Bump the npm_and_yarn group across 15 directories with 9 updates by dependabot[bot] · Pull Request #7 · soft-cloud-dev/firefox

dependabot · 2026-09-13T05:42:25Z

Bumps the npm_and_yarn group with 3 updates in the / directory: fast-uri, js-yaml and nanoid.
Bumps the npm_and_yarn group with 4 updates in the /browser/components/aboutwelcome directory: browserslist, fast-uri, immutable and qs.
Bumps the npm_and_yarn group with 5 updates in the /browser/components/asrouter directory:

Package	From	To
browserslist	`4.24.5`	`4.28.9`
fast-uri	`3.0.6`	`3.1.7`
js-yaml	`4.1.0`	`4.3.2`
immutable	`4.3.7`	`4.3.9`
qs	`6.13.0`	`6.16.0`

Bumps the npm_and_yarn group with 5 updates in the /browser/components/storybook directory:

Package	From	To
browserslist	`4.24.4`	`4.28.9`
fast-uri	`3.0.6`	`3.1.7`
js-yaml	`3.14.1`	`3.15.2`
nanoid	`3.3.11`	`3.3.19`
qs	`6.14.0`	`6.16.0`

Bumps the npm_and_yarn group with 5 updates in the /browser/extensions/newtab directory:

Package	From	To
baseline-browser-mapping	`2.10.0`	`2.11.23`
browserslist	`4.28.1`	`4.28.9`
fast-uri	`3.0.6`	`3.1.7`
nanoid	`3.3.11`	`3.3.19`
qs	`6.13.0`	`6.16.0`

Bumps the npm_and_yarn group with 3 updates in the /devtools/client/debugger directory: baseline-browser-mapping, browserslist and js-yaml.
Bumps the npm_and_yarn group with 1 update in the /devtools/client/debugger/test/mochitest/examples/react directory: immutable.
Bumps the npm_and_yarn group with 1 update in the /devtools/client/framework/test/node directory: js-yaml.
Bumps the npm_and_yarn group with 1 update in the /devtools/client/webconsole/test/node directory: browserslist.
Bumps the npm_and_yarn group with 4 updates in the /dom/webgpu/tests/cts/checkout directory: browserslist, js-yaml, qs and morgan.
Bumps the npm_and_yarn group with 3 updates in the /remote/test/puppeteer directory: @humanfs/node, browserslist and fast-uri.
Bumps the npm_and_yarn group with 1 update in the /taskcluster/docker/index-task directory: qs.
Bumps the npm_and_yarn group with 1 update in the /testing/talos/talos/tests/devtools/addon/content/pages/custom/debugger/app directory: immutable.
Bumps the npm_and_yarn group with 3 updates in the /tools/lint/stylelint/stylelint-plugin-mozilla directory: fast-uri, js-yaml and nanoid.
Bumps the npm_and_yarn group with 3 updates in the /tools/ts directory: baseline-browser-mapping, browserslist and js-yaml.

Updates fast-uri from 3.1.5 to 3.1.7

Release notes

Sourced from fast-uri's releases.

v3.1.7

⚠️ Security Warning

This is a security release that fixes the following high-severity security advisories:

GHSA-qw65-cvwx-89v3 — authority injection via an unvalidated port in serialize()

GHSA-58mr-gqgx-xq4g — host confusion via unbalanced or misplaced IP-literal brackets

Users of the v3.x release line should upgrade to v3.1.7.

Full Changelog: fastify/fast-uri@v3.1.6...v3.1.7

v3.1.6

⚠️ Security Warning

This release addresses the following high-severity security advisories:

GHSA-5jgf-p345-68v8 — host confusion via skipped IDN canonicalization on scheme-relative references

GHSA-fph4-wmhf-6fwf — server-side request forgery via repeated hostname percent-decoding

GHSA-f65p-4m7j-42xc — server-side request forgery via malformed IPv6 normalization

GHSA-jqff-g426-hqxp — host confusion via percent-encoded scheme normalization

Users of the v3.x release line should upgrade to v3.1.6.

Full Changelog: fastify/fast-uri@v3.1.5...v3.1.6

Commits

412e40a Bumped v3.1.7
9f4c943 fix: backport port and IP-literal validation to v3.x (#216)
1eb3ce4 fix: treat unterminated bracket hosts as reg-names again (#214)
6f970b2 Bumped v3.1.6
d941579 fix: never run IDN canonicalization on bracketed IP literals
c0f0279 test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)
37f3417 Merge commit from fork
607bfbe Merge commit from fork
ae92a4c Merge commit from fork
444ecda Merge commit from fork
Additional commits viewable in compare view

Updates js-yaml from 4.3.1 to 4.3.2

Changelog

Sourced from js-yaml's changelog.

4.3.2 - 2026-08-26

Changed

[backport] Hard-limit merge sequence size to 100.

Security

[backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

Commits

79ca68d 4.3.2 released
d90b661 Backport merge limits from v5.4.1
See full diff in compare view

Updates nanoid from 3.3.17 to 3.3.19

Release notes

Sourced from nanoid's releases.

3.3.19

Fixed killing the app by setting huge user ID.

3.3.18

Fixed infinite loop on async for React Native (by @OvergrowthBeards-JB).

Changelog

Sourced from nanoid's changelog.

3.3.19

Fixed killing the app by setting huge user ID (by @geoffrey-diederichs).

3.3.18

Fixed infinite loop on async for React Native (by @OvergrowthBeards-JB).

Commits

eb63bd6 Release 3.3.19 version
9067e03 Sync CJS and ESM
9ad9805 Release 3.3.18 version
55e50a0 Update CI action
e10f8d4 Update index.native.js (#606)
See full diff in compare view

Updates browserslist from 4.24.5 to 4.28.9

Release notes

Sourced from browserslist's releases.

4.28.9

Improve or parsing performance (by @NotAFlightRisk).

4.28.8

Fixed including kaios in baseline queries (by @Jaybhade).

4.28.7

Improved parsing performance.

Fixed unbounded memory growth (by @alanturing881).

Fixed prototype write issue (by @alanturing881).

4.28.6

Fixed Electron version queries (by @spokodev).

4.28.5

Fixed > and >= queries (by @spokodev).

4.28.4

Fixed SyntaxError regression of 4.28.3.

4.28.3

Fixed baseline query case-insensitivity (by @swwind).

4.28.2

Fix prototype pollution (by @chluo1997).

4.28.1

Removed Baseline warning since we have it own warning.

4.27.0

Added BROWSERSLIST_TRACE_WARNING environment variable.

4.26.3

Fixed throwOnMissing with extends query (by @alexander-akait).

4.26.2

Fixed baseline-browser-mapping version requirement.

4.26.1

Updated Firefox ESR.

4.26.0

Added Baseline queries (by @tonypconway).

4.25.4

Fixed Windows support for custom stats (by @torgeilo).

4.25.3

Fixed ReDoS (by @ericcornelissen).

... (truncated)

Changelog

Sourced from browserslist's changelog.

4.28.9

Improve or parsing performance (by @NotAFlightRisk).

4.28.8

Fixed including kaios in baseline queries (by @Jaybhade).

4.28.7

Improved parsing performance.

Fixed unbounded memory growth (by @alanturing881).

Fixed prototype write issue (by @alanturing881).

4.28.6

Fixed Electron version queries (by @spokodev).

4.28.5

Fixed > and >= queries (by @spokodev).

4.28.4

Fixed SyntaxError regression of 4.28.3.

4.28.3

Fixed baseline query case-insensitivity (by @swwind).

4.28.2

Fix prototype pollution (by @chluo1997).

4.28.1

Removed Baseline warning since we have it own warning.

4.48.0

Added firefox >= esr query support (by @SethFalco).

Fixed docs (by @SethFalco).

4.27.0

Added BROWSERSLIST_TRACE_WARNING environment variable.

4.26.3

Fixed throwOnMissing with extends query (by @alexander-akait).

... (truncated)

Commits

12ed525 Release 4.28.9 version
b1d8cf9 Update dependencies
21517b6 Improve or parsing performance
f2f2e6c Release 4.28.8 version
d0787c8 Update dependencies
fcf8fa9 Merge pull request #939 from Jaybhade/fix/baseline-kaios-without-downstream
57ecd64 fix: support "including kaios" without downstream
093a0f6 Update EM banner
b637868 Release 4.28.7 version
313f465 Update dependencies
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for browserslist since your current version.

Updates fast-uri from 3.0.6 to 3.1.7

Release notes

Sourced from fast-uri's releases.

v3.1.7

⚠️ Security Warning

This is a security release that fixes the following high-severity security advisories:

GHSA-qw65-cvwx-89v3 — authority injection via an unvalidated port in serialize()

GHSA-58mr-gqgx-xq4g — host confusion via unbalanced or misplaced IP-literal brackets

Users of the v3.x release line should upgrade to v3.1.7.

Full Changelog: fastify/fast-uri@v3.1.6...v3.1.7

v3.1.6

⚠️ Security Warning

This release addresses the following high-severity security advisories:

GHSA-5jgf-p345-68v8 — host confusion via skipped IDN canonicalization on scheme-relative references

GHSA-fph4-wmhf-6fwf — server-side request forgery via repeated hostname percent-decoding

GHSA-f65p-4m7j-42xc — server-side request forgery via malformed IPv6 normalization

GHSA-jqff-g426-hqxp — host confusion via percent-encoded scheme normalization

Users of the v3.x release line should upgrade to v3.1.6.

Full Changelog: fastify/fast-uri@v3.1.5...v3.1.6

Commits

412e40a Bumped v3.1.7
9f4c943 fix: backport port and IP-literal validation to v3.x (#216)
1eb3ce4 fix: treat unterminated bracket hosts as reg-names again (#214)
6f970b2 Bumped v3.1.6
d941579 fix: never run IDN canonicalization on bracketed IP literals
c0f0279 test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)
37f3417 Merge commit from fork
607bfbe Merge commit from fork
ae92a4c Merge commit from fork
444ecda Merge commit from fork
Additional commits viewable in compare view

Updates immutable from 4.3.7 to 4.3.9

Release notes

Sourced from immutable's releases.

v4.3.9

What's changed

fix(List): guard oversized bounds in setListBounds. Fixes CVE GHSA-v56q-mh7h-f735

perf(Map): index large hash-collision buckets for faster lookups. Fixes CVE GHSA-xvcm-6775-5m9r

Full Changelog: immutable-js/immutable-js@v4.3.8...v4.3.9

v4.3.8

Fix Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

Changelog

Sourced from immutable's changelog.

4.3.9

fix(List): guard oversized bounds in setListBounds. Fixes CVE GHSA-v56q-mh7h-f735

perf(Map): index large hash-collision buckets for faster lookups. Fixes CVE GHSA-xvcm-6775-5m9r

5.1.7

fix(Repeat): lastIndexOf returned size instead of size - 1 by @chatman-media in immutable-js/immutable-js#2227. Fixes CVE CVE-2026-29063

fix(IndexedCollection): has(index) on a lazy Seq of unknown size now checks index existence instead of searching for a value equal to the index #2203

[TypeScript]: reduce/reduceRight without an initial value now infer the result type from the collection's values when the reducer returns a value (e.g. list.reduce((a, b) => a + b) infers number), matching Array#reduce. Previously an explicit type argument was required. #2205

5.1.6

fix(reverseFactory): read reversedSequence.size in __iterator instead of this #2196

5.1.5

Fix Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

5.1.4

Migrate some files to TS by @jdeniau in immutable-js/immutable-js#2125

Iterator.ts

PairSorting.ts

toJS.ts

Math.ts

Hash.ts

Extract CollectionHelperMethods and convert to TS by @jdeniau in immutable-js/immutable-js#2131

Use npm trusted publishing only to avoid token stealing.

Documentation

Fix/a11y issues by @lyannel in immutable-js/immutable-js#2136

Doc add Map.get signature update by @borracciaBlu in immutable-js/immutable-js#2138

fix(doc):minor-issues#2132 by @JayMeDotDot in immutable-js/immutable-js#2133

Fix algolia search by @jdeniau in immutable-js/immutable-js#2135

Typo in OrderedMap by @jdeniau in immutable-js/immutable-js#2144

Internal

chore: Sort all imports and activate eslint import rule by @jdeniau in immutable-js/immutable-js#2119

5.1.3

TypeScript

fix: allow readonly map entry constructor by @septs in immutable-js/immutable-js#2123

Documentation

... (truncated)

Commits

5da7919 4.3.9
794a1a9 Merge commit from fork
3dd7e56 perf(Map): index large hash-collision buckets for faster lookups
62d0b58 fix ts in tests
8c0e5f8 Merge commit from fork
f0bc997 Merge commit from fork
8ac83f4 change tag
f7373e5 use id-token to deploy 4.x version
2f545ad changelog
485cbe0 4.3.8
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for immutable since your current version.

Updates qs from 6.13.0 to 6.16.0

Changelog

Sourced from qs's changelog.

6.16.0

[New] stringify: add a depth option to bound recursion depth (default Infinity)

[Fix] stringify: serialize Date values when a filter is provided

[Fix] parse: enforce arrayLimit on comma groups under []= when throwOnLimitExceeded is set

[Fix] parse: flatten a collection appended to an overflowed array (#571)

[Fix] utils: isBuffer: do not invoke a non-callable constructor.isBuffer

[Fix] stringify: do not let allowEmptyArrays skip cycle detection (or drop own keys) on an empty array with own properties

[Fix] stringify: encode dots in a top-level key with a primitive value when encodeDotInKeys is set (#562)

[Docs] threat model: clarify stringify deep-nesting DoS is caller-bounded

[Docs] clarify arrayLimit is a representation threshold, not an element-count cap

[Tests] parse: remove a test that pinned []= comma groups escaping arrayLimit

[Tests] stringify: pin current encodeDotInKeys separator-dot behavior

[Dev Deps] update @ljharb/eslint-config, eslint

[Dev Deps] update eslint, evalmd

6.15.3

[Fix] parse: enforce throwOnLimitExceeded for cumulative array growth via combine/merge

[Fix] utils: respect encoding of surrogate pairs across chunks (#559)

[Robustness] parse: throw the arrayLimit error before splitting oversized comma values

[Robustness] utils.merge / utils.assign: avoid invoking __proto__ setter when copying own properties

[Robustness] utils: enforce arrayLimit consistently across merge's array paths

[Perf] utils: make compact O(n) via a side-channel visited-set instead of Array.indexOf

[Deps] update side-channel

[Dev Deps] update eslint, mock-property, tape

[Tests] parse: characterize current lenient handling of unbalanced bracket keys (#558)

6.15.2

[Fix] stringify: skip null/undefined entries in arrayFormat: 'comma' + encodeValuesOnly instead of crashing in encoder

[Fix] stringify: use configured delimiter after charsetSentinel (#555)

[Fix] stringify: apply formatter to encoded key under strictNullHandling (#554)

[Fix] stringify: skip null/undefined filter-array entries instead of crashing in encoder (#551)

[Fix] parse: handle nested bracket groups and add regression tests (#530); changes output for some unbalanced bracket keys (see #558)

[readme] fix grammar (#550)

[Dev Deps] update @ljharb/eslint-config

[Tests] add regression tests for keys containing percent-encoded bracket text

6.15.1

[Fix] parse: parameterLimit: Infinity with throwOnLimitExceeded: true silently drops all parameters

[Deps] update @ljharb/eslint-config

[Dev Deps] update @ljharb/eslint-config, iconv-lite

[Tests] increase coverage

6.15.0

[New] parse: add strictMerge option to wrap object/primitive conflicts in an array (#425, #122)

[Fix] duplicates option should not apply to bracket notation keys (#514)

6.14.2

[Fix] parse: mark overflow objects for indexed notation exceeding arrayLimit (#546)

[Fix] arrayLimit means max count, not max index, in combine/merge/parseArrayValue

[Fix] parse: throw on arrayLimit exceeded with indexed notation when throwOnLimitExceeded is true (#529)

... (truncated)

Commits

bb9379e v6.16.0
62fd254 [Fix] stringify: serialize Date values when a filter is provided
8859c37 [Fix] parse: enforce arrayLimit on comma groups under []= when `throwOn...
8079adc [Tests] parse: remove a test that pinned []= comma groups escaping `array...
d56f48c [Fix] parse: flatten a collection appended to an overflowed array
e83d321 [Fix] utils: isBuffer: do not invoke a non-callable constructor.isBuffer
7e87a07 [Dev Deps] update @ljharb/eslint-config, eslint
9a76af2 [Dev Deps] update eslint, evalmd
3a890d4 [Dev Deps] update eslint, evalmd
b433a9b [Fix] stringify: do not let allowEmptyArrays skip cycle detection (or dro...
Additional commits viewable in compare view

Updates browserslist from 4.24.5 to 4.28.9

Release notes

Sourced from browserslist's releases.

4.28.9

Improve or parsing performance (by @NotAFlightRisk).

4.28.8

Fixed including kaios in baseline queries (by @Jaybhade).

4.28.7

Improved parsing performance.

Fixed unbounded memory growth (by @alanturing881).

Fixed prototype write issue (by @alanturing881).

4.28.6

Fixed Electron version queries (by @spokodev).

4.28.5

Fixed > and >= queries (by @spokodev).

4.28.4

Fixed SyntaxError regression of 4.28.3.

4.28.3

Fixed baseline query case-insensitivity (by @swwind).

4.28.2

Fix prototype pollution (by @chluo1997).

4.28.1

Removed Baseline warning since we have it own warning.

4.27.0

Added BROWSERSLIST_TRACE_WARNING environment variable.

4.26.3

Fixed throwOnMissing with extends query (by @alexander-akait).

4.26.2

Fixed baseline-browser-mapping version requirement.

4.26.1

Updated Firefox ESR.

4.26.0

Added Baseline queries (by @tonypconway).

4.25.4

Fixed Windows support for custom stats (by @torgeilo).

4.25.3

Fixed ReDoS (by @ericcornelissen).

... (truncated)

Changelog

Sourced from browserslist's changelog.

4.28.9

Improve or parsing performance (by @NotAFlightRisk).

4.28.8

Fixed including kaios in baseline queries (by @Jaybhade).

4.28.7

Improved parsing performance.

Fixed unbounded memory growth (by @alanturing881).

Fixed prototype write issue (by @alanturing881).

4.28.6

Fixed Electron version queries (by @spokodev).

4.28.5

Fixed > and >= queries (by @spokodev).

4.28.4

Fixed SyntaxError regression of 4.28.3.

4.28.3

Fixed baseline query case-insensitivity (by @swwind).

4.28.2

Fix prototype pollution (by @chluo1997).

4.28.1

Removed Baseline warning since we have it own warning.

4.48.0

Added firefox >= esr query support (by @SethFalco).

Fixed docs (by @SethFalco).

4.27.0

Added BROWSERSLIST_TRACE_WARNING environment variable.

4.26.3

Fixed throwOnMissing with extends query (by @alexander-akait).

... (truncated)

Commits

12ed525 Release 4.28.9 version
b1d8cf9 Update dependencies
21517b6 Improve or parsing performance
f2f2e6c Release 4.28.8 version
d0787c8 Update dependencies
fcf8fa9 Merge pull request #939 from Jaybhade/fix/baseline-kaios-without-downstream
57ecd64 fix: support "including kaios" without downstream
093a0f6 Update EM banner
b637868 Release 4.28.7 version
313f465 Update dependencies
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for browserslist since your current version.

Updates fast-uri from 3.0.6 to 3.1.7

Release notes

Sourced from fast-uri's releases.

v3.1.7

⚠️ Security Warning

This is a security release that fixes the following high-severity security advisories:

GHSA-qw65-cvwx-89v3 — authority injection via an unvalidated port in serialize()

GHSA-58mr-gqgx-xq4g — host confusion via unbalanced or misplaced IP-literal brackets

Users of the v3.x release line should upgrade to v3.1.7.

Full Changelog: fastify/fast-uri@v3.1.6...v3.1.7

v3.1.6

⚠️ Security Warning

This release addresses the following high-severity security advisories:

GHSA-5jgf-p345-68v8 — host confusion via skipped IDN canonicalization on scheme-relative references

GHSA-fph4-wmhf-6fwf — server-side request forgery via repeated hostname percent-decoding

GHSA-f65p-4m7j-42xc — server-side request forgery via malformed IPv6 normalization

GHSA-jqff-g426-hqxp — host confusion via percent-encoded scheme normalization

Users of the v3.x release line should upgrade to v3.1.6.

Full Changelog: fastify/fast-uri@v3.1.5...v3.1.6

Commits

412e40a Bumped v3.1.7
9f4c943 fix: backport port and IP-literal validation to v3.x (#216)
1eb3ce4 fix: treat unterminated bracket hosts as reg-names again (#214)
6f970b2 Bumped v3.1.6
d941579 fix: never run IDN canonicalization on bracketed IP literals
c0f0279 test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)
37f3417 Merge commit from fork
607bfbe Merge commit from fork
ae92a4c Merge commit from fork
444ecda Merge commit from fork
Additional commits viewable in compare view

Updates js-yaml from 4.1.0 to 4.3.2

Changelog

Sourced from js-yaml's changelog.

4.3.2 - 2026-08-26

Changed

[backport] Hard-limit merge sequence size to 100.

Security

[backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

Commits

79ca68d 4.3.2 released
d90b661 Backport merge limits from v5.4.1
See full diff in compare view

Updates immutable from 4.3.7 to 4.3.9

Release notes

Sourced from immutable's releases.

v4.3.9

What's changed

fix(List): guard oversized bounds in setListBounds. Fixes CVE GHSA-v56q-mh7h-f735

perf(Map): index large hash-collision buckets for faster lookups. Fixes CVE GHSA-xvcm-6775-5m9r

Full Changelog: immutable-js/immutable-js@v4.3.8...v4.3.9

v4.3.8

Fix Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

Changelog

Sourced from immutable's changelog.

4.3.9

fix(List): guard oversized bounds in setListBounds. Fixes CVE GHSA-v56q-mh7h-f735

perf(Map): index large hash-collision buckets for faster lookups. Fixes CVE GHSA-xvcm-6775-5m9r

5.1.7

fix(Repeat): lastIndexOf returned size instead of size - 1 by @chatman-media in immutable-js/immutable-js#2227. Fixes CVE CVE-2026-29063

fix(IndexedCollection): has(index) on a lazy Seq of unknown size now checks index existence instead of searching for a value equal to the index #2203

[TypeScript]: reduce/reduceRight without an initial value now infer the result type from the collection's values when the reducer returns a value (e.g. list.reduce((a, b) => a + b) infers number), matching Array#reduce. Previously an explicit type argument was required. #2205

5.1.6

fix(reverseFactory): read reversedSequence.size in __iterator instead of this #2196

5.1.5

Fix Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

5.1.4

Migrate some files to TS by @jdeniau in immutable-js/immutable-js#2125

Iterator.ts

PairSorting.ts

toJS.ts

Math.ts

Hash.ts

Extract CollectionHelperMethods and convert to TS by @jdeniau in immutable-js/immutable-js#2131

Use npm trusted publishing only to avoid token stealing.

Documentation

Fix/a11y issues by @lyannel in immutable-js/immutable-js#2136

Doc add Map.get signature update by @borracciaBlu in immutable-js/immutable-js#2138

fix(doc):minor-issues#2132 by @JayMeDotDot in immutable-js/immutable-js#2133

Fix algolia search by @jdeniau in immutable-js/immutable-js#2135

Typo in OrderedMap by @jdeniau in immutable-js/immutable-js#2144

Internal

chore: Sort all imports and activate eslint import rule by @jdeniau in immutable-js/immutable-js#2119

5.1.3

TypeScript

fix: allow readonly map entry constructor by @septs in immutable-js/immutable-js#2123

Documentation

... (truncated)

Commits

5da7919 4.3.9
794a1a9 Merge commit from fork
3dd7e56 perf(Map): index large hash-collision buckets for faster lookups
62d0b58 fix ts in tests
8c0e5f8 Merge commit from fork
f0bc997 Merge commit from fork
8ac83f4 change tag
f7373e5 use id-token to deploy 4.x version
2f545ad changelog
485cbe0 4.3.8
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for immutable since your current version.

Updates qs from 6.13.0 to 6.16.0

Changelog

Sourced from qs's changelog.

6.16.0

[New] stringify: add a depth option to bound recursion depth (default Infinity)

[Fix] stringify: serialize Date values when a filter is provided

[Fix] parse: enforce arrayLimit on comma groups under []= when throwOnLimitExceeded is set

[Fix] parse: flatten a collection appended to an overflowed array (#571)

[Fix] utils: isBuffer: do not invoke a non-callable constructor.isBuffer

[Fix] stringify: do not let allowEmptyArrays skip cycle detection (or drop own keys) on an empty array with own properties

[Fix] stringify: encode dots in a top-level key with a primitive value when encodeDotInKeys is set (#562)

[Docs] threat model: clarify stringify deep-nesting DoS is caller-bounded

[Docs] clarify arrayLimit is a representation threshold, not an element-count cap

[Tests] parse: remove a test that pinned []= comma groups escaping arrayLimit

[Tests] stringify: pin current encodeDotInKeys separator-dot behavior

[Dev Deps] update @ljharb/eslint-config, eslint

[Dev Deps] update eslint, evalmd

6.15.3

[Fix] parse: enforce throwOnLimitExceeded for cumulative array growth via combine/merge

[Fix] utils: respect encoding of surrogate pairs across chunks (#559)

[Robustness] parse: throw the arrayLimit error before splitting oversized comma values

[Robustness] utils.merge / utils.assign: avoid invoking __proto__ setter when copying own properties

[Robustness] utils: enforce arrayLimit consistently across merge's array paths

[Perf] utils: make compact O(n) via a side-channel visited-set instead of Array.indexOf

[Deps] update side-channel

[Dev Deps] update eslint, mock-property, tape

[Tests] parse: characterize current lenient handling of unbalanced bracket keys (#558)

6.15.2

[Fix] stringify: skip null/undefined entries in arrayFormat: 'comma' + encodeValuesOnly instead of crashing in encoder

[Fix] stringify: use configured delimiter after charsetSentinel (#555)

[Fix] stringify: apply formatter to encoded key under strictNullHandling (#554)

[Fix] stringify: skip null/undefined filter-array entries instead of crashing in encoder (#551)

[Fix] parse: handle nested bracket groups and add regression tests (#530); changes output for some unbalanced bracket keys (see #558)

[readme] fix grammar (#550)

[Dev Deps] update @ljharb/eslint-config

[Tests] add regression tests for keys containing percent-encoded bracket text

6.15.1

[Fix] parse: parameterLimit: Infinity with throwOnLimitExceeded: true silently drops all parameters

[Deps] update @ljharb/eslint-config

[Dev Deps] update @ljharb/eslint-config, iconv-lite

[Tests] increase coverage

6.15.0

[New] parse: add strictMerge option to wrap object/primitive conflicts in an array (#425, #122)

[Fix] duplicates option should not apply to bracket notation keys (#514)

6.14.2

[Fix] parse: mark overflow objects for indexed notation exceeding arrayLimit (#546)

[Fix] arrayLimit means max count, not max index, in combine/merge/parseArrayValue

[Fix] parse: throw on arrayLimit exceeded with indexed notation when throwOnLimitExceeded is true (#529)

... (truncated)

Commits

bb9379e v6.16.0
62fd254 [Fix] stringify: serialize Date values when a filter is provided
8859c37 [Fix] parse: enforce arrayLimit on comma groups under []= when `throwOn...
8079adc [Tests] parse: remove a test that pinned []= comma groups escaping `array...
d56f48c [Fix] parse: flatten a collection appended to an overflowed array
e83d321 [Fix] utils: isBuffer: do not invoke a non-callable constructor.isBuffer
7e87a07 [Dev Deps] update @ljharb/eslint-config, eslint

Bumps the npm_and_yarn group with 3 updates in the / directory: [fast-uri](https://github.com/fastify/fast-uri), [js-yaml](https://github.com/nodeca/js-yaml) and [nanoid](https://github.com/ai/nanoid). Bumps the npm_and_yarn group with 4 updates in the /browser/components/aboutwelcome directory: [browserslist](https://github.com/browserslist/browserslist), [fast-uri](https://github.com/fastify/fast-uri), [immutable](https://github.com/immutable-js/immutable-js) and [qs](https://github.com/ljharb/qs). Bumps the npm_and_yarn group with 5 updates in the /browser/components/asrouter directory: | Package | From | To | | --- | --- | --- | | [browserslist](https://github.com/browserslist/browserslist) | `4.24.5` | `4.28.9` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.0.6` | `3.1.7` | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.0` | `4.3.2` | | [immutable](https://github.com/immutable-js/immutable-js) | `4.3.7` | `4.3.9` | | [qs](https://github.com/ljharb/qs) | `6.13.0` | `6.16.0` | Bumps the npm_and_yarn group with 5 updates in the /browser/components/storybook directory: | Package | From | To | | --- | --- | --- | | [browserslist](https://github.com/browserslist/browserslist) | `4.24.4` | `4.28.9` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.0.6` | `3.1.7` | | [js-yaml](https://github.com/nodeca/js-yaml) | `3.14.1` | `3.15.2` | | [nanoid](https://github.com/ai/nanoid) | `3.3.11` | `3.3.19` | | [qs](https://github.com/ljharb/qs) | `6.14.0` | `6.16.0` | Bumps the npm_and_yarn group with 5 updates in the /browser/extensions/newtab directory: | Package | From | To | | --- | --- | --- | | [baseline-browser-mapping](https://github.com/web-platform-dx/baseline-browser-mapping) | `2.10.0` | `2.11.23` | | [browserslist](https://github.com/browserslist/browserslist) | `4.28.1` | `4.28.9` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.0.6` | `3.1.7` | | [nanoid](https://github.com/ai/nanoid) | `3.3.11` | `3.3.19` | | [qs](https://github.com/ljharb/qs) | `6.13.0` | `6.16.0` | Bumps the npm_and_yarn group with 3 updates in the /devtools/client/debugger directory: [baseline-browser-mapping](https://github.com/web-platform-dx/baseline-browser-mapping), [browserslist](https://github.com/browserslist/browserslist) and [js-yaml](https://github.com/nodeca/js-yaml). Bumps the npm_and_yarn group with 1 update in the /devtools/client/debugger/test/mochitest/examples/react directory: [immutable](https://github.com/immutable-js/immutable-js). Bumps the npm_and_yarn group with 1 update in the /devtools/client/framework/test/node directory: [js-yaml](https://github.com/nodeca/js-yaml). Bumps the npm_and_yarn group with 1 update in the /devtools/client/webconsole/test/node directory: [browserslist](https://github.com/browserslist/browserslist). Bumps the npm_and_yarn group with 4 updates in the /dom/webgpu/tests/cts/checkout directory: [browserslist](https://github.com/browserslist/browserslist), [js-yaml](https://github.com/nodeca/js-yaml), [qs](https://github.com/ljharb/qs) and [morgan](https://github.com/expressjs/morgan). Bumps the npm_and_yarn group with 3 updates in the /remote/test/puppeteer directory: [@humanfs/node](https://github.com/humanwhocodes/humanfs/tree/HEAD/packages/node), [browserslist](https://github.com/browserslist/browserslist) and [fast-uri](https://github.com/fastify/fast-uri). Bumps the npm_and_yarn group with 1 update in the /taskcluster/docker/index-task directory: [qs](https://github.com/ljharb/qs). Bumps the npm_and_yarn group with 1 update in the /testing/talos/talos/tests/devtools/addon/content/pages/custom/debugger/app directory: [immutable](https://github.com/immutable-js/immutable-js). Bumps the npm_and_yarn group with 3 updates in the /tools/lint/stylelint/stylelint-plugin-mozilla directory: [fast-uri](https://github.com/fastify/fast-uri), [js-yaml](https://github.com/nodeca/js-yaml) and [nanoid](https://github.com/ai/nanoid). Bumps the npm_and_yarn group with 3 updates in the /tools/ts directory: [baseline-browser-mapping](https://github.com/web-platform-dx/baseline-browser-mapping), [browserslist](https://github.com/browserslist/browserslist) and [js-yaml](https://github.com/nodeca/js-yaml). Updates `fast-uri` from 3.1.5 to 3.1.7 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.5...v3.1.7) Updates `js-yaml` from 4.3.1 to 4.3.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.1...4.3.2) Updates `nanoid` from 3.3.17 to 3.3.19 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](ai/nanoid@3.3.17...3.3.19) Updates `browserslist` from 4.24.5 to 4.28.9 - [Release notes](https://github.com/browserslist/browserslist/releases) - [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md) - [Commits](browserslist/browserslist@4.24.5...4.28.9) Updates `fast-uri` from 3.0.6 to 3.1.7 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.5...v3.1.7) Updates `immutable` from 4.3.7 to 4.3.9 - [Release notes](https://github.com/immutable-js/immutable-js/releases) - [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md) - [Commits](immutable-js/immutable-js@v4.3.7...v4.3.9) Updates `qs` from 6.13.0 to 6.16.0 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.13.0...v6.16.0) Updates `browserslist` from 4.24.5 to 4.28.9 - [Release notes](https://github.com/browserslist/browserslist/releases) - [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md) - [Commits](browserslist/browserslist@4.24.5...4.28.9) Updates `fast-uri` from 3.0.6 to 3.1.7 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.5...v3.1.7) Updates `js-yaml` from 4.1.0 to 4.3.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.1...4.3.2) Updates `immutable` from 4.3.7 to 4.3.9 - [Release notes](https://github.com/immutable-js/immutable-js/releases) - [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md) - [Commits](immutable-js/immutable-js@v4.3.7...v4.3.9) Updates `qs` from 6.13.0 to 6.16.0 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.13.0...v6.16.0) Updates `browserslist` from 4.24.4 to 4.28.9 - [Release notes](https://github.com/browserslist/browserslist/releases) - [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md) - [Commits](browserslist/browserslist@4.24.5...4.28.9) Updates `fast-uri` from 3.0.6 to 3.1.7 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.5...v3.1.7) Updates `js-yaml` from 3.14.1 to 3.15.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.1...4.3.2) Updates `nanoid` from 3.3.11 to 3.3.19 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](ai/nanoid@3.3.17...3.3.19) Updates `qs` from 6.14.0 to 6.16.0 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.13.0...v6.16.0) Updates `baseline-browser-mapping` from 2.10.0 to 2.11.23 - [Release notes](https://github.com/web-platform-dx/baseline-browser-mapping/releases) - [Commits](web-platform-dx/baseline-browser-mapping@v2.10.0...v2.11.23) Updates `browserslist` from 4.28.1 to 4.28.9 - [Release notes](https://github.com/browserslist/browserslist/releases) - [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md) - [Commits](browserslist/browserslist@4.24.5...4.28.9) Updates `fast-uri` from 3.0.6 to 3.1.7 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.5...v3.1.7) Updates `nanoid` from 3.3.11 to 3.3.19 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](ai/nanoid@3.3.17...3.3.19) Updates `qs` from 6.13.0 to 6.16.0 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.13.0...v6.16.0) Updates `baseline-browser-mapping` from 2.8.2 to 2.11.23 - [Release notes](https://github.com/web-platform-dx/baseline-browser-mapping/releases) - [Commits](web-platform-dx/baseline-browser-mapping@v2.10.0...v2.11.23) Updates `browserslist` from 4.26.0 to 4.28.9 - [Release notes](https://github.com/browserslist/browserslist/releases) - [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md) - [Commits](browserslist/browserslist@4.24.5...4.28.9) Updates `js-yaml` from 3.14.1 to 3.15.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.1...4.3.2) Updates `immutable` from 3.8.2 to 4.3.9 - [Release notes](https://github.com/immutable-js/immutable-js/releases) - [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md) - [Commits](immutable-js/immutable-js@v4.3.7...v4.3.9) Updates `js-yaml` from 3.13.1 to 3.15.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.1...4.3.2) Updates `browserslist` from 4.21.4 to 4.28.9 - [Release notes](https://github.com/browserslist/browserslist/releases) - [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md) - [Commits](browserslist/browserslist@4.24.5...4.28.9) Updates `browserslist` from 4.22.1 to 4.28.9 - [Release notes](https://github.com/browserslist/browserslist/releases) - [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md) - [Commits](browserslist/browserslist@4.24.5...4.28.9) Updates `js-yaml` from 3.14.1 to 3.14.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.1...4.3.2) Updates `qs` from 6.11.0 to 6.16.0 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.13.0...v6.16.0) Updates `morgan` from 1.10.0 to 1.12.0 - [Release notes](https://github.com/expressjs/morgan/releases) - [Changelog](https://github.com/expressjs/morgan/blob/master/HISTORY.md) - [Commits](expressjs/morgan@1.10.0...1.12.0) Updates `@humanfs/node` from 0.16.6 to 0.16.8 - [Release notes](https://github.com/humanwhocodes/humanfs/releases) - [Changelog](https://github.com/humanwhocodes/humanfs/blob/main/packages/node/CHANGELOG.md) - [Commits](https://github.com/humanwhocodes/humanfs/commits/node-v0.16.8/packages/node) Updates `browserslist` from 4.24.0 to 4.28.9 - [Release notes](https://github.com/browserslist/browserslist/releases) - [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md) - [Commits](browserslist/browserslist@4.24.5...4.28.9) Updates `fast-uri` from 3.0.6 to 3.1.7 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.5...v3.1.7) Updates `qs` from 6.6.0 to 6.16.0 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.13.0...v6.16.0) Updates `immutable` from 3.8.2 to 4.3.9 - [Release notes](https://github.com/immutable-js/immutable-js/releases) - [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md) - [Commits](immutable-js/immutable-js@v4.3.7...v4.3.9) Updates `fast-uri` from 3.0.6 to 3.1.7 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.5...v3.1.7) Updates `js-yaml` from 4.1.0 to 4.3.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.1...4.3.2) Updates `nanoid` from 3.3.8 to 3.3.19 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](ai/nanoid@3.3.17...3.3.19) Updates `baseline-browser-mapping` from 2.10.32 to 2.11.23 - [Release notes](https://github.com/web-platform-dx/baseline-browser-mapping/releases) - [Commits](web-platform-dx/baseline-browser-mapping@v2.10.0...v2.11.23) Updates `browserslist` from 4.28.2 to 4.28.9 - [Release notes](https://github.com/browserslist/browserslist/releases) - [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md) - [Commits](browserslist/browserslist@4.24.5...4.28.9) Updates `js-yaml` from 3.14.2 to 3.15.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.1...4.3.2) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: nanoid dependency-version: 3.3.19 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: browserslist dependency-version: 4.28.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: immutable dependency-version: 4.3.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.16.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: browserslist dependency-version: 4.28.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: immutable dependency-version: 4.3.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.16.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: browserslist dependency-version: 4.28.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 3.15.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: nanoid dependency-version: 3.3.19 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.16.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: baseline-browser-mapping dependency-version: 2.11.23 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: browserslist dependency-version: 4.28.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: nanoid dependency-version: 3.3.19 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.16.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: baseline-browser-mapping dependency-version: 2.11.23 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: browserslist dependency-version: 4.28.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 3.15.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: immutable dependency-version: 4.3.9 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 3.15.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: browserslist dependency-version: 4.28.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: browserslist dependency-version: 4.28.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 3.14.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.16.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: morgan dependency-version: 1.12.0 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: "@humanfs/node" dependency-version: 0.16.8 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: browserslist dependency-version: 4.28.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.16.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: immutable dependency-version: 4.3.9 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: nanoid dependency-version: 3.3.19 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: baseline-browser-mapping dependency-version: 2.11.23 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: browserslist dependency-version: 4.28.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 3.15.2 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 13, 2026

Navigation Menu

Bump the npm_and_yarn group across 15 directories with 9 updates - #7

Bump the npm_and_yarn group across 15 directories with 9 updates#7
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-18b90d5137

dependabot Bot commented on behalf of github Sep 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 13, 2026

v3.1.7

⚠️ Security Warning

v3.1.6

⚠️ Security Warning

4.3.2 - 2026-08-26

Changed

Security

3.3.19

3.3.18

3.3.19

3.3.18

4.28.9

4.28.8

4.28.7

4.28.6

4.28.5

4.28.4

4.28.3

4.28.2

4.28.1

4.27.0

4.26.3

4.26.2

4.26.1

4.26.0

4.25.4

4.25.3

4.28.9

4.28.8

4.28.7

4.28.6

4.28.5

4.28.4

4.28.3

4.28.2

4.28.1

4.48.0

4.27.0

4.26.3

v3.1.7

⚠️ Security Warning

v3.1.6

⚠️ Security Warning

v4.3.9

What's changed

v4.3.8

4.3.9

5.1.7

5.1.6

5.1.5

5.1.4

Documentation

Internal

5.1.3

TypeScript

Documentation

6.16.0

6.15.3

6.15.2

6.15.1

6.15.0

6.14.2

4.28.9

4.28.8

4.28.7

4.28.6

4.28.5

4.28.4

4.28.3

4.28.2

4.28.1

4.27.0

4.26.3

4.26.2

4.26.1

4.26.0

4.25.4

4.25.3