Bump the npm_and_yarn group across 4 directories with 20 updates by dependabot[bot] · Pull Request #520 · ob-f/OpenBot

dependabot · 2026-07-10T21:25:34Z

Bumps the npm_and_yarn group with 1 update in the /controller/node-js/server directory: morgan.
Bumps the npm_and_yarn group with 9 updates in the /controller/web-server directory:

Package	From	To
ws	`7.5.9`	`7.5.11`
ws	`6.2.2`	`6.2.4`
ws	`8.17.1`	`8.21.0`
js-cookie	`3.0.5`	`3.0.7`
@babel/core	`7.22.9`	`7.29.7`
@babel/plugin-transform-modules-systemjs	`7.22.5`	`7.29.7`
@grpc/grpc-js	`1.9.15`	`1.9.16`
js-yaml	`3.14.1`	`removed`
postcss	`8.4.39`	`8.5.16`
shell-quote	`1.8.1`	`1.9.0`
vm2	`3.9.19`	`3.11.5`

Bumps the npm_and_yarn group with 5 updates in the /controller/web-server/server directory:

Package	From	To
morgan	`1.9.1`	`1.11.0`
ws	`7.5.10`	`7.5.11`
js-yaml	`3.14.1`	`removed`
shell-quote	`1.8.1`	`1.9.0`
path-to-regexp	`0.1.7`	`8.4.2`

Bumps the npm_and_yarn group with 9 updates in the /policy/frontend directory:

Package	From	To
@babel/plugin-transform-modules-systemjs	`7.12.1`	`7.29.7`
yaml	`1.10.0`	`1.10.3`
brace-expansion	`1.1.11`	`1.1.16`
form-data	`3.0.1`	`3.0.5`
js-yaml	`3.14.1`	`3.15.0`
picomatch	`2.2.2`	`2.3.2`
http-proxy-middleware	`1.0.6`	`2.0.10`
follow-redirects	`1.15.6`	`1.16.0`
lodash	`4.17.21`	`4.18.1`

Updates morgan from 1.9.1 to 1.11.0

Release notes

Sourced from morgan's releases.

1.11.0

What's Changed

feat: add :pid token by @ganesh3367 in expressjs/morgan#329

Security Fix:

Escape control characters in :remote-user token to prevent log injection

Fixes CVE-2026-5078 GHSA-4vj7-5mj6-jm8m

New Contributors

@inigomarquinez made their first contribution in expressjs/morgan#291

@jonchurch made their first contribution in expressjs/morgan#299

@bjohansebas made their first contribution in expressjs/morgan#301

@UlisesGascon made their first contribution in expressjs/morgan#300

@ctcpip made their first contribution in expressjs/morgan#319

@ganesh3367 made their first contribution in expressjs/morgan#329

Full Changelog: expressjs/morgan@1.10.0...1.11.0

1.10.1

What's Changed

renaming simple to sample in readme by @ryhinchey in expressjs/morgan#237

adding installation instructions to readme by @ryhinchey in expressjs/morgan#233

chore: add support for OSSF scorecard reporting by @inigomarquinez in expressjs/morgan#291

ci: replace travis with github actions by @inigomarquinez in expressjs/morgan#290

docs: add example output for log formats by @jonchurch in expressjs/morgan#299

ci: use ubuntu-latest by @bjohansebas in expressjs/morgan#301

ci: apply OSSF Scorecard security best practices by @UlisesGascon in expressjs/morgan#300

remove --bail by @jonchurch in expressjs/morgan#314

⬆️ bump on-headers by @ctcpip in expressjs/morgan#319

New Contributors

@inigomarquinez made their first contribution in expressjs/morgan#291

@jonchurch made their first contribution in expressjs/morgan#299

@bjohansebas made their first contribution in expressjs/morgan#301

@UlisesGascon made their first contribution in expressjs/morgan#300

@ctcpip made their first contribution in expressjs/morgan#319

Full Changelog: expressjs/morgan@1.10.0...1.10.1

1.10.0

Add :total-time token

Fix trailing space in colored status code for dev format

deps: basic-auth@~2.0.1

deps: safe-buffer@5.1.2

deps: depd@~2.0.0

Replace internal eval usage with Function constructor

Use instance methods on process to check for listeners

deps: on-headers@~1.0.2

Fix res.writeHead patch missing return value

Changelog

Sourced from morgan's changelog.

1.11.0 / 2026-06-02

add :pid token

Security Fix:

Escape control characters in :remote-user token to prevent log injection

Fixes CVE-2026-5078 GHSA-4vj7-5mj6-jm8m

1.10.1 / 2025-07-17

deps: on-headers@~1.1.0

Fix CVE-2025-7339 (GHSA-76c9-3jph-rj3q)

1.10.0 / 2020-03-20

Add :total-time token

Fix trailing space in colored status code for dev format

deps: basic-auth@~2.0.1

deps: safe-buffer@5.1.2

deps: depd@~2.0.0

Replace internal eval usage with Function constructor

Use instance methods on process to check for listeners

deps: on-headers@~1.0.2

Fix res.writeHead patch missing return value

Commits

e0e6f17 Release 1.11.0 (#350)
b3f5d9b Merge commit from fork
203c758 build(deps): bump github/codeql-action from 4.32.4 to 4.35.2 (#346)
002bc81 build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#347)
561b0d7 build(deps): bump actions/upload-artifact from 5.0.0 to 7.0.0 (#338)
2db705e build(deps): bump github/codeql-action from 3.29.7 to 4.32.4 (#337)
a373c5f build(deps): bump ossf/scorecard-action from 2.3.1 to 2.4.3 (#327)
c8e72fa build(deps): bump actions/checkout from 4.1.1 to 6.0.1 (#324)
023300e build(deps): bump actions/upload-artifact from 4.3.1 to 4.6.2 (#307)
9d8d6c0 build(deps): bump coverallsapp/github-action from 1.2.5 to 2.3.6 (#306)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for morgan since your current version.

Updates ws from 7.5.9 to 7.5.11

Release notes

Sourced from ws's releases.

7.5.11

Bug fixes

Backported 2b2abd45 to the 7.x release line (e14c4586).

7.5.10

Bug fixes

Backported e55e5106 to the 7.x release line (22c28763).

Commits

fd36cd8 [dist] 7.5.11
e14c458 [security] Limit retained message parts
d962d70 [dist] 7.5.10
22c2876 [security] Fix crash when the Upgrade header cannot be read (#2231)
See full diff in compare view

Updates ws from 6.2.2 to 6.2.4

Release notes

Sourced from ws's releases.

7.5.11

Bug fixes

Backported 2b2abd45 to the 7.x release line (e14c4586).

7.5.10

Bug fixes

Backported e55e5106 to the 7.x release line (22c28763).

Commits

fd36cd8 [dist] 7.5.11
e14c458 [security] Limit retained message parts
d962d70 [dist] 7.5.10
22c2876 [security] Fix crash when the Upgrade header cannot be read (#2231)
See full diff in compare view

Updates ws from 8.17.1 to 8.21.0

Release notes

Sourced from ws's releases.

7.5.11

Bug fixes

Backported 2b2abd45 to the 7.x release line (e14c4586).

7.5.10

Bug fixes

Backported e55e5106 to the 7.x release line (22c28763).

Commits

fd36cd8 [dist] 7.5.11
e14c458 [security] Limit retained message parts
d962d70 [dist] 7.5.10
22c2876 [security] Fix crash when the Upgrade header cannot be read (#2231)
See full diff in compare view

Updates js-cookie from 3.0.5 to 3.0.7

Release notes

Sourced from js-cookie's releases.

v3.0.7

Prevent cookie attribute injection: CVE-2026-46625 (eb3c40e)

Add Partitioned attribute to readme (b994768)

Publish to npm registry via trusted publisher exclusively (4dc71be)

Ensure consistent behaviour for get('name') + get() (1953d30)

Commits

17bacba Craft v3.0.7 release
adb823c Fix release workflow halting at git tag
5f9e759 May remove Git user config from release workflow
6ac9211 Fix release workflow not able to push commit + tag
2278bc5 Fix missing package version bump
eb3c40e Prevent cookie attribute injection
f6f157f Bump globals from 17.5.0 to 17.6.0
f409d02 Bump eslint from 10.2.0 to 10.3.0
a686883 Bump protobufjs in the npm_and_yarn group across 1 directory
c6112d2 Bump @protobufjs/utf8 in the npm_and_yarn group across 1 directory
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for js-cookie since your current version.

Updates @babel/core from 7.22.9 to 7.29.7

Release notes

Sourced from @babel/core's releases.

v7.29.7 (2026-05-25)

Re-release all packages with npm provenance attestations

v7.29.6 (2026-05-25)

🐛 Bug Fix

babel-generator

#18014 Catchup source map position in preserveFormat (@nicolo-ribaudo)

babel-core

#18001 [7.x packport]Improve input source map handling (@JLHwung)

babel-core, babel-generator

#17998 Preserve original identifier names from input sourcemaps (#17992) (@Andarist)

Committers: 3

Huáng Jùnliàng (@JLHwung)

Mateusz Burzyński (@Andarist)

Nicolò Ribaudo (@nicolo-ribaudo)

v7.29.5 (2026-05-05)

🏠 Internal

babel-preset-env

Update @babel/* dependencies

v7.29.4 (2026-05-05)

🐛 Bug Fix

babel-plugin-transform-modules-systemjs

#17974 [7.x backport]fix(systemjs): improve module string name support (@JLHwung)

Committers: 1

Huáng Jùnliàng (@JLHwung)

v7.29.3 (2026-04-30)

👓 Spec Compliance

babel-parser

#17923 Support flow extends bound (@JLHwung)

🐛 Bug Fix

babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators

#17931 fix(decorators): replace super within all removed static elements (@JLHwung)

babel-register

#17915 Fix thread synchronization issues in @babel/register (@liuxingbaoyu)

babel-compat-data, babel-plugin-bugfix-safari-rest-destructuring-rhs-array, babel-preset-env

#17788 Add bugfix plugin for Safari array rest destructuring bug (@JLHwung)

💅 Polish

babel-parser

... (truncated)

Commits

4fba754 v7.29.7
04ea6b2 v7.29.6
99f498a [7.x packport]Improve input source map handling (#18001)
feba0a3 Preserve original identifier names from input sourcemaps (#17992) (#17998)
aa8394e v7.29.0
ad0d03f [7.x backport] feat: Allow specifying startLine in code frame (#17739)
d7f4008 v7.28.6
e130225 Polish(standalone): improve message on invalid preset/plugin (#17606)
99dcba5 chore: enable some ts-eslint rules (#17592)
c92c491 Improve Unicode handling in code-frame tokenizer (#17589)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @babel/core since your current version.

Updates @babel/plugin-transform-modules-systemjs from 7.22.5 to 7.29.7

Release notes

Sourced from @babel/plugin-transform-modules-systemjs's releases.

v7.29.7 (2026-05-25)

Re-release all packages with npm provenance attestations

v7.29.6 (2026-05-25)

🐛 Bug Fix

babel-generator

#18014 Catchup source map position in preserveFormat (@nicolo-ribaudo)

babel-core

#18001 [7.x packport]Improve input source map handling (@JLHwung)

babel-core, babel-generator

#17998 Preserve original identifier names from input sourcemaps (#17992) (@Andarist)

Committers: 3

Huáng Jùnliàng (@JLHwung)

Mateusz Burzyński (@Andarist)

Nicolò Ribaudo (@nicolo-ribaudo)

v7.29.5 (2026-05-05)

🏠 Internal

babel-preset-env

Update @babel/* dependencies

v7.29.4 (2026-05-05)

🐛 Bug Fix

babel-plugin-transform-modules-systemjs

#17974 [7.x backport]fix(systemjs): improve module string name support (@JLHwung)

Committers: 1

Huáng Jùnliàng (@JLHwung)

v7.29.3 (2026-04-30)

👓 Spec Compliance

babel-parser

#17923 Support flow extends bound (@JLHwung)

🐛 Bug Fix

babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators

#17931 fix(decorators): replace super within all removed static elements (@JLHwung)

babel-register

#17915 Fix thread synchronization issues in @babel/register (@liuxingbaoyu)

babel-compat-data, babel-plugin-bugfix-safari-rest-destructuring-rhs-array, babel-preset-env

#17788 Add bugfix plugin for Safari array rest destructuring bug (@JLHwung)

💅 Polish

babel-parser

... (truncated)

Commits

4fba754 v7.29.7
a458f66 v7.29.4
32ebd5a [7.x backport]fix(systemjs): improve module string name support (#17974)
aa8394e v7.29.0
0053db6 Update polyfill packages (#17727)
61647ae v7.28.5
a177d55 [Babel 8] Use t.traverseFast to replace some path.traverse (#17518)
eebd3a0 v7.27.1
317e332 Enforce node protocol import (#17207)
fdc0fb5 [Babel 8] Bump nodejs requirements to ^20.19.0 || >= 22.12.0 (#17204)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @babel/plugin-transform-modules-systemjs since your current version.

Updates @grpc/grpc-js from 1.9.15 to 1.9.16

Release notes

Sourced from @grpc/grpc-js's releases.

@grpc/grpc-js 1.9.16

Fix a bug that could cause servers to crash when handling malformed requests (advisory GHSA-5375-pq7m-f5r2)

Fix a bug that could cause clients and servers to crash when handling malformed compressed messages (advisory GHSA-99f4-grh7-6pcq)

Commits

0acbec3 Merge pull request #3057 from murgatroid99/grpc-js_1.9.16
dc863ba Merge commit from fork
5174091 Merge commit from fork
343ef83 grpc-js: Bump version to 1.9.16
f7d3eec Make compression error a static string
b6dcfc3 Fix crashes when receiving malformed compressed data
1cf4bfa Fix server crash when handling invalid requests
1aec8d8 Merge pull request #2992 from murgatroid99/grpc-js_fix_buffer_type_1.9.x
b9797cf grpc-js: Declare buffer type to avoid build error
ff204f7 Merge pull request #2887 from murgatroid99/grpc-js-xds_preserve_type_state_1.9.x
Additional commits viewable in compare view

Updates protobufjs from 6.11.4 to 7.2.6

Release notes

Sourced from protobufjs's releases.

protobufjs: v7.2.6

7.2.6 (2024-01-16)

Bug Fixes

report missing import properly in loadSync (#1960) (af3ff83)

protobufjs: v7.2.5

7.2.5 (2023-08-21)

Bug Fixes

crash in comment parsing (#1890) (eaf9f0a)

deprecation warning for new Buffer (#1905) (e93286e)

possible infinite loop when parsing option (#1923) (f2a8620)

protobufjs: v7.2.4

7.2.4 (2023-06-23)

Bug Fixes

do not let setProperty change the prototype (#1899) (e66379f)

protobufjs: v7.2.3

7.2.3 (2023-03-27)

Bug Fixes

type names can be split into multiple tokens (#1877) (8817ee6)

protobufjs: v7.2.2

7.2.2 (2023-02-07)

Bug Fixes

do not allow to extend same field twice to prevent the error (#1784) (14f0536)

protobufjs: v7.2.1

7.2.1 (2023-02-02)

Bug Fixes

cli: fix relative path to Google pb files (#1859) (e42eea4)

Revert "fix: error should be thrown" (4489fa7)

... (truncated)

Changelog

Sourced from protobufjs's changelog.

7.2.6 (2024-01-16)

Bug Fixes

report missing import properly in loadSync (#1960) (af3ff83)

7.2.5 (2023-08-21)

Bug Fixes

crash in comment parsing (#1890) (eaf9f0a)

deprecation warning for new Buffer (#1905) (e93286e)

possible infinite loop when parsing option (#1923) (f2a8620)

7.2.4 (2023-06-23)

Bug Fixes

do not let setProperty change the prototype (#1899) (e66379f)

7.2.3 (2023-03-27)

Bug Fixes

type names can be split into multiple tokens (#1877) (8817ee6)

7.2.2 (2023-02-07)

Bug Fixes

do not allow to extend same field twice to prevent the error (#1784) (14f0536)

7.2.1 (2023-02-02)

Bug Fixes

cli: fix relative path to Google pb files (#1859) (e42eea4)

Revert "fix: error should be thrown" (4489fa7)

use bundled filename to fix common pb includes (#1860) (dce9a2e)

use ES5 style function syntax (#1830) (64e8936)

7.2.0 (2023-01-24)

... (truncated)

Commits

2f846fe chore: release master (#1962)
af3ff83 fix: report missing import properly in loadSync (#1960)
4436cc7 chore: release master (#1925)
e93286e fix: deprecation warning for new Buffer (#1905)
eaf9f0a fix: crash in comment parsing (#1890)
f2a8620 fix: possible infinite loop when parsing option (#1923)
42e5a9c chore: release master (#1900)
e66379f fix: do not let setProperty change the prototype (#1899)
56b1e64 chore: release master (#1879)
8817ee6 fix: type names can be split into multiple tokens (#1877)
Additional commits viewable in compare view

Install script changes

This version modifies prepublish script that runs during installation. Review the package contents before updating.

Removes js-yaml

Updates postcss from 8.4.39 to 8.5.16

Release notes

Sourced from postcss's releases.

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

Fixed declaration parsing performance (by @homanp).

8.5.14

Fixed custom syntax regression (by @43081j).

8.5.13

Fixed postcss-scss commend regression.

8.5.12

Fixed reading any file via user-generated CSS.

Added opts.unsafeMap to disable checks.

8.5.11

Fixed nested brackets parsing performance (by @offset).

8.5.10

Fixed XSS via unescaped </style> in non-bundler cases (by @TharVid).

8.5.9

Speed up source map encoding paring in case of the error.

8.5.8

Fixed Processor#version.

8.5.7

Improved source map annotation cleaning performance (by CodeAnt AI).

8.5.6

Fixed ContainerWithChildren type discriminating (by @Goodwine).

8.5.5

Fixed package.json→exports compatibility with some tools (by @JounQin).

8.5.4

Fixed Parcel compatibility issue (by @git-sumitchaudhary).

8.5.3

Added more details to Unknown word error (by @hiepxanh).

Fixed types (by @romainmenke).

Fixed docs (by @catnipan).

8.5.2

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

Fixed declaration parsing performance (by @homanp).

8.5.14

Fixed custom syntax regression (by @43081j).

8.5.13

Fixed postcss-scss commend regression.

8.5.12

Fixed reading any file via user-generated CSS.

Added opts.unsafeMap to disable checks.

8.5.11

Fixed nested brackets parsing performance (by @offset).

8.5.10

Fixed XSS via unescaped </style> in non-bundler cases (by @TharVid).

8.5.9

Speed up source map encoding paring in case of the error.

8.5.8

Fixed Processor#version.

8.5.7

Improved source map annotation cleaning performance (by CodeAnt AI).

8.5.6

Fixed ContainerWithChildren type discriminating (by @Goodwine).

8.5.5

... (truncated)

Commits

92ccc93 Release 8.5.16 version
818bdd6 Update formatting
46e4510 Fix Input#origin() returning incorrect position (#2036)
34942ce Fix tests
d4feed6 Don't clone root-less child nodes in container constructor (#2097)
da323fc Revert version update to fix old Node.js on CI
8863369 Update dependencies
3828982 Preserve node raws when rehydrating a JSON AST (#2100)
d1e80b8 Fix Node#rangeBy() ignoring index 0 (#2091)
b91e4a6 Fix Node.js 26 tests
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates shell-quote from 1.8.1 to 1.9.0

Changelog

Sourced from shell-quote's changelog.

v1.9.0 - 2026-06-24

Commits

[New] add types dca6e21

[Dev Deps] update eslint 9aa9e8f

[Fix] parse: finalize tokens in linear time (GHSA-395f-4hp3-45gv) 7ff5488

[actions] update workflows 75e8497

[actions] Windows + node 4/6/7: pin eslint to 9 before install, since npm 2/3 cannot stage eslint 10@types/esrecurse 3fb739d

[actions] retry npm install on Windows to survive npm 2/3 staging-rename flake abe0163

[actions] Windows + node 5/7: install deps with a modern node b4bafa2

[Fix] quote: escape leading ~ to prevent shell tilde-expansion 7a76c1a

[Dev Deps] update auto-changelog, tape 7184b44

[Dev Deps] apparently jackspeak is no longer in the graph 9ba368a

v1.8.4 - 2026-05-22

Commits

[Fix] quote: validate object-token shapes 4378a6e

[Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint, npmignore 22ebec0

[Tests] increase coverage 9f3caa3

[readme] replace runkit CI badge with shields.io check-runs badge 3344a04

[Dev Deps] update @ljharb/eslint-config 699c511

v1.8.3 - 2025-06-01

Fixed

[Fix] remove unnecessary backslash escaping in single quotes [#15](https://github.com/ljharb/shell-quote/issues/15)

v1.8.2 - 2024-11-27

Fixed

[Fix] quote: preserve empty strings [#18](https://github.com/ljharb/shell-quote/issues/18)

Commits

[meta] fix changelog tags 0fb9fd8

[actions] split out node 10-20, and 20+ 819bd84

[Dev Deps] update @ljharb/eslint-config, auto-changelog, npmignore, tape fc56408

[actions] update npm for windows tests fdeb0fd

[Dev Deps] update @ljharb/eslint-config, aud, tape b8a4a3b

[actions] prevent node 14 on ARM mac from failing 9eecafc

[meta] exclude more files from the package 4044e7f

[Tests] replace aud with npm audit 8cfdbd8

[meta] add missing engines.node 843820e

[Dev Deps] add missing peer dep 4c3b88d

[Dev Deps] pin jackspeak since 2.1.2+ depends on npm aliases, which kill the install process in npm < 6 80322ed

Commits

db09fc7 v1.9.0
7ff5488 [Fix] parse: finalize tokens in linear time (GHSA-395f-4hp3-45gv)
b4bafa2 [actions] Windows + node 5/7: install deps with a modern node
3fb739d [actions] Windows + node 4/6/7: pin eslint to 9 before install, since npm 2/3...
abe0163 [actions] retry npm install on Windows to survive npm 2/3 staging-rename flake
7a76c1a [Fix] quote: escape leading ~ to prevent shell tilde-expansion
75e8497 [actions] update workflows
dca6e21 [New] add types
9aa9e8f [Dev Deps] update eslint
9ba368a [Dev Deps] apparently jackspeak is no longer in the graph
Additional commits viewable in compare view

Updates undici from 5.28.4 to 6.19.7

Release notes

Sourced from undici's releases.

v6.19.7

Full Changelog: nodejs/undici@v6.19.6...v6.19.7

v6.19.6

Full Changelog: nodejs/undici@v6.19.5...v6.19.6

v6.19.5

Full Changelog: nodejs/undici@v6.19.4...v6.19.5

v6.19.4

Full Changelog: nodejs/undici@v6.19.3...v6.19.4

v6.19.3

Full Changelog: nodejs/undici@v6.19.2...v6.19.3

v6.19.2

What's Changed

fix #3337 by @KhafraDev in nodejs/undici#3338

build: use husky as husky install is deprecated by @jazelly in nodejs/undici#3340

fix: interceptors.d.ts has no default export by @Uzlopak in nodejs/undici#3332

Full Changelog: nodejs/undici@v6.19.1...v6.19.2

v6.19.1

What's Changed

don't append empty origin by @KhafraDev in nodejs/undici#3335

Full Changelog: nodejs/undici@v6.19.0...v6.19.1

v6.19.0

What's Changed

build(deps): bump ossf/scorecard-action from 2.3.1 to 2.3.3 by @dependabot in nodejs/undici#3305

build(deps): bump codecov/codecov-action from 4.3.1 to 4.4.1 by @dependabot in nodejs/undici#3303

build(deps): bump step-security/harden-runner from 2.7.1 to 2.8.0 by @dependabot in nodejs/undici#3304

build(deps): bump github/codeql-action from 3.25.3 to 3.25.7 by @dependabot in nodejs/undici#3306

build(deps): bump node from 9e8f45f to dd7e693 in /build by @dependabot in

Bumps the npm_and_yarn group with 1 update in the /controller/node-js/server directory: [morgan](https://github.com/expressjs/morgan). Bumps the npm_and_yarn group with 9 updates in the /controller/web-server directory: | Package | From | To | | --- | --- | --- | | [ws](https://github.com/websockets/ws) | `7.5.9` | `7.5.11` | | [ws](https://github.com/websockets/ws) | `6.2.2` | `6.2.4` | | [ws](https://github.com/websockets/ws) | `8.17.1` | `8.21.0` | | [js-cookie](https://github.com/js-cookie/js-cookie) | `3.0.5` | `3.0.7` | | [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) | `7.22.9` | `7.29.7` | | [@babel/plugin-transform-modules-systemjs](https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-modules-systemjs) | `7.22.5` | `7.29.7` | | [@grpc/grpc-js](https://github.com/grpc/grpc-node) | `1.9.15` | `1.9.16` | | [js-yaml](https://github.com/nodeca/js-yaml) | `3.14.1` | `removed` | | [postcss](https://github.com/postcss/postcss) | `8.4.39` | `8.5.16` | | [shell-quote](https://github.com/ljharb/shell-quote) | `1.8.1` | `1.9.0` | | [vm2](https://github.com/patriksimek/vm2) | `3.9.19` | `3.11.5` | Bumps the npm_and_yarn group with 5 updates in the /controller/web-server/server directory: | Package | From | To | | --- | --- | --- | | [morgan](https://github.com/expressjs/morgan) | `1.9.1` | `1.11.0` | | [ws](https://github.com/websockets/ws) | `7.5.10` | `7.5.11` | | [js-yaml](https://github.com/nodeca/js-yaml) | `3.14.1` | `removed` | | [shell-quote](https://github.com/ljharb/shell-quote) | `1.8.1` | `1.9.0` | | [path-to-regexp](https://github.com/pillarjs/path-to-regexp) | `0.1.7` | `8.4.2` | Bumps the npm_and_yarn group with 9 updates in the /policy/frontend directory: | Package | From | To | | --- | --- | --- | | [@babel/plugin-transform-modules-systemjs](https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-modules-systemjs) | `7.12.1` | `7.29.7` | | [yaml](https://github.com/eemeli/yaml) | `1.10.0` | `1.10.3` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.11` | `1.1.16` | | [form-data](https://github.com/form-data/form-data) | `3.0.1` | `3.0.5` | | [js-yaml](https://github.com/nodeca/js-yaml) | `3.14.1` | `3.15.0` | | [picomatch](https://github.com/micromatch/picomatch) | `2.2.2` | `2.3.2` | | [http-proxy-middleware](https://github.com/chimurai/http-proxy-middleware) | `1.0.6` | `2.0.10` | | [follow-redirects](https://github.com/follow-redirects/follow-redirects) | `1.15.6` | `1.16.0` | | [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.18.1` | Updates `morgan` from 1.9.1 to 1.11.0 - [Release notes](https://github.com/expressjs/morgan/releases) - [Changelog](https://github.com/expressjs/morgan/blob/master/HISTORY.md) - [Commits](expressjs/morgan@1.9.1...1.11.0) Updates `ws` from 7.5.9 to 7.5.11 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@7.5.9...7.5.11) Updates `ws` from 6.2.2 to 6.2.4 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@7.5.9...7.5.11) Updates `ws` from 8.17.1 to 8.21.0 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@7.5.9...7.5.11) Updates `js-cookie` from 3.0.5 to 3.0.7 - [Release notes](https://github.com/js-cookie/js-cookie/releases) - [Commits](js-cookie/js-cookie@v3.0.5...v3.0.7) Updates `@babel/core` from 7.22.9 to 7.29.7 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.7/packages/babel-core) Updates `@babel/plugin-transform-modules-systemjs` from 7.22.5 to 7.29.7 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.7/packages/babel-plugin-transform-modules-systemjs) Updates `@grpc/grpc-js` from 1.9.15 to 1.9.16 - [Release notes](https://github.com/grpc/grpc-node/releases) - [Commits](https://github.com/grpc/grpc-node/compare/@grpc/grpc-js@1.9.15...@grpc/grpc-js@1.9.16) Updates `protobufjs` from 6.11.4 to 7.2.6 - [Release notes](https://github.com/protobufjs/protobuf.js/releases) - [Changelog](https://github.com/protobufjs/protobuf.js/blob/master/CHANGELOG.md) - [Commits](protobufjs/protobuf.js@v6.11.4...protobufjs-v7.2.6) Removes `js-yaml` Updates `postcss` from 8.4.39 to 8.5.16 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.4.39...8.5.16) Updates `shell-quote` from 1.8.1 to 1.9.0 - [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md) - [Commits](ljharb/shell-quote@v1.8.1...v1.9.0) Updates `undici` from 5.28.4 to 6.19.7 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v5.28.4...v6.19.7) Updates `vm2` from 3.9.19 to 3.11.5 - [Release notes](https://github.com/patriksimek/vm2/releases) - [Changelog](https://github.com/patriksimek/vm2/blob/main/CHANGELOG.md) - [Commits](patriksimek/vm2@3.9.19...v3.11.5) Updates `morgan` from 1.9.1 to 1.11.0 - [Release notes](https://github.com/expressjs/morgan/releases) - [Changelog](https://github.com/expressjs/morgan/blob/master/HISTORY.md) - [Commits](expressjs/morgan@1.9.1...1.11.0) Updates `ws` from 7.5.10 to 7.5.11 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@7.5.9...7.5.11) Removes `js-yaml` Updates `shell-quote` from 1.8.1 to 1.9.0 - [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md) - [Commits](ljharb/shell-quote@v1.8.1...v1.9.0) Updates `path-to-regexp` from 0.1.7 to 8.4.2 - [Release notes](https://github.com/pillarjs/path-to-regexp/releases) - [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md) - [Commits](pillarjs/path-to-regexp@v0.1.7...v8.4.2) Updates `@babel/plugin-transform-modules-systemjs` from 7.12.1 to 7.29.7 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.7/packages/babel-plugin-transform-modules-systemjs) Updates `yaml` from 1.10.0 to 1.10.3 - [Release notes](https://github.com/eemeli/yaml/releases) - [Commits](eemeli/yaml@v1.10.0...v1.10.3) Updates `brace-expansion` from 1.1.11 to 1.1.16 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@1.1.11...v1.1.16) Updates `form-data` from 3.0.1 to 3.0.5 - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v3.0.1...v3.0.5) Updates `js-yaml` from 3.14.1 to 3.15.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/commits) Updates `picomatch` from 2.2.2 to 2.3.2 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@2.2.2...2.3.2) Updates `http-proxy-middleware` from 1.0.6 to 2.0.10 - [Release notes](https://github.com/chimurai/http-proxy-middleware/releases) - [Changelog](https://github.com/chimurai/http-proxy-middleware/blob/v2.0.10/CHANGELOG.md) - [Commits](chimurai/http-proxy-middleware@v1.0.6...v2.0.10) Updates `follow-redirects` from 1.15.6 to 1.16.0 - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.15.6...v1.16.0) Updates `lodash` from 4.17.21 to 4.18.1 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.18.1) --- updated-dependencies: - dependency-name: morgan dependency-version: 1.11.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 7.5.11 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 6.2.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 8.21.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: js-cookie dependency-version: 3.0.7 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@babel/core" dependency-version: 7.29.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@babel/plugin-transform-modules-systemjs" dependency-version: 7.29.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@grpc/grpc-js" dependency-version: 1.9.16 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: protobufjs dependency-version: 7.2.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.16 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: shell-quote dependency-version: 1.9.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 6.19.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: vm2 dependency-version: 3.11.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: morgan dependency-version: 1.11.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 7.5.11 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: shell-quote dependency-version: 1.9.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: path-to-regexp dependency-version: 8.4.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@babel/plugin-transform-modules-systemjs" dependency-version: 7.29.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: yaml dependency-version: 1.10.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.16 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: form-data dependency-version: 3.0.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 3.15.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 2.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: http-proxy-middleware dependency-version: 2.0.10 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: follow-redirects dependency-version: 1.16.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.18.1 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jul 10, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump the npm_and_yarn group across 4 directories with 20 updates#520

Bump the npm_and_yarn group across 4 directories with 20 updates#520
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/controller/node-js/server/npm_and_yarn-7fc8bfbce2

dependabot Bot commented on behalf of github Jul 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 10, 2026

1.11.0

What's Changed

New Contributors

1.10.1

What's Changed

New Contributors

1.10.0

1.11.0 / 2026-06-02

1.10.1 / 2025-07-17

1.10.0 / 2020-03-20

7.5.11

Bug fixes

7.5.10

Bug fixes

7.5.11

Bug fixes

7.5.10

Bug fixes

7.5.11

Bug fixes

7.5.10

Bug fixes

v3.0.7

v7.29.7 (2026-05-25)

v7.29.6 (2026-05-25)

🐛 Bug Fix

Committers: 3

v7.29.5 (2026-05-05)

🏠 Internal

v7.29.4 (2026-05-05)

🐛 Bug Fix

Committers: 1

v7.29.3 (2026-04-30)

👓 Spec Compliance

🐛 Bug Fix

💅 Polish

v7.29.7 (2026-05-25)

v7.29.6 (2026-05-25)

🐛 Bug Fix

Committers: 3

v7.29.5 (2026-05-05)

🏠 Internal

v7.29.4 (2026-05-05)

🐛 Bug Fix

Committers: 1

v7.29.3 (2026-04-30)

👓 Spec Compliance

🐛 Bug Fix

💅 Polish

@​grpc/grpc-js 1.9.16

protobufjs: v7.2.6

7.2.6 (2024-01-16)

Bug Fixes

protobufjs: v7.2.5

7.2.5 (2023-08-21)

Bug Fixes

protobufjs: v7.2.4

7.2.4 (2023-06-23)

Bug Fixes

protobufjs: v7.2.3

7.2.3 (2023-03-27)

Bug Fixes

protobufjs: v7.2.2

7.2.2 (2023-02-07)

Bug Fixes

protobufjs: v7.2.1

7.2.1 (2023-02-02)

Bug Fixes

7.2.6 (2024-01-16)

Bug Fixes

7.2.5 (2023-08-21)

Bug Fixes

7.2.4 (2023-06-23)

Bug Fixes

7.2.3 (2023-03-27)

Bug Fixes

7.2.2 (2023-02-07)

`@grpc/grpc-js` 1.9.16