced from postcss's releases.

8.5.26

  • Fixed list.split() regression (by @​lazerg).
  • Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

  • Fixed 8.5.17 visitor regression.
  • Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

  • Preserve the BOM after the processing (by @​hdimer).

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

8.5.19

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

  • Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

  • Fixed Maximum call stack size exceeded error.
  • Fixed Prototype hijacking for postcss.fromJSON().
  • Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

8.5.15

  • Fixed declaration parsing performance (by @​homanp).

8.5.14

8.5.13

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.26

  • Fixed list.split() regression (by @​lazerg).
  • Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

  • Fixed 8.5.17 visitor regression.
  • Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

  • Preserve the BOM after the processing (by @​hdimer).

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

8.5.19

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

  • Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

  • Fixed Maximum call stack size exceeded error.
  • Fixed Prototype hijacking for postcss.fromJSON().
  • Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.


Updates react-router from 7.13.2 to 7.18.2

Release notes

Sourced from react-router's releases.

v7.18.2

See the changelog for release notes: https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7182

v7.18.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7181

v7.18.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180

v7.17.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7170

v7.16.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7160

v7.15.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7151

v7.15.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7150

v7.14.2

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7142

v7.14.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7141

v7.14.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7140

Changelog

Sourced from react-router's changelog.

v7.18.2

Patch Changes

  • Harden RSC CSRF codepaths. (#15353)

v7.18.1

Patch Changes

  • No changes

v7.18.0

Patch Changes

  • Fix server handler prerender responses when using ssr: false and future.v8_trailingSlashAwareDataRequests: true. Avoids false positive "SPA Mode" detection when serving prerendered paths (#15173)
  • Use the ServerRouter nonce for nonce-aware SSR components when they don't provide their own value so strict CSP pages can load them. (#15170)
  • Use turbo-stream to serialize and deserialize Framework Mode hydration errors (#15175)
  • Precompute route branch matchers to avoid recompiling route path regexes during matching (#15186)
  • Use the constructed request URL host when validating action request origins. (#15185)
  • Remove the un-documented custom error serialization logic from Data Mode SSR built-in hydration flows (#15175)
  • Validate protocols in RSC render redirects (#15177)
  • Consolidate url normalization logic and better handle mixed slashes (#15176)

v7.17.0

Minor Changes

  • Ship a subset of the official documentation inside the react-router package (#15121)
    • Markdown docs are now available in node_modules/react-router/docs, letting AI coding agents and the React Router agent skills read official docs locally
    • Excludes auto-generated API docs (api/), community/ content, and tutorials (tutorials/)

v7.16.0

Minor Changes

  • Stabilize future.unstable_trailingSlashAwareDataRequests as future.v8_trailingSlashAwareDataRequests (#15098)

Patch Changes

  • Disable manifest path when lazy route dicovery is disabled (#15068)

  • Fix browser URL creation to use the configured history window instead of the global window. (#15066)

    • Pass the history/router window through to createBrowserURLImpl so custom window contexts keep the correct URL origin.

  • Fix useNavigation() return type to preserve discriminated union across navigation states (#15095)

  • Widen MetaDescriptor script:ld+json type from LdJsonObject to LdJsonObject | LdJsonObject[] to permit multiple JSON-LD schemas in a single <script type="application/ld+json"> tag emitted by <Meta /> (#15082)

... (truncated)

Commits

Updates brace-expansion from 2.0.1 to 2.1.4

Release notes

Sourced from brace-expansion's releases.

v1.1.15

  • Backport v5.0.6 change to v1 (#111) 0b09384

juliangruber/brace-expansion@v1.1.14...v1.1.15

Commits

Updates brace-expansion from 1.1.11 to 1.1.18

Release notes

Sourced from brace-expansion's releases.

v1.1.15

  • Backport v5.0.6 change to v1 (#111) 0b09384

juliangruber/brace-expansion@v1.1.14...v1.1.15

Commits

Updates brace-expansion from 5.0.7 to 5.0.9

Release notes

Sourced from brace-expansion's releases.

v1.1.15

  • Backport v5.0.6 change to v1 (#111) 0b09384

juliangruber/brace-expansion@v1.1.14...v1.1.15

Commits

Updates js-yaml from 4.1.0 to 4.3.1

Changelog

Sourced from js-yaml's changelog.

4.3.1 - 2026-07-31

Security

  • [backport] Remove quadratic complexity from !!omap duplicate key detection.

4.3.0 - 2026-06-27

Added

  • [backport] Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.

Fixed

  • Restore umd builds back to es5.

Removed

  • [backport] maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

[4.2.0] - 2026-06-01

Added

  • Added docs/safety.md with notes about processing untrusted YAML.
  • Added maxDepth (100) loader option. Not a problem, but gives a better exception instead of RangeError on stack overflow.
  • Added maxMergeSeqLength (20) loader option. Not a problem after merge fix, but an additional restriction for safety.
  • Added sourcemaps to dist/ builds.

Changed

  • Stop resolving numbers with underscores as numeric scalars, #627.
  • Switched dev toolchains to Vite / neostandard.
  • Updated demo.
  • Reorganized tests.
  • dist/ files are no longer kept in the repository.

Fixed

  • Fix parsing of properties on the first implicit block mapping key, #62.
  • Fix trailing whitespace handling when folding flow scalar lines, #307.
  • Reject top-level block scalars without content indentation, #280.
  • Ensure numbers survive round-trip, #737.
  • Fix test coverage for issue #221.
  • Fix flow scalar trailing whitespace folding, #307.
  • Fix digits in YAML named tag handles.

Security

  • Fix potential DoS via quadratic complexity in merge - deduplicate repeated elements (makes sense for malformed files > 10K).

[3.14.2] - 2025-11-15

Security

... (truncated)

Commits
  • 86e91b8 4.3.1 released
  • c3cc4b0 Backport quadratic complexity fix for !!omap
  • 33d05b5 4.3.0 released
  • 663bfab Drop demo publish, to not override new v5 one.
  • 1cb8c7b Add v4-legacy tag for publish
  • 02f27af Restore umd builds back to es5
  • 8be84ed Fix es5 compatibility
  • 59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
  • 6842ef6 doc polish
  • 590dbab 4.2.0 released
  • Additional commits viewable in compare view

Updates nanoid from 3.3.11 to 3.3.18

Release notes

Sourced from nanoid's releases.

3.3.18

3.3.17

  • Fixed infinite loop on zero size.

3.3.16

3.3.15

  • Fixed npm provenance error.

3.3.14

  • Fixed random pool corruption on big ID sizes.

3.3.13

  • Reduced npm package size.

3.3.12

  • Fixed breaking Nano ID by requesting big ID.
Changelog

Sourced from nanoid's changelog.

3.3.18

3.3.17

  • Fixed infinite loop on zero size.

3.3.16

3.3.15

  • Fixed npm provenance error.

3.3.14

  • Fixed random pool corruption on big ID sizes.

3.3.13

  • Reduced npm package size.

3.3.12

  • Fixed breaking Nano ID by requesting big ID.
Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nanoid since your current version.


Updates @angular/common from 20.3.26 to 20.3.27

Release notes

Sourced from @​angular/common's releases.

20.3.27

compiler

Commit Description
fix - 5dbcd0ee16 disallow i18n event attributes
fix - db0d4a1a39 restrict possible event handler check to property names longer than 2 characters

http

Commit Description
fix - a64e2883e9 distinguish repeated transfer cache params

platform-server

Commit Description
fix - 6f80cca0b8 update domino to latest version
Changelog

Sourced from @​angular/common's changelog.

20.3.27 (2026-07-29)

compiler

Commit Type Description
5dbcd0ee16 fix disallow i18n event attributes
db0d4a1a39 fix restrict possible event handler check to property names longer than 2 characters

http

Commit Type Description
a64e2883e9 fix distinguish repeated transfer cache params

platform-server

Commit Type Description
6f80cca0b8 fix update domino to latest version

22.0.8 (2026-07-22)

common

Commit Type Description
c0368f2278 fix preserve crossorigin on image preloads

core

Commit Type Description
8616ba9db6 fix ensure SVG animation attributeName is checked case-insensitively

forms

Commit Type Description
d302c7ab83 fix ensure pending status propagates to the root form in signal forms

http

Commit Type Description
9d40f8aefe fix prevent transfer cache key collisions

migrations

Commit Type Description
388daea2fc fix correctly migrate ngClass with mixed space-separated keys
bb39cda648 fix preserve NgClass import on partial migration

22.0.7 (2026-07-15)

common

Commit Type Description
91e33aa1de fix avoid prototype lookups in date format caches

compiler

... (truncated)

Commits

Updates @angular/compiler from 20.3.26 to 20.3.27

Release notes

Sourced from @​angular/compiler's releases.

20.3.27

compiler

Commit Description
fix - 5dbcd0ee16 disallow i18n event attributes
fix - db0d4a1a39 restrict possible event handler check to property names longer than 2 characters

http

Commit Description
fix - a64e2883e9 distinguish repeated transfer cache params

platform-server

Commit Description
fix - 6f80cca0b8 update domino to latest version
Changelog

Sourced from @​angular/compiler's changelog.

20.3.27 (2026-07-29)

compiler

Commit Type Description
5dbcd0ee16 fix disallow i18n event attributes
db0d4a1a39 fix restrict possible event handler check to property names longer than 2 characters

http

Commit Type Description
a64e2883e9 fix distinguish repeated transfer cache params

platform-server

Commit Type Description
6f80cca0b8 fix update domino to latest version

22.0.8 (2026-07-22)

common

Commit Type Description
c0368f2278 fix preserve crossorigin on image preloads

core

Commit Type Description
8616ba9db6 fix ensure SVG animation attributeName is checked case-insensitively

forms

Commit Type Description
d302c7ab83 fix ensure pending status propagates to the root form in signal forms

http

Commit Type Description
9d40f8aefe fix prevent transfer cache key collisions

migrations

Commit Type Description
388daea2fc fix correctly migrate ngClass with mixed space-separated keys
bb39cda648 fix preserve NgClass import on partial migration

22.0.7 (2026-07-15)

common

Commit Type Description
91e33aa1de fix avoid prototype lookups in date format caches

compiler

... (truncated)

Commits
  • db0d4a1 fix(compiler): restrict possible event handler check to property names longer...
  • 5dbcd0e fix(compiler): disallow i18n event attributes
  • See full diff in compare view

Updates axios from 1.8.4 to 1.19.0

Release notes

Sourced from axios's releases.

v1.19.0 - July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

  • Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

🚀 New Features

  • Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers. (#11043, #11081)
  • Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)
  • HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)

🐛 Bug Fixes

  • Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)
  • Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)
  • Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)
  • Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)
  • URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11024, #11038)
  • Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)
  • Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (#11044, #11059)
  • Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (#11061)
  • Synchronous Interceptors: Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (#11071)

🔧 Maintenance & Chores

  • Dependencies: Updated development and test tooling, the docs fixture's Axios version, and GitHub Actions integrations including Checkout, Setup Node, Setup Deno, and Zizmor. (#11031, #11055, #11056, #11058, #11079, #11080, #11088, #11089, #11090)
  • Build Outputs: Limited sourcemap generation to published minified bundles, removing broken map references from non-minified builds. (#11054)
  • Form Data Internals: Centralized FormData header handling and made the Node.js adapter tolerate getHeaders() returning undefined under the content-only policy. (#11062)
  • Developer Experience: Ignored common local AI-tooling directories and fixed a constant-reassignment crash when the development sandbox serves its root path. (#11032, #11073)
  • Documentation: Updated sponsor information, clarified that baseURL is not a path-security boundary, scoped provenance claims to attested releases, and corrected the configuration-defaults documentation. (#11041, #11068, #11076, #11078)
  • Publishing: Simplified v1 publishing to use the npm version bundled with Node.js 26 and updated package metadata for the 1.19.0 release. (#11083, #11095)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve Axios:

... (truncated)

Changelog

Sourced from axios's changelog.

v1.19.0 — July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

  • Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

🚀 New Features

  • Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers. (#11043, #11081)
  • Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)
  • HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)

🐛 Bug Fixes

  • Form Data Conversion: Limite...

    Description has been truncated

@dependabot
chore(deps): bump the all-security-updates group across 2 directories…
21812c0 
… with 17 updates

Bumps the all-security-updates group with 4 updates in the /projects/ai/agents/examples/deep-search/frontend directory: [brace-expansion](https://github.com/juliangruber/brace-expansion), [nanoid](https://github.com/ai/nanoid), [postcss](https://github.com/postcss/postcss) and [react-router](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router).
Bumps the all-security-updates group with 14 updates in the /projects/operational-ai-leap/demo_app/ui directory:

| Package | From | To |
| --- | --- | --- |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `2.0.1` | `2.1.4` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.11` | `1.1.18` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `5.0.7` | `5.0.9` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.0` | `4.3.1` |
| [nanoid](https://github.com/ai/nanoid) | `3.3.11` | `3.3.18` |
| [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common) | `20.3.26` | `20.3.27` |
| [@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler) | `20.3.26` | `20.3.27` |
| [axios](https://github.com/axios/axios) | `1.8.4` | `1.19.0` |
| [engine.io](https://github.com/socketio/socket.io) | `6.6.4` | `6.6.9` |
| [ip-address](https://github.com/beaugunderson/ip-address) | `10.2.0` | `10.5.0` |
| [fast-uri](https://github.com/fastify/fast-uri) | `3.1.3` | `3.1.5` |
| [hono](https://github.com/honojs/hono) | `4.12.30` | `4.13.1` |
| [undici](https://github.com/nodejs/undici) | `6.27.0` | `6.28.0` |
| [socket.io-parser](https://github.com/socketio/socket.io) | `4.2.4` | `4.2.7` |
| [webpack-dev-server](https://github.com/webpack/webpack-dev-server) | `5.2.5` | `5.2.6` |
| [ws](https://github.com/websockets/ws) | `8.17.1` | `8.21.3` |



Updates `brace-expansion` from 1.1.13 to 1.1.18
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.13...v1.1.18)

Updates `nanoid` from 3.3.11 to 3.3.18
- [Release notes](https://github.com/ai/nanoid/releases)
- [Changelog](https://github.com/ai/nanoid/blob/3.3.18/CHANGELOG.md)
- [Commits](ai/nanoid@3.3.11...3.3.18)

Updates `postcss` from 8.5.10 to 8.5.26
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.10...8.5.26)

Updates `react-router` from 7.13.2 to 7.18.2
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/react-router@7.18.2/packages/react-router/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/react-router@7.18.2/packages/react-router)

Updates `brace-expansion` from 2.0.1 to 2.1.4
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.13...v1.1.18)

Updates `brace-expansion` from 1.1.11 to 1.1.18
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.13...v1.1.18)

Updates `brace-expansion` from 5.0.7 to 5.0.9
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.13...v1.1.18)

Updates `js-yaml` from 4.1.0 to 4.3.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.3.1)

Updates `nanoid` from 3.3.11 to 3.3.18
- [Release notes](https://github.com/ai/nanoid/releases)
- [Changelog](https://github.com/ai/nanoid/blob/3.3.18/CHANGELOG.md)
- [Commits](ai/nanoid@3.3.11...3.3.18)

Updates `@angular/common` from 20.3.26 to 20.3.27
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v20.3.27/packages/common)

Updates `@angular/compiler` from 20.3.26 to 20.3.27
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v20.3.27/packages/compiler)

Updates `axios` from 1.8.4 to 1.19.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.8.4...v1.19.0)

Updates `engine.io` from 6.6.4 to 6.6.9
- [Release notes](https://github.com/socketio/socket.io/releases)
- [Changelog](https://github.com/socketio/socket.io/blob/main/CHANGELOG.md)
- [Commits](https://github.com/socketio/socket.io/compare/engine.io@6.6.4...engine.io@6.6.9)

Updates `ip-address` from 10.2.0 to 10.5.0
- [Release notes](https://github.com/beaugunderson/ip-address/releases)
- [Commits](beaugunderson/ip-address@v10.2.0...v10.5.0)

Updates `fast-uri` from 3.1.3 to 3.1.5
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.3...v3.1.5)

Updates `form-data` from 4.0.2 to 4.0.6
- [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md)
- [Commits](form-data/form-data@v4.0.2...v4.0.6)

Updates `hono` from 4.12.30 to 4.13.1
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.30...v4.13.1)

Updates `undici` from 6.27.0 to 6.28.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.27.0...v6.28.0)

Updates `socket.io-parser` from 4.2.4 to 4.2.7
- [Release notes](https://github.com/socketio/socket.io/releases)
- [Changelog](https://github.com/socketio/socket.io/blob/main/CHANGELOG.md)
- [Commits](https://github.com/socketio/socket.io/compare/socket.io-parser@4.2.4...socket.io-parser@4.2.7)

Updates `webpack-dev-server` from 5.2.5 to 5.2.6
- [Release notes](https://github.com/webpack/webpack-dev-server/releases)
- [Changelog](https://github.com/webpack/webpack-dev-server/blob/v5.2.6/CHANGELOG.md)
- [Commits](webpack/webpack-dev-server@v5.2.5...v5.2.6)

Updates `ws` from 8.17.1 to 8.21.3
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.17.1...8.21.3)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 1.1.18
  dependency-type: indirect
  dependency-group: all-security-updates
- dependency-name: nanoid
  dependency-version: 3.3.18
  dependency-type: indirect
  dependency-group: all-security-updates
- dependency-name: postcss
  dependency-version: 8.5.26
  dependency-type: indirect
  dependency-group: all-security-updates
- dependency-name: react-router
  dependency-version: 7.18.2
  dependency-type: indirect
  dependency-group: all-security-updates
- dependency-name: brace-expansion
  dependency-version: 2.1.4
  dependency-type: indirect
  dependency-group: all-security-updates
- dependency-name: brace-expansion
  dependency-version: 1.1.18
  dependency-type: indirect
  dependency-group: all-security-updates
- dependency-name: brace-expansion
  dependency-version: 5.0.9
  dependency-type: indirect
  dependency-group: all-security-updates
- dependency-name: js-yaml
  dependency-version: 4.3.1
  dependency-type: indirect
  dependency-group: all-security-updates
- dependency-name: nanoid
  dependency-version: 3.3.18
  dependency-type: indirect
  dependency-group: all-security-updates
- dependency-name: "@angular/common"
  dependency-version: 20.3.27
  dependency-type: direct:production
  dependency-group: all-security-updates
- dependency-name: "@angular/compiler"
  dependency-version: 20.3.27
  dependency-type: direct:production
  dependency-group: all-security-updates
- dependency-name: axios
  dependency-version: 1.19.0
  dependency-type: indirect
  dependency-group: all-security-updates
- dependency-name: engine.io
  dependency-version: 6.6.9
  dependency-type: indirect
  dependency-group: all-security-updates
- dependency-name: ip-address
  dependency-version: 10.5.0
  dependency-type: indirect
  dependency-group: all-security-updates
- dependency-name: fast-uri
  dependency-version: 3.1.5
  dependency-type: indirect
  dependency-group: all-security-updates
- dependency-name: form-data
  dependency-version: 4.0.6
  dependency-type: indirect
  dependency-group: all-security-updates
- dependency-name: hono
  dependency-version: 4.13.1
  dependency-type: indirect
  dependency-group: all-security-updates
- dependency-name: undici
  dependency-version: 6.28.0
  dependency-type: indirect
  dependency-group: all-security-updates
- dependency-name: socket.io-parser
  dependency-version: 4.2.7
  dependency-type: indirect
  dependency-group: all-security-updates
- dependency-name: webpack-dev-server
  dependency-version: 5.2.6
  dependency-type: indirect
  dependency-group: all-security-updates
- dependency-name: ws
  dependency-version: 8.21.3
  dependency-type: indirect
  dependency-group: all-security-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file p0 SECURITY labels Aug 12, 2026
@github-actions

github-actions Bot commented Aug 12, 2026

Copy link
Copy Markdown

Super-linter summary

Language Validation result
EDITORCONFIG Pass ✅
GITLEAKS Pass ✅
GIT_COMMITLINT Pass ✅
GIT_MERGE_CONFLICT_MARKERS Pass ✅
JSON Pass ✅
JSON_PRETTIER Pass ✅
SPELL_CODESPELL Pass ✅

All files and directories linted successfully

For more information, see the
GitHub Actions workflow run

Powered by Super-linter

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file p0 SECURITY

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants