chore(deps): bump the npm_and_yarn group across 2 directories with 15 updates by dependabot[bot] · Pull Request #667 · dzcode-io/dzcode.io

dependabot · 2026-04-08T03:11:56Z

Bumps the npm_and_yarn group with 14 updates in the / directory:

Package	From	To
@sentry/node	`8.35.0`	`8.49.0`
drizzle-orm	`0.33.0`	`0.45.2`
lodash	`4.17.21`	`4.18.1`
glob	`11.0.0`	`12.0.0`
js-yaml	`3.14.1`	`3.14.2`
brace-expansion	`1.1.11`	`1.1.13`
axios	`1.7.7`	`1.14.0`
effect	`3.6.5`	`3.21.0`
tmp	`0.2.3`	`0.2.5`
flatted	`3.3.1`	`3.4.2`
handlebars	`4.7.8`	`4.7.9`
yaml	`1.10.2`	`1.10.3`
picomatch	`2.3.1`	`2.3.2`
tar	`6.2.1`	`7.5.11`

Bumps the npm_and_yarn group with 1 update in the /api directory: drizzle-orm.

Updates @sentry/node from 8.35.0 to 8.49.0

Changelog

Sourced from @sentry/node's changelog.

8.49.0

feat(v8/browser): Flush offline queue on flush and browser online event (#14969)

feat(v8/react): Add a handled prop to ErrorBoundary (#14978)

fix(profiling/v8): Don't put require, __filename and __dirname on global object (#14952)

fix(v8/node): Enforce that ContextLines integration does not leave open file handles (#14997)

fix(v8/replay): Disable mousemove sampling in rrweb for iOS browsers (#14944)

fix(v8/sveltekit): Ensure source maps deletion is called after source ma… (#14963)

fix(v8/vue): Re-throw error when no errorHandler exists (#14943)

Work in this release was contributed by @HHK1 and @mstrokin. Thank you for your contribution!

8.48.0

Deprecations

feat(v8/core): Deprecate getDomElement method (#14799)

Deprecates getDomElement. There is no replacement.

Other changes

fix(nestjs/v8): Use correct main/module path in package.json (#14791)

fix(v8/core): Use consistent continueTrace implementation in core (#14819)

fix(v8/node): Correctly resolve debug IDs for ANR events with custom appRoot (#14823)

fix(v8/node): Ensure NODE_OPTIONS is not passed to worker threads (#14825)

fix(v8/angular): Fall back to element tagName when name is not provided to TraceDirective (#14828)

fix(aws-lambda): Remove version suffix from lambda layer (#14843)

fix(v8/node): Ensure express requests are properly handled (#14851)

feat(v8/node): Add openTelemetrySpanProcessors option (#14853)

fix(v8/react): Use Set as the allRoutes container. (#14878) (#14884)

fix(v8/react): Improve handling of routes nested under path="/" (#14897)

feat(v8/core): Add normalizedRequest to samplingContext (#14903)

fix(v8/feedback): Avoid lazy loading code for syncFeedbackIntegration (#14918)

Work in this release was contributed by @arturovt. Thank you for your contribution!

8.47.0

feat(v8/core): Add updateSpanName helper function (#14736)

feat(v8/node): Do not overwrite prisma db.system in newer Prisma versions (#14772)

feat(v8/node/deps): Bump @prisma/instrumentation from 5.19.1 to 5.22.0 (#14755)

feat(v8/replay): Mask srcdoc iframe contents per default (#14779)

ref(v8/nextjs): Fix typo in source maps deletion warning (#14776)

Work in this release was contributed by @aloisklink and @benjick. Thank you for your contributions!

8.46.0

feat: Allow capture of more than 1 ANR event [v8] (#14713)

... (truncated)

Commits

db51933 release: 8.49.0
629fba2 meta(changelog): Update CHANGELOG for 8.49.0 (#15019)
f5ac627 fix(v8/node): Enforce that ContextLines integration does not leave open file ...
286f6b0 test(v8/e2e): Fix node-express test transitive dependency (#15004)
798a932 feat(v8/browser): Flush offline queue on flush and browser online event (#14969)
0c3b2a4 fix(v8/replay): Disable mousemove sampling in rrweb for iOS browsers (#14944)
fda1aee feat(v8/react): Add a handled prop to ErrorBoundary (#14978)
5182853 chore(v8/repo): Add missing v7 changelog entries (#14961)
af00c8f fix(v8/sveltekit): Ensure source maps deletion is called after source ma… (#1...
8926cb7 fix(v8/vue): Re-throw error when no errorHandler exists (#14943)
Additional commits viewable in compare view

Updates drizzle-orm from 0.33.0 to 0.45.2

Release notes

Sourced from drizzle-orm's releases.

0.45.2

Fixed sql.identifier(), sql.as() escaping issues. Previously all the values passed to this functions were not properly escaped causing a possible SQL Injection (CWE-89) vulnerability

Thanks to @EthanKim88, @0x90sh and @wgoodall01 for reaching out to us with a reproduction and suggested fix

0.45.1

Fixed pg-native Pool detection in node-postgres transactions breaking in environments with forbidden require() (#5107)

0.45.0

Fixed pg-native Pool detection in node-postgres transactions

Allowed subqueries in select fields

Updated typo algorythm => algorithm

Fixed $onUpdate not handling SQL values (fixes #2388, tests implemented by L-Mario564 in #2911)

Fixed pg mappers not handling Date instances in bun-sql:postgresql driver responses for date, timestamp types (fixes #4493)

0.44.7

fix durable sqlite transaction return value #3746 - thanks @joaocstro

0.44.6

feat: add $replicas reference #4874

0.44.5

Fixed invalid usage of .one() in durable-sqlite session

Fixed spread operator related crash in sqlite blob columns

Better browser support for sqlite blob columns

Improved sqlite blob mapping

0.44.4

Fix wrong DrizzleQueryError export. thanks @nathankleyn

0.44.3

Fixed types of $client for clients created by drizzle function
await db.$client.[...]
Added the updated_at column to the neon_auth.users_sync table definition.

0.44.2

[BUG]: Fixed type issues with joins with certain variations of tsconfig: #4535, #4457

0.44.1

[BUG]: Drizzle can no longer run on Durable Objects

0.44.0

Error handling

Starting from this version, we’ve introduced a new DrizzleQueryError that wraps all errors from database drivers and provides a set of useful information:

... (truncated)

Commits

273c780 + 0.45.2 (#5534)
4aa6ecf Kit updates (#5490)
e8e6edf feat(drizzle-kit): support d1 via binding (#5302)
a086f59 Fixed pg-native Pool detection in node-postgres transactions breaking in envi...
c445637 Merge pull request #5095 from drizzle-team/main-workflows
e7b3aaa Merge branch 'main' into main-workflows
0d885a5 refactor: Update condition for run-feature job to improve clarity and functio...
45a1ffb Merge pull request #5087 from drizzle-team/main-workflows
6357645 chore: Comment out NEON_HTTP_CONNECTION_STRING requirement in release workflows
53dec98 refactor: Simplify release router workflow by removing unnecessary switch job...
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for drizzle-orm since your current version.

Updates lodash from 4.17.21 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

lodash: lodash/lodash@4.18.0-npm...4.18.1-npm

lodash-es: lodash/lodash@4.18.0-es...4.18.1-es

lodash-amd: lodash/lodash@4.18.0-amd...4.18.1-amd

lodash.templatelodash/lodash@4.18.0-npm-packages...4.18.1-npm-packages

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

Add security notice for _.template in threat model and API docs (#6099)

Document lower > upper behavior in _.random (#6115)

Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

lodash.orderby

lodash.tonumber

lodash.trim

lodash.trimend

lodash.sortedindexby

lodash.zipobjectdeep

lodash.unset

lodash.omit

lodash.template

Commits

cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
75535f5 chore: prune stale advisory refs (#6170)
62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
59be2de release(minor): bump to 4.18.0 (#6161)
af63457 fix: broken tests for _.template 879aaa9
1073a76 fix: linting issues
879aaa9 fix: validate imports keys in _.template
fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
b819080 ci: add dist sync validation workflow (#6137)
Additional commits viewable in compare view

Updates glob from 11.0.0 to 12.0.0

Changelog

Sourced from glob's changelog.

changeglob

13

Move the CLI program out to a separate package, glob-bin. Install that if you'd like to continue using glob from the command line.

12

Remove the unsafe --shell option. The --shell option is now ONLY supported on known shells where the behavior can be implemented safely.

11.1

GHSA-5j98-mcp5-4vw2

Add the --shell option for the command line, with a warning that this is unsafe. (It will be removed in v12.)

Add the --cmd-arg/-g as a way to safely add positional arguments to the command provided to the CLI tool.

Detect commands with space or quote characters on known shells, and pass positional arguments to them safely, avoiding shell:true execution.

11.0

Drop support for node before v20

10.4

Add includeChildMatches: false option

Export the Ignore class

10.3

Add --default -p flag to provide a default pattern

exclude symbolic links to directories when follow and nodir are both set

10.2

Add glob cli

10.1

Return '.' instead of the empty string '' when the current working directory is returned as a match.

Add posix: true option to return / delimited paths, even on

... (truncated)

Commits

2b03cca 12.0.0
d56203d prettier config
bb521e5 Remove --shell option where unsafe to use
2551fb5 11.1.0
47473c0 bin: Do not expose filenames to shell expansion
bc33fe1 skip tilde test on systems that lack tilde expansion
59bf9ca fix notes
dde4fa6 docs(README): add #anchor and improve notes
0559b0e docs: add better links to path-scurry docs
c9773c2 fix: correct typos in README.md
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by isaacs, a new releaser for glob since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates js-yaml from 3.14.1 to 3.14.2

Changelog

Sourced from js-yaml's changelog.

[3.14.2] - 2025-11-15

Security

Backported v4.1.1 fix to v3

[4.1.1] - 2025-11-12

Security

Fix prototype pollution issue in yaml merge (<<) operator.

[4.1.0] - 2021-04-15

Added

Types are now exported as yaml.types.XXX.

Every type now has options property with original arguments kept as they were (see yaml.types.int.options as an example).

Changed

Schema.extend() now keeps old type order in case of conflicts (e.g. Schema.extend([ a, b, c ]).extend([ b, a, d ]) is now ordered as abcd instead of cbad).

[4.0.0] - 2021-01-03

Changed

Check migration guide to see details for all breaking changes.

Breaking: "unsafe" tags !!js/function, !!js/regexp, !!js/undefined are moved to js-yaml-js-types package.

Breaking: removed safe* functions. Use load, loadAll, dump instead which are all now safe by default.

yaml.DEFAULT_SAFE_SCHEMA and yaml.DEFAULT_FULL_SCHEMA are removed, use yaml.DEFAULT_SCHEMA instead.

yaml.Schema.create(schema, tags) is removed, use schema.extend(tags) instead.

!!binary now always mapped to Uint8Array on load.

Reduced nesting of /lib folder.

Parse numbers according to YAML 1.2 instead of YAML 1.1 (01234 is now decimal, 0o1234 is octal, 1:23 is parsed as string instead of base60).

dump() no longer quotes :, [, ], (, ) except when necessary, #470, #557.

Line and column in exceptions are now formatted as (X:Y) instead of at line X, column Y (also present in compact format), #332.

Code snippet created in exceptions now contains multiple lines with line numbers.

dump() now serializes undefined as null in collections and removes keys with undefined in mappings, #571.

dump() with skipInvalid=true now serializes invalid items in collections as null.

Custom tags starting with ! are now dumped as !tag instead of !<!tag>, #576.

Custom tags starting with tag:yaml.org,2002: are now shorthanded using !!, #258.

Added

Added .mjs (es modules) support.

Added quotingType and forceQuotes options for dumper to configure string literal style, #290, #529.

Added styles: { '!!null': 'empty' } option for dumper (serializes { foo: null } as "foo: "), #570.

... (truncated)

Commits

9963d36 3.14.2 released
10d3c8e dist rebuild
5278870 fix prototype pollution in merge (<<) (#731)
See full diff in compare view

Updates brace-expansion from 1.1.11 to 1.1.13

Release notes

Sourced from brace-expansion's releases.

v1.1.12

pkg: publish on tag 1.x c460dbd

fmt ccb8ac6

Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) c3c73c8

juliangruber/brace-expansion@v1.1.11...v1.1.12

Commits

6c353ca 1.1.13
7fd684f Backport fix for GHSA-f886-m6hf-6m8v (#95)
44f33b4 1.1.12
c460dbd pkg: publish on tag 1.x
ccb8ac6 fmt
c3c73c8 Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65)
See full diff in compare view

Updates axios from 1.7.7 to 1.14.0

Release notes

Sourced from axios's releases.

v1.14.0

This release focuses on compatibility fixes, adapter stability improvements, and test/tooling modernisation.

⚠️ Important Changes

Breaking Changes: None identified in this release.

Action Required: If you rely on env-based proxy behaviour or CJS resolution edge-cases, validate your integration after upgrade (notably proxy-from-env v2 alignment and main entry compatibility fix).

🚀 New Features

Runtime Features: No new end-user features were introduced in this release.

Test Coverage Expansion: Added broader smoke/module test coverage for CJS and ESM package usage. (#7510)

🐛 Bug Fixes

Headers: Trim trailing CRLF in normalised header values. (#7456)

HTTP/2: Close detached HTTP/2 sessions on timeout to avoid lingering sessions. (#7457)

Fetch Adapter: Cancel ReadableStream created during request-stream capability probing to prevent async resource leaks. (#7515)

Proxy Handling: Fixed env proxy behavior with proxy-from-env v2 usage. (#7499)

CommonJS Compatibility: Fixed package main entry regression affecting CJS consumers. (#7532)

🔧 Maintenance & Chores

Security/Dependencies: Updated formidable and refreshed package set to newer versions. (#7533, #10556)

Tooling: Continued migration to Vitest and modernised CI/test harnesses. (#7484, #7489, #7498)

Build/Lint Stack: Rollup, ESLint, TypeScript, and related dev-dependency updates. (#7508, #7509, #7522)

Documentation: Clarified JSON parsing and adapter-related docs/comments. (#7398, #7460, #7478)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve Axios:

@aviu16 (#7456)

@NETIZEN-11 (#7460)

@fedotov (#7457)

@nthbotast (#7478)

@veeceey (#7398)

@penkzhou (#7515)

Full Changelog: v1.13.6...v1.14.0

v1.13.6

This release focuses on platform compatibility, error handling improvements, and code quality maintenance.

⚠️ Important Changes

Breaking Changes: None identified in this release.

Action Required: Users targeting React Native should verify their integration, particularly if relying on specific Blob or FormData behaviours, as improvements have been made to support these objects.

🚀 New Features

React Native Blob Support: Axios now includes support for React Native Blob objects. Thanks to @moh3n9595 for the initial implementation. (#5764)

Code Quality: Implemented prettier across the codebase and resolved associated formatting issues. (#7385)

🐛 Bug Fixes

Environment Compatibility:

Fixed module exports for React Native and Browserify environments. (#7386)

... (truncated)

Changelog

Sourced from axios's changelog.

Changelog

1.13.3 (2026-01-20)

Bug Fixes

http2: Use port 443 for HTTPS connections by default. (#7256) (d7e6065)

interceptor: handle the error in the same interceptor (#6269) (5945e40)

main field in package.json should correspond to cjs artifacts (#5756) (7373fbf)

package.json: add 'bun' package.json 'exports' condition. Load the Node.js build in Bun instead of the browser build (#5754) (b89217e)

silentJSONParsing=false should throw on invalid JSON (#7253) (#7257) (7d19335)

turn AxiosError into a native error (#5394) (#5558) (1c6a86d)

types: add handlers to AxiosInterceptorManager interface (#5551) (8d1271b)

types: restore AxiosError.cause type from unknown to Error (#7327) (d8233d9)

unclear error message is thrown when specifying an empty proxy authorization (#6314) (6ef867e)

Features

add undefined as a value in AxiosRequestConfig (#5560) (095033c)

add automatic minor and patch upgrades to dependabot (#6053) (65a7584)

add Node.js coverage script using c8 (closes #7289) (#7294) (ec9d94e)

added copilot instructions (3f83143)

compatibility with frozen prototypes (#6265) (860e033)

enhance pipeFileToResponse with error handling (#7169) (88d7884)

types: Intellisense for string literals in a widened union (#6134) (f73474d), closes microsoft/TypeScript#33471

Reverts

Revert "fix: silentJSONParsing=false should throw on invalid JSON (#7253) (#7…" (#7298) (a4230f5), closes #7253 #7 #7298

deps: bump peter-evans/create-pull-request from 7 to 8 in the github-actions group (#7334) (2d6ad5e)

Contributors to this release

Ashvin Tiwari

Nikunj Mochi

Anchal Singh

jasonsaayman

Julian Dax

Akash Dhar Dubey

Madhumita

Tackoil

Justin Dhillon

Rudransh

WuMingDao

codenomnom

Nandan Acharya

Eric Dubé

Tibor Pilz

Gabriel Quaresma

Turadg Aleahmad

... (truncated)

Commits

46bee3d chore(release): prepare release 1.14.0 (#10563)
518aff5 chore: add AI Moderator workflow for spam detection (#10551)
b7dfda3 chore(sponsor): update sponsor block (#10557)
9aa34d5 fix: updated release flow to match the current flows (#10562)
e9e5ebe Update packages to latest version (#10556)
4d8931c fix: formidable dependency vulnerable to arbitrary (#7533)
3a6f5c1 chore(deps-dev): bump @babel/preset-env (#7531)
bcfd299 fix: bug axios breaks commonjs compatibility main entry (#7532)
d6dcbfd fix: dependabot uses the correct labels (#7530)
5dd7ba7 chore: upgrade to latest ts (#7522)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for axios since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates effect from 3.6.5 to 3.21.0

Release notes

Sourced from effect's releases.

effect@3.21.0

Minor Changes
#5780 f7bb09b Thanks @kitlangton! - Add Cron.prev and reverse iteration support, aligning next/prev lookup tables, fixing DST handling symmetry, and expanding cron backward/forward test coverage.

#5780 bd7552a Thanks @mattiamanzati! - Add type-level utils to asserting layer types
#5780 ad1a7eb Thanks @schickling! - RcMap: support dynamic idleTimeToLive values per key

The idleTimeToLive option can now be a function that receives the key and returns a duration, allowing different TTL values for different resources.
const map =
  yield *
  RcMap.make({
    lookup: (key: string) => acquireResource(key),
    idleTimeToLive: (key: string) => {
      if (key.startsWith("premium:")) return Duration.minutes(10)
      return Duration.minutes(1)
    }
  })
#5780 0d32048 Thanks @mikearnaldi! - Fix annotateCurrentSpan, add Effect.currentPropagatedSpan
Patch Changes
#5780 0d32048 Thanks @mikearnaldi! - Add logs to first propagated span, in the following case before this fix the log would not be added to the p span because Effect.fn adds a fake span for the purpose of adding a stack frame.
import { Effect } from "effect"
const f = Effect.fn(function* () {
yield* Effect.logWarning("FooBar")
return yield* Effect.fail("Oops")
})
const p = f().pipe(Effect.withSpan("p"))
effect@3.20.1

Patch Changes

#6133 add06f4 Thanks @aniravi24! - Fix Equal.equals crash when comparing null values inside structuralRegion. Added null guard before Object.getPrototypeOf calls to prevent TypeError: Cannot convert undefined or null to object.

#6093 a03b6a2 Thanks @luchersou! - avoid class for PrettyError to preserve error.name

effect@3.20.0

Minor Changes

... (truncated)

Changelog

Sourced from effect's changelog.

3.21.0

Minor Changes
#5780 f7bb09b Thanks @kitlangton! - Add Cron.prev and reverse iteration support, aligning next/prev lookup tables, fixing DST handling symmetry, and expanding cron backward/forward test coverage.

#5780 bd7552a Thanks @mattiamanzati! - Add type-level utils to asserting layer types
#5780 ad1a7eb Thanks @schickling! - RcMap: support dynamic idleTimeToLive values per key

The idleTimeToLive option can now be a function that receives the key and returns a duration, allowing different TTL values for different resources.
const map =
  yield *
  RcMap.make({
    lookup: (key: string) => acquireResource(key),
    idleTimeToLive: (key: string) => {
      if (key.startsWith("premium:")) return Duration.minutes(10)
      return Duration.minutes(1)
    }
  })
#5780 0d32048 Thanks @mikearnaldi! - Fix annotateCurrentSpan, add Effect.currentPropagatedSpan
Patch Changes
#5780 0d32048 Thanks @mikearnaldi! - Add logs to first propagated span, in the following case before this fix the log would not be added to the p span because Effect.fn adds a fake span for the purpose of adding a stack frame.
import { Effect } from "effect"
const f = Effect.fn(function* () {
yield* Effect.logWarning("FooBar")
return yield* Effect.fail("Oops")
})
const p = f().pipe(Effect.withSpan("p"))
3.20.1

Patch Changes

#6133 add06f4 Thanks @aniravi24! - Fix Equal.equals crash when comparing null values inside structuralRegion. Added null guard before Object.getPrototypeOf calls to prevent TypeError: Cannot convert undefined or null to object.

#6093 a03b6a2 Thanks @luchersou! - avoid class for PrettyError to preserve error.name

3.20.0

... (truncated)

Commits

6e3782a Version Packages (#6135)
f7bb09b Add Cron.prev reverse iteration support (#5786)
bd7552a Add type-level utils to asserting layer types (#5920)
ad1a7eb RcMap: support dynamic idleTimeToLive values per key (#5859)
0d32048 Add logs to first propagated span (#5710)
37a8af5 Version Packages (#6134)
a03b6a2 fix(logger): use source maps for error stack traces in browser pretty logger ...
7d8fc1e docs(Layer): clarify scopedDiscard JSDoc to match effectDiscard (#5790)
add06f4 fix(Equal): guard against null in structuralRegion comparison (#6133)
aa47393 Version Packages (#6089)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for effect since your current version.

Updates tmp from 0.2.3 to 0.2.5

Commits

3d2fe38 Bump up the version
e162828 Merge pull request #309 from fflorent/fix-tmp-dir-with-dir
b847d2f Fix use of tmp.dir() with dir option
08fa3ab Update version
1cf4ec5 Merge commit from fork
188b25e Fix GHSA-52f5-9888-hmc6
73b9fe4 Add test case for GHSA-52f5-9888-hmc6

… updates Bumps the npm_and_yarn group with 14 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@sentry/node](https://github.com/getsentry/sentry-javascript) | `8.35.0` | `8.49.0` | | [drizzle-orm](https://github.com/drizzle-team/drizzle-orm) | `0.33.0` | `0.45.2` | | [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.18.1` | | [glob](https://github.com/isaacs/node-glob) | `11.0.0` | `12.0.0` | | [js-yaml](https://github.com/nodeca/js-yaml) | `3.14.1` | `3.14.2` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.11` | `1.1.13` | | [axios](https://github.com/axios/axios) | `1.7.7` | `1.14.0` | | [effect](https://github.com/Effect-TS/effect/tree/HEAD/packages/effect) | `3.6.5` | `3.21.0` | | [tmp](https://github.com/raszi/node-tmp) | `0.2.3` | `0.2.5` | | [flatted](https://github.com/WebReflection/flatted) | `3.3.1` | `3.4.2` | | [handlebars](https://github.com/handlebars-lang/handlebars.js) | `4.7.8` | `4.7.9` | | [yaml](https://github.com/eemeli/yaml) | `1.10.2` | `1.10.3` | | [picomatch](https://github.com/micromatch/picomatch) | `2.3.1` | `2.3.2` | | [tar](https://github.com/isaacs/node-tar) | `6.2.1` | `7.5.11` | Bumps the npm_and_yarn group with 1 update in the /api directory: [drizzle-orm](https://github.com/drizzle-team/drizzle-orm). Updates `@sentry/node` from 8.35.0 to 8.49.0 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/8.49.0/CHANGELOG.md) - [Commits](getsentry/sentry-javascript@8.35.0...8.49.0) Updates `drizzle-orm` from 0.33.0 to 0.45.2 - [Release notes](https://github.com/drizzle-team/drizzle-orm/releases) - [Commits](drizzle-team/drizzle-orm@0.33.0...0.45.2) Updates `lodash` from 4.17.21 to 4.18.1 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.18.1) Updates `glob` from 11.0.0 to 12.0.0 - [Changelog](https://github.com/isaacs/node-glob/blob/main/changelog.md) - [Commits](isaacs/node-glob@v11.0.0...v12.0.0) Updates `js-yaml` from 3.14.1 to 3.14.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.14.1...3.14.2) Updates `brace-expansion` from 1.1.11 to 1.1.13 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@1.1.11...v1.1.13) Updates `axios` from 1.7.7 to 1.14.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.7.7...v1.14.0) Updates `effect` from 3.6.5 to 3.21.0 - [Release notes](https://github.com/Effect-TS/effect/releases) - [Changelog](https://github.com/Effect-TS/effect/blob/main/packages/effect/CHANGELOG.md) - [Commits](https://github.com/Effect-TS/effect/commits/effect@3.21.0/packages/effect) Updates `tmp` from 0.2.3 to 0.2.5 - [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md) - [Commits](raszi/node-tmp@v0.2.3...v0.2.5) Updates `flatted` from 3.3.1 to 3.4.2 - [Commits](WebReflection/flatted@v3.3.1...v3.4.2) Updates `form-data` from 4.0.1 to 4.0.5 - [Release notes](https://github.com/form-data/form-data/releases) - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v4.0.1...v4.0.5) Updates `handlebars` from 4.7.8 to 4.7.9 - [Release notes](https://github.com/handlebars-lang/handlebars.js/releases) - [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/v4.7.9/release-notes.md) - [Commits](handlebars-lang/handlebars.js@v4.7.8...v4.7.9) Updates `yaml` from 1.10.2 to 1.10.3 - [Release notes](https://github.com/eemeli/yaml/releases) - [Commits](eemeli/yaml@v1.10.2...v1.10.3) Updates `picomatch` from 2.3.1 to 2.3.2 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@2.3.1...2.3.2) Updates `tar` from 6.2.1 to 7.5.11 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v6.2.1...v7.5.11) Updates `drizzle-orm` from 0.33.0 to 0.45.2 - [Release notes](https://github.com/drizzle-team/drizzle-orm/releases) - [Commits](drizzle-team/drizzle-orm@0.33.0...0.45.2) --- updated-dependencies: - dependency-name: "@sentry/node" dependency-version: 8.49.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: drizzle-orm dependency-version: 0.45.2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.18.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: glob dependency-version: 12.0.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 3.14.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.13 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: axios dependency-version: 1.14.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: effect dependency-version: 3.21.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tmp dependency-version: 0.2.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: flatted dependency-version: 3.4.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: form-data dependency-version: 4.0.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: handlebars dependency-version: 4.7.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: yaml dependency-version: 1.10.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 2.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tar dependency-version: 7.5.11 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: drizzle-orm dependency-version: 0.45.2 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 8, 2026

github-project-automation bot added this to DzCode i/o Apr 8, 2026

github-actions bot added data Data related changes ( data folder ) api API related changes ( api folder ) labels Apr 8, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the npm_and_yarn group across 2 directories with 15 updates#667

chore(deps): bump the npm_and_yarn group across 2 directories with 15 updates#667
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm_and_yarn-97773b76c3

dependabot bot commented on behalf of github Apr 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot bot commented on behalf of github Apr 8, 2026

8.49.0

8.48.0

Deprecations

Other changes

8.47.0

8.46.0

0.45.2

0.45.1

0.45.0

0.44.7

0.44.6

0.44.5

0.44.4

0.44.3

0.44.2

0.44.1

0.44.0

Error handling

4.18.1

Bugs

4.18.0

v4.18.0

Security

Docs

lodash.* modular packages

changeglob

13

12

11.1

11.0

10.4

10.3

10.2

10.1

[3.14.2] - 2025-11-15

Security

[4.1.1] - 2025-11-12

Security

[4.1.0] - 2021-04-15

Added

Changed

[4.0.0] - 2021-01-03

Changed

Added

v1.1.12

v1.14.0

⚠️ Important Changes

🚀 New Features

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

v1.13.6

⚠️ Important Changes

🚀 New Features

🐛 Bug Fixes

Changelog

1.13.3 (2026-01-20)

Bug Fixes

Features

Reverts

Contributors to this release

effect@3.21.0

Minor Changes

Patch Changes

effect@3.20.1

Patch Changes

effect@3.20.0

Minor Changes

3.21.0

Minor Changes

Patch Changes

3.20.1

Patch Changes

3.20.0

Uh oh!

Reviewers

Assignees

Labels

`lodash.*` modular packages