Bump the npm_and_yarn group across 1 directory with 7 updates by dependabot[bot] · Pull Request #17 · sthj7319-bit/CopilotForXcode

dependabot · 2026-09-05T17:09:26Z

Bumps the npm_and_yarn group with 7 updates in the /Server directory:

Package	From	To
webpack	`5.99.9`	`5.110.3`
fast-uri	`3.0.6`	`3.1.7`
picomatch	`4.0.2`	`4.0.7`
picomatch	`2.3.1`	`2.3.2`
nanoid	`3.3.11`	`3.3.18`
postcss	`8.5.3`	`8.5.28`
postcss-selector-parser	`7.1.0`	`7.1.6`
serialize-javascript	`6.0.2`	`7.1.1`

Updates webpack from 5.99.9 to 5.110.3

Release notes

Sourced from webpack's releases.

v5.110.3

Patch Changes

Fix import() options, circular reexport severity and namespace writes. (by @alexander-akait in #21867)

Skip ESM interop when require() targets a module outside the concatenation. (by @hai-x in #21884)

Fix concatenated require() in a require.ensure callback or a computed request. (by @hai-x in #21907)

Keep optimization.minimize a boolean; its options move to minimizeOptions. (by @alexander-akait in #21886)

Fix mangled exports read through require() and a leaked internal reference. (by @alexander-akait in #21905)

Fix new on a default import of a wrapped CommonJS module. (by @alexander-akait in #21876)

Throw when a deferred namespace of an async module is forced while it evaluates. (by @alexander-akait in #21871)

Do not report a missing export for a name a side-effect-free barrel defers. (by @alexander-akait in #21874)

Fix queue, URL scheme, dotenv, HTTP module and persistent cache edge cases. (by @alexander-akait in #21901)

Evaluate a deferred import's async dependencies where the import sits. (by @alexander-akait in #21902)

Omit ambiguous export * names from the module namespace. (by @alexander-akait in #21878)

v5.110.2

Patch Changes

Fix analyzable ESM baking around cycles, mixed-served wasm and style url maps. (by @alexander-akait in #21851)

Minify more HTML and CSS shorthands, and cut two costs off printing. (by @alexander-akait in #21842)

Report a named import that is never read when it names a missing export. (by @alexander-akait in #21856)

Fix ESM circular reexports, cyclic const TDZ, and defer evaluation order. (by @alexander-akait in #21852)

Stop output.html emitting an unused JS chunk for each generated page. (by @alexander-akait in #21859)

Stop emitting the CSS chunk loading runtime when every CSS chunk is initial. (by @alexander-akait in #21862)

Strip a BOM a loader put on a string, and shift a source map that counted it. (by @alexander-akait in #21857)

v5.110.1

Patch Changes

Fix a capture-group-less snapshot.managedPaths RegExp; speed up cache writes. (by @alexander-akait in #21843)

Throw SyntaxError, or WebAssembly.CompileError, from an unparsable module. (by @alexander-akait in #21847)

Accept the optimization.minimize: true shorthand set by a plugin in apply(). (by @AgentEnder in #21845)

... (truncated)

Changelog

Sourced from webpack's changelog.

5.110.3

Patch Changes

Fix import() options, circular reexport severity and namespace writes. (by @alexander-akait in #21867)

Skip ESM interop when require() targets a module outside the concatenation. (by @hai-x in #21884)

Fix concatenated require() in a require.ensure callback or a computed request. (by @hai-x in #21907)

Keep optimization.minimize a boolean; its options move to minimizeOptions. (by @alexander-akait in #21886)

Fix mangled exports read through require() and a leaked internal reference. (by @alexander-akait in #21905)

Fix new on a default import of a wrapped CommonJS module. (by @alexander-akait in #21876)

Throw when a deferred namespace of an async module is forced while it evaluates. (by @alexander-akait in #21871)

Do not report a missing export for a name a side-effect-free barrel defers. (by @alexander-akait in #21874)

Fix queue, URL scheme, dotenv, HTTP module and persistent cache edge cases. (by @alexander-akait in #21901)

Evaluate a deferred import's async dependencies where the import sits. (by @alexander-akait in #21902)

Omit ambiguous export * names from the module namespace. (by @alexander-akait in #21878)

5.110.2

Patch Changes

Fix analyzable ESM baking around cycles, mixed-served wasm and style url maps. (by @alexander-akait in #21851)

Minify more HTML and CSS shorthands, and cut two costs off printing. (by @alexander-akait in #21842)

Report a named import that is never read when it names a missing export. (by @alexander-akait in #21856)

Fix ESM circular reexports, cyclic const TDZ, and defer evaluation order. (by @alexander-akait in #21852)

Stop output.html emitting an unused JS chunk for each generated page. (by @alexander-akait in #21859)

Stop emitting the CSS chunk loading runtime when every CSS chunk is initial. (by @alexander-akait in #21862)

Strip a BOM a loader put on a string, and shift a source map that counted it. (by @alexander-akait in #21857)

5.110.1

Patch Changes

Fix a capture-group-less snapshot.managedPaths RegExp; speed up cache writes. (by @alexander-akait in #21843)

... (truncated)

Commits

a2d7b9c chore(release): new release (#21868)
d6e86c0 test(test262): assert two more errors webpack reports at build time (#21906)
6a963fe fix: keep require() into a concatenation substituted and unmangled (#21905)
e1eb099 fix: concatenated require() in require.ensure callback or computed reques...
8d1ab53 chore: escape literal NUL bytes in Compilation.js (#21904)
5e6c4d7 fix(defer): evaluate async dependencies where the deferred import sits (#21902)
7ea4fa3 fix: handle audited correctness edge cases (#21901)
c50713c fix: keep code generation data per result instead of per NormalModule (#21900)
ebd3be4 docs: document the post-minor stabilization week and out-of-band releases (#2...
80be700 fix(config): keep the resolved optimization.minimize a boolean (#21886)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for webpack since your current version.

Updates fast-uri from 3.0.6 to 3.1.7

Release notes

Sourced from fast-uri's releases.

v3.1.7

⚠️ Security Warning

This is a security release that fixes the following high-severity security advisories:

GHSA-qw65-cvwx-89v3 — authority injection via an unvalidated port in serialize()

GHSA-58mr-gqgx-xq4g — host confusion via unbalanced or misplaced IP-literal brackets

Users of the v3.x release line should upgrade to v3.1.7.

Full Changelog: fastify/fast-uri@v3.1.6...v3.1.7

v3.1.6

⚠️ Security Warning

This release addresses the following high-severity security advisories:

GHSA-5jgf-p345-68v8 — host confusion via skipped IDN canonicalization on scheme-relative references

GHSA-fph4-wmhf-6fwf — server-side request forgery via repeated hostname percent-decoding

GHSA-f65p-4m7j-42xc — server-side request forgery via malformed IPv6 normalization

GHSA-jqff-g426-hqxp — host confusion via percent-encoded scheme normalization

Users of the v3.x release line should upgrade to v3.1.6.

Full Changelog: fastify/fast-uri@v3.1.5...v3.1.6

v3.1.5

⚠️ Security Warning

Fix for GHSA-7p8r-x3mc-p8w7

Full Changelog: fastify/fast-uri@v3.1.4...v3.1.5

v3.1.4

⚠️ Security Release

Fix for GHSA-v2hh-gcrm-f6hx

Full Changelog: fastify/fast-uri@v3.1.3...v3.1.4

v3.1.3

⚠️ Security Release

Fixes: GHSA-4c8g-83qw-93j6

Full Changelog: fastify/fast-uri@v3.1.2...v3.1.3

v3.1.2

⚠️ Security Release

... (truncated)

Commits

412e40a Bumped v3.1.7
9f4c943 fix: backport port and IP-literal validation to v3.x (#216)
1eb3ce4 fix: treat unterminated bracket hosts as reg-names again (#214)
6f970b2 Bumped v3.1.6
d941579 fix: never run IDN canonicalization on bracketed IP literals
c0f0279 test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)
37f3417 Merge commit from fork
607bfbe Merge commit from fork
ae92a4c Merge commit from fork
444ecda Merge commit from fork
Additional commits viewable in compare view

Updates picomatch from 4.0.2 to 4.0.7

Release notes

Sourced from picomatch's releases.

4.0.7

What's Changed

fix: handle terminal globstars in parenthesized patterns by @mrmlnc in micromatch/picomatch#198

Full Changelog: micromatch/picomatch@4.0.6...4.0.7

4.0.6

What's Changed

fix: scan full pattern when tokens are requested by @mrmlnc in micromatch/picomatch#197

fix: return complete pattern parts from scan by @mrmlnc in micromatch/picomatch#199

Full Changelog: micromatch/picomatch@4.0.5...4.0.6

4.0.5

What's Changed

fix: preserve all branches when rewriting risky repeated extglobs by @MerlijnW70 in micromatch/picomatch#182

fix: honor the windows option when matching basenames by @MerlijnW70 in micromatch/picomatch#183

New Contributors

@MerlijnW70 made their first contribution in micromatch/picomatch#182

Full Changelog: micromatch/picomatch@4.0.4...4.0.5

4.0.4

This is a security release fixing several security relevant issues.

What's Changed

Fix for CVE-2026-33671

Fix for CVE-2026-33672

Full Changelog: micromatch/picomatch@4.0.3...4.0.4

4.0.3

What's Changed

fix: exception when glob pattern contains constructor by @Jason3S in micromatch/picomatch#144

New Contributors

@Jason3S made their first contribution in micromatch/picomatch#144

Full Changelog: micromatch/picomatch@4.0.2...4.0.3

Changelog

Sourced from picomatch's changelog.

4.0.7 (2026-08-24)

Fixed

Fixed terminal globstars in parenthesized patterns (#142, e279bd7).

4.0.6 (2026-08-24)

Fixed

scan() now scans the full pattern when tokens are requested, instead of merging the remaining path segments into the final token (#62, 5f5819d).

scan() now returns complete pattern parts, including leading and trailing empty segments, and handles nested and escaped parentheses correctly (#58, f201165).

4.0.5 (2026-07-02)

Fixed

Preserved every branch when safely rewriting repeated extglobs (#182, 6289307).

Honored the windows option when matching basenames (#183, ab8bc4d).

4.0.4 (2026-03-23)

Security

Prevented regular expression denial of service (ReDoS) from crafted repeated or nested extglob quantifiers by safely rewriting or treating risky patterns as literals. The new maxExtglobRecursion option defaults to 0; positive numeric values allow limited nesting, while false disables the safeguard (CVE-2026-33671, 5eceecd).

Prevented inherited object properties from being interpreted as POSIX character classes (CVE-2026-33672, 4516eb5).

4.0.3 (2025-07-15)

Fixed

Avoided an exception when a glob pattern contains constructor (#144, a9e2dd2).

Commits

6bb4067 4.0.7
fdfb155 Merge pull request #198 from micromatch/issue-142
38c6b7a 4.0.6
ada9d3f Merge pull request #199 from micromatch/issue-58
9b74f6f Merge pull request #197 from micromatch/issue-62
f201165 fix: return complete pattern parts from scan
e279bd7 fix: handle terminal globstars in parenthesized patterns
5f5819d fix: scan full pattern when tokens are requested
4f41a8e 4.0.5
02cfc1b Update .verb.md and run verb to generate README documentation
Additional commits viewable in compare view

Updates picomatch from 2.3.1 to 2.3.2

Release notes

Sourced from picomatch's releases.

4.0.7

What's Changed

fix: handle terminal globstars in parenthesized patterns by @mrmlnc in micromatch/picomatch#198

Full Changelog: micromatch/picomatch@4.0.6...4.0.7

4.0.6

What's Changed

fix: scan full pattern when tokens are requested by @mrmlnc in micromatch/picomatch#197

fix: return complete pattern parts from scan by @mrmlnc in micromatch/picomatch#199

Full Changelog: micromatch/picomatch@4.0.5...4.0.6

4.0.5

What's Changed

fix: preserve all branches when rewriting risky repeated extglobs by @MerlijnW70 in micromatch/picomatch#182

fix: honor the windows option when matching basenames by @MerlijnW70 in micromatch/picomatch#183

New Contributors

@MerlijnW70 made their first contribution in micromatch/picomatch#182

Full Changelog: micromatch/picomatch@4.0.4...4.0.5

4.0.4

This is a security release fixing several security relevant issues.

What's Changed

Fix for CVE-2026-33671

Fix for CVE-2026-33672

Full Changelog: micromatch/picomatch@4.0.3...4.0.4

4.0.3

What's Changed

fix: exception when glob pattern contains constructor by @Jason3S in micromatch/picomatch#144

New Contributors

@Jason3S made their first contribution in micromatch/picomatch#144

Full Changelog: micromatch/picomatch@4.0.2...4.0.3

Changelog

Sourced from picomatch's changelog.

4.0.7 (2026-08-24)

Fixed

Fixed terminal globstars in parenthesized patterns (#142, e279bd7).

4.0.6 (2026-08-24)

Fixed

scan() now scans the full pattern when tokens are requested, instead of merging the remaining path segments into the final token (#62, 5f5819d).

scan() now returns complete pattern parts, including leading and trailing empty segments, and handles nested and escaped parentheses correctly (#58, f201165).

4.0.5 (2026-07-02)

Fixed

Preserved every branch when safely rewriting repeated extglobs (#182, 6289307).

Honored the windows option when matching basenames (#183, ab8bc4d).

4.0.4 (2026-03-23)

Security

Prevented regular expression denial of service (ReDoS) from crafted repeated or nested extglob quantifiers by safely rewriting or treating risky patterns as literals. The new maxExtglobRecursion option defaults to 0; positive numeric values allow limited nesting, while false disables the safeguard (CVE-2026-33671, 5eceecd).

Prevented inherited object properties from being interpreted as POSIX character classes (CVE-2026-33672, 4516eb5).

4.0.3 (2025-07-15)

Fixed

Avoided an exception when a glob pattern contains constructor (#144, a9e2dd2).

Commits

6bb4067 4.0.7
fdfb155 Merge pull request #198 from micromatch/issue-142
38c6b7a 4.0.6
ada9d3f Merge pull request #199 from micromatch/issue-58
9b74f6f Merge pull request #197 from micromatch/issue-62
f201165 fix: return complete pattern parts from scan
e279bd7 fix: handle terminal globstars in parenthesized patterns
5f5819d fix: scan full pattern when tokens are requested
4f41a8e 4.0.5
02cfc1b Update .verb.md and run verb to generate README documentation
Additional commits viewable in compare view

Updates nanoid from 3.3.11 to 3.3.18

Release notes

Sourced from nanoid's releases.

3.3.18

Fixed infinite loop on async for React Native (by @OvergrowthBeards-JB).

3.3.17

Fixed infinite loop on zero size.

3.3.16

Fixed infinite loop on negative size (by @greymoth-jp).

3.3.15

Fixed npm provenance error.

3.3.14

Fixed random pool corruption on big ID sizes.

3.3.13

Reduced npm package size.

3.3.12

Fixed breaking Nano ID by requesting big ID.

Changelog

Sourced from nanoid's changelog.

3.3.18

Fixed infinite loop on async for React Native (by @OvergrowthBeards-JB).

3.3.17

Fixed infinite loop on zero size.

3.3.16

Fixed infinite loop on negative size (by @greymoth-jp).

3.3.15

Fixed npm provenance error.

3.3.14

Fixed random pool corruption on big ID sizes.

3.3.13

Reduced npm package size.

3.3.12

Fixed breaking Nano ID by requesting big ID.

Commits

9ad9805 Release 3.3.18 version
55e50a0 Update CI action
e10f8d4 Update index.native.js (#606)
73d6716 Release 3.3.17 version
f9d13f1 Sync 0 size behaviour with PostCSS 5
9760e11 Release 3.3.16 version
e835c9b fix(non-secure): clamp negative size to prevent infinite loop (#601)
96dd086 Update CI action
ba0bc3b Do not create latest release for v3
6819724 Release 3.3.15 version
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nanoid since your current version.

Updates postcss from 8.5.3 to 8.5.28

Release notes

Sourced from postcss's releases.

8.5.28

Fixes types regression.

8.5.27

Fixed removing any comments starting with /*# (by @dylanpulver).

Fixed * hack before a comment in Custom Properties (by @Jaybhade).

Fixed empty values in the middle of list.comma() (by @MahinAnowar).

Fixed whitespace-only values in list.space() (by @MahinAnowar).

Fixed rule’s end position on space before semicolon (by @maximilliangrand).

Fixed types (by @romainmenke).

Fixed Chinese text in deprecation warning (by @Jesse205).

8.5.26

Fixed list.split() regression (by @lazerg).

Track symlinks in path protection in source map loading (by @drengir1).

8.5.25

Fixed 8.5.17 visitor regression.

Fixed list.split() for non-string values (by @amir-rezaei).

8.5.24

Preserve the BOM after the processing (by @hdimer).

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.28

Fixes types regression.

8.5.27

Fixed removing any comments starting with /*# (by @dylanpulver).

Fixed * hack before a comment in Custom Properties (by @Jaybhade).

Fixed empty values in the middle of list.comma() (by @MahinAnowar).

Fixed whitespace-only values in list.space() (by @MahinAnowar).

Fixed rule’s end position on space before semicolon (by @maximilliangrand).

Fixed types (by @romainmenke).

Fixed Chinese text in deprecation warning (by @Jesse205).

8.5.26

Fixed list.split() regression (by @lazerg).

Track symlinks in path protection in source map loading (by @drengir1).

8.5.25

Fixed 8.5.17 visitor regression.

Fixed list.split() for non-string values (by @amir-rezaei).

8.5.24

Preserve the BOM after the processing (by @hdimer).

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

... (truncated)

Commits

e544bff Release 8.5.28 version
f8fc252 Typo
5039fd7 Add missed release notes
ae40ca4 Release 8.5.27 version
62b1626 Fix linter
1dba938 Update dependencies
3e82edc Keep non-annotation comments when the processor has no plugins (#2150)
6d23bc3 Fix link
508e997 Add GitHub Sponsors link
e993739 Add CodeRabbit sponsor (#2145)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates postcss-selector-parser from 7.1.0 to 7.1.6

Release notes

Sourced from postcss-selector-parser's releases.

7.1.6

fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (GHSA-rj75-hqrm-r3gf, reported by Wayde Shi)

7.1.5

fix: don't treat a non-prefix token before | as a namespace (#324 by @spokodev)

fix: preserve whitespace before a * namespace in attribute selectors (#325 by @spokodev)

fix: TypeError on unclosed [, ( and trailing | (#330 by @theRizwan)

7.1.4

fix: tolerate non-node children when serializing selectors

7.1.3

Improve fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (clone/walk)

7.1.2

Fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (#316 by @MoOx)

v7.1.1

7.1.1

perf: replace startsWith with strict equality (#308)

fix(types): add walkUniversal declaration (#311)

Changelog

Sourced from postcss-selector-parser's changelog.

7.1.6 - 2026-09-03

fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (GHSA-rj75-hqrm-r3gf, reported by Wayde Shi)

7.1.5 - 2026-08-07

fix: don't treat a non-prefix token before | as a namespace (#324 by @spokodev)

fix: preserve whitespace before a * namespace in attribute selectors (#325 by @spokodev)

fix: TypeError on unclosed [, ( and trailing | (#330 by @theRizwan)

7.1.4 - 2026-06-11

fix: tolerate non-node children when serializing selectors

7.1.3 - 2026-06-11

Improve fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (clone/walk)

7.1.2 - 2026-06-09

Fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (#316 by @MoOx)

7.1.1

perf: replace startsWith with strict equality (#308)

fix(types): add walkUniversal declaration (#311)

Commits

4eb3468 7.1.6
62b1917 fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability
e33e9bc 7.1.5
6f4e6c1 fix: TypeError on unclosed [, ( and trailing | (#330)
4d8437f fix: preserve whitespace before a * namespace in attribute selectors (#325)
e2f9029 fix: don't treat a non-prefix token before | as a namespace (#324)
dd50ee1 chore(deps-dev): bump postcss from 8.5.18 to 8.5.23 (#331)
7e3abb2 chore(deps-dev): bump postcss from 8.5.15 to 8.5.18 (#328)
4a7e4e3 7.1.4
e2021c5 fix: tolerate non-node children when serializing selectors
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by moox, a new releaser for postcss-selector-parser since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates serialize-javascript from 6.0.2 to 7.1.1

Release notes

Sourced from serialize-javascript's releases.

v7.1.1

What's Changed

fix: fix XSS bypass via split </script payload across function bodies by @okuryu in yahoo/serialize-javascript#226

release: v7.1.1 by @okuryu in yahoo/serialize-javascript#227

Full Changelog: yahoo/serialize-javascript@v7.1.0...v7.1.1

v7.1.0

What's Changed

feat: add Node.js 26 to test matrix by @okuryu in yahoo/serialize-javascript#224

release: v7.1.0 by @okuryu in yahoo/serialize-javascript#225

Full Changelog: yahoo/serialize-javascript@v7.0.7...v7.1.0

v7.0.7

What's Changed

fix: reject spoofed RegExp objects with non-string source property by @redonkulus in yahoo/serialize-javascript#222

release: v7.0.7 by @okuryu in yahoo/serialize-javascript#223

Full Changelog: yahoo/serialize-javascript@v7.0.6...v7.0.7

v7.0.6

What's Changed

build(deps-dev): bump lodash from 4.17.23 to 4.18.1 by @dependabot[bot] in yahoo/serialize-javascript#215

fix: reject spoofed URL objects with non-string toString() result by @redonkulus in yahoo/serialize-javascript#217

release: v7.0.6 by @okuryu in yahoo/serialize-javascript#221

Full Changelog: yahoo/serialize-javascript@v7.0.5...v7.0.6

v7.0.5

Fixes

Improve robustness and validation for array-like object serialization.

Fix an issue where certain object structures could lead to excessive CPU usage.

For more details, please see GHSA-qj8w-gfj5-8c6v.

v7.0.4

What's Changed

release: v7.0.4 by @okuryu in yahoo/serialize-javascript#211

Full Changelog: yahoo/serialize-javascript@v7.0.3...v7.0.4

v7.0.3

fix(CVE-2020-7660): fix for RegExp.flags and Date.prototype.toISOString (#207) 2e609d0

... (truncated)

Commits

8c8caa7 release: v7.1.1
ffda9f1 fix: fix XSS bypass via split </script payload across function bodies
739145a release: v7.1.0
57865ed feat: add Node.js 26 to test matrix
01bec60 release: v7.0.7
5009715 fix: reject spoofed RegExp objects with non-string source property
153eb43 release: v7.0.6
a83d2cb fix: reject spoofed URL objects with non-string toString() result
451af65 build(deps-dev): bump lodash from 4.17.23 to 4.18.1 (#215)
df3f1c1 release: v7.0.5
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for serialize-javascript since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions...

Description has been truncated

Bumps the npm_and_yarn group with 7 updates in the /Server directory: | Package | From | To | | --- | --- | --- | | [webpack](https://github.com/webpack/webpack) | `5.99.9` | `5.110.3` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.0.6` | `3.1.7` | | [picomatch](https://github.com/micromatch/picomatch) | `4.0.2` | `4.0.7` | | [picomatch](https://github.com/micromatch/picomatch) | `2.3.1` | `2.3.2` | | [nanoid](https://github.com/ai/nanoid) | `3.3.11` | `3.3.18` | | [postcss](https://github.com/postcss/postcss) | `8.5.3` | `8.5.28` | | [postcss-selector-parser](https://github.com/postcss/postcss-selector-parser) | `7.1.0` | `7.1.6` | | [serialize-javascript](https://github.com/yahoo/serialize-javascript) | `6.0.2` | `7.1.1` | Updates `webpack` from 5.99.9 to 5.110.3 - [Release notes](https://github.com/webpack/webpack/releases) - [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md) - [Commits](webpack/webpack@v5.99.9...v5.110.3) Updates `fast-uri` from 3.0.6 to 3.1.7 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.0.6...v3.1.7) Updates `picomatch` from 4.0.2 to 4.0.7 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@4.0.2...4.0.7) Updates `picomatch` from 2.3.1 to 2.3.2 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@4.0.2...4.0.7) Updates `nanoid` from 3.3.11 to 3.3.18 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/3.3.18/CHANGELOG.md) - [Commits](ai/nanoid@3.3.11...3.3.18) Updates `postcss` from 8.5.3 to 8.5.28 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.3...8.5.28) Updates `postcss-selector-parser` from 7.1.0 to 7.1.6 - [Release notes](https://github.com/postcss/postcss-selector-parser/releases) - [Changelog](https://github.com/postcss/postcss-selector-parser/blob/main/CHANGELOG.md) - [Commits](postcss/postcss-selector-parser@v7.1.0...7.1.6) Updates `serialize-javascript` from 6.0.2 to 7.1.1 - [Release notes](https://github.com/yahoo/serialize-javascript/releases) - [Commits](yahoo/serialize-javascript@v6.0.2...v7.1.1) --- updated-dependencies: - dependency-name: webpack dependency-version: 5.110.3 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 4.0.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 2.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: nanoid dependency-version: 3.3.18 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.28 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: postcss-selector-parser dependency-version: 7.1.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: serialize-javascript dependency-version: 7.1.1 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-09-05T17:09:37Z

At the moment we are not accepting contributions to the repository.

Feedback for GitHub Copilot for Xcode can be given in the Copilot community discussions.

dependabot · 2026-09-05T17:09:39Z

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 5, 2026

github-actions Bot closed this Sep 5, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/Server/npm_and_yarn-f69b23851b branch September 5, 2026 17:09

Navigation Menu

Bump the npm_and_yarn group across 1 directory with 7 updates - #17

Bump the npm_and_yarn group across 1 directory with 7 updates#17
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/Server/npm_and_yarn-f69b23851b

dependabot Bot commented on behalf of github Sep 5, 2026

Uh oh!

github-actions Bot commented Sep 5, 2026

Uh oh!

dependabot Bot commented on behalf of github Sep 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 5, 2026

v5.110.3

Patch Changes

v5.110.2

Patch Changes

v5.110.1

Patch Changes

5.110.3

Patch Changes

5.110.2

Patch Changes

5.110.1

Patch Changes

v3.1.7

⚠️ Security Warning

v3.1.6

⚠️ Security Warning

v3.1.5

⚠️ Security Warning

v3.1.4

⚠️ Security Release

v3.1.3

⚠️ Security Release

v3.1.2

⚠️ Security Release

4.0.7

What's Changed

4.0.6

What's Changed

4.0.5

What's Changed

New Contributors

4.0.4

What's Changed

4.0.3

What's Changed

New Contributors

4.0.7 (2026-08-24)

Fixed

4.0.6 (2026-08-24)

Fixed

4.0.5 (2026-07-02)

Fixed

4.0.4 (2026-03-23)

Security

4.0.3 (2025-07-15)

Fixed

4.0.7

What's Changed

4.0.6

What's Changed

4.0.5

What's Changed

New Contributors

4.0.4

What's Changed

4.0.3

What's Changed

New Contributors

4.0.7 (2026-08-24)

Fixed

4.0.6 (2026-08-24)

Fixed

4.0.5 (2026-07-02)

Fixed

4.0.4 (2026-03-23)

Security

4.0.3 (2025-07-15)

Fixed

3.3.18

3.3.17

3.3.16

3.3.15

3.3.14

3.3.13

3.3.12

3.3.18

3.3.17

3.3.16