chore(deps): bump the npm_and_yarn group across 1 directory with 11 updates by dependabot[bot] · Pull Request #261 · LironEr/bundlemon

dependabot · 2026-04-10T01:58:02Z

Bumps the npm_and_yarn group with 11 updates in the / directory:

Package	From	To
fastify	`5.5.0`	`5.12.5`
vite	`5.4.21`	`6.4.3`
@isaacs/brace-expansion	`5.0.0`	`5.0.1`
ajv	`6.12.6`	`6.15.0`
defu	`6.1.4`	`6.1.7`
flatted	`3.1.1`	`3.4.4`
h3	`1.11.1`	`1.15.11`
node-forge	`1.3.2`	`1.4.0`
picomatch	`2.3.1`	`2.3.2`
rollup	`4.24.0`	`4.63.6`
svgo	`3.3.2`	`3.3.5`
vite	`5.4.21`	`6.4.3`

Updates fastify from 5.5.0 to 5.12.5

Release notes

Sourced from fastify's releases.

v5.12.5

⚠️ Security release

Fix for GHSA-4mh8-r7rc-xpvc

What's Changed

[Backport 5.x] perf: reduce content-type parser overhead by @github-actions[bot] in fastify/fastify#7019

[Backport 5.x] perf: avoid redundant request-part reads during validation by @github-actions[bot] in fastify/fastify#7020

Full Changelog: fastify/fastify@v5.12.4...v5.12.5

v5.12.4

Fixed the fastify.js version mismatch.

Full Changelog: fastify/fastify@v5.12.2...v5.12.4

v5.12.2

⚠️ Security release

Fix for GHSA-9q9j-q6p8-xq58

Fix for GHSA-hwr6-493r-vm6h

Fix for GHSA-p68q-wchp-6fh7

Fix for GHSA-667r-xxjv-c9mm

What's Changed

[Backport 5.x] fix: callNotFound should run not-found preHandler regardless of registration order by @github-actions[bot] in fastify/fastify#6973

[Backport 5.x] chore: npm ignore remaining agent files by @github-actions[bot] in fastify/fastify#7003

Full Changelog: fastify/fastify@v5.12.1...v5.12.2

v5.12.1

⚠️ Security release

Fix for GHSA-w2qp-rph6-63g4

Fix for GHSA-3m5p-2c4r-xxw2

What's Changed

[Backport 5.x] test: fix reply.mediaType by @github-actions[bot] in fastify/fastify#6950

[Backport 5.x] ci: allow backport in pr title by @github-actions[bot] in fastify/fastify#6952

[Backport 5.x] fix: run preClose hook exactly once per declaring instance by @github-actions[bot] in fastify/fastify#6954

[Backport 5.x] fix: report canonical route url for hidden prefix slash route by @github-actions[bot] in fastify/fastify#6961

Full Changelog: fastify/fastify@v5.12.0...v5.12.1

v5.12.0

What's Changed

chore(sponsor): add testmu ai by @Eomm in fastify/fastify#6922

... (truncated)

Commits

ba235fd Bumped v5.12.5
ad06a4c Merge commit from fork
7af0d77 [Backport 5.x] perf: avoid redundant request-part reads during validation (#7...
990ebef [Backport 5.x] perf: reduce content-type parser overhead (#7019)
1690e35 Bumped v5.12.4
1c991c4 Bumped v5.12.3
942a2be Bumped v5.12.2
853f6e2 test(validation): cover normalization and async branches
f02d8d4 fix(validation): do not unwrap async validator results
93c239a fix: reject malformed URLs before custom 404 handlers
Additional commits viewable in compare view

Updates vite from 5.4.21 to 6.4.3

Release notes

Sourced from vite's releases.

v6.4.3

Please refer to CHANGELOG.md for details.

v6.4.2

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

6.4.3 (2026-06-01)

fix: backport #22572, reject windows alternate paths (#22576) (96b0c10), closes #22572 #22576

fix(deps): backport #22571, reject UNC paths for launch-editor-middleware (#22575) (8fed5cf), closes #22571 #22575

6.4.2 (2026-04-06)

fix: apply server.fs check to env transport (#22159) (#22163) (fe28e47), closes #22159 #22163

fix: avoid path traversal with optimize deps sourcemap handler (#22161) (ca4da5d), closes #22161

6.4.1 (2025-10-20)

fix(dev): trim trailing slash before server.fs.deny check (#20968) (#20969) (1114b5d), closes #20968 #20969

6.4.0 (2025-10-15)

feat: allow passing down resolved config to vite's createServer (#20932) (ca6455e), closes #20932

6.3.7 (2025-10-14)

fix(esbuild): inject esbuild helpers correctly for esbuild 0.25.9+ (#20940) (c59a222), closes #20940

6.3.6 (2025-09-08)

fix: apply fs.strict check to HTML files (#20736) (0ab19ea), closes #20736

fix: upgrade sirv to 3.0.2 (#20735) (e11d240), closes #20735

test: detect ts support via process.features (#20544) (7d99229), closes #20544

6.3.5 (2025-05-05)

fix(ssr): handle uninitialized export access as undefined (#19959) (fd38d07), closes #19959

6.3.4 (2025-04-30)

fix: check static serve file inside sirv (#19965) (c22c43d), closes #19965

fix(optimizer): return plain object when using require to import externals in optimized dependenci (efc5eab), closes #19940

... (truncated)

Commits

6c2c881 release: v6.4.3
96b0c10 fix: backport #22572, reject windows alternate paths (#22576)
8fed5cf fix(deps): backport #22571, reject UNC paths for launch-editor-middleware (#2...
6b3fad0 release: v6.4.2
ca4da5d fix: avoid path traversal with optimize deps sourcemap handler (#22161)
fe28e47 fix: apply server.fs check to env transport (#22159) (#22163)
5487f4f release: v6.4.1
1114b5d fix(dev): trim trailing slash before server.fs.deny check (#20968) (#20969)
f12697c release: v6.4.0
ca6455e feat: allow passing down resolved config to vite's createServer (#20932)
Additional commits viewable in compare view

Updates @isaacs/brace-expansion from 5.0.0 to 5.0.1

Updates ajv from 6.12.6 to 6.15.0

Commits

184bc32 6.15.0
fea46af test/fix prototype pollution via $data ref with format keyword (#2606)
e3af0a7 6.14.0
b552ed6 add regExp option to address $data exploit via a regular expression (CVE-2025...
72f2286 docs: update v7 info
231e52b Merge pull request #1320 from philsturgeon/patch-1
d3475fc Add spectral, an AJV util from a sponsor
413afe0 docs: v7.0.0-beta.3
11e997b update readme for v7
See full diff in compare view

Updates defu from 6.1.4 to 6.1.7

Release notes

Sourced from defu's releases.

v6.1.7

compare changes

📦 Build

Correct the types export entry (#160)

Export Defu types (#157)

❤️ Contributors

Jakub Michálek (@J-Michalek)

Kricsleo (@kricsleo)

v6.1.6

compare changes

📦 Build

Fix mixed types (407b516)

v6.1.5

compare changes

🩹 Fixes

Prevent prototype pollution via __proto__ in defaults (#156)

Ignore inherited enumerable properties (11ba022)

✅ Tests

Add more tests for plain objects (b65f603)

❤️ Contributors

Pooya Parsa (@pi0)

Kricsleo (@kricsleo)

Changelog

Sourced from defu's changelog.

v6.1.7

compare changes

🩹 Fixes

defu.d.cts: Export Defu types (#157)

📦 Build

Correct the types export entry (#160)

❤️ Contributors

Jakub Michálek (@J-Michalek)

Kricsleo (@kricsleo)

v6.1.6

compare changes

📦 Build

Fix mixed types (407b516)

❤️ Contributors

Pooya Parsa (@pi0)

v6.1.5

compare changes

🩹 Fixes

Prevent prototype pollution via __proto__ in defaults (#156)

Ignore inherited enumerable properties (11ba022)

🏡 Chore

Add tea.yaml (70cffe5)

Update repo (23cc432)

Fix typecheck (89df6bb)

✅ Tests

Add more tests for plain objects (b65f603)

🤖 CI

... (truncated)

Commits

80c0146 chore(release): v6.1.7
40d7ef4 fix(defu.d.cts): export Defu types (#157)
3d3a7c8 build: correct the types export entry (#160)
001c290 chore(release): v6.1.6
407b516 build: fix mixed types
23e59e6 chore(release): v6.1.5
11ba022 fix: ignore inherited enumerable properties
3942bfb fix: prevent prototype pollution via __proto__ in defaults (#156)
d3ef16d chore(deps): update actions/checkout action to v6 (#151)
869a053 chore(deps): update actions/setup-node action to v6 (#149)
Additional commits viewable in compare view

Updates flatted from 3.1.1 to 3.4.4

Commits

e6f5ca7 3.4.4
47f14fa removed E_STRICT from PHP
4050568 fixced go-lang issues in CI
4303f4d Merge pull request #101 from mfinelli/gocriticfixes
106735b updated package-lock.json
670a1bd 3.4.3
50a61a9 Fix #104 - allow null as replacer value
8aa64f4 solved crytical errors over dependencies
b85577f Fix go-critic errors
bb8c63c Merge pull request #100 from WebReflection/WebReflection-patch-1
Additional commits viewable in compare view

Updates h3 from 1.11.1 to 1.15.11

Release notes

Sourced from h3's releases.

v1.15.11

compare changes

🏡 Chore

Update defu to 6.1.6 (6125485)

Update deps (4998dd8)

Update cookie-es (d166186)

v1.15.10

compare changes

🩹 Fixes

Preserve percent-encoded req.url in app event handler (#1355)

❤️ Contributors

Sergio Azócar (@sergioazoc)

v1.15.9

compare changes

🩹 Fixes

Preserve %25 in pathname (1103df6)

static: Prevent path traversal via double-encoded dot segments (%252e%252e) (c56683d)

sse: Sanitize carriage returns in event stream data and comments (ba3c3fe)

v1.15.8

compare changes

🩹 Fixes

Preserve %25 in pathname (1103df6)

v1.15.7

compare changes

🩹 Fixes

static: Narrow path traversal check to match .. as a path segment only (c049dc0)

app: Decode percent-encoded path segments to prevent auth bypass (313ea52)

💅 Refactors

Remove implicit event handler conversion warning (#1340)

❤️ Contributors

... (truncated)

Changelog

Sourced from h3's changelog.

v1.15.11

compare changes

🏡 Chore

Update defu to 6.1.6 (6125485)

Update deps (4998dd8)

Update cookie-es (d166186)

❤️ Contributors

Pooya Parsa (@pi0)

v1.15.10

compare changes

🩹 Fixes

Preserve percent-encoded req.url in app event handler (#1355)

🏡 Chore

Update deps (26fec6f)

❤️ Contributors

Pooya Parsa (@pi0)

Sergio Azócar (@sergioazoc)

v1.15.9

compare changes

🩹 Fixes

Preserve %25 in pathname (1103df6)

static: Prevent path traversal via double-encoded dot segments (%252e%252e) (c56683d)

sse: Sanitize carriage returns in event stream data and comments (ba3c3fe)

🏡 Chore

release: V1.15.8 (e3b9c9e)

Update deps (23045df)

❤️ Contributors

Pooya Parsa (@pi0)

... (truncated)

Commits

7b9f41f chore(release): v1.15.11
d166186 chore: update cookie-es
4998dd8 chore: update deps
6125485 chore: update defu to 6.1.6
b72bb57 chore(release): v1.15.10
d8ef318 remove resolutions for h3
26fec6f chore: update deps
51ca9b3 fix: preserve percent-encoded req.url in app event handler (#1355)
4e8d43a chore(release): v1.15.9
23045df chore: update deps
Additional commits viewable in compare view

Updates node-forge from 1.3.2 to 1.4.0

Changelog

Sourced from node-forge's changelog.

1.4.0 - 2026-03-24

Security

HIGH: Denial of Service in BigInteger.modInverse()

A Denial of Service (DoS) vulnerability exists due to an infinite loop in the BigInteger.modInverse() function (inherited from the bundled jsbn library). When modInverse() is called with a zero value as input, the internal Extended Euclidean Algorithm enters an unreachable exit condition, causing the process to hang indefinitely and consume 100% CPU.

Reported by Kr0emer.

CVE ID: CVE-2026-33891

GHSA ID: GHSA-5gfm-wpxj-wjgq

HIGH: Signature forgery in RSA-PKCS due to ASN.1 extra field.

RSASSA PKCS#1 v1.5 signature verification accepts forged signatures for low public exponent keys (e=3). Attackers can forge signatures by stuffing "garbage" bytes within the ASN.1 structure in order to construct a signature that passes verification, enabling Bleichenbacher style forgery. This issue is similar to CVE-2022-24771, but adds bytes in an addition field within the ASN.1 structure, rather than outside of it.

Additionally, forge does not validate that signatures include a minimum of 8 bytes of padding as defined by the specification, providing attackers additional space to construct Bleichenbacher forgeries.

Reported as part of a U.C. Berkeley security research project by:

Austin Chu, Sohee Kim, and Corban Villa.

CVE ID: CVE-2026-33894

GHSA ID: GHSA-ppp5-5v6c-4jwp

HIGH: Signature forgery in Ed25519 due to missing S < L check.

Ed25519 signature verification accepts forged non-canonical signatures where the scalar S is not reduced modulo the group order (S >= L). A valid signature and its S + L variant both verify in forge, while Node.js crypto.verify (OpenSSL-backed) rejects the S + L variant, as defined by the specification. This class of signature malleability has been exploited in practice to bypass authentication and authorization logic (see CVE-2026-25793, CVE-2022-35961). Applications relying on signature uniqueness (i.e., dedup by signature bytes, replay tracking, signed-object canonicalization checks) may be bypassed.

Reported as part of a U.C. Berkeley security research project by:

Austin Chu, Sohee Kim, and Corban Villa.

CVE ID: CVE-2026-33895

GHSA ID: GHSA-q67f-28xg-22rw

HIGH: basicConstraints bypass in certificate chain verification.

pki.verifyCertificateChain() does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the basicConstraints and keyUsage extensions. This allows any leaf certificate (without these extensions) to act as a CA and sign other certificates, which node-forge will accept as valid.

Reported by Doruk Tan Ozturk (@peaktwilight) - doruk.ch

CVE ID: CVE-2026-33896

GHSA ID: GHSA-2328-f5f3-gj25

... (truncated)

Commits

fa385f9 Release 1.4.0.
07d4e16 Update changelog.
cb90fd9 Update changelog.
963e7c5 Add unit test for "pseudonym"
f0b6f5b Add pseudonym OID
3df48a3 Fix missing CVE ID.
2e49283 Add x509 basicConstraints check.
bdecf11 Add canonical signature scaler check for S < L.
af094e6 Add RSA padding and DigestInfo length checks.
796eeb1 Improve jsbn fix.
Additional commits viewable in compare view

Updates picomatch from 2.3.1 to 2.3.2

Release notes

Sourced from picomatch's releases.

2.3.2

This is a security release fixing several security relevant issues.

What's Changed

fix: exception when glob pattern contains constructor by @Jason3S in micromatch/picomatch#144

Fix for CVE-2026-33671

Fix for CVE-2026-33672

Full Changelog: micromatch/picomatch@2.3.1...2.3.2

Changelog

Sourced from picomatch's changelog.

2.3.2 (2026-03-23)

Fixed

Avoided an exception when a glob pattern contains constructor (#144, 3f4f10e).

Security

Backported the extglob-quantifier ReDoS fix from 4.0.4. Risky repeated extglobs are now safely rewritten or treated as literals by default; positive numeric maxExtglobRecursion values allow limited nesting, while false disables the safeguard (CVE-2026-33671, eec17ae).

Prevented inherited object properties from being interpreted as POSIX character classes (CVE-2026-33672, fc1f6b6).

Commits

81cba8d Publish 2.3.2
fc1f6b6 Merge commit from fork
eec17ae Merge commit from fork
78f8ca4 Merge pull request #156 from micromatch/backport-144
3f4f10e Merge pull request #144 from Jason3S/jdent-object-properties
See full diff in compare view

Updates rollup from 4.24.0 to 4.63.6

Release notes

Sourced from rollup's releases.

v4.63.6

4.63.6

2026-10-01

Bug Fixes

Ensure external reexports are always imported when used in a reified dynamic namespace (#6540)

Pull Requests

#6527: Update minor/patch updates (@renovate[bot])

#6529: Update dependency eslint-plugin-unicorn to v76 (@renovate[bot])

#6530: Lock file maintenance (@renovate[bot])

#6535: Lock file maintenance (@renovate[bot], @lukastaegert)

#6540: Import external re-exports used by shared-chunk namespace objects (@00200200)

v4.63.5

4.63.5

2026-09-24

Bug Fixes

Fix an issue where watch mode would hang instead of terminating when closing via Ctrl+C (#6521)

Avoid starting overlapping watch mode runs when plugins invalidate files at the wrong time (#6526)

Fix many edge cases where watch mode events were not properly emitted to listeners, especially when errors occur (#6526)

Pull Requests

#6520: Lock file maintenance (@renovate[bot], @lukastaegert)

#6521: Terminate watch mode via natural process exit when possible (@lukastaegert)

#6523: Protect cc pin against renovate lock file maintenance (@lukastaegert)

#6525: docs: fix typos 'interations' and 'coresponding' (@haimingZZ)

#6526: fix(watch): prevent overlapping runs and other run lifecycle bugs (@lukastaegert)

v4.63.4

4.63.4

2026-09-19

Bug Fixes

Ensure meta information of the cached module is exposed in shouldTransformCachedModule (#6442)

Do not create invalid code if import attribute values contain special characters (#6502)

Pull Requests

#6429: ci: collect Rust coverage from JS tests in dedicated job (@lukastaegert)

#6442: fix: expose cached module meta during cache checks (@ychampion, @lukastaegert)

... (truncated)

Changelog

Sourced from rollup's changelog.

4.63.6

2026-10-01

Bug Fixes

Ensure external reexports are always imported when used in a reified dynamic namespace (#6540)

Pull Requests

#6527: Update minor/patch updates (@renovate[bot])

#6529: Update dependency eslint-plugin-unicorn to v76 (@renovate[bot])

#6530: Lock file maintenance (@renovate[bot])

#6535: Lock file maintenance (@renovate[bot], @lukastaegert)

#6540: Import external re-exports used by shared-chunk namespace objects (@00200200)

4.63.5

2026-09-24

Bug Fixes

Fix an issue where watch mode would hang instead of terminating when closing via Ctrl+C (#6521)

Avoid starting overlapping watch mode runs when plugins invalidate files at the wrong time (#6526)

Fix many edge cases where watch mode events were not properly emitted to listeners, especially when errors occur (#6526)

Pull Requests

#6520: Lock file maintenance (@renovate[bot], @lukastaegert)

#6521: Terminate watch mode via natural process exit when possible (@lukastaegert)

#6523: Protect cc pin against renovate lock file maintenance (@lukastaegert)

#6525: docs: fix typos 'interations' and 'coresponding' (@haimingZZ)

#6526: fix(watch): prevent overlapping runs and other run lifecycle bugs (@lukastaegert)

4.63.4

2026-09-19

Bug Fixes

Ensure meta information of the cached module is exposed in shouldTransformCachedModule (#6442)

Do not create invalid code if import attribute values contain special characters (#6502)

Pull Requests

#6429: ci: collect Rust coverage from JS tests in dedicated job (@lukastaegert)

#6442: fix: expose cached module meta during cache checks (@ychampion, @lukastaegert)

#6496: docs: name the parameter runHook actually takes (@darkdi, @lukastaegert)

#6502: Escape quotes and backslashes in import attribute values (@dylanpulver, @lukastaegert)

#6517: Improve agent instructions (@lukastaegert)

... (truncated)

Commits

966ac85 4.63.6
cf36f1c Import external re-exports used by shared-chunk namespace objects (#6540)
5376264 Lock file maintenance (#6535)
299f95c Update dependency eslint-plugin-unicorn to v76 (#6529)
dd9c7d4 Lock file maintenance (#6530)
afdd518 Update minor/patch updates (#6527)
3722484 4.63.5
9156d5b fix(watch): prevent overlapping runs and other run lifecycle bugs (#6526)
87fbbf6 Protect cc pin against renovate lock file maintenance (#6523)
30f0442 docs: fix typos 'interations' and 'coresponding' (#6525)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for rollup since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates svgo from 3.3.2 to 3.3.5

Release notes

Sourced from svgo's releases.

v3.3.5

What's Changed

Security

Backport the removeScriptElement hardening from SVGO v4 in #2269:

reject executable data: URLs and legacy vbscript: URLs

sanitize executable HTML inside <foreignObject> elements

handle namespace-prefixed SVG anchors and URL schemes containing ASCII tabs or newlines

This addresses GHSA-4vpr-x523-8j87 and GHSA-w27v-7q3p-w38r for the v3 release line.

Support

SVGO v3 is not officially supported; please consider upgrading to SVGO v4. This security fix has been backported, but there is no commitment to backport more complex changes in the future.

See the migration guide from v3 to v4.

v3.3.4

What's Changed

Security

removeScriptElement, remove JavaScript URIs case-insensitively and make <script> handling namespace aware. By @SethFalco

Support

SVGO v3 is not officially supported, please consider upgrading to SVGO v4 instead. We've backported this fix as there are security implications, but there is no commitment to do this for more complex changes in future.

Consider reading our Migration Guide from v3 to v4 which should ease the process.

v3.3.3

What's Changed

Dependencies

Migrates from our unsupported fork of sax (@trysound/sax) to the upstream version of sax (sax).

Bug Fixes

No longer throws error when encountering comments in DTD.

Metrics

Before and after of the browser bundle of each respective version:

v3.3.2 v3.3.3 Delta

svgo.browser.js 910.9 kB 912.9 kB ⬆️ 2 kB

... (truncated)

Commits

4380590 ci: configure v3 publish tag in package metadata (#2271)
4c84fe7 ci: publish v3 with npm trusted publishing (#2270)
994a9f0 fix(removeScriptElement): backport security hardening to v3 (#2269)
72a2388 Merge commit from fork
bbab162 deps: upgrade to sax v1.5.0
See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for svgo since your current version.

Updates vite from 5.4.21 to 6.4.3

Release notes

Sourced from vite's releases.

v6.4.3

Please refer to CHANGELOG.md for details.

v6.4.2

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

6.4.3 (2026-06-01)

fix: backport #22572, reject windows alternate paths (#22576) (96b0c10), closes #22572 #22576

fix(deps): backport #22571, reject UNC paths for launch-editor-middleware (#22575) (8fed5cf), closes #22571 #22575

6.4.2 (2026-04-06)

fix: apply server.fs check to env transport (#22159) (#22163) (fe28e47), closes #22159 #22163

fix: avoid path traversal with optimize deps sourcemap handler (#22161) (ca4da5d), closes #22161

6.4.1 (2025-10-20)

fix(dev): trim trailing slash before server.fs.deny check (#20968) (#20969) (1114b5d), closes #20968 #20969

6.4.0 (2025-10-15)

feat: allow passing down resolved config to vite's createServer (#20932) (ca6455e), closes #20932

6.3.7 (2025-10-14)

fix(esbuild): inject esbuild helpers correctly for esbuild 0.25.9+ (#20940) (c59a222), closes #20940

6.3.6 (2025-09-08)

fix: apply fs.strict check to HTML files (#20736) (0ab19ea), closes #20736

fix: upgrade sirv to 3.0.2 (#20735) (e11d240), closes #20735

test: detect ts support via process.features (#20544) (7d99229), closes #20544

6.3.5 (2025-05-05)

fix(ssr): handle uninitialized export access as undefined (#19959) (fd38d07), closes #19959

6.3.4 (2025-04-30)

fix: check static serve file inside sirv (#19965) (c22c43d), closes #19965

fix(optimizer): return plain object when using require to import externals in optimized dependenci (

… updates Bumps the npm_and_yarn group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [fastify](https://github.com/fastify/fastify) | `5.5.0` | `5.8.3` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `5.4.21` | `6.4.2` | | @isaacs/brace-expansion | `5.0.0` | `5.0.1` | | [ajv](https://github.com/ajv-validator/ajv) | `6.12.6` | `6.14.0` | | [defu](https://github.com/unjs/defu) | `6.1.4` | `6.1.7` | | [flatted](https://github.com/WebReflection/flatted) | `3.1.1` | `3.4.2` | | [h3](https://github.com/h3js/h3) | `1.11.1` | `1.15.11` | | [node-forge](https://github.com/digitalbazaar/forge) | `1.3.2` | `1.4.0` | | [picomatch](https://github.com/micromatch/picomatch) | `2.3.1` | `2.3.2` | | [svgo](https://github.com/svg/svgo) | `3.3.2` | `3.3.3` | Bumps the npm_and_yarn group with 1 update in the /apps/website directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). Updates `fastify` from 5.5.0 to 5.8.3 - [Release notes](https://github.com/fastify/fastify/releases) - [Commits](fastify/fastify@v5.5.0...v5.8.3) Updates `vite` from 5.4.21 to 6.4.2 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v6.4.2/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v6.4.2/packages/vite) Updates `@isaacs/brace-expansion` from 5.0.0 to 5.0.1 Updates `ajv` from 6.12.6 to 6.14.0 - [Release notes](https://github.com/ajv-validator/ajv/releases) - [Commits](ajv-validator/ajv@v6.12.6...v6.14.0) Updates `defu` from 6.1.4 to 6.1.7 - [Release notes](https://github.com/unjs/defu/releases) - [Changelog](https://github.com/unjs/defu/blob/main/CHANGELOG.md) - [Commits](unjs/defu@v6.1.4...v6.1.7) Updates `flatted` from 3.1.1 to 3.4.2 - [Commits](WebReflection/flatted@v3.1.1...v3.4.2) Updates `h3` from 1.11.1 to 1.15.11 - [Release notes](https://github.com/h3js/h3/releases) - [Changelog](https://github.com/h3js/h3/blob/v1.15.11/CHANGELOG.md) - [Commits](h3js/h3@v1.11.1...v1.15.11) Updates `node-forge` from 1.3.2 to 1.4.0 - [Changelog](https://github.com/digitalbazaar/forge/blob/main/CHANGELOG.md) - [Commits](digitalbazaar/forge@v1.3.2...v1.4.0) Updates `picomatch` from 2.3.1 to 2.3.2 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@2.3.1...2.3.2) Updates `rollup` from 4.24.0 to 4.60.1 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md) - [Commits](rollup/rollup@v4.24.0...v4.60.1) Updates `svgo` from 3.3.2 to 3.3.3 - [Release notes](https://github.com/svg/svgo/releases) - [Commits](svg/svgo@v3.3.2...v3.3.3) Updates `vite` from 5.4.21 to 8.0.8 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v6.4.2/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v6.4.2/packages/vite) --- updated-dependencies: - dependency-name: fastify dependency-version: 5.8.3 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 6.4.2 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: "@isaacs/brace-expansion" dependency-version: 5.0.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ajv dependency-version: 6.14.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: defu dependency-version: 6.1.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: flatted dependency-version: 3.4.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: h3 dependency-version: 1.15.11 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: node-forge dependency-version: 1.4.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 2.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: rollup dependency-version: 4.60.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: svgo dependency-version: 3.3.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 8.0.8 dependency-type: direct:development dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

LironEr · 2026-10-01T12:42:21Z

@dependabot rebase

dependabot · 2026-10-01T12:42:26Z

Looks like this PR is already up-to-date with main! If you'd still like to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

LironEr · 2026-10-01T12:43:20Z

@dependabot recreate

dependabot · 2026-10-01T12:48:39Z

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

…pdates Bumps the npm_and_yarn group with 11 updates in the / directory: | Package | From | To | | --- | --- | --- | | [fastify](https://github.com/fastify/fastify) | `5.5.0` | `5.12.5` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `5.4.21` | `6.4.3` | | @isaacs/brace-expansion | `5.0.0` | `5.0.1` | | [ajv](https://github.com/ajv-validator/ajv) | `6.12.6` | `6.15.0` | | [defu](https://github.com/unjs/defu) | `6.1.4` | `6.1.7` | | [flatted](https://github.com/WebReflection/flatted) | `3.1.1` | `3.4.4` | | [h3](https://github.com/h3js/h3) | `1.11.1` | `1.15.11` | | [node-forge](https://github.com/digitalbazaar/forge) | `1.3.2` | `1.4.0` | | [picomatch](https://github.com/micromatch/picomatch) | `2.3.1` | `2.3.2` | | [rollup](https://github.com/rollup/rollup) | `4.24.0` | `4.63.6` | | [svgo](https://github.com/svg/svgo) | `3.3.2` | `3.3.5` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `5.4.21` | `6.4.3` | Updates `fastify` from 5.5.0 to 5.12.5 - [Release notes](https://github.com/fastify/fastify/releases) - [Commits](fastify/fastify@v5.5.0...v5.12.5) Updates `vite` from 5.4.21 to 6.4.3 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v6.4.3/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v6.4.3/packages/vite) Updates `@isaacs/brace-expansion` from 5.0.0 to 5.0.1 Updates `ajv` from 6.12.6 to 6.15.0 - [Release notes](https://github.com/ajv-validator/ajv/releases) - [Commits](ajv-validator/ajv@v6.12.6...v6.15.0) Updates `defu` from 6.1.4 to 6.1.7 - [Release notes](https://github.com/unjs/defu/releases) - [Changelog](https://github.com/unjs/defu/blob/main/CHANGELOG.md) - [Commits](unjs/defu@v6.1.4...v6.1.7) Updates `flatted` from 3.1.1 to 3.4.4 - [Commits](WebReflection/flatted@v3.1.1...v3.4.4) Updates `h3` from 1.11.1 to 1.15.11 - [Release notes](https://github.com/h3js/h3/releases) - [Changelog](https://github.com/h3js/h3/blob/v1.15.11/CHANGELOG.md) - [Commits](h3js/h3@v1.11.1...v1.15.11) Updates `node-forge` from 1.3.2 to 1.4.0 - [Changelog](https://github.com/digitalbazaar/forge/blob/main/CHANGELOG.md) - [Commits](digitalbazaar/forge@v1.3.2...v1.4.0) Updates `picomatch` from 2.3.1 to 2.3.2 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@2.3.1...2.3.2) Updates `rollup` from 4.24.0 to 4.63.6 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md) - [Commits](rollup/rollup@v4.24.0...v4.63.6) Updates `svgo` from 3.3.2 to 3.3.5 - [Release notes](https://github.com/svg/svgo/releases) - [Commits](svg/svgo@v3.3.2...v3.3.5) Updates `vite` from 5.4.21 to 6.4.3 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v6.4.3/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v6.4.3/packages/vite) --- updated-dependencies: - dependency-name: "@isaacs/brace-expansion" dependency-version: 5.0.1 dependency-type: indirect - dependency-name: ajv dependency-version: 6.14.0 dependency-type: indirect - dependency-name: defu dependency-version: 6.1.7 dependency-type: indirect - dependency-name: fastify dependency-version: 5.8.3 dependency-type: direct:production - dependency-name: flatted dependency-version: 3.4.2 dependency-type: indirect - dependency-name: h3 dependency-version: 1.15.11 dependency-type: indirect - dependency-name: node-forge dependency-version: 1.4.0 dependency-type: indirect - dependency-name: picomatch dependency-version: 2.3.2 dependency-type: indirect - dependency-name: rollup dependency-version: 4.60.1 dependency-type: indirect - dependency-name: svgo dependency-version: 3.3.3 dependency-type: indirect - dependency-name: vite dependency-version: 6.4.2 dependency-type: direct:development - dependency-name: vite dependency-version: 8.0.8 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>

…ps://github.com/LironEr/bundlemon into dependabot/npm_and_yarn/npm_and_yarn-9039f54258 # Conflicts: # apps/service/package.json # apps/website/package.json # yarn.lock

bundlemon · 2026-10-01T13:00:09Z

BundleMon

Files added (20)

Status	Path	Size	Limits
✅	JS files _{assets/ReportsChart-(hash).js}	+361.22KB	-
✅	JS files _{assets/bytes-(hash).js}	+273.41KB	-
✅	JS files _{assets/Table-(hash).js}	+240.75KB	-
✅	assets/Main-index-(hash).js	+169.92KB	-
✅	JS files _{assets/TextField-(hash).js}	+44.67KB	-
✅	JS files _{assets/Tabs-(hash).js}	+37.28KB	-
✅	JS files _{assets/ReportsPage-(hash).js}	+33.56KB	-
✅	JS files _{assets/Popover-(hash).js}	+25.33KB	-
✅	JS files _{assets/ReportPage-(hash).js}	+8.7KB	-
✅	JS files _{assets/Alert-(hash).js}	+6.07KB	-
✅	JS files _{assets/utils-(hash).js}	+5.85KB	-
✅	JS files _{assets/LoadingButton-(hash).js}	+3.58KB	-
✅	JS files _{assets/CircularProgress-(hash).js}	+3.03KB	-
✅	JS files _{assets/CreateProjectPage-(hash).js}	+1.48KB	-
✅	JS files _{assets/LoginPage-(hash).js}	+1.35KB	-
✅	index.html	+1.17KB	-
✅	JS files _{assets/rolldown-(hash).js}	+901B	-
✅	JS files _{assets/AlertTitle-(hash).js}	+876B	-
✅	JS files _{assets/createSvgIcon-(hash).js}	+282B	-
✅	JS files _{assets/useQueryParams-(hash).js}	+107B	-

Total files change +1.19MB

Groups added (1)

Status	Path	Size	Limits
✅	JS files _*/.js	+1.19MB	-

Final result: ✅

View report in BundleMon website ➡️

Current branch size history

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 10, 2026

dependabot Bot mentioned this pull request Apr 10, 2026

chore(deps): bump h3 from 1.11.1 to 1.15.5 in the npm_and_yarn group across 1 directory #260

Closed

LironEr closed this Oct 1, 2026

LironEr reopened this Oct 1, 2026

dependabot Bot changed the title ~~chore(deps): bump the npm_and_yarn group across 2 directories with 11 updates~~ chore(deps): bump the npm_and_yarn group across 1 directory with 11 updates Oct 1, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/npm_and_yarn-9039f54258 branch from 4cb457d to 52d9ad3 Compare October 1, 2026 12:48

LironEr added 2 commits October 1, 2026 14:57

fix

7ffa3ef

Merge branch 'dependabot/npm_and_yarn/npm_and_yarn-9039f54258' of htt…

4e68cdf

…ps://github.com/LironEr/bundlemon into dependabot/npm_and_yarn/npm_and_yarn-9039f54258 # Conflicts: # apps/service/package.json # apps/website/package.json # yarn.lock

fix tests

bba26cb

LironEr merged commit 9b4ab27 into main Oct 1, 2026
10 checks passed

LironEr deleted the dependabot/npm_and_yarn/npm_and_yarn-9039f54258 branch October 1, 2026 19:49

Navigation Menu

Uh oh!

chore(deps): bump the npm_and_yarn group across 1 directory with 11 updates - #261

chore(deps): bump the npm_and_yarn group across 1 directory with 11 updates#261
LironEr merged 5 commits into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-9039f54258

dependabot Bot commented on behalf of github Apr 10, 2026 •

edited

Loading

Uh oh!

LironEr commented Oct 1, 2026

Uh oh!

dependabot Bot commented on behalf of github Oct 1, 2026

Uh oh!

LironEr commented Oct 1, 2026

Uh oh!

dependabot Bot commented on behalf of github Oct 1, 2026

Uh oh!

bundlemon Bot commented Oct 1, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Apr 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v5.12.5

⚠️ Security release

What's Changed

v5.12.4

v5.12.2

⚠️ Security release

What's Changed

v5.12.1

⚠️ Security release

What's Changed

v5.12.0

What's Changed

v6.4.3

v6.4.2

6.4.3 (2026-06-01)

6.4.2 (2026-04-06)

6.4.1 (2025-10-20)

6.4.0 (2025-10-15)

6.3.7 (2025-10-14)

6.3.6 (2025-09-08)

6.3.5 (2025-05-05)

6.3.4 (2025-04-30)

v6.1.7

📦 Build

❤️ Contributors

v6.1.6

📦 Build

v6.1.5

🩹 Fixes

✅ Tests

❤️ Contributors

v6.1.7

🩹 Fixes

📦 Build

❤️ Contributors

v6.1.6

📦 Build

❤️ Contributors

v6.1.5

🩹 Fixes

🏡 Chore

✅ Tests

🤖 CI

v1.15.11

🏡 Chore

v1.15.10

🩹 Fixes

❤️ Contributors

v1.15.9

🩹 Fixes

v1.15.8

🩹 Fixes

v1.15.7

🩹 Fixes

💅 Refactors

❤️ Contributors

v1.15.11

🏡 Chore

❤️ Contributors

v1.15.10

🩹 Fixes

🏡 Chore

❤️ Contributors

v1.15.9

🩹 Fixes

🏡 Chore

❤️ Contributors

1.4.0 - 2026-03-24

Security

2.3.2

What's Changed

2.3.2 (2026-03-23)

Fixed

Security

v4.63.6

4.63.6

dependabot Bot commented on behalf of github Apr 10, 2026 •

edited

Loading

bundlemon Bot commented Oct 1, 2026 •

edited

Loading