Bump the npm_and_yarn group across 1 directory with 14 updates by dependabot[bot] · Pull Request #4159 · CMSgov/design-system

dependabot · 2026-07-21T22:23:03Z

Bumps the npm_and_yarn group with 14 updates in the / directory:

Package	From	To
@babel/core	`7.28.4`	`7.29.6`
vite	`6.4.1`	`6.4.3`
@angular/common	`19.1.3`	`20.3.25`
@angular/compiler	`19.1.3`	`20.3.25`
@angular/core	`19.1.3`	`20.3.25`
astro	`5.16.5`	`7.1.0`
form-data	`3.0.1`	`3.0.5`
svgo	`2.8.0`	`2.8.3`
axios	`1.7.9`	`1.18.1`
ip-address	`9.0.5`	`10.2.0`
multer	`2.0.2`	`2.2.0`
shell-quote	`1.8.1`	`1.10.0`
undici	`7.24.7`	`7.28.0`
websocket-driver	`0.7.4`	`0.7.5`

Updates @babel/core from 7.28.4 to 7.29.6

Release notes

Sourced from @babel/core's releases.

v7.29.6 (2026-05-25)

🐛 Bug Fix

babel-generator

#18014 Catchup source map position in preserveFormat (@nicolo-ribaudo)

babel-core

#18001 [7.x packport]Improve input source map handling (@JLHwung)

babel-core, babel-generator

#17998 Preserve original identifier names from input sourcemaps (#17992) (@Andarist)

Committers: 3

Huáng Jùnliàng (@JLHwung)

Mateusz Burzyński (@Andarist)

Nicolò Ribaudo (@nicolo-ribaudo)

v7.29.5 (2026-05-05)

🏠 Internal

babel-preset-env

Update @babel/* dependencies

v7.29.4 (2026-05-05)

🐛 Bug Fix

babel-plugin-transform-modules-systemjs

#17974 [7.x backport]fix(systemjs): improve module string name support (@JLHwung)

Committers: 1

Huáng Jùnliàng (@JLHwung)

v7.29.3 (2026-04-30)

👓 Spec Compliance

babel-parser

#17923 Support flow extends bound (@JLHwung)

🐛 Bug Fix

babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators

#17931 fix(decorators): replace super within all removed static elements (@JLHwung)

babel-register

#17915 Fix thread synchronization issues in @babel/register (@liuxingbaoyu)

babel-compat-data, babel-plugin-bugfix-safari-rest-destructuring-rhs-array, babel-preset-env

#17788 Add bugfix plugin for Safari array rest destructuring bug (@JLHwung)

💅 Polish

babel-parser

#17782 Improve trailing comma comment handling (@JLHwung)

📝 Documentation

#17847 Replace npmjs.com links with npmx.dev (@nicolo-ribaudo)

... (truncated)

Commits

04ea6b2 v7.29.6
99f498a [7.x packport]Improve input source map handling (#18001)
feba0a3 Preserve original identifier names from input sourcemaps (#17992) (#17998)
aa8394e v7.29.0
ad0d03f [7.x backport] feat: Allow specifying startLine in code frame (#17739)
d7f4008 v7.28.6
e130225 Polish(standalone): improve message on invalid preset/plugin (#17606)
99dcba5 chore: enable some ts-eslint rules (#17592)
c92c491 Improve Unicode handling in code-frame tokenizer (#17589)
d725e39 Add BABEL_7_TO_8_DANGEROUSLY_DISABLE_VERSION_CHECK (#17569)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @babel/core since your current version.

Updates vite from 6.4.1 to 6.4.3

Release notes

Sourced from vite's releases.

v6.4.3

Please refer to CHANGELOG.md for details.

v6.4.2

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

6.4.3 (2026-06-01)

fix: backport #22572, reject windows alternate paths (#22576) (96b0c10), closes #22572 #22576

fix(deps): backport #22571, reject UNC paths for launch-editor-middleware (#22575) (8fed5cf), closes #22571 #22575

6.4.2 (2026-04-06)

fix: apply server.fs check to env transport (#22159) (#22163) (fe28e47), closes #22159 #22163

fix: avoid path traversal with optimize deps sourcemap handler (#22161) (ca4da5d), closes #22161

Commits

6c2c881 release: v6.4.3
96b0c10 fix: backport #22572, reject windows alternate paths (#22576)
8fed5cf fix(deps): backport #22571, reject UNC paths for launch-editor-middleware (#2...
6b3fad0 release: v6.4.2
ca4da5d fix: avoid path traversal with optimize deps sourcemap handler (#22161)
fe28e47 fix: apply server.fs check to env transport (#22159) (#22163)
5487f4f release: v6.4.1
1114b5d fix(dev): trim trailing slash before server.fs.deny check (#20968) (#20969)
f12697c release: v6.4.0
ca6455e feat: allow passing down resolved config to vite's createServer (#20932)
Additional commits viewable in compare view

Updates @angular/common from 19.1.3 to 20.3.25

Release notes

Sourced from @angular/common's releases.

20.3.25

common

Commit Description

Limits date format string length

skip transfer cache for uncacheable HTTP traffic

use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Description

sanitize two-way properties

core

Commit Description

harden TransferState restoration against DOM clobbering

validate lowercase SVG animation attribute names (#69270)

http

Commit Description

preserve empty referrer option in HttpRequest

Rejects non-HTTP(S) URLs in JSONP requests

skip transfer cache for fetch credentialed requests

platform-server

Commit Description

harden platform location origin validation during SSR

deprecate ServerXhr (#69256)

service-worker

Commit Description

Strips sensitive headers on cross-origin redirects

Deprecations

platform-server

XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

20.3.24

platform-server

Commit Description

throw on suspicious URLs and restrict protocol-relative URLs

update domino to latest version

20.3.23

compiler

Commit Description

prevent namespaced SVG elements from being stripped

20.3.22

common

... (truncated)

Changelog

Sourced from @angular/common's changelog.

20.3.25 (2026-06-10)

Deprecations

platform-server

XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

common

Commit Type Description

9f443bc24c fix Limits date format string length

566ad05f20 fix skip transfer cache for uncacheable HTTP traffic

1a62130a6b fix use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Type Description

a68ec702a0 fix sanitize two-way properties

core

Commit Type Description

768a349e6e fix harden TransferState restoration against DOM clobbering

ca48b4728d fix validate lowercase SVG animation attribute names (#69270)

http

Commit Type Description

06be298267 fix preserve empty referrer option in HttpRequest

fa940e1f4d fix Rejects non-HTTP(S) URLs in JSONP requests

e2ef1ce72a fix skip transfer cache for fetch credentialed requests

platform-server

Commit Type Description

49368c1859 fix harden platform location origin validation during SSR

d55c94ad81 refactor deprecate ServerXhr (#69256)

service-worker

Commit Type Description

d65a5f457b fix Strips sensitive headers on cross-origin redirects

22.0.0 (2026-06-03)

Blog post "Announcing Angular v22".

Breaking Changes

compiler

This change will trigger the nullishCoalescingNotNullable and optionalChainNotNullable diagnostics on exisiting projects. You might want to disable those 2 diagnotiscs in your tsconfig temporarily.

data prefixed attribute no-longer bind inputs nor outputs.

The compiler will throw when there a when inputs, outputs or model are binding to the same input/outputs.

in variables will throw in template expressions.

compiler-cli

... (truncated)

Commits

06be298 fix(http): preserve empty referrer option in HttpRequest
9f443bc fix(common): Limits date format string length
fa940e1 fix(http): Rejects non-HTTP(S) URLs in JSONP requests
1a62130 fix(common): use cryptographically secure SHA-256 for transfer cache key gene...
566ad05 fix(common): skip transfer cache for uncacheable HTTP traffic
e2ef1ce fix(http): skip transfer cache for fetch credentialed requests
3d135ce fix(common): add upper bounds for digitsInfo
39a4b4c fix(common): sanitize placeholder
de7b2a6 fix(http): exclude withCredentials requests from transfer cache
4233188 fix(http): skip TransferCache for cookie-bearing requests by default
Additional commits viewable in compare view

Updates @angular/compiler from 19.1.3 to 20.3.25

Release notes

Sourced from @angular/compiler's releases.

20.3.25

common

Commit Description

Limits date format string length

skip transfer cache for uncacheable HTTP traffic

use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Description

sanitize two-way properties

core

Commit Description

harden TransferState restoration against DOM clobbering

validate lowercase SVG animation attribute names (#69270)

http

Commit Description

preserve empty referrer option in HttpRequest

Rejects non-HTTP(S) URLs in JSONP requests

skip transfer cache for fetch credentialed requests

platform-server

Commit Description

harden platform location origin validation during SSR

deprecate ServerXhr (#69256)

service-worker

Commit Description

Strips sensitive headers on cross-origin redirects

Deprecations

platform-server

XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

20.3.24

platform-server

Commit Description

throw on suspicious URLs and restrict protocol-relative URLs

update domino to latest version

20.3.23

compiler

Commit Description

prevent namespaced SVG elements from being stripped

20.3.22

common

... (truncated)

Changelog

Sourced from @angular/compiler's changelog.

20.3.25 (2026-06-10)

Deprecations

platform-server

XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

common

Commit Type Description

9f443bc24c fix Limits date format string length

566ad05f20 fix skip transfer cache for uncacheable HTTP traffic

1a62130a6b fix use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Type Description

a68ec702a0 fix sanitize two-way properties

core

Commit Type Description

768a349e6e fix harden TransferState restoration against DOM clobbering

ca48b4728d fix validate lowercase SVG animation attribute names (#69270)

http

Commit Type Description

06be298267 fix preserve empty referrer option in HttpRequest

fa940e1f4d fix Rejects non-HTTP(S) URLs in JSONP requests

e2ef1ce72a fix skip transfer cache for fetch credentialed requests

platform-server

Commit Type Description

49368c1859 fix harden platform location origin validation during SSR

d55c94ad81 refactor deprecate ServerXhr (#69256)

service-worker

Commit Type Description

d65a5f457b fix Strips sensitive headers on cross-origin redirects

22.0.0 (2026-06-03)

Blog post "Announcing Angular v22".

Breaking Changes

compiler

This change will trigger the nullishCoalescingNotNullable and optionalChainNotNullable diagnostics on exisiting projects. You might want to disable those 2 diagnotiscs in your tsconfig temporarily.

data prefixed attribute no-longer bind inputs nor outputs.

The compiler will throw when there a when inputs, outputs or model are binding to the same input/outputs.

in variables will throw in template expressions.

compiler-cli

... (truncated)

Commits

a68ec70 fix(compiler): sanitize two-way properties
d40acc6 fix(compiler): prevent namespaced SVG <style> elements from being stripped
7ae6381 test(compiler-cli): align ngtsc sanitization expectations with modern DOM sch...
36200bd test(core): update spec files to match 20.3.x limits and actual contexts (#68...
823b37f test(compiler): remove obsolete schema_extractor import (#68926)
e345a58 fix(core): normalize tag names in runtime i18n attribute security context loo...
8f35b18 fix(compiler): normalize tag names with custom namespaces in DomElementSchema...
64a89e9 fix(compiler): sanitize dynamic href and xlink:href bindings on SVG a element...
6404edf fix(compiler): strip namespaced SVG script elements during template compilati...
dc631ef fix(core): support prefix-insensitive DOM schema lookups and compile-time i18...
Additional commits viewable in compare view

Updates @angular/core from 19.1.3 to 20.3.25

Release notes

Sourced from @angular/core's releases.

20.3.25

common

Commit Description

Limits date format string length

skip transfer cache for uncacheable HTTP traffic

use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Description

sanitize two-way properties

core

Commit Description

harden TransferState restoration against DOM clobbering

validate lowercase SVG animation attribute names (#69270)

http

Commit Description

preserve empty referrer option in HttpRequest

Rejects non-HTTP(S) URLs in JSONP requests

skip transfer cache for fetch credentialed requests

platform-server

Commit Description

harden platform location origin validation during SSR

deprecate ServerXhr (#69256)

service-worker

Commit Description

Strips sensitive headers on cross-origin redirects

Deprecations

platform-server

XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

20.3.24

platform-server

Commit Description

throw on suspicious URLs and restrict protocol-relative URLs

update domino to latest version

20.3.23

compiler

Commit Description

prevent namespaced SVG elements from being stripped

20.3.22

common

... (truncated)

Changelog

Sourced from @angular/core's changelog.

20.3.25 (2026-06-10)

Deprecations

platform-server

XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

common

Commit Type Description

9f443bc24c fix Limits date format string length

566ad05f20 fix skip transfer cache for uncacheable HTTP traffic

1a62130a6b fix use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Type Description

a68ec702a0 fix sanitize two-way properties

core

Commit Type Description

768a349e6e fix harden TransferState restoration against DOM clobbering

ca48b4728d fix validate lowercase SVG animation attribute names (#69270)

http

Commit Type Description

06be298267 fix preserve empty referrer option in HttpRequest

fa940e1f4d fix Rejects non-HTTP(S) URLs in JSONP requests

e2ef1ce72a fix skip transfer cache for fetch credentialed requests

platform-server

Commit Type Description

49368c1859 fix harden platform location origin validation during SSR

d55c94ad81 refactor deprecate ServerXhr (#69256)

service-worker

Commit Type Description

d65a5f457b fix Strips sensitive headers on cross-origin redirects

22.0.0 (2026-06-03)

Blog post "Announcing Angular v22".

Breaking Changes

compiler

This change will trigger the nullishCoalescingNotNullable and optionalChainNotNullable diagnostics on exisiting projects. You might want to disable those 2 diagnotiscs in your tsconfig temporarily.

data prefixed attribute no-longer bind inputs nor outputs.

The compiler will throw when there a when inputs, outputs or model are binding to the same input/outputs.

in variables will throw in template expressions.

compiler-cli

... (truncated)

Commits

ca48b47 fix(core): validate lowercase SVG animation attribute names (#69270)
1a62130 fix(common): use cryptographically secure SHA-256 for transfer cache key gene...
49368c1 fix(platform-server): harden platform location origin validation during SSR
566ad05 fix(common): skip transfer cache for uncacheable HTTP traffic
768a349 fix(core): harden TransferState restoration against DOM clobbering
7ae6381 test(compiler-cli): align ngtsc sanitization expectations with modern DOM sch...
6595409 test(core): update golden symbols and host bindings sanitization spec (#68926)
d86e4e7 fix(core): reject script element as a dynamic component host (#68926)
b8f1f72 test(core): remove obsolete blockquote cite host binding tests (#68926)
36200bd test(core): update spec files to match 20.3.x limits and actual contexts (#68...
Additional commits viewable in compare view

Updates astro from 5.16.5 to 7.1.0

Release notes

Sourced from astro's releases.

astro@7.1.0

Minor Changes
#17302 5f4dc03 Thanks @astrobot-houston! - Adds a new deferRender option to the glob() content loader

When set to true, renderable entries (such as Markdown) are not rendered during content sync. Instead, rendering is deferred until the entry is actually rendered in a page, using the same on-demand path that .mdx files already use.

This reduces memory usage during astro build for large collections whose rendered output is much larger than the source — for example, Markdown that uses heavy rehype plugins like rehype-katex. Such builds could previously run out of memory while storing the eagerly-rendered HTML for every entry.
// src/content.config.ts
import { defineCollection } from 'astro:content';
import { glob } from 'astro/loaders';
const docs = defineCollection({
loader: glob({ pattern: '**/*.md', base: 'src/content/docs', deferRender: true }),
});
By default deferRender is false, preserving the existing behavior of rendering entries eagerly during sync so their rendered HTML can be cached across builds.
#17296 30698a2 Thanks @ematipico! - Adds a new experimental collectionStorage option for controlling how the content layer persists its data store

By default, Astro serializes the entire content layer data store to a single file (.astro/data-store.json). For very large content collections, this file can grow large enough to hit platform file-size limits.

Set experimental.collectionStorage: 'chunked' to instead split the data store across many smaller, content-addressed files inside a .astro/data-store/ directory, described by a manifest:
// astro.config.mjs
import { defineConfig } from 'astro/config';
export default defineConfig({
experimental: {
collectionStorage: 'chunked',
},
});
Because each part file is named by a hash of its contents, unchanged parts keep the same name across builds and are not rewritten, and identical parts are deduplicated. The default value is 'single-file', which preserves the current behavior.
#17214 44c4989 Thanks @ematipico! - Adds support for the more specific CSP directives script-src-elem, script-src-attr, style-src-elem, and style-src-attr through a new kind option.

Previously, CSP was only scoped to generic script-src/style-src directives. Now each source or hash can be scoped to a narrower directive — for example, to allow inline style attributes (such as those from define:vars or Shiki) without loosening the policy for your <style> and <link> elements.

Scoping sources and hashes in your config

Each entry in resources and hashes can be an object with a kind property. Depending on whether you use scriptDirective or styleDirective, "element" targets script-src-elem or style-src-elem, "attribute" targets script-src-attr or style-src-attr, and "default" (the same as a bare string or hash) targets script-src or style-src.
// astro.config.mjs

... (truncated)

Changelog

Sourced from astro's changelog.

7.1.0

Minor Changes
#17302 5f4dc03 Thanks @astrobot-houston! - Adds a new deferRender option to the glob() content loader

When set to true, renderable entries (such as Markdown) are not rendered during content sync. Instead, rendering is deferred until the entry is actually rendered in a page, using the same on-demand path that .mdx files already use.

This reduces memory usage during astro build for large collections whose rendered output is much larger than the source — for example, Markdown that uses heavy rehype plugins like rehype-katex. Such builds could previously run out of memory while storing the eagerly-rendered HTML for every entry.
// src/content.config.ts
import { defineCollection } from 'astro:content';
import { glob } from 'astro/loaders';
const docs = defineCollection({
loader: glob({ pattern: '**/*.md', base: 'src/content/docs', deferRender: true }),
});
By default deferRender is false, preserving the existing behavior of rendering entries eagerly during sync so their rendered HTML can be cached across builds.
#17296 30698a2 Thanks @ematipico! - Adds a new experimental collectionStorage option for controlling how the content layer persists its data store

By default, Astro serializes the entire content layer data store to a single file (.astro/data-store.json). For very large content collections, this file can grow large enough to hit platform file-size limits.

Set experimental.collectionStorage: 'chunked' to instead split the data store across many smaller, content-addressed files inside a .astro/data-store/ directory, described by a manifest:
// astro.config.mjs
import { defineConfig } from 'astro/config';
export default defineConfig({
experimental: {
collectionStorage: 'chunked',
},
});
Because each part file is named by a hash of its contents, unchanged parts keep the same name across builds and are not rewritten, and identical parts are deduplicated. The default value is 'single-file', which preserves the current behavior.
#17214 44c4989 Thanks @ematipico! - Adds support for the more specific CSP directives script-src-elem, script-src-attr, style-src-elem, and style-src-attr through a new kind option.

Previously, CSP was only scoped to generic script-src/style-src directives. Now each source or hash can be scoped to a narrower directive — for example, to allow inline style attributes (such as those from define:vars or Shiki) without loosening the policy for your <style> and <link> elements.

Scoping sources and hashes in your config

Each entry in resources and hashes can be an object with a kind property. Depending on whether you use scriptDirective or styleDirective, "element" targets script-src-elem or style-src-elem, "attribute" targets script-src-attr or style-src-attr, and "default" (the same as a bare string or hash) targets script-src or style-src.

... (truncated)

Commits

fdd673c [ci] release (#17387)
d9f99e1 Preserve CSP resource defaults for element directives (#17394)
092da56 Add more escaping for rendered content (#17393)
186a1e7 fix(logger): allows setting in updateConfig() (#17391)
4407483 fix(logger): use console API in JSON logger for cross-runtime compatibility...
16de021 feat(logger): allow passing entrypoint as URL (#17389)
ed71eaf fix(logger): make AstroLoggerDestination not generic (#17390)
30698a2 feat: chunk data store (#17296)
44c4989 feat(csp): support for -elem and -attr directives (#17214)
7db6420 Add --ignore-lock flag to run multiple dev servers (#17331)
Additional commits viewable in compare view

Updates form-data from 3.0.1 to 3.0.5

Changelog

Sourced from form-data's changelog.

v3.0.5 - 2026-06-12

Commits

[Fix] escape CR, LF, and " in field names and filenames 8777e67

[Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint, tape 27c61a5

[Deps] update hasown 6a8a1c6

v3.0.4 - 2025-07-16

Fixed

[Fix] append: avoid a crash on nullish values [#577](https://github.com/form-data/form-data/issues/577)

Commits

[eslint] update linting config f5e7eb0

[meta] add auto-changelog d2eb290

[Tests] handle predict-v8-randomness failures in node < 17 and node > 23 e8c574c

[Fix] Switch to using crypto ran...
Description has been truncated

Bumps the npm_and_yarn group with 14 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) | `7.28.4` | `7.29.6` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `6.4.1` | `6.4.3` | | [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common) | `19.1.3` | `20.3.25` | | [@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler) | `19.1.3` | `20.3.25` | | [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core) | `19.1.3` | `20.3.25` | | [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `5.16.5` | `7.1.0` | | [form-data](https://github.com/form-data/form-data) | `3.0.1` | `3.0.5` | | [svgo](https://github.com/svg/svgo) | `2.8.0` | `2.8.3` | | [axios](https://github.com/axios/axios) | `1.7.9` | `1.18.1` | | [ip-address](https://github.com/beaugunderson/ip-address) | `9.0.5` | `10.2.0` | | [multer](https://github.com/expressjs/multer) | `2.0.2` | `2.2.0` | | [shell-quote](https://github.com/ljharb/shell-quote) | `1.8.1` | `1.10.0` | | [undici](https://github.com/nodejs/undici) | `7.24.7` | `7.28.0` | | [websocket-driver](https://github.com/faye/websocket-driver-node) | `0.7.4` | `0.7.5` | Updates `@babel/core` from 7.28.4 to 7.29.6 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.6/packages/babel-core) Updates `vite` from 6.4.1 to 6.4.3 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v6.4.3/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v6.4.3/packages/vite) Updates `@angular/common` from 19.1.3 to 20.3.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.25/packages/common) Updates `@angular/compiler` from 19.1.3 to 20.3.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.25/packages/compiler) Updates `@angular/core` from 19.1.3 to 20.3.25 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.25/packages/core) Updates `astro` from 5.16.5 to 7.1.0 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/astro@7.1.0/packages/astro) Updates `form-data` from 3.0.1 to 3.0.5 - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v3.0.1...v3.0.5) Updates `svgo` from 2.8.0 to 2.8.3 - [Release notes](https://github.com/svg/svgo/releases) - [Commits](svg/svgo@v2.8.0...v2.8.3) Updates `axios` from 1.7.9 to 1.18.1 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.7.9...v1.18.1) Updates `ip-address` from 9.0.5 to 10.2.0 - [Commits](beaugunderson/ip-address@v9.0.5...v10.2.0) Updates `multer` from 2.0.2 to 2.2.0 - [Release notes](https://github.com/expressjs/multer/releases) - [Changelog](https://github.com/expressjs/multer/blob/main/CHANGELOG.md) - [Commits](expressjs/multer@v2.0.2...v2.2.0) Updates `shell-quote` from 1.8.1 to 1.10.0 - [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md) - [Commits](ljharb/shell-quote@v1.8.1...v1.10.0) Updates `undici` from 7.24.7 to 7.28.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.24.7...v7.28.0) Updates `websocket-driver` from 0.7.4 to 0.7.5 - [Changelog](https://github.com/faye/websocket-driver-node/blob/main/CHANGELOG.md) - [Commits](faye/websocket-driver-node@0.7.4...0.7.5) --- updated-dependencies: - dependency-name: "@angular/common" dependency-version: 20.3.25 dependency-type: direct:production - dependency-name: "@angular/compiler" dependency-version: 20.3.25 dependency-type: direct:production - dependency-name: "@angular/core" dependency-version: 20.3.25 dependency-type: direct:production - dependency-name: "@babel/core" dependency-version: 7.29.6 dependency-type: direct:development - dependency-name: astro dependency-version: 7.1.0 dependency-type: direct:production - dependency-name: axios dependency-version: 1.18.1 dependency-type: indirect - dependency-name: form-data dependency-version: 3.0.5 dependency-type: indirect - dependency-name: ip-address dependency-version: 10.2.0 dependency-type: indirect - dependency-name: multer dependency-version: 2.2.0 dependency-type: indirect - dependency-name: shell-quote dependency-version: 1.10.0 dependency-type: indirect - dependency-name: svgo dependency-version: 2.8.3 dependency-type: indirect - dependency-name: undici dependency-version: 7.28.0 dependency-type: indirect - dependency-name: vite dependency-version: 6.4.3 dependency-type: direct:development - dependency-name: websocket-driver dependency-version: 0.7.5 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 21, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/npm_and_yarn-6cc2c2ec48 branch from aa7451b to dc54dbd Compare July 23, 2026 20:27

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump the npm_and_yarn group across 1 directory with 14 updates - #4159

Bump the npm_and_yarn group across 1 directory with 14 updates#4159
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-6cc2c2ec48

dependabot Bot commented on behalf of github Jul 21, 2026 •

edited

Loading

Scoping sources and hashes in your config

Scoping sources and hashes in your config

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Commit	Description
	Limits date format string length
	skip transfer cache for uncacheable HTTP traffic
	use cryptographically secure SHA-256 for transfer cache key generation

Commit	Description
	harden TransferState restoration against DOM clobbering
	validate lowercase SVG animation attribute names (#69270)

Commit	Description
	preserve empty referrer option in HttpRequest
	Rejects non-HTTP(S) URLs in JSONP requests
	skip transfer cache for fetch credentialed requests

Commit	Description
	harden platform location origin validation during SSR
	deprecate ServerXhr (#69256)

Commit	Description
	throw on suspicious URLs and restrict protocol-relative URLs
	update domino to latest version

Commit	Type	Description
9f443bc24c	fix	Limits date format string length
566ad05f20	fix	skip transfer cache for uncacheable HTTP traffic
1a62130a6b	fix	use cryptographically secure SHA-256 for transfer cache key generation

Commit	Type	Description
768a349e6e	fix	harden TransferState restoration against DOM clobbering
ca48b4728d	fix	validate lowercase SVG animation attribute names (#69270)

Commit	Type	Description
06be298267	fix	preserve empty referrer option in HttpRequest
fa940e1f4d	fix	Rejects non-HTTP(S) URLs in JSONP requests
e2ef1ce72a	fix	skip transfer cache for fetch credentialed requests

Commit	Type	Description
49368c1859	fix	harden platform location origin validation during SSR
d55c94ad81	refactor	deprecate ServerXhr (#69256)

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v7.29.6 (2026-05-25)

🐛 Bug Fix

Committers: 3

v7.29.5 (2026-05-05)

🏠 Internal

v7.29.4 (2026-05-05)

🐛 Bug Fix

Committers: 1

v7.29.3 (2026-04-30)

👓 Spec Compliance

🐛 Bug Fix

💅 Polish

📝 Documentation

v6.4.3

v6.4.2

6.4.3 (2026-06-01)

6.4.2 (2026-04-06)

20.3.25

common

compiler

core

http

platform-server

service-worker

Deprecations

platform-server

20.3.24

platform-server

20.3.23

compiler

20.3.22

common

20.3.25 (2026-06-10)

Deprecations

platform-server

common

compiler

core

http

platform-server

service-worker

22.0.0 (2026-06-03)

Breaking Changes

compiler

compiler-cli

20.3.25

common

compiler

core

http

platform-server

service-worker

Deprecations

platform-server

20.3.24

platform-server

20.3.23

compiler

20.3.22

common

20.3.25 (2026-06-10)

Deprecations

platform-server

common

compiler

core

http

platform-server

service-worker

22.0.0 (2026-06-03)

Breaking Changes

compiler

compiler-cli

20.3.25

common

compiler

dependabot Bot commented on behalf of github Jul 21, 2026 •

edited

Loading