Skip to content

chore(deps): bump the minor-and-patch group with 8 updates - #2

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-5a8fc4c452
Closed

chore(deps): bump the minor-and-patch group with 8 updates#2
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-5a8fc4c452

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 8 updates:

Package From To
async 3.2.3 3.2.6
cors 2.8.5 2.8.6
fs-extra 11.2.0 11.4.1
jsonwebtoken 9.0.2 9.0.3
lodash 4.17.21 4.18.1
morgan 1.10.0 1.12.1
nodemon 3.1.0 3.1.14
standard-version 9.3.2 9.5.0

Updates async from 3.2.3 to 3.2.6

Changelog

Sourced from async's changelog.

v3.2.6

  • Fix ReDoS vulnerability in autoInject (#1980)

v3.2.5

  • Ensure Error objects such as AggregateError are propagated without modification (#1920)

v3.2.4

  • Fix a bug in priorityQueue where it didn't wait for the result. (#1725)
  • Fix a bug where unshiftAsync was included in priorityQueue. (#1790)
Commits
  • 85fb18f Version 3.2.6
  • 8c0c941 Update built files
  • 5f756b4 Fix ReDoS (#1980)
  • 39cdc9b build(deps-dev): bump karma from 6.4.3 to 6.4.4 (#1985)
  • 7b8ddeb build(deps-dev): bump @​babel/core from 7.24.7 to 7.25.2 (#1981)
  • 4634a9d build(deps-dev): bump rollup from 4.18.0 to 4.19.2 (#1982)
  • afb176c build(deps-dev): bump chai from 4.4.1 to 4.5.0 (#1983)
  • 3568a74 build(deps-dev): bump @​babel/eslint-parser from 7.24.7 to 7.25.1 (#1984)
  • 9e885fd build(deps-dev): bump babel-plugin-istanbul from 6.1.1 to 7.0.0 (#1986)
  • f9c7f2a build(deps-dev): bump semver from 7.6.2 to 7.6.3 (#1987)
  • Additional commits viewable in compare view

Updates cors from 2.8.5 to 2.8.6

Release notes

Sourced from cors's releases.

v2.8.6

What's Changed

New Contributors

... (truncated)

Changelog

Sourced from cors's changelog.

2.8.6 / 2026-01-22

  • Improve documentation (API, context, examples...)
  • Remove additional markdown files from tarball
Commits
Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for cors since your current version.


Updates fs-extra from 11.2.0 to 11.4.1

Changelog

Sourced from fs-extra's changelog.

11.4.1 / 2026-09-22

  • Properly handle read errors (e.g. due to permissions) in emptyDir*() (#1080)
  • Allow renaming with only Unicode normalization difference in the filename (APFS-specific) (#859, #1079)

11.4.0 / 2026-07-23

  • Proper EEXIST error when trying to create a symlink and the dest already exists as a broken symlink (#925, #1076)

11.3.6 / 2026-06-29

  • Fix handling of symlinked destination ancestors in copy/move methods (#1071, #1073)
  • Docs typo fixed (#1074)

11.3.5 / 2026-05-06

  • Fix ensureLink*/ensureSymlink* identical file detection on Windows (#1068)
  • Fix error handling in timestamp preservation code (#1065, #1069)
  • Fix potential file descriptor leak on error in synchronous timestamp preservation code (#1066)

11.3.4 / 2026-03-03

  • Fix bug where calling ensureSymlink/ensureSymlinkSync with a relative srcPath would fail if the symlink already existed (#1038, #1064)

11.3.3 / 2025-12-18

  • Fix copying symlink when destination is a symlink to the same target (#1019, #1060)

11.3.2 / 2025-09-15

  • Fix spurrious UnhandledPromiseRejectionWarning that could occur when calling .copy() in some cases (#1056, #1058)

11.3.1 / 2025-08-05

  • Fix case where move/moveSync could incorrectly think files are identical on Windows (#1050)

11.3.0 / 2025-01-15

  • Add promise support for newer fs methods (#1044, #1045)
  • Use fs.opendir in copy()/copySync() for better perf/scalability (#972, #1028)
Commits

Updates jsonwebtoken from 9.0.2 to 9.0.3

Changelog

Sourced from jsonwebtoken's changelog.

9.0.3 - 2025-12-04

  • updates jws version to 4.0.1.
Commits

Updates lodash from 4.17.21 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

  • Add security notice for _.template in threat model and API docs (#6099)
  • Document lower > upper behavior in _.random (#6115)
  • Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

Commits
  • cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
  • 75535f5 chore: prune stale advisory refs (#6170)
  • 62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
  • 59be2de release(minor): bump to 4.18.0 (#6161)
  • af63457 fix: broken tests for _.template 879aaa9
  • 1073a76 fix: linting issues
  • 879aaa9 fix: validate imports keys in _.template
  • fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
  • 18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
  • b819080 ci: add dist sync validation workflow (#6137)
  • Additional commits viewable in compare view

Updates morgan from 1.10.0 to 1.12.1

Release notes

Sourced from morgan's releases.

1.12.1

Important

What's Changed

New Contributors

Full Changelog: expressjs/morgan@1.12.0...1.12.1

1.12.0

What's Changed

New Contributors

Full Changelog: expressjs/morgan@1.11.0...1.12.0

1.11.0

What's Changed

Security Fix:

New Contributors

... (truncated)

Changelog

Sourced from morgan's changelog.

1.12.1

1.12.0

  • Security fix for CVE-2026-15603(GHSA-jxfw-x594-9x9m)
  • Allow format functions to return objects for streams in objectMode
  • Respect the NO_COLOR environment variable in the dev format

1.11.0

  • add :pid token

Security Fix:

1.10.1

Commits
  • b1272e7 1.12.1 (#386)
  • 4b695ed fix: escape double quotes in log fields
  • 0f74eca build(deps): bump github/codeql-action/analyze from 4.37.4 to 4.37.9 (#384)
  • e399e3c build(deps): bump github/codeql-action/init from 4.37.4 to 4.37.9 (#383)
  • 1e86b34 build(deps): bump github/codeql-action/autobuild from 4.37.4 to 4.37.9 (#382)
  • 87c0afd build(deps): bump github/codeql-action/upload-sarif to 4.37.9 (#381)
  • 286b000 test: run CI on Windows and macOS (#379)
  • 5a5902a docs: fix typos across documentation (#378)
  • 063f084 1.12.0 (#376)
  • fbf9383 fix: escape all token values in log output
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for morgan since your current version.


Updates nodemon from 3.1.0 to 3.1.14

Release notes

Sourced from nodemon's releases.

v3.1.14

3.1.14 (2026-02-20)

Bug Fixes

v3.1.13

3.1.13 (2026-02-19)

Bug Fixes

  • TypeScript definition for 'restart' args (5c03715), closes #2265

v3.1.12

3.1.12 (2026-02-19)

Bug Fixes

v3.1.11

3.1.11 (2025-11-11)

Bug Fixes

v3.1.10

3.1.10 (2025-04-23)

Bug Fixes

v3.1.9

3.1.9 (2024-12-13)

Bug Fixes

  • maintain backward support for exitcrash (9c9de6e)

v3.1.8

3.1.8 (2024-12-13)

... (truncated)

Commits
  • cfebe2f fix: get watch working on windows
  • f34bfa9 chore: fix release to run after tests
  • 5c03715 fix: TypeScript definition for 'restart' args
  • 28de4b7 chore: semver-release wanted 22-24 🤦
  • 6217164 chore: move release workflow to node 20
  • 2c458de chore: bump semver-release + update workflow
  • 9376af3 fix: bump minimatch
  • e045423 chore: website
  • f7a4edd chore: website
  • f26223f chore: website
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nodemon since your current version.


Updates standard-version from 9.3.2 to 9.5.0

Release notes

Sourced from standard-version's releases.

v9.5.0

9.5.0 (2022-05-15)

Features

Bug Fixes

  • deps: update dependency conventional-changelog to v3.1.25 (#865) (4c938a2)
  • deps: update dependency conventional-changelog-conventionalcommits to v4.6.3 (#866) (6c75ed0)

v9.4.0

9.4.0 (2021-12-31)

Features

Bug Fixes

  • Ensures provided packageFiles arguments are merged with bumpFiles when no bumpFiles argument is specified (default). (#534) (2785023), closes #533
Changelog

Sourced from standard-version's changelog.

9.5.0 (2022-05-15)

Features

Bug Fixes

  • deps: update dependency conventional-changelog to v3.1.25 (#865) (4c938a2)
  • deps: update dependency conventional-changelog-conventionalcommits to v4.6.3 (#866) (6c75ed0)

9.4.0 (2021-12-31)

Features

Bug Fixes

  • Ensures provided packageFiles arguments are merged with bumpFiles when no bumpFiles argument is specified (default). (#534) (2785023), closes #533
Commits
  • 017dcb6 chore(master): release 9.5.0 (#867)
  • 61b41fa feat(deprecated): add deprecation message (#907)
  • 6c75ed0 fix(deps): update dependency conventional-changelog-conventionalcommits to v4...
  • 4c938a2 fix(deps): update dependency conventional-changelog to v3.1.25 (#865)
  • fd05681 chore(master): release 9.4.0 (#864)
  • e510623 build: run tests on label
  • eceaedf feat: add .cjs config file (#717)
  • 366a498 build: update publish configuration
  • 095e1eb test: updates .gitignore test to check against a default package and bump fil...
  • fb3f3fa chore: Move to native fs.access, removes fs-access package. (#840)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by oss-bot, a new releaser for standard-version since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the minor-and-patch group with 8 updates
bf8b812 
Bumps the minor-and-patch group with 8 updates:

| Package | From | To |
| --- | --- | --- |
| [async](https://github.com/caolan/async) | `3.2.3` | `3.2.6` |
| [cors](https://github.com/expressjs/cors) | `2.8.5` | `2.8.6` |
| [fs-extra](https://github.com/jprichardson/node-fs-extra) | `11.2.0` | `11.4.1` |
| [jsonwebtoken](https://github.com/auth0/node-jsonwebtoken) | `9.0.2` | `9.0.3` |
| [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.18.1` |
| [morgan](https://github.com/expressjs/morgan) | `1.10.0` | `1.12.1` |
| [nodemon](https://github.com/remy/nodemon) | `3.1.0` | `3.1.14` |
| [standard-version](https://github.com/conventional-changelog/standard-version) | `9.3.2` | `9.5.0` |


Updates `async` from 3.2.3 to 3.2.6
- [Release notes](https://github.com/caolan/async/releases)
- [Changelog](https://github.com/caolan/async/blob/master/CHANGELOG.md)
- [Commits](caolan/async@v3.2.3...v3.2.6)

Updates `cors` from 2.8.5 to 2.8.6
- [Release notes](https://github.com/expressjs/cors/releases)
- [Changelog](https://github.com/expressjs/cors/blob/master/HISTORY.md)
- [Commits](expressjs/cors@v2.8.5...v2.8.6)

Updates `fs-extra` from 11.2.0 to 11.4.1
- [Changelog](https://github.com/jprichardson/node-fs-extra/blob/master/CHANGELOG.md)
- [Commits](jprichardson/node-fs-extra@11.2.0...11.4.1)

Updates `jsonwebtoken` from 9.0.2 to 9.0.3
- [Changelog](https://github.com/auth0/node-jsonwebtoken/blob/master/CHANGELOG.md)
- [Commits](auth0/node-jsonwebtoken@v9.0.2...v9.0.3)

Updates `lodash` from 4.17.21 to 4.18.1
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.18.1)

Updates `morgan` from 1.10.0 to 1.12.1
- [Release notes](https://github.com/expressjs/morgan/releases)
- [Changelog](https://github.com/expressjs/morgan/blob/master/HISTORY.md)
- [Commits](expressjs/morgan@1.10.0...1.12.1)

Updates `nodemon` from 3.1.0 to 3.1.14
- [Release notes](https://github.com/remy/nodemon/releases)
- [Commits](remy/nodemon@v3.1.0...v3.1.14)

Updates `standard-version` from 9.3.2 to 9.5.0
- [Release notes](https://github.com/conventional-changelog/standard-version/releases)
- [Changelog](https://github.com/conventional-changelog/standard-version/blob/master/CHANGELOG.md)
- [Commits](conventional-changelog/standard-version@v9.3.2...v9.5.0)

---
updated-dependencies:
- dependency-name: async
  dependency-version: 3.2.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: cors
  dependency-version: 2.8.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: fs-extra
  dependency-version: 11.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: jsonwebtoken
  dependency-version: 9.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: morgan
  dependency-version: 1.12.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: nodemon
  dependency-version: 3.1.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: standard-version
  dependency-version: 9.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 3, 2026
@dependabot @github

dependabot Bot commented on behalf of github Nov 3, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are no longer updatable, so this is no longer needed.

@dependabot dependabot Bot closed this Nov 3, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/minor-and-patch-5a8fc4c452 branch November 3, 2026 14:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants