Skip to content

deps(deps): bump the production-minor-patch group across 1 directory with 42 updates#81

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-minor-patch-cd6c66f821
Closed

deps(deps): bump the production-minor-patch group across 1 directory with 42 updates#81
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-minor-patch-cd6c66f821

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 14, 2026 •
edited
Loading

Bumps the production-minor-patch group with 15 updates in the / directory:

Package From To
cookie-parser 1.4.5 1.4.7
express-session 1.17.1 1.19.0
lodash 4.17.20 4.18.1
moment 2.29.1 2.30.1
sqlite3 5.0.2 5.1.7
validator 13.5.2 13.15.35
cors 2.8.5 2.8.6
handlebars 4.0.0 4.7.9
decompress 4.2.0 4.2.1
shell-quote 1.7.2 1.8.3
bytes 3.1.0 3.1.2
cookie-signature 1.0.6 1.0.7
destroy 1.0.4 1.2.0
iconv-lite 0.4.24 0.6.3
mime-db 1.52.0 1.54.0

Updates cookie-parser from 1.4.5 to 1.4.7

Release notes

Sourced from cookie-parser's releases.

1.4.7

What's Changed

New Contributors

Full Changelog: expressjs/cookie-parser@1.4.6...1.4.7

1.4.6

  • deps: cookie@0.4.1
Changelog

Sourced from cookie-parser's changelog.

1.4.7 / 2024-10-08

  • deps: cookie@0.7.2
    • Fix object assignment of hasOwnProperty
  • deps: cookie@0.7.1
    • Allow leading dot for domain
      • Although not permitted in the spec, some users expect this to work and user agents ignore the leading dot according to spec
    • Add fast path for serialize without options, use obj.hasOwnProperty when parsing
  • deps: cookie@0.7.0
    • perf: parse cookies ~10% faster
    • fix: narrow the validation of cookies to match RFC6265
    • fix: add main to package.json for rspack
  • deps: cookie@0.6.0
    • Add partitioned option
  • deps: cookie@0.5.0
    • Add priority option
    • Fix expires option to reject invalid dates
    • pref: improve default decode speed
    • pref: remove slow string split in parse
  • deps: cookie@0.4.2
    • pref: read value only when assigning in parse
    • pref: remove unnecessary regexp in parse

1.4.6 / 2021-11-16

  • deps: cookie@0.4.1
Commits
Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for cookie-parser since your current version.


Updates express-session from 1.17.1 to 1.19.0

Release notes

Sourced from express-session's releases.

v1.19.0

What's Changed

Main Changes

  • Add dynamic cookie options support Cookie options can now be dynamic, allowing for more flexible and context-aware configuration based on each request. This feature enables programmatic modification of cookie attributes like secure, httpOnly, sameSite, maxAge, domain, and path based on session or request conditions.

    var app = express()
app.use(session({
  secret: 'keyboard cat',
  resave: false,
  saveUninitialized: true,
  cookie: function (req) {
    var match = req.url.match(/^\/([^/]+)/);
    return {
      path: match ? '/' + match[1] : '/',
      httpOnly: true,
      secure: req.secure || false,
      maxAge: 60000
    }
  }
}))

  • Add sameSite 'auto' support for automatic SameSite attribute configuration Added sameSite: 'auto' option for cookie configuration that automatically sets SameSite=None for HTTPS and SameSite=Lax for HTTP connections, simplifying cookie handling across different environments.

  • deps: use tilde notation for dependencies

PRs

New Contributors

... (truncated)

Changelog

Sourced from express-session's changelog.

1.19.0 / 2026-01-22

  • Add dynamic cookie options support
  • Add sameSite 'auto' support for automatic SameSite attribute configuration
  • deps: use tilde notation for dependencies

1.18.2 / 2025-07-17

1.18.1 / 2024-10-08

  • deps: cookie@0.7.2
    • Fix object assignment of hasOwnProperty
  • deps: cookie@0.7.1
    • Allow leading dot for domain
      • Although not permitted in the spec, some users expect this to work and user agents ignore the leading dot according to spec
    • Add fast path for serialize without options, use obj.hasOwnProperty when parsing
  • deps: cookie@0.7.0
    • perf: parse cookies ~10% faster
    • fix: narrow the validation of cookies to match RFC6265
    • fix: add main to package.json for rspack

1.18.0 / 2024-01-28

  • Add debug log for pathname mismatch
  • Add partitioned to cookie options
  • Add priority to cookie options
  • Fix handling errors from setting cookie
  • Support any type in secret that crypto.createHmac supports
  • deps: cookie@0.6.0
    • Fix expires option to reject invalid dates
    • perf: improve default decode speed
    • perf: remove slow string split in parse
  • deps: cookie-signature@1.0.7

1.17.3 / 2022-05-11

  • Fix resaving already-saved new session at end of request
  • deps: cookie@0.4.2

1.17.2 / 2021-05-19

... (truncated)

Commits
  • c10b2a3 1.19.0 (#1107)
  • 2673736 feat: add support to dynamic cookie options (#1027)
  • 73e0193 Add sameSite 'auto' support to match secure 'auto' pattern (#1087)
  • 264b6a0 deps: use tilde notation for dependencies (#1096)
  • 6d69f09 chore: remove history.md from being packaged on publish (#1097)
  • 00b8a5f refactor: remove unused sess parameter from generateSessionId function (#...
  • 2cd6561 build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.3 (#1082)
  • 1307f30 build(deps): bump actions/checkout from 4.2.2 to 6.0.0 (#1088)
  • 0e7a438 build(deps): bump github/codeql-action from 4.31.2 to 4.31.6 (#1089)
  • a095a9a build(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 (#1090)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for express-session since your current version.


Updates lodash from 4.17.20 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

  • Add security notice for _.template in threat model and API docs (#6099)
  • Document lower > upper behavior in _.random (#6115)
  • Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

Commits
  • cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
  • 75535f5 chore: prune stale advisory refs (#6170)
  • 62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
  • 59be2de release(minor): bump to 4.18.0 (#6161)
  • af63457 fix: broken tests for _.template 879aaa9
  • 1073a76 fix: linting issues
  • 879aaa9 fix: validate imports keys in _.template
  • fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
  • 18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
  • b819080 ci: add dist sync validation workflow (#6137)
  • Additional commits viewable in compare view

Updates moment from 2.29.1 to 2.30.1

Changelog

Sourced from moment's changelog.

2.30.1

2.30.0 Full changelog

  • Release Dec 26, 2023

2.29.4

  • Release Jul 6, 2022
    • #6015 [bugfix] Fix ReDoS in preprocessRFC2822 regex

2.29.3 Full changelog

  • Release Apr 17, 2022
    • #5995 [bugfix] Remove const usage
    • #5990 misc: fix advisory link

2.29.2 See full changelog

  • Release Apr 3 2022

Address GHSA-8hfj-j24r-96c4

Commits

Updates sqlite3 from 5.0.2 to 5.1.7

Release notes

Sourced from sqlite3's releases.

v5.1.7

What's Changed

New Contributors

Full Changelog: TryGhost/node-sqlite3@v5.1.6...v5.1.7

v5.1.7-rc.0

Please install v5.1.7 instead.

Full Changelog: TryGhost/node-sqlite3@v5.1.6...v5.1.7-rc.0

v5.1.6

What's Changed

New Contributors

Full Changelog: TryGhost/node-sqlite3@v5.1.5...v5.1.6

v5.1.5

What's Changed

Full Changelog: TryGhost/node-sqlite3@v5.1.4...v5.1.5

v5.1.4

What's Changed

Full Changelog: TryGhost/node-sqlite3@v5.1.3...v5.1.4

v5.1.3

What's Changed

... (truncated)

Commits
  • ba4ba07 v5.1.7
  • d04c1fb Removed Node version from matrix title
  • 03d6e75 v5.1.7-rc.0
  • 8398daa Fixed uploading assets from Docker
  • 8b86e41 Fixed uploading release assets on Windows
  • 83c8c0a Configured releases to be created as prereleases
  • f792f69 Update dependency node-addon-api to v7
  • 4ef11bf Removed extraneous parameter to event emit function
  • e99160a Inlined init() functions into class header files
  • 3372130 Improved RowToJS performance by removing Napi::String::New instantiation
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by daniellockyer, a new releaser for sqlite3 since your current version.

Install script changes

This version modifies install script that runs during installation. Review the package contents before updating.


Updates validator from 13.5.2 to 13.15.35

Release notes

Sourced from validator's releases.

13.15.35

Fixes, New Locales and Enhancements

New Contributors

Full Changelog: validatorjs/validator.js@13.15.26...13.15.35

13.15.26

Fixes, New Locales and Enhancements

New Contributors

Full Changelog: validatorjs/validator.js@13.15.23...13.15.26

13.15.23

Fixes, New Locales and Enhancements

... (truncated)

Changelog

Sourced from validator's changelog.

13.15.35

Fixes, New Locales and Enhancements

13.15.26

Fixes, New Locales and Enhancements

13.15.23

Fixes, New Locales and Enhancements

13.15.22

Fixes, New Locales and Enhancements

13.15.20

Fixes, New Locales and Enhancements

... (truncated)

Commits
  • 7a80797 maintenance: 2604 release (#2695)
  • 941db7f fix(isSlug): restrict allowed characters to valid slug charset (#2693)
  • 2758f70 chore: fix typo in comment (#2591)
  • fcfbff5 feat(isJson): allow any valid JSON value to pass (#2690)
  • f06caee refactor: replace if-then-else flow by a single return statement (#2592)
  • 9fa1e3a feat(isPostalCode): Add postal code for Monaco (#2682)
  • b1aea75 feat(isMobilePhone): add Djibouti (fr-DJ) mobile phone validation (#2676)
  • f715cdd fix(isPassportNumber): improve MX locale (#2643)
  • e8c6914 fix(isTaxID): add formatted CPF support and additional test cases for pt-BR l...
  • 90b0a9a fix(isTaxID): improve pt-BR locale by adding support for alphanumeric CNPJ ...
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for validator since your current version.


Updates cors from 2.8.5 to 2.8.6

Release notes

Sourced from cors's releases.

v2.8.6

What's Changed

New Contributors

... (truncated)

Changelog

Sourced from cors's changelog.

2.8.6 / 2026-01-22

  • Improve documentation (API, context, examples...)
  • Remove additional markdown files from tarball
Commits
Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for cors since your current version.


Updates handlebars from 4.0.0 to 4.7.9

Release notes

Sourced from handlebars's releases.

v4.7.9

  • fix: enable shell mode for spawn to ...

    Description has been truncated

@dependabot
deps(deps): bump the production-minor-patch group across 1 directory …
37986eb 
…with 42 updates

Bumps the production-minor-patch group with 15 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [cookie-parser](https://github.com/expressjs/cookie-parser) | `1.4.5` | `1.4.7` |
| [express-session](https://github.com/expressjs/session) | `1.17.1` | `1.19.0` |
| [lodash](https://github.com/lodash/lodash) | `4.17.20` | `4.18.1` |
| [moment](https://github.com/moment/moment) | `2.29.1` | `2.30.1` |
| [sqlite3](https://github.com/TryGhost/node-sqlite3) | `5.0.2` | `5.1.7` |
| [validator](https://github.com/validatorjs/validator.js) | `13.5.2` | `13.15.35` |
| [cors](https://github.com/expressjs/cors) | `2.8.5` | `2.8.6` |
| [handlebars](https://github.com/handlebars-lang/handlebars.js) | `4.0.0` | `4.7.9` |
| [decompress](https://github.com/kevva/decompress) | `4.2.0` | `4.2.1` |
| [shell-quote](https://github.com/ljharb/shell-quote) | `1.7.2` | `1.8.3` |
| [bytes](https://github.com/visionmedia/bytes.js) | `3.1.0` | `3.1.2` |
| [cookie-signature](https://github.com/visionmedia/node-cookie-signature) | `1.0.6` | `1.0.7` |
| [destroy](https://github.com/stream-utils/destroy) | `1.0.4` | `1.2.0` |
| [iconv-lite](https://github.com/pillarjs/iconv-lite) | `0.4.24` | `0.6.3` |
| [mime-db](https://github.com/jshttp/mime-db) | `1.52.0` | `1.54.0` |



Updates `cookie-parser` from 1.4.5 to 1.4.7
- [Release notes](https://github.com/expressjs/cookie-parser/releases)
- [Changelog](https://github.com/expressjs/cookie-parser/blob/master/HISTORY.md)
- [Commits](expressjs/cookie-parser@1.4.5...1.4.7)

Updates `express-session` from 1.17.1 to 1.19.0
- [Release notes](https://github.com/expressjs/session/releases)
- [Changelog](https://github.com/expressjs/session/blob/master/HISTORY.md)
- [Commits](expressjs/session@v1.17.1...v1.19.0)

Updates `lodash` from 4.17.20 to 4.18.1
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.20...4.18.1)

Updates `moment` from 2.29.1 to 2.30.1
- [Changelog](https://github.com/moment/moment/blob/develop/CHANGELOG.md)
- [Commits](moment/moment@2.29.1...2.30.1)

Updates `sqlite3` from 5.0.2 to 5.1.7
- [Release notes](https://github.com/TryGhost/node-sqlite3/releases)
- [Commits](TryGhost/node-sqlite3@v5.0.2...v5.1.7)

Updates `validator` from 13.5.2 to 13.15.35
- [Release notes](https://github.com/validatorjs/validator.js/releases)
- [Changelog](https://github.com/validatorjs/validator.js/blob/master/CHANGELOG.md)
- [Commits](validatorjs/validator.js@13.5.2...13.15.35)

Updates `cors` from 2.8.5 to 2.8.6
- [Release notes](https://github.com/expressjs/cors/releases)
- [Changelog](https://github.com/expressjs/cors/blob/master/HISTORY.md)
- [Commits](expressjs/cors@v2.8.5...v2.8.6)

Updates `handlebars` from 4.0.0 to 4.7.9
- [Release notes](https://github.com/handlebars-lang/handlebars.js/releases)
- [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/v4.7.9/release-notes.md)
- [Commits](handlebars-lang/handlebars.js@v4.0.0...v4.7.9)

Updates `minimist` from 1.2.8 to 1.2.5
- [Changelog](https://github.com/minimistjs/minimist/blob/main/CHANGELOG.md)
- [Commits](minimistjs/minimist@v1.2.8...v1.2.5)

Updates `node-fetch` from 2.7.0 to 2.6.0
- [Release notes](https://github.com/node-fetch/node-fetch/releases)
- [Changelog](https://github.com/node-fetch/node-fetch/blob/v2.6.0/CHANGELOG.md)
- [Commits](node-fetch/node-fetch@v2.7.0...v2.6.0)

Updates `set-value` from 2.0.1 to 3.0.1
- [Commits](jonschlinkert/set-value@2.0.1...3.0.1)

Updates `ini` from 1.3.8 to 1.3.5
- [Release notes](https://github.com/npm/ini/releases)
- [Changelog](https://github.com/npm/ini/blob/main/CHANGELOG.md)
- [Commits](npm/ini@v1.3.8...v1.3.5)

Updates `decompress` from 4.2.0 to 4.2.1
- [Release notes](https://github.com/kevva/decompress/releases)
- [Commits](kevva/decompress@v4.2.0...v4.2.1)

Updates `shell-quote` from 1.7.2 to 1.8.3
- [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md)
- [Commits](ljharb/shell-quote@v1.7.2...v1.8.3)

Updates `are-we-there-yet` from 1.1.7 to 2.0.0
- [Release notes](https://github.com/npm/are-we-there-yet/releases)
- [Changelog](https://github.com/npm/are-we-there-yet/blob/main/CHANGELOG.md)
- [Commits](npm/are-we-there-yet@v1.1.7...v2.0.0)

Updates `async` from 0.2.10 to 3.2.6
- [Release notes](https://github.com/caolan/async/releases)
- [Changelog](https://github.com/caolan/async/blob/master/CHANGELOG.md)
- [Commits](caolan/async@0.2.10...v3.2.6)

Updates `bytes` from 3.1.0 to 3.1.2
- [Changelog](https://github.com/visionmedia/bytes.js/blob/master/History.md)
- [Commits](visionmedia/bytes.js@3.1.0...3.1.2)

Updates `concat-stream` from 1.6.2 to 2.0.0
- [Commits](max-mapper/concat-stream@v1.6.2...v2.0.0)

Updates `content-disposition` from 0.5.3 to 0.5.4
- [Release notes](https://github.com/jshttp/content-disposition/releases)
- [Changelog](https://github.com/jshttp/content-disposition/blob/v0.5.4/HISTORY.md)
- [Commits](jshttp/content-disposition@v0.5.3...v0.5.4)

Updates `cookie` from 0.4.0 to 0.7.2
- [Release notes](https://github.com/jshttp/cookie/releases)
- [Commits](jshttp/cookie@v0.4.0...v0.7.2)

Updates `cookie-signature` from 1.0.6 to 1.0.7
- [Changelog](https://github.com/tj/node-cookie-signature/blob/master/History.md)
- [Commits](https://github.com/visionmedia/node-cookie-signature/commits)

Updates `core-util-is` from 1.0.2 to 1.0.3
- [Commits](isaacs/core-util-is@v1.0.2...v1.0.3)

Updates `destroy` from 1.0.4 to 1.2.0
- [Changelog](https://github.com/stream-utils/destroy/blob/master/HISTORY.md)
- [Commits](stream-utils/destroy@1.0.4...1.2.0)

Updates `detect-libc` from 1.0.3 to 2.1.2
- [Changelog](https://github.com/lovell/detect-libc/blob/main/CHANGELOG.md)
- [Commits](lovell/detect-libc@v1.0.3...v2.1.2)

Updates `encodeurl` from 1.0.2 to 2.0.0
- [Release notes](https://github.com/pillarjs/encodeurl/releases)
- [Commits](pillarjs/encodeurl@v1.0.2...v2.0.0)

Updates `minimatch` from 3.1.2 to 3.1.5
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v3.1.2...v3.1.5)

Updates `finalhandler` from 1.1.2 to 1.3.2
- [Release notes](https://github.com/pillarjs/finalhandler/releases)
- [Changelog](https://github.com/pillarjs/finalhandler/blob/master/HISTORY.md)
- [Commits](pillarjs/finalhandler@v1.1.2...v1.3.2)

Updates `follow-redirects` from 1.15.11 to 1.16.0
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](follow-redirects/follow-redirects@v1.15.11...v1.16.0)

Updates `gauge` from 2.7.4 to 3.0.2
- [Release notes](https://github.com/npm/gauge/releases)
- [Changelog](https://github.com/npm/gauge/blob/main/CHANGELOG.md)
- [Commits](npm/gauge@v2.7.4...v3.0.2)

Updates `iconv-lite` from 0.4.24 to 0.6.3
- [Release notes](https://github.com/pillarjs/iconv-lite/releases)
- [Changelog](https://github.com/pillarjs/iconv-lite/blob/master/Changelog.md)
- [Commits](pillarjs/iconv-lite@v0.4.24...v0.6.3)

Updates `mime-db` from 1.52.0 to 1.54.0
- [Release notes](https://github.com/jshttp/mime-db/releases)
- [Changelog](https://github.com/jshttp/mime-db/blob/master/HISTORY.md)
- [Commits](jshttp/mime-db@v1.52.0...v1.54.0)

Updates `node-gyp` from 3.8.0 to 12.3.0
- [Release notes](https://github.com/nodejs/node-gyp/releases)
- [Changelog](https://github.com/nodejs/node-gyp/blob/main/CHANGELOG.md)
- [Commits](nodejs/node-gyp@v3.8.0...v12.3.0)

Updates `nopt` from 3.0.6 to 5.0.0
- [Release notes](https://github.com/npm/nopt/releases)
- [Changelog](https://github.com/npm/nopt/blob/main/CHANGELOG.md)
- [Commits](npm/nopt@v3.0.6...v5.0.0)

Updates `npmlog` from 4.1.2 to 5.0.1
- [Release notes](https://github.com/npm/npmlog/releases)
- [Changelog](https://github.com/npm/npmlog/blob/main/CHANGELOG.md)
- [Commits](npm/npmlog@v4.1.2...v5.0.1)

Updates `on-headers` from 1.0.2 to 1.1.0
- [Release notes](https://github.com/jshttp/on-headers/releases)
- [Changelog](https://github.com/jshttp/on-headers/blob/master/HISTORY.md)
- [Commits](jshttp/on-headers@v1.0.2...v1.1.0)

Updates `path-to-regexp` from 0.1.7 to 0.1.13
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/v.0.1.13/History.md)
- [Commits](pillarjs/path-to-regexp@v0.1.7...v.0.1.13)

Updates `send` from 0.17.1 to 0.19.2
- [Release notes](https://github.com/pillarjs/send/releases)
- [Changelog](https://github.com/pillarjs/send/blob/master/HISTORY.md)
- [Commits](pillarjs/send@0.17.1...0.19.2)

Updates `serve-static` from 1.14.1 to 1.16.3
- [Release notes](https://github.com/expressjs/serve-static/releases)
- [Changelog](https://github.com/expressjs/serve-static/blob/master/HISTORY.md)
- [Commits](expressjs/serve-static@v1.14.1...v1.16.3)

Updates `streamsearch` from 0.1.2 to 1.1.0
- [Commits](mscdex/streamsearch@v0.1.2...v1.1.0)

Updates `uglify-js` from 2.4.24 to 3.19.3
- [Release notes](https://github.com/mishoo/UglifyJS/releases)
- [Commits](mishoo/UglifyJS@v2.4.24...v3.19.3)

Updates `which` from 1.3.1 to 2.0.2
- [Release notes](https://github.com/npm/node-which/releases)
- [Changelog](https://github.com/npm/node-which/blob/main/CHANGELOG.md)
- [Commits](npm/node-which@v1.3.1...v2.0.2)

Updates `wordwrap` from 0.0.2 to 1.0.0
- [Commits](https://github.com/substack/node-wordwrap/commits)

---
updated-dependencies:
- dependency-name: cookie-parser
  dependency-version: 1.4.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: express-session
  dependency-version: 1.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: moment
  dependency-version: 2.30.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: sqlite3
  dependency-version: 5.1.7
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: validator
  dependency-version: 13.15.35
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: cors
  dependency-version: 2.8.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: handlebars
  dependency-version: 4.7.9
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: minimist
  dependency-version: 1.2.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: node-fetch
  dependency-version: 2.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: set-value
  dependency-version: 3.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-minor-patch
- dependency-name: ini
  dependency-version: 1.3.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: decompress
  dependency-version: 4.2.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: shell-quote
  dependency-version: 1.8.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: are-we-there-yet
  dependency-version: 2.0.0
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: production-minor-patch
- dependency-name: async
  dependency-version: 3.2.6
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: production-minor-patch
- dependency-name: bytes
  dependency-version: 3.1.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: concat-stream
  dependency-version: 2.0.0
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: production-minor-patch
- dependency-name: content-disposition
  dependency-version: 0.5.4
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: cookie
  dependency-version: 0.7.2
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: cookie-signature
  dependency-version: 1.0.7
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: core-util-is
  dependency-version: 1.0.3
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: destroy
  dependency-version: 1.2.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: detect-libc
  dependency-version: 2.1.2
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: production-minor-patch
- dependency-name: encodeurl
  dependency-version: 2.0.0
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: production-minor-patch
- dependency-name: minimatch
  dependency-version: 3.1.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: finalhandler
  dependency-version: 1.3.2
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: follow-redirects
  dependency-version: 1.16.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: gauge
  dependency-version: 3.0.2
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: production-minor-patch
- dependency-name: iconv-lite
  dependency-version: 0.6.3
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: mime-db
  dependency-version: 1.54.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: node-gyp
  dependency-version: 12.3.0
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: production-minor-patch
- dependency-name: nopt
  dependency-version: 5.0.0
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: production-minor-patch
- dependency-name: npmlog
  dependency-version: 5.0.1
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: production-minor-patch
- dependency-name: on-headers
  dependency-version: 1.1.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: path-to-regexp
  dependency-version: 0.1.13
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: send
  dependency-version: 0.19.2
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: serve-static
  dependency-version: 1.16.3
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: streamsearch
  dependency-version: 1.1.0
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: production-minor-patch
- dependency-name: uglify-js
  dependency-version: 3.19.3
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: production-minor-patch
- dependency-name: which
  dependency-version: 2.0.2
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: production-minor-patch
- dependency-name: wordwrap
  dependency-version: 1.0.0
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: production-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added automated Automated updates from bots and CI/CD dependencies Pull requests that update a dependency file security Security-related updates and fixes labels May 14, 2026
@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 14, 2026

Dependency Review

The following issues were found:

  • ❌ 3 vulnerable package(s)
  • ❌ 1 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 2 package(s) with unknown licenses.
  • ⚠️ 67 packages with OpenSSF Scorecard issues.

View full job summary

@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github May 25, 2026

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this May 25, 2026
@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/production-minor-patch-cd6c66f821 branch May 25, 2026 20:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

automated Automated updates from bots and CI/CD dependencies Pull requests that update a dependency file security Security-related updates and fixes

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants