Repository navigation
chore(deps): bump the npm_and_yarn group across 1 directory with 9 updates - #982
dependabot[bot] wants to merge 1 commit into
Conversation
…dates Bumps the npm_and_yarn group with 9 updates in the /internal/dev_server/ui directory: | Package | From | To | | --- | --- | --- | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `6.4.3` | `6.4.5` | | [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) | `7.27.3` | `7.29.7` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.18` | `1.1.21` | | [@vitest/mocker](https://github.com/vitest-dev/vitest/tree/HEAD/packages/mocker) | `3.2.7` | `5.0.5` | | [browserslist](https://github.com/browserslist/browserslist) | `4.24.5` | `4.29.5` | | [dompurify](https://github.com/cure53/DOMPurify) | `3.2.4` | `3.4.17` | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.3.1` | `4.3.2` | | [source-map-js](https://github.com/7rulnik/source-map-js) | `1.2.1` | `1.2.2` | | [uuid](https://github.com/uuidjs/uuid) | `8.3.2` | `removed` | Updates `vite` from 6.4.3 to 6.4.5 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v6.4.5/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v6.4.5/packages/vite) Updates `@babel/core` from 7.27.3 to 7.29.7 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.7/packages/babel-core) Updates `brace-expansion` from 1.1.18 to 1.1.21 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.18...v1.1.21) Updates `@vitest/mocker` from 3.2.7 to 5.0.5 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/mocker) Updates `browserslist` from 4.24.5 to 4.29.5 - [Release notes](https://github.com/browserslist/browserslist/releases) - [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md) - [Commits](browserslist/browserslist@4.24.5...4.29.5) Updates `dompurify` from 3.2.4 to 3.4.17 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.2.4...3.4.17) Updates `js-yaml` from 4.3.1 to 4.3.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.1...4.3.2) Updates `source-map-js` from 1.2.1 to 1.2.2 - [Release notes](https://github.com/7rulnik/source-map-js/releases) - [Changelog](https://github.com/7rulnik/source-map-js/blob/main/CHANGELOG.md) - [Commits](7rulnik/source-map-js@v1.2.1...v1.2.2) Removes `uuid` --- updated-dependencies: - dependency-name: vite dependency-version: 6.4.5 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: "@babel/core" dependency-version: 7.29.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.21 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@vitest/mocker" dependency-version: 5.0.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: browserslist dependency-version: 4.29.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: dompurify dependency-version: 3.4.17 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: source-map-js dependency-version: 1.2.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: uuid dependency-version: dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![semgrep-code-launchdarkly[bot]](https://avatars.githubusercontent.com/u/8039656?s=60&v=4){kind=small}
| @@ -9308,6 +9534,12 @@ | |||
| "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.7.0.tgz", | |||
| "integrity": "sha512-gLXCKdN1/j47AiHiOkJN69hJmcbGTHI0ImLmbYLHykhgeN0jVGola9yVjFgzCUklsZQMW55o+dW7IXv3RCXDzA==" | |||
| }, | |||
| "node_modules/turbo-stream": { | |||
There was a problem hiding this comment.
High severity vulnerability may affect your project—review required:
Line 9537 lists a dependency (turbo-stream) with a known High severity vulnerability.
ℹ️ Why this matters
Affected versions of react-router and turbo-stream are vulnerable to Allocation of Resources Without Limits or Throttling. React Router Framework Mode uses turbo-stream to serialize loader/action data into Single Fetch responses. The underlying serialization algorithm becomes a bottleneck on certain data shapes, so an attacker who can influence the serialized data can cause excessive resource consumption and a Denial of Service.
References: https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-33994, GHSA, CVE
To resolve this comment:
Check if you use React Router Framework Mode with Single Fetch enabled (the default in v7 Framework Mode, or opt-in via future.unstable_singleFetch in Remix v2.9.0+) and not Declarative or Data mode.
- If you're affected, upgrade this dependency to at least version 3.0.0 at internal/dev_server/ui/package-lock.json.
- If you're not affected, comment
/fp we don't use this [condition]
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
You can view more details on this finding in the Semgrep AppSec Platform here.
| "integrity": "sha512-RBvlC0wwmDxyPjA+i1e09KuVQEGcJJz/w/bQ1Hxbz2I4NDetFOvrtIBknRhmO2gBUdOrIkMnYZWiGIjdBcNRVA==", | ||
| "license": "MIT" | ||
| }, | ||
| "node_modules/@launchpad-ui/navigation/node_modules/react-router": { |
There was a problem hiding this comment.
High severity vulnerability may affect your project—review required:
Line 2308 lists a dependency (react-router) with a known High severity vulnerability.
ℹ️ Why this matters
Affected versions of react-router and turbo-stream are vulnerable to Allocation of Resources Without Limits or Throttling. React Router Framework Mode uses turbo-stream to serialize loader/action data into Single Fetch responses. The underlying serialization algorithm becomes a bottleneck on certain data shapes, so an attacker who can influence the serialized data can cause excessive resource consumption and a Denial of Service.
References: https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-33994, GHSA, CVE
To resolve this comment:
Check if you use React Router Framework Mode with Single Fetch enabled (the default in v7 Framework Mode, or opt-in via future.unstable_singleFetch in Remix v2.9.0+) and not Declarative or Data mode.
- If you're affected, upgrade this dependency to at least version 7.14.0 at internal/dev_server/ui/package-lock.json.
- If you're not affected, comment
/fp we don't use this [condition]
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
You can view more details on this finding in the Semgrep AppSec Platform here.
Bumps the npm_and_yarn group with 9 updates in the /internal/dev_server/ui directory:
6.4.36.4.57.27.37.29.71.1.181.1.213.2.75.0.54.24.54.29.53.2.43.4.174.3.14.3.21.2.11.2.28.3.2removedUpdates
vitefrom 6.4.3 to 6.4.5Release notes
Sourced from vite's releases.
Changelog
Sourced from vite's changelog.
Commits
83ab40brelease: v6.4.591e40d7fix: checkserver.fsafter stripping query as well (#22160) (#23855)5f0d9a4release: v6.4.4eec6464fix(server): check resolved ids for transform access (#20410)e570d8dfix(server): store ids tosafeModulePathsrather than URLs (#23656)8afec69fix(deps): update launch-editor to v2.14.2 (#23654)19902cffix(html): filename passed to transformIndexHtml should not include queries (...Updates
@babel/corefrom 7.27.3 to 7.29.7Release notes
Sourced from @babel/core's releases.
... (truncated)
Commits
4fba754v7.29.704ea6b2v7.29.699f498a[7.x packport]Improve input source map handling (#18001)feba0a3Preserve original identifier names from input sourcemaps (#17992) (#17998)aa8394ev7.29.0ad0d03f[7.x backport] feat: Allow specifying startLine in code frame (#17739)d7f4008v7.28.6e130225Polish(standalone): improve message on invalid preset/plugin (#17606)99dcba5chore: enable some ts-eslint rules (#17592)c92c491Improve Unicode handling in code-frame tokenizer (#17589)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for
@babel/coresince your current version.Updates
brace-expansionfrom 1.1.18 to 1.1.21Commits
8e81e181.1.21ffdfa3eMerge commit from forkc6513ad1.1.201efee7cMerge commit from forka34340a1.1.190bcbfc0Merge commit from forkUpdates
@vitest/mockerfrom 3.2.7 to 5.0.5Release notes
Sourced from @vitest/mocker's releases.
... (truncated)
Commits
7a825dbchore: release v5.0.5 (#11609)6a11cf6chore: release v5.0.4 (#11554)58c86edchore(deps): update all non-major dependencies (#11550)5c95521fix(browser): clean up unmocked and pending mocks (#11537)cd423bafix(mocker): fix native loader mocking edge cases (#11540)36d19cbfix: wrap module mocks during in-source testing (#11505)fe025b2chore(deps): update dependency msw to v3 (#11482)b0f2b3bfix: track project files and mocks with --changed (#11432)33cadeachore: release v5.0.3 (#11409)15cc006fix: don't print an interceptor warning in browser mode (#11377)Updates
browserslistfrom 4.24.5 to 4.29.5Release notes
Sourced from browserslist's releases.
... (truncated)
Changelog
Sourced from browserslist's changelog.
... (truncated)
Commits
2e4b904Release 4.29.5 version11a13ecUpdate dependenciese80fabcMerge pull request #957 from nk-batman21/fix-coverage-custom-stats-versionscac8029Normalize custom statistics versions in coveragef7a99b9Release 4.29.4 version03fc702Update dependenciesefe07e1Merge pull request #956 from ybai08/fix-joined-range-boundsef50f5bFix joined version bounds in version ray and range queries8219dd7Merge pull request #954 from abhu85/fix-since-extends-whitespace893120bAllow arbitrary whitespaces in since, extends, config and not queriesMaintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for browserslist since your current version.
Updates
dompurifyfrom 3.2.4 to 3.4.17Release notes
Sourced from dompurify's releases.
... (truncated)
Commits
a77a3e7release: 3.4.17 (#1672)b9b9d80release: 3.4.16 (#1636)1d7460crelease: 3.4.15 (#1609)4e6fe24release: 3.4.14 (#1587)3067f77release: 3.4.13 (#1562)a9ca1e5release: 3.4.12 (#1537)0cae518release: 3.4.11 (#1494)6ee5716release: 3.4.10 (#1478)5210247release: 3.4.9 (#1459)bcdd828release: 3.4.8 (#1439)Install script changes
This version adds
preparescript that runs during installation. Review the package contents before updating.Updates
js-yamlfrom 4.3.1 to 4.3.2Changelog
Sourced from js-yaml's changelog.
Commits
79ca68d4.3.2 releasedd90b661Backport merge limits from v5.4.1Updates
source-map-jsfrom 1.2.1 to 1.2.2Release notes
Sourced from source-map-js's releases.
Changelog
Sourced from source-map-js's changelog.
Commits
0a1d3341.2.24c6fa26Update changelogcf76580Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)7899a86Fix crash when executing browser with CSP script-src that don't permit unsafe...Removes
uuidDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.
Note
Overview
Bumps npm dependencies for the dev server UI (
internal/dev_server/ui) with no application source changes in this diff.Direct dependency updates in
package.json:@launchpad-ui/components0.4.4 → 0.25.0,launchdarkly-js-client-sdk3.4.0 → 3.9.6,vite6.4.3 → 6.4.5, andvitest3.2.7 → 5.0.5. The Dependabot group also refreshes transitive packages (e.g. Babel,browserslist,dompurify,js-yaml,source-map-js) and drops an unuseduuidresolution via the lockfile.Reviewers should confirm
npm run build,npm test, and a quick UI smoke check still pass—the Launchpad components and Vitest major jumps are the main compatibility risks.Reviewed by Cursor Bugbot for commit 76513f4. Bugbot is set up for automated code reviews on this repo. Configure here.