Skip to content

chore(deps): bump the npm-security group across 1 directory with 15 updates - #125

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/npm-security-9ff3b108e0
Open

chore(deps): bump the npm-security group across 1 directory with 15 updates#125
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/npm-security-9ff3b108e0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm-security group with 15 updates in the / directory:

Package From To
dompurify 3.3.3 3.4.13
postcss 8.5.3 8.5.23
brace-expansion 1.1.11 1.1.21
js-yaml 3.14.1 3.14.2
extract-zip 1.7.0 removed
browserslist 4.24.5 4.29.0
colord 2.9.3 2.10.0
fast-uri 3.0.6 3.1.8
immutable 5.1.2 5.1.9
nanoid 5.1.5 5.1.16
nanoid 3.3.11 3.3.19
protobufjs 7.6.4 7.6.6
react-router 6.30.3 7.18.4
shell-quote 1.8.2 1.10.0
svgo 3.3.2 3.3.5
webpack-dev-server 4.15.2 5.2.6

Updates dompurify from 3.3.3 to 3.4.13

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.13

  • Fixed an issue with hook removal during IN_PLACE sanitization, thanks @​koyokr
  • Fixed an issue with hooks potentially bypassing the clone guard, thanks @​AkshayjainG
  • Fixed an issue with DOM clobbering via ownerDocument during IN_PLACE, thanks @​AkshayjainG
  • Bumped several dependencies where possible

DOMPurify 3.4.12

  • Fixed an issue where a hook would not get called for custom elements, thanks @​Rikuxx0
  • Hardened the handling of hooks removing elements, @​mkrause-bee360
  • Added support for a few new SVG attributes, thanks @​cbn-falias & @​Develop-KIM
  • Hardened the handling of declarative partial updates
  • Updated the documentation is several spots, README, wiki, etc.
  • Bumped several dependencies where possible

DOMPurify 3.4.11

  • Fixed an issue with a leaky config for hooks via setConfig, thanks @​trace37labs
  • Bumped vulnerable development dependencies to arrive at plain 0 with npm audit
  • Updated the osv-scanner suppression list as no vulnerable dependencies are left for now
  • Updated up the linting tool-chain and removed now-redundant lint directives
  • Updated the documentation is several spots, README, wiki, etc.
  • Bumped several dependencies where possible

DOMPurify 3.4.10

  • Refactored codebase for clarity: extracted the public type declarations into types.ts
  • Decomposed the three largest sanitizer functions into focused helpers
  • Removed duplicated defaults and dead branches, consolidated SAFE_FOR_TEMPLATES scrubbing into single shared path
  • Improved per-node performance by hoisting the mXSS probe regexes and testing textContent before innerHTML
  • Added a deterministic micro-benchmark harness (npm run bench) with a --compare mode
  • Reduced CI cost by running the full three-engine browser suite once per PR
  • Refreshed the demos/ folder so every demo runs again, and added a SVG-via-<img> demo
  • Documented the bench and test:happydom scripts in the README
  • Completed the Attack Classes & Bypass History wiki page
  • Bumped several dependencies where possible

DOMPurify 3.4.9

  • Further improved the handling of Trusted Types config options, thanks @​offset
  • Further improved the handling of IN_PLACE sanitization, thanks @​mozfreddyb
  • Added more test coverage for IN_PLACE and Trusted Types related usage
  • Bumped several dependencies where possible
  • Updated README and wiki with more accurate documentation & attack samples

DOMPurify 3.4.8

  • Cleaned up the repository root, renamed some and removed unneeded files
  • Fixed an issue with handling of Trusted Types policies, thanks @​fulstadev
  • Fixed the node iterator for better template scrubbing, thanks @​IamLeandrooooo
  • Included formerly missing LICENSE-MPL in published npm package, thanks @​asamuzaK
  • Bumped several dependencies where possible

DOMPurify 3.4.7

... (truncated)

Commits
Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates postcss from 8.5.3 to 8.5.23

Release notes

Sourced from postcss's releases.

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

8.5.19

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

  • Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

  • Fixed Maximum call stack size exceeded error.
  • Fixed Prototype hijacking for postcss.fromJSON().
  • Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

8.5.15

  • Fixed declaration parsing performance (by @​homanp).

8.5.14

8.5.13

  • Fixed postcss-scss commend regression.

8.5.12

  • Fixed reading any file via user-generated CSS.
  • Added opts.unsafeMap to disable checks.

8.5.11

  • Fixed nested brackets parsing performance (by @​offset).

8.5.10

  • Fixed XSS via unescaped </style> in non-bundler cases (by @​TharVid).

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

8.5.19

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

  • Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

  • Fixed Maximum call stack size exceeded error.
  • Fixed Prototype hijacking for postcss.fromJSON().
  • Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

8.5.15

  • Fixed declaration parsing performance (by @​homanp).

8.5.14

8.5.13

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.


Updates brace-expansion from 1.1.11 to 1.1.21

Release notes

Sourced from brace-expansion's releases.

v1.1.15

  • Backport v5.0.6 change to v1 (#111) 0b09384

juliangruber/brace-expansion@v1.1.14...v1.1.15

v1.1.12

  • pkg: publish on tag 1.x c460dbd
  • fmt ccb8ac6
  • Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) c3c73c8

juliangruber/brace-expansion@v1.1.11...v1.1.12

Commits

Updates js-yaml from 3.14.1 to 3.14.2

Changelog

Sourced from js-yaml's changelog.

[3.14.2] - 2025-11-15

Security

  • Backported v4.1.1 fix to v3

[4.1.1] - 2025-11-12

Security

  • Fix prototype pollution issue in yaml merge (<<) operator.

[4.1.0] - 2021-04-15

Added

  • Types are now exported as yaml.types.XXX.
  • Every type now has options property with original arguments kept as they were (see yaml.types.int.options as an example).

Changed

  • Schema.extend() now keeps old type order in case of conflicts (e.g. Schema.extend([ a, b, c ]).extend([ b, a, d ]) is now ordered as abcd instead of cbad).

[4.0.0] - 2021-01-03

Changed

  • Check migration guide for details of all breaking changes.
  • Breaking: "unsafe" tags !!js/function, !!js/regexp, !!js/undefined are moved to js-yaml-js-types package.
  • Breaking: removed safe* functions. Use load, loadAll, dump instead which are all now safe by default.
  • yaml.DEFAULT_SAFE_SCHEMA and yaml.DEFAULT_FULL_SCHEMA are removed, use yaml.DEFAULT_SCHEMA instead.
  • yaml.Schema.create(schema, tags) is removed, use schema.extend(tags) instead.
  • !!binary now always mapped to Uint8Array on load.
  • Reduced nesting of /lib folder.
  • Parse numbers according to YAML 1.2 instead of YAML 1.1 (01234 is now decimal, 0o1234 is octal, 1:23 is parsed as string instead of base60).
  • dump() no longer quotes :, [, ], (, ) except when necessary, #470, #557.
  • Line and column in exceptions are now formatted as (X:Y) instead of at line X, column Y (also present in compact format), #332.
  • Code snippet created in exceptions now contains multiple lines with line numbers.
  • dump() now serializes undefined as null in collections and removes keys with undefined in mappings, #571.
  • Custom tags starting with ! are now dumped as !tag instead of !<!tag>, #576.
  • Custom tags starting with tag:yaml.org,2002: are now shorthanded using !!, #258.

Added

  • Added .mjs (es modules) support.
  • Added quotingType and forceQuotes options for dumper to configure string literal style, #290, #529.
  • Added styles: { '!!null': 'empty' } option for dumper (serializes { foo: null } as "foo: "), #570.

... (truncated)

Commits

Removes extract-zip

Updates browserslist from 4.24.5 to 4.29.0

Release notes

Sourced from browserslist's releases.

4.29.0

  • Added query continuations across lines and array entries (by @​fzlzjerry).

4.28.9

4.28.8

  • Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

4.28.6

4.28.5

4.28.4

  • Fixed SyntaxError regression of 4.28.3.

4.28.3

  • Fixed baseline query case-insensitivity (by @​swwind).

4.28.2

4.28.1

  • Removed Baseline warning since we have it own warning.

4.27.0

  • Added BROWSERSLIST_TRACE_WARNING environment variable.

4.26.3

4.26.2

  • Fixed baseline-browser-mapping version requirement.

4.26.1

  • Updated Firefox ESR.

4.26.0

4.25.4

... (truncated)

Changelog

Sourced from browserslist's changelog.

4.29.0

  • Added query continuations across lines and array entries (by @​fzlzjerry).

4.28.9

4.28.8

  • Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

4.28.6

4.28.5

4.28.4

  • Fixed SyntaxError regression of 4.28.3.

4.28.3

  • Fixed baseline query case-insensitivity (by @​swwind).

4.28.2

4.28.1

  • Removed Baseline warning since we have it own warning.

4.48.0

4.27.0

  • Added BROWSERSLIST_TRACE_WARNING environment variable.

... (truncated)

Commits
  • e6dd578 Release 4.29.0 version
  • 8987b7d Typo
  • 47fefe6 Move from actions-up to pnpm
  • 17b1e23 Update dependencies
  • df16b26 Merge pull request #944 from fzlzjerry/fix/757-query-continuations
  • a2673d7 Support query continuations across entries
  • f46a5b7 Merge pull request #942 from agilgur5/fix-docs-typo-security-table
  • 989c8c9 docs: fix typo in table rendering for SECURITY.md
  • 12ed525 Release 4.28.9 version
  • b1d8cf9 Update dependencies
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for browserslist since your current version.


Updates colord from 2.9.3 to 2.10.0

Release notes

Sourced from colord's releases.

v2.10 (RGB color mixing)

  • mix, tints, shades and tones (mix plugin) now accept an optional interpolation color space. LAB stays the default; pass "rgb" to interpolate RGB channels instead — the way browsers and design tools (such as Figma) composite translucent layers.
import { colord, extend } from "colord";
import mixPlugin from "colord/plugins/mix";
extend([mixPlugin]);
colord("#ff0000").mix("#ffffff", 0.5, "rgb").toHex(); // "#ff8080"
colord("#f0f3f1").mix("#007d40", 0.14, "rgb").toHex(); // "#cee2d8" — same as compositing rgba(0, 125, 64, 0.14) over #f0f3f1
colord("#ff0000").tints(3, "rgb").map((c) => c.toHex()); // ["#ff0000", "#ff8080", "#ffffff"]

Changelog

Sourced from colord's changelog.

2.10.0

  • Improve mix plugin by adding an optional "rgb" interpolation mode to mix, tints, tones and shades

2.9.7

  • Make HEX parsing and serialization more than 2x faster

2.9.6

  • Fix: Rotate the unrounded hue so rotate and harmonies preserve the original color
  • Fix: Normalize HWB whiteness + blackness over 100% to gray ❤️ @​spokodev

2.9.5

Both fixes change returned numbers for a small set of colors; toHex() output is unchanged. Snapshots holding h: 360, "hsl(360, …)" or a delta() value may need updating.

2.9.4

  • Fix: Reject malformed color strings in linear time ❤️ @​GAP-dev
Commits

Updates fast-uri from 3.0.6 to 3.1.8

Release notes

Sourced from fast-uri's releases.

v3.1.8

⚠️ Security Warning

This security release fixes the following medium-severity security advisory:

Users of the v3.x release line should upgrade to v3.1.8.

Full Changelog: fastify/fast-uri@v3.1.7...v3.1.8

v3.1.7

⚠️ Security Warning

This is a security release that fixes the following high-severity security advisories:

Users of the v3.x release line should upgrade to v3.1.7.

Full Changelog: fastify/fast-uri@v3.1.6...v3.1.7

v3.1.6

⚠️ Security Warning

This release addresses the following high-severity security advisories:

Users of the v3.x release line should upgrade to v3.1.6.

Full Changelog: fastify/fast-uri@v3.1.5...v3.1.6

v3.1.5

⚠️ Security Warning

Fix for GHSA-7p8r-x3mc-p8w7

Full Changelog: fastify/fast-uri@v3.1.4...v3.1.5

v3.1.4

⚠️ Security Release

Fix for GHSA-v2hh-gcrm-f6hx

Full Changelog: fastify/fast-uri@v3.1.3...v3.1.4

... (truncated)

Commits
  • ead3ab7 Bumped v3.1.8
  • c88b59e fix: normalize decoded reg-name case
  • 412e40a Bumped v3.1.7
  • 9f4c943 fix: backport port and IP-literal validation to v3.x (#216)
  • 1eb3ce4 fix: treat unterminated bracket hosts as reg-names again (#214)
  • 6f970b2 Bumped v3.1.6
  • d941579 fix: never run IDN canonicalization on bracketed IP literals
  • c0f0279 test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)
  • 37f3417 Merge commit from fork
  • 607bfbe Merge commit from fork
  • Additional commits viewable in compare view

Updates immutable from 5.1.2 to 5.1.9

Release notes

Sourced from immutable's releases.

v5.1.9

What's Changed

Full Changelog: immutable-js/immutable-js@v5.1.8...v5.1.9

v5.1.8

What's Changed

Full Changelog: immutable-js/immutable-js@v5.1.7...v5.1.8

v5.1.7

What's Changed

internal

New Contributors

Full Changelog: immutable-js/immutable-js@v5.1.6...v5.1.7

v5.1.6

What's Changed

... (truncated)

Changelog

Sourced from immutable's changelog.

5.1.9

  • fix(List): a List grown past 32 elements while all its values are undefined no longer reads those values back as null (affected get, iteration, toArray, equals and hashCode)

5.1.8

4.3.9

5.1.7

  • fix(Repeat): lastIndexOf returned size instead of size - 1 by @​chatman-media in immutable-js/immutable-js#2227. Fixes CVE CVE-2026-29063
  • fix(IndexedCollection): has(index) on a lazy Seq of unknown size now checks index existence instead of searching for a value equal to the index #2203
  • [TypeScript]: reduce/reduceRight without an initial value now infer the result type from the collection's values when the reducer returns a value (e.g. list.reduce((a, b) => a + b) infers number), matching Array#reduce. Previously an explicit type argument was required. #2205

5.1.6

  • fix(reverseFactory): read reversedSequence.size in __iterator instead of this #2196

5.1.5

  • Fix Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

5.1.4

Documentation

Internal

... (truncated)

Commits
  • 329f7a6 5.1.9
  • 21fabd9 changelog
  • 009164f Merge pull request #2235 from immutable-js/fix/avoid-null-when-setsize33
  • 5b65bfb fix(List): preserve undefined values when grown past 32 elements
  • 50bf39e Update CHANGELOG.md for versions 5.1.8 and 4.3.9
  • 6496539 5.1.8
  • 808a83a Merge commit from fork
  • e51d49f perf(Map): index large hash-collision buckets for faster lookups
  • 25c58b0 fix typescript in tests
  • a1a1ee4 Merge commit from fork
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for immutable since your current version.


Updates nanoid from 5.1.5 to 5.1.16

Release notes

Sourced from nanoid's releases.

5.1.16

5.1.15

  • Fixed random pool corruption on big ID sizes.

5.1.14

  • Fixed npm package size regression.

5.1.13

  • Fixed npm package size regression.

5.1.12

  • Moved to npm Provenance and Staged Publishing.

5.1.11

  • Fixed breaking Nano ID by requesting big ID.

5.1.10

5.1.9

  • Fixed npm package size regression.

5.1.8

5.1.7

5.1.6

  • Fixed infinite loop on 0 size for customAlphabet.
Changelog

Sourced from nanoid's changelog.

5.1.16

5.1.15

  • Fixed random pool corruption on big ID sizes.

5.1.14

  • Fixed npm package size regression.

5.1.13

  • Fixed npm package size regression.

5.1.12

  • Moved to npm Provenance and Staged Publishing.

5.1.11

  • Fixed breaking Nano ID by requesting big ID.

5.1.10

5.1.9

  • Fixed npm package size regression.

5.1.8

5.1.7

5.1.6

  • Fixed infinite loop on 0 size for customAlphabet.
Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nanoid since your current version.


Updates nanoid from 3.3.11 to 3.3.19

Release notes

Sourced from nanoid's releases.

5.1.16

5.1.15

  • Fixed random pool corruption on big ID sizes.

5.1.14

  • Fixed npm package size regression.

5.1.13

  • Fixed npm package size regression.

5.1.12

  • Moved to npm Provenance and Staged Publishing.

5.1.11

  • Fixed breaking Nano ID by requesting big ID.

5.1.10

5.1.9

  • Fixed npm package size regression.

5.1.8

5.1.7

5.1.6

  • Fixed infinite loop on 0 size for customAlphabet.
Changelog

Sourced from nanoid's changelog.

5.1.16

5.1.15

  • Fixed random pool corruption on big ID sizes.

5.1.14

  • Fixed npm package size regression.

5.1.13

  • Fixed npm package size regression.

5.1.12

  • Moved to npm Provenance and Staged Publishing.

5.1.11

  • Fixed breaking Nano ID by requesting big ID.

5.1.10

5.1.9

  • Fixed npm package size regression.

5.1.8

5.1.7

5.1.6

  • Fixed infinite loop on 0 size for customAlphabet.
Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nanoid since your current version.


Updates protobufjs from 7.6.4 to 7.6.6

Release notes

Sourced from protobufjs's releases.

protobufjs: v7.6.6

7.6.6 (2026-08-27)

Bug Fixes

protobufjs: v7.6.5

@dependabot
chore(deps): bump the npm-security group across 1 directory with 15 u…
6e857a7 
…pdates

Bumps the npm-security group with 15 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.3.3` | `3.4.13` |
| [postcss](https://github.com/postcss/postcss) | `8.5.3` | `8.5.23` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.11` | `1.1.21` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `3.14.1` | `3.14.2` |
| [extract-zip](https://github.com/maxogden/extract-zip) | `1.7.0` | `removed` |
| [browserslist](https://github.com/browserslist/browserslist) | `4.24.5` | `4.29.0` |
| [colord](https://github.com/omgovich/colord) | `2.9.3` | `2.10.0` |
| [fast-uri](https://github.com/fastify/fast-uri) | `3.0.6` | `3.1.8` |
| [immutable](https://github.com/immutable-js/immutable-js) | `5.1.2` | `5.1.9` |
| [nanoid](https://github.com/ai/nanoid) | `5.1.5` | `5.1.16` |
| [nanoid](https://github.com/ai/nanoid) | `3.3.11` | `3.3.19` |
| [protobufjs](https://github.com/protobufjs/protobuf.js) | `7.6.4` | `7.6.6` |
| [react-router](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router) | `6.30.3` | `7.18.4` |
| [shell-quote](https://github.com/ljharb/shell-quote) | `1.8.2` | `1.10.0` |
| [svgo](https://github.com/svg/svgo) | `3.3.2` | `3.3.5` |
| [webpack-dev-server](https://github.com/webpack/webpack-dev-server) | `4.15.2` | `5.2.6` |



Updates `dompurify` from 3.3.3 to 3.4.13
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.3.3...3.4.13)

Updates `postcss` from 8.5.3 to 8.5.23
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.3...8.5.23)

Updates `brace-expansion` from 1.1.11 to 1.1.21
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@1.1.11...v1.1.21)

Updates `js-yaml` from 3.14.1 to 3.14.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@3.14.1...3.14.2)

Removes `extract-zip`

Updates `browserslist` from 4.24.5 to 4.29.0
- [Release notes](https://github.com/browserslist/browserslist/releases)
- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md)
- [Commits](browserslist/browserslist@4.24.5...4.29.0)

Updates `colord` from 2.9.3 to 2.10.0
- [Release notes](https://github.com/omgovich/colord/releases)
- [Changelog](https://github.com/omgovich/colord/blob/master/CHANGELOG.md)
- [Commits](https://github.com/omgovich/colord/commits/v2.10)

Updates `fast-uri` from 3.0.6 to 3.1.8
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.0.6...v3.1.8)

Updates `immutable` from 5.1.2 to 5.1.9
- [Release notes](https://github.com/immutable-js/immutable-js/releases)
- [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md)
- [Commits](immutable-js/immutable-js@v5.1.2...v5.1.9)

Updates `nanoid` from 5.1.5 to 5.1.16
- [Release notes](https://github.com/ai/nanoid/releases)
- [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md)
- [Commits](ai/nanoid@5.1.5...5.1.16)

Updates `nanoid` from 3.3.11 to 3.3.19
- [Release notes](https://github.com/ai/nanoid/releases)
- [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md)
- [Commits](ai/nanoid@5.1.5...5.1.16)

Updates `protobufjs` from 7.6.4 to 7.6.6
- [Release notes](https://github.com/protobufjs/protobuf.js/releases)
- [Changelog](https://github.com/protobufjs/protobuf.js/blob/protobufjs-v7.6.6/CHANGELOG.md)
- [Commits](protobufjs/protobuf.js@protobufjs-v7.6.4...protobufjs-v7.6.6)

Updates `react-router` from 6.30.3 to 7.18.4
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/react-router@7.18.4/packages/react-router/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/react-router@7.18.4/packages/react-router)

Updates `shell-quote` from 1.8.2 to 1.10.0
- [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md)
- [Commits](ljharb/shell-quote@v1.8.2...v1.10.0)

Updates `svgo` from 3.3.2 to 3.3.5
- [Release notes](https://github.com/svg/svgo/releases)
- [Commits](svg/svgo@v3.3.2...v3.3.5)

Updates `webpack-dev-server` from 4.15.2 to 5.2.6
- [Release notes](https://github.com/webpack/webpack-dev-server/releases)
- [Changelog](https://github.com/webpack/webpack-dev-server/blob/v5.2.6/CHANGELOG.md)
- [Commits](webpack/webpack-dev-server@v4.15.2...v5.2.6)

---
updated-dependencies:
- dependency-name: dompurify
  dependency-version: 3.4.13
  dependency-type: direct:production
  dependency-group: npm-security
- dependency-name: postcss
  dependency-version: 8.5.23
  dependency-type: direct:production
  dependency-group: npm-security
- dependency-name: brace-expansion
  dependency-version: 1.1.21
  dependency-type: indirect
  dependency-group: npm-security
- dependency-name: js-yaml
  dependency-version: 3.14.2
  dependency-type: indirect
  dependency-group: npm-security
- dependency-name: extract-zip
  dependency-version:
  dependency-type: indirect
  dependency-group: npm-security
- dependency-name: browserslist
  dependency-version: 4.29.0
  dependency-type: indirect
  dependency-group: npm-security
- dependency-name: colord
  dependency-version: 2.10.0
  dependency-type: indirect
  dependency-group: npm-security
- dependency-name: fast-uri
  dependency-version: 3.1.8
  dependency-type: indirect
  dependency-group: npm-security
- dependency-name: immutable
  dependency-version: 5.1.9
  dependency-type: indirect
  dependency-group: npm-security
- dependency-name: nanoid
  dependency-version: 5.1.16
  dependency-type: indirect
  dependency-group: npm-security
- dependency-name: nanoid
  dependency-version: 3.3.19
  dependency-type: indirect
  dependency-group: npm-security
- dependency-name: protobufjs
  dependency-version: 7.6.6
  dependency-type: indirect
  dependency-group: npm-security
- dependency-name: react-router
  dependency-version: 7.18.4
  dependency-type: indirect
  dependency-group: npm-security
- dependency-name: shell-quote
  dependency-version: 1.10.0
  dependency-type: indirect
  dependency-group: npm-security
- dependency-name: svgo
  dependency-version: 3.3.5
  dependency-type: indirect
  dependency-group: npm-security
- dependency-name: webpack-dev-server
  dependency-version: 5.2.6
  dependency-type: indirect
  dependency-group: npm-security
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 19, 2026
@socket-security

socket-security Bot commented Sep 19, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatednpm/​react-router-dom@​6.30.3 ⏵ 7.18.4100 +3100 +265 -997 +2100
Addednpm/​@​wordpress/​scripts@​35.0.09710010010070
Updatednpm/​@​wordpress/​e2e-test-utils-playwright@​1.23.0 ⏵ 2.0.0100 +110098100 +270
Updatednpm/​@​wordpress/​env@​10.23.0 ⏵ 11.15.094 -1100100100 +170
Updatednpm/​dompurify@​3.3.3 ⏵ 3.4.13100 +1100 +361009370 -20
Updatednpm/​postcss@​8.5.3 ⏵ 8.5.28100 +1100 +248294 -1100
Updatednpm/​webpack@​5.99.8 ⏵ 5.111.193 -2100 +293 +199 +1100

View full report

@socket-security

socket-security Bot commented Sep 19, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm @zip.js/zip.js is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package-lock.json → npm/@wordpress/env@11.15.0 → npm/@zip.js/zip.js@2.7.57

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@zip.js/zip.js@2.7.57. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm @zip.js/zip.js is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package-lock.json → npm/@wordpress/env@11.15.0 → npm/@zip.js/zip.js@2.7.57

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@zip.js/zip.js@2.7.57. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm csp_evaluator is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package-lock.json → npm/@wordpress/e2e-test-utils-playwright@2.0.0 → npm/csp_evaluator@1.1.8

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/csp_evaluator@1.1.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm data-urls is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package-lock.json → npm/@wordpress/scripts@35.0.0 → npm/data-urls@5.0.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/data-urls@5.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm rrweb-cssom is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package-lock.json → npm/@wordpress/scripts@35.0.0 → npm/rrweb-cssom@0.8.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/rrweb-cssom@0.8.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm zstddec is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package-lock.json → npm/@wordpress/env@11.15.0 → npm/zstddec@0.2.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/zstddec@0.2.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@dependabot @github

dependabot Bot commented on behalf of github Sep 28, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot attempted to update this pull request, but because the branch dependabot/npm_and_yarn/npm-security-9ff3b108e0 is protected it was unable to do so.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants