chore(deps): bump the npm_and_yarn group across 1 directory with 16 updates by dependabot[bot] · Pull Request #3985 · GetStream/stream-chat-react-native

dependabot · 2026-11-12T16:35:50Z

Bumps the npm_and_yarn group with 16 updates in the / directory:

Package	From	To
zod	`4.6.5`	`4.6.6`
axios	`1.19.0`	`1.21.1`
body-parser	`2.3.0`	`2.4.0`
brace-expansion	`1.1.11`	`1.1.21`
compression	`1.8.1`	`1.8.2`
fast-uri	`3.1.2`	`3.1.9`
fast-xml-parser	`5.11.0`	`5.12.0`
follow-redirects	`1.16.0`	`1.16.3`
handlebars	`4.7.8`	`4.7.10`
ip-address	`10.1.0`	`10.7.6`
joi	`17.13.3`	`17.13.9`
launch-editor	`2.13.2`	`2.14.2`
moment	`2.30.1`	`2.31.0`
node-forge	`1.4.0`	`1.4.3`
postcss-selector-parser	`7.1.1`	`7.1.8`
qs	`6.15.3`	`6.17.1`

Updates zod from 4.6.5 to 4.6.6

Release notes

Sourced from zod's releases.

v4.6.6

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243fb, the pre-rewrite copy of 9c219833 with identical contents.

Commits:

0cd3af5e9f50ad11bbcd4407a46a21b8848ba574 docs: load the en locale directly in Zod Mini

9d5e60f162997b764b40d45aa02481888db50dea docs: import locales from zod/locales, not z.locales

34a626f307871ecbb0123947559328dc52ed5e3e docs: tighten the z.locales tree-shaking note

74304ce5b5796b5edb9a88ceb8e170b6ea3e82df release: stage npm versions instead of publishing them (#6622)

b2ef983e0711ff6517d6020b021071e2e5653efa docs: add Code for Japan to bronze sponsors

8fb2faf0584828a6a027d8279db36f6f52784462 docs: crop the Code for Japan logo and list it first in bronze

bacad518c41610d654658172d325874bf0ee6290 docs: square the Code for Japan logo to match the other bronze tiles

c42596bd1c87e941d7241d10e012c5c196adcc10 release: hold the run on the release-approval environment until the staged versions are approved (#6638)

a2ba4a67986a3e6b2b131be30084a2f460d9ea67 fix(types): declare record output and input as members, not base type arguments (#6645)

a0ebf970f2d752e5f58527cd2942ff48be4f46bd fix(v4): check array, set and map size bounds before parsing elements (#6652)

529f78dd9431b07f49647fee3aa0819b3f8b66b7 4.6.6

9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 ci: stage at verbose so a failed OIDC token exchange says why

Commits

9c21983 ci: stage at verbose so a failed OIDC token exchange says why
529f78d 4.6.6
a0ebf97 fix(v4): check array, set and map size bounds before parsing elements (#6652)
a2ba4a6 fix(types): declare record output and input as members, not base type argumen...
c42596b release: hold the run on the release-approval environment until the staged ve...
bacad51 docs: square the Code for Japan logo to match the other bronze tiles
8fb2faf docs: crop the Code for Japan logo and list it first in bronze
b2ef983 docs: add Code for Japan to bronze sponsors
74304ce release: stage npm versions instead of publishing them (#6622)
34a626f docs: tighten the z.locales tree-shaking note
Additional commits viewable in compare view

Updates axios from 1.19.0 to 1.21.1

Release notes

Sourced from axios's releases.

v1.21.1 — November 9, 2026

This release raises the minimum follow-redirects version to fix a published CVE, fixes a Next.js prerendering failure caused by the response duration timer, corrects the getAdapter typings, and includes documentation corrections, new test coverage, CI runner changes and dependency updates.

🔒 Security Fixes

follow-redirects: Raised the follow-redirects range from ^1.16.0 to ^1.16.2 to fix CVE-2026-116689 (GHSA-mrwp-f3q8-3g9p). In the vulnerable versions, sensitiveHeaders arrays from another realm were ignored and custom credentials could follow redirects. Only the Node.js HTTP adapter is affected, and there are no API changes. (#11410)

🐛 Bug Fixes

Response Duration: dispatchRequest now measures response.duration with performance.now() and uses Date.now() only when performance.now() isn't available. In v1.21.0, any axios request from a Server Component failed Next.js production builds with Cache Components (cacheComponents: true), because Next.js rejects Date.now() while prerendering. The duration is still a whole number of milliseconds, and system clock changes no longer affect it. (#11411)

TypeScript: getAdapter now accepts an optional config?: AxiosRequestConfig in index.d.ts and index.d.cts, matching what it does at runtime. You can now call getAdapter('fetch', { env: { fetch: myFetch } }) without a cast. (#11404)

🔧 Maintenance & Chores

Documentation Corrections: Brought the README and docs site in line with how axios actually behaves:

transformRequest runs for every method, and transformers receive (data, headers, status).

responseType and Content-Type have no default value.

AxiosHeaders#get and #normalize are described correctly.

Errors should be identified with axios.isAxiosError(), not by name.

The error tables now list ECONNREFUSED and ERR_FORM_DATA_DEPTH_EXCEEDED, and note that FormData parsing has a fixed depth limit that maxDepth doesn't change.

New notes cover what redact doesn't scan, which adapters enforce maxContentLength / maxBodyLength, and how formToJSON() handles field name collisions.

(#11374, #11373, #11389, #11419, #11429, #11430)

Docs Site: Added a Partners page, a shared card design for sponsors and partners, a Namespace sponsor badge, and a blog whose first post announces HeroDevs Never-Ending Support for Axios v0. Also applied the v1.20.0/v1.21.0 release notes to the docs, and fixed internal links in the es, fr and zh translations so they keep their locale prefix. (#11390, #11399, #11400, #11412, #11401)

Test Coverage: Added cancellation tests across the HTTP, fetch and XHR adapters. They cover AbortSignal, CancelToken, cancelling while a request interceptor is pending, and timeout precedence. Also added tests for no_proxy edge cases in shouldBypassProxy, such as internationalized domain names, malformed CIDR and IPv4 entries, and port-qualified entries. Neither changes runtime behavior. (#11376, #11431)

CI: GitHub Actions jobs now run on Namespace runners. The npm publish job stays on GitHub-hosted runners, because npm provenance and trusted publishing (OIDC) only work there. (#11396)

Dependencies: Updated development and tooling dependencies, including vitest and @vitest/* (to 5.x at the root), typescript (7.x at the root), vite, rollup, eslint, playwright, @commitlint/*, @rollup/plugin-alias, @rollup/plugin-terser, body-parser, multer, serialize-javascript, fast-uri, qs, zizmorcore/zizmor-action, and follow-redirects in /docs. (#11383, #11375, #11372, #11345, #11392, #11387, #11386, #11385, #11391, #11388, #11395, #11421, #11422, #11426)

Release: Prepared the 1.21.1 release. (#11435)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

@Ghoscro (#11374)

@pei711 (#11373)

@ivanhapaz (#11399)

@aelmanaa (#11404)

@Aryapatel-007 (#11429, #11430)

@umair-ghafoor-ai (#11376)

@yxshee (#11389)

@malinele (#11401)

@AnantDuhan (#11431)

Full Changelog

v1.21.0 — October 21, 2026

This release adds response timing and opt-in UTF-8 Basic authentication, improves request handling across runtimes, and changes how header defaults are recognized.

... (truncated)

Changelog

Sourced from axios's changelog.

Changelog

v1.21.0 — October 21, 2026

This release adds response timing and opt-in UTF-8 Basic authentication, improves request handling across runtimes, and changes how header defaults are recognized.

⚠️ Breaking Changes & Deprecations

Header Defaults: Only plain objects, null-prototype maps, and compatible AxiosHeaders instances are treated as common or method-specific defaults; literal headers such as Link are now preserved. Applications using custom class instances as defaults must convert them to plain maps, for example { post: { ...customDefaults } }, or compatible AxiosHeaders. Otherwise, those instances become literal header values, including on requests using other methods. (#11156)

🚀 New Features

Response Timing: Added response.duration, in milliseconds, including on error.response when present. Timing measures adapter execution and excludes interceptors and transforms; streamed responses stop timing when the stream becomes available. Axios replaces any existing duration value supplied by a custom adapter. (#11214)

UTF-8 Basic Authentication: Added transitional.encodeBasicAuthUsername: true to support Unicode usernames in XHR and Fetch requests. The option defaults to false, preserving existing authentication behavior; applications opting in should supply the original Unicode username and remove manual pre-encoding workarounds. (#11159)

🐛 Bug Fixes

Fetch Compatibility: Restored requests in runtimes such as Cloudflare Workers that reject the implicit cache: 'default', while preserving explicit caller settings. Response-size failures now retain their original ERR_BAD_RESPONSE and request context when runtime wrappers replace the underlying stream error. (#11194, #11179)

Runtime Consistency: Aligned encoded-byte size accounting, multipart uploads, proxy routing, same-origin resolution, parameter merging, and form serialization across adapters. Circular parameters now reject with ERR_BAD_OPTION_VALUE, and sparse or non-index numeric form fields serialize as keyed objects. With proxy: false, native proxyEnv agents using unsupported pool-management or TLS-session lifecycle overrides now reject with ERR_BAD_OPTION_VALUE; construct those agents without proxyEnv. (#11242)

Header Handling: Preserved headers named __proto__ using safe casing without changing the AxiosHeaders instance prototype. Function matchers in has(), delete(), and clear() now receive the headers instance as this, matching their declared contract. (#11134, #11216)

URL and Data URL Parsing: Accepted case-insensitive supported URL schemes and Base64 markers, and corrected decoding of percent-encoded Base64 data URLs. Node data URL allocation estimates remain aligned with decoding so configured size limits apply before allocation. (#11138, #11163, #11294)

Error Diagnostics: Preserved short reconstructed request stacks and appended wrapped error stacks under Caused by: so tooling that reads only error.stack retains the original failure context. (#11132, #11142)

Interceptor Removal: Restored removal through canonical numeric-string interceptor IDs, including after registry compaction. (#11139)

Proxy TLS: HTTPS CONNECT tunnels now apply current origin TLS options from an explicit httpsAgent, or from https.globalAgent when no explicit agent is supplied. This preserves process-wide custom CA settings through proxy tunnels. (#11178)

XHR Lifecycle: Used asynchronous Cookie Store reads for XSRF tokens where supported, preserving cookie fallback, timeout accounting, and cancellation. Upload and download progress listeners are now removed on completion, failure, timeout, and cancellation. (#11166, #11225)

HTTP/2 Sessions: Stopped reusing sessions immediately after GOAWAY and prevented draining sessions from scheduling idle timers that could delay process exit. (#11210)

TypeScript Declarations: Exposed the response-default marker as a public type to resolve TS2527 when consumers emit declarations involving unresolved response generics, covering both ESM and CommonJS. (#11125)

🔧 Maintenance & Chores

Configuration Performance: Reduced request configuration merge overhead, particularly for requests with many headers, while preserving merge semantics and prototype-pollution guards. (#11208)

Same-Origin Checks: Removed obsolete Internet Explorer detection without changing origin decisions in supported environments. (#11174)

Dependencies: Updated follow-redirects to 1.16.1 and refreshed development, documentation, test, and GitHub Actions dependencies. Removed unused dayjs from the docs package, root chalk, and chai from CJS module tests. (#11169, #11188, #11189, #11195, #11212, #11213, #11218, #11220, #11221, #11230, #11234, #11244, #11245, #11266, #11267, #11268, #11269, #11270, #11271, #11272, #11298, #11302, #11303, #11304, #11305, #11306, #11313, #11321, #11322, #11323, #11342)

Documentation: Fixed interceptor test links, updated README CDN examples to the published 1.20.0 bundle, and corrected guidance on interceptor options and request lifecycle ordering. (#11228, #11149, #11335)

Contributor Workflow: Consolidated agent instructions in AGENTS.md, standardized PR labels, required prerelease notes and validation evidence, and clarified that npm test requires installed Playwright browsers. (#11238, #11273, #11223, #11284)

Sponsors and Support: Added HeroDevs, Code for Japan, and Sweepico sponsor listings, refreshed sponsor data, and documented extended security support for Axios v0. (#11222, #11249, #11252, #11341)

Proxy Regression Coverage: Added a long dotted request-hostname test for NO_PROXY handling, extending coverage of an existing denial-of-service fix. (#11235)

Release Preparation: Updated package version metadata for 1.21.0. (#11346)

🌟 New Contributors

Welcome to our 24 new contributors. Thank you for helping improve Axios:

@lazerg (#11194)

@QIU-Guanzong (#11228)

@Iams4kura (#11125)

@vjymisal0 (#11179)

@jarrensj (#11238)

@LineGu (#11132)

@luantaraschi (#11134)

... (truncated)

Commits

335e2f8 chore(release): prepare release 1.21.1 (#11435)
c07e981 docs: note that FormData parsing has a fixed depth limit (#11430)
f0fcec7 test(helpers): cover IDN, CIDR and port edge cases in shouldBypassProxy (#11431)
4f203a9 docs(i18n): add locale prefix to internal links in es, fr, zh docs (#11401)
98156ee docs: correct request config and AxiosHeaders descriptions (#11389)
a81d62a test: cover cancellation lifecycle and timeout precedence (#11376)
a42a19a docs: add missing error codes to the error tables (#11429)
1fcaf82 chore(deps-dev): refresh development dependencies (#11426)
fb88a1b chore(deps-dev): bump the development_dependencies group with 4 updates (#11422)
31cc02a chore(deps): bump zizmorcore/zizmor-action from 0.7.1 to 0.8.0 in the github-...
Additional commits viewable in compare view

Updates body-parser from 2.3.0 to 2.4.0

Release notes

Sourced from body-parser's releases.

v2.4.0

Important: Security

Security fix for CVE-2026-111181 (GHSA-27r3-jxmh-p828)

What's Changed

build(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in expressjs/body-parser#737

chore: group github actions updates by @Phillip9587 in expressjs/body-parser#743

build(deps): bump the github-actions group with 3 updates by @dependabot[bot] in expressjs/body-parser#745

test: fix 'presist' typo in test descriptions by @maxtaran2010 in expressjs/body-parser#749

docs: include security fix in 2.3.0 changes by @UlisesGascon in expressjs/body-parser#748

fix: avoid mutating read options when reading body by @Phillip9587 in expressjs/body-parser#742

refactor: move getCharset helper to only usage by @Phillip9587 in expressjs/body-parser#707

build(deps): bump the github-actions group with 7 updates by @dependabot[bot] in expressjs/body-parser#753

refactor: switch to neostandard by @Phillip9587 in expressjs/body-parser#751

perf(json): avoid first-char regex for direct JSON bodies by @Phillip9587 in expressjs/body-parser#744

docs: fix entity verify error description by @Rawal27 in expressjs/body-parser#755

feat: zstandard support by @Phillip9587 in expressjs/body-parser#586

test: remove unused experimentalZstd option by @Phillip9587 in expressjs/body-parser#757

ci: run tests on windows and macos matrix by @kilisamemarisaaa in expressjs/body-parser#759

deps: qs@^6.16.0 by @krzysdz in expressjs/body-parser#762

build(deps): bump the github-actions group with 3 updates by @dependabot[bot] in expressjs/body-parser#763

ci: trigger npm publish on release published and set dist-tag by @UlisesGascon in expressjs/body-parser#768

build(deps): bump the github-actions group with 3 updates by @dependabot[bot] in expressjs/body-parser#771

fix(test): pin supertest to 7.3.0 to avoid 7.3.1 regression by @saadkhantareen in expressjs/body-parser#773

perf: inline content stream setup by @Phillip9587 in expressjs/body-parser#750

docs: note that req.body may be undefined in v2 by @Hashim1999164 in expressjs/body-parser#752

docs: fix strict option description by @Rawal27 in expressjs/body-parser#756

docs: fix depth error description by @johnnyhuirilef in expressjs/body-parser#776

chore: update dependencies by @Phillip9587 in expressjs/body-parser#778

Release: 2.4.0 by @UlisesGascon in expressjs/body-parser#777

New Contributors

@maxtaran2010 made their first contribution in expressjs/body-parser#749

@Rawal27 made their first contribution in expressjs/body-parser#755

@kilisamemarisaaa made their first contribution in expressjs/body-parser#759

@saadkhantareen made their first contribution in expressjs/body-parser#773

@Hashim1999164 made their first contribution in expressjs/body-parser#752

@johnnyhuirilef made their first contribution in expressjs/body-parser#776

Full Changelog: expressjs/body-parser@v2.3.0...v2.4.0

Changelog

Sourced from body-parser's changelog.

2.4.0

Security fix for GHSA-27r3-jxmh-p828 (CVE-2026-111181)

feat: add zstd content-encoding support (#586)

Requires Node.js ^22.15.0 or >=23.8.0; older versions keep returning 415 for zstd encoded bodies

fix: avoid mutating the parser options and the request object while reading the body (#742, #750)

perf(json): avoid first-char regex for direct JSON bodies (#744)

deps:

content-type@^2.1.0

iconv-lite^0.7.3

qs@^6.16.1

Commits

b4744d7 2.4.0 (#777)
f7075ea fix: prevent process crash from trailing bytes after a compressed body
185ff1d chore: update dependencies (#778)
73713f7 docs: fix depth error description (#776)
2dcc826 docs: improve readability (#756)
402dbdc docs: note that req.body may be undefined in v2 (#752)
9883a1e perf: inline content stream setup (#750)
02101da fix(test): pin supertest to 7.3.0 to avoid 7.3.1 regression (#773)
822a0fd build(deps): bump the github-actions group with 3 updates (#771)
aa9889b ci: trigger npm publish on release published and set dist-tag (#768)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for body-parser since your current version.

Updates brace-expansion from 1.1.11 to 1.1.21

Release notes

Sourced from brace-expansion's releases.

v1.1.15

Backport v5.0.6 change to v1 (#111) 0b09384

juliangruber/brace-expansion@v1.1.14...v1.1.15

v1.1.12

pkg: publish on tag 1.x c460dbd

fmt ccb8ac6

Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) c3c73c8

juliangruber/brace-expansion@v1.1.11...v1.1.12

Commits

8e81e18 1.1.21
ffdfa3e Merge commit from fork
c6513ad 1.1.20
1efee7c Merge commit from fork
a34340a 1.1.19
0bcbfc0 Merge commit from fork
758fcd6 1.1.18
27fbeed Merge commit from fork
5c57cc2 1.1.17
d757f1d npm ignore .claude
Additional commits viewable in compare view

Updates compression from 1.8.1 to 1.8.2

Release notes

Sourced from compression's releases.

v1.8.2

Important

Fix CVE-2026-87776 (GHSA-vc2v-76pw-4v95)

What's Changed

chore: add funding to package.json by @bjohansebas in expressjs/compression#248

build(deps): bump github/codeql-action from 3.29.2 to 3.29.5 by @dependabot[bot] in expressjs/compression#249

build(deps): bump actions/checkout from 4.2.2 to 5.0.0 by @dependabot[bot] in expressjs/compression#253

build(deps): bump github/codeql-action from 3.29.7 to 3.29.11 by @dependabot[bot] in expressjs/compression#252

build(deps): bump actions/download-artifact from 4.3.0 to 5.0.0 by @dependabot[bot] in expressjs/compression#251

build(deps): bump actions/setup-node from 4.4.0 to 6.0.0 by @dependabot[bot] in expressjs/compression#261

build(deps): bump github/codeql-action from 3.29.11 to 4.31.2 by @dependabot[bot] in expressjs/compression#260

build(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 by @dependabot[bot] in expressjs/compression#259

build(deps): bump actions/download-artifact from 5.0.0 to 6.0.0 by @dependabot[bot] in expressjs/compression#258

build(deps): bump coverallsapp/github-action from 2.3.6 to 2.3.7 by @dependabot[bot] in expressjs/compression#264

build(deps): bump actions/checkout from 5.0.0 to 6.0.0 by @dependabot[bot] in expressjs/compression#263

build(deps): bump github/codeql-action from 4.31.2 to 4.31.5 by @dependabot[bot] in expressjs/compression#262

chore: up node version to 25.x in CI by @imangas in expressjs/compression#272

doc(package): remove history.md and add readme.md to published files by @sheplu in expressjs/compression#270

Update link to CONTRIBUTING.md by @krzysdz in expressjs/compression#281

test: run CI on Windows and macOS by @kilisamemarisaaa in expressjs/compression#283

build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 by @dependabot[bot] in expressjs/compression#257

build(deps): bump actions/download-artifact from 6.0.0 to 7.0.0 by @dependabot[bot] in expressjs/compression#268

build(deps): bump github/codeql-action from 4.31.5 to 4.31.9 by @dependabot[bot] in expressjs/compression#265

build(deps): bump actions/setup-node from 6.0.0 to 6.1.0 by @dependabot[bot] in expressjs/compression#266

build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 by @dependabot[bot] in expressjs/compression#267

chore(ci): npm-publish via reusable workflows by @sheplu in expressjs/compression#269

docs: update outdated Brotli note and fix npm install docs URL by @Vansh1811 in expressjs/compression#276

fix: match Cache-Control no-transform directive case-insensitively by @vaibhavmashal in expressjs/compression#286

1.8.2 by @UlisesGascon in expressjs/compression#287

New Contributors

@imangas made their first contribution in expressjs/compression#272

@sheplu made their first contribution in expressjs/compression#270

@krzysdz made their first contribution in expressjs/compression#281

@kilisamemarisaaa made their first contribution in expressjs/compression#283

@Vansh1811 made their first contribution in expressjs/compression#276

@vaibhavmashal made their first contribution in expressjs/compression#286

Full Changelog: expressjs/compression@v1.8.1...v1.8.2

Changelog

Sourced from compression's changelog.

1.8.2

Fix CVE-2026-87776 (GHSA-vc2v-76pw-4v95)

deps: add destroy@1.2.0

Match Cache-Control: no-transform directive case-insensitively

Commits

0f97074 1.8.2 (#287)
151f63e fix: destroy compression stream on response close
0a76495 fix: match Cache-Control no-transform directive case-insensitively (#286)
c17b6e5 docs: update outdated Brotli note and fix npm install docs URL (#276)
112911a chore(ci): npm-publish via reusable workflows (#269)
1bf5eb0 build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 (#267)
d8fe64d build(deps): bump actions/setup-node from 6.0.0 to 6.1.0 (#266)
b218ff5 build(deps): bump github/codeql-action from 4.31.5 to 4.31.9 (#265)
8a1cf8e build(deps): bump actions/download-artifact from 6.0.0 to 7.0.0 (#268)
4a19855 build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 (#257)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for compression since your current version.

Updates fast-uri from 3.1.2 to 3.1.9

Release notes

Sourced from fast-uri's releases.

v3.1.9

Security

This security release fixes four URI parsing and normalization vulnerabilities in fast-uri 3.x. Applications that process untrusted URI input should upgrade to v3.1.9.

Medium — URI scheme spoofing through percent-encoded schemes (GHSA-w74x-v6f9-j3xg, CVE-2026-110306): percent-encoded scheme input is now rejected instead of being decoded into a live scheme.

Medium — Host confusion during domain-host canonicalization (GHSA-wjr9-j795-jxcr, CVE-2026-110180): malformed domain hosts containing ambiguous delimiters or stripped control characters are now rejected instead of being silently rewritten.

Low — Incorrect relative-reference normalization (GHSA-xhq7-xmqj-769h, CVE-2026-110095): dot-segment removal now preserves the resolution semantics of relative references.

Low — Scheme injection in suffix references (GHSA-333x-w4r6-6crp, CVE-2026-110725): first-segment colons in path-only suffix references are now escaped so the output is not reparsed as a scheme.

Upgrade with:
npm install fast-uri@3.1.9
Thanks to @zekth for reporting the scheme, host, and relative-reference issues, and to @UlisesGascon for finding the suffix-reference issue and reviewing the remediations.

What's Changed

ci: enable trusted publishing releases (v3.x) by @mcollina in fastify/fast-uri#229

Full Changelog: fastify/fast-uri@v3.1.8...v3.1.9

v3.1.8

⚠️ Security Warning

This security release fixes the following medium-severity security advisory:

GHSA-hrr3-gc8f-f4qj — inconsistent host case normalization via percent-encoded octets

Users of the v3.x release line should upgrade to v3.1.8.

Full Changelog: fastify/fast-uri@v3.1.7...v3.1.8

v3.1.7

⚠️ Security Warning

This is a security release that fixes the following high-severity security advisories:

GHSA-qw65-cvwx-89v3 — authority injection via an unvalidated port in serialize()

GHSA-58mr-gqgx-xq4g — host confusion via unbalanced or misplaced IP-literal brackets

Users of the v3.x release line should upgrade to v3.1.7.

Full Changelog: fastify/fast-uri@v3.1.6...v3.1.7

v3.1.6

⚠️ Security Warning

... (truncated)

Commits

0def703 Bumped v3.1.9
a1d0da2 test: generate only relative path references
9eb8759 fix: preserve relative paths in suffix and relative resolution
54c30f7 docs: note suffix-reference authority ambiguity
39e6493 fix: escape a first-segment colon in suffix references
745183c test: cover first-segment colon in suffix references
ddfc6a5 fix(SEC-03): reject non reg-name characters in domain hosts
d86a8d2 fix: keep a colon-first segment behind "./" in relative normalization
eb483b5 test: cover colon-first relative references in normalization
b110a35 fix(SEC-02): preserve meaning of relative references during normalization
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for fast-uri since your current version.

Updates fast-xml-parser from 5.11.0 to 5.12.0

Release notes

Sourced from fast-xml-parser's releases.

v5.12.0

What's Changed

fix: add endIndex to the CommonJS XMLMetaData declaration by @dualfroz in NaturalIntelligence/fast-xml-parser#896

Bump zizmorcore/z...
Description has been truncated

…pdates Bumps the npm_and_yarn group with 16 updates in the / directory: | Package | From | To | | --- | --- | --- | | [zod](https://github.com/colinhacks/zod) | `4.6.5` | `4.6.6` | | [axios](https://github.com/axios/axios) | `1.19.0` | `1.21.1` | | [body-parser](https://github.com/expressjs/body-parser) | `2.3.0` | `2.4.0` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.11` | `1.1.21` | | [compression](https://github.com/expressjs/compression) | `1.8.1` | `1.8.2` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.1.2` | `3.1.9` | | [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) | `5.11.0` | `5.12.0` | | [follow-redirects](https://github.com/follow-redirects/follow-redirects) | `1.16.0` | `1.16.3` | | [handlebars](https://github.com/handlebars-lang/handlebars.js) | `4.7.8` | `4.7.10` | | [ip-address](https://github.com/beaugunderson/ip-address) | `10.1.0` | `10.7.6` | | [joi](https://github.com/hapijs/joi) | `17.13.3` | `17.13.9` | | [launch-editor](https://github.com/vitejs/launch-editor) | `2.13.2` | `2.14.2` | | [moment](https://github.com/moment/moment) | `2.30.1` | `2.31.0` | | [node-forge](https://github.com/digitalbazaar/forge) | `1.4.0` | `1.4.3` | | [postcss-selector-parser](https://github.com/postcss/postcss-selector-parser) | `7.1.1` | `7.1.8` | | [qs](https://github.com/ljharb/qs) | `6.15.3` | `6.17.1` | Updates `zod` from 4.6.5 to 4.6.6 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v4.6.5...v4.6.6) Updates `axios` from 1.19.0 to 1.21.1 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.19.0...v1.21.1) Updates `body-parser` from 2.3.0 to 2.4.0 - [Release notes](https://github.com/expressjs/body-parser/releases) - [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md) - [Commits](expressjs/body-parser@v2.3.0...v2.4.0) Updates `brace-expansion` from 1.1.11 to 1.1.21 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@1.1.11...v1.1.21) Updates `compression` from 1.8.1 to 1.8.2 - [Release notes](https://github.com/expressjs/compression/releases) - [Changelog](https://github.com/expressjs/compression/blob/master/HISTORY.md) - [Commits](expressjs/compression@v1.8.1...v1.8.2) Updates `fast-uri` from 3.1.2 to 3.1.9 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.2...v3.1.9) Updates `fast-xml-parser` from 5.11.0 to 5.12.0 - [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases) - [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md) - [Commits](NaturalIntelligence/fast-xml-parser@v5.11.0...v5.12.0) Updates `follow-redirects` from 1.16.0 to 1.16.3 - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.16.0...v1.16.3) Updates `handlebars` from 4.7.8 to 4.7.10 - [Release notes](https://github.com/handlebars-lang/handlebars.js/releases) - [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/v4.7.10/release-notes.md) - [Commits](handlebars-lang/handlebars.js@v4.7.8...v4.7.10) Updates `ip-address` from 10.1.0 to 10.7.6 - [Release notes](https://github.com/beaugunderson/ip-address/releases) - [Commits](beaugunderson/ip-address@v10.1.0...v10.7.6) Updates `joi` from 17.13.3 to 17.13.9 - [Commits](hapijs/joi@v17.13.3...v17.13.9) Updates `launch-editor` from 2.13.2 to 2.14.2 - [Commits](vitejs/launch-editor@v2.13.2...v2.14.2) Updates `moment` from 2.30.1 to 2.31.0 - [Release notes](https://github.com/moment/moment/releases) - [Changelog](https://github.com/moment/moment/blob/develop/CHANGELOG.md) - [Commits](moment/moment@2.30.1...2.31.0) Updates `node-forge` from 1.4.0 to 1.4.3 - [Changelog](https://github.com/digitalbazaar/forge/blob/main/CHANGELOG.md) - [Commits](digitalbazaar/forge@v1.4.0...v1.4.3) Updates `postcss-selector-parser` from 7.1.1 to 7.1.8 - [Release notes](https://github.com/postcss/postcss-selector-parser/releases) - [Changelog](https://github.com/postcss/postcss-selector-parser/blob/main/CHANGELOG.md) - [Commits](postcss/postcss-selector-parser@v7.1.1...7.1.8) Updates `qs` from 6.15.3 to 6.17.1 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.15.3...v6.17.1) --- updated-dependencies: - dependency-name: zod dependency-version: 4.6.6 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: axios dependency-version: 1.21.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: body-parser dependency-version: 2.4.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.21 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: compression dependency-version: 1.8.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-xml-parser dependency-version: 5.12.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: follow-redirects dependency-version: 1.16.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: handlebars dependency-version: 4.7.10 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ip-address dependency-version: 10.7.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: joi dependency-version: 17.13.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: launch-editor dependency-version: 2.14.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: moment dependency-version: 2.31.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: node-forge dependency-version: 1.4.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: postcss-selector-parser dependency-version: 7.1.8 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.17.1 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added Dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Nov 12, 2026

isekovanic closed this Nov 12, 2026

Navigation Menu

Repository navigation

chore(deps): bump the npm_and_yarn group across 1 directory with 16 updates - #3985

chore(deps): bump the npm_and_yarn group across 1 directory with 16 updates#3985
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/npm_and_yarn-217fe0e2f1

dependabot Bot commented on behalf of github Nov 12, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Nov 12, 2026

v4.6.6

Commits:

v1.21.1 — November 9, 2026

🔒 Security Fixes

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

v1.21.0 — October 21, 2026

Changelog

v1.21.0 — October 21, 2026

⚠️ Breaking Changes & Deprecations

🚀 New Features

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

v2.4.0

Important: Security

What's Changed

New Contributors

2.4.0

v1.1.15

v1.1.12

v1.8.2

Important

What's Changed

New Contributors

1.8.2

v3.1.9

Security

What's Changed

v3.1.8

⚠️ Security Warning

v3.1.7

⚠️ Security Warning

v3.1.6

⚠️ Security Warning

v5.12.0

What's Changed

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant