chore(deps): bump the security group across 4 directories with 16 updates by dependabot[bot] · Pull Request #1772 · getflip/swirl

dependabot · 2026-08-19T13:51:31Z

Bumps the security group with 16 updates in the / directory:

Package	From	To
@babel/core	`7.20.12`	`7.29.6`
svgo	`2.8.0`	`2.8.3`
vite	`3.2.10`	`6.4.3`
@angular/common	`19.2.23`	`20.3.27`
@angular/compiler	`19.2.23`	`20.3.27`
next	`14.2.35`	`15.5.21`
postcss	`8.4.33`	`8.5.23`
@hono/node-server	`1.19.9`	`1.19.17`
brace-expansion	`1.1.11`	`1.1.18`
fast-uri	`3.0.6`	`3.1.7`
hono	`4.12.3`	`4.13.5`
http-proxy-middleware	`2.0.9`	`2.0.10`
immutable	`5.1.3`	`5.1.9`
js-yaml	`3.14.1`	`3.15.2`
undici	`5.28.4`	`5.29.0`
websocket-driver	`0.7.4`	`0.7.5`

Bumps the security group with 2 updates in the /apps/swirl-docs directory: next and postcss.
Bumps the security group with 3 updates in the /packages/swirl-components directory: @babel/core, svgo and vite.
Bumps the security group with 2 updates in the /packages/swirl-components-angular directory: @angular/common and @angular/compiler.

Updates @babel/core from 7.20.12 to 7.29.6

Release notes

Sourced from @babel/core's releases.

v7.29.6 (2026-05-25)

🐛 Bug Fix

babel-generator

#18014 Catchup source map position in preserveFormat (@nicolo-ribaudo)

babel-core

#18001 [7.x packport]Improve input source map handling (@JLHwung)

babel-core, babel-generator

#17998 Preserve original identifier names from input sourcemaps (#17992) (@Andarist)

Committers: 3

Huáng Jùnliàng (@JLHwung)

Mateusz Burzyński (@Andarist)

Nicolò Ribaudo (@nicolo-ribaudo)

v7.29.5 (2026-05-05)

🏠 Internal

babel-preset-env

Update @babel/* dependencies

v7.29.4 (2026-05-05)

🐛 Bug Fix

babel-plugin-transform-modules-systemjs

#17974 [7.x backport]fix(systemjs): improve module string name support (@JLHwung)

Committers: 1

Huáng Jùnliàng (@JLHwung)

v7.29.3 (2026-04-30)

👓 Spec Compliance

babel-parser

#17923 Support flow extends bound (@JLHwung)

🐛 Bug Fix

babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators

#17931 fix(decorators): replace super within all removed static elements (@JLHwung)

babel-register

#17915 Fix thread synchronization issues in @babel/register (@liuxingbaoyu)

babel-compat-data, babel-plugin-bugfix-safari-rest-destructuring-rhs-array, babel-preset-env

#17788 Add bugfix plugin for Safari array rest destructuring bug (@JLHwung)

💅 Polish

babel-parser

#17782 Improve trailing comma comment handling (@JLHwung)

📝 Documentation

#17847 Replace npmjs.com links with npmx.dev (@nicolo-ribaudo)

... (truncated)

Commits

04ea6b2 v7.29.6
99f498a [7.x packport]Improve input source map handling (#18001)
feba0a3 Preserve original identifier names from input sourcemaps (#17992) (#17998)
aa8394e v7.29.0
ad0d03f [7.x backport] feat: Allow specifying startLine in code frame (#17739)
d7f4008 v7.28.6
e130225 Polish(standalone): improve message on invalid preset/plugin (#17606)
99dcba5 chore: enable some ts-eslint rules (#17592)
c92c491 Improve Unicode handling in code-frame tokenizer (#17589)
d725e39 Add BABEL_7_TO_8_DANGEROUSLY_DISABLE_VERSION_CHECK (#17569)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @babel/core since your current version.

Updates svgo from 2.8.0 to 2.8.3

Release notes

Sourced from svgo's releases.

v2.8.3

What's Changed

Security

removeScriptElement, make <script> handling namespace aware. By @SethFalco

Support

SVGO v2 is not officially supported, please consider upgrading to SVGO v4 instead. We've backported this fix as there are security implications, but there is no commitment to do this for more complex changes in future.

Consider reading our Migration Guide from v2 to v3 and Migration Guide from v3 to v4 which should ease the process.

v2.8.2

This is effectively just a re-release of SVGO v2.8.1, but with *.test.js files omitted. It seems something was wrong with the configuration in the v2.8.0 tag and I hadn't noticed it included a few extra files. 😅

We'll deprecate v2.8.1, and I'll include the change log here.

What's Changed

Dependencies

Migrates from our unsupported fork of sax (@trysound/sax) to the upstream version of sax (sax).

Bug Fixes

No longer throws error when encountering comments in DTD.

Metrics

Before and after of the browser bundle of each respective version:

v2.8.0 v2.8.2 Delta

svgo.browser.js 587.2 kB 589.2 kB ⬆️ 2 kB

Support

SVGO v2 is not officially supported, please consider upgrading to SVGO v4 instead. We've backported this fix as there are security implications, but there is no commitment to do this for more complex changes in future.

Consider reading our Migration Guide from v2 to v3 and Migration Guide from v3 to v4 which should ease the process.

v2.8.1

Deprecated

This release left *.test.js files in the package, which have been omitted in v2.8.2. Sorry for the noise!

What's Changed

Dependencies

... (truncated)

Commits

628e3bc Merge commit from fork
f706b07 deps: upgrade to sax v1.5.0
See full diff in compare view

Maintainer changes

This version was pushed to npm by sethiii, a new releaser for svgo since your current version.

Updates vite from 3.2.10 to 6.4.3

Release notes

Sourced from vite's releases.

v6.4.3

Please refer to CHANGELOG.md for details.

v6.4.2

Please refer to CHANGELOG.md for details.

v6.4.1

Please refer to CHANGELOG.md for details.

v5.4.21

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

6.4.3 (2026-06-01)

fix: backport #22572, reject windows alternate paths (#22576) (96b0c10), closes #22572 #22576

fix(deps): backport #22571, reject UNC paths for launch-editor-middleware (#22575) (8fed5cf), closes #22571 #22575

6.4.2 (2026-04-06)

fix: apply server.fs check to env transport (#22159) (#22163) (fe28e47), closes #22159 #22163

fix: avoid path traversal with optimize deps sourcemap handler (#22161) (ca4da5d), closes #22161

6.4.1 (2025-10-20)

fix(dev): trim trailing slash before server.fs.deny check (#20968) (#20969) (1114b5d), closes #20968 #20969

6.4.0 (2025-10-15)

feat: allow passing down resolved config to vite's createServer (#20932) (ca6455e), closes #20932

6.3.7 (2025-10-14)

fix(esbuild): inject esbuild helpers correctly for esbuild 0.25.9+ (#20940) (c59a222), closes #20940

6.3.6 (2025-09-08)

fix: apply fs.strict check to HTML files (#20736) (0ab19ea), closes #20736

fix: upgrade sirv to 3.0.2 (#20735) (e11d240), closes #20735

test: detect ts support via process.features (#20544) (7d99229), closes #20544

6.3.5 (2025-05-05)

fix(ssr): handle uninitialized export access as undefined (#19959) (fd38d07), closes #19959

6.3.4 (2025-04-30)

fix: check static serve file inside sirv (#19965) (c22c43d), closes #19965

fix(optimizer): return plain object when using require to import externals in optimized dependenci (efc5eab), closes #19940

... (truncated)

Commits

6c2c881 release: v6.4.3
96b0c10 fix: backport #22572, reject windows alternate paths (#22576)
8fed5cf fix(deps): backport #22571, reject UNC paths for launch-editor-middleware (#2...
6b3fad0 release: v6.4.2
ca4da5d fix: avoid path traversal with optimize deps sourcemap handler (#22161)
fe28e47 fix: apply server.fs check to env transport (#22159) (#22163)
5487f4f release: v6.4.1
1114b5d fix(dev): trim trailing slash before server.fs.deny check (#20968) (#20969)
f12697c release: v6.4.0
ca6455e feat: allow passing down resolved config to vite's createServer (#20932)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for vite since your current version.

Updates @angular/common from 19.2.23 to 20.3.27

Release notes

Sourced from @angular/common's releases.

20.3.27

compiler

Commit Description

disallow i18n event attributes

restrict possible event handler check to property names longer than 2 characters

http

Commit Description

distinguish repeated transfer cache params

platform-server

Commit Description

update domino to latest version

20.3.26

compiler-cli

Commit Description

update babel dependencies to latest v7

core

Commit Description

avoid caching missing locale data

reject dynamic script host elements

http

Commit Description

prevent caching of responses with Set-Cookie headers

service-worker

Commit Description

preserve referrer in asset requests

preserve referrer policy in asset requests

20.3.25

common

Commit Description

Limits date format string length

skip transfer cache for uncacheable HTTP traffic

use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Description

sanitize two-way properties

core

Commit Description

harden TransferState restoration against DOM clobbering

... (truncated)

Changelog

Sourced from @angular/common's changelog.

20.3.27 (2026-07-29)

compiler

Commit Type Description

5dbcd0ee16 fix disallow i18n event attributes

db0d4a1a39 fix restrict possible event handler check to property names longer than 2 characters

http

Commit Type Description

a64e2883e9 fix distinguish repeated transfer cache params

platform-server

Commit Type Description

6f80cca0b8 fix update domino to latest version

20.3.26 (2026-07-08)

compiler-cli

Commit Type Description

406aaa31e6 fix update babel dependencies to latest v7

core

Commit Type Description

26831d0cbd fix avoid caching missing locale data

8eb7aea08b fix reject dynamic script host elements

http

Commit Type Description

b963f61028 fix prevent caching of responses with Set-Cookie headers

service-worker

Commit Type Description

... (truncated)

Commits

a64e288 fix(http): distinguish repeated transfer cache params
b963f61 fix(http): prevent caching of responses with Set-Cookie headers
06be298 fix(http): preserve empty referrer option in HttpRequest
9f443bc fix(common): Limits date format string length
fa940e1 fix(http): Rejects non-HTTP(S) URLs in JSONP requests
1a62130 fix(common): use cryptographically secure SHA-256 for transfer cache key gene...
566ad05 fix(common): skip transfer cache for uncacheable HTTP traffic
e2ef1ce fix(http): skip transfer cache for fetch credentialed requests
3d135ce fix(common): add upper bounds for digitsInfo
39a4b4c fix(common): sanitize placeholder
Additional commits viewable in compare view

Updates @angular/compiler from 19.2.23 to 20.3.27

Release notes

Sourced from @angular/compiler's releases.

20.3.27

compiler

Commit Description

disallow i18n event attributes

restrict possible event handler check to property names longer than 2 characters

http

Commit Description

distinguish repeated transfer cache params

platform-server

Commit Description

update domino to latest version

20.3.26

compiler-cli

Commit Description

update babel dependencies to latest v7

core

Commit Description

avoid caching missing locale data

reject dynamic script host elements

http

Commit Description

prevent caching of responses with Set-Cookie headers

service-worker

Commit Description

preserve referrer in asset requests

preserve referrer policy in asset requests

20.3.25

common

Commit Description

Limits date format string length

skip transfer cache for uncacheable HTTP traffic

use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Description

sanitize two-way properties

core

Commit Description

harden TransferState restoration against DOM clobbering

... (truncated)

Changelog

Sourced from @angular/compiler's changelog.

20.3.27 (2026-07-29)

compiler

Commit Type Description

5dbcd0ee16 fix disallow i18n event attributes

db0d4a1a39 fix restrict possible event handler check to property names longer than 2 characters

http

Commit Type Description

a64e2883e9 fix distinguish repeated transfer cache params

platform-server

Commit Type Description

6f80cca0b8 fix update domino to latest version

20.3.26 (2026-07-08)

compiler-cli

Commit Type Description

406aaa31e6 fix update babel dependencies to latest v7

core

Commit Type Description

26831d0cbd fix avoid caching missing locale data

8eb7aea08b fix reject dynamic script host elements

http

Commit Type Description

b963f61028 fix prevent caching of responses with Set-Cookie headers

service-worker

Commit Type Description

... (truncated)

Commits

db0d4a1 fix(compiler): restrict possible event handler check to property names longer...
5dbcd0e fix(compiler): disallow i18n event attributes
a68ec70 fix(compiler): sanitize two-way properties
d40acc6 fix(compiler): prevent namespaced SVG <style> elements from being stripped
7ae6381 test(compiler-cli): align ngtsc sanitization expectations with modern DOM sch...
36200bd test(core): update spec files to match 20.3.x limits and actual contexts (#68...
823b37f test(compiler): remove obsolete schema_extractor import (#68926)
e345a58 fix(core): normalize tag names in runtime i18n attribute security context loo...
8f35b18 fix(compiler): normalize tag names with custom namespaces in DomElementSchema...
64a89e9 fix(compiler): sanitize dynamic href and xlink:href bindings on SVG a element...
Additional commits viewable in compare view

Updates next from 14.2.35 to 15.5.21

Release notes

Sourced from next's releases.

v15.5.21

This release contains security fixes for the following advisories:

High:

Denial of Service in App Router using Server Actions

Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Server-Side Request Forgery in Server Actions on custom servers

Moderate:

Cache confusion of response bodies for requests with bodies

Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

Denial of Service in the Image Optimization API using SVGs

Unauthenticated disclosure of internal Server Function endpoints

Unbounded Server Action payload in Edge runtime

v15.5.20

Contains no changes except publishing @next/swc-wasm-web which was accidentally not published since 15.5.15.

Commits

e26f6ff v15.5.21
7f5deeb [15.x] Improve performance of checking valid MPA form submissions
57c31f7 [15.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
e3e5666 [15.x] Set correct origin for internal redirects in custom server
35f5013 [15.x] Ensure exotic rewrite param values are properly encoded
062f667 [15.x] fix(fetch-cache): key fetch(Request, init) by the effective request
577c9dc [15.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies
530d4fa [15.x] fix(next/image): improve performance of detectContentType()
8fabaf3 [15.x] Performance improvements when decoding React Server function payloads
ff12a61 [15.x] Validate server reference IDs during manifest lookup
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.

Updates postcss from 8.4.33 to 8.5.23

Release notes

Sourced from postcss's releases.

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

Fixed declaration parsing performance (by @homanp).

8.5.14

Fixed custom syntax regression (by @43081j).

8.5.13

Fixed postcss-scss commend regression.

8.5.12

Fixed reading any file via user-generated CSS.

Added opts.unsafeMap to disable checks.

8.5.11

Fixed nested brackets parsing performance (by @offset).

8.5.10

Fixed XSS via unescaped </style> in non-bundler cases (by @TharVid).

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

Fixed declaration parsing performance (by @homanp).

8.5.14

Fixed custom syntax regression (by @43081j).

8.5.13

... (truncated)

Commits

eb9e1fe Release 8.5.23 version
9d19c78 Update dependencies
7beca13 Does no load source map file without opts.from
decea51 Typo
c18e30d Update EM banner
98a39ad Update EM banner
a3e48c4 Release 8.5.22 version
f49d691 Fix custom property losing its semicolon before a comment (#2117)
28e0daf Release 8.5.21 version
3d2b4e4 Update dependencies
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates @hono/node-server from 1.19.9 to 1.19.17

Release notes

Sourced from @hono/node-server's releases.

v1.19.17

No release notes provided.

v1.19.14

What's Changed

fix: add custom inspect to lightweight Request/Response to prevent TypeError on console.log by @usualoma in honojs/node-server#340

Full Changelog: honojs/node-server@v1.19.13...v1.19.14

v1.19.13

Security Fix

Fixed an issue in Serve Static Middleware where inconsistent handling of repeated slashes (//) between the router and static file resolution could allow middleware to be bypassed. Users of Serve Static Middleware are encouraged to upgrade to this version.

See GHSA-92pp-h63x-v22m for details.

v1.19.12

What's Changed

chore: ignore claude setting by @yusukebe in honojs/node-server#314

fix: request draining for early 413 responses by @usualoma in honojs/node-server#329

Full Changelog: honojs/node-server@v1.19.11...v1.19.12

v1.19.11

What's Changed

fix: do not overwrite Content-Length in the fast path pattern if Content-Length already exists. by @usualoma in honojs/node-server#309

Full Changelog: honojs/node-server@v1.19.10...v1.19.11

v1.19.10

Security Fix

Fixed an authorization bypass in Serve Static Middleware caused by inconsistent URL decoding (%2F handling) between the router and static file resolution. Users of Serve Static Middleware are encouraged to upgrade to this version.

See GHSA-wc8c-qw6v-h7f6 for details.

Commits

71941da 1.19.17
0208500 ci: add stage option for publishing (#386)
cbdf713 1.19.16
86e96c2 ci: add an action for trusted publisher (#385)
99c1a1a ci: run on v1.x branch pushes
84cb2ee Merge commit from fork
b5e63a3 1.19.14
c02d777 fix: add custom inspect to lightweight Request/Response to prevent TypeError ...
fd64e65 1.19.13
025c30f Merge commit from fork
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @hono/node-server since your current version.

Updates brace-expansion from 1.1.11 to 1.1.18

Release notes

Sourced from brace-expansion's releases.

v1.1.15

Backport v5.0.6 change to v1 (#111) 0b09384

juliangruber/brace-expansion@v1.1.14...v1.1.15

v1.1.12

pkg: publish on tag 1.x c460dbd

fmt ccb8ac6

Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) c3c73c8

juliangruber/brace-expansion@v1.1.11...v1.1.12

Commits

758fcd6 1.1.18
27fbeed Merge commit from fork
5c57cc2 1.1.17
d757f1d npm ignore .claude
cb4b9e4 fix: backport GHSA-mh99-v99m-4gvg (#129)
447763a 1.1.16
d74e630 fix: v1 backport for CVE-2026-13149 (#122)
2203f4f 1.1.15
0b09384 Backport v5.0.6 change to v1 (#111)
10c05fc 1.1.14
Additional commits viewable in compare view

Updates fast-uri from 3.0.6 to 3.1.7

Release notes

Sourced from fast-uri's releases.

v3.1.7

⚠️ Security Warning

This is a security release that fixes the following high-severity security advisories:

GHSA-qw65-cvwx-89v3 — authority injection via an unvalidated port in serialize()

GHSA-58mr-gqgx-xq4g — host confusion via unbalanced or misplaced IP-literal brackets

Users of the v3.x release line should upgrade to v3.1.7.

Full Changelog: fastify/fast-uri@v3.1.6...v3.1.7

v3.1.6

⚠️ Security Warning

This release addresses the following high-severity security advisories:

GHSA-5jgf-p345-68v8 — host confusion via skipped IDN canonicalization on scheme-relative references

GHSA-fph4-wmhf-6fwf — server-side request forgery via repeated hostname percent-decoding

GHSA-f65p-4m7j-42xc — server-side request forgery via malformed IPv6 normalization

GHSA-jqff-g426-hqxp — host confusion via percent-encoded scheme normalizationDescription has been truncated

vercel · 2026-08-19T13:51:34Z

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments

Project	Deployment	Actions	Updated
getflipdev	Ignored	Preview	Sep 3, 2026 7:52am UTC
staginggetflipdev	Ignored	Preview	Sep 3, 2026 7:52am UTC

…ates Bumps the security group with 16 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) | `7.20.12` | `7.29.6` | | [svgo](https://github.com/svg/svgo) | `2.8.0` | `2.8.3` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `3.2.10` | `6.4.3` | | [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common) | `19.2.23` | `20.3.27` | | [@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler) | `19.2.23` | `20.3.27` | | [next](https://github.com/vercel/next.js) | `14.2.35` | `15.5.21` | | [postcss](https://github.com/postcss/postcss) | `8.4.33` | `8.5.23` | | [@hono/node-server](https://github.com/honojs/node-server) | `1.19.9` | `1.19.17` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.11` | `1.1.18` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.0.6` | `3.1.7` | | [hono](https://github.com/honojs/hono) | `4.12.3` | `4.13.5` | | [http-proxy-middleware](https://github.com/chimurai/http-proxy-middleware) | `2.0.9` | `2.0.10` | | [immutable](https://github.com/immutable-js/immutable-js) | `5.1.3` | `5.1.9` | | [js-yaml](https://github.com/nodeca/js-yaml) | `3.14.1` | `3.15.2` | | [undici](https://github.com/nodejs/undici) | `5.28.4` | `5.29.0` | | [websocket-driver](https://github.com/faye/websocket-driver-node) | `0.7.4` | `0.7.5` | Bumps the security group with 2 updates in the /apps/swirl-docs directory: [next](https://github.com/vercel/next.js) and [postcss](https://github.com/postcss/postcss). Bumps the security group with 3 updates in the /packages/swirl-components directory: [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core), [svgo](https://github.com/svg/svgo) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). Bumps the security group with 2 updates in the /packages/swirl-components-angular directory: [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common) and [@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler). Updates `@babel/core` from 7.20.12 to 7.29.6 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.6/packages/babel-core) Updates `svgo` from 2.8.0 to 2.8.3 - [Release notes](https://github.com/svg/svgo/releases) - [Commits](svg/svgo@v2.8.0...v2.8.3) Updates `vite` from 3.2.10 to 6.4.3 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v6.4.3/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v6.4.3/packages/vite) Updates `@angular/common` from 19.2.23 to 20.3.27 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/v20.3.27/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.27/packages/common) Updates `@angular/compiler` from 19.2.23 to 20.3.27 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/v20.3.27/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.27/packages/compiler) Updates `next` from 14.2.35 to 15.5.21 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v14.2.35...v15.5.21) Updates `postcss` from 8.4.33 to 8.5.23 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.4.33...8.5.23) Updates `@hono/node-server` from 1.19.9 to 1.19.17 - [Release notes](https://github.com/honojs/node-server/releases) - [Commits](honojs/node-server@v1.19.9...v1.19.17) Updates `brace-expansion` from 1.1.11 to 1.1.18 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@1.1.11...v1.1.18) Updates `fast-uri` from 3.0.6 to 3.1.7 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.0.6...v3.1.7) Updates `hono` from 4.12.3 to 4.13.5 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.3...v4.13.5) Updates `http-proxy-middleware` from 2.0.9 to 2.0.10 - [Release notes](https://github.com/chimurai/http-proxy-middleware/releases) - [Changelog](https://github.com/chimurai/http-proxy-middleware/blob/v2.0.10/CHANGELOG.md) - [Commits](chimurai/http-proxy-middleware@v2.0.9...v2.0.10) Updates `immutable` from 5.1.3 to 5.1.9 - [Release notes](https://github.com/immutable-js/immutable-js/releases) - [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md) - [Commits](immutable-js/immutable-js@v5.1.3...v5.1.9) Updates `js-yaml` from 3.14.1 to 3.15.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/3.15.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.14.1...3.15.2) Updates `undici` from 5.28.4 to 5.29.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v5.28.4...v5.29.0) Updates `websocket-driver` from 0.7.4 to 0.7.5 - [Changelog](https://github.com/faye/websocket-driver-node/blob/main/CHANGELOG.md) - [Commits](faye/websocket-driver-node@0.7.4...0.7.5) Updates `next` from 14.2.35 to 15.5.21 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v14.2.35...v15.5.21) Updates `postcss` from 8.4.33 to 8.5.23 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.4.33...8.5.23) Updates `@babel/core` from 7.20.12 to 7.29.6 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.6/packages/babel-core) Updates `svgo` from 2.8.0 to 2.8.3 - [Release notes](https://github.com/svg/svgo/releases) - [Commits](svg/svgo@v2.8.0...v2.8.3) Updates `vite` from 3.2.10 to 6.4.3 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v6.4.3/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v6.4.3/packages/vite) Updates `@angular/common` from 19.2.23 to 20.3.27 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/v20.3.27/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.27/packages/common) Updates `@angular/compiler` from 19.2.23 to 20.3.27 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/v20.3.27/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.27/packages/compiler) Updates `next` from 14.2.35 to 15.5.21 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v14.2.35...v15.5.21) Updates `postcss` from 8.4.33 to 8.5.23 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.4.33...8.5.23) Updates `next` from 14.2.35 to 15.5.21 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v14.2.35...v15.5.21) Updates `postcss` from 8.4.33 to 8.5.23 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.4.33...8.5.23) Updates `@babel/core` from 7.23.0 to 7.29.6 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.6/packages/babel-core) Updates `svgo` from 2.8.0 to 2.8.3 - [Release notes](https://github.com/svg/svgo/releases) - [Commits](svg/svgo@v2.8.0...v2.8.3) Updates `vite` from 5.4.0 to 6.4.3 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v6.4.3/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v6.4.3/packages/vite) Updates `@babel/core` from 7.23.0 to 7.29.6 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.6/packages/babel-core) Updates `svgo` from 2.8.0 to 2.8.3 - [Release notes](https://github.com/svg/svgo/releases) - [Commits](svg/svgo@v2.8.0...v2.8.3) Updates `vite` from 5.4.0 to 6.4.3 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v6.4.3/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v6.4.3/packages/vite) Updates `@angular/common` from 19.2.23 to 20.3.27 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/v20.3.27/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.27/packages/common) Updates `@angular/compiler` from 19.2.23 to 20.3.27 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/v20.3.27/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.27/packages/compiler) Updates `@angular/common` from 19.2.23 to 20.3.27 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/v20.3.27/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.27/packages/common) Updates `@angular/compiler` from 19.2.23 to 20.3.27 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/v20.3.27/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v20.3.27/packages/compiler) --- updated-dependencies: - dependency-name: "@angular/common" dependency-version: 20.3.27 dependency-type: direct:production dependency-group: security - dependency-name: "@angular/common" dependency-version: 20.3.27 dependency-type: direct:production dependency-group: security - dependency-name: "@angular/common" dependency-version: 20.3.27 dependency-type: direct:production dependency-group: security - dependency-name: "@angular/common" dependency-version: 20.3.27 dependency-type: direct:production dependency-group: security - dependency-name: "@angular/compiler" dependency-version: 20.3.27 dependency-type: direct:production dependency-group: security - dependency-name: "@angular/compiler" dependency-version: 20.3.27 dependency-type: direct:production dependency-group: security - dependency-name: "@angular/compiler" dependency-version: 20.3.27 dependency-type: direct:production dependency-group: security - dependency-name: "@angular/compiler" dependency-version: 20.3.27 dependency-type: direct:production dependency-group: security - dependency-name: "@babel/core" dependency-version: 7.29.6 dependency-type: direct:development dependency-group: security - dependency-name: "@babel/core" dependency-version: 7.29.6 dependency-type: direct:development dependency-group: security - dependency-name: "@babel/core" dependency-version: 7.29.6 dependency-type: direct:development dependency-group: security - dependency-name: "@babel/core" dependency-version: 7.29.6 dependency-type: direct:development dependency-group: security - dependency-name: "@hono/node-server" dependency-version: 1.19.17 dependency-type: indirect dependency-group: security - dependency-name: brace-expansion dependency-version: 1.1.18 dependency-type: indirect dependency-group: security - dependency-name: fast-uri dependency-version: 3.1.5 dependency-type: indirect dependency-group: security - dependency-name: hono dependency-version: 4.13.3 dependency-type: indirect dependency-group: security - dependency-name: http-proxy-middleware dependency-version: 2.0.10 dependency-type: indirect dependency-group: security - dependency-name: immutable dependency-version: 5.1.9 dependency-type: indirect dependency-group: security - dependency-name: js-yaml dependency-version: 3.15.1 dependency-type: indirect dependency-group: security - dependency-name: next dependency-version: 15.5.21 dependency-type: direct:production dependency-group: security - dependency-name: next dependency-version: 15.5.21 dependency-type: direct:production dependency-group: security - dependency-name: next dependency-version: 15.5.21 dependency-type: direct:production dependency-group: security - dependency-name: next dependency-version: 15.5.21 dependency-type: direct:production dependency-group: security - dependency-name: postcss dependency-version: 8.5.23 dependency-type: direct:development dependency-group: security - dependency-name: postcss dependency-version: 8.5.23 dependency-type: direct:development dependency-group: security - dependency-name: postcss dependency-version: 8.5.23 dependency-type: direct:development dependency-group: security - dependency-name: postcss dependency-version: 8.5.23 dependency-type: direct:development dependency-group: security - dependency-name: svgo dependency-version: 2.8.3 dependency-type: direct:development dependency-group: security - dependency-name: svgo dependency-version: 2.8.3 dependency-type: direct:development dependency-group: security - dependency-name: svgo dependency-version: 2.8.3 dependency-type: direct:development dependency-group: security - dependency-name: svgo dependency-version: 2.8.3 dependency-type: direct:development dependency-group: security - dependency-name: undici dependency-version: 5.29.0 dependency-type: indirect dependency-group: security - dependency-name: vite dependency-version: 6.4.3 dependency-type: direct:development dependency-group: security - dependency-name: vite dependency-version: 6.4.3 dependency-type: direct:development dependency-group: security - dependency-name: vite dependency-version: 6.4.3 dependency-type: direct:development dependency-group: security - dependency-name: vite dependency-version: 6.4.3 dependency-type: direct:development dependency-group: security - dependency-name: websocket-driver dependency-version: 0.7.5 dependency-type: indirect dependency-group: security ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 19, 2026

dependabot Bot mentioned this pull request Aug 19, 2026

Bump the security group across 4 directories with 16 updates #1767

Closed

dependabot Bot changed the title ~~Bump the security group across 4 directories with 16 updates~~ chore(deps): bump the security group across 4 directories with 16 updates Aug 21, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/security-7053fa539f branch 5 times, most recently from d435686 to c9d4e25 Compare August 27, 2026 13:00

dependabot Bot force-pushed the dependabot/npm_and_yarn/security-7053fa539f branch from c9d4e25 to e5c86dc Compare September 3, 2026 07:52

Navigation Menu

Uh oh!

chore(deps): bump the security group across 4 directories with 16 updates - #1772

chore(deps): bump the security group across 4 directories with 16 updates#1772
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/security-7053fa539f

dependabot Bot commented on behalf of github Aug 19, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Aug 19, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

0 participants

Commit	Description
	disallow i18n event attributes
	restrict possible event handler check to property names longer than 2 characters

Commit	Description
	avoid caching missing locale data
	reject dynamic script host elements

Commit	Description
	preserve referrer in asset requests
	preserve referrer policy in asset requests

Commit	Description
	Limits date format string length
	skip transfer cache for uncacheable HTTP traffic
	use cryptographically secure SHA-256 for transfer cache key generation

Commit	Type	Description
5dbcd0ee16	fix	disallow i18n event attributes
db0d4a1a39	fix	restrict possible event handler check to property names longer than 2 characters

Commit	Type	Description
26831d0cbd	fix	avoid caching missing locale data
8eb7aea08b	fix	reject dynamic script host elements

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v7.29.6 (2026-05-25)

🐛 Bug Fix

Committers: 3

v7.29.5 (2026-05-05)

🏠 Internal

v7.29.4 (2026-05-05)

🐛 Bug Fix

Committers: 1

v7.29.3 (2026-04-30)

👓 Spec Compliance

🐛 Bug Fix

💅 Polish

📝 Documentation

v2.8.3

What's Changed

Security

Support

v2.8.2

What's Changed

Dependencies

Bug Fixes

Metrics

Support

v2.8.1

Deprecated

What's Changed

Dependencies

v6.4.3

v6.4.2

v6.4.1

v5.4.21

6.4.3 (2026-06-01)

6.4.2 (2026-04-06)

6.4.1 (2025-10-20)

6.4.0 (2025-10-15)

6.3.7 (2025-10-14)

6.3.6 (2025-09-08)

6.3.5 (2025-05-05)

6.3.4 (2025-04-30)

20.3.27

compiler

http

platform-server

20.3.26

compiler-cli

core

http

service-worker

20.3.25

common

compiler

core

20.3.27 (2026-07-29)

compiler

http

platform-server

20.3.26 (2026-07-08)

compiler-cli

core

http

service-worker

20.3.27

compiler

http

platform-server

20.3.26

compiler-cli

core

http

service-worker

20.3.25

common

compiler

core

20.3.27 (2026-07-29)

compiler

dependabot Bot commented on behalf of github Aug 19, 2026 •

edited

Loading

vercel Bot commented Aug 19, 2026 •

edited

Loading