chore(deps): bump the npm_and_yarn group across 2 directories with 12 updates by dependabot[bot] · Pull Request #1 · TavoElgueaLopez/datatracker

dependabot · 2026-08-16T23:49:00Z

Bumps the npm_and_yarn group with 5 updates in the / directory:

Package	From	To
js-cookie	`3.0.5`	`3.0.7`
lodash	`4.17.21`	`4.18.1`
send	`0.18.0`	`0.19.0`
pug	`3.0.2`	`3.0.3`
vite	`4.5.3`	`6.4.3`

Bumps the npm_and_yarn group with 5 updates in the /playwright directory:

Package	From	To
lodash	`4.17.21`	`4.18.1`
@tootallnate/once	`2.0.0`	`removed`
brace-expansion	`1.1.11`	`1.1.18`
flatted	`3.2.7`	`3.4.4`
js-yaml	`4.1.0`	`4.3.1`

Updates js-cookie from 3.0.5 to 3.0.7

Release notes

Sourced from js-cookie's releases.

v3.0.7

Prevent cookie attribute injection: CVE-2026-46625 (eb3c40e)

Add Partitioned attribute to readme (b994768)

Publish to npm registry via trusted publisher exclusively (4dc71be)

Ensure consistent behaviour for get('name') + get() (1953d30)

Commits

17bacba Craft v3.0.7 release
adb823c Fix release workflow halting at git tag
5f9e759 May remove Git user config from release workflow
6ac9211 Fix release workflow not able to push commit + tag
2278bc5 Fix missing package version bump
eb3c40e Prevent cookie attribute injection
f6f157f Bump globals from 17.5.0 to 17.6.0
f409d02 Bump eslint from 10.2.0 to 10.3.0
a686883 Bump protobufjs in the npm_and_yarn group across 1 directory
c6112d2 Bump @protobufjs/utf8 in the npm_and_yarn group across 1 directory
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for js-cookie since your current version.

Updates lodash from 4.17.21 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

lodash: lodash/lodash@4.18.0-npm...4.18.1-npm

lodash-es: lodash/lodash@4.18.0-es...4.18.1-es

lodash-amd: lodash/lodash@4.18.0-amd...4.18.1-amd

lodash.templatelodash/lodash@4.18.0-npm-packages...4.18.1-npm-packages

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

Add security notice for _.template in threat model and API docs (#6099)

Document lower > upper behavior in _.random (#6115)

Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

lodash.orderby

lodash.tonumber

lodash.trim

lodash.trimend

lodash.sortedindexby

lodash.zipobjectdeep

lodash.unset

lodash.omit

lodash.template

Commits

cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
75535f5 chore: prune stale advisory refs (#6170)
62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
59be2de release(minor): bump to 4.18.0 (#6161)
af63457 fix: broken tests for _.template 879aaa9
1073a76 fix: linting issues
879aaa9 fix: validate imports keys in _.template
fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
b819080 ci: add dist sync validation workflow (#6137)
Additional commits viewable in compare view

Updates send from 0.18.0 to 0.19.0

Release notes

Sourced from send's releases.

0.19.0

What's Changed

Remove link renderization in html while redirecting (pillarjs/send#235)

New Contributors

@UlisesGascon made their first contribution in pillarjs/send#235

Full Changelog: pillarjs/send@0.18.0...0.19.0

Changelog

Sourced from send's changelog.

0.19.0 / 2024-09-10

Remove link renderization in html while redirecting

Commits

9d2db99 0.19.0
ae4f298 Merge commit from fork
See full diff in compare view

Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for send since your current version.

Updates pug from 3.0.2 to 3.0.3

Release notes

Sourced from pug's releases.

pug-code-gen@3.0.3

Bug Fixes

Validate templateName and globals are valid JavaScript identifiers to prevent possible remote code execution if un-trusted user input is passed to the compilation options (#3438)

pug@3.0.3

Bug Fixes

Update pug-code-gen with the following fix: (#3438)

Validate templateName and globals are valid JavaScript identifiers to prevent possible remote code execution if un-trusted user input is passed to the compilation options

Commits

32acfe8 fix: ensure template names are valid identifiers (#3438)
4767caf refactor: convert pug-error to TypeScript (#3355)
a724446 chore: update character-parser (#3354)
6cca8f7 docs: fix GitHub format in README (#3335)
See full diff in compare view

Updates vite from 4.5.3 to 6.4.3

Release notes

Sourced from vite's releases.

v6.4.3

Please refer to CHANGELOG.md for details.

v6.4.2

Please refer to CHANGELOG.md for details.

v6.4.1

Please refer to CHANGELOG.md for details.

v6.4.0

Please refer to CHANGELOG.md for details.

v6.3.7

Please refer to CHANGELOG.md for details.

v5.4.21

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

6.4.3 (2026-06-01)

fix: backport #22572, reject windows alternate paths (#22576) (96b0c10), closes #22572 #22576

fix(deps): backport #22571, reject UNC paths for launch-editor-middleware (#22575) (8fed5cf), closes #22571 #22575

6.4.2 (2026-04-06)

fix: apply server.fs check to env transport (#22159) (#22163) (fe28e47), closes #22159 #22163

fix: avoid path traversal with optimize deps sourcemap handler (#22161) (ca4da5d), closes #22161

6.4.1 (2025-10-20)

fix(dev): trim trailing slash before server.fs.deny check (#20968) (#20969) (1114b5d), closes #20968 #20969

6.4.0 (2025-10-15)

feat: allow passing down resolved config to vite's createServer (#20932) (ca6455e), closes #20932

6.3.7 (2025-10-14)

fix(esbuild): inject esbuild helpers correctly for esbuild 0.25.9+ (#20940) (c59a222), closes #20940

6.3.6 (2025-09-08)

fix: apply fs.strict check to HTML files (#20736) (0ab19ea), closes #20736

fix: upgrade sirv to 3.0.2 (#20735) (e11d240), closes #20735

test: detect ts support via process.features (#20544) (7d99229), closes #20544

6.3.5 (2025-05-05)

fix(ssr): handle uninitialized export access as undefined (#19959) (fd38d07), closes #19959

6.3.4 (2025-04-30)

fix: check static serve file inside sirv (#19965) (c22c43d), closes #19965

fix(optimizer): return plain object when using require to import externals in optimized dependenci (efc5eab), closes #19940

... (truncated)

Commits

6c2c881 release: v6.4.3
96b0c10 fix: backport #22572, reject windows alternate paths (#22576)
8fed5cf fix(deps): backport #22571, reject UNC paths for launch-editor-middleware (#2...
6b3fad0 release: v6.4.2
ca4da5d fix: avoid path traversal with optimize deps sourcemap handler (#22161)
fe28e47 fix: apply server.fs check to env transport (#22159) (#22163)
5487f4f release: v6.4.1
1114b5d fix(dev): trim trailing slash before server.fs.deny check (#20968) (#20969)
f12697c release: v6.4.0
ca6455e feat: allow passing down resolved config to vite's createServer (#20932)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for vite since your current version.

Updates esbuild from 0.18.20 to 0.25.12

Release notes

Sourced from esbuild's releases.

v0.25.12
Fix a minification regression with CSS media queries (#4315)

The previous release introduced support for parsing media queries which unintentionally introduced a regression with the removal of duplicate media rules during minification. Specifically the grammar for @media <media-type> and <media-condition-without-or> { ... } was missing an equality check for the <media-condition-without-or> part, so rules with different suffix clauses in this position would incorrectly compare equal and be deduplicated. This release fixes the regression.
Update the list of known JavaScript globals (#4310)

This release updates esbuild's internal list of known JavaScript globals. These are globals that are known to not have side-effects when the property is accessed. For example, accessing the global Array property is considered to be side-effect free but accessing the global scrollY property can trigger a layout, which is a side-effect. This is used by esbuild's tree-shaking to safely remove unused code that is known to be side-effect free. This update adds the following global properties:

From ES2017:

Atomics

SharedArrayBuffer

From ES2020:

BigInt64Array

BigUint64Array

From ES2021:

FinalizationRegistry

WeakRef

From ES2025:

Float16Array

Iterator

Note that this does not indicate that constructing any of these objects is side-effect free, just that accessing the identifier is side-effect free. For example, this now allows esbuild to tree-shake classes that extend from Iterator:
// This can now be tree-shaken by esbuild:
class ExampleIterator extends Iterator {}
Add support for the new @view-transition CSS rule (#4313)

With this release, esbuild now has improved support for pretty-printing and minifying the new @view-transition rule (which esbuild was previously unaware of):
/* Original code */
@view-transition {
  navigation: auto;
  types: check;
}
/* Old output */
@view-transition { navigation: auto; types: check; }
/* New output */
@view-transition {
navigation: auto;
types: check;

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2023

This changelog documents all esbuild versions published in the year 2023 (versions 0.16.13 through 0.19.11).

0.19.11
Fix TypeScript-specific class transform edge case (#3559)

The previous release introduced an optimization that avoided transforming super() in the class constructor for TypeScript code compiled with useDefineForClassFields set to false if all class instance fields have no initializers. The rationale was that in this case, all class instance fields are omitted in the output so no changes to the constructor are needed. However, if all of this is the case and there are #private instance fields with initializers, those private instance field initializers were still being moved into the constructor. This was problematic because they were being inserted before the call to super() (since super() is now no longer transformed in that case). This release introduces an additional optimization that avoids moving the private instance field initializers into the constructor in this edge case, which generates smaller code, matches the TypeScript compiler's output more closely, and avoids this bug:
// Original code
class Foo extends Bar {
  #private = 1;
  public: any;
  constructor() {
    super();
  }
}
// Old output (with esbuild v0.19.9)
class Foo extends Bar {
constructor() {
super();
this.#private = 1;
}
#private;
}
// Old output (with esbuild v0.19.10)
class Foo extends Bar {
constructor() {
this.#private = 1;
super();
}
#private;
}
// New output
class Foo extends Bar {
#private = 1;
constructor() {
super();
}
}
Minifier: allow reording a primitive past a side-effect (#3568)

The minifier previously allowed reordering a side-effect past a primitive, but didn't handle the case of reordering a primitive past a side-effect. This additional case is now handled:

... (truncated)

Commits

208f539 publish 0.25.12 to npm
5f03afd update release notes
6b2ee78 minify: remove css rules containing empty :is()
f361deb add some additional known static methods
07aa646 automatically mark "RegExp.escape()" calls as pure
9039c46 simplify some call expression checks
188944d add some additional known static methods
d3c67f9 fix #4310: add Iterator and other known globals
4a51f0b fix: escape dev server breadcrumb hrefs properly (#4316)
26b29ed fix #4315: @media deduplication bug edge case
Additional commits viewable in compare view

Updates postcss from 8.4.33 to 8.4.35

Release notes

Sourced from postcss's releases.

8.4.35

Avoid ! in node.parent.nodes type.

Allow to pass undefined to node adding method to simplify types.

8.4.34

Fixed AtRule#nodes type (by @tim-we).

Cleaned up code (by @DrKiraDmitry).

Changelog

Sourced from postcss's changelog.

8.4.35

Avoid ! in node.parent.nodes type.

Allow to pass undefined to node adding method to simplify types.

8.4.34

Fixed AtRule#nodes type (by Tim Weißenfels).

Cleaned up code (by Dmitry Kirillov).

Commits

edda95e Release 8.4.35 version
612f360 Merge pull request #1924 from postcss/refactor/types
5e7449f Fix node.parent.nodes type
65075df Allow to pass undefined to adding methods to simplify type check
477b3bb Release 8.4.34 version
25af117 Update dependencies
bb0314a Merge pull request #1922 from tim-we/improve-at-rule-types
9dd5a93 Fix at-rule test
8322d11 Fix visitor test
ee7fcd4 Fix Document#nodes
Additional commits viewable in compare view

Updates rollup from 3.29.4 to 4.62.4

Release notes

Sourced from rollup's releases.

v4.62.4

4.62.4

2026-08-01

Bug Fixes

Resolve a regression when using Rollup on older Linux distributions (#6467)

Pull Requests

#6463: docs: add llms.txt documentation index for LLMs and agents (@abyworkings-coder, @lukastaegert)

#6464: fix(deps): update minor/patch updates (@renovate[bot])

#6465: chore(deps): lock file maintenance (@renovate[bot])

#6466: chore(deps): lock file maintenance (@renovate[bot])

#6467: ci: fix linux-gnu glibc regression and enforce glibc ≤ 2.28 compatibility (@lukastaegert)

v4.62.3

4.62.3

2026-07-26

Bug Fixes

Sanitize illegal characters preserved modules input base (#6439)

Pull Requests

#6421: docs: update x_google_ignoreList link to canonical URL (@DucMinhNe, @lukastaegert)

#6422: fix(deps): update minor/patch updates (@renovate[bot], @lukastaegert)

#6423: chore(deps): update actions/checkout action to v7 (@renovate[bot])

#6424: chore(deps): update dependency eslint-plugin-unicorn to v68 (@renovate[bot], @lukastaegert)

#6425: chore(deps): lock file maintenance (@renovate[bot], @lukastaegert)

#6426: chore(deps): lock file maintenance (@renovate[bot])

#6432: fix: make isLegal idempotent by not using a global-flag regex (@spokodev, @lukastaegert)

#6433: docs: clarify sideEffects and moduleSideEffects (@ishaanlabs-gg, @lukastaegert)

#6434: chore(deps): update dtolnay/rust-toolchain digest to 4be7066 (@renovate[bot], @lukastaegert)

#6435: fix(deps): update minor/patch updates (@renovate[bot])

#6436: chore(deps): update actions/cache action to v6 (@renovate[bot])

#6438: chore(deps): lock file maintenance (@renovate[bot], @lukastaegert)

#6439: Sanitize input base before computing preserved module chunk names (@MahinAnowar, @lukastaegert)

#6443: chore(deps): update dependency eslint-plugin-unicorn to v71 (@renovate[bot], @lukastaegert)

#6444: fix(deps): update rust crate swc_compiler_base to v60 (@renovate[bot])

#6446: chore(deps): update dtolnay/rust-toolchain digest to 4cda84d (@renovate[bot])

#6447: fix(deps): update minor/patch updates (@renovate[bot])

#6448: chore(deps): update actions/setup-node action to v7 (@renovate[bot])

#6449: chore(deps): update dependency eslint-plugin-unicorn to v72 (@renovate[bot])

#6450: chore(deps): update dependency pinia to v4 (@renovate[bot], @lukastaegert)

#6451: chore(deps): lock file maintenance (@renovate[bot], @lukastaegert)

#6455: docs: fix broken commonjs namedExports link in troubleshooting (@Hashim1999164, @lukastaegert)

... (truncated)

Changelog

Sourced from rollup's changelog.

rollup changelog

Commits

ddc4ffa 4.62.4
86d1710 Update audit resolve
7beedfa ci: fix linux-gnu glibc regression and enforce glibc ≤ 2.28 compatibility (#6...
9c2c58d docs: add llms.txt documentation index for LLMs and agents (#6463)
dc69288 chore(deps): lock file maintenance (#6466)
5ee0821 chore(deps): lock file maintenance (#6465)
4501389 fix(deps): update minor/patch updates (#6464)
a80a197 4.62.3
e87e19b Update audit resolve
72f98e9 Fix build:docs after rollup update (#6460)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for rollup since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates lodash from 4.17.21 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

lodash: lodash/lodash@4.18.0-npm...4.18.1-npm

lodash-es: lodash/lodash@4.18.0-es...4.18.1-es

lodash-amd: lodash/lodash@4.18.0-amd...4.18.1-amd

lodash.templatelodash/lodash@4.18.0-npm-packages...4.18.1-npm-packages

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

Add security notice for _.template in threat model and API docs (#6099)

Document lower > upper behavior in _.random (#6115)

Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

lodash.orderby

lodash.tonumber

lodash.trim

lodash.trimend

lodash.sortedindexby

lodash.zipobjectdeep

lodash.unset

lodash.omit

lodash.template

Commits

cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
75535f5 chore: prune stale advisory refs (#6170)
62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
59be2de release(minor): bump to 4.18.0 (#6161)
af63457 fix: broken tests for _.template 879aaa9
1073a76 fix: linting issues
879aaa9 fix: validate imports keys in _.template
fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
b819080 ci: add dist sync validation workflow (#6137)
Additional commits viewable in compare view

Removes @tootallnate/once

Updates brace-expansion from 1.1.11 to 1.1.18

Release notes

Sourced from brace-expansion's releases.

v1.1.15

Backport v5.0.6 change to v1 (#111) 0b09384

juliangruber/brace-expansion@v1.1.14...v1.1.15

v1.1.12

pkg: publish on tag 1.x c460dbd

fmt ccb8ac6

Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) c3c73c8

juliangruber/brace-expansion@v1.1.11...v1.1.12

Commits

758fcd6 1.1.18
27fbeed Merge commit from fork
5c57cc2 1.1.17
d757f1d npm ignore .claude
cb4b9e4 fix: backport GHSA-mh99-v99m-4gvg (#129)
447763a 1.1.16
d74e630 fix: v1 backport for CVE-2026-13149 (#122)
2203f4f 1.1.15
0b09384 Backport v5.0.6 change to v1 (#111)
10c05fc 1.1.14
Additional commits viewable in compare view

Updates flatted from 3.2.7 to 3.4.4

Commits

e6f5ca7 3.4.4
47f14fa removed E_STRICT from PHP
4050568 fixced go-lang issues in CI
4303f4d Merge pull request #101 from mfinelli/gocriticfixes
106735b updated package-lock.json
670a1bd 3.4.3
50a61a9 Fix #104 - allow null as replacer value
8aa64f4 solved crytical errors over dependencies
b85577f Fix go-critic errors
bb8c63c Merge pull request #100 from WebReflection/WebReflection-patch-1
Additional commits viewable in compare view

Updates js-yaml from 4.1.0 to 4.3.1

Changelog

Sourced from js-yaml's changelog.

4.3.1 - 2026-07-31

Security

[backport] Remove quadratic complexity from !!omap duplicate key detection.

4.3.0 - 2026-06-27

Added

[backport] Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.

Fixed

Restore umd builds back to es5.

Removed

[backport] maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

[4.2.0] - 2026-06-01

Added

Added docs/safety.md with notes about processing untrusted YAML.

Added maxDepth (100) loader option. Not a problem, but gives a better exception instead of RangeError on stack overflow.

Added maxMergeSeqLength (20) loader option. Not a problem after merge fix, but an additional restriction for safety.

Added sourcemaps to dist/ builds.

Changed

Stop resolving numbers with underscores as numeric scalars, #627.

Switched dev toolchains to Vite / neostandard.

Updated demo.

Reorganized tests.

dist/ files are no longer kept in the repository.

Fixed

Fix parsing of properties on the first implicit block mapping key, #62.

Fix trailing whitespace handling when folding flow scalar lines, #307.

Reject top-level block scalars without content indentation, #280.

Ensure numbers survive round-trip, #737.

Fix test coverage for issue #221.

Fix flow scalar trailing whitespace folding, #307.

Fix digits in YAML named tag handles.

Security

Fix potential DoS via quadratic complexity in merge - deduplicate repeated elements (makes sense for malformed files > 10K).

[3.14.2] - 2025-11-15

Security

... (truncated)

Commits

86e91b8 4.3.1 released
c3cc4b0 Backport quadratic complexity fix for !!omap
33d05b5 4.3.0 released
663bfab Drop demo publish, to not override new v5 one.
1cb8c7b Add v4-legacy tag for publish
02f27af Restore umd builds back to es5
8be84ed Fix es5 compatibility
59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
6842ef6 doc polish
590dbab 4.2.0 released
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this sp...

Description has been truncated

… updates Bumps the npm_and_yarn group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [js-cookie](https://github.com/js-cookie/js-cookie) | `3.0.5` | `3.0.7` | | [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.18.1` | | [send](https://github.com/pillarjs/send) | `0.18.0` | `0.19.0` | | [pug](https://github.com/pugjs/pug) | `3.0.2` | `3.0.3` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `4.5.3` | `6.4.3` | Bumps the npm_and_yarn group with 5 updates in the /playwright directory: | Package | From | To | | --- | --- | --- | | [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.18.1` | | [@tootallnate/once](https://github.com/TooTallNate/once) | `2.0.0` | `removed` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.11` | `1.1.18` | | [flatted](https://github.com/WebReflection/flatted) | `3.2.7` | `3.4.4` | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.0` | `4.3.1` | Updates `js-cookie` from 3.0.5 to 3.0.7 - [Release notes](https://github.com/js-cookie/js-cookie/releases) - [Commits](js-cookie/js-cookie@v3.0.5...v3.0.7) Updates `lodash` from 4.17.21 to 4.18.1 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.18.1) Updates `send` from 0.18.0 to 0.19.0 - [Release notes](https://github.com/pillarjs/send/releases) - [Changelog](https://github.com/pillarjs/send/blob/master/HISTORY.md) - [Commits](pillarjs/send@0.18.0...0.19.0) Updates `pug` from 3.0.2 to 3.0.3 - [Release notes](https://github.com/pugjs/pug/releases) - [Commits](https://github.com/pugjs/pug/compare/pug@3.0.2...pug@3.0.3) Updates `vite` from 4.5.3 to 6.4.3 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v6.4.3/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v6.4.3/packages/vite) Updates `esbuild` from 0.18.20 to 0.25.12 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2023.md) - [Commits](evanw/esbuild@v0.18.20...v0.25.12) Updates `postcss` from 8.4.33 to 8.4.35 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.4.33...8.4.35) Updates `rollup` from 3.29.4 to 4.62.4 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG-3.md) - [Commits](rollup/rollup@v3.29.4...v4.62.4) Updates `lodash` from 4.17.21 to 4.18.1 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.18.1) Removes `@tootallnate/once` Updates `brace-expansion` from 1.1.11 to 1.1.18 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@1.1.11...v1.1.18) Updates `flatted` from 3.2.7 to 3.4.4 - [Commits](WebReflection/flatted@v3.2.7...v3.4.4) Updates `js-yaml` from 4.1.0 to 4.3.1 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.0...4.3.1) --- updated-dependencies: - dependency-name: js-cookie dependency-version: 3.0.7 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.18.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: send dependency-version: 0.19.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: pug dependency-version: 3.0.3 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 6.4.3 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: esbuild dependency-version: 0.25.12 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.4.35 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: rollup dependency-version: 4.62.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.18.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@tootallnate/once" dependency-version: dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.18 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: flatted dependency-version: 3.4.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.3.1 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

changeset-bot · 2026-08-16T23:49:05Z

⚠️ No Changeset found

Latest commit: b688841

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

snyk-io · 2026-08-16T23:49:25Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

socket-security · 2026-08-16T23:49:32Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability	Quality	Maintenance
npm/lodash-es@4.18.1
npm/lodash@4.18.1
npm/vite@4.5.3 ⏵ 6.4.3	^-2	⁺⁴¹		^-1
npm/pug@3.0.2 ⏵ 3.0.3		⁺²	⁺¹
npm/send@0.18.0 ⏵ 0.19.0		⁺¹
npm/js-cookie@3.0.5 ⏵ 3.0.7		⁺¹⁶		⁺⁶
npm/npm-check-updates@16.14.18 ⏵ 23.0.2	⁺⁶

View full report

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 16, 2026

Navigation Menu

chore(deps): bump the npm_and_yarn group across 2 directories with 12 updates - #1

chore(deps): bump the npm_and_yarn group across 2 directories with 12 updates#1
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-f3f19ffd04

dependabot Bot commented on behalf of github Aug 16, 2026

Uh oh!

changeset-bot Bot commented Aug 16, 2026

Uh oh!

snyk-io Bot commented Aug 16, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Aug 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Aug 16, 2026

v3.0.7

4.18.1

Bugs

4.18.0

v4.18.0

Security

Docs

lodash.* modular packages

0.19.0

What's Changed

New Contributors

0.19.0 / 2024-09-10

pug-code-gen@3.0.3

Bug Fixes

pug@3.0.3

Bug Fixes

v6.4.3

v6.4.2

v6.4.1

v6.4.0

v6.3.7

v5.4.21

6.4.3 (2026-06-01)

6.4.2 (2026-04-06)

6.4.1 (2025-10-20)

6.4.0 (2025-10-15)

6.3.7 (2025-10-14)

6.3.6 (2025-09-08)

6.3.5 (2025-05-05)

6.3.4 (2025-04-30)

v0.25.12

Changelog: 2023

0.19.11

8.4.35

8.4.34

8.4.35

8.4.34

v4.62.4

4.62.4

Bug Fixes

Pull Requests

v4.62.3

4.62.3

Bug Fixes

Pull Requests

rollup changelog

4.18.1

Bugs

4.18.0

v4.18.0

Security

Docs

lodash.* modular packages

v1.1.15

v1.1.12

4.3.1 - 2026-07-31

Security

4.3.0 - 2026-06-27

Added

Fixed

Removed

[4.2.0] - 2026-06-01

Added

Changed

Fixed

Security

[3.14.2] - 2025-11-15

Security

Uh oh!

changeset-bot Bot commented Aug 16, 2026

⚠️ No Changeset found

Uh oh!

snyk-io Bot commented Aug 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

socket-security Bot commented Aug 16, 2026

Uh oh!

`lodash.*` modular packages

`lodash.*` modular packages

snyk-io Bot commented Aug 16, 2026 •

edited

Loading