Skip to content

build(deps): bump the npm-security group across 1 directory with 10 updates - #4788

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-security-fbf2a05532
Closed

build(deps): bump the npm-security group across 1 directory with 10 updates#4788
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-security-fbf2a05532

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm-security group with 10 updates in the / directory:

Package From To
@angular/common 20.3.27 20.3.28
@angular/core 20.3.27 20.3.28
adm-zip 0.6.0 0.6.1
joi 17.13.4 17.13.8
@grpc/grpc-js 1.14.4 1.14.5
js-yaml 3.15.1 3.15.2
multer 2.2.0 2.4.0
baseline-browser-mapping 2.10.42 2.11.28
dompurify 3.4.13 3.4.16
markdown-it 14.3.0 14.3.2

Updates @angular/common from 20.3.27 to 20.3.28

Release notes

Sourced from @​angular/common's releases.

20.3.28

core

Commit Description
fix - 2f96c8020f sanitize host bindings on concrete hosts

http

Commit Description
fix - 969133d426 match header values exactly when deleting
fix - 29dd26bd71 preserve immutability of materialized clones
fix - e4c416c20a run root interceptors in the terminal request chain
Changelog

Sourced from @​angular/common's changelog.

20.3.28 (2026-08-13)

core

Commit Type Description
2f96c8020f fix sanitize host bindings on concrete hosts

http

Commit Type Description
969133d426 fix match header values exactly when deleting
29dd26bd71 fix preserve immutability of materialized clones
e4c416c20a fix run root interceptors in the terminal request chain

Commits
  • e4c416c fix(http): run root interceptors in the terminal request chain
  • 969133d fix(http): match header values exactly when deleting
  • 29dd26b fix(http): preserve immutability of materialized clones
  • See full diff in compare view

Updates @angular/core from 20.3.27 to 20.3.28

Release notes

Sourced from @​angular/core's releases.

20.3.28

core

Commit Description
fix - 2f96c8020f sanitize host bindings on concrete hosts

http

Commit Description
fix - 969133d426 match header values exactly when deleting
fix - 29dd26bd71 preserve immutability of materialized clones
fix - e4c416c20a run root interceptors in the terminal request chain
Changelog

Sourced from @​angular/core's changelog.

20.3.28 (2026-08-13)

core

Commit Type Description
2f96c8020f fix sanitize host bindings on concrete hosts

http

Commit Type Description
969133d426 fix match header values exactly when deleting
29dd26bd71 fix preserve immutability of materialized clones
e4c416c20a fix run root interceptors in the terminal request chain

Commits

Updates adm-zip from 0.6.0 to 0.6.1

Release notes

Sourced from adm-zip's releases.

v0.6.1

Full Changelog: cthackers/adm-zip@v0.6.0...v0.6.1

  • Updated dev dependencies
  • Fixed uncaught crash in async decompression on malformed DEFLATE data
  • Fixed addLocalFolder following symlinks out of the archived folder
  • Stripped setuid/setgid/sticky bits from extracted file permissions
  • Enforced the decompression size cap on the async path and for size 0
  • Rejected archives with duplicate entry names
  • Blocked extraction from writing through symlinks inside the target
  • Routed malformed-header parse errors through the async callback
  • Rejected zip entries whose declared data extent runs past the buffer
  • Fixed addLocalFolderPromise hanging on empty folders and swallowing errors
  • Fixed addLocalFolderAsync2 mangling local paths on Windows
Commits
  • cb2cf9b Fixed addLocalFolderAsync2 mangling local paths on Windows
  • 54902b6 Fixed addLocalFolderPromise hanging on empty folders and swallowing errors
  • 73131bd Fixed CI
  • 758898d Rejected zip entries whose declared data extent runs past the buffer
  • 74b6e9f Routed malformed-header parse errors through the async callback
  • eaa35fa Blocked extraction from writing through symlinks inside the target
  • 1e015e3 Increment version
  • 05101d4 Rejected archives with duplicate entry names
  • 4916006 Enforced the decompression size cap on the async path and for size 0
  • 6a63c33 Stripped setuid/setgid/sticky bits from extracted file permissions
  • Additional commits viewable in compare view

Updates joi from 17.13.4 to 17.13.8

Commits

Updates @grpc/grpc-js from 1.14.4 to 1.14.5

Release notes

Sourced from @​grpc/grpc-js's releases.

@​grpc/grpc-js 1.14.5

  • Fix a bug that caused clients to automatically transmit excessive error details to clients by default (advisory GHSA-f596-whhp-79r4)
  • Fix a bug that caused getAuthContext to return unverified certificates as though they were verified in some configurations (advisory GHSA-m9gg-hp2v-232j)
  • Fix a bug that could cause stale call data to accumulate if a channel failed to connect for a long period of time (#3078)
  • Fix a bug that could cause call status to be reported with expected fields missing (#3079)
  • Avoid redundant end() calls on completed HTTP/2 streams (#3082 contributed by @​olavloite)
  • Unify call numbers and avoid disabled trace allocations (#3084 contributed by @​olavloite)
Commits
  • 56567d9 Merge pull request #3086 from murgatroid99/grpc-js_1.14.5
  • 748ae86 Merge pull request #3088 from murgatroid99/grpc-js_perf_improvement_backport
  • 526702d test(grpc-js): fix type errors in client stream lifecycle tests
  • 26a8d3d fix(grpc-js): avoid redundant end() calls on completed HTTP/2 streams
  • 152eebd chore(grpc-js): unify call numbers and avoid disabled trace allocations
  • c5ae750 grpc-js(-xds): Increment version numbers (1.14.x)
  • 735a09a Merge commit from fork
  • af9b140 Merge commit from fork
  • 45ac33e Merge commit from fork
  • 9df49e3 Merge pull request #3081 from murgatroid99/grpc-js-xds_weighted_target_fix_ba...
  • Additional commits viewable in compare view

Updates js-yaml from 3.15.1 to 3.15.2

Changelog

Sourced from js-yaml's changelog.

3.15.2 - 2026-08-26

Changed

  • [backport] Hard-limit merge sequence size to 100.

Security

  • [backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.
Commits

Updates multer from 2.2.0 to 2.4.0

Release notes

Sourced from multer's releases.

v2.4.0

Highlights

multer finally supports Google Cloud Functions and Firebase 🎉

These platforms read the request body before your code runs, so multer's classic req.pipe(busboy) received nothing: empty req.body, empty req.files, and nearly a decade of duplicated issues.

The new streamHandler option closes that gap: you decide how the body reaches the parser, so the pre-read rawBody just works (see image).

const multer = require('multer')
const upload = multer({
storage: multer.memoryStorage(),
streamHandler: (req, busboy) => {
// Cloud Functions / Firebase expose the pre-read body here
if (req.rawBody) busboy.end(req.rawBody)
else req.pipe(busboy)
}
})
app.post('/upload', upload.single('file'), (req, res) => {
res.json({ name: req.file.originalname, size: req.file.size })
})

This landed thanks to community PRs going back to 2017; their authors are credited as co-authors in the release.

Important: Security

What's Changed

... (truncated)

Changelog

Sourced from multer's changelog.

2.4.0

  • Fix CVE-2026-88932 (GHSA-3pph-fpjx-jg34)
  • Add filename to LIMIT_FILE_SIZE and LIMIT_UNEXPECTED_FILE errors (#1416)
  • Accept a function for limits, called with the request, to set limits per request (#1133)
  • Add opt-in flush option to DiskStorage to fsync files before the callback runs (#1458)
  • Expose busboy's defCharset, highWaterMark and fileHwm options (#1465)
  • Add streamHandler option to feed busboy from pre-consumed bodies (Google Cloud Functions, Firebase) (#1466)
  • Allow multer.diskStorage() to be called without options (#1471)
  • Decode WHATWG-escaped characters (%0A, %0D, %22) in field names, matching file.originalname since 2.3.0: req.body keys, file.fieldname and err.field now carry the real name. If you matched the escaped spelling as a workaround, use the real name now (#1473)
  • Report the decoded filename in err.filename on LIMIT_FILE_SIZE errors, matching file.originalname (#1478)
  • Reject non-integer or negative limits values at construction time; a float limit silently disabled the check (#1395, #1335)
  • Accept requests with exactly limits.parts parts; LIMIT_PART_COUNT now fires only when the limit is exceeded. If you set parts one higher to work around this, you can drop the extra one (#1446)
  • Files skipped by fileFilter no longer count towards maxCount (#1426)
  • Change the LIMIT_UNEXPECTED_FILE message to "Unexpected file field" (#426)
  • Remove the concat-stream dependency (#1356)
  • Docs: add JSDoc to the public API and document the storage engine stream contract (#1467, #1468)
  • Docs: add FormData upload examples (#896)
  • Docs: remove the translated READMEs (#1463)
  • Internal: run the test suite on macOS (#1464)

2.3.0

Commits
  • 35979e5 2.4.0 (#1469)
  • b888532 chore(deps): bump github/codeql-action/upload-sarif to 4.37.9 (#1474)
  • e6bcd7d chore(deps): bump github/codeql-action/analyze from 4.37.4 to 4.37.9 (#1475)
  • 00dec43 chore(deps): bump github/codeql-action/init from 4.37.4 to 4.37.9 (#1476)
  • 8d5c3b7 feat: allow diskStorage without options (#1471)
  • 02f6e82 fix: report the decoded filename on LIMIT_FILE_SIZE (#1478)
  • bc3f72d fix: decode escaped field names, not just filenames (#1473)
  • 2661325 docs: add JSDoc to the public API (#1467)
  • 53337f9 fix: remove late-completing uploads aborted before the engine names them
  • 7f2c9ab feat: add streamHandler option to feed busboy from pre-consumed bodies (#1466)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for multer since your current version.


Updates baseline-browser-mapping from 2.10.42 to 2.11.28

Release notes

Sourced from baseline-browser-mapping's releases.

v2.11.0

What's Changed in 2.11.0

  • feat: Adds a new getTimeline() method for getting the series of minimum browser changes, either grouped by date or by browser.
  • refactor: Substantial refactoring of the data compression process that replaces the full list of browsers from @mdn/browser-compat-data and downstream-browsers.json and features from web-features (in their very pared down form) with a change-list timeline that reflects which versions supported Baseline (newly available) on a given date. Thanks to @​swwind for the idea!
  • refactor: Some common functions have been moved to a util.ts module for use in other scripts.
  • fix: Removes process.exit() calls when unsupported option combinations are passed to getCompatibleVersions() and getAllVersions() in favour of throwing an Error. There is a small security risk with process.exit() calls that sites accepting unsanitised inputs could be the subject of attacks. Unsupported config options now throw and Error which should allow for more graceful handling. Thanks to @​bnbdr for flagging this as vulnerability CVE-2026-45819 .

Fixes #134

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.10.44...v2.11.0

Commits
  • 17963c0 Patch to 2.11.28 because browser or feature data changed
  • 5d628d8 Browser or feature data changed
  • 18ccb38 Updating static site
  • 6141d06 Patch to 2.11.27 because browser or feature data changed
  • e1d166b Browser or feature data changed
  • 42972a7 Updating static site
  • c1934c6 Patch to 2.11.26 because browser or feature data changed
  • 4873684 Browser or feature data changed
  • 9030798 Updating static site
  • a5df351 Updating static site
  • Additional commits viewable in compare view

Updates dompurify from 3.4.13 to 3.4.16

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.16

  • Fixed a problem with IN_PLACE node removal when working with hooks, thanks @​manus-pi
  • Fixed a problem with IN_PLACE sanitization and raw-text roots, thanks @​h-t-m
  • Fixed a problem with ESM default exports landing in CommonJS declarations, thanks @​ssi02014
  • Migrated from rollup to rolldown because performance, thanks @​ssi02014
  • Bumped several dependencies where possible

DOMPurify 3.4.15

  • Added better clobbering hardening when XML content is involved, thanks @​gnyselcuk
  • Added several smaller hardening and edge-case improvements, thanks @​leechristensen
  • Bumped several dependencies where possible

DOMPurify 3.4.14

  • Fixed an issue with possible bypasses when risky tags are allow-listed, thanks @​AlirezaRouhbakhsh
  • Fixed a couple of edge cases with mixed document contexts, thanks @​fishjojo1
  • Added the SVG pointer-events and vector-effect presentation attributes to the allow-list, thanks @​Jaybhade
  • Conducted another refactoring run, removed dead branches and duplicated logic, flattened attribute validation
  • Updated the documentation in several spots, README, wiki, etc., thanks @​Akokonunes
  • Updated several development dependencies and CI workflow actions
Commits

Updates markdown-it from 14.3.0 to 14.3.2

Changelog

Sourced from markdown-it's changelog.

[14.3.2] - 2026-09-12

Security

  • Backported 15.0.2 fixes.

[14.3.1] - 2026-08-27

Security

  • Backported 15.0.1 fixes.
Commits
  • efb9993 14.3.2 released
  • daf5a3c Backported 15.0.2 fixes
  • a855f10 14.3.1 released
  • ad70f6b Backported 15.0.1 fixes
  • b407f3b Ignore generated API docs in lint
  • bf025ad Prepare package.json for v14 backports
  • 2d9bbea fix: recognize lowercase declarations as HTML blocks (CommonMark 4.6) (#1189)
  • a311cfb fix: keep literal backslash before space in link destination (CommonMark 6.3)...
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
build(deps): bump the npm-security group across 1 directory with 10 u…
818ca52 
…pdates

Bumps the npm-security group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common) | `20.3.27` | `20.3.28` |
| [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core) | `20.3.27` | `20.3.28` |
| [adm-zip](https://github.com/cthackers/adm-zip) | `0.6.0` | `0.6.1` |
| [joi](https://github.com/hapijs/joi) | `17.13.4` | `17.13.8` |
| [@grpc/grpc-js](https://github.com/grpc/grpc-node) | `1.14.4` | `1.14.5` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `3.15.1` | `3.15.2` |
| [multer](https://github.com/expressjs/multer) | `2.2.0` | `2.4.0` |
| [baseline-browser-mapping](https://github.com/web-platform-dx/baseline-browser-mapping) | `2.10.42` | `2.11.28` |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.4.13` | `3.4.16` |
| [markdown-it](https://github.com/markdown-it/markdown-it) | `14.3.0` | `14.3.2` |



Updates `@angular/common` from 20.3.27 to 20.3.28
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/v20.3.28/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v20.3.28/packages/common)

Updates `@angular/core` from 20.3.27 to 20.3.28
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/v20.3.28/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v20.3.28/packages/core)

Updates `adm-zip` from 0.6.0 to 0.6.1
- [Release notes](https://github.com/cthackers/adm-zip/releases)
- [Changelog](https://github.com/cthackers/adm-zip/blob/master/history.md)
- [Commits](cthackers/adm-zip@v0.6.0...v0.6.1)

Updates `joi` from 17.13.4 to 17.13.8
- [Commits](hapijs/joi@v17.13.4...v17.13.8)

Updates `@grpc/grpc-js` from 1.14.4 to 1.14.5
- [Release notes](https://github.com/grpc/grpc-node/releases)
- [Commits](https://github.com/grpc/grpc-node/compare/@grpc/grpc-js@1.14.4...@grpc/grpc-js@1.14.5)

Updates `js-yaml` from 3.15.1 to 3.15.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/3.15.2/CHANGELOG.md)
- [Commits](nodeca/js-yaml@3.15.1...3.15.2)

Updates `multer` from 2.2.0 to 2.4.0
- [Release notes](https://github.com/expressjs/multer/releases)
- [Changelog](https://github.com/expressjs/multer/blob/main/CHANGELOG.md)
- [Commits](expressjs/multer@v2.2.0...v2.4.0)

Updates `baseline-browser-mapping` from 2.10.42 to 2.11.28
- [Release notes](https://github.com/web-platform-dx/baseline-browser-mapping/releases)
- [Commits](web-platform-dx/baseline-browser-mapping@v2.10.42...v2.11.28)

Updates `dompurify` from 3.4.13 to 3.4.16
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.13...3.4.16)

Updates `markdown-it` from 14.3.0 to 14.3.2
- [Changelog](https://github.com/markdown-it/markdown-it/blob/14.3.2/CHANGELOG.md)
- [Commits](markdown-it/markdown-it@14.3.0...14.3.2)

---
updated-dependencies:
- dependency-name: "@angular/common"
  dependency-version: 20.3.28
  dependency-type: direct:development
  dependency-group: npm-security
- dependency-name: "@angular/core"
  dependency-version: 20.3.28
  dependency-type: direct:development
  dependency-group: npm-security
- dependency-name: adm-zip
  dependency-version: 0.6.1
  dependency-type: direct:development
  dependency-group: npm-security
- dependency-name: joi
  dependency-version: 17.13.8
  dependency-type: direct:production
  dependency-group: npm-security
- dependency-name: "@grpc/grpc-js"
  dependency-version: 1.14.5
  dependency-type: direct:production
  dependency-group: npm-security
- dependency-name: js-yaml
  dependency-version: 3.15.2
  dependency-type: direct:production
  dependency-group: npm-security
- dependency-name: multer
  dependency-version: 2.4.0
  dependency-type: direct:production
  dependency-group: npm-security
- dependency-name: baseline-browser-mapping
  dependency-version: 2.11.28
  dependency-type: indirect
  dependency-group: npm-security
- dependency-name: dompurify
  dependency-version: 3.4.16
  dependency-type: indirect
  dependency-group: npm-security
- dependency-name: markdown-it
  dependency-version: 14.3.2
  dependency-type: indirect
  dependency-group: npm-security
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 14, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 15, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 15, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/npm-security-fbf2a05532 branch October 15, 2026 17:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@VRamakrishna VRamakrishna Awaiting requested review from VRamakrishna VRamakrishna is a code owner
@sandeepnRES sandeepnRES Awaiting requested review from sandeepnRES sandeepnRES is a code owner
@outSH outSH Awaiting requested review from outSH outSH is a code owner
@RafaelAPB RafaelAPB Awaiting requested review from RafaelAPB RafaelAPB is a code owner
@AndreAugusto11 AndreAugusto11 Awaiting requested review from AndreAugusto11 AndreAugusto11 is a code owner
@LordKubaya LordKubaya Awaiting requested review from LordKubaya LordKubaya is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants