Skip to content

Comments

chore(deps): bump the npm_and_yarn group across 2 directories with 15 updates#29

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm_and_yarn-d63c44299a
Open

chore(deps): bump the npm_and_yarn group across 2 directories with 15 updates#29
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm_and_yarn-d63c44299a

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Feb 21, 2026

Bumps the npm_and_yarn group with 12 updates in the / directory:

Package From To
react-router 6.30.1 6.30.2
@backstage/backend-defaults 0.6.2 0.15.2
qs 6.14.0 6.14.2
@backstage/cli-common 0.1.15 0.1.18
@backstage/plugin-techdocs-node 1.13.10 1.14.2
@smithy/config-resolver 4.3.2 4.4.6
diff 4.0.2 4.0.4
js-yaml 3.14.1 3.14.2
jws 3.2.2 3.2.3
lodash 4.17.21 4.17.23
node-forge 1.3.1 1.3.3
vm2 3.10.0 3.10.5

Bumps the npm_and_yarn group with 1 update in the /plugins/stack-overflow-teams-backend directory: @backstage/backend-defaults.

Updates react-router from 6.30.1 to 6.30.2

Release notes

Sourced from react-router's releases.

v6.30.2

See the changelog for release notes: https://github.com/remix-run/react-router/blob/v6/CHANGELOG.md#v6302

Changelog

Sourced from react-router's changelog.

v6.30.2

Date: 2025-11-13

Security Notice

This release addresses 1 security vulnerability:

Patch Changes

  • Normalize double-slashes in resolvePath (#14537)

Full Changelog: v6.30.1...v6.30.2

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for react-router since your current version.


Updates @backstage/backend-defaults from 0.6.2 to 0.15.2

Changelog

Sourced from @​backstage/backend-defaults's changelog.

0.15.2

Patch Changes

  • 7455dae: Use node prefix on native imports
  • 44f5d04: Minor internal restructure of the postgres config loading code
  • 4fc7bf0: Bump to tar v7
  • 5dd683f: createRateLimitMiddleware is now exported from @backstage/backend-defaults/httpRouter
  • 8dd518a: Support connection.type: azure in database client to use Microsoft Entra authentication with Azure database for PostgreSQL
  • 69d880e: Bump to latest zod to ensure it has the latest features
  • Updated dependencies
    • @​backstage/backend-app-api@​1.5.0
    • @​backstage/integration@​1.20.0
    • @​backstage/integration-aws-node@​0.1.20
    • @​backstage/backend-plugin-api@​1.7.0
    • @​backstage/backend-dev-utils@​0.1.7
    • @​backstage/config-loader@​1.10.8
    • @​backstage/cli-node@​0.2.18
    • @​backstage/plugin-auth-node@​0.6.13
    • @​backstage/plugin-permission-node@​0.10.10
    • @​backstage/plugin-events-node@​0.4.19

0.15.2-next.1

Patch Changes

  • 8dd518a: Support connection.type: azure in database client to use Microsoft Entra authentication with Azure database for PostgreSQL
  • Updated dependencies
    • @​backstage/integration@​1.20.0-next.1
    • @​backstage/cli-node@​0.2.18-next.1
    • @​backstage/backend-plugin-api@​1.7.0-next.1

0.15.1-next.0

Patch Changes

  • 7455dae: Use node prefix on native imports
  • 44f5d04: Minor internal restructure of the postgres config loading code
  • 4fc7bf0: Bump to tar v7
  • 69d880e: Bump to latest zod to ensure it has the latest features
  • Updated dependencies
    • @​backstage/integration-aws-node@​0.1.20-next.0
    • @​backstage/backend-plugin-api@​1.7.0-next.0
    • @​backstage/backend-dev-utils@​0.1.7-next.0
    • @​backstage/config-loader@​1.10.8-next.0
    • @​backstage/integration@​1.19.3-next.0
    • @​backstage/cli-node@​0.2.17-next.0
    • @​backstage/plugin-auth-node@​0.6.12-next.0
    • @​backstage/backend-app-api@​1.5.0-next.0
    • @​backstage/plugin-permission-node@​0.10.9-next.0

... (truncated)

Commits

Updates qs from 6.14.0 to 6.14.2

Changelog

Sourced from qs's changelog.

6.14.2

  • [Fix] parse: mark overflow objects for indexed notation exceeding arrayLimit (#546)
  • [Fix] arrayLimit means max count, not max index, in combine/merge/parseArrayValue
  • [Fix] parse: throw on arrayLimit exceeded with indexed notation when throwOnLimitExceeded is true (#529)
  • [Fix] parse: enforce arrayLimit on comma-parsed values
  • [Fix] parse: fix error message to reflect arrayLimit as max index; remove extraneous comments (#545)
  • [Robustness] avoid .push, use void
  • [readme] document that addQueryPrefix does not add ? to empty output (#418)
  • [readme] clarify parseArrays and arrayLimit documentation (#543)
  • [readme] replace runkit CI badge with shields.io check-runs badge
  • [meta] fix changelog typo (arrayLength → arrayLimit)
  • [actions] fix rebase workflow permissions

6.14.1

  • [Fix] ensure arrayLimit applies to [] notation as well
  • [Fix] parse: when a custom decoder returns null for a key, ignore that key
  • [Refactor] parse: extract key segment splitting helper
  • [meta] add threat model
  • [actions] add workflow permissions
  • [Tests] stringify: increase coverage
  • [Dev Deps] update eslint, @ljharb/eslint-config, npmignore, es-value-fixtures, for-each, object-inspect
Commits
  • bdcf0c7 v6.14.2
  • 294db90 [readme] document that addQueryPrefix does not add ? to empty output
  • 5c308e5 [readme] clarify parseArrays and arrayLimit documentation
  • 6addf8c [Fix] parse: mark overflow objects for indexed notation exceeding arrayLimit
  • cfc108f [Fix] arrayLimit means max count, not max index, in combine/merge/`pars...
  • febb644 [Fix] parse: throw on arrayLimit exceeded with indexed notation when `thr...
  • f6a7abf [Fix] parse: enforce arrayLimit on comma-parsed values
  • fbc5206 [Fix] parse: fix error message to reflect arrayLimit as max index; remove e...
  • 1b9a8b4 [actions] fix rebase workflow permissions
  • 2a35775 [meta] fix changelog typo (arrayLength → arrayLimit)
  • Additional commits viewable in compare view

Updates @backstage/cli-common from 0.1.15 to 0.1.18

Changelog

Sourced from @​backstage/cli-common's changelog.

0.1.18

Patch Changes

  • 7455dae: Use node prefix on native imports

0.1.18-next.0

Patch Changes

  • 7455dae: Use node prefix on native imports
  • Updated dependencies
    • @​backstage/errors@​1.2.7

0.1.17

Patch Changes

  • ae4dd5d: Move some of the symlink resolution to isChildPath

0.1.16

Patch Changes

  • 5cfb2a4: Added new run, runOutput, and runCheck utilities to help run child processes in a safe and portable way.
  • c8c2329: Add proxy configuration from env-vars to create-app tasks
  • 2bae83a: Bumped dev dependencies @types/node

0.1.16-next.2

Patch Changes

  • 2bae83a: Bumped dev dependencies @types/node
  • Updated dependencies
    • @​backstage/errors@​1.2.7

0.1.16-next.1

Patch Changes

  • 5cfb2a4: Added new run, runOutput, and runCheck utilities to help run child processes in a safe and portable way.

0.1.16-next.0

Patch Changes

  • c8c2329: Add proxy configuration from env-vars to create-app tasks
Commits

Updates @backstage/plugin-techdocs-node from 1.13.10 to 1.14.2

Changelog

Sourced from @​backstage/plugin-techdocs-node's changelog.

1.14.2

Patch Changes

  • 7455dae: Use node prefix on native imports
  • 3c455d4: Some security fixes
  • Updated dependencies
    • @​backstage/integration@​1.20.0
    • @​backstage/integration-aws-node@​0.1.20
    • @​backstage/backend-plugin-api@​1.7.0
    • @​backstage/plugin-search-common@​1.2.22

1.14.2-next.1

Patch Changes

  • 3c455d4: Some security fixes
  • Updated dependencies
    • @​backstage/integration@​1.20.0-next.1
    • @​backstage/backend-plugin-api@​1.7.0-next.1

1.14.1-next.0

Patch Changes

  • 7455dae: Use node prefix on native imports
  • Updated dependencies
    • @​backstage/integration-aws-node@​0.1.20-next.0
    • @​backstage/backend-plugin-api@​1.7.0-next.0
    • @​backstage/plugin-search-common@​1.2.22-next.0
    • @​backstage/integration@​1.19.3-next.0
    • @​backstage/catalog-model@​1.7.6
    • @​backstage/config@​1.3.6
    • @​backstage/errors@​1.2.7
    • @​backstage/plugin-techdocs-common@​0.1.1

1.14.0

Minor Changes

  • 63c459c: BREAKING: It's now possible to use the credentials from the integrations.awsS3 config to authenticate with AWS S3. The new priority is:

    1. aws.accounts
    2. techdocs.publisher.awsS3.credentials
    3. integrations.awsS3
    4. Default credential chain

    In case of multiple integrations.awsS3 are present, the target integration is determined by the accessKeyId in techdocs.publisher.awsS3.credentials if provided. Otherwise, the default credential chain is used.

    This means that depending on your setup, this feature may break your existing setup.

... (truncated)

Commits

Updates @smithy/config-resolver from 4.3.2 to 4.4.6

Release notes

Sourced from @​smithy/config-resolver's releases.

@​smithy/util-defaults-mode-browser@​4.3.32

Patch Changes

  • @​smithy/smithy-client@​4.11.5

@​smithy/middleware-compression@​4.3.31

Patch Changes

  • Updated dependencies [c5db01c]
    • @​smithy/core@​3.23.2

@​smithy/util-defaults-mode-browser@​4.3.31

Patch Changes

  • @​smithy/smithy-client@​4.11.4

@​smithy/util-defaults-mode-browser@​4.3.30

Patch Changes

  • @​smithy/smithy-client@​4.11.3

@​smithy/middleware-compression@​4.3.30

Patch Changes

  • Updated dependencies [6f96c01]
    • @​smithy/core@​3.23.1

@​smithy/util-defaults-mode-browser@​4.3.29

Patch Changes

  • @​smithy/smithy-client@​4.11.2

@​smithy/middleware-compression@​4.3.29

Patch Changes

  • Updated dependencies [4f05c6a]
    • @​smithy/core@​3.23.0

@​smithy/util-defaults-mode-browser@​4.3.28

Patch Changes

  • @​smithy/smithy-client@​4.11.1

@​smithy/middleware-compression@​4.3.28

Patch Changes

  • @​smithy/core@​3.22.1

@​smithy/middleware-compression@​4.3.27

Patch Changes

... (truncated)

Changelog

Sourced from @​smithy/config-resolver's changelog.

4.4.6

Patch Changes

  • Updated dependencies [745867a]
    • @​smithy/types@​4.12.0
    • @​smithy/node-config-provider@​4.3.8
    • @​smithy/util-endpoints@​3.2.8
    • @​smithy/util-middleware@​4.2.8

4.4.5

Patch Changes

  • Updated dependencies [9ccb841]
    • @​smithy/types@​4.11.0
    • @​smithy/node-config-provider@​4.3.7
    • @​smithy/util-endpoints@​3.2.7
    • @​smithy/util-middleware@​4.2.7

4.4.4

Patch Changes

  • Updated dependencies [5a56762]
    • @​smithy/types@​4.10.0
    • @​smithy/node-config-provider@​4.3.6
    • @​smithy/util-endpoints@​3.2.6
    • @​smithy/util-middleware@​4.2.6

4.4.3

Patch Changes

  • Updated dependencies [3926fd7]
    • @​smithy/types@​4.9.0
    • @​smithy/node-config-provider@​4.3.5
    • @​smithy/util-endpoints@​3.2.5
    • @​smithy/util-middleware@​4.2.5

4.4.2

Patch Changes

  • 372b46f: allow * region with warning

4.4.1

Patch Changes

... (truncated)

Commits

Updates diff from 4.0.2 to 4.0.4

Changelog

Sourced from diff's changelog.

v4.0.4 - January 2026

Only change from 4.0.2 is a backport of the fix to GHSA-73rr-hh4g-fpgx.

v4.0.3 (deprecated)

Accidental release - do not use.

Commits
Maintainer changes

This version was pushed to npm by explodingcabbage, a new releaser for diff since your current version.


Updates form-data from 2.3.3 to 2.5.5

Release notes

Sourced from form-data's releases.

v2.5.2

Fixes

  • Buffer.from and Buffer.alloc require node 4+
  • npmignore temporary build files (#532)
  • move util.isArray to Array.isArray (#564)

Tests

  • migrate from travis to GHA

Dev Improvements

  • Fixed error in the documentations as indicated in #439
  • Added remaining combined-stream options to typedef
  • Bumped rimraf to 2.7.1 (dev-dep)
  • Added constructor options to TypeScript defs
  • Fixed error in callback signatures

Added Types

  • Added TS types
  • Improved documentation

Added getBuffer method

Updated test builds to support node10 and 12.

Changelog

Sourced from form-data's changelog.

v2.5.5 - 2025-07-18

Commits

  • [meta] actually ensure the readme backup isn’t published 10626c0
  • [Fix] use proper dependency 026abe5

v2.5.4 - 2025-07-17

Fixed

Commits

  • [eslint] update linting config 8bf2492
  • [meta] add auto-changelog b5101ad
  • [Tests] handle predict-v8-randomness failures in node < 17 and node > 23 0e93122
  • [Fix] Switch to using crypto random for boundary values b88316c
  • [Fix] validate boundary type in setBoundary() method 131ae5e
  • [Tests] Switch to newer v8 prediction library; enable node 24 testing c97cfbe
  • [Refactor] use hasown 97ac9c2
  • [meta] remove local commit hooks be99d4e
  • [Dev Deps] remove unused deps ddbc89b
  • [meta] fix scripts to use prepublishOnly e351a97
  • [Dev Deps] remove unused script 8f23366
  • [Dev Deps] add missing peer dep 02ff026
  • [meta] fix readme capitalization 2fd5f61

v2.5.3 - 2025-02-14

Merged

Fixed

Commits

  • [Refactor] use Object.prototype.hasOwnProperty.call 6e682d4
  • [Dev Deps] update @types/node, browserify, coveralls, eslint, formidable, in-publish, phantomjs-prebuilt, pkgfiles, pre-commit, request, tape, typescript 819f6b7
  • Only apps should have lockfiles b170ee2
  • [Deps] update combined-stream, mime-types 6b1ca1d
  • Bumped version 2.5.3 9457283
  • [Dev Deps] pin request which via tough-cookie ^2.4 depends on psl 9dbe192

v2.5.2 - 2024-10-10

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by ljharb, a new releaser for form-data since your current version.

Install script changes

This version modifies prepublish script that runs during installation. Review the package contents before updating.


Updates js-yaml from 3.14.1 to 3.14.2

Changelog

Sourced from js-yaml's changelog.

[3.14.2] - 2025-11-15

Security

  • Backported v4.1.1 fix to v3

[4.1.1] - 2025-11-12

Security

  • Fix prototype pollution issue in yaml merge (<<) operator.

[4.1.0] - 2021-04-15

Added

  • Types are now exported as yaml.types.XXX.
  • Every type now has options property with original arguments kept as they were (see yaml.types.int.options as an example).

Changed

  • Schema.extend() now keeps old type order in case of conflicts (e.g. Schema.extend([ a, b, c ]).extend([ b, a, d ]) is now ordered as abcd instead of cbad).

[4.0.0] - 2021-01-03

Changed

  • Check migration guide to see details for all breaking changes.
  • Breaking: "unsafe" tags !!js/function, !!js/regexp, !!js/undefined are moved to js-yaml-js-types package.
  • Breaking: removed safe* functions. Use load, loadAll, dump instead which are all now safe by default.
  • yaml.DEFAULT_SAFE_SCHEMA and yaml.DEFAULT_FULL_SCHEMA are removed, use yaml.DEFAULT_SCHEMA instead.
  • yaml.Schema.create(schema, tags) is removed, use schema.extend(tags) instead.
  • !!binary now always mapped to Uint8Array on load.
  • Reduced nesting of /lib folder.
  • Parse numbers according to YAML 1.2 instead of YAML 1.1 (01234 is now decimal, 0o1234 is octal, 1:23 is parsed as string instead of base60).
  • dump() no longer quotes :, [, ], (, ) except when necessary, #470, #557.
  • Line and column in exceptions are now formatted as (X:Y) instead of at line X, column Y (also present in compact format), #332.
  • Code snippet created in exceptions now contains multiple lines with line numbers.
  • dump() now serializes undefined as null in collections and removes keys with undefined in mappings, #571.
  • dump() with skipInvalid=true now serializes invalid items in collections as null.
  • Custom tags starting with ! are now dumped as !tag instead of !<!tag>, #576.
  • Custom tags starting with tag:yaml.org,2002: are now shorthanded using !!, #258.

Added

  • Added .mjs (es modules) support.
  • Added quotingType and forceQuotes options for dumper to configure string literal style, #290, #529.
  • Added styles: { '!!null': 'empty' } option for dumper (serializes { foo: null } as "foo: "), #570.

... (truncated)

Commits

Updates jsonpath-plus from 7.2.0 to 10.3.0

Release notes

Sourced from jsonpath-plus's releases.

v10.3.0

What's Changed

Full Changelog: JSONPath-Plus/JSONPath@v10.2.0...v10.3.0

Changelog

Sourced from jsonpath-plus's changelog.

10.3.0

  • fix(eval): rce using non-string prop names (#237)
  • feat(demo): make demo link shareable (#238)
  • chore: update deps. and devDeps.

10.2.0

  • fix(eval): improve security of safe-eval (#233)
  • chore: update deps. and devDeps.

10.1.0

  • feat: add typeof operator to safe script

10.0.7

  • fix(security): prevent constructor access
  • docs: add security policy file

10.0.6

  • fix(security): prevent call/apply invocation of Function

10.0.5

  • fix: remove overly aggressive disabling of native functions but disallow __proto__

10.0.4

  • fix(security): further prevent binding of Function calls which may evade detection

10.0.3

  • fix(security): prevent binding of Function calls which may evade detection

10.0.2

  • fix(security): prevent Function calls outside of member expressions

10.0.1

  • fix(security): prohibit Function in "safe" vm

10.0.0

BREAKING CHANGES:

  • Require Node 18+

... (truncated)

Commits
  • 9754e4b chore: bump version
  • f690da1 chore: update deps and devDeps
  • 313a9b4 Merge pull request #238 from 80avin/shareable-demo
  • 39a0d03 Merge pull request #237 from 80avin/fix-10.2.0-rce
  • 1c532fc feat(demo): make demo link shareable
  • 3094289 fix(eval): rce using non-string prop names
  • 8e4acf8 chore: bump version
  • f0708a4 chore: update deps. and devDeps.
  • 0bfda55 build(deps): bump @​eslint/plugin-kit from 0.2.0 to 0.2.3 (#234)
  • 73ad72e fix(eval): improve security of safe-eval (#233)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by 80avin, a new releaser for jsonpath-plus since your current version.


Updates jws from 3.2.2 to 3.2.3

Release notes

Sourced from jws's releases.

v3.2.3

Changed

  • Fix advisory GHSA-869p-cjfg-cm3x: createSign and createVerify now require that a non empty secret is provided (via opts.secret, opts.privateKey or opts.key) when using HMAC algorithms.
  • Upgrading JWA version to 1.4.2, addressing a compatibility issue for Node >= 25.
Changelog

Sourced from jws's changelog.

[3.2.3]

Changed

  • Fix advisory GHSA-869p-cjfg-cm3x: createSign and createVerify now require that a non empty secret is provided (via opts.secret, opts.privateKey or opts.key) when using HMAC algorithms.
  • Upgrading JWA version to 1.4.2, adressing a compatibility issue for Node >= 25.

[3.0.0]

Changed

2.0.0 - 2015-01-30

Changed

  • BREAKING: Default payload encoding changed from binary to utf8. utf8 is a is a more sensible default than binary because many payloads, as far as I can tell, will contain user-facing strings that could be in any language. (6b6de48)

  • Code reorganization, thanks @​fearphage! (7880050)

Added

  • Option in all relevant methods for encoding. For those few users that might be depending on a binary encoding of the messages, this is for them. (6b6de48)
Commits
  • 4f6e73f Merge commit from fork
  • bd0fea5 version 3.2.3
  • 7c3b4b4 Enhance tests for HMAC streaming sign and verify
  • a9b8ed9 Improve secretOrKey initialization in VerifyStream
  • 6707fde Improve secret handling in SignStream
  • See full diff in compare view
Maintainer changes

This version was pushed to npm by julien.wollscheid, a new releaser for jws since your current version.


Updates lodash from 4.17.21 to 4.17.23

Commits

Updates node-forge from 1.3.1 to 1.3.3

Changelog

Sourced from node-forge's changelog.

1.3.3 - 2025-12-02

Fixed

  • [pkcs12] Make digestAlgorithm parameters optional to fix PKCS#12/PFX issues introduced in 1.3.2.

1.3.2 - 2025-11-25

Security

  • HIGH: ASN.1 Validator Desynchronization
    • An Interpretation Conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.
    • Reported by Hunter Wodzenski.
    • CVE ID: CVE-2025-12816
    • GHSA ID: GHSA-5gfm-wpxj-wjgq
  • HIGH: ASN.1 Unbounded Recursion
    • An Uncontrolled Recursion (CWE-674) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 structures that trigger unbounded recursive parsing. This leads to a Denial-of-Service (DoS) via stack exhaustion when parsing untrusted DER inputs.
    • Reported by Hunter Wodzenski.
    • CVE ID: CVE-2025-66031
    • GHSA ID: GHSA-554w-wpv2-vw27
  • MODERATE: ASN.1 OID Integer Truncation
    • An Integer Overflow (CWE-190) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures containing OIDs with oversized arcs. These arcs may be decoded as smaller, trusted OIDs due to 32-bit bitwise truncation, enabling the bypass of downstream OID-based security decisions.
    • Reported by Hunter Wodzenski.
    • CVE ID: CVE-2025-66030
    • GHSA ID: GHSA-65ch-62r8-g69g

Fixed

  • [asn1] Fix for vulnerability identified by CVE-2025-12816 PKCS#12 MAC verification bypass due to missing macData enforcement and improper asn1.validate routine.
  • [asn1] Add fromDer() max recursion depth check.
    • Add a asn1.maxDepth global configurable maximum depth of 256.
    • Add a asn1.fromDer() per-call maxDepth option.
    • NOTE: The default maximum is assumed to be higher than needed for valid data. If this assumption is false then this could be a breaking change. Please file an issue if there are use cases that need a higher maximum.
    • NOTE: The per-call maxDepth parameter has not been exposed up through all of the API stack due to the complexities involved. Please file an issue if there are use cases that require this instead of changing the default

... (truncated)

Commits

Updates tough-cookie from 2.5.0 to 4.1.4

Release notes

Sourced from tough-cookie's releases.

v4.1.4

https://www.npmjs.com/package/tough-cookie/v/4.1.4

What's Changed

New Contributors

Full Changelog: salesforce/tough-cookie@v4.1.3...v4.1.4

4.1.3

Security fix for Prototype Pollution discovery in #282. This is a minor release, although output from the inspect utility is affected by this change, we felt this change was important enough to be pushed into the next patch.

4.1.2 -- Patch and Bugfix Release

What's Changed

Full Changelog: salesforce/tough-cookie@v4.1.1...v4.1.2

4.1.1

Patch Release

What's Changed

Full Changelog: salesforce/tough-cookie@v4.1.0...v4.1.1

4.1.0

v4.1.0

Minor release, focused mainly on resolving reported issues and some minor feature work.

What's Changed

... (truncated)

Commits
  • cacbc37 Bump version to 4.1.4
  • a48fb3a Add tests for url validation
  • 50e69bf Merge pull request #261 from postmanlabs/fix/url-string-validation
  • 1253d58 Merge pull request #409 from corvidism/validators-to-string
  • 238367e Add local alias for toString
  • 4ff4d29 4.1.3 release preparation, update the package and lib/version to 4.1.3. (#284)
  • 12d4747 Prevent prototype pollution in cookie memstore (#283)
  • f06b72d Fix documentation for store.findCookies, missing allowSpecialUseDomain proper...
  • cf6debd Fix incorrect string validation for URL
  • b1a8898 fix: allow set cookies with localhost (#253)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by ccasey, a new releaser for tough-cookie since your current version.


Updates vm2 from 3.10.0 to 3.10.5
...

Description has been truncated

@dependabot
chore(deps): bump the npm_and_yarn group across 2 directories with 15…
a88a8d2 
… updates

Bumps the npm_and_yarn group with 12 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [react-router](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router) | `6.30.1` | `6.30.2` |
| [@backstage/backend-defaults](https://github.com/backstage/backstage/tree/HEAD/packages/backend-defaults) | `0.6.2` | `0.15.2` |
| [qs](https://github.com/ljharb/qs) | `6.14.0` | `6.14.2` |
| [@backstage/cli-common](https://github.com/backstage/backstage/tree/HEAD/packages/cli-common) | `0.1.15` | `0.1.18` |
| [@backstage/plugin-techdocs-node](https://github.com/backstage/backstage/tree/HEAD/plugins/techdocs-node) | `1.13.10` | `1.14.2` |
| [@smithy/config-resolver](https://github.com/smithy-lang/smithy-typescript/tree/HEAD/packages/config-resolver) | `4.3.2` | `4.4.6` |
| [diff](https://github.com/kpdecker/jsdiff) | `4.0.2` | `4.0.4` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `3.14.1` | `3.14.2` |
| [jws](https://github.com/brianloveswords/node-jws) | `3.2.2` | `3.2.3` |
| [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.17.23` |
| [node-forge](https://github.com/digitalbazaar/forge) | `1.3.1` | `1.3.3` |
| [vm2](https://github.com/patriksimek/vm2) | `3.10.0` | `3.10.5` |

Bumps the npm_and_yarn group with 1 update in the /plugins/stack-overflow-teams-backend directory: [@backstage/backend-defaults](https://github.com/backstage/backstage/tree/HEAD/packages/backend-defaults).


Updates `react-router` from 6.30.1 to 6.30.2
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/main/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/react-router@6.30.2/packages/react-router)

Updates `@backstage/backend-defaults` from 0.6.2 to 0.15.2
- [Release notes](https://github.com/backstage/backstage/releases)
- [Changelog](https://github.com/backstage/backstage/blob/master/packages/backend-defaults/CHANGELOG.md)
- [Commits](https://github.com/backstage/backstage/commits/HEAD/packages/backend-defaults)

Updates `qs` from 6.14.0 to 6.14.2
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.14.0...v6.14.2)

Updates `@backstage/cli-common` from 0.1.15 to 0.1.18
- [Release notes](https://github.com/backstage/backstage/releases)
- [Changelog](https://github.com/backstage/backstage/blob/master/packages/cli-common/CHANGELOG.md)
- [Commits](https://github.com/backstage/backstage/commits/HEAD/packages/cli-common)

Updates `@backstage/plugin-techdocs-node` from 1.13.10 to 1.14.2
- [Release notes](https://github.com/backstage/backstage/releases)
- [Changelog](https://github.com/backstage/backstage/blob/master/plugins/techdocs-node/CHANGELOG.md)
- [Commits](https://github.com/backstage/backstage/commits/v1.14.2/plugins/techdocs-node)

Updates `@smithy/config-resolver` from 4.3.2 to 4.4.6
- [Release notes](https://github.com/smithy-lang/smithy-typescript/releases)
- [Changelog](https://github.com/smithy-lang/smithy-typescript/blob/main/packages/config-resolver/CHANGELOG.md)
- [Commits](https://github.com/smithy-lang/smithy-typescript/commits/@smithy/config-resolver@4.4.6/packages/config-resolver)

Updates `diff` from 4.0.2 to 4.0.4
- [Changelog](https://github.com/kpdecker/jsdiff/blob/master/release-notes.md)
- [Commits](kpdecker/jsdiff@v4.0.2...v4.0.4)

Updates `form-data` from 2.3.3 to 2.5.5
- [Release notes](https://github.com/form-data/form-data/releases)
- [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md)
- [Commits](https://github.com/form-data/form-data/commits/v2.5.5)

Updates `js-yaml` from 3.14.1 to 3.14.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@3.14.1...3.14.2)

Updates `jsonpath-plus` from 7.2.0 to 10.3.0
- [Release notes](https://github.com/s3u/JSONPath/releases)
- [Changelog](https://github.com/JSONPath-Plus/JSONPath/blob/main/CHANGES.md)
- [Commits](JSONPath-Plus/JSONPath@v7.2.0...v10.3.0)

Updates `jws` from 3.2.2 to 3.2.3
- [Release notes](https://github.com/brianloveswords/node-jws/releases)
- [Changelog](https://github.com/auth0/node-jws/blob/master/CHANGELOG.md)
- [Commits](auth0/node-jws@v3.2.2...v3.2.3)

Updates `lodash` from 4.17.21 to 4.17.23
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.17.23)

Updates `node-forge` from 1.3.1 to 1.3.3
- [Changelog](https://github.com/digitalbazaar/forge/blob/main/CHANGELOG.md)
- [Commits](digitalbazaar/forge@v1.3.1...v1.3.3)

Updates `tough-cookie` from 2.5.0 to 4.1.4
- [Release notes](https://github.com/salesforce/tough-cookie/releases)
- [Changelog](https://github.com/salesforce/tough-cookie/blob/master/CHANGELOG.md)
- [Commits](salesforce/tough-cookie@v2.5.0...v4.1.4)

Updates `vm2` from 3.10.0 to 3.10.5
- [Release notes](https://github.com/patriksimek/vm2/releases)
- [Commits](patriksimek/vm2@v3.10.0...v3.10.5)

Updates `@backstage/backend-defaults` from 0.6.2 to 0.15.2
- [Release notes](https://github.com/backstage/backstage/releases)
- [Changelog](https://github.com/backstage/backstage/blob/master/packages/backend-defaults/CHANGELOG.md)
- [Commits](https://github.com/backstage/backstage/commits/HEAD/packages/backend-defaults)

---
updated-dependencies:
- dependency-name: react-router
  dependency-version: 6.30.2
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@backstage/backend-defaults"
  dependency-version: 0.15.2
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.14.2
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@backstage/cli-common"
  dependency-version: 0.1.18
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@backstage/plugin-techdocs-node"
  dependency-version: 1.14.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@smithy/config-resolver"
  dependency-version: 4.4.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: diff
  dependency-version: 4.0.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: form-data
  dependency-version: 2.5.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 3.14.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: jsonpath-plus
  dependency-version: 10.3.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: jws
  dependency-version: 3.2.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: lodash
  dependency-version: 4.17.23
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: node-forge
  dependency-version: 1.3.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: tough-cookie
  dependency-version: 4.1.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vm2
  dependency-version: 3.10.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@backstage/backend-defaults"
  dependency-version: 0.15.2
  dependency-type: direct:production
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Feb 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants