chore(deps): bump the npm_and_yarn group across 2 directories with 29 updates #27

dependabot · 2025-12-31T16:52:58Z

Bumps the npm_and_yarn group with 25 updates in the /internal/remediation/fixtures/santatracker directory:

Package	From	To
dat.gui	`0.7.3`	`0.7.8`
firebase	`8.10.0`	`10.9.0`
google-closure-library	`v20190909.0.0`	`20200315.0.0`
json5	`2.1.0`	`2.2.3`
rollup	`2.59.0`	`2.79.2`
terser	`3.10.11`	`4.8.1`
tmp	`0.0.33`	`0.2.4`
@babel/traverse	`7.6.0`	`7.28.5`
@grpc/grpc-js	`1.4.2`	`1.14.3`
y18n	`4.0.0`	`4.0.3`
yargs-parser	`10.1.0`	`22.0.0`
acorn	`7.1.0`	`7.4.1`
acorn	`6.0.2`	`6.4.2`
ajv	`5.5.2`	`6.12.6`
braces	`3.0.2`	`3.0.3`
cross-spawn	`6.0.5`	`6.0.6`
get-func-name	`2.0.0`	`2.0.2`
glob-parent	`5.0.0`	`5.1.2`
ws	`7.1.2`	`7.5.10`
ws	`6.2.1`	`6.2.3`
json-schema	`0.2.3`	`0.4.0`
jws	`4.0.0`	`4.0.1`
minimatch	`3.0.4`	`3.1.2`
node-forge	`0.10.0`	`1.3.3`
path-parse	`1.0.6`	`1.0.7`
pathval	`1.1.0`	`1.1.1`
postcss	`7.0.5`	`8.5.6`

Bumps the npm_and_yarn group with 1 update in the /internal/resolution/manifest/fixtures directory: lodash.

Updates dat.gui from 0.7.3 to 0.7.8

Release notes

Sourced from dat.gui's releases.

0.7.8

Fix ReDos in CSS_RGB and CSS_RGBA #279

0.7.7

No release notes provided.

0.7.6

No release notes provided.

0.7.5

No release notes provided.

0.7.4

No release notes provided.

Commits

6a444cc 0.7.8
103be80 Removed CHANGELOG.md
f720c72 Merge pull request #279 from yetingli/master
40f4fc1 Remove link to defunct tutorial.
1e1aecb Fix ReDos in CSS_RGB and CSS_RGBA
51d1a37 Merge pull request #274 from dataarts/dependabot/npm_and_yarn/lodash-4.17.19
28b15c6 Bump lodash from 4.17.15 to 4.17.19
071edeb Use primitive type instead of nullable boxed type
92cebb3 Re-lint.
b290bf7 Update lint rules.
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by mrdoob, a new releaser for dat.gui since your current version.

Updates firebase from 8.10.0 to 10.9.0

Commits

1eb302f Version Packages (#8063)
b498867 Merge master into release
ce88e71 snapshot listeners source from cache (#7982)
6d487d7 Prevent using authTokenSyncURL if the string begins with a double slash (#8060)
b4d59d6 Merge master into release
2b22838 Fix glob pattern to work with Node 20 and its NPM version (#8059)
feb5038 Update CI node.js versions to 20.x (#8055)
245dd26 Enforce authTokenSyncURL being a path and not a url. (#8056)
e60188d Version Packages (#8046)
7e2efbf Merge master into release
Additional commits viewable in compare view

Updates google-closure-library from v20190909.0.0 to 20200315.0.0

Release notes

Sourced from google-closure-library's releases.

Closure Library v20200315

New Additions

Add SafeHtml.comment.

Security Fixes

Fixes CVE-2020-8910.

Backwards Incompatible Changes

Delete inlay css styles, which are not actually used by Closure.

Add non-nullable modifier to return type of functions never returning null.

Remove forwardDeclares from Closure Events Listenable by reducing the typing of the event key's src property to just Listenable, instead of Listenable|EventTarget. Note that EventTarget is the primary implementation of Listenable.

Other Changes

Added SafeUrl.fromMediaSource()

Fix authority parsing in Closure URI parser.

Document mode is now based on user agent on IE if not present in document

Add a define to module manager so that we can control module loading behaviors.

Add non-nullable modifier to return type of functions never returning null.

goog.isArray in deprecated in favor of Array.isArray

Update Thenable.then rejection handler JSDoc to reflect actual functionality.

Closure Library v20200224

New Additions

Create goog.debug.deepFreeze.

Added goog.async.promises.allMapsValues utility function

Backwards Incompatible Changes

AbstractRange.prototype.getTextRange(s) now return AbstractRange instead of the specific TextRange subclass

Other Changes

Remove some forwardDeclares from closure labs net.

Remove forwardDeclares from closure/graphics.

Remove forwardDeclare from closure/fs.

Linkify matching {} and () in URL like https://g\.com?res\{x=3\}

The functions allowed by the CSS sanitizer are now case insensitive.

Replace uses of goog.isArray in preparation for its removal

Remove special case for ie6-ie10 in nexttick.

Remove some forwardDeclares from closure/net.

Remove forwardDeclares from various Closure packages.

Closure Library v20200204

Note: the last two releases were not pushed to npm. To keep a complete changelog these release notes include the last two as well.

New Additions

Add TrustedResourceUrl.fromSafeScript().

New htmlsanitizer builder API addition.

Extract the version from Headless Chrome user-agent strings.

Backwards Incompatible Changes

goog.net.WebSocket no longer accepts direct autoReconnect and getNextReconnect arguments; specify these as fields in an options object instead.

... (truncated)

Commits

c6e4fe0 Bump version.
2fb2c6d Migrate goog.forwardDeclare to goog.requireType.
ade336a Migrate goog.forwardDeclare to goog.requireType.
964e8f3 RELNOTES[NEW]: Add SafeHtml.comment.
a93d568 RELNOTES: Add non-nullable modifier to return type of functions never returni...
294fc00 Fix authority parsing in Closure URI parser.
49624ab Add a define to module manager so that we can control module loading behaviors.
5845fb1 Removed the legacy buffering-proxy detection (aka test-channel).
f4c4443 Add non-nullable modifier to return type of functions never returning null.
60f4a9c Add non-nullable modifier to return type of functions never returning null.
Additional commits viewable in compare view

Updates json5 from 2.1.0 to 2.2.3

Release notes

Sourced from json5's releases.

v2.2.3

Fix: [email protected] is now the 'latest' release according to npm instead of v1.0.2. (#299)

v2.2.2

Fix: Properties with the name __proto__ are added to objects and arrays. (#199) This also fixes a prototype pollution vulnerability reported by Jonathan Gregson! (#295).

v2.2.1

Fix: Removed dependence on minimist to patch CVE-2021-44906. (#266)

v2.2.0

New: Accurate and documented TypeScript declarations are now included. There is no need to install @types/json5. (#236, #244)

v2.1.3 [code, diff]

Fix: An out of memory bug when parsing numbers has been fixed. (#228, #229)

v2.1.2

Fix: Bump minimist to v1.2.5. (#222)

v2.1.1

New: package.json and package.json5 include a module property so bundlers like webpack, rollup and parcel can take advantage of the ES Module build. (#208)

Fix: stringify outputs \0 as \\x00 when followed by a digit. (#210)

Fix: Spelling mistakes have been fixed. (#196)

Changelog

Sourced from json5's changelog.

v2.2.3 [code, diff]

Fix: [email protected] is now the 'latest' release according to npm instead of v1.0.2. (#299)

v2.2.2 [code, diff]

Fix: Properties with the name __proto__ are added to objects and arrays. (#199) This also fixes a prototype pollution vulnerability reported by Jonathan Gregson! (#295).

v2.2.1 [code, diff]

Fix: Removed dependence on minimist to patch CVE-2021-44906. (#266)

v2.2.0 [code, diff]

New: Accurate and documented TypeScript declarations are now included. There is no need to install @types/json5. (#236, #244)

v2.1.3 [code, diff]

Fix: An out of memory bug when parsing numbers has been fixed. (#228, #229)

v2.1.2 [code, diff]

Fix: Bump minimist to v1.2.5. (#222)

v2.1.1 [code, [diff][d2.1.1]]

... (truncated)

Commits

c3a7524 2.2.3
94fd06d docs: update CHANGELOG for v2.2.3
3b8cebf docs(security): use GitHub security advisories
f0fd9e1 docs: publish a security policy
6a91a05 docs(template): bug -> bug report
14f8cb1 2.2.2
10cc7ca docs: update CHANGELOG for v2.2.2
7774c10 fix: add proto to objects and arrays
edde30a Readme: slight tweak to intro
97286f8 Improve example in readme
Additional commits viewable in compare view

Updates rollup from 2.59.0 to 2.79.2

Release notes

Sourced from rollup's releases.

v.2.79.2

2.79.2

2024-09-26

Bug Fixes

Fix a vulnerability in generated code that affects IIFE, UMD and CJS bundles when run in a browser context (#5671)

Pull Requests

#5671: Fix DOM Clobbering CVE (@lukastaegert)

Changelog

Sourced from rollup's changelog.

rollup changelog

2.79.1

2022-09-22

Bug Fixes

Avoid massive performance degradation when creating thousands of chunks (#4643)

Pull Requests

#4639: fix: typo docs and contributors link in CONTRIBUTING.md ( @takurinton)

#4641: Update type definition of resolveId (@ivanjonas)

#4643: Improve performance of chunk naming collision check ( @lukastaegert)

2.79.0

2022-08-31

Features

Add amd.forceJsExtensionForImports to enforce using .js extensions for relative AMD imports (#4607)

Pull Requests

#4607: add option to keep extensions for amd (@wh1tevs)

2.78.1

2022-08-19

Bug Fixes

Avoid inferring "arguments" as name for a default export placeholder variable (#4613)

Pull Requests

#4613: Prevent using arguments for generated variable names ( @lukastaegert)

2.78.0

2022-08-14

Features

Support writing plugin hooks as objects with a "handler" property (#4600)

Allow changing execution order per plugin hook (#4600)

Add flag to execute plugins in async parallel hooks sequentially (#4600)

... (truncated)

Commits

c9bd03d 2.79.2
48aef33 fix: resolve DOM Clobbering CVE-2024-43788 (backport to v2) (#5677)
69ff418 2.79.1
04dce1b Update changelog
159137e fix: typo docs and contributors link in CONTRIBUTING.md (#4639)
e1392b3 Update type definition of resolveId (#4641)
7836357 Improve performance of chunk naming collision check (#4643)
71d20c9 Reduce permissions for repl-artefacts.yml workflow (#4630)
8193ea5 Adapt workflow to use Node 14 sub-version to work with branch protection
8477f8f 2.79.0
Additional commits viewable in compare view

Updates terser from 3.10.11 to 4.8.1

Changelog

Sourced from terser's changelog.

v4.8.1 (backport)

Security fix for RegExps that should not be evaluated (regexp DDOS)

v4.8.0

Support for numeric separators (million = 1_000_000) was added.

Assigning properties to a class is now assumed to be pure.

Fixed bug where yield wasn't considered a valid property key in generators.

v4.7.0

A bug was fixed where an arrow function would have the wrong size

arguments object is now considered safe to retrieve properties from (useful for length, or 0) even when pure_getters is not set.

Fixed erroneous const declarations without value (which is invalid) in some corner cases when using collapse_vars.

v4.6.13

Fixed issue where ES5 object properties were being turned into ES6 object properties due to more lax unicode rules.

Fixed parsing of BigInt with lowercase e in them.

v4.6.12

Fixed subtree comparison code, making it see that [1,[2, 3]] is different from [1, 2, [3]]

Printing of unicode identifiers has been improved

v4.6.11

Read unused classes' properties and method keys, to figure out if they use other variables.

Prevent inlining into block scopes when there are name collisions

Functions are no longer inlined into parameter defaults, because they live in their own special scope.

When inlining identity functions, take into account the fact they may be used to drop this in function calls.

Nullish coalescing operator (x ?? y), plus basic optimization for it.

Template literals in binary expressions such as + have been further optimized

v4.6.10

Do not use reduce_vars when classes are present

v4.6.9

Check if block scopes actually exist in blocks

v4.6.8

Take into account "executed bits" of classes like static properties or computed keys, when checking if a class evaluation might throw or have side effects.

v4.6.7

Some new performance gains through a AST_Node.size() method which measures a node's source code length without printing it to a string first.

... (truncated)

Commits

40674a4 update changelog, version
d8cc569 backport fix to potential regexp DDOS
504b967 4.8.0
9f380dc update changelog
7dd0b9d update assumptions
cfad907 Allow yield to be used as property key in generators.
283f44f Make class property assignment pure.
ee965e8 Add numeric separators support (#725)
ee6b8af 4.7.0
807f729 update changelog
Additional commits viewable in compare view

Updates tmp from 0.0.33 to 0.2.4

Changelog

Sourced from tmp's changelog.

v0.2.2 (2024-02-28)

🐛 Bug Fix

#278 Closes #268: Revert "fix #246: remove any double quotes or single quotes… (@mbargiel)

📝 Documentation

#279 Closes #266: move paragraph on graceful cleanup to the head of the documentation (@silkentrance)

Committers: 5

Carsten Klein (@silkentrance)

Dave Nicolson (@dnicolson)

KARASZI István (@raszi)

Maxime Bargiel (@mbargiel)

@robertoaceves

v0.2.1 (2020-04-28)

🚀 Enhancement

#252 Closes #250: introduce tmpdir option for overriding the system tmp dir (@silkentrance)

🏠 Internal

#253 Closes #191: generate changelog from pull requests using lerna-changelog (@silkentrance)

Committers: 1

Carsten Klein (@silkentrance)

v0.2.0 (2020-04-25)

🚀 Enhancement

#234 feat: stabilize tmp for v0.2.0 release (@silkentrance)

🐛 Bug Fix

#231 Closes #230: regression after fix for #197 (@silkentrance)

#220 Closes #197: return sync callback when using the sync interface, otherwise return the async callback (@silkentrance)

#193 Closes #192: tmp must not exit the process on its own (@silkentrance)

📝 Documentation

#221 Gh 206 document name option (@silkentrance)

🏠 Internal

#226 Closes #212: enable direct name option test (@silkentrance)

#225 Closes #211: existing tests must clean up after themselves (@silkentrance)

#224 Closes #217: name tests must use tmpName (@silkentrance)

#223 Closes #214: refactor tests and lib (@silkentrance)

#198 Update dependencies to latest versions (@matsev)

... (truncated)

Commits

08fa3ab Update version
1cf4ec5 Merge commit from fork
188b25e Fix GHSA-52f5-9888-hmc6
73b9fe4 Add test case for GHSA-52f5-9888-hmc6
b8e2f29 Remove broken tests
2892a02 Remove outdated URL
f592318 Reformat package.json
995ac8c Merge pull request #301 from raszi/dependabot/npm_and_yarn/braces-3.0.3
caa758d Bump braces from 3.0.2 to 3.0.3
5f0b252 Merge pull request #297 from raszi/feat/release-v0.2.3
Additional commits viewable in compare view

Updates @babel/traverse from 7.6.0 to 7.28.5

Release notes

Sourced from @babel/traverse's releases.

v7.28.5 (2025-10-23)

Thank you @CO0Ki3, @Olexandr88, and @youthfulhps for your first PRs!

👓 Spec Compliance

babel-parser

#17446 Allow Runtime Errors for Function Call Assignment Targets (@liuxingbaoyu)

babel-helper-validator-identifier

#17501 fix: update identifier to unicode 17 (@fisker)

🐛 Bug Fix

babel-plugin-proposal-destructuring-private

#17534 Allow mixing private destructuring and rest (@CO0Ki3)

babel-parser

#17521 Improve @babel/parser error typing (@JLHwung)

#17491 fix: improve ts-only declaration parsing (@JLHwung)

babel-plugin-proposal-discard-binding, babel-plugin-transform-destructuring

#17519 fix: rest correctly returns plain array (@liuxingbaoyu)

babel-helper-create-class-features-plugin, babel-helper-member-expression-to-functions, babel-plugin-transform-block-scoping, babel-plugin-transform-optional-chaining, babel-traverse, babel-types

#17503 Fix JSXIdentifier handling in isReferencedIdentifier (@JLHwung)

babel-traverse

#17504 fix: ensure scope.push register in anonymous fn (@JLHwung)

🏠 Internal

babel-types

#17494 Type checking babel-types scripts (@JLHwung)

🏃‍♀️ Performance

babel-core

#17490 Faster finding of locations in buildCodeFrameError (@liuxingbaoyu)

Committers: 8

Babel Bot (@babel-bot)

Byeongho Yoo (@youthfulhps)

Huáng Jùnliàng (@JLHwung)

Hyeon Dokko (@CO0Ki3)

Nicolò Ribaudo (@nicolo-ribaudo)

@Olexandr88

@liuxingbaoyu

fisker Cheung (@fisker)

v7.28.4 (2025-09-05)

Thanks @gwillen and @mrginglymus for your first PRs!

🏠 Internal

babel-core, babel-helper-check-duplicate-nodes, babel-traverse, babel-types

#17493 Update Jest to v30.1.1 (@JLHwung)

babel-plugin-transform-regenerator

#17455 chore: Clean up transform-regenerator (@liuxingbaoyu)

... (truncated)

Changelog

Sourced from @babel/traverse's changelog.

v7.28.5 (2025-10-23)

👓 Spec Compliance

babel-parser

#17446 Allow Runtime Errors for Function Call Assignment Targets (@liuxingbaoyu)

babel-helper-validator-identifier

#17501 fix: update identifier to unicode 17 (@fisker)

🐛 Bug Fix

babel-plugin-proposal-destructuring-private

#17534 Allow mixing private destructuring and rest (@CO0Ki3)

babel-parser

#17521 Improve @babel/parser error typing (@JLHwung)

#17491 fix: improve ts-only declaration parsing (@JLHwung)

babel-plugin-proposal-discard-binding, babel-plugin-transform-destructuring

#17519 fix: rest correctly returns plain array (@liuxingbaoyu)

babel-helper-create-class-features-plugin, babel-helper-member-expression-to-functions, babel-plugin-transform-block-scoping, babel-plugin-transform-optional-chaining, babel-traverse, babel-types

#17503 Fix JSXIdentifier handling in isReferencedIdentifier (@JLHwung)

babel-traverse

#17504 fix: ensure scope.push register in anonymous fn (@JLHwung)

🏠 Internal

babel-types

#17494 Type checking babel-types scripts (@JLHwung)

🏃‍♀️ Performance

babel-core

#17490 Faster finding of locations in buildCodeFrameError (@liuxingbaoyu)

v7.28.4 (2025-09-05)

🏠 Internal

babel-core, babel-helper-check-duplicate-nodes, babel-traverse, babel-types

#17493 Update Jest to v30.1.1 (@JLHwung)

babel-plugin-transform-regenerator

#17455 chore: Clean up transform-regenerator (@liuxingbaoyu)

babel-core

#17474 Switch to @jridgewell/remapping (@mrginglymus)

v7.28.3 (2025-08-14)

👓 Spec Compliance

babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators, babel-plugin-transform-class-static-block, babel-preset-env

#17443 [static blocks] Do not inject new static fields after static code (@nicolo-ribaudo)

🐛 Bug Fix

babel-parser

#17465 fix(parser/typescript): parse import("./a", {with:{},}) (@easrng)

#17478 fix(parser): stop subscript parsing on async arrow (@JLHwung)

💅 Polish

babel-plugin-transform-regenerator, babel-plugin-transform-runtime

... (truncated)

Commits

61647ae v7.28.5
e579cb0 Enable strictNullChecks for traverse (#17499)
7385eae [Babel 8] Improve scope information collection performance (#17043)
26bc651 [Babel 8] Better node type definitions for computed (#17500)
e626523 Fix JSXIdentifier handling in isReferencedIdentifier (#17503)
19c9126 fix: ensure scope.push register in anonymous fn (#17504)
35055e3 v7.28.4
b41f8cd Update Jest to v30.1.1 (#17493)
22493b6 Improve @babel/traverse typings (#17485)
18d88b8 Improve @babel/core typings (#17471)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @babel/traverse since your current version.

Updates @grpc/grpc-js from 1.4.2 to 1.14.3

Release notes

Sourced from @grpc/grpc-js's releases.

@grpc/grpc-js 1.14.3

Send halfClose immediately after messages to prevent late halfClose issues with Envoy (#3031 contributed by @serkanerip)

@grpc/grpc-js 1.14.2

Fix server keep alive timeout not properly destroying connections (#3022 contributed by @mattias-wiberg)

@grpc/grpc-js 1.14.1

Fix a regression of the settings used internally for HTTP/2 sessions (#3023)

@grpc/grpc-js-xds 1.14.0

Implement RBAC support (gRFC A41) (#2939, #2945)

Add weighted_round_robin to LB policy registry (#3001) (currently experimental, enabled by the environment variable GRPC_EXPERIMENTAL_XDS_WRR_LB)

Add wrr_locality to LB policy registry (#3003)

@grpc/grpc-js 1.14.0

Changelog

Add getAuthContext method to client and server call classes (more details can be found in gRFC L35) (#2920)

Implement custom backend metrics support (gRFC A51) (#2978, #2983, #2985, #2986, #2999)

Add getConnectionInfo method to the ServerInterceptingCall class (#2922)

Implement the weighted_round_robin load balancing policy (#2998)

Fix jitter behavior for client retries (#2960 contributed by @ekscentrysytet)

Start connecting from a random index in the round_robin LB policy (#2979)

Send connection-level WINDOW_UPDATE at session start (#2971 contributed by @KoenRijpstra)

Experimental API Changes

Added:

CHANNEL_ARGS_CONFIG_SELECTOR_KEY

StatusOr<T>

CallStream

statusOrFromValue

statusOrFromError

Modified:

ResolverListener#onSuccessfulResolution now has the signature (endpointList: StatusOr<Endpoint[]>, attributes: { [key: string]: unknown }, serviceConfig: StatusOr<ServiceConfig> | null, resolutionNote: string): boolean

LoadBalancer#updateAddressList now has the signature `updateAddressList(endpointList: StatusOr<Endpoint[]>,lbConfig: TypedLoadBalancingConfig, channelOptions: ChannelOptions, resolutionNote: string): boolean

@grpc/grpc-js 1.13.4

Fix ability to set SNI with ssl_target_name_override option (#2956)

@grpc/grpc-js 1.13.3

Disable Nagle's algorithm (#2936)

Avoid calling http2.getDefaultSettings (#2937)

@grpc/grpc-js 1.13.2

Fix a bug that caused clients to be unable to connect through local proxies (#2933)

... (truncated)

Commits

ccd29b2 Merge pull request #3032 from murgatroid99/grpc-js_retry_half_close_1.14
9ea15ce grpc-js: Bump version to 1.14.3
4d387d4 Use nextMessageToSend for early half-close
88a083d remove halfCloseSent field
f6895cb Send halfClose immediately after messages to prevent late halfClose issues wi...
37f2817 revert changes
4e26a27 half close right after write
bf0dc8f Merge pull request #3029 from murgatroid99/grpc-js_keepalive_fix_backport
235474e grpc-js: Bump to 1.14.2
2f090c6 grpc-js: Fix server keep alive timeout not properly destroying connections
Additional commits viewable in compare view

Updates y18n from 4.0.0 to 4.0.3

Changelog

Sourced from y18n's changelog.

4.0.3 (2021-04-07)

Bug Fixes

release: 4.x.x should not enforce Node 10 (#126) (1e21a53)

4.0.1 (2020-11-30)

Bug Fixes

address prototype pollution issue (#108) (a9ac604)

Commits

0aa97c5 chore: release 4.x.x (#128)
a8e7f04 build(release-please): configure branch properly (#127)
1e21a53 fix(release): 4.x.x should not enforce Node 10 (#126)
8dc7580 docs: update CHANGELOG
7de58ca fix: address prototype pollution issue
See full diff in compare view

Maintainer changes

This version was pushed to npm by oss-bot, a new releaser for y18n since your current version.

Updates yargs-parser from 10.1.0 to 22.0.0

Release notes

Sourced from yargs-parser's releases.

yargs-parser: v22.0.0

22.0.0 (2025-05-26)

⚠ BREAKING CHANGES

yargs is now ESM first (#503)

Features

yargs is now ESM first (#503) (6d69295)

yargs-parser: v21.1.1

21.1.1 (2022-08-04)

Bug Fixes

typescript: ignore .cts files during publish (#454) (d69f9c3), closes #452

yargs-parser: v21.1.0

21.1.0 (2022-08-03)

Features

allow the browser build to be imported (#443) (a89259f)

Bug Fixes

halt-at-non-option: prevent known args from being parsed when "unknown-options-as-args" is enabled (#438) (c474bc1)

node version check now uses process.versions.node (#450) (d07bcdb)

parse options ending with 3+ hyphens (#434) (4f1060b)

yargs-parser: v21.0.1

21.0.1 (2022-02-27)

Bug Fixes

return deno env object (#432) (b00eb87)

yargs-parser yargs-parser-v21.0.0

⚠ BREAKING CHANGES

drops support for 10 (#421)

... (truncated)

Changelog

Sourced from yargs-parser's changelog.

22.0.0 (2025-05-26)

⚠ BREAKING CHANGES

yargs is now ESM first (#503)

Features

yargs is now ESM first (#503) (6d69295)

21.1.1 (2022-08-04)

Bug Fixes

typescript: ignore .cts files during publish (#454) (d69f9c3), closes #452

21.1.0 (2022-08-03)

Features

allow the browser build to be imported (#443) (a89259f)

Bug Fixes

halt-at-non-option: prevent known args from being parsed when "unknown-options-as-args" is enabled (#438) (c474bc1)

node version check now uses process.versions.node (#450) (d07bcdb)

parse options ending with 3+ hyphens (#434) (

… updates Bumps the npm_and_yarn group with 25 updates in the /internal/remediation/fixtures/santatracker directory: | Package | From | To | | --- | --- | --- | | [dat.gui](https://github.com/dataarts/dat.gui) | `0.7.3` | `0.7.8` | | [firebase](https://github.com/firebase/firebase-js-sdk) | `8.10.0` | `10.9.0` | | [google-closure-library](https://github.com/google/closure-library) | `v20190909.0.0` | `20200315.0.0` | | [json5](https://github.com/json5/json5) | `2.1.0` | `2.2.3` | | [rollup](https://github.com/rollup/rollup) | `2.59.0` | `2.79.2` | | [terser](https://github.com/terser/terser) | `3.10.11` | `4.8.1` | | [tmp](https://github.com/raszi/node-tmp) | `0.0.33` | `0.2.4` | | [@babel/traverse](https://github.com/babel/babel/tree/HEAD/packages/babel-traverse) | `7.6.0` | `7.28.5` | | [@grpc/grpc-js](https://github.com/grpc/grpc-node) | `1.4.2` | `1.14.3` | | [y18n](https://github.com/yargs/y18n) | `4.0.0` | `4.0.3` | | [yargs-parser](https://github.com/yargs/yargs-parser) | `10.1.0` | `22.0.0` | | [acorn](https://github.com/acornjs/acorn) | `7.1.0` | `7.4.1` | | [acorn](https://github.com/acornjs/acorn) | `6.0.2` | `6.4.2` | | [ajv](https://github.com/ajv-validator/ajv) | `5.5.2` | `6.12.6` | | [braces](https://github.com/micromatch/braces) | `3.0.2` | `3.0.3` | | [cross-spawn](https://github.com/moxystudio/node-cross-spawn) | `6.0.5` | `6.0.6` | | [get-func-name](https://github.com/chaijs/get-func-name) | `2.0.0` | `2.0.2` | | [glob-parent](https://github.com/gulpjs/glob-parent) | `5.0.0` | `5.1.2` | | [ws](https://github.com/websockets/ws) | `7.1.2` | `7.5.10` | | [ws](https://github.com/websockets/ws) | `6.2.1` | `6.2.3` | | [json-schema](https://github.com/kriszyp/json-schema) | `0.2.3` | `0.4.0` | | [jws](https://github.com/brianloveswords/node-jws) | `4.0.0` | `4.0.1` | | [minimatch](https://github.com/isaacs/minimatch) | `3.0.4` | `3.1.2` | | [node-forge](https://github.com/digitalbazaar/forge) | `0.10.0` | `1.3.3` | | [path-parse](https://github.com/jbgutierrez/path-parse) | `1.0.6` | `1.0.7` | | [pathval](https://github.com/chaijs/pathval) | `1.1.0` | `1.1.1` | | [postcss](https://github.com/postcss/postcss) | `7.0.5` | `8.5.6` | Bumps the npm_and_yarn group with 1 update in the /internal/resolution/manifest/fixtures directory: [lodash](https://github.com/lodash/lodash). Updates `dat.gui` from 0.7.3 to 0.7.8 - [Release notes](https://github.com/dataarts/dat.gui/releases) - [Commits](dataarts/dat.gui@v0.7.3...v0.7.8) Updates `firebase` from 8.10.0 to 10.9.0 - [Release notes](https://github.com/firebase/firebase-js-sdk/releases) - [Changelog](https://github.com/firebase/firebase-js-sdk/blob/main/CHANGELOG.md) - [Commits](https://github.com/firebase/firebase-js-sdk/compare/[email protected]@10.9.0) Updates `google-closure-library` from v20190909.0.0 to 20200315.0.0 - [Release notes](https://github.com/google/closure-library/releases) - [Commits](google/closure-library@v20190909...v20200315) Updates `json5` from 2.1.0 to 2.2.3 - [Release notes](https://github.com/json5/json5/releases) - [Changelog](https://github.com/json5/json5/blob/main/CHANGELOG.md) - [Commits](json5/json5@v2.1.0...v2.2.3) Updates `rollup` from 2.59.0 to 2.79.2 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG-2.md) - [Commits](rollup/rollup@v2.59.0...v2.79.2) Updates `terser` from 3.10.11 to 4.8.1 - [Changelog](https://github.com/terser/terser/blob/master/CHANGELOG.md) - [Commits](terser/terser@3.10.11...v4.8.1) Updates `tmp` from 0.0.33 to 0.2.4 - [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md) - [Commits](raszi/node-tmp@v0.0.33...v0.2.4) Updates `@babel/traverse` from 7.6.0 to 7.28.5 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.28.5/packages/babel-traverse) Updates `@grpc/grpc-js` from 1.4.2 to 1.14.3 - [Release notes](https://github.com/grpc/grpc-node/releases) - [Commits](https://github.com/grpc/grpc-node/compare/@grpc/[email protected]...@grpc/[email protected]) Updates `y18n` from 4.0.0 to 4.0.3 - [Release notes](https://github.com/yargs/y18n/releases) - [Changelog](https://github.com/yargs/y18n/blob/y18n-v4.0.3/CHANGELOG.md) - [Commits](yargs/y18n@v4.0.0...y18n-v4.0.3) Updates `yargs-parser` from 10.1.0 to 22.0.0 - [Release notes](https://github.com/yargs/yargs-parser/releases) - [Changelog](https://github.com/yargs/yargs-parser/blob/main/CHANGELOG.md) - [Commits](yargs/yargs-parser@v10.1.0...yargs-parser-v22.0.0) Updates `acorn` from 7.1.0 to 7.4.1 - [Commits](acornjs/acorn@7.1.0...7.4.1) Updates `acorn` from 6.0.2 to 6.4.2 - [Commits](acornjs/acorn@7.1.0...7.4.1) Updates `ajv` from 5.5.2 to 6.12.6 - [Release notes](https://github.com/ajv-validator/ajv/releases) - [Commits](ajv-validator/ajv@v5.5.2...v6.12.6) Updates `browserslist` from 4.3.2 to 4.7.0 - [Release notes](https://github.com/browserslist/browserslist/releases) - [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md) - [Commits](browserslist/browserslist@4.3.2...4.7.0) Updates `braces` from 3.0.2 to 3.0.3 - [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md) - [Commits](micromatch/braces@3.0.2...3.0.3) Updates `cross-spawn` from 6.0.5 to 6.0.6 - [Changelog](https://github.com/moxystudio/node-cross-spawn/blob/v6.0.6/CHANGELOG.md) - [Commits](moxystudio/node-cross-spawn@v6.0.5...v6.0.6) Updates `node-fetch` from 2.6.1 to 2.6.6 - [Release notes](https://github.com/node-fetch/node-fetch/releases) - [Commits](node-fetch/node-fetch@v2.6.1...v2.6.6) Updates `get-func-name` from 2.0.0 to 2.0.2 - [Release notes](https://github.com/chaijs/get-func-name/releases) - [Commits](https://github.com/chaijs/get-func-name/commits/v2.0.2) Updates `glob-parent` from 5.0.0 to 5.1.2 - [Release notes](https://github.com/gulpjs/glob-parent/releases) - [Changelog](https://github.com/gulpjs/glob-parent/blob/main/CHANGELOG.md) - [Commits](gulpjs/glob-parent@v5.0.0...v5.1.2) Updates `ws` from 7.1.2 to 7.5.10 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@7.1.2...7.5.10) Updates `ws` from 6.2.1 to 6.2.3 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@7.1.2...7.5.10) Updates `json-schema` from 0.2.3 to 0.4.0 - [Commits](kriszyp/json-schema@v0.2.3...v0.4.0) Updates `jws` from 4.0.0 to 4.0.1 - [Release notes](https://github.com/brianloveswords/node-jws/releases) - [Changelog](https://github.com/auth0/node-jws/blob/master/CHANGELOG.md) - [Commits](auth0/node-jws@v4.0.0...v4.0.1) Updates `minimatch` from 3.0.4 to 3.1.2 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v3.0.4...v3.1.2) Updates `node-forge` from 0.10.0 to 1.3.3 - [Changelog](https://github.com/digitalbazaar/forge/blob/main/CHANGELOG.md) - [Commits](digitalbazaar/forge@0.10.0...v1.3.3) Updates `path-parse` from 1.0.6 to 1.0.7 - [Commits](https://github.com/jbgutierrez/path-parse/commits/v1.0.7) Updates `pathval` from 1.1.0 to 1.1.1 - [Release notes](https://github.com/chaijs/pathval/releases) - [Changelog](https://github.com/chaijs/pathval/blob/master/CHANGELOG.md) - [Commits](chaijs/pathval@v1.1.0...v1.1.1) Updates `postcss` from 7.0.5 to 8.5.6 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@7.0.5...8.5.6) Updates `protobufjs` from 6.11.2 to 7.5.4 - [Release notes](https://github.com/protobufjs/protobuf.js/releases) - [Changelog](https://github.com/protobufjs/protobuf.js/blob/master/CHANGELOG.md) - [Commits](protobufjs/protobuf.js@v6.11.2...protobufjs-v7.5.4) Updates `lodash` from 4.17.17 to 4.17.21 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](https://github.com/lodash/lodash/commits/4.17.21) --- updated-dependencies: - dependency-name: dat.gui dependency-version: 0.7.8 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: firebase dependency-version: 10.9.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: google-closure-library dependency-version: 20200315.0.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: json5 dependency-version: 2.2.3 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: rollup dependency-version: 2.79.2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: terser dependency-version: 4.8.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: tmp dependency-version: 0.2.4 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@babel/traverse" dependency-version: 7.28.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@grpc/grpc-js" dependency-version: 1.14.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: y18n dependency-version: 4.0.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: yargs-parser dependency-version: 22.0.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: acorn dependency-version: 7.4.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: acorn dependency-version: 6.4.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ajv dependency-version: 6.12.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: browserslist dependency-version: 4.7.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: braces dependency-version: 3.0.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: cross-spawn dependency-version: 6.0.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: node-fetch dependency-version: 2.6.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: get-func-name dependency-version: 2.0.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: glob-parent dependency-version: 5.1.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 7.5.10 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 6.2.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: json-schema dependency-version: 0.4.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: jws dependency-version: 4.0.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: minimatch dependency-version: 3.1.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: node-forge dependency-version: 1.3.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: path-parse dependency-version: 1.0.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: pathval dependency-version: 1.1.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: protobufjs dependency-version: 7.5.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.17.21 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Dec 31, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump the npm_and_yarn group across 2 directories with 29 updates #27

chore(deps): bump the npm_and_yarn group across 2 directories with 29 updates #27

Uh oh!

dependabot bot commented on behalf of github Dec 31, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

chore(deps): bump the npm_and_yarn group across 2 directories with 29 updates #27

Are you sure you want to change the base?

chore(deps): bump the npm_and_yarn group across 2 directories with 29 updates #27

Uh oh!

Conversation

dependabot bot commented on behalf of github Dec 31, 2025

0.7.8

0.7.7

0.7.6

0.7.5

0.7.4

Closure Library v20200315

Closure Library v20200224

Closure Library v20200204

v2.2.3

v2.2.2

v2.2.1

v2.2.0

v2.1.3 [code, diff]

v2.1.2

v2.1.1

v2.2.3 [code, diff]

v2.2.2 [code, diff]

v2.2.1 [code, diff]

v2.2.0 [code, diff]

v2.1.3 [code, diff]

v2.1.2 [code, diff]

v2.1.1 [code, [diff][d2.1.1]]

v.2.79.2

2.79.2

Bug Fixes

Pull Requests

rollup changelog

2.79.1

Bug Fixes

Pull Requests

2.79.0

Features

Pull Requests

2.78.1

Bug Fixes

Pull Requests

2.78.0

Features

v4.8.1 (backport)

v4.8.0

v4.7.0

v4.6.13

v4.6.12

v4.6.11

v4.6.10

v4.6.9

v4.6.8

v4.6.7

v0.2.2 (2024-02-28)

🐛 Bug Fix

📝 Documentation

Committers: 5

v0.2.1 (2020-04-28)

🚀 Enhancement

🏠 Internal

Committers: 1

v0.2.0 (2020-04-25)

🚀 Enhancement

🐛 Bug Fix

📝 Documentation

🏠 Internal

v7.28.5 (2025-10-23)

👓 Spec Compliance

🐛 Bug Fix

🏠 Internal

🏃‍♀️ Performance

Committers: 8

v7.28.4 (2025-09-05)

🏠 Internal

v7.28.5 (2025-10-23)

👓 Spec Compliance

🐛 Bug Fix

🏠 Internal

🏃‍♀️ Performance

`@grpc/grpc-js` 1.14.3

`@grpc/grpc-js` 1.14.2

`@grpc/grpc-js` 1.14.1

`@grpc/grpc-js-xds` 1.14.0

`@grpc/grpc-js` 1.14.0

`@grpc/grpc-js` 1.13.4

`@grpc/grpc-js` 1.13.3

`@grpc/grpc-js` 1.13.2