Bump the npm_and_yarn group across 11 directories with 22 updates by dependabot[bot] · Pull Request #16 · endorphinians/web3.js

dependabot · 2026-04-09T10:02:11Z

Bumps the npm_and_yarn group with 16 updates in the / directory:

Package	From	To
bn.js	`5.2.1`	`5.2.3`
webpack	`5.76.0`	`5.106.0`
axios	`0.21.4`	`1.13.5`
@babel/traverse	`7.19.4`	`7.29.0`
js-yaml	`3.14.1`	`3.14.2`
base-x	`3.0.9`	`3.0.11`
braces	`3.0.2`	`3.0.3`
cipher-base	`1.0.4`	`1.0.7`
tmp	`0.2.1`	`0.2.5`
flatted	`3.2.7`	`3.4.2`
handlebars	`4.7.7`	`4.7.9`
min-document	`2.19.0`	`2.19.2`
pbkdf2	`3.1.2`	`3.1.5`
picomatch	`2.3.1`	`2.3.2`
tar-fs	`2.1.1`	`2.1.4`
web3-core-method	`1.9.0`	`1.10.4`

Bumps the npm_and_yarn group with 1 update in the /packages/web3-core directory: web3-core-method.
Bumps the npm_and_yarn group with 1 update in the /packages/web3-core-method directory: web3-core-subscriptions.
Bumps the npm_and_yarn group with 2 updates in the /packages/web3-eth directory: web3-core-method and web3-core-subscriptions.
Bumps the npm_and_yarn group with 4 updates in the /packages/web3-eth-accounts directory: bn.js, cipher-base, pbkdf2 and web3-core-method.
Bumps the npm_and_yarn group with 2 updates in the /packages/web3-eth-contract directory: web3-core-method and web3-core-subscriptions.
Bumps the npm_and_yarn group with 1 update in the /packages/web3-eth-personal directory: web3-core-method.
Bumps the npm_and_yarn group with 1 update in the /packages/web3-eth2-core directory: axios.
Bumps the npm_and_yarn group with 1 update in the /packages/web3-net directory: web3-core-method.
Bumps the npm_and_yarn group with 2 updates in the /packages/web3-shh directory: web3-core-method and web3-core-subscriptions.
Bumps the npm_and_yarn group with 1 update in the /packages/web3-utils directory: bn.js.

Updates bn.js from 5.2.1 to 5.2.3

Changelog

Sourced from bn.js's changelog.

5.2.3 / 2026-02-19

fix: imaskn state (#317)

5.2.2 / 2025-04-25

fix: imuln/muln with zero (#313)

Commits

ea6c072 5.2.3
33df26b fix imaskn state (#317)
6db7c38 5.2.2
c7e1a53 Fix imuln/muln with zero (#313)
4cc0bfa docs: mention the max plain JS number argument value (#307)
5df40f8 Document length unit in toBuffer(...) input (#299)
See full diff in compare view

Updates webpack from 5.76.0 to 5.106.0

Release notes

Sourced from webpack's releases.

v5.106.0

Minor Changes

Add exportType: "style" for CSS modules to inject styles into DOM via HTMLStyleElement, similar to style-loader functionality. (by @xiaoxiaojx in #20579)

Add context option support for VirtualUrlPlugin (by @xiaoxiaojx in #20449)

The context for the virtual module. A string path. Defaults to 'auto', which will try to resolve the context from the module id.

Support custom context path for resolving relative imports in virtual modules

Add examples demonstrating context usage and filename customization

Generate different CssModule instances for different exportType values. (by @xiaoxiaojx in #20590)

Added the localIdentHashFunction option to configure the hash function to be used for hashing. (by @alexander-akait in #20694) Additionally, the localIdentName option can now be a function.

Added support for destructuring assignment require in cjs, allowing for tree shaking. (by @ahabhgk in #20548)

Added the validate option to enable/disable validation in webpack/plugins/loaders, also implemented API to make it inside plugins. (by @xiaoxiaojx in #20275)

Added source support for async WASM modules. (by @magic-akari in #20364)

Patch Changes

Add a static getSourceBasicTypes method to the Module class to prevent errors across multiple versions. (by @xiaoxiaojx in #20614)

Included fragment groups in the conflicting order warning for CSS. (by @aryanraj45 in #20660)

Avoid rendering unused top-level __webpack_exports__ declaration when output ECMA module library. (by @hai-x in #20669)

Fixed resolving in CSS modules. (by @alexander-akait in #20771)

Allow external modules place in async chunks when output ECMA module. (by @hai-x in #20662)

Implement deprecate flag in schema for better TypeScript support to show which options are already deprecated by the configuration (by @bjohansebas in #20432)

Set .name to "default" for anonymous default export functions and classes per ES spec (by @xiaoxiaojx in #20773)

Hash entry chunks after runtime chunks to prevent stale content hash references in watch mode (by @xiaoxiaojx in #20724)

Fix multiple bugs and optimizations in CSS modules: correct third code point position in walkCssTokens number detection, fix multiline CSS comment regex, fix swapped :import/:export error message, fix comma callback incorrectly popping balanced stack, fix cache comparison missing array length check, fix match.index mutation side effect, move publicPathAutoRegex to module scope, precompute merged callbacks in consumeUntil, simplify redundant ternary in CssGenerator, fix typo GRID_TEMPLATE_ARES, remove duplicate grid-column-start, and merge duplicate getCompilationHooks calls. (by @xiaoxiaojx in #20648)

Correct url() path resolution and preserve source maps for non-link CSS export types (style, text, css-style-sheet) (by @xiaoxiaojx in #20717)

Emit error when proxy server returns non-200 status code in HttpUriPlugin instead of silently failing. (by @xiaoxiaojx in #20646)

import.meta as standalone expression now returns a complete object with known properties (url, webpack, main, env) instead of an empty object ({}), and hoists it as a module-level variable to ensure import.meta === import.meta identity. In preserve-unknown mode (ESM output), the hoisted object merges runtime import.meta properties via Object.assign. (by @xiaoxiaojx in #20658)

Fix incorrect condition in FileSystemInfo that always evaluated to false, preventing trailing slash removal from directory paths during build dependency resolution. (by @xiaoxiaojx in #20649)

fix: VirtualUrlPlugin absolute path virtual module IDs getting concatenated with compiler context (by @xiaoxiaojx in #20656)

... (truncated)

Changelog

Sourced from webpack's changelog.

5.106.0

Minor Changes

Add exportType: "style" for CSS modules to inject styles into DOM via HTMLStyleElement, similar to style-loader functionality. (by @xiaoxiaojx in #20579)

Add context option support for VirtualUrlPlugin (by @xiaoxiaojx in #20449)

The context for the virtual module. A string path. Defaults to 'auto', which will try to resolve the context from the module id.

Support custom context path for resolving relative imports in virtual modules

Add examples demonstrating context usage and filename customization

Generate different CssModule instances for different exportType values. (by @xiaoxiaojx in #20590)

Added the localIdentHashFunction option to configure the hash function to be used for hashing. (by @alexander-akait in #20694) Additionally, the localIdentName option can now be a function.

Added support for destructuring assignment require in cjs, allowing for tree shaking. (by @ahabhgk in #20548)

Added the validate option to enable/disable validation in webpack/plugins/loaders, also implemented API to make it inside plugins. (by @xiaoxiaojx in #20275)

Added source support for async WASM modules. (by @magic-akari in #20364)

Patch Changes

Add a static getSourceBasicTypes method to the Module class to prevent errors across multiple versions. (by @xiaoxiaojx in #20614)

Included fragment groups in the conflicting order warning for CSS. (by @aryanraj45 in #20660)

Avoid rendering unused top-level __webpack_exports__ declaration when output ECMA module library. (by @hai-x in #20669)

Fixed resolving in CSS modules. (by @alexander-akait in #20771)

Allow external modules place in async chunks when output ECMA module. (by @hai-x in #20662)

Implement deprecate flag in schema for better TypeScript support to show which options are already deprecated by the configuration (by @bjohansebas in #20432)

Set .name to "default" for anonymous default export functions and classes per ES spec (by @xiaoxiaojx in #20773)

Hash entry chunks after runtime chunks to prevent stale content hash references in watch mode (by @xiaoxiaojx in #20724)

Fix multiple bugs and optimizations in CSS modules: correct third code point position in walkCssTokens number detection, fix multiline CSS comment regex, fix swapped :import/:export error message, fix comma callback incorrectly popping balanced stack, fix cache comparison missing array length check, fix match.index mutation side effect, move publicPathAutoRegex to module scope, precompute merged callbacks in consumeUntil, simplify redundant ternary in CssGenerator, fix typo GRID_TEMPLATE_ARES, remove duplicate grid-column-start, and merge duplicate getCompilationHooks calls. (by @xiaoxiaojx in #20648)

Correct url() path resolution and preserve source maps for non-link CSS export types (style, text, css-style-sheet) (by @xiaoxiaojx in #20717)

Emit error when proxy server returns non-200 status code in HttpUriPlugin instead of silently failing. (by @xiaoxiaojx in #20646)

import.meta as standalone expression now returns a complete object with known properties (url, webpack, main, env) instead of an empty object ({}), and hoists it as a module-level variable to ensure import.meta === import.meta identity. In preserve-unknown mode (ESM output), the hoisted object merges runtime import.meta properties via Object.assign. (by @xiaoxiaojx in #20658)

Fix incorrect condition in FileSystemInfo that always evaluated to false, preventing trailing slash removal from directory paths during build dependency resolution. (by @xiaoxiaojx in #20649)

... (truncated)

Commits

8774a01 chore(release): new release (#20593)
cc66616 fix: add @deprecated to methods
7cdc173 feat: support source phase import for WebAssembly modules (#20364)
0b60f1c chore(members): update to match @webpack/core-wg (#20784)
955a68c test: generate snapshots per stats test case (#20785)
47bb540 chore: fix examples (#20780)
390333f fix: set .name to "default" for anonymous default exports per ES spec (#20773)
91aa5da fix: CSS modules deep reexport
61fbd29 chore(deps-dev): bump lodash from 4.17.23 to 4.18.1 (#20768)
c7f5cf9 chore(deps-dev): bump lodash-es from 4.17.23 to 4.18.1 (#20766)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for webpack since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates axios from 0.21.4 to 1.13.5

Release notes

Sourced from axios's releases.

v1.13.5

Release 1.13.5

Highlights

Security: Fixed a potential Denial of Service issue involving the __proto__ key in mergeConfig. (PR #7369)

Bug fix: Resolved an issue where AxiosError could be missing the status field on and after v1.13.3. (PR #7368)

Changes

Security

Fix Denial of Service via __proto__ key in mergeConfig. (PR #7369)

Fixes

Fix/5657. (PR #7313)

Ensure status is present in AxiosError on and after v1.13.3. (PR #7368)

Features / Improvements

Add input validation to isAbsoluteURL. (PR #7326)

Refactor: bump minor package versions. (PR #7356)

Documentation

Clarify object-check comment. (PR #7323)

Fix deprecated Buffer constructor usage and README formatting. (PR #7371)

CI / Maintenance

Chore: fix issues with YAML. (PR #7355)

CI: update workflow YAMLs. (PR #7372)

CI: fix run condition. (PR #7373)

Dev deps: bump karma-sourcemap-loader from 0.3.8 to 0.4.0. (PR #7360)

Chore(release): prepare release 1.13.5. (PR #7379)

New Contributors

@sachin11063 (first contribution — PR #7323)

@asmitha-16 (first contribution — PR #7326)

Full Changelog: axios/axios@v1.13.4...v1.13.5

v1.13.4

Overview

The release addresses issues discovered in v1.13.3 and includes significant CI/CD improvements.

Full Changelog: v1.13.3...v1.13.4

What's New in v1.13.4

Bug Fixes

fix: issues with version 1.13.3 (#7352) (ee90dfc)

Fixed issues discovered in v1.13.3 release

... (truncated)

Commits

29f7542 chore(release): prepare release 1.13.5 (#7379)
431c3a3 ci: fix run condition (#7373)
9ff3a78 ci: update ymls (#7372)
265b712 docs: fix deprecated Buffer constructor and formatting issues in README (#7371)
475e75a feat: add input validation to isAbsoluteURL (#7326)
28c7215 fix: Denial of Service via proto Key in mergeConfig (#7369)
04cf019 docs: clarify object check comment (#7323)
696fa75 fix: status is missing in AxiosError on and after v1.13.3 (#7368)
569f028 fix: added a option to choose between legacy and the new request/response int...
44b7c9f chore(deps-dev): bump karma-sourcemap-loader (#7360)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for axios since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates @babel/traverse from 7.19.4 to 7.29.0

Release notes

Sourced from @babel/traverse's releases.

v7.29.0 (2026-01-31)

Thanks @simbahax for your first PR!

🚀 New Feature

babel-types

#17750 [7.x backport] Add attributes import declaration builder (@JLHwung)

babel-standalone

#17663 [7.x backport] feat(standalone): export async transform (@JLHwung)

#17725 [7.x backport] feat: read standalone targets from data-targets (@JLHwung)

🐛 Bug Fix

babel-parser

#17765 fix(parser): correctly parse type assertions in extends clause (@nicolo-ribaudo)

#17723 [7.x backport] fix(parser): improve super type argument parsing (@JLHwung)

babel-traverse

#17708 fix(traverse): provide a hub when traversing a File or Program and no parentPath is given (@simbahax)

babel-plugin-transform-block-scoping, babel-traverse

#17737 [7.x backport] fix: Rename switch discriminant references when body creates shadowing variable (@magic-akari)

🏃‍♀️ Performance

babel-generator, babel-runtime-corejs3

#17642 [Babel 7] Improve generator performance (@liuxingbaoyu)

Committers: 6

David (@simbahax)

Huáng Jùnliàng (@JLHwung)

Nicolò Ribaudo (@nicolo-ribaudo)

@liuxingbaoyu

@magic-akari

v7.28.6 (2026-01-12)

Thanks @kadhirash and @kolvian for your first PRs!

🐛 Bug Fix

babel-cli, babel-code-frame, babel-core, babel-helper-check-duplicate-nodes, babel-helper-fixtures, babel-helper-plugin-utils, babel-node, babel-plugin-transform-flow-comments, babel-plugin-transform-modules-commonjs, babel-plugin-transform-property-mutators, babel-preset-env, babel-traverse, babel-types

#17589 Improve Unicode handling in code-frame tokenizer (@JLHwung)

babel-plugin-transform-regenerator

#17556 fix: transform-regenerator correctly handles scope (@liuxingbaoyu)

babel-plugin-transform-react-jsx

#17538 fix: Keep jsx comments (@liuxingbaoyu)

💅 Polish

babel-core, babel-standalone

#17606 Polish(standalone): improve message on invalid preset/plugin (@JLHwung)

🏠 Internal

babel-plugin-bugfix-v8-static-class-fields-redefine-readonly, babel-plugin-proposal-decorators, babel-plugin-proposal-import-attributes-to-assertions, babel-plugin-proposal-import-wasm-source, babel-plugin-syntax-async-do-expressions, babel-plugin-syntax-decorators, babel-plugin-syntax-destructuring-private, babel-plugin-syntax-do-expressions, babel-plugin-syntax-explicit-resource-management, babel-plugin-syntax-export-default-from, babel-plugin-syntax-flow, babel-plugin-syntax-function-bind, babel-plugin-syntax-function-sent, babel-plugin-syntax-import-assertions, babel-plugin-syntax-import-attributes, babel-plugin-syntax-import-defer, babel-plugin-syntax-import-source, babel-plugin-syntax-jsx, babel-plugin-syntax-module-blocks, babel-plugin-syntax-optional-chaining-assign, babel-plugin-syntax-partial-application, babel-plugin-syntax-pipeline-operator, babel-plugin-syntax-throw-expressions, babel-plugin-syntax-typescript, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-class-properties, babel-plugin-transform-class-static-block, babel-plugin-transform-dotall-regex, babel-plugin-transform-duplicate-named-capturing-groups-regex, babel-plugin-transform-explicit-resource-management, babel-plugin-transform-exponentiation-operator, babel-plugin-transform-json-strings, babel-plugin-transform-logical-assignment-operators, babel-plugin-transform-nullish-coalescing-operator, babel-plugin-transform-numeric-separator, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-catch-binding, babel-plugin-transform-optional-chaining, babel-plugin-transform-private-methods, babel-plugin-transform-private-property-in-object, babel-plugin-transform-regexp-modifiers, babel-plugin-transform-unicode-property-regex, babel-plugin-transform-unicode-sets-regex

#17580 Allow Babel 8 in compatible Babel 7 plugins (@nicolo-ribaudo)

... (truncated)

Commits

aa8394e v7.29.0
84366a8 fix(traverse): provide a hub when traversing a File or Program and no parentP...
229eb45 [7.x backport] fix: Rename switch discriminant references when body creates s...
d7f4008 v7.28.6
905bc22 fix: lint errors in main branch (#17612)
a03e2b6 fix: path.evaluate correctly returns confident (#17584)
aac2c37 chore: Use Gulpfile.mts (#17579)
65c4a6b [Babel 8] fix: Improve traverse types (#17574)
99dcba5 chore: enable some ts-eslint rules (#17592)
c92c491 Improve Unicode handling in code-frame tokenizer (#17589)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @babel/traverse since your current version.

Updates js-yaml from 3.14.1 to 3.14.2

Changelog

Sourced from js-yaml's changelog.

[3.14.2] - 2025-11-15

Security

Backported v4.1.1 fix to v3

[4.1.1] - 2025-11-12

Security

Fix prototype pollution issue in yaml merge (<<) operator.

[4.1.0] - 2021-04-15

Added

Types are now exported as yaml.types.XXX.

Every type now has options property with original arguments kept as they were (see yaml.types.int.options as an example).

Changed

Schema.extend() now keeps old type order in case of conflicts (e.g. Schema.extend([ a, b, c ]).extend([ b, a, d ]) is now ordered as abcd instead of cbad).

[4.0.0] - 2021-01-03

Changed

Check migration guide to see details for all breaking changes.

Breaking: "unsafe" tags !!js/function, !!js/regexp, !!js/undefined are moved to js-yaml-js-types package.

Breaking: removed safe* functions. Use load, loadAll, dump instead which are all now safe by default.

yaml.DEFAULT_SAFE_SCHEMA and yaml.DEFAULT_FULL_SCHEMA are removed, use yaml.DEFAULT_SCHEMA instead.

yaml.Schema.create(schema, tags) is removed, use schema.extend(tags) instead.

!!binary now always mapped to Uint8Array on load.

Reduced nesting of /lib folder.

Parse numbers according to YAML 1.2 instead of YAML 1.1 (01234 is now decimal, 0o1234 is octal, 1:23 is parsed as string instead of base60).

dump() no longer quotes :, [, ], (, ) except when necessary, #470, #557.

Line and column in exceptions are now formatted as (X:Y) instead of at line X, column Y (also present in compact format), #332.

Code snippet created in exceptions now contains multiple lines with line numbers.

dump() now serializes undefined as null in collections and removes keys with undefined in mappings, #571.

dump() with skipInvalid=true now serializes invalid items in collections as null.

Custom tags starting with ! are now dumped as !tag instead of !<!tag>, #576.

Custom tags starting with tag:yaml.org,2002: are now shorthanded using !!, #258.

Added

Added .mjs (es modules) support.

Added quotingType and forceQuotes options for dumper to configure string literal style, #290, #529.

Added styles: { '!!null': 'empty' } option for dumper (serializes { foo: null } as "foo: "), #570.

... (truncated)

Commits

9963d36 3.14.2 released
10d3c8e dist rebuild
5278870 fix prototype pollution in merge (<<) (#731)
See full diff in compare view

Updates base-x from 3.0.9 to 3.0.11

Commits

043a888 3.0.11
2705ddd [backport 3.x] Prohibit char codes that would overflow the BASE_MAP
3d43c0e 3.0.10
0a35446 Improve decoding performance
See full diff in compare view

Updates braces from 3.0.2 to 3.0.3

Commits

74b2db2 3.0.3
88f1429 update eslint. lint, fix unit tests.
415d660 Snyk js braces 6838727 (#40)
190510f fix tests, skip 1 test in test/braces.expand
716eb9f readme bump
a5851e5 Merge pull request #37 from coderaiser/fix/vulnerability
2092bd1 feature: braces: add maxSymbols (https://github.com/micromatch/braces/issues/...
9f5b4cf fix: vulnerability (https://security.snyk.io/vuln/SNYK-JS-BRACES-6838727)
98414f9 remove funding file
665ab5d update keepEscaping doc (#27)
Additional commits viewable in compare view

Updates cipher-base from 1.0.4 to 1.0.7

Changelog

Sourced from cipher-base's changelog.

v1.0.7 - 2025-09-24

Commits

[Refactor] use to-buffer fd1e5ee

[Dev Deps] update @ljharb/eslint-config 08ba803

v1.0.6 - 2024-11-26

Commits

[Fix] io.js 3.0 - Node.js 5.3 typed array support b7ddd2a

v1.0.5 - 2024-11-17

Commits

[Tests] standard -> eslint, make test dir, etc ae02fd6

[Tests] migrate from travis to GHA 66387d7

[meta] fix package.json indentation 5c02918

[Fix] return valid values on multi-byte-wide TypedArray input 8fd1364

[meta] add auto-changelog 88dc806

[meta] add npmignore and safe-publish-latest 7a137d7

Only apps should have lockfiles 42528f2

[Deps] update inherits, safe-buffer 0e7a2d9

[meta] add missing engines.node f2dc13e

Commits

0056718 v1.0.7
fd1e5ee [Refactor] use to-buffer
08ba803 [Dev Deps] update @ljharb/eslint-config
f5249f9 v1.0.6
b7ddd2a [Fix] io.js 3.0 - Node.js 5.3 typed array support
f03cebf v1.0.5
88dc806 [meta] add auto-changelog
7a137d7 [meta] add npmignore and safe-publish-latest
5c02918 [meta] fix package.json indentation
8fd1364 [Fix] return valid values on multi-byte-wide TypedArray input
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by ljharb, a new releaser for cipher-base since your current version.

Install script changes

This version adds prepublish script that runs during installation. Review the package contents before updating.

Updates decode-uri-component from 0.2.0 to 0.2.2

Release notes

Sourced from decode-uri-component's releases.

v0.2.2

Prevent overwriting previously decoded tokens 980e0bf

SamVerschueren/decode-uri-component@v0.2.1...v0.2.2

v0.2.1

Switch to GitHub workflows 76abc93

Fix issue where decode throws - fixes #6 746ca5d

Update license (#1) 486d7e2

Tidelift tasks a650457

Meta tweaks 66e1c28

SamVerschueren/decode-uri-component@v0.2.0...v0.2.1

Commits

a0eea46 0.2.2
980e0bf Prevent overwriting previously decoded tokens
3c8a373 0.2.1
76abc93 Switch to GitHub workflows
746ca5d Fix issue where decode throws - fixes #6
486d7e2 Update license (#1)
a650457 Tidelift tasks
66e1c28 Meta tweaks
See full diff in compare view

Updates tmp from 0.2.1 to 0.2.5

Changelog

Sourced from tmp's changelog.

v0.2.2 (2024-02-28)

🐛 Bug Fix

#278 Closes #268: Revert "fix #246: remove any double quotes or single quotes… (@mbargiel)

📝 Documentation

#279 Closes #266: move paragraph on graceful cleanup to the head of the documentation (@silkentrance)

Committers: 5

Carsten Klein (@silkentrance)

Dave Nicolson (@dnicolson)

KARASZI István (@raszi)

Maxime Bargiel (@mbargiel)

@robertoaceves

Commits

3d2fe38 Bump up the version
e162828 Merge pull request #309 from fflorent/fix-tmp-dir-with-dir
b847d2f Fix use of tmp.dir() with dir option
08fa3ab Update version
1cf4ec5 Merge commit from fork
188b25e Fix GHSA-52f5-9888-hmc6
73b9fe4 Add test case for GHSA-52f5-9888-hmc6
b8e2f29 Remove broken tests
2892a02 Remove outdated URL
f592318 Reformat package.json
Additional commits viewable in compare view

Updates flatted from 3.2.7 to 3.4.2

Commits

3bf0909 3.4.2
885ddcc fix CWE-1321
0bdba70 added flatted-view to the benchmark
2a02dce 3.4.1
fba4e8f Merge pull request #89 from WebReflection/python-fix
5fe8648 added "when in Rome" also a test for PHP
53517ad some minor improvement
b3e2a0c Fixing recursion issue in Python too
c4b46db Add SECURITY.md for security policy and reporting
f86d071 Create dependabot.yml for version updates
Additional commits viewable in compare view

Updates handlebars from 4.7.7 to 4.7.9

Release notes

Sourced from handlebars's releases.

v4.7.9

fix: enable shell mode for spawn to resolve Windows EINVAL issue - e0137c2

fix type "RuntimeOptions" also accepting string partials - eab1d14

feat(types): set hash to be a Record<string, any> - de4414d

fix non-contiguous program indices - 4512766

refactor: rename i to startPartIndex - e497a35

security: fix security issues - 68d8df5

GHSA-2w6w-674q-4c4q

GHSA-3mfm-83xf-c92r

GHSA-xhpv-hc6g-r9c6

GHSA-xjpj-3mr7-gcpf

GHSA-9cx6-37pm-9jff

GHSA-2qvq-rjwj-gvw9

GHSA-7rx3-28cr-v5wh

GHSA-442j-39wm-28r2

Commits

v4.7.8

Make library compatible with workers (#1894) - 3d3796c

Don't rely on Node.js global object (#1776) - 2954e7e

Fix compiling of each block params in strict mode (#1855) - 30dbf04

Fix rollup warning when importing Handlebars as ESM - 03d387b

Fix bundler issue with webpack 5 (#1862) - c6c6bbb

Use https instead of git for mustache submodule - 88ac068

Commits

Changelog

Sourced from handlebars's changelog.

v4.7.9 - March 26th, 2026

fix: enable shell mode for spawn to resolve Windows EINVAL issue - e0137c2

fix type "RuntimeOptions" also accepting string partials - eab1d14

feat(types): set hash to be a Record<string, any> - de4414d

fix non-contiguous program indices - 4512766

refactor: rename i to startPartIndex - e497a35

security: fix security issues - 68d8df5

Commits

v4.7.8 - July 27th, 2023

Make library compatible with workers (#1894) - 3d3796c

Don't rely on Node.js global object (#1776) - 2954e7e

Fix compiling of each block params in strict mode (#1855) - 30dbf04

Fix rollup warning whe...
Description has been truncated

Bumps the npm_and_yarn group with 16 updates in the / directory: | Package | From | To | | --- | --- | --- | | [bn.js](https://github.com/indutny/bn.js) | `5.2.1` | `5.2.3` | | [webpack](https://github.com/webpack/webpack) | `5.76.0` | `5.106.0` | | [axios](https://github.com/axios/axios) | `0.21.4` | `1.13.5` | | [@babel/traverse](https://github.com/babel/babel/tree/HEAD/packages/babel-traverse) | `7.19.4` | `7.29.0` | | [js-yaml](https://github.com/nodeca/js-yaml) | `3.14.1` | `3.14.2` | | [base-x](https://github.com/cryptocoinjs/base-x) | `3.0.9` | `3.0.11` | | [braces](https://github.com/micromatch/braces) | `3.0.2` | `3.0.3` | | [cipher-base](https://github.com/crypto-browserify/cipher-base) | `1.0.4` | `1.0.7` | | [tmp](https://github.com/raszi/node-tmp) | `0.2.1` | `0.2.5` | | [flatted](https://github.com/WebReflection/flatted) | `3.2.7` | `3.4.2` | | [handlebars](https://github.com/handlebars-lang/handlebars.js) | `4.7.7` | `4.7.9` | | [min-document](https://github.com/Raynos/min-document) | `2.19.0` | `2.19.2` | | [pbkdf2](https://github.com/browserify/pbkdf2) | `3.1.2` | `3.1.5` | | [picomatch](https://github.com/micromatch/picomatch) | `2.3.1` | `2.3.2` | | [tar-fs](https://github.com/mafintosh/tar-fs) | `2.1.1` | `2.1.4` | | [web3-core-method](https://github.com/ethereum/web3.js) | `1.9.0` | `1.10.4` | Bumps the npm_and_yarn group with 1 update in the /packages/web3-core directory: [web3-core-method](https://github.com/ethereum/web3.js). Bumps the npm_and_yarn group with 1 update in the /packages/web3-core-method directory: [web3-core-subscriptions](https://github.com/ethereum/web3.js). Bumps the npm_and_yarn group with 2 updates in the /packages/web3-eth directory: [web3-core-method](https://github.com/ethereum/web3.js) and [web3-core-subscriptions](https://github.com/ethereum/web3.js). Bumps the npm_and_yarn group with 4 updates in the /packages/web3-eth-accounts directory: [bn.js](https://github.com/indutny/bn.js), [cipher-base](https://github.com/crypto-browserify/cipher-base), [pbkdf2](https://github.com/browserify/pbkdf2) and [web3-core-method](https://github.com/ethereum/web3.js). Bumps the npm_and_yarn group with 2 updates in the /packages/web3-eth-contract directory: [web3-core-method](https://github.com/ethereum/web3.js) and [web3-core-subscriptions](https://github.com/ethereum/web3.js). Bumps the npm_and_yarn group with 1 update in the /packages/web3-eth-personal directory: [web3-core-method](https://github.com/ethereum/web3.js). Bumps the npm_and_yarn group with 1 update in the /packages/web3-eth2-core directory: [axios](https://github.com/axios/axios). Bumps the npm_and_yarn group with 1 update in the /packages/web3-net directory: [web3-core-method](https://github.com/ethereum/web3.js). Bumps the npm_and_yarn group with 2 updates in the /packages/web3-shh directory: [web3-core-method](https://github.com/ethereum/web3.js) and [web3-core-subscriptions](https://github.com/ethereum/web3.js). Bumps the npm_and_yarn group with 1 update in the /packages/web3-utils directory: [bn.js](https://github.com/indutny/bn.js). Updates `bn.js` from 5.2.1 to 5.2.3 - [Release notes](https://github.com/indutny/bn.js/releases) - [Changelog](https://github.com/indutny/bn.js/blob/master/CHANGELOG.md) - [Commits](indutny/bn.js@v5.2.1...v5.2.3) Updates `webpack` from 5.76.0 to 5.106.0 - [Release notes](https://github.com/webpack/webpack/releases) - [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md) - [Commits](webpack/webpack@v5.76.0...v5.106.0) Updates `axios` from 0.21.4 to 1.13.5 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v0.21.4...v1.13.5) Updates `@babel/traverse` from 7.19.4 to 7.29.0 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.0/packages/babel-traverse) Updates `js-yaml` from 3.14.1 to 3.14.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.14.1...3.14.2) Updates `base-x` from 3.0.9 to 3.0.11 - [Commits](cryptocoinjs/base-x@v3.0.9...v3.0.11) Updates `braces` from 3.0.2 to 3.0.3 - [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md) - [Commits](micromatch/braces@3.0.2...3.0.3) Updates `cipher-base` from 1.0.4 to 1.0.7 - [Changelog](https://github.com/browserify/cipher-base/blob/master/CHANGELOG.md) - [Commits](browserify/cipher-base@v1.0.4...v1.0.7) Updates `decode-uri-component` from 0.2.0 to 0.2.2 - [Release notes](https://github.com/SamVerschueren/decode-uri-component/releases) - [Commits](SamVerschueren/decode-uri-component@v0.2.0...v0.2.2) Updates `tmp` from 0.2.1 to 0.2.5 - [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md) - [Commits](raszi/node-tmp@v0.2.1...v0.2.5) Updates `flatted` from 3.2.7 to 3.4.2 - [Commits](WebReflection/flatted@v3.2.7...v3.4.2) Updates `handlebars` from 4.7.7 to 4.7.9 - [Release notes](https://github.com/handlebars-lang/handlebars.js/releases) - [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/v4.7.9/release-notes.md) - [Commits](handlebars-lang/handlebars.js@v4.7.7...v4.7.9) Updates `min-document` from 2.19.0 to 2.19.2 - [Commits](Raynos/min-document@v2.19.0...v2.19.2) Updates `pbkdf2` from 3.1.2 to 3.1.5 - [Changelog](https://github.com/browserify/pbkdf2/blob/master/CHANGELOG.md) - [Commits](browserify/pbkdf2@v3.1.2...v3.1.5) Updates `picomatch` from 2.3.1 to 2.3.2 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@2.3.1...2.3.2) Updates `sha.js` from 2.4.11 to 2.4.12 - [Changelog](https://github.com/browserify/sha.js/blob/master/CHANGELOG.md) - [Commits](browserify/sha.js@v2.4.11...v2.4.12) Updates `tar-fs` from 2.1.1 to 2.1.4 - [Commits](mafintosh/tar-fs@v2.1.1...v2.1.4) Updates `web3-core-method` from 1.9.0 to 1.10.4 - [Release notes](https://github.com/ethereum/web3.js/releases) - [Changelog](https://github.com/web3/web3.js/blob/v1.10.4/CHANGELOG.md) - [Commits](web3/web3.js@v1.9.0...v1.10.4) Updates `web3-core-subscriptions` from 1.9.0 to 1.10.0 - [Release notes](https://github.com/ethereum/web3.js/releases) - [Changelog](https://github.com/web3/web3.js/blob/4.x/CHANGELOG.md) - [Commits](web3/web3.js@v1.10.0...v1.10.3) Updates `web3-core-method` from 1.10.0 to 1.10.4 - [Release notes](https://github.com/ethereum/web3.js/releases) - [Changelog](https://github.com/web3/web3.js/blob/v1.10.4/CHANGELOG.md) - [Commits](web3/web3.js@v1.9.0...v1.10.4) Updates `web3-core-subscriptions` from 1.10.0 to 1.10.3 - [Release notes](https://github.com/ethereum/web3.js/releases) - [Changelog](https://github.com/web3/web3.js/blob/4.x/CHANGELOG.md) - [Commits](web3/web3.js@v1.10.0...v1.10.3) Updates `web3-core-method` from 1.10.0 to 1.10.4 - [Release notes](https://github.com/ethereum/web3.js/releases) - [Changelog](https://github.com/web3/web3.js/blob/v1.10.4/CHANGELOG.md) - [Commits](web3/web3.js@v1.9.0...v1.10.4) Updates `web3-core-subscriptions` from 1.10.0 to 1.10.3 - [Release notes](https://github.com/ethereum/web3.js/releases) - [Changelog](https://github.com/web3/web3.js/blob/4.x/CHANGELOG.md) - [Commits](web3/web3.js@v1.10.0...v1.10.3) Updates `bn.js` from 5.2.1 to 5.2.3 - [Release notes](https://github.com/indutny/bn.js/releases) - [Changelog](https://github.com/indutny/bn.js/blob/master/CHANGELOG.md) - [Commits](indutny/bn.js@v5.2.1...v5.2.3) Updates `bn.js` from 4.12.0 to 4.12.3 - [Release notes](https://github.com/indutny/bn.js/releases) - [Changelog](https://github.com/indutny/bn.js/blob/master/CHANGELOG.md) - [Commits](indutny/bn.js@v5.2.1...v5.2.3) Updates `cipher-base` from 1.0.4 to 1.0.7 - [Changelog](https://github.com/browserify/cipher-base/blob/master/CHANGELOG.md) - [Commits](browserify/cipher-base@v1.0.4...v1.0.7) Updates `elliptic` from 6.5.4 to 6.6.1 - [Commits](indutny/elliptic@v6.5.4...v6.6.1) Updates `pbkdf2` from 3.1.2 to 3.1.5 - [Changelog](https://github.com/browserify/pbkdf2/blob/master/CHANGELOG.md) - [Commits](browserify/pbkdf2@v3.1.2...v3.1.5) Updates `sha.js` from 2.4.11 to 2.4.12 - [Changelog](https://github.com/browserify/sha.js/blob/master/CHANGELOG.md) - [Commits](browserify/sha.js@v2.4.11...v2.4.12) Updates `web3-core-method` from 1.10.0 to 1.10.4 - [Release notes](https://github.com/ethereum/web3.js/releases) - [Changelog](https://github.com/web3/web3.js/blob/v1.10.4/CHANGELOG.md) - [Commits](web3/web3.js@v1.9.0...v1.10.4) Updates `web3-core-method` from 1.10.0 to 1.10.4 - [Release notes](https://github.com/ethereum/web3.js/releases) - [Changelog](https://github.com/web3/web3.js/blob/v1.10.4/CHANGELOG.md) - [Commits](web3/web3.js@v1.9.0...v1.10.4) Updates `web3-core-subscriptions` from 1.10.0 to 1.10.3 - [Release notes](https://github.com/ethereum/web3.js/releases) - [Changelog](https://github.com/web3/web3.js/blob/4.x/CHANGELOG.md) - [Commits](web3/web3.js@v1.10.0...v1.10.3) Updates `web3-core-method` from 1.10.0 to 1.10.4 - [Release notes](https://github.com/ethereum/web3.js/releases) - [Changelog](https://github.com/web3/web3.js/blob/v1.10.4/CHANGELOG.md) - [Commits](web3/web3.js@v1.9.0...v1.10.4) Updates `axios` from 0.21.4 to 1.15.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v0.21.4...v1.13.5) Updates `@babel/traverse` from 7.19.4 to 7.29.0 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.0/packages/babel-traverse) Updates `minimatch` from 3.1.2 to 3.1.5 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v3.1.2...v3.1.5) Updates `braces` from 3.0.2 to 2.3.2 - [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md) - [Commits](micromatch/braces@3.0.2...3.0.3) Updates `json5` from 2.2.1 to 2.2.3 - [Release notes](https://github.com/json5/json5/releases) - [Changelog](https://github.com/json5/json5/blob/main/CHANGELOG.md) - [Commits](json5/json5@v2.2.1...v2.2.3) Updates `picomatch` from 2.3.1 to 2.3.2 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@2.3.1...2.3.2) Updates `web3-core-method` from 1.10.0 to 1.10.4 - [Release notes](https://github.com/ethereum/web3.js/releases) - [Changelog](https://github.com/web3/web3.js/blob/v1.10.4/CHANGELOG.md) - [Commits](web3/web3.js@v1.9.0...v1.10.4) Updates `web3-core-method` from 1.10.0 to 1.10.4 - [Release notes](https://github.com/ethereum/web3.js/releases) - [Changelog](https://github.com/web3/web3.js/blob/v1.10.4/CHANGELOG.md) - [Commits](web3/web3.js@v1.9.0...v1.10.4) Updates `web3-core-subscriptions` from 1.10.0 to 1.10.3 - [Release notes](https://github.com/ethereum/web3.js/releases) - [Changelog](https://github.com/web3/web3.js/blob/4.x/CHANGELOG.md) - [Commits](web3/web3.js@v1.10.0...v1.10.3) Updates `bn.js` from 5.2.1 to 5.2.3 - [Release notes](https://github.com/indutny/bn.js/releases) - [Changelog](https://github.com/indutny/bn.js/blob/master/CHANGELOG.md) - [Commits](indutny/bn.js@v5.2.1...v5.2.3) --- updated-dependencies: - dependency-name: bn.js dependency-version: 5.2.3 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: webpack dependency-version: 5.106.0 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: axios dependency-version: 1.13.5 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@babel/traverse" dependency-version: 7.29.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 3.14.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: base-x dependency-version: 3.0.11 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: braces dependency-version: 3.0.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: cipher-base dependency-version: 1.0.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: decode-uri-component dependency-version: 0.2.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tmp dependency-version: 0.2.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: flatted dependency-version: 3.4.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: handlebars dependency-version: 4.7.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: min-document dependency-version: 2.19.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: pbkdf2 dependency-version: 3.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 2.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: sha.js dependency-version: 2.4.12 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tar-fs dependency-version: 2.1.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: web3-core-method dependency-version: 1.10.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: web3-core-subscriptions dependency-version: 1.10.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: web3-core-method dependency-version: 1.10.4 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: web3-core-subscriptions dependency-version: 1.10.3 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: web3-core-method dependency-version: 1.10.4 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: web3-core-subscriptions dependency-version: 1.10.3 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: bn.js dependency-version: 5.2.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: bn.js dependency-version: 4.12.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: cipher-base dependency-version: 1.0.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: elliptic dependency-version: 6.6.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: pbkdf2 dependency-version: 3.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: sha.js dependency-version: 2.4.12 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: web3-core-method dependency-version: 1.10.4 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: web3-core-method dependency-version: 1.10.4 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: web3-core-subscriptions dependency-version: 1.10.3 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: web3-core-method dependency-version: 1.10.4 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: axios dependency-version: 1.15.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@babel/traverse" dependency-version: 7.29.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: minimatch dependency-version: 3.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: braces dependency-version: 2.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: json5 dependency-version: 2.2.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 2.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: web3-core-method dependency-version: 1.10.4 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: web3-core-method dependency-version: 1.10.4 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: web3-core-subscriptions dependency-version: 1.10.3 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: bn.js dependency-version: 5.2.3 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-04-09T23:36:01Z

Superseded by #17.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 9, 2026

dependabot Bot mentioned this pull request Apr 9, 2026

Bump the npm_and_yarn group across 11 directories with 22 updates #15

Closed

dependabot Bot closed this Apr 9, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/npm_and_yarn-ef4814f340 branch April 9, 2026 23:36

Navigation Menu

Repository navigation

Bump the npm_and_yarn group across 11 directories with 22 updates - #16

Bump the npm_and_yarn group across 11 directories with 22 updates#16
dependabot[bot] wants to merge 1 commit into
1.xfrom
dependabot/npm_and_yarn/npm_and_yarn-ef4814f340

dependabot Bot commented on behalf of github Apr 9, 2026

Uh oh!

dependabot Bot commented on behalf of github Apr 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Apr 9, 2026

5.2.3 / 2026-02-19

5.2.2 / 2025-04-25

v5.106.0

Minor Changes

Patch Changes

5.106.0

Minor Changes

Patch Changes

v1.13.5

Release 1.13.5

Highlights

Changes

Security

Fixes

Features / Improvements

Documentation

CI / Maintenance

New Contributors

v1.13.4

Overview

What's New in v1.13.4

Bug Fixes

v7.29.0 (2026-01-31)

🚀 New Feature

🐛 Bug Fix

🏃‍♀️ Performance

Committers: 6

v7.28.6 (2026-01-12)

🐛 Bug Fix

💅 Polish

🏠 Internal

[3.14.2] - 2025-11-15

Security

[4.1.1] - 2025-11-12

Security

[4.1.0] - 2021-04-15

Added

Changed

[4.0.0] - 2021-01-03

Changed

Added

v1.0.7 - 2025-09-24

Commits

v1.0.6 - 2024-11-26

Commits

v1.0.5 - 2024-11-17

Commits

v0.2.2

v0.2.1

v0.2.2 (2024-02-28)

🐛 Bug Fix

📝 Documentation

Committers: 5

v4.7.9

v4.7.8

v4.7.9 - March 26th, 2026

v4.7.8 - July 27th, 2023

Uh oh!

dependabot Bot commented on behalf of github Apr 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants