Skip to content

Bump the npm_and_yarn group across 6 directories with 21 updates - #5979

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-b2346347e7
Closed

Bump the npm_and_yarn group across 6 directories with 21 updates#5979
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-b2346347e7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 18 updates in the / directory:

Package From To
compression 1.8.1 1.8.2
adm-zip 0.5.17 0.6.1
katex 0.17.0 0.19.1
sanitize-html 2.17.4 2.18.1
brace-expansion 1.1.15 1.1.21
js-yaml 3.14.2 3.15.2
axios 1.16.1 1.21.0
baseline-browser-mapping 2.9.10 2.11.34
browserslist 4.28.1 4.29.5
fast-uri 3.1.2 3.1.9
follow-redirects 1.16.0 1.16.2
happy-dom 20.9.0 21.0.4
postcss-selector-parser 7.1.0 7.1.7
proxy-addr 2.0.7 2.0.8
qs 6.15.2 6.17.1
shell-quote 1.8.4 1.12.0
source-map-js 1.2.1 1.2.2
zod 4.2.1 4.6.7

Bumps the npm_and_yarn group with 4 updates in the /samples directory: brace-expansion, source-map-js, @angular/common and @angular/core.
Bumps the npm_and_yarn group with 3 updates in the /samples/01.getting-started/k.direct-line-token/javascript/web directory: follow-redirects, qs and csv-parse.
Bumps the npm_and_yarn group with 4 updates in the /samples/01.getting-started/k.direct-line-token/javascript/bot directory: axios, follow-redirects, qs and csv-parse.
Bumps the npm_and_yarn group with 2 updates in the /packages/bundle directory: katex and sanitize-html.
Bumps the npm_and_yarn group with 1 update in the /packages/support/cldr-data-downloader directory: adm-zip.

Updates compression from 1.8.1 to 1.8.2

Release notes

Sourced from compression's releases.

v1.8.2

Important

What's Changed

New Contributors

Full Changelog: expressjs/compression@v1.8.1...v1.8.2

Changelog

Sourced from compression's changelog.

1.8.2

Commits
  • 0f97074 1.8.2 (#287)
  • 151f63e fix: destroy compression stream on response close
  • 0a76495 fix: match Cache-Control no-transform directive case-insensitively (#286)
  • c17b6e5 docs: update outdated Brotli note and fix npm install docs URL (#276)
  • 112911a chore(ci): npm-publish via reusable workflows (#269)
  • 1bf5eb0 build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 (#267)
  • d8fe64d build(deps): bump actions/setup-node from 6.0.0 to 6.1.0 (#266)
  • b218ff5 build(deps): bump github/codeql-action from 4.31.5 to 4.31.9 (#265)
  • 8a1cf8e build(deps): bump actions/download-artifact from 6.0.0 to 7.0.0 (#268)
  • 4a19855 build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 (#257)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for compression since your current version.


Updates adm-zip from 0.5.17 to 0.6.1

Release notes

Sourced from adm-zip's releases.

v0.6.1

Full Changelog: cthackers/adm-zip@v0.6.0...v0.6.1

  • Updated dev dependencies
  • Fixed uncaught crash in async decompression on malformed DEFLATE data
  • Fixed addLocalFolder following symlinks out of the archived folder
  • Stripped setuid/setgid/sticky bits from extracted file permissions
  • Enforced the decompression size cap on the async path and for size 0
  • Rejected archives with duplicate entry names
  • Blocked extraction from writing through symlinks inside the target
  • Routed malformed-header parse errors through the async callback
  • Rejected zip entries whose declared data extent runs past the buffer
  • Fixed addLocalFolderPromise hanging on empty folders and swallowing errors
  • Fixed addLocalFolderAsync2 mangling local paths on Windows

v0.6.0

Full Changelog: cthackers/adm-zip@v0.5.18...v0.6.0

This release fixes a security vulnerability (CVE-2026-39244), resolves several long-standing bugs, ships built-in TypeScript types, and includes two behavior changes worth reading before you upgrade.

  • extractEntryTo(dirEntry, target, maintainEntryPath = false) now preserves subdirectories instead of flattening files into the target folder by basename (which also silently overwrote same-named files). (#306)
  • Extraction no longer fails when the modification time can't be set — utimes is now best-effort. (#379)
  • Minimum Node.js is now 14 (the code already required it; engines was incorrectly >=12).
  • CVE-2026-39244 — a crafted archive declaring a huge uncompressed size could force an unbounded Buffer.alloc and OOM the process; allocation is now bounded by the data actually present. Reported by Daniel Púa (devploit), Anh Hong, and José Antonio Zamudio Amaya. (#568)
  • Hardened entry-name lookup against object injection (proto names). Prototype-less table.
  • Data-descriptor regression rejecting valid archives (#548, #533, #554)
  • Directory permissions not restored on extract (#530)
  • Infinite recursion on symlink loops in addLocalFolder (#541)
  • Uncaught process crash in writeFileToAsync on write failure (#470, #459, #402)
  • Empty name on directory entries (#466)
  • test() always returned false for archives with files
  • ~6× faster entry sorting for large archives
  • Built-in TypeScript definitions (types.d.ts) — you can drop @​types/adm-zip

v0.5.18

What's Changed

New Contributors

Full Changelog: cthackers/adm-zip@v0.5.17...v0.5.18

Changelog

Sourced from adm-zip's changelog.

0.6.0 / 2026-07-10

Security

  • Fixed CVE-2026-39244: a crafted archive declaring a huge uncompressed size could force an unbounded Buffer.alloc (memory exhaustion / DoS) before any validation. Allocation is now bounded by the data actually present — STORED output is sized from the real bytes, DEFLATED output is grown by the inflater and capped at the declared size (#568)
  • Hardened the internal entry-name lookup table against object injection: entry names come from untrusted archives, and a name such as __proto__ previously resolved to Object.prototype, crashing addFile and hiding the entry from getEntry/readFile. The table is now prototype-less

Bug fixes

  • Fixed a regression (0.5.15) that rejected valid archives using a data descriptor (general-purpose bit 3). The payload is now validated against the authoritative central-directory CRC instead of requiring/parsing the trailing descriptor (#548, #533, #554)
  • Fixed extractAllTo/extractAllToAsync not restoring directory permissions with keepOriginalPermission; directory modes are applied after their contents are written, deepest path first, and no longer lock the extractor out of a restrictive directory (#530)
  • Fixed infinite recursion in addLocalFolder when a folder contains a symlink pointing back to an ancestor (e.g. workspace node_modules); the walk now tracks resolved real paths and skips already-visited directories (#541)
  • Fixed an uncaught exception (ERR_INVALID_ARG_TYPE) that crashed the process when writeFileToAsync could not open the target file (bad permissions, invalid filename, exhausted file descriptors); write failures are now reported through the callback and write errors are no longer silently swallowed (#470, #459, #402)
  • Fixed directory entries reporting an empty name (e.g. a/b/c/ now returns c) (#466)
  • Fixed extractEntryTo flattening subdirectories when maintainEntryPath is false; the structure below the extracted directory is now preserved instead of collapsing (and overwriting) files by basename (#306)
  • Fixed a failed utimes aborting extraction; setting the modification time is now best-effort and never fails extraction of already-written content (#379)
  • Fixed test() always returning false for any archive containing a file (it indexed the entries array with an entry object instead of reading the entry); it now correctly verifies each entry's CRC

Performance

  • Faster entry sorting when writing archives with many entries: names are decoded once instead of on every comparison (about 6× faster sort for large archives)

Added

  • Bundled TypeScript type definitions (types.d.ts), so @types/adm-zip is no longer required

Notes

  • Behavior change: extractEntryTo(dir, target, /* maintainEntryPath */ false) now preserves subdirectories beneath the extracted directory rather than flattening them
  • Behavior change: extraction no longer fails when the modification time cannot be set

0.5.4 / 2021-03-08

  • Fixed relative paths
  • Added zipcrypto encryption
  • Lower verMade for macOS when generating zip file

0.5.3 / 2021-02-07

  • Fixed filemode when unzipping

0.5.2 / 2021-01-27

  • Fixed path traversal issue (GHSL-2020-198)

0.5.1 / 2020-11-27

  • Incremented version (cthackers)
  • Fixed outFileName (cthackers)

0.5.0 / 2020-11-19

  • Added extra parameter to extractEntryTo so target filename can be renamed (cthackers)

... (truncated)

Commits
  • cb2cf9b Fixed addLocalFolderAsync2 mangling local paths on Windows
  • 54902b6 Fixed addLocalFolderPromise hanging on empty folders and swallowing errors
  • 73131bd Fixed CI
  • 758898d Rejected zip entries whose declared data extent runs past the buffer
  • 74b6e9f Routed malformed-header parse errors through the async callback
  • eaa35fa Blocked extraction from writing through symlinks inside the target
  • 1e015e3 Increment version
  • 05101d4 Rejected archives with duplicate entry names
  • 4916006 Enforced the decompression size cap on the async path and for size 0
  • 6a63c33 Stripped setuid/setgid/sticky bits from extracted file permissions
  • Additional commits viewable in compare view

Updates katex from 0.17.0 to 0.19.1

Release notes

Sourced from katex's releases.

v0.19.1

0.19.1 (2026-10-23)

Bug Fixes

v0.19.0

0.19.0 (2026-10-01)

Documentation

BREAKING CHANGES

  • Missing character metrics now reported via strict with error code symbolNotInFont, changing warning formatting, calling any strict callbacks, and producing errors in strict: "error" mode. Also, strict callbacks returning undefined or null now warn instead of ignoring the issue (and no longer typecheck); return false or "ignore" to suppress warnings.

v0.18.11

0.18.11 (2026-10-01)

Features

  • handle character metrics warnings via strict (#4243) (4237070)

v0.18.10

0.18.10 (2026-09-30)

Features

  • make KaTeX fallback to browsr math font before Times New Roman (#4298) (a477b2e)

v0.18.9

0.18.9 (2026-09-23)

Features

v0.18.8

0.18.8 (2026-09-23)

Bug Fixes

... (truncated)

Changelog

Sourced from katex's changelog.

0.19.1 (2026-10-23)

Bug Fixes

0.19.0 (2026-10-01)

Documentation

BREAKING CHANGES

  • Missing character metrics now reported via strict with error code symbolNotInFont, changing warning formatting, calling any strict callbacks, and producing errors in strict: "error" mode. Also, strict callbacks returning undefined or null now warn instead of ignoring the issue (and no longer typecheck); return false or "ignore" to suppress warnings.

0.18.11 (2026-10-01)

Features

  • handle character metrics warnings via strict (#4243) (4237070)

0.18.10 (2026-09-30)

Features

  • make KaTeX fallback to browsr math font before Times New Roman (#4298) (a477b2e)

0.18.9 (2026-09-23)

Features

0.18.8 (2026-09-23)

Bug Fixes

0.18.7 (2026-09-06)

... (truncated)

Commits
  • 8000fbd chore(release): 0.19.1 [ci skip]
  • 6971e5c fix: allow percent sign in raw argument type (#4307)
  • 8f0d9bc chore: handle devicePixelRatio in screenshotter (#4303)
  • faa8a4c docs(users): add Whiteboard (#4310)
  • f18d73d docs(users): add Liubai (#4313)
  • 4ffde03 chore(deps): bump github/codeql-action from 4.38.3 to 4.39.0 (#4314)
  • cac2561 chore(deps): bump github/codeql-action from 4.38.2 to 4.38.3 (#4306)
  • 6ea2dc9 chore(release): 0.19.0 [ci skip]
  • cbb1fce docs: note strict changes shipped in 0.18.11 (#4300)
  • d5bed9f chore(release): 0.18.11 [ci skip]
  • Additional commits viewable in compare view
Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates sanitize-html from 2.17.4 to 2.18.1

Changelog

Sourced from sanitize-html's changelog.

2.18.1 (2026-10-14)

Changes

  • Remove the deepmerge dependency, which was used only to combine tag-specific and * (all tags) entries in allowedClasses and allowedStyles. That is now done by a few lines of code within sanitize-html.

    This is not a fix for a vulnerability in sanitize-html. Security scanners such as Snyk now report CVE-2026-93753 in deepmerge, which can affect applications that merge untrusted objects, such as parsed JSON request bodies. sanitize-html only ever merged the developer's own configuration, never anything taken from the HTML being sanitized, so it was not exploitable through sanitize-html. Since we needed only a small part of what deepmerge does, we removed the dependency so that these reports no longer appear for sanitize-html users.

Security

  • Since 2.18.0, the fallback markup of a discarded <iframe> was re-sanitized by a recursive call with no limit, one level per nested unclosed <iframe>. A few kilobytes of crafted input could throw RangeError: Maximum call stack size exceeded with the default options, and the nestingLimit option was not enforced across the fallback because each nested call started counting from zero. The fallback of a discarded <iframe> is still sanitized and kept, but only up to eight nested <iframe> elements (deeper fallback is escaped as text, as before 2.18.0), and the current nesting depth now carries into the nested call so nestingLimit applies to the whole output. Only 2.18.0 was affected, and the exception is thrown synchronously, so applications that catch errors from sanitizeHtml only lost the affected request (CWE-674, GHSA-c9rx-x947-fp3h).

    Thanks to hkmj19, JohnBeckley, and amikhailovstiltsoft for reporting the vulnerability.

2.18.0 (2026-09-30)

Adds

  • Added a logger option: pass any console-shaped object, with debug, info, warn and error methods, and sanitize-html's own diagnostics are delivered to it rather than to the console, so an application with a logging pipeline of its own can route them. Missing methods, and no option at all, fall back to the console. Those messages also lost their decorative line breaks and warning icon, so each is now a single line of text; their wording is otherwise unchanged.

Fixes

  • allowedSchemesByTag is now applied to srcset and imagesrcset URLs. Previously the per-tag lookup used the attribute name instead of the tag name, so these attributes always fell back to the global allowedSchemes and ignored a tag-specific scheme allowlist. Thanks to spokodev for the fix.
  • Starting in version 2.17.6, sanitize-html began escaping any markup preserved inside a disallowed iframe tag, which was a change in behavior due to an upstream change in htmlparser2. This fix ensures such "fallback markup" is preserved without escaping, but also fully sanitized according to the same rules as the original input. Thanks to sumitjhacodes for the fix.

Security

  • When meta was allowed together with its http-equiv and content attributes, the destination URL of a <meta http-equiv="refresh" content="0;url=..."> was never checked against allowedSchemes, because it is embedded in content rather than being an attribute of its own. So javascript:, data: and other disallowed destinations passed through. The refresh URL is now extracted the way browsers do it, allowing for the different spellings, separators, quoting and letter case of url=, and checked against allowedSchemes (or allowedSchemesByTag.meta). If it is rejected, or the content cannot be parsed as a refresh, the content attribute is removed. content on other meta elements is unchanged. The default configuration does not allow meta and was not affected (CWE-79, CWE-601, GHSA-cv27-6wvh-8x7j).

    Thanks to adrbogacz for reporting the vulnerability.

  • When noscript is listed in nonTextTags, the discarded region could end too early. Browsers with scripting enabled treat <noscript> content as raw text up to the first </noscript>, but the underlying parser treats it as markup, so an end tag for an enclosing element inside <noscript> closed it implicitly and the rest of its content was emitted as ordinary sanitized markup. The discard region now continues until the point where a browser would end the <noscript> element, while implied closes of other nonTextTags such as <option> behave as before (CWE-79, CWE-436, GHSA-x3q4-9hxx-gx8m).

    Thanks to joaquiniglesiaslug for reporting the vulnerability.

  • The check that drops SVG animation elements (animate, animateColor, animateMotion, animateTransform, set) when they retarget a URL attribute such as href compared the full tag name, so a namespace-prefixed spelling like svg:animate was not recognized when such tags were allowed (for example with allowedTags: false). In XML serializations such as XHTML or standalone SVG, the prefixed element is a real animation element and could retarget a link to a javascript: URL after sanitization. The element and attributeName are now matched by their local names, ignoring any prefix (CWE-79, CWE-184, GHSA-374f-7chj-9948).

    Thanks to Kai Aizen (SnailSploit) for reporting the vulnerability.

2.17.7 (2026-08-13)

Security

  • Fixed an XSS / URL scheme policy bypass affecting configurations that allow the SVG animation elements (animate, animateColor, animateMotion, animateTransform or set) together with attributeName and one of the animation value attributes. The default configuration was not affected, as these elements are not in the default allowedTags. apostrophecms was not affected. Thanks to koyokr for responsibly disclosing the vulnerability (GHSA-g8qq-57p8-ggw5).

2.17.6 (2026-07-10)

... (truncated)

Commits

Updates brace-expansion from 1.1.15 to 1.1.21

Commits

Updates js-yaml from 3.14.2 to 3.15.2

Changelog

Sourced from js-yaml's changelog.

3.15.2 - 2026-08-26

Changed

  • [backport] Hard-limit merge sequence size to 100.

Security

  • [backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

3.15.1 - 2026-07-31

Security

  • [backport] Remove quadratic complexity from !!omap duplicate key detection.

3.15.0 - 2026-06-27

Added

  • Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one safeLoad() / safeLoadAll() call.
Commits

Updates axios from 1.16.1 to 1.21.0

Release notes

Sourced from axios's releases.

v1.21.0 — October 21, 2026

This release adds response timing and opt-in UTF-8 Basic authentication, improves request handling across runtimes, and changes how header defaults are recognized.

⚠️ Breaking Changes & Deprecations

  • Header Defaults: Only plain objects, null-prototype maps, and compatible AxiosHeaders instances are treated as common or method-specific defaults; literal headers such as Link are now preserved. Applications using custom class instances as defaults must convert them to plain maps, for example { post: { ...customDefaults } }, or compatible AxiosHeaders. Otherwise, those instances become literal header values, including on requests using other methods. (#11156)

🚀 New Features

  • Response Timing: Added response.duration, in milliseconds, including on error.response when present. Timing measures adapter execution and excludes interceptors and transforms; streamed responses stop timing when the stream becomes available. Axios replaces any existing duration value supplied by a custom adapter. (#11214)
  • UTF-8 Basic Authentication: Added transitional.encodeBasicAuthUsername: true to support Unicode usernames in XHR and Fetch requests. The option defaults to false, preserving existing authentication behavior; applications opting in should supply the original Unicode username and remove manual pre-encoding workarounds. (#11159)

🐛 Bug Fixes

  • Fetch Compatibility: Restored requests in runtimes such as Cloudflare Workers that reject the implicit cache: 'default', while preserving explicit caller settings. Response-size failures now retain their original ERR_BAD_RESPONSE and request context when runtime wrappers replace the underlying stream error. (#11194, #11179)
  • Runtime Consistency: Aligned encoded-byte size accounting, multipart uploads, proxy routing, same-origin resolution, parameter merging, and form serialization across adapters. Circular parameters now reject with ERR_BAD_OPTION_VALUE, and sparse or non-index numeric form fields serialize as keyed objects. With proxy: false, native proxyEnv agents using unsupported pool-management or TLS-session lifecycle overrides now reject with ERR_BAD_OPTION_VALUE; construct those agents without proxyEnv. (#11242)
  • Header Handling: Preserved headers named __proto__ using safe casing without changing the AxiosHeaders instance prototype. Function matchers in has(), delete(), and clear() now receive the headers instance as this, matching their declared contract. (#11134, #11216)
  • URL and Data URL Parsing: Accepted case-insensitive supported URL schemes and Base64 markers, and corrected decoding of percent-encoded Base64 data URLs. Node data URL allocation estimates remain aligned with decoding so configured size limits apply before allocation. (#11138, #11163, #11294)
  • Error Diagnostics: Preserved short reconstructed request stacks and appended wrapped error stacks under Caused by: so tooling that reads only error.stack retains the original failure context. (#11132, #11142)
  • Interceptor Removal: Restored removal through canonical numeric-string interceptor IDs, including after registry compaction. (#11139)
  • Proxy TLS: HTTPS CONNECT tunnels now apply current origin TLS options from an explicit httpsAgent, or from https.globalAgent when no explicit agent is supplied. This preserves process-wide custom CA settings through proxy tunnels. (#11178)
  • XHR Lifecycle: Used asynchronous Cookie Store reads for XSRF tokens where supported, preserving cookie fallback, timeout accounting, and cancellation. Upload and download progress listeners are now removed on completion, failure, timeout, and cancellation. (#11166, #11225)
  • HTTP/2 Sessions: Stopped reusing sessions immediately after GOAWAY and prevented draining sessions from scheduling idle timers that could delay process exit. (#11210)
  • TypeScript Declarations: Exposed the response-default marker as a public type to resolve TS2527 when consumers emit declarations involving unresolved response generics, covering both ESM and CommonJS. (#11125)

🔧 Maintenance & Chores

  • Configuration Performance: Reduced request configuration merge overhead, particularly for requests with many headers, while preserving merge semantics and prototype-pollution guards. (#11208)
  • Same-Origin Checks: Removed obsolete Internet Explorer detection without changing origin decisions in supported environments. (#11174)
  • Dependencies: Updated follow-redirects to 1.16.1 and refreshed development, documentation, test, and GitHub Actions dependencies. Removed unused dayjs from the docs package, root chalk, and chai from CJS module tests. (#11169, #11188, #11189, #11195, #11212, #11213, #11218, #11220, #11221, #11230, #11234, #11244, #11245, #11266, #11267, #11268, #11269, #11270, #11271, #11272, #11298, #11302, #11303, #11304, #11305, #11306, #11313, #11321, #11322, #11323, #11342)
  • Documentation: Fixed interceptor test links, updated README CDN examples to the published 1.20.0 bundle, and corrected guidance on interceptor options and request lifecycle ordering. (#11228, #11149, #11335)
  • Contributor Workflow: Consolidated agent instructions in AGENTS.md, standardized PR labels, required prerelease notes and validation evidence, and clarified that npm test requires installed Playwright browsers. (#11238, #11273, #11223, #11284)
  • Sponsors and Support: Added HeroDevs, Code for Japan, and Sweepico sponsor listings, refreshed sponsor data, and documented extended security support for Axios v0. (#11222, #11249, #11252, #11341)
  • Proxy Regression Coverage: Added a long dotted request-hostname test for NO_PROXY handling, extending coverage of an existing denial-of-service fix. (#11235)
  • Release Preparation: Updated package version metadata for 1.21.0. (#11346)

🌟 New Contributors

Welcome to our 24 new contributors. Thank you for helping improve Axios:

... (truncated)

Changelog

Sourced from axios's changelog.

v1.21.0 — October 21, 2026

This release adds response timing and opt-in UTF-8 Basic authentication, improves request handling across runtimes, and changes how header defaults are recognized.

⚠️ Breaking Changes & Deprecations

  • Header Defaults: Only pl...

    Description has been truncated

@dependabot
Bump the npm_and_yarn group across 6 directories with 21 updates
ee14f7e 
Bumps the npm_and_yarn group with 18 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [compression](https://github.com/expressjs/compression) | `1.8.1` | `1.8.2` |
| [adm-zip](https://github.com/cthackers/adm-zip) | `0.5.17` | `0.6.1` |
| [katex](https://github.com/KaTeX/KaTeX) | `0.17.0` | `0.19.1` |
| [sanitize-html](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html) | `2.17.4` | `2.18.1` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.15` | `1.1.21` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `3.14.2` | `3.15.2` |
| [axios](https://github.com/axios/axios) | `1.16.1` | `1.21.0` |
| [baseline-browser-mapping](https://github.com/web-platform-dx/baseline-browser-mapping) | `2.9.10` | `2.11.34` |
| [browserslist](https://github.com/browserslist/browserslist) | `4.28.1` | `4.29.5` |
| [fast-uri](https://github.com/fastify/fast-uri) | `3.1.2` | `3.1.9` |
| [follow-redirects](https://github.com/follow-redirects/follow-redirects) | `1.16.0` | `1.16.2` |
| [happy-dom](https://github.com/capricorn86/happy-dom) | `20.9.0` | `21.0.4` |
| [postcss-selector-parser](https://github.com/postcss/postcss-selector-parser) | `7.1.0` | `7.1.7` |
| [proxy-addr](https://github.com/jshttp/proxy-addr) | `2.0.7` | `2.0.8` |
| [qs](https://github.com/ljharb/qs) | `6.15.2` | `6.17.1` |
| [shell-quote](https://github.com/ljharb/shell-quote) | `1.8.4` | `1.12.0` |
| [source-map-js](https://github.com/7rulnik/source-map-js) | `1.2.1` | `1.2.2` |
| [zod](https://github.com/colinhacks/zod) | `4.2.1` | `4.6.7` |

Bumps the npm_and_yarn group with 4 updates in the /samples directory: [brace-expansion](https://github.com/juliangruber/brace-expansion), [source-map-js](https://github.com/7rulnik/source-map-js), [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common) and [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core).
Bumps the npm_and_yarn group with 3 updates in the /samples/01.getting-started/k.direct-line-token/javascript/web directory: [follow-redirects](https://github.com/follow-redirects/follow-redirects), [qs](https://github.com/ljharb/qs) and [csv-parse](https://github.com/adaltas/node-csv/tree/HEAD/packages/csv-parse).
Bumps the npm_and_yarn group with 4 updates in the /samples/01.getting-started/k.direct-line-token/javascript/bot directory: [axios](https://github.com/axios/axios), [follow-redirects](https://github.com/follow-redirects/follow-redirects), [qs](https://github.com/ljharb/qs) and [csv-parse](https://github.com/adaltas/node-csv/tree/HEAD/packages/csv-parse).
Bumps the npm_and_yarn group with 2 updates in the /packages/bundle directory: [katex](https://github.com/KaTeX/KaTeX) and [sanitize-html](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html).
Bumps the npm_and_yarn group with 1 update in the /packages/support/cldr-data-downloader directory: [adm-zip](https://github.com/cthackers/adm-zip).


Updates `compression` from 1.8.1 to 1.8.2
- [Release notes](https://github.com/expressjs/compression/releases)
- [Changelog](https://github.com/expressjs/compression/blob/master/HISTORY.md)
- [Commits](expressjs/compression@v1.8.1...v1.8.2)

Updates `adm-zip` from 0.5.17 to 0.6.1
- [Release notes](https://github.com/cthackers/adm-zip/releases)
- [Changelog](https://github.com/cthackers/adm-zip/blob/master/history.md)
- [Commits](cthackers/adm-zip@v0.5.17...v0.6.1)

Updates `katex` from 0.17.0 to 0.19.1
- [Release notes](https://github.com/KaTeX/KaTeX/releases)
- [Changelog](https://github.com/KaTeX/KaTeX/blob/main/CHANGELOG.md)
- [Commits](KaTeX/KaTeX@v0.17.0...v0.19.1)

Updates `sanitize-html` from 2.17.4 to 2.18.1
- [Changelog](https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md)
- [Commits](https://github.com/apostrophecms/apostrophe/commits/sanitize-html@2.18.1/packages/sanitize-html)

Updates `brace-expansion` from 1.1.15 to 1.1.21
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.15...v1.1.21)

Updates `js-yaml` from 3.14.2 to 3.15.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/3.15.2/CHANGELOG.md)
- [Commits](nodeca/js-yaml@3.14.2...3.15.2)

Updates `axios` from 1.16.1 to 1.21.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.16.1...v1.21.0)

Updates `baseline-browser-mapping` from 2.9.10 to 2.11.34
- [Release notes](https://github.com/web-platform-dx/baseline-browser-mapping/releases)
- [Commits](web-platform-dx/baseline-browser-mapping@v2.9.10...v2.11.34)

Updates `browserslist` from 4.28.1 to 4.29.5
- [Release notes](https://github.com/browserslist/browserslist/releases)
- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md)
- [Commits](browserslist/browserslist@4.28.1...4.29.5)

Updates `fast-uri` from 3.1.2 to 3.1.9
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.2...v3.1.9)

Updates `follow-redirects` from 1.16.0 to 1.16.2
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](follow-redirects/follow-redirects@v1.16.0...v1.16.2)

Updates `happy-dom` from 20.9.0 to 21.0.4
- [Release notes](https://github.com/capricorn86/happy-dom/releases)
- [Commits](capricorn86/happy-dom@v20.9.0...v21.0.4)

Updates `postcss-selector-parser` from 7.1.0 to 7.1.7
- [Release notes](https://github.com/postcss/postcss-selector-parser/releases)
- [Changelog](https://github.com/postcss/postcss-selector-parser/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss-selector-parser@v7.1.0...7.1.7)

Updates `proxy-addr` from 2.0.7 to 2.0.8
- [Release notes](https://github.com/jshttp/proxy-addr/releases)
- [Changelog](https://github.com/jshttp/proxy-addr/blob/master/HISTORY.md)
- [Commits](jshttp/proxy-addr@v2.0.7...v2.0.8)

Updates `qs` from 6.15.2 to 6.17.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.15.2...v6.17.1)

Updates `shell-quote` from 1.8.4 to 1.12.0
- [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md)
- [Commits](ljharb/shell-quote@v1.8.4...v1.12.0)

Updates `source-map-js` from 1.2.1 to 1.2.2
- [Release notes](https://github.com/7rulnik/source-map-js/releases)
- [Changelog](https://github.com/7rulnik/source-map-js/blob/main/CHANGELOG.md)
- [Commits](7rulnik/source-map-js@v1.2.1...v1.2.2)

Updates `zod` from 4.2.1 to 4.6.7
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.2.1...v4.6.7)

Updates `brace-expansion` from 1.1.15 to 1.1.21
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.15...v1.1.21)

Updates `source-map-js` from 1.2.1 to 1.2.2
- [Release notes](https://github.com/7rulnik/source-map-js/releases)
- [Changelog](https://github.com/7rulnik/source-map-js/blob/main/CHANGELOG.md)
- [Commits](7rulnik/source-map-js@v1.2.1...v1.2.2)

Updates `@angular/common` from 21.2.15 to 22.2.3
- [Release notes](https://github.com/angular/angular/releases)
- [Commits](https://github.com/angular/angular/commits/v22.2.3/packages/common)

Updates `@angular/core` from 21.2.15 to 22.2.3
- [Release notes](https://github.com/angular/angular/releases)
- [Commits](https://github.com/angular/angular/commits/v22.2.3/packages/core)

Updates `follow-redirects` from 1.16.0 to 1.16.2
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](follow-redirects/follow-redirects@v1.16.0...v1.16.2)

Updates `qs` from 6.15.2 to 6.17.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.15.2...v6.17.1)

Updates `csv-parse` from 6.1.0 to 7.0.3
- [Changelog](https://github.com/adaltas/node-csv/blob/master/packages/csv-parse/CHANGELOG.md)
- [Commits](https://github.com/adaltas/node-csv/commits/csv-parse@7.0.3/packages/csv-parse)

Updates `axios` from 1.16.1 to 1.21.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.16.1...v1.21.0)

Updates `follow-redirects` from 1.16.0 to 1.16.2
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](follow-redirects/follow-redirects@v1.16.0...v1.16.2)

Updates `qs` from 6.15.2 to 6.17.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.15.2...v6.17.1)

Updates `csv-parse` from 6.1.0 to 7.0.3
- [Changelog](https://github.com/adaltas/node-csv/blob/master/packages/csv-parse/CHANGELOG.md)
- [Commits](https://github.com/adaltas/node-csv/commits/csv-parse@7.0.3/packages/csv-parse)

Updates `katex` from 0.17.0 to 0.19.1
- [Release notes](https://github.com/KaTeX/KaTeX/releases)
- [Changelog](https://github.com/KaTeX/KaTeX/blob/main/CHANGELOG.md)
- [Commits](KaTeX/KaTeX@v0.17.0...v0.19.1)

Updates `sanitize-html` from 2.17.4 to 2.18.1
- [Changelog](https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md)
- [Commits](https://github.com/apostrophecms/apostrophe/commits/sanitize-html@2.18.1/packages/sanitize-html)

Updates `adm-zip` from 0.5.17 to 0.6.1
- [Release notes](https://github.com/cthackers/adm-zip/releases)
- [Changelog](https://github.com/cthackers/adm-zip/blob/master/history.md)
- [Commits](cthackers/adm-zip@v0.5.17...v0.6.1)

---
updated-dependencies:
- dependency-name: compression
  dependency-version: 1.8.2
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: adm-zip
  dependency-version: 0.6.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: katex
  dependency-version: 0.19.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: sanitize-html
  dependency-version: 2.18.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 1.1.21
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 3.15.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: axios
  dependency-version: 1.21.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: baseline-browser-mapping
  dependency-version: 2.11.34
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: browserslist
  dependency-version: 4.29.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fast-uri
  dependency-version: 3.1.9
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: follow-redirects
  dependency-version: 1.16.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: happy-dom
  dependency-version: 21.0.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: postcss-selector-parser
  dependency-version: 7.1.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: proxy-addr
  dependency-version: 2.0.8
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.17.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: shell-quote
  dependency-version: 1.12.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: source-map-js
  dependency-version: 1.2.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: zod
  dependency-version: 4.6.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 1.1.21
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: source-map-js
  dependency-version: 1.2.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@angular/common"
  dependency-version: 22.2.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@angular/core"
  dependency-version: 22.2.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: follow-redirects
  dependency-version: 1.16.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.17.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: csv-parse
  dependency-version: 7.0.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: axios
  dependency-version: 1.21.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: follow-redirects
  dependency-version: 1.16.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.17.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: csv-parse
  dependency-version: 7.0.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: katex
  dependency-version: 0.19.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: sanitize-html
  dependency-version: 2.18.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: adm-zip
  dependency-version: 0.6.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 28, 2026
Copilot AI balanced review requested due to automatic review settings October 28, 2026 23:49
@dependabot dependabot Bot added the javascript Pull requests that update javascript code label Oct 28, 2026
Copilot AI reviewed Oct 28, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

The upgrade introduces an ESM-only sanitizer dependency that the CommonJS build and Jest configuration do not handle, causing the Fluent theme’s package-export test to fail before its assertion runs.

1 open issue
3 files not reviewed
  • samples/01.getting-started/k.direct-line-token/javascript/bot/package-lock.json: Generated file
  • samples/01.getting-started/k.direct-line-token/javascript/web/package-lock.json: Generated file
  • samples/package-lock.json: Generated file
What changed in this PR

Updates dependencies across Web Chat’s runtime bundle, development tools, and samples, bringing in upstream security fixes and maintenance releases.

Changes:

  • Upgrades KaTeX, HTML sanitization, and CLDR archive extraction dependencies.
  • Refreshes Happy DOM, concurrent build tooling, and development-server compression.
  • Updates sample dependency locks, including Angular, CSV processing, and HTTP utilities.
File Description
samples/​package-lock.json Updates Angular and shared utility dependencies.
samples/​01.getting-started/​k.direct-line-token/​javascript/​web/​package-lock.json Refreshes CSV, redirect, and query-string dependencies.
samples/​01.getting-started/​k.direct-line-token/​javascript/​bot/​package-lock.json Updates Axios, CSV, and related HTTP dependencies.
packages/​test/​page-object/​package.json Updates concurrent build tooling.
packages/​test/​harness/​package.json Updates concurrent build tooling.
packages/​test/​dev-server/​package.json Upgrades compression middleware.
packages/​support/​cldr-data-downloader/​package.json Upgrades ZIP extraction dependency.
packages/​fluent-theme/​package.json Updates concurrent build tooling.
packages/​bundle/​package.json Upgrades KaTeX and HTML sanitization.
package.json Updates Happy DOM and concurrent tooling.
package-lock.json Records workspace upgrades and transitive dependency changes.

Review effort: Balanced

Comment thread packages/bundle/package.json
"prop-types": "15.8.1",
"punycode": "2.3.1",
"sanitize-html": "2.17.4",
"sanitize-html": "2.18.1",
@dependabot @github

dependabot Bot commented on behalf of github Oct 29, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #5983.

@dependabot dependabot Bot closed this Oct 29, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/npm_and_yarn-b2346347e7 branch October 29, 2026 20:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@compulim William Wong (compulim) Awaiting requested review from compulim compulim is a code owner
@cwhitten Chris Whitten (cwhitten) Awaiting requested review from cwhitten cwhitten is a code owner
@tdurnford Thomas Durnford (tdurnford) Awaiting requested review from tdurnford tdurnford is a code owner
@OEvgeny Eugene (OEvgeny) Awaiting requested review from OEvgeny OEvgeny is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant