Bump the npm_and_yarn group across 2 directories with 5 updates by dependabot[bot] · Pull Request #179 · ArchiDevil/hat

dependabot · 2026-04-05T10:34:59Z

Bumps the npm_and_yarn group with 5 updates in the /frontend directory:

Package	From	To
brace-expansion	`2.0.2`	`2.0.3`
flatted	`3.3.2`	`3.4.2`
picomatch	`4.0.3`	`4.0.4`
undici	`7.22.0`	`7.24.7`
yaml	`2.8.2`	`2.8.3`

Bumps the npm_and_yarn group with 3 updates in the /generator directory: brace-expansion, flatted and picomatch.

Updates brace-expansion from 2.0.2 to 2.0.3

Commits

73b5459 2.0.3
311ac0d Backport fix for GHSA-f886-m6hf-6m8v to v2 (#96)
See full diff in compare view

Updates flatted from 3.3.2 to 3.4.2

Commits

3bf0909 3.4.2
885ddcc fix CWE-1321
0bdba70 added flatted-view to the benchmark
2a02dce 3.4.1
fba4e8f Merge pull request #89 from WebReflection/python-fix
5fe8648 added "when in Rome" also a test for PHP
53517ad some minor improvement
b3e2a0c Fixing recursion issue in Python too
c4b46db Add SECURITY.md for security policy and reporting
f86d071 Create dependabot.yml for version updates
Additional commits viewable in compare view

Updates picomatch from 4.0.3 to 4.0.4

Release notes

Sourced from picomatch's releases.

4.0.4

This is a security release fixing several security relevant issues.

What's Changed

Fix for CVE-2026-33671

Fix for CVE-2026-33672

Full Changelog: micromatch/picomatch@4.0.3...4.0.4

Commits

e5474fc Publish 4.0.4
4516eb5 Merge commit from fork
5eceecd Merge commit from fork
0db7dd7 Run benchmark again against latest minimatch version (#161)
9500377 docs: clarify what brace expansion syntax is and isn't supported (#134)
2661f23 fix typo in globstars.js test name (#138)
1798b07 docs: fix makeRe example (#143)
9d76bc5 chore: undocument removed options (#146)
e4d718b Remove unused time-require (#160)
38dffeb chore(deps): pin dependencies (#158)
Additional commits viewable in compare view

Updates undici from 7.22.0 to 7.24.7

Release notes

Sourced from undici's releases.

v7.24.7

What's Changed

docs: update broken links in file "Dispatcher.md" by @samuel871211 in nodejs/undici#4924

doc: remove unused parameter redirectionLimitReached by @samuel871211 in nodejs/undici#4933

test: skip flaky macOS Node 20 cookie fetch cases by @mcollina in nodejs/undici#4932

fix(types): align Response with DOM fetch types by @theamodhshetty in nodejs/undici#4867

fix(types): Fix clone method type declaration to be an instance method rather than instance property by @mistval in nodejs/undici#4925

test: skip IPv6 tests when IPv6 is not available by @mcollina in nodejs/undici#4939

fix: correctly handle multi-value rawHeaders in fetch by @mcollina in nodejs/undici#4938

ignore AGENTS.md by @mcollina in nodejs/undici#4942

New Contributors

@samuel871211 made their first contribution in nodejs/undici#4924

@mistval made their first contribution in nodejs/undici#4925

Full Changelog: nodejs/undici@v7.24.6...v7.24.7

v7.24.6

What's Changed

fix(test): client wasm compatible with clang 22 by @rozzilla in nodejs/undici#4909

fix(mock): improve error message when intercepts are exhausted by @travisbreaks in nodejs/undici#4912

fix(websocket): support open diagnostics over h2 by @mcollina in nodejs/undici#4921

fix: assume http/https scheme for scheme-less proxy env vars by @travisbreaks in nodejs/undici#4914

fix(cache): check Authorization on request headers per RFC 9111 §3.5 by @metalix2 in nodejs/undici#4911

fix: wrap kConnector call in try/catch to prevent client hang by @veeceey in nodejs/undici#4834

docs: clarify fetch and FormData pairing by @mcollina in nodejs/undici#4922

fix: support Connection header with connection-specific header names per RFC 7230 by @mcollina in nodejs/undici#4775

fix: avoid prototype collisions in parseHeaders by @mcollina in nodejs/undici#4923

build(deps-dev): bump typescript from 5.9.3 to 6.0.2 by @dependabot[bot] in nodejs/undici#4926

test: auto-init WPT submodule by @mcollina in nodejs/undici#4930

New Contributors

@rozzilla made their first contribution in nodejs/undici#4909

@veeceey made their first contribution in nodejs/undici#4834

Full Changelog: nodejs/undici@v7.24.5...v7.24.6

v7.24.5

What's Changed

Formdata tests by @KhafraDev in nodejs/undici#4902

test: add unexpected disconnect guards to more client test files by @samayer12 in nodejs/undici#4844

fix(cache): only apply 1-year deleteAt for immutable responses by @metalix2 in nodejs/undici#4913

New Contributors

@metalix2 made their first contribution in nodejs/undici#4913

Full Changelog: nodejs/undici@v7.24.4...v7.24.5

v7.24.4

What's Changed

... (truncated)

Commits

84f23e2 Bumped v7.24.7 (#4947)
a770b10 ignore AGENTS.md (#4942)
6acd19b fix: correctly handle multi-value rawHeaders in fetch (#4938)
1da1c74 test: skip IPv6 tests when IPv6 is not available (#4939)
04cb773 fix(types): Fix clone method type declaration to be an instance method rather...
5145a7c fix(types): align Response with DOM fetch types (#4867)
ec23620 test: skip flaky macOS Node 20 cookie fetch cases
5559235 doc: remove unused parameter redirectionLimitReached (#4933)
a4e4b84 docs: update broken links in file "Dispatcher.md" (#4924)
38eab36 Bumped v7.24.6 (#4931)
Additional commits viewable in compare view

Updates yaml from 2.8.2 to 2.8.3

Release notes

Sourced from yaml's releases.

v2.8.3

Add trailingComma ToString option for multiline flow formatting (#670)

Catch stack overflow during node composition (1e84ebb)

Commits

ce14587 2.8.3
1e84ebb fix: Catch stack overflow during node composition
6b24090 ci: Include Prettier check in lint action
9424dee chore: Refresh lockfile
d1aca82 Add trailingComma ToString option for multiline flow formatting (#670)
4321509 ci: Drop the branch filter from GitHub PR actions
47207d0 chore: Update docs-slate
5212fae chore: Update docs-slate
See full diff in compare view

Updates brace-expansion from 2.0.2 to 2.0.3

Commits

73b5459 2.0.3
311ac0d Backport fix for GHSA-f886-m6hf-6m8v to v2 (#96)
See full diff in compare view

Updates flatted from 3.3.2 to 3.4.2

Commits

3bf0909 3.4.2
885ddcc fix CWE-1321
0bdba70 added flatted-view to the benchmark
2a02dce 3.4.1
fba4e8f Merge pull request #89 from WebReflection/python-fix
5fe8648 added "when in Rome" also a test for PHP
53517ad some minor improvement
b3e2a0c Fixing recursion issue in Python too
c4b46db Add SECURITY.md for security policy and reporting
f86d071 Create dependabot.yml for version updates
Additional commits viewable in compare view

Updates picomatch from 4.0.3 to 4.0.4

Release notes

Sourced from picomatch's releases.

4.0.4

This is a security release fixing several security relevant issues.

What's Changed

Fix for CVE-2026-33671

Fix for CVE-2026-33672

Full Changelog: micromatch/picomatch@4.0.3...4.0.4

Commits

e5474fc Publish 4.0.4
4516eb5 Merge commit from fork
5eceecd Merge commit from fork
0db7dd7 Run benchmark again against latest minimatch version (#161)
9500377 docs: clarify what brace expansion syntax is and isn't supported (#134)
2661f23 fix typo in globstars.js test name (#138)
1798b07 docs: fix makeRe example (#143)
9d76bc5 chore: undocument removed options (#146)
e4d718b Remove unused time-require (#160)
38dffeb chore(deps): pin dependencies (#158)
Additional commits viewable in compare view

Updates brace-expansion from 1.1.12 to 1.1.13

Commits

73b5459 2.0.3
311ac0d Backport fix for GHSA-f886-m6hf-6m8v to v2 (#96)
See full diff in compare view

Updates flatted from 3.3.1 to 3.4.2

Commits

3bf0909 3.4.2
885ddcc fix CWE-1321
0bdba70 added flatted-view to the benchmark
2a02dce 3.4.1
fba4e8f Merge pull request #89 from WebReflection/python-fix
5fe8648 added "when in Rome" also a test for PHP
53517ad some minor improvement
b3e2a0c Fixing recursion issue in Python too
c4b46db Add SECURITY.md for security policy and reporting
f86d071 Create dependabot.yml for version updates
Additional commits viewable in compare view

Updates picomatch from 2.3.1 to 2.3.2

Release notes

Sourced from picomatch's releases.

4.0.4

This is a security release fixing several security relevant issues.

What's Changed

Fix for CVE-2026-33671

Fix for CVE-2026-33672

Full Changelog: micromatch/picomatch@4.0.3...4.0.4

Commits

e5474fc Publish 4.0.4
4516eb5 Merge commit from fork
5eceecd Merge commit from fork
0db7dd7 Run benchmark again against latest minimatch version (#161)
9500377 docs: clarify what brace expansion syntax is and isn't supported (#134)
2661f23 fix typo in globstars.js test name (#138)
1798b07 docs: fix makeRe example (#143)
9d76bc5 chore: undocument removed options (#146)
e4d718b Remove unused time-require (#160)
38dffeb chore(deps): pin dependencies (#158)
Additional commits viewable in compare view

Updates brace-expansion from 1.1.12 to 1.1.13

Commits

73b5459 2.0.3
311ac0d Backport fix for GHSA-f886-m6hf-6m8v to v2 (#96)
See full diff in compare view

Updates flatted from 3.3.1 to 3.4.2

Commits

3bf0909 3.4.2
885ddcc fix CWE-1321
0bdba70 added flatted-view to the benchmark
2a02dce 3.4.1
fba4e8f Merge pull request #89 from WebReflection/python-fix
5fe8648 added "when in Rome" also a test for PHP
53517ad some minor improvement
b3e2a0c Fixing recursion issue in Python too
c4b46db Add SECURITY.md for security policy and reporting
f86d071 Create dependabot.yml for version updates
Additional commits viewable in compare view

Updates picomatch from 2.3.1 to 2.3.2

Release notes

Sourced from picomatch's releases.

4.0.4

This is a security release fixing several security relevant issues.

What's Changed

Fix for CVE-2026-33671

Fix for CVE-2026-33672

Full Changelog: micromatch/picomatch@4.0.3...4.0.4

Commits

e5474fc Publish 4.0.4
4516eb5 Merge commit from fork
5eceecd Merge commit from fork
0db7dd7 Run benchmark again against latest minimatch version (#161)
9500377 docs: clarify what brace expansion syntax is and isn't supported (#134)
2661f23 fix typo in globstars.js test name (#138)
1798b07 docs: fix makeRe example (#143)
9d76bc5 chore: undocument removed options (#146)
e4d718b Remove unused time-require (#160)
38dffeb chore(deps): pin dependencies (#158)
Additional commits viewable in compare view

ArchiDevil · 2026-04-05T18:53:53Z

@dependabot rebase

Bumps the npm_and_yarn group with 5 updates in the /frontend directory: | Package | From | To | | --- | --- | --- | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `2.0.2` | `2.0.3` | | [flatted](https://github.com/WebReflection/flatted) | `3.3.2` | `3.4.2` | | [picomatch](https://github.com/micromatch/picomatch) | `4.0.3` | `4.0.4` | | [undici](https://github.com/nodejs/undici) | `7.22.0` | `7.24.7` | | [yaml](https://github.com/eemeli/yaml) | `2.8.2` | `2.8.3` | Bumps the npm_and_yarn group with 3 updates in the /generator directory: [brace-expansion](https://github.com/juliangruber/brace-expansion), [flatted](https://github.com/WebReflection/flatted) and [picomatch](https://github.com/micromatch/picomatch). Updates `brace-expansion` from 2.0.2 to 2.0.3 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v2.0.2...v2.0.3) Updates `flatted` from 3.3.2 to 3.4.2 - [Commits](WebReflection/flatted@v3.3.2...v3.4.2) Updates `picomatch` from 4.0.3 to 4.0.4 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@4.0.3...4.0.4) Updates `undici` from 7.22.0 to 7.24.7 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.22.0...v7.24.7) Updates `yaml` from 2.8.2 to 2.8.3 - [Release notes](https://github.com/eemeli/yaml/releases) - [Commits](eemeli/yaml@v2.8.2...v2.8.3) Updates `brace-expansion` from 1.1.12 to 1.1.13 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v2.0.2...v2.0.3) Updates `flatted` from 3.3.1 to 3.4.2 - [Commits](WebReflection/flatted@v3.3.2...v3.4.2) Updates `picomatch` from 2.3.1 to 2.3.2 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@4.0.3...4.0.4) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 2.0.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: flatted dependency-version: 3.4.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 4.0.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 7.24.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: yaml dependency-version: 2.8.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.13 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: flatted dependency-version: 3.4.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 2.3.2 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Apr 5, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/frontend/npm_and_yarn-2c5c2c170e branch from dfbab32 to 03ebeb6 Compare April 5, 2026 18:57

ArchiDevil approved these changes Apr 5, 2026

View reviewed changes

ArchiDevil merged commit 28906ad into master Apr 5, 2026
2 checks passed

ArchiDevil deleted the dependabot/npm_and_yarn/frontend/npm_and_yarn-2c5c2c170e branch April 5, 2026 19:28

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the npm_and_yarn group across 2 directories with 5 updates#179

Bump the npm_and_yarn group across 2 directories with 5 updates#179
ArchiDevil merged 1 commit intomasterfrom
dependabot/npm_and_yarn/frontend/npm_and_yarn-2c5c2c170e

dependabot Bot commented on behalf of github Apr 5, 2026 •

edited

Loading

Uh oh!

ArchiDevil commented Apr 5, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Apr 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

4.0.4

What's Changed

v7.24.7

What's Changed

New Contributors

v7.24.6

What's Changed

New Contributors

v7.24.5

What's Changed

New Contributors

v7.24.4

What's Changed

v2.8.3

4.0.4

What's Changed

4.0.4

What's Changed

4.0.4

What's Changed

Uh oh!

ArchiDevil commented Apr 5, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Apr 5, 2026 •

edited

Loading