Skip to content

Bump the npm_and_yarn group across 1 directory with 32 updates#4

Open
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/npm_and_yarn/npm_and_yarn-84d7a7f371
Open

Bump the npm_and_yarn group across 1 directory with 32 updates#4
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/npm_and_yarn/npm_and_yarn-84d7a7f371

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Feb 4, 2026

Bumps the npm_and_yarn group with 19 updates in the / directory:

Package From To
hoek 5.0.3 6.1.3
npm 4.6.1 11.9.0
angular 1.6.8 1.8.3
angular-sanitize 1.6.8 1.8.3
kind-of 6.0.2 6.0.3
async 2.6.0 2.6.4
bl 1.2.1 1.2.3
browserify-sign 4.0.4 4.2.5
cached-path-relative 1.0.1 1.1.0
cipher-base 1.0.4 1.0.7
decode-uri-component 0.2.0 0.2.2
flatnest 1.0.0 1.0.1
minimatch 3.0.4 3.1.2
json-schema 0.2.3 0.4.0
json5 0.5.1 2.2.3
lodash.merge 4.6.0 4.6.2
node-notifier 5.2.1 10.0.1
stringstream 0.0.5 0.0.6
secp256k1 3.5.0 3.8.1

Updates hoek from 5.0.3 to 6.1.3

Commits

Updates npm from 4.6.1 to 11.9.0

Release notes

Sourced from npm's releases.

v11.9.0

11.9.0 (2026-02-04)

Features

Bug Fixes

Dependencies

Chores

v11.8.0

11.8.0 (2026-01-21)

Features

  • 545e861 #8828 show proxy environment variables in npm config list (Max Black)

Bug Fixes

Documentation

Dependencies

Chores

... (truncated)

Changelog

Sourced from npm's changelog.

11.9.0 (2026-02-04)

Features

Bug Fixes

Dependencies

Chores

11.8.0 (2026-01-21)

Features

  • 545e861 #8828 show proxy environment variables in npm config list (Max Black)

Bug Fixes

Documentation

Dependencies

Chores

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by gar, a new releaser for npm since your current version.


Updates angular from 1.6.8 to 1.8.3

Changelog

Sourced from angular's changelog.

1.8.3 ultimate-farewell (2022-04-07)

One final release of AngularJS in order to update package README files on npm.

1.8.2 meteoric-mining (2020-10-21)

Bug Fixes

  • $sceDelegate: ensure that resourceUrlWhitelist() is identical to trustedResourceUrlList() (e41f01, #17090)

1.8.1 mutually-supporting (2020-09-30)

Bug Fixes

  • $sanitize: do not trigger CSP alert/report in Firefox and Chrome (2fab3d)

Refactorings

  • SanitizeUriProvider: remove usages of whitelist (76738102)
  • httpProvider: remove usages of whitelist and blacklist (c953af6b)
  • sceDelegateProvider: remove usages of whitelist and blacklist (a206e267)

Deprecation Notices

For the purposes of backward compatibility, the previous symbols are aliased to their new symbol.

1.8.0 nested-vaccination (2020-06-01)

_This release contains a breaking change to resolve a security issue which was discovered by Krzysztof Kotowicz(@​koto); and independently by Esben Sparre Andreasen (@​esbena) while

... (truncated)

Commits
  • cf16b24 docs(changelog): add release notes for 1.8.3
  • 757d56e docs(*): update end-of-life messages (#17177)
  • f362437 docs(eol): add EOL options text and link to template header used in every page
  • fb04e42 test(Angular): fix angularInit() tests on Safari v15+
  • 6a52c4f test(input): fix tests on Firefox v93+
  • ed30c4d docs(README.md): add wiki link to MVC
  • 4032655 chore(deps): bump js-yaml from 3.5.5 to 3.14.1
  • 47f8c65 chore(deps): bump normalize-url from 4.5.0 to 4.5.1
  • 56b0ee3 chore(e2e): run tests against Chrome 91 on macOS Catalina
  • 58cd897 chore(e2e): run tests against Firefox 85 on macOS Catalina
  • Additional commits viewable in compare view

Updates angular-sanitize from 1.6.8 to 1.8.3

Changelog

Sourced from angular-sanitize's changelog.

1.8.3 ultimate-farewell (2022-04-07)

One final release of AngularJS in order to update package README files on npm.

1.8.2 meteoric-mining (2020-10-21)

Bug Fixes

  • $sceDelegate: ensure that resourceUrlWhitelist() is identical to trustedResourceUrlList() (e41f01, #17090)

1.8.1 mutually-supporting (2020-09-30)

Bug Fixes

  • $sanitize: do not trigger CSP alert/report in Firefox and Chrome (2fab3d)

Refactorings

  • SanitizeUriProvider: remove usages of whitelist (76738102)
  • httpProvider: remove usages of whitelist and blacklist (c953af6b)
  • sceDelegateProvider: remove usages of whitelist and blacklist (a206e267)

Deprecation Notices

For the purposes of backward compatibility, the previous symbols are aliased to their new symbol.

1.8.0 nested-vaccination (2020-06-01)

_This release contains a breaking change to resolve a security issue which was discovered by Krzysztof Kotowicz(@​koto); and independently by Esben Sparre Andreasen (@​esbena) while

... (truncated)

Commits
  • cf16b24 docs(changelog): add release notes for 1.8.3
  • 757d56e docs(*): update end-of-life messages (#17177)
  • f362437 docs(eol): add EOL options text and link to template header used in every page
  • fb04e42 test(Angular): fix angularInit() tests on Safari v15+
  • 6a52c4f test(input): fix tests on Firefox v93+
  • ed30c4d docs(README.md): add wiki link to MVC
  • 4032655 chore(deps): bump js-yaml from 3.5.5 to 3.14.1
  • 47f8c65 chore(deps): bump normalize-url from 4.5.0 to 4.5.1
  • 56b0ee3 chore(e2e): run tests against Chrome 91 on macOS Catalina
  • 58cd897 chore(e2e): run tests against Firefox 85 on macOS Catalina
  • Additional commits viewable in compare view

Updates ajv from 4.11.4 to 4.11.8

Release notes

Sourced from ajv's releases.

4.11.7

The last release before 5.0.0

Commits

Updates kind-of from 6.0.2 to 6.0.3

Changelog

Sourced from kind-of's changelog.

[6.0.3] - 2020-01-16

  • Merge pull request #31 for issue #30

[6.0.0] - 2017-10-13

  • refactor code to be more performant
  • refactor benchmarks

[5.1.0] - 2017-10-13

Added

  • Merge pull request #15 from aretecode/patch-1
  • adds support and tests for string & array iterators

Changed

  • updates benchmarks

[5.0.2] - 2017-08-02

  • Merge pull request #14 from struct78/master
  • Added undefined check

[5.0.0] - 2017-06-21

  • Merge pull request #12 from aretecode/iterator
  • Set Iterator + Map Iterator
  • streamline isbuffer, minor edits

[4.0.0] - 2017-05-19

  • Merge pull request #8 from tunnckoCore/master
  • update deps

[3.2.2] - 2017-05-16

  • fix version

[3.2.1] - 2017-05-16

  • add browserify

[3.2.0] - 2017-04-25

  • Merge pull request #10 from ksheedlo/unrequire-buffer
  • add promise support and tests
  • Remove unnecessary Buffer check

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by doowb, a new releaser for kind-of since your current version.


Updates async from 2.6.0 to 2.6.4

Changelog

Sourced from async's changelog.

v2.6.4

  • Fix potential prototype pollution exploit (#1828)

v2.6.3

  • Updated lodash to squelch a security warning (#1675)

v2.6.2

  • Updated lodash to squelch a security warning (#1620)

v2.6.1

  • Updated lodash to prevent npm audit warnings. (#1532, #1533)
  • Made async-es more optimized for webpack users (#1517)
  • Fixed a stack overflow with large collections and a synchronous iterator (#1514)
  • Various small fixes/chores (#1505, #1511, #1527, #1530)
Commits
Maintainer changes

This version was pushed to npm by hargasinski, a new releaser for async since your current version.


Updates bl from 1.2.1 to 1.2.3

Release notes

Sourced from bl's releases.

v1.2.2

  • use safe-buffer #51
Commits

Updates brace-expansion from 1.1.6 to 1.1.8

Commits

Updates browserify-sign from 4.0.4 to 4.2.5

Changelog

Sourced from browserify-sign's changelog.

v4.2.5 - 2025-09-24

Commits

  • [Tests] clean up tests and convert console info skips to tape skips 37b083c
  • [Fix] restore node 0.10 support faade86
  • [Deps] update parse-asn1 5a0f159
  • [actions] drop unsupported nodes from CI 106be97

v4.2.4 - 2025-09-22

Commits

  • [actions] split out node 10-20, and 20+ 17920d9
  • [meta] remove files field 6d5b280
  • [Deps] update bn.js, browserify-rsa, elliptic 31be0c2
  • [Dev Deps] update @ljharb/eslint-config, auto-changelog, semver, tape 5f66982
  • [Tests] replace aud with npm audit d44b24d
  • [Dev Deps] add missing peer dep ab975f4
  • [Deps] revert 9e2bf12, now that v3.1.1 is out 428cf7f

v4.2.3 - 2024-03-05

Commits

v4.2.2 - 2023-10-25

Fixed

Commits

  • Only apps should have lockfiles 09a8995
  • [eslint] switch to eslint 83fe463
  • [meta] add npmignore and auto-changelog 4418183
  • [meta] fix package.json indentation 9ac5a5e
  • [Tests] migrate from travis to github actions d845d85
  • [Fix] sign: throw on unsupported padding scheme 8767739
  • [Fix] properly check the upper bound for DSA signatures 85994cd
  • [Tests] handle openSSL not supporting a scheme f5f17c2

... (truncated)

Commits
  • d3a7458 v4.2.5
  • 37b083c [Tests] clean up tests and convert console info skips to tape skips
  • faade86 [Fix] restore node 0.10 support
  • 5a0f159 [Deps] update parse-asn1
  • 106be97 [actions] drop unsupported nodes from CI
  • 9c37172 v4.2.4
  • 6d5b280 [meta] remove files field
  • 17920d9 [actions] split out node 10-20, and 20+
  • 31be0c2 [Deps] update bn.js, browserify-rsa, elliptic
  • ab975f4 [Dev Deps] add missing peer dep
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by ljharb, a new releaser for browserify-sign since your current version.


Updates cached-path-relative from 1.0.1 to 1.1.0

Commits

Updates cipher-base from 1.0.4 to 1.0.7

Changelog

Sourced from cipher-base's changelog.

v1.0.7 - 2025-09-24

Commits

  • [Refactor] use to-buffer fd1e5ee
  • [Dev Deps] update @ljharb/eslint-config 08ba803

v1.0.6 - 2024-11-26

Commits

  • [Fix] io.js 3.0 - Node.js 5.3 typed array support b7ddd2a

v1.0.5 - 2024-11-17

Commits

  • [Tests] standard -> eslint, make test dir, etc ae02fd6
  • [Tests] migrate from travis to GHA 66387d7
  • [meta] fix package.json indentation 5c02918
  • [Fix] return valid values on multi-byte-wide TypedArray input 8fd1364
  • [meta] add auto-changelog 88dc806
  • [meta] add npmignore and safe-publish-latest 7a137d7
  • Only apps should have lockfiles 42528f2
  • [Deps] update inherits, safe-buffer 0e7a2d9
  • [meta] add missing engines.node f2dc13e
Commits
  • 0056718 v1.0.7
  • fd1e5ee [Refactor] use to-buffer
  • 08ba803 [Dev Deps] update @ljharb/eslint-config
  • f5249f9 v1.0.6
  • b7ddd2a [Fix] io.js 3.0 - Node.js 5.3 typed array support
  • f03cebf v1.0.5
  • 88dc806 [meta] add auto-changelog
  • 7a137d7 [meta] add npmignore and safe-publish-latest
  • 5c02918 [meta] fix package.json indentation
  • 8fd1364 [Fix] return valid values on multi-byte-wide TypedArray input
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by ljharb, a new releaser for cipher-base since your current version.


Updates decode-uri-component from 0.2.0 to 0.2.2

Release notes

Sourced from decode-uri-component's releases.

v0.2.2

  • Prevent overwriting previously decoded tokens 980e0bf

SamVerschueren/decode-uri-component@v0.2.1...v0.2.2

v0.2.1

  • Switch to GitHub workflows 76abc93
  • Fix issue where decode throws - fixes #6 746ca5d
  • Update license (#1) 486d7e2
  • Tidelift tasks a650457
  • Meta tweaks 66e1c28

SamVerschueren/decode-uri-component@v0.2.0...v0.2.1

Commits

Updates flatnest from 1.0.0 to 1.0.1

Commits

Updates form-data from 2.1.2 to 2.1.4

Release notes

Sourced from form-data's releases.

Proper toString

Broken version

No release notes provided.

Changelog

Sourced from form-data's changelog.

v2.1.4 - 2017-04-08

2.1.3 - 2017-04-08

v2.1.3 - 2017-04-08

Merged

Description has been truncated

@dependabot
Bump the npm_and_yarn group across 1 directory with 32 updates
dc753a0 
Bumps the npm_and_yarn group with 19 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [hoek](https://github.com/hapijs/hoek) | `5.0.3` | `6.1.3` |
| [npm](https://github.com/npm/cli) | `4.6.1` | `11.9.0` |
| [angular](https://github.com/angular/angular.js) | `1.6.8` | `1.8.3` |
| [angular-sanitize](https://github.com/angular/angular.js) | `1.6.8` | `1.8.3` |
| [kind-of](https://github.com/jonschlinkert/kind-of) | `6.0.2` | `6.0.3` |
| [async](https://github.com/caolan/async) | `2.6.0` | `2.6.4` |
| [bl](https://github.com/rvagg/bl) | `1.2.1` | `1.2.3` |
| [browserify-sign](https://github.com/crypto-browserify/browserify-sign) | `4.0.4` | `4.2.5` |
| [cached-path-relative](https://github.com/ashaffer/cached-path-relative) | `1.0.1` | `1.1.0` |
| [cipher-base](https://github.com/crypto-browserify/cipher-base) | `1.0.4` | `1.0.7` |
| [decode-uri-component](https://github.com/SamVerschueren/decode-uri-component) | `0.2.0` | `0.2.2` |
| [flatnest](https://github.com/brycebaril/node-flatnest) | `1.0.0` | `1.0.1` |
| [minimatch](https://github.com/isaacs/minimatch) | `3.0.4` | `3.1.2` |
| [json-schema](https://github.com/kriszyp/json-schema) | `0.2.3` | `0.4.0` |
| [json5](https://github.com/json5/json5) | `0.5.1` | `2.2.3` |
| [lodash.merge](https://github.com/lodash/lodash) | `4.6.0` | `4.6.2` |
| [node-notifier](https://github.com/mikaelbr/node-notifier) | `5.2.1` | `10.0.1` |
| [stringstream](https://github.com/mhart/StringStream) | `0.0.5` | `0.0.6` |
| [secp256k1](https://github.com/cryptocoinjs/secp256k1-node) | `3.5.0` | `3.8.1` |



Updates `hoek` from 5.0.3 to 6.1.3
- [Release notes](https://github.com/hapijs/hoek/releases)
- [Commits](hapijs/hoek@v5.0.3...v6.1.3)

Updates `npm` from 4.6.1 to 11.9.0
- [Release notes](https://github.com/npm/cli/releases)
- [Changelog](https://github.com/npm/cli/blob/latest/CHANGELOG.md)
- [Commits](npm/cli@v4.6.1...v11.9.0)

Updates `angular` from 1.6.8 to 1.8.3
- [Changelog](https://github.com/angular/angular.js/blob/master/CHANGELOG.md)
- [Commits](angular/angular.js@v1.6.8...v1.8.3)

Updates `angular-sanitize` from 1.6.8 to 1.8.3
- [Changelog](https://github.com/angular/angular.js/blob/master/CHANGELOG.md)
- [Commits](angular/angular.js@v1.6.8...v1.8.3)

Updates `ajv` from 4.11.4 to 4.11.8
- [Release notes](https://github.com/ajv-validator/ajv/releases)
- [Commits](https://github.com/ajv-validator/ajv/commits/4.11.8)

Updates `kind-of` from 6.0.2 to 6.0.3
- [Changelog](https://github.com/jonschlinkert/kind-of/blob/master/CHANGELOG.md)
- [Commits](jonschlinkert/kind-of@6.0.2...6.0.3)

Updates `async` from 2.6.0 to 2.6.4
- [Release notes](https://github.com/caolan/async/releases)
- [Changelog](https://github.com/caolan/async/blob/v2.6.4/CHANGELOG.md)
- [Commits](caolan/async@v2.6.0...v2.6.4)

Updates `bl` from 1.2.1 to 1.2.3
- [Release notes](https://github.com/rvagg/bl/releases)
- [Changelog](https://github.com/rvagg/bl/blob/master/CHANGELOG.md)
- [Commits](rvagg/bl@v1.2.1...v1.2.3)

Updates `brace-expansion` from 1.1.6 to 1.1.8
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.6...v1.1.8)

Updates `browserify-sign` from 4.0.4 to 4.2.5
- [Changelog](https://github.com/browserify/browserify-sign/blob/main/CHANGELOG.md)
- [Commits](browserify/browserify-sign@v4.0.4...v4.2.5)

Updates `cached-path-relative` from 1.0.1 to 1.1.0
- [Commits](https://github.com/ashaffer/cached-path-relative/commits)

Updates `cipher-base` from 1.0.4 to 1.0.7
- [Changelog](https://github.com/browserify/cipher-base/blob/master/CHANGELOG.md)
- [Commits](browserify/cipher-base@v1.0.4...v1.0.7)

Updates `decode-uri-component` from 0.2.0 to 0.2.2
- [Release notes](https://github.com/SamVerschueren/decode-uri-component/releases)
- [Commits](SamVerschueren/decode-uri-component@v0.2.0...v0.2.2)

Updates `flatnest` from 1.0.0 to 1.0.1
- [Commits](https://github.com/brycebaril/node-flatnest/commits)

Updates `form-data` from 2.1.2 to 2.1.4
- [Release notes](https://github.com/form-data/form-data/releases)
- [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md)
- [Commits](form-data/form-data@v2.1.2...v2.1.4)

Updates `minimatch` from 3.0.4 to 3.1.2
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v3.0.4...v3.1.2)

Updates `hosted-git-info` from 2.4.2 to 2.5.0
- [Release notes](https://github.com/npm/hosted-git-info/releases)
- [Changelog](https://github.com/npm/hosted-git-info/blob/main/CHANGELOG.md)
- [Commits](npm/hosted-git-info@v2.4.2...v2.5.0)

Updates `ini` from 1.3.4 to 1.3.8
- [Release notes](https://github.com/npm/ini/releases)
- [Changelog](https://github.com/npm/ini/blob/main/CHANGELOG.md)
- [Commits](npm/ini@v1.3.4...v1.3.8)

Updates `json-schema` from 0.2.3 to 0.4.0
- [Commits](kriszyp/json-schema@v0.2.3...v0.4.0)

Updates `json5` from 0.5.1 to 2.2.3
- [Release notes](https://github.com/json5/json5/releases)
- [Changelog](https://github.com/json5/json5/blob/main/CHANGELOG.md)
- [Commits](json5/json5@v0.5.1...v2.2.3)

Updates `lodash.merge` from 4.6.0 to 4.6.2
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](https://github.com/lodash/lodash/commits)

Updates `micromatch` from 3.1.5 to 4.0.8
- [Release notes](https://github.com/micromatch/micromatch/releases)
- [Changelog](https://github.com/micromatch/micromatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/micromatch@3.1.5...4.0.8)

Updates `node-notifier` from 5.2.1 to 10.0.1
- [Changelog](https://github.com/mikaelbr/node-notifier/blob/master/CHANGELOG.md)
- [Commits](mikaelbr/node-notifier@v5.2.1...v10.0.1)

Updates `chownr` from 1.0.1 to 3.0.0
- [Commits](isaacs/chownr@v1.0.1...v3.0.0)

Updates `npm-user-validate` from 0.1.5 to 4.0.0
- [Release notes](https://github.com/npm/npm-user-validate/releases)
- [Changelog](https://github.com/npm/npm-user-validate/blob/main/CHANGELOG.md)
- [Commits](npm/npm-user-validate@v0.1.5...v4.0.0)

Updates `stringstream` from 0.0.5 to 0.0.6
- [Commits](mhart/StringStream@v0.0.5...v0.0.6)

Updates `tough-cookie` from 2.3.2 to 2.3.3
- [Release notes](https://github.com/salesforce/tough-cookie/releases)
- [Changelog](https://github.com/salesforce/tough-cookie/blob/master/CHANGELOG.md)
- [Commits](salesforce/tough-cookie@v2.3.2...v2.3.3)

Updates `tar` from 2.2.1 to 7.5.7
- [Release notes](https://github.com/isaacs/node-tar/releases)
- [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md)
- [Commits](isaacs/node-tar@v2.2.1...v7.5.7)

Updates `path-parse` from 1.0.5 to 1.0.7
- [Commits](https://github.com/jbgutierrez/path-parse/commits/v1.0.7)

Updates `pbkdf2` from 3.0.14 to 3.1.5
- [Changelog](https://github.com/browserify/pbkdf2/blob/master/CHANGELOG.md)
- [Commits](browserify/pbkdf2@v3.0.14...v3.1.5)

Updates `secp256k1` from 3.5.0 to 3.8.1
- [Release notes](https://github.com/cryptocoinjs/secp256k1-node/releases)
- [Commits](cryptocoinjs/secp256k1-node@v3.5.0...v3.8.1)

Updates `sha.js` from 2.4.10 to 2.4.12
- [Changelog](https://github.com/browserify/sha.js/blob/master/CHANGELOG.md)
- [Commits](browserify/sha.js@v2.4.10...v2.4.12)

---
updated-dependencies:
- dependency-name: hoek
  dependency-version: 6.1.3
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: npm
  dependency-version: 11.9.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: angular
  dependency-version: 1.8.3
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: angular-sanitize
  dependency-version: 1.8.3
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: ajv
  dependency-version: 4.11.8
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: kind-of
  dependency-version: 6.0.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: async
  dependency-version: 2.6.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: bl
  dependency-version: 1.2.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 1.1.8
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: browserify-sign
  dependency-version: 4.2.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: cached-path-relative
  dependency-version: 1.1.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: cipher-base
  dependency-version: 1.0.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: decode-uri-component
  dependency-version: 0.2.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: flatnest
  dependency-version: 1.0.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: form-data
  dependency-version: 2.1.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: minimatch
  dependency-version: 3.1.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: hosted-git-info
  dependency-version: 2.5.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ini
  dependency-version: 1.3.8
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: json-schema
  dependency-version: 0.4.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: json5
  dependency-version: 2.2.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: lodash.merge
  dependency-version: 4.6.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: micromatch
  dependency-version: 4.0.8
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: node-notifier
  dependency-version: 10.0.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: chownr
  dependency-version: 3.0.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: npm-user-validate
  dependency-version: 4.0.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: stringstream
  dependency-version: 0.0.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: tough-cookie
  dependency-version: 2.3.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: tar
  dependency-version: 7.5.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: path-parse
  dependency-version: 1.0.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: pbkdf2
  dependency-version: 3.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: secp256k1
  dependency-version: 3.8.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: sha.js
  dependency-version: 2.4.12
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Feb 4, 2026
@socket-security
Copy link

socket-security bot commented Feb 4, 2026

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedhoek@​5.0.3 ⏵ 6.1.3100 +18575 -450100
Updatedangular-sanitize@​1.6.8 ⏵ 1.8.31009992 +150100
Updatedangular@​1.6.8 ⏵ 1.8.310076 +793 +150100
Updatedbabelify@​7.3.0 ⏵ 10.0.0100 +110010075100
Updatedgulp-notify@​3.2.0 ⏵ 5.0.010010010080100
Updatednpm@​4.6.1 ⏵ 11.9.081 +3100 +5091 -997 +380
Updatedopen@​0.0.5 ⏵ 11.0.0100100 +75100 +2683100
Updatedgulp@​3.9.1 ⏵ 5.0.1100 +110010083100

View full report

@socket-security
Copy link

socket-security bot commented Feb 4, 2026

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm npm is 94.0% likely obfuscated

Confidence: 0.94

Location: Package overview

From: package-lock.json → npm/npm@11.9.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/npm@11.9.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants