Bump the npm_and_yarn group across 2 directories with 5 updates by dependabot[bot] · Pull Request #1 · ayushmodi001/video_streaming

dependabot · 2026-08-05T17:48:45Z

Bumps the npm_and_yarn group with 3 updates in the / directory: multer, body-parser and brace-expansion.
Bumps the npm_and_yarn group with 1 update in the /frontend directory: vite.

Updates multer from 2.1.1 to 2.2.0

Release notes

Sourced from multer's releases.

v2.2.0

Important

Fix CVE-2026-5038 (GHSA-3p4h-7m6x-2hcm)

Fix CVE-2026-5079 (GHSA-72gw-mp4g-v24j)

What's Changed

chore(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 by @dependabot[bot] in expressjs/multer#1397

chore(deps): bump github/codeql-action from 4.32.4 to 4.36.1 by @dependabot[bot] in expressjs/multer#1409

chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in expressjs/multer#1410

ci: add Node 26 to test matrix by @gameroman in expressjs/multer#1404

Release: 2.2.0 by @UlisesGascon in expressjs/multer#1412

New Contributors

@gameroman made their first contribution in expressjs/multer#1404

Full Changelog: expressjs/multer@v2.1.1...v2.2.0

Changelog

Sourced from multer's changelog.

2.2.0

Fix CVE-2026-5038 (GHSA-3p4h-7m6x-2hcm)

Fix CVE-2026-5079 (GHSA-72gw-mp4g-v24j)

Commits

2e2af08 2.2.0 (#1412)
a192b52 feat: add fieldNestingDepth limit option
9c801c7 fix: clean up in-progress disk writes on abort
0adb21d ci: add Node 26 to test matrix (#1404)
f5e17c3 chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#1410)
de1fefd chore(deps): bump github/codeql-action from 4.32.4 to 4.36.1 (#1409)
67abfc8 chore(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#1397)
See full diff in compare view

Updates body-parser from 2.2.2 to 2.3.0

Release notes

Sourced from body-parser's releases.

v2.3.0

Important: Security

Security fix for CVE-2026-12590 (GHSA-v422-hmwv-36x6)

What's Changed

build(deps): bump actions/download-artifact from 6.0.0 to 7.0.0 by @dependabot[bot] in expressjs/body-parser#681

build(deps): bump actions/checkout from 5.0.0 to 6.0.1 by @dependabot[bot] in expressjs/body-parser#682

build(deps): bump actions/setup-node from 6.0.0 to 6.1.0 by @dependabot[bot] in expressjs/body-parser#683

build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 by @dependabot[bot] in expressjs/body-parser#685

build(deps): bump github/codeql-action from 4.31.2 to 4.31.9 by @dependabot[bot] in expressjs/body-parser#684

perf(urlencoded): move empty-body guard to avoid extra function closure by @Phillip9587 in expressjs/body-parser#647

Improve ESM compatibility by @Phillip9587 in expressjs/body-parser#697

docs: add recommendations for configuring payload limits by @bjohansebas in expressjs/body-parser#699

build(deps): bump actions/setup-node from 6.1.0 to 6.2.0 by @dependabot[bot] in expressjs/body-parser#701

build(deps): bump github/codeql-action from 4.31.10 to 4.32.0 by @dependabot[bot] in expressjs/body-parser#702

build(deps): bump actions/checkout from 6.0.1 to 6.0.2 by @dependabot[bot] in expressjs/body-parser#700

chore: add explicit type commonjs to package.json by @Phillip9587 in expressjs/body-parser#711

deps: update dependencies to latest versions by @Phillip9587 in expressjs/body-parser#708

build(deps): bump actions/download-artifact from 7.0.0 to 8.0.0 by @dependabot[bot] in expressjs/body-parser#712

build(deps): bump github/codeql-action from 4.32.0 to 4.32.4 by @dependabot[bot] in expressjs/body-parser#713

build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0 by @dependabot[bot] in expressjs/body-parser#714

fix: improve limit option validation by @Phillip9587 in expressjs/body-parser#698

build(deps): bump github/codeql-action from 4.32.4 to 4.35.1 by @dependabot[bot] in expressjs/body-parser#719

build(deps): bump actions/setup-node from 6.2.0 to 6.3.0 by @dependabot[bot] in expressjs/body-parser#718

build(deps): bump actions/download-artifact from 8.0.0 to 8.0.1 by @dependabot[bot] in expressjs/body-parser#717

perf: eliminate conditional check in json strict mode hot path by @Phillip9587 in expressjs/body-parser#651

ci: add node.js 26 to text matrix by @Phillip9587 in expressjs/body-parser#726

build(deps): bump actions/setup-node from 6.3.0 to 6.4.0 by @dependabot[bot] in expressjs/body-parser#725

build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 by @dependabot[bot] in expressjs/body-parser#724

build(deps): bump github/codeql-action from 4.35.1 to 4.35.3 by @dependabot[bot] in expressjs/body-parser#723

Upgrade "content-type" by @blakeembrey in expressjs/body-parser#728

refactor: switch to const/let and enable eslint no-var rule by @Phillip9587 in expressjs/body-parser#729

Update outdated reference to MDN docs by @krzysdz in expressjs/body-parser#730

build(deps): bump github/codeql-action from 4.35.3 to 4.36.1 by @dependabot[bot] in expressjs/body-parser#731

build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in expressjs/body-parser#732

chore: updated deps to latest by @Phillip9587 in expressjs/body-parser#733

2.3.0 by @UlisesGascon in expressjs/body-parser#735

New Contributors

@krzysdz made their first contribution in expressjs/body-parser#730

Full Changelog: expressjs/body-parser@v2.2.2...v2.3.0

Changelog

Sourced from body-parser's changelog.

2.3.0 / 2026-06-15

Security fix for GHSA-v422-hmwv-36x6

fix: use static exports instead of lazy getters to improve ESM compatibility

feat: add subpath exports for individual parsers

fix: improve limit option validation (#698)

Invalid limit values (e.g. unparseable strings or NaN) now throw instead of being silently ignored, which previously disabled size limit enforcement

null and undefined fall back to the default 100kb limit

deps:

content-type@^2.0.0

http-errors@^2.0.1

iconv-lite^0.7.2

qs@^6.15.2

raw-body@^3.0.2

type-is@^2.1.0

Commits

d0f2ace 2.3.0 (#735)
7d03f2f chore: updated deps to latest (#733)
8024ba7 build(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#732)
32b4ed4 build(deps): bump github/codeql-action from 4.35.3 to 4.36.1 (#731)
ff0f6b9 docs: update outdated reference to MDN docs (#730)
14d001a refactor: switch to const/let and enable eslint no-var rule (#729)
37f36a2 deps: update content-type and type-is (#728)
e1c244b build(deps): bump github/codeql-action from 4.35.1 to 4.35.3 (#723)
e01087f build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#724)
a7698d3 build(deps): bump actions/setup-node from 6.3.0 to 6.4.0 (#725)
Additional commits viewable in compare view

Updates brace-expansion from 5.0.6 to 5.0.9

Commits

fbcf8ec 5.0.9
f6f3939 test: cover dropping empties when only some prefixes are empty
688a99e Merge commit from fork
c66e5f9 docs: make the maxLength example produce a non-empty result (#137)
473d3e9 Bump linkify-it from 5.0.1 to 5.0.2 (#128)
96a63c0 5.0.8
a1bd339 Merge commit from fork
592a36f Bump tar from 7.5.16 to 7.5.20 (#127)
bd14690 Bump brace-expansion from 2.0.2 to 2.1.2 (#126)
e729ba6 Bump ws from 8.19.0 to 8.21.1 (#124)
Additional commits viewable in compare view

Updates vite from 5.4.21 to 8.2.0

Release notes

Sourced from vite's releases.

create-vite@8.2.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.2.0

Please refer to CHANGELOG.md for details.

v8.2.0

Please refer to CHANGELOG.md for details.

v8.2.0-beta.0

Please refer to CHANGELOG.md for details.

v8.1.5

Please refer to CHANGELOG.md for details.

v8.1.4

Please refer to CHANGELOG.md for details.

v8.1.3

Please refer to CHANGELOG.md for details.

v8.1.2

Please refer to CHANGELOG.md for details.

v8.1.1

Please refer to CHANGELOG.md for details.

create-vite@8.1.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.1.0

Please refer to CHANGELOG.md for details.

v8.1.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.1.0-beta.0

Please refer to CHANGELOG.md for details.

v8.1.0-beta.0

Please refer to CHANGELOG.md for details.

v8.0.16

Please refer to CHANGELOG.md for details.

v8.0.15

Please refer to CHANGELOG.md for details.

v8.0.14

Please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from vite's changelog.

8.2.0 (2026-07-30)

Features

add input to server.fs.allow (#23035) (95a3cda)

bundled-dev: reload once after rebuild instead of via the fallback page (#23106) (b24381d)

bundled-dev: support worker file update accepted by HMR (#23068) (0d04351)

config: include column in config incompatibility location (#23064) (8a24572)

dev: resolve interface name for explicit host in network URLs (#22965) (3ac77d9)

Bug Fixes

bundledDev: print build errors to the terminal when an HMR update fails (#23024) (41c4658)

deps: update all non-major dependencies (#23069) (4c07b74)

hmr: preserve environment snapshot during server restart (#22992) (b1186c3)

importAnalysis: interop imports injected into optimized dep files by plugins (#23029) (8c2a87d)

module-runner: keep stack trace interception working when Object.prototype is frozen (#23073) (599c5b0)

server: strip base in indexHtml module graph lookup (#22932) (fa005d1)

support resolving top-level input option with plugins (#23101) (41df81a)

Documentation

config: correct cacheDir default fallback description (#23060) (aafa103)

Tests

config CJS module vars in ESM case (#23010) (d8cd388)

8.2.0-beta.0 (2026-07-22)

Features

add input option (#22642) (9beae37)

config: warn features incompatible with native loader in bundle loader (#22850) (05302b0)

css: export PostCSS config type for type-safe configs (#22792) (302c755)

dev: label network URLs with their interface name (#22830) (78accc4)

optimizer: support aube lockfile (#22813) (6319827)

optimizer: support nub lockfile (#22891) (65d3604)

update rolldown-related dependencies and use client-side HMR in bundled-dev (#22961) (960e9ef)

wasm: expand test suite, unwrap WebAssembly.Global and enable js-string builtins (#22674) (9e79b51)

Bug Fixes

build: map CSS chunks in chunk import maps (fix #22946) (#22947) (e16ff3a)

config: exclude virtual modules from native config compat check (#22979) (2ced1fe)

css: rewrite urls in OnceExit-injected content (#22983) (abb793e)

deps: update all non-major dependencies (#22985) (04f345b)

deps: update dependency magic-string to v1 (#22998) (c60b4d7)

hmr: remove hot data after prune (#23002) (be96316)

resolve root to real path (#22832) (55bba7b)

Performance Improvements

... (truncated)

Commits

24a611f release: v7.2.4
2d66b7b fix: revert "perf(deps): replace debug with obug (#21107)"
a668014 release: v7.2.3
acfe939 perf(deps): replace debug with obug (#21107)
4f8171e fix(deps): update all non-major dependencies (#21128)
5029720 chore(deps): update rolldown-related dependencies (#21127)
5909efd fix: allow multiple bindCLIShortcuts calls with shortcut merging (#21103)
39a0a15 chore(deps): update rolldown-related dependencies (#21095)
6a34ac3 fix(deps): update all non-major dependencies (#21096)
02ceaec chore(deps): update dependency @rollup/plugin-commonjs to v29 (#21099)
Additional commits viewable in compare view

Updates postcss from 8.5.15 to 8.5.25

Release notes

Sourced from postcss's releases.

8.5.25

Fixed 8.5.17 visitor regression.

Fixed list.split() for non-string values (by @amir-rezaei).

8.5.24

Preserve the BOM after the processing (by @hdimer).

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

Changelog

Sourced from postcss's changelog.

8.5.25

Fixed 8.5.17 visitor regression.

Fixed list.split() for non-string values (by @amir-rezaei).

8.5.24

Preserve the BOM after the processing (by @hdimer).

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

Commits

08c989c Release 8.5.25 version
24f6814 Fix 8.5.17 visitor regression
f2fa53f Add supply chain security requirement to PostCSS plugin guide
10edf0b fix: return empty array for empty string in list.split (#2121)
0ebe8ad Release 8.5.24 version
73218c6 Update dependencies
9a114f6 Preserve the BOM when stringifying (#2119)
9069261 Fix types check
eb9e1fe Release 8.5.23 version
9d19c78 Update dependencies
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the npm_and_yarn group with 3 updates in the / directory: [multer](https://github.com/expressjs/multer), [body-parser](https://github.com/expressjs/body-parser) and [brace-expansion](https://github.com/juliangruber/brace-expansion). Bumps the npm_and_yarn group with 1 update in the /frontend directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). Updates `multer` from 2.1.1 to 2.2.0 - [Release notes](https://github.com/expressjs/multer/releases) - [Changelog](https://github.com/expressjs/multer/blob/main/CHANGELOG.md) - [Commits](expressjs/multer@v2.1.1...v2.2.0) Updates `body-parser` from 2.2.2 to 2.3.0 - [Release notes](https://github.com/expressjs/body-parser/releases) - [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md) - [Commits](expressjs/body-parser@v2.2.2...v2.3.0) Updates `brace-expansion` from 5.0.6 to 5.0.9 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v5.0.6...v5.0.9) Updates `vite` from 5.4.21 to 8.2.0 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/create-vite@8.2.0/packages/vite) Updates `postcss` from 8.5.15 to 8.5.25 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.15...8.5.25) --- updated-dependencies: - dependency-name: multer dependency-version: 2.2.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: body-parser dependency-version: 2.3.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 5.0.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 8.2.0 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.25 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 5, 2026

Navigation Menu

Bump the npm_and_yarn group across 2 directories with 5 updates - #1

Bump the npm_and_yarn group across 2 directories with 5 updates#1
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/npm_and_yarn-48d7a86d5c

dependabot Bot commented on behalf of github Aug 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Aug 5, 2026

v2.2.0

Important

What's Changed

New Contributors

2.2.0

v2.3.0

Important: Security

What's Changed

New Contributors

2.3.0 / 2026-06-15

create-vite@8.2.0

plugin-legacy@8.2.0

v8.2.0

v8.2.0-beta.0

v8.1.5

v8.1.4

v8.1.3

v8.1.2

v8.1.1

create-vite@8.1.0

plugin-legacy@8.1.0

v8.1.0

plugin-legacy@8.1.0-beta.0

v8.1.0-beta.0

v8.0.16

v8.0.15

v8.0.14

8.2.0 (2026-07-30)

Features

Bug Fixes

Documentation

Tests

8.2.0-beta.0 (2026-07-22)

Features

Bug Fixes

Performance Improvements

8.5.25

8.5.24

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.17

8.5.16

8.5.25

8.5.24

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.17

8.5.16

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants