Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

Comments

Bump the npm_and_yarn group across 3 directories with 10 updates#809

Open
dependabot[bot] wants to merge 1 commit intomaster from
dependabot/npm_and_yarn/api/javascript/gha-cleanup/npm_and_yarn-c2977652b3
Open

Bump the npm_and_yarn group across 3 directories with 10 updates #809
dependabot[bot] wants to merge 1 commit intomaster from
dependabot/npm_and_yarn/api/javascript/gha-cleanup/npm_and_yarn-c2977652b3

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Feb 21, 2026

Bumps the npm_and_yarn group with 4 updates in the /api/javascript/gha-cleanup directory: lodash, cross-spawn, jws and tmp.
Bumps the npm_and_yarn group with 5 updates in the /api/javascript/org-invite directory:

Package From To
lodash 4.17.21 4.17.23
@octokit/plugin-paginate-rest 9.1.0 9.2.2
@octokit/request 8.1.4 8.4.1
jws 3.2.2 3.2.3
tmp 0.0.33 removed

Bumps the npm_and_yarn group with 3 updates in the /graphql/enterprise directory: brace-expansion, dset and js-yaml.

Updates lodash from 4.17.21 to 4.17.23

Commits

Updates cross-spawn from 6.0.5 to 6.0.6

Changelog

Sourced from cross-spawn's changelog.

6.0.6 (2024年11月18日)

Bug Fixes

Commits

Updates jws from 3.2.2 to 3.2.3

Release notes

Sourced from jws's releases.

v3.2.3

Changed

  • Fix advisory GHSA-869p-cjfg-cm3x: createSign and createVerify now require that a non empty secret is provided (via opts.secret, opts.privateKey or opts.key) when using HMAC algorithms.
  • Upgrading JWA version to 1.4.2, addressing a compatibility issue for Node >= 25.
Changelog

Sourced from jws's changelog.

[3.2.3]

Changed

  • Fix advisory GHSA-869p-cjfg-cm3x: createSign and createVerify now require that a non empty secret is provided (via opts.secret, opts.privateKey or opts.key) when using HMAC algorithms.
  • Upgrading JWA version to 1.4.2, adressing a compatibility issue for Node >= 25.

[3.0.0]

Changed

2.0.0 - 2015年01月30日

Changed

  • BREAKING: Default payload encoding changed from binary to utf8. utf8 is a is a more sensible default than binary because many payloads, as far as I can tell, will contain user-facing strings that could be in any language. (6b6de48)

  • Code reorganization, thanks @​fearphage! (7880050)

Added

  • Option in all relevant methods for encoding. For those few users that might be depending on a binary encoding of the messages, this is for them. (6b6de48)
Commits
  • 4f6e73f Merge commit from fork
  • bd0fea5 version 3.2.3
  • 7c3b4b4 Enhance tests for HMAC streaming sign and verify
  • a9b8ed9 Improve secretOrKey initialization in VerifyStream
  • 6707fde Improve secret handling in SignStream
  • See full diff in compare view
Maintainer changes

This version was pushed to npm by julien.wollscheid, a new releaser for jws since your current version.


Removes tmp

Updates lodash from 4.17.21 to 4.17.23

Commits

Updates @octokit/plugin-paginate-rest from 9.1.0 to 9.2.2

Release notes

Sourced from @​octokit/plugin-paginate-rest's releases.

v9.2.2

9.2.2 (2025年02月15日)

Bug Fixes

v9.2.1

9.2.1 (2024年03月01日)

Bug Fixes

  • pkg: pin @octokit/core peerDependency to v5 (#599) (5b84386)

v9.2.0

9.2.0 (2024年02月22日)

Features

  • new /orgs/{org}/organization-roles/{role_id}/teams and /orgs/{org}/organization-roles/{role_id}/users endpoints (#594) (75aeaaf)

v9.1.5

9.1.5 (2023年12月04日)

Bug Fixes

v9.1.4

9.1.4 (2023年11月12日)

Bug Fixes

v9.1.3

9.1.3 (2023年11月09日)

Bug Fixes

v9.1.2

9.1.2 (2023年10月26日)

... (truncated)

Commits
  • e1e4489 fix: ReDos regex vulnerability, reported by @​DayShift (#660)
  • 5b84386 fix(pkg): pin @octokit/core peerDependency to v5 (#599)
  • fa01f94 ci(action): update actions/add-to-project action to v0.6.0 (#598)
  • 75aeaaf feat: new /orgs/{org}/organization-roles/{role_id}/teams and `/orgs/{org}/o...
  • 54d6bcf chore(deps): update dependency prettier to v3.2.5
  • 1bfa2f8 chore(deps): update dependency npm-run-all2 to v6
  • eb4a8fe chore(deps): replace dependency npm-run-all with npm-run-all2 ^5.0.0
  • 11ef779 chore(deps): update dependency esbuild to ^0.20.0
  • 2b6cc98 ci(action): update peter-evans/create-or-update-comment action to v4
  • d7c9de5 chore(deps): update dependency prettier to v3.2.4 (#588)
  • Additional commits viewable in compare view

Updates @octokit/request from 8.1.4 to 8.4.1

Release notes

Sourced from @​octokit/request's releases.

v8.4.1

8.4.1 (2025年02月15日)

Bug Fixes

v8.4.0

8.4.0 (2024年04月09日)

Features

v8.3.1

8.3.1 (2024年04月05日)

Bug Fixes

  • upgrade @octokit/endpoint (4e7127c)

v8.3.0

8.3.0 (2024年04月05日)

Bug Fixes

Features

v8.2.0

8.2.0 (2024年02月09日)

Features

  • add documentation link in error message (#667) (dbfeab2)

v8.1.6

8.1.6 (2023年11月22日)

Bug Fixes

... (truncated)

Commits
  • 356411e fix: ReDos regex vulnerability, reported by @​DayShift (#741)
  • abc4955 feat: re-add redirect request option (#636)
  • 4e7127c fix: upgrade @octokit/endpoint
  • 2e67925 feat(security): Add provenance (#685)
  • 6822e8b fix: upgrade @octokit/types
  • dbfeab2 feat: add documentation link in error message (#667)
  • c013de4 docs: fix spelling errors (#671)
  • 3d22c38 chore(deps): update dependency prettier to v3.2.5
  • 984ec17 chore(deps): update dependency esbuild to ^0.20.0
  • 2a9cf78 ci(action): update peter-evans/create-or-update-comment action to v4
  • Additional commits viewable in compare view

Updates @octokit/request-error from 5.0.1 to 5.1.1

Release notes

Sourced from @​octokit/request-error's releases.

v5.1.1

5.1.1 (2025年02月14日)

Bug Fixes

v5.1.0

5.1.0 (2024年04月05日)

Bug Fixes

  • upgrade @octokit/types to v13 (3af20bd)

Features

Commits

Updates jws from 3.2.2 to 3.2.3

Release notes

Sourced from jws's releases.

v3.2.3

Changed

  • Fix advisory GHSA-869p-cjfg-cm3x: createSign and createVerify now require that a non empty secret is provided (via opts.secret, opts.privateKey or opts.key) when using HMAC algorithms.
  • Upgrading JWA version to 1.4.2, addressing a compatibility issue for Node >= 25.
Changelog

Sourced from jws's changelog.

[3.2.3]

Changed

  • Fix advisory GHSA-869p-cjfg-cm3x: createSign and createVerify now require that a non empty secret is provided (via opts.secret, opts.privateKey or opts.key) when using HMAC algorithms.
  • Upgrading JWA version to 1.4.2, adressing a compatibility issue for Node >= 25.

[3.0.0]

Changed

2.0.0 - 2015年01月30日

Changed

  • BREAKING: Default payload encoding changed from binary to utf8. utf8 is a is a more sensible default than binary because many payloads, as far as I can tell, will contain user-facing strings that could be in any language. (6b6de48)

  • Code reorganization, thanks @​fearphage! (7880050)

Added

  • Option in all relevant methods for encoding. For those few users that might be depending on a binary encoding of the messages, this is for them. (6b6de48)
Commits
  • 4f6e73f Merge commit from fork
  • bd0fea5 version 3.2.3
  • 7c3b4b4 Enhance tests for HMAC streaming sign and verify
  • a9b8ed9 Improve secretOrKey initialization in VerifyStream
  • 6707fde Improve secret handling in SignStream
  • See full diff in compare view
Maintainer changes

This version was pushed to npm by julien.wollscheid, a new releaser for jws since your current version.


Removes tmp

Updates brace-expansion from 1.1.11 to 1.1.12

Release notes

Sourced from brace-expansion's releases.

v1.1.12

  • pkg: publish on tag 1.x c460dbd
  • fmt ccb8ac6
  • Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) c3c73c8

juliangruber/brace-expansion@v1.1.11...v1.1.12

Commits

Updates dset from 3.1.2 to 3.1.4

Release notes

Sourced from dset's releases.

v3.1.3

Patches

  • Add "types" export conditions for TypeScript "nodenext"/"node16" resolution: #40 Thank you @​Akkuma

Full Changelog: lukeed/dset@v3.1.2...v3.1.3

Commits

Updates js-yaml from 4.1.0 to 4.1.1

Changelog

Sourced from js-yaml's changelog.

[4.1.1] - 2025年11月12日

Security

  • Fix prototype pollution issue in yaml merge (<<) operator.
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.
 

Bumps the npm_and_yarn group with 4 updates in the /api/javascript/gha-cleanup directory: [lodash](https://github.com/lodash/lodash), [cross-spawn](https://github.com/moxystudio/node-cross-spawn), [jws](https://github.com/brianloveswords/node-jws) and [tmp](https://github.com/raszi/node-tmp).
Bumps the npm_and_yarn group with 5 updates in the /api/javascript/org-invite directory:
| Package | From | To |
| --- | --- | --- |
| [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.17.23` |
| [@octokit/plugin-paginate-rest](https://github.com/octokit/plugin-paginate-rest.js) | `9.1.0` | `9.2.2` |
| [@octokit/request](https://github.com/octokit/request.js) | `8.1.4` | `8.4.1` |
| [jws](https://github.com/brianloveswords/node-jws) | `3.2.2` | `3.2.3` |
| [tmp](https://github.com/raszi/node-tmp) | `0.0.33` | `removed` |
Bumps the npm_and_yarn group with 3 updates in the /graphql/enterprise directory: [brace-expansion](https://github.com/juliangruber/brace-expansion), [dset](https://github.com/lukeed/dset) and [js-yaml](https://github.com/nodeca/js-yaml).
Updates `lodash` from 4.17.21 to 4.17.23
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.17.23)
Updates `cross-spawn` from 6.0.5 to 6.0.6
- [Changelog](https://github.com/moxystudio/node-cross-spawn/blob/v6.0.6/CHANGELOG.md)
- [Commits](moxystudio/node-cross-spawn@v6.0.5...v6.0.6)
Updates `jws` from 3.2.2 to 3.2.3
- [Release notes](https://github.com/brianloveswords/node-jws/releases)
- [Changelog](https://github.com/auth0/node-jws/blob/master/CHANGELOG.md)
- [Commits](auth0/node-jws@v3.2.2...v3.2.3)
Removes `tmp`
Updates `lodash` from 4.17.21 to 4.17.23
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.17.23)
Updates `@octokit/plugin-paginate-rest` from 9.1.0 to 9.2.2
- [Release notes](https://github.com/octokit/plugin-paginate-rest.js/releases)
- [Commits](octokit/plugin-paginate-rest.js@v9.1.0...v9.2.2)
Updates `@octokit/request` from 8.1.4 to 8.4.1
- [Release notes](https://github.com/octokit/request.js/releases)
- [Commits](octokit/request.js@v8.1.4...v8.4.1)
Updates `@octokit/request-error` from 5.0.1 to 5.1.1
- [Release notes](https://github.com/octokit/request-error.js/releases)
- [Commits](octokit/request-error.js@v5.0.1...v5.1.1)
Updates `jws` from 3.2.2 to 3.2.3
- [Release notes](https://github.com/brianloveswords/node-jws/releases)
- [Changelog](https://github.com/auth0/node-jws/blob/master/CHANGELOG.md)
- [Commits](auth0/node-jws@v3.2.2...v3.2.3)
Removes `tmp`
Updates `brace-expansion` from 1.1.11 to 1.1.12
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@1.1.11...v1.1.12)
Updates `dset` from 3.1.2 to 3.1.4
- [Release notes](https://github.com/lukeed/dset/releases)
- [Commits](lukeed/dset@v3.1.2...v3.1.4)
Updates `js-yaml` from 4.1.0 to 4.1.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.1.1)
---
updated-dependencies:
- dependency-name: lodash
 dependency-version: 4.17.23
 dependency-type: direct:production
 dependency-group: npm_and_yarn
- dependency-name: cross-spawn
 dependency-version: 6.0.6
 dependency-type: indirect
 dependency-group: npm_and_yarn
- dependency-name: jws
 dependency-version: 3.2.3
 dependency-type: indirect
 dependency-group: npm_and_yarn
- dependency-name: tmp
 dependency-version: 
 dependency-type: indirect
 dependency-group: npm_and_yarn
- dependency-name: lodash
 dependency-version: 4.17.23
 dependency-type: direct:production
 dependency-group: npm_and_yarn
- dependency-name: "@octokit/plugin-paginate-rest"
 dependency-version: 9.2.2
 dependency-type: indirect
 dependency-group: npm_and_yarn
- dependency-name: "@octokit/request"
 dependency-version: 8.4.1
 dependency-type: indirect
 dependency-group: npm_and_yarn
- dependency-name: "@octokit/request-error"
 dependency-version: 5.1.1
 dependency-type: indirect
 dependency-group: npm_and_yarn
- dependency-name: jws
 dependency-version: 3.2.3
 dependency-type: indirect
 dependency-group: npm_and_yarn
- dependency-name: tmp
 dependency-version: 
 dependency-type: indirect
 dependency-group: npm_and_yarn
- dependency-name: brace-expansion
 dependency-version: 1.1.12
 dependency-type: indirect
 dependency-group: npm_and_yarn
- dependency-name: dset
 dependency-version: 3.1.4
 dependency-type: indirect
 dependency-group: npm_and_yarn
- dependency-name: js-yaml
 dependency-version: 4.1.1
 dependency-type: indirect
 dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Feb 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants

AltStyle によって変換されたページ (->オリジナル) /