chore(deps): bump the npm-security group across 1 directory with 10 updates by dependabot[bot] · Pull Request #334 · Terminal49/API

dependabot · 2026-08-21T04:52:41Z

Bumps the npm-security group with 7 updates in the / directory:

Package	From	To
adm-zip	`0.5.16`	`0.6.0`
fast-uri	`3.1.2`	`3.1.5`
hono	`4.12.26`	`4.13.3`
ip-address	`10.2.0`	`10.5.0`
linkify-it	`5.0.1`	`5.0.2`
nanoid	`3.3.11`	`3.3.18`
postcss	`8.5.14`	`8.5.26`

Updates adm-zip from 0.5.16 to 0.6.0

Release notes

Sourced from adm-zip's releases.

v0.6.0

Full Changelog: cthackers/adm-zip@v0.5.18...v0.6.0

This release fixes a security vulnerability (CVE-2026-39244), resolves several long-standing bugs, ships built-in TypeScript types, and includes two behavior changes worth reading before you upgrade.

extractEntryTo(dirEntry, target, maintainEntryPath = false) now preserves subdirectories instead of flattening files into the target folder by basename (which also silently overwrote same-named files). (#306)

Extraction no longer fails when the modification time can't be set — utimes is now best-effort. (#379)

Minimum Node.js is now 14 (the code already required it; engines was incorrectly >=12).

CVE-2026-39244 — a crafted archive declaring a huge uncompressed size could force an unbounded Buffer.alloc and OOM the process; allocation is now bounded by the data actually present. Reported by Daniel Púa (devploit), Anh Hong, and José Antonio Zamudio Amaya. (#568)

Hardened entry-name lookup against object injection (proto names). Prototype-less table.

Data-descriptor regression rejecting valid archives (#548, #533, #554)

Directory permissions not restored on extract (#530)

Infinite recursion on symlink loops in addLocalFolder (#541)

Uncaught process crash in writeFileToAsync on write failure (#470, #459, #402)

Empty name on directory entries (#466)

test() always returned false for archives with files

~6× faster entry sorting for large archives

Built-in TypeScript definitions (types.d.ts) — you can drop @types/adm-zip

v0.5.18

What's Changed

Bump js-yaml from 4.1.1 to 4.3.0 by @dependabot[bot] in cthackers/adm-zip#566

Fix corrupted zip when round-tripping entries with a data descriptor (#555) by @JohnJunior in cthackers/adm-zip#564

prevent crashes when process.versions is an empty object by @matt-fidd in cthackers/adm-zip#551

support for writing zip64 by @mielverkerken in cthackers/adm-zip#562

Fix Archive Utility failure on zips with empty directories (#558) by @JohnJunior in cthackers/adm-zip#563

New Contributors

@JohnJunior made their first contribution in cthackers/adm-zip#564

@matt-fidd made their first contribution in cthackers/adm-zip#551

@mielverkerken made their first contribution in cthackers/adm-zip#562

Full Changelog: cthackers/adm-zip@v0.5.17...v0.5.18

v0.5.17

What's Changed

entryHeader time setter more tolerant by @thomasheritage in cthackers/adm-zip#540

Add check for local desc flag in crc check by @issacgerges in cthackers/adm-zip#543

Create only if the directory does not exist by @DennisHill in cthackers/adm-zip#557

Fix issue with absolute paths by @kwolfy in cthackers/adm-zip#559

New Contributors

@thomasheritage made their first contribution in cthackers/adm-zip#540

@issacgerges made their first contribution in cthackers/adm-zip#543

@DennisHill made their first contribution in cthackers/adm-zip#557

@kwolfy made their first contribution in cthackers/adm-zip#559

Full Changelog: cthackers/adm-zip@v0.5.16...v0.5.17

Changelog

Sourced from adm-zip's changelog.

0.6.0 / 2026-07-10

Security

Fixed CVE-2026-39244: a crafted archive declaring a huge uncompressed size could force an unbounded Buffer.alloc (memory exhaustion / DoS) before any validation. Allocation is now bounded by the data actually present — STORED output is sized from the real bytes, DEFLATED output is grown by the inflater and capped at the declared size (#568)

Hardened the internal entry-name lookup table against object injection: entry names come from untrusted archives, and a name such as __proto__ previously resolved to Object.prototype, crashing addFile and hiding the entry from getEntry/readFile. The table is now prototype-less

Bug fixes

Fixed a regression (0.5.15) that rejected valid archives using a data descriptor (general-purpose bit 3). The payload is now validated against the authoritative central-directory CRC instead of requiring/parsing the trailing descriptor (#548, #533, #554)

Fixed extractAllTo/extractAllToAsync not restoring directory permissions with keepOriginalPermission; directory modes are applied after their contents are written, deepest path first, and no longer lock the extractor out of a restrictive directory (#530)

Fixed infinite recursion in addLocalFolder when a folder contains a symlink pointing back to an ancestor (e.g. workspace node_modules); the walk now tracks resolved real paths and skips already-visited directories (#541)

Fixed an uncaught exception (ERR_INVALID_ARG_TYPE) that crashed the process when writeFileToAsync could not open the target file (bad permissions, invalid filename, exhausted file descriptors); write failures are now reported through the callback and write errors are no longer silently swallowed (#470, #459, #402)

Fixed directory entries reporting an empty name (e.g. a/b/c/ now returns c) (#466)

Fixed extractEntryTo flattening subdirectories when maintainEntryPath is false; the structure below the extracted directory is now preserved instead of collapsing (and overwriting) files by basename (#306)

Fixed a failed utimes aborting extraction; setting the modification time is now best-effort and never fails extraction of already-written content (#379)

Fixed test() always returning false for any archive containing a file (it indexed the entries array with an entry object instead of reading the entry); it now correctly verifies each entry's CRC

Performance

Faster entry sorting when writing archives with many entries: names are decoded once instead of on every comparison (about 6× faster sort for large archives)

Added

Bundled TypeScript type definitions (types.d.ts), so @types/adm-zip is no longer required

Notes

Behavior change: extractEntryTo(dir, target, /* maintainEntryPath */ false) now preserves subdirectories beneath the extracted directory rather than flattening them

Behavior change: extraction no longer fails when the modification time cannot be set

0.5.4 / 2021-03-08

Fixed relative paths

Added zipcrypto encryption

Lower verMade for macOS when generating zip file

0.5.3 / 2021-02-07

Fixed filemode when unzipping

0.5.2 / 2021-01-27

Fixed path traversal issue (GHSL-2020-198)

0.5.1 / 2020-11-27

Incremented version (cthackers)

Fixed outFileName (cthackers)

0.5.0 / 2020-11-19

Added extra parameter to extractEntryTo so target filename can be renamed (cthackers)

... (truncated)

Commits

2b4d840 updated minimum node engine version to >= 14
dc57f0f Hardened entry-name lookup, fixed test(), and sped up entry sorting
f81806a Made utimes best-effort so it can't abort extraction (#379)
ab04324 Fixed extractEntryTo flattening subdirectories (#306)
8a5d9ba Fixed empty name for directory entries (#466)
3e72790 Fixed uncaught crash in writeFileToAsync on write failure (#470, #459, #402)
651ae4c Added typescript types
e72021d Fixed infinite recursion on symlink loops in addLocalFolder (#541)
8f3176b Fixed directory permissions on linux
4d2c8f9 Fixed error introduced with zip descriptor checks
Additional commits viewable in compare view

Updates axios from 1.16.1 to 1.19.0

Release notes

Sourced from axios's releases.

v1.19.0 - July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

🚀 New Features

Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers. (#11043, #11081)

Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)

HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)

🐛 Bug Fixes

Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)

Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)

Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)

Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)

URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11024, #11038)

Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)

Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (#11044, #11059)

Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (#11061)

Synchronous Interceptors: Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (#11071)

🔧 Maintenance & Chores

Dependencies: Updated development and test tooling, the docs fixture's Axios version, and GitHub Actions integrations including Checkout, Setup Node, Setup Deno, and Zizmor. (#11031, #11055, #11056, #11058, #11079, #11080, #11088, #11089, #11090)

Build Outputs: Limited sourcemap generation to published minified bundles, removing broken map references from non-minified builds. (#11054)

Form Data Internals: Centralized FormData header handling and made the Node.js adapter tolerate getHeaders() returning undefined under the content-only policy. (#11062)

Developer Experience: Ignored common local AI-tooling directories and fixed a constant-reassignment crash when the development sandbox serves its root path. (#11032, #11073)

Documentation: Updated sponsor information, clarified that baseURL is not a path-security boundary, scoped provenance claims to attested releases, and corrected the configuration-defaults documentation. (#11041, #11068, #11076, #11078)

Publishing: Simplified v1 publishing to use the npm version bundled with Node.js 26 and updated package metadata for the 1.19.0 release. (#11083, #11095)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve Axios:

@afonsojramos (#11028)

@MahinAnowar (#11006)

@yassertawfik4 (#11024)

@AnandSundar (#11029)

@lin-hongkuan (#11035)

@Wali007-lab (#11054)

@magicdawn (#11043)

@andrewkernel (#11053)

@Sagargupta16 (#11059)

@Rpaudel379 (#11078)

... (truncated)

Changelog

Sourced from axios's changelog.

v1.19.0 — July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

🚀 New Features

Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers. (#11043, #11081)

Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)

HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)

🐛 Bug Fixes

Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)

Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)

Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)

Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)

URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11008, #11038)

Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)

Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (#11044, #11059)

Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (#11061)

Synchronous Interceptors: Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (#11071)

🔧 Maintenance & Chores

Dependencies: Updated development and test tooling, the docs fixture's Axios version, and GitHub Actions integrations including Checkout, Setup Node, Setup Deno, and Zizmor. (#11031, #11055, #11056, #11058, #11079, #11080, #11088, #11089, #11090)

Build Outputs: Limited sourcemap generation to published minified bundles, removing broken map references from non-minified builds. (#11054)

Form Data Internals: Centralized FormData header handling and made the Node.js adapter tolerate getHeaders() returning undefined under the content-only policy. (#11062)

Developer Experience: Ignored common local AI-tooling directories and fixed a constant-reassignment crash when the development sandbox serves its root path. (#11032, #11073)

Documentation: Updated sponsor information, clarified that baseURL is not a path-security boundary, scoped provenance claims to attested releases, and corrected the configuration-defaults documentation. (#11041, #11068, #11076, #11078)

Publishing: Simplified v1 publishing to use the npm version bundled with Node.js 26 and updated package metadata for the 1.19.0 release. (#11083, #11095)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve Axios:

@afonsojramos (#11028)

@MahinAnowar (#11006)

@yassertawfik4 (#11024)

@AnandSundar (#11029)

@lin-hongkuan (#11035)

@Wali007-lab (#11054)

@magicdawn (#11043)

@andrewkernel (#11053)

@Sagargupta16 (#11059)

... (truncated)

Commits

311fcc5 chore(release): prepare release 1.19.0 (#11095)
cb4fd74 chore(deps): bump axios from 1.16.1 to 1.18.1 in /docs (#11088)
004c93a chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 in the github-action...
122edde chore(deps-dev): bump the development_dependencies group with 3 updates (#11089)
c44f8d0 ci: use bundled npm for v1 publish (#11083)
878bb29 fix(sandbox): resolve TypeError on constant variable path assignment (#11073)
a092bae fix(core): synchronous interceptors swallow errors and proceed with request (...
3041b8f feat(HttpStatusCode): add missing 520 status code (#11067)
58b16c8 refactor(helpers): extract duplicated setFormDataHeaders into a shared helper...
3077e62 feat(types): Allow the Params property to be typed, instead of any (#11081)
Additional commits viewable in compare view

Updates fast-uri from 3.1.2 to 3.1.5

Release notes

Sourced from fast-uri's releases.

v3.1.5

⚠️ Security Warning

Fix for GHSA-7p8r-x3mc-p8w7

Full Changelog: fastify/fast-uri@v3.1.4...v3.1.5

v3.1.4

⚠️ Security Release

Fix for GHSA-v2hh-gcrm-f6hx

Full Changelog: fastify/fast-uri@v3.1.3...v3.1.4

v3.1.3

⚠️ Security Release

Fixes: GHSA-4c8g-83qw-93j6

Full Changelog: fastify/fast-uri@v3.1.2...v3.1.3

Commits

5e179cb Bumped v3.1.5
2cad02d Merge commit from fork
6aeece6 Bumped v3.1.4
2d50fba fix: reject literal backslash in URI authority
0549fe3 Bumped v3.1.3
2a6d357 Merge commit from fork
See full diff in compare view

Updates hono from 4.12.26 to 4.13.3

Release notes

Sourced from hono's releases.

v4.13.3

What's Changed

fix(client): prevent URL corruption when replaceUrlParam contains $ replacement tokens in honojs/hono#5227

fix(etag): copy pending stream bytes in honojs/hono#5239

fix(etag): avoid skipping headers when filtering 304 response headers in honojs/hono#5234

fix(cors): append Origin to Vary header on OPTIONS preflight in honojs/hono#5235

docs(context): add custom headers append option example to Context JSDoc in honojs/hono#5248

fix(trie-router): match suffix wildcard routes in honojs/hono#5236

fix(pattern-router/linear-router): prevent prefix overmatch on wildcard routes in honojs/hono#5252

fix(csrf): exempt OPTIONS request from CSRF validation in honojs/hono#5250

fix(utils/ipaddr): avoid truncation on embedded IPv4 addresses in expand IPv6 in honojs/hono#5247

feat(pretty-json): support structured JSON content-types (+json) in honojs/hono#5226

Full Changelog: honojs/hono@v4.13.2...v4.13.3

v4.13.2

What's Changed

fix(secure-headers): output standard empty parentheses () instead of none for disabled Permissions-Policy directives in honojs/hono#5197

fix(jsx): render async children of document metadata tags instead of [object Promise] in honojs/hono#5204

fix(etag): resolve incorrect incremental hashing for chunked responses in honojs/hono#5199

fix(client): serialize multiple cookies correctly in honojs/hono#5202

fix(etag): stabilize digest across stream chunks in honojs/hono#5205

fix(url): strip trailing question mark correctly for optional params with regex quantifiers in honojs/hono#5209

perf(cors): pre-join static array header options during initialization in honojs/hono#5210

fix(client): send falsy JSON bodies in honojs/hono#5215

feat(secure-headers): add missing W3C Permissions-Policy directives in honojs/hono#5214

Full Changelog: honojs/hono@v4.13.1...v4.13.2

v4.13.1

What's Changed

fix(trie-router): count every slash a pattern consumes by @Jaybhade in honojs/hono#5189

fix(utils/stream): re-acquire writer lock when pipe() throws by @Sriharsha-dev369 in honojs/hono#4988

fix(etag): skip unsafe methods or error responses on non-* case by @na-trium-144 in honojs/hono#5196

New Contributors

@Jaybhade made their first contribution in honojs/hono#5189

@Sriharsha-dev369 made their first contribution in honojs/hono#4988

Full Changelog: honojs/hono@v4.13.0...v4.13.1

v4.13.0

Hono v4.13.0 is now available!

The highlight of this release is performance: a batch of low-level optimizations makes the core request/response path significantly faster — up to 1.25x on common routes in our benchmark. This release also adds first-class support for the HTTP QUERY method, defined in RFC 10008, a new Method Not Allowed middleware, and more.

Performance improvements

This release includes a series of small optimizations: skipping unnecessary Headers allocations, replacing regex tests with indexOf, allocating internal state lazily, and more.

... (truncated)

Commits

0293343 4.13.3
5ad469a feat(pretty-json): support structured JSON content-types (+json) (#5226)
c91ec9b fix(utils/ipaddr): avoid truncation on embedded IPv4 addresses in expandIPv6 ...
eea9735 fix(csrf): exempt OPTIONS request from CSRF validation (#5250)
a194628 fix(pattern-router/linear-router): prevent prefix overmatch on wildcard route...
63bbcf5 fix(trie-router): match suffix wildcard routes (#5236)
ef0739d docs(context): add custom headers append option example to Context JSDoc (#5248)
8bf03c3 fix(cors): append Origin to Vary header on OPTIONS preflight (#5235)
546eca0 fix(etag): avoid skipping headers when filtering 304 response headers (#5234)
7195c24 fix(etag): copy pending stream bytes (#5239)
Additional commits viewable in compare view

Updates ip-address from 10.2.0 to 10.5.0

Release notes

Sourced from ip-address's releases.

v10.5.0

What's Changed

Honor the fromURL graceful-failure contract for non-IPv6 hosts by @beaugunderson in beaugunderson/ip-address#218

Correct the documentation where it disagreed with the library by @beaugunderson in beaugunderson/ip-address#219

Full Changelog: beaugunderson/ip-address@v10.4.0...v10.5.0

v10.4.0

What's Changed

Add GitHub Actions CI by @beaugunderson in beaugunderson/ip-address#213

Keep the package loadable on node 12, and enforce it by @beaugunderson in beaugunderson/ip-address#216

Validate the byte arrays Address6 is given by @beaugunderson in beaugunderson/ip-address#217

Full Changelog: beaugunderson/ip-address@v10.3.1...v10.4.0

v10.3.1

Full Changelog: beaugunderson/ip-address@v10.3.0...v10.3.1

v10.3.0

Full Changelog: beaugunderson/ip-address@v10.2.2...v10.3.0

v10.2.2

Full Changelog: beaugunderson/ip-address@v10.2.1...v10.2.2

v10.2.1

Full Changelog: beaugunderson/ip-address@v10.2.0...v10.2.1

Commits

ef98e0a 10.5.0
9fd1110 Correct the documentation where it disagreed with the library (#219)
d478737 Honor the fromURL graceful-failure contract for non-IPv6 hosts (#218)
fbb8db2 10.4.0
45a2b11 Validate the byte arrays Address6 is given (#217)
bac8810 Keep the package loadable on node 12, and enforce it (#216)
9b3d848 Add a security policy and a README section on security posture
e84a7b3 Order the README API reference Address4, Address6, AddressError
015160b Collapse each class in the README API reference
34061a8 Pin checkout and setup-node to commits in the release job
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for ip-address since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates linkify-it from 5.0.1 to 5.0.2

Changelog

Sourced from linkify-it's changelog.

5.0.2 / 2026-07-02

Fixed DoS in mailto: links (restrict user name to 64 chars).

Restricted user/pass part length in links.

Commits

50a0c91 5.0.2 released
de3b885 Update package hooks
13effaa Add package lock
39d748d Bump c8
00ce877 Drop tlds deps
ecde823 Update benchmark to mitata
23c62cd Refactor demo / doc build and publish
fd63f3b CI config update
f4ea5af demo: update bootstrap & layout
1454fb6 lint: dim warnings
Additional commits viewable in compare view

Updates nanoid from 3.3.11 to 3.3.18

Release notes

Sourced from nanoid's releases.

3.3.18

Fixed infinite loop on async for React Native (by @OvergrowthBeards-JB).

3.3.17

Fixed infinite loop on zero size.

3.3.16

Fixed infinite loop on negative size (by @greymoth-jp).

3.3.15

Fixed npm provenance error.

3.3.14

Fixed random pool corruption on big ID sizes.

3.3.13

Reduced npm package size.

3.3.12

Fixed breaking Nano ID by requesting big ID.

Changelog

Sourced from nanoid's changelog.

3.3.18

Fixed infinite loop on async for React Native (by @OvergrowthBeards-JB).

3.3.17

Fixed infinite loop on zero size.

3.3.16

Fixed infinite loop on negative size (by @greymoth-jp).

3.3.15

Fixed npm provenance error.

3.3.14

Fixed random pool corruption on big ID sizes.

3.3.13

Reduced npm package size.

3.3.12

Fixed breaking Nano ID by requesting big ID.

Commits

9ad9805 Release 3.3.18 version
55e50a0 Update CI action
e10f8d4 Update index.native.js (#606)
73d6716 Release 3.3.17 version
f9d13f1 Sync 0 size behaviour with PostCSS 5
9760e11 Release 3.3.16 version
e835c9b fix(non-secure): clamp negative size to prevent infinite loop (#601)
96dd086 Update CI action
ba0bc3b Do not create latest release for v3
6819724 Release 3.3.15 version
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nanoid since your current version.

Updates postcss from 8.5.14 to 8.5.26

Release notes

Sourced from postcss's releases.

8.5.26

Fixed list.split() regression (by @lazerg).

Track symlinks in path protection in source map loading (by @drengir1).

8.5.25

Fixed 8.5.17 visitor regression.

Fixed list.split() for non-string values (by @amir-rezaei).

8.5.24

Preserve the BOM after the processing (by @hdimer).

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

Fixed declaration parsing performance (by @homanp).

Changelog

Sourced from postcss's changelog.

8.5.26

Fixed list.split() regression (by @lazerg).

Track symlinks in path protection in source map loading (by @drengir1).

8.5.25

Fixed 8.5.17 visitor regression.

Fixed list.split() for non-string values (by @amir-rezaei).

8.5.24

Preserve the BOM after the processing (by @hdimer).

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

... (truncated)

Commits

07b2577 Release 8.5.26 version
47de6b9 Update CI
1493a83 Fix Rule#selectors losing the empty selector (#2129)
180db16 Typo
29e9e00 Resolve symlinks before the previous-source-map containment check (#2125)
3ba8f84 Update dependencies
87e72f6 Update lock file
caaeeb9 Upgrade nanoid to fix infinite loop on zero size (#2124)
3609b6f Explain how to type plugin options
fbad419 docs: sh...
Description has been truncated

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

…pdates Bumps the npm-security group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [adm-zip](https://github.com/cthackers/adm-zip) | `0.5.16` | `0.6.0` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.1.2` | `3.1.5` | | [hono](https://github.com/honojs/hono) | `4.12.26` | `4.13.3` | | [ip-address](https://github.com/beaugunderson/ip-address) | `10.2.0` | `10.5.0` | | [linkify-it](https://github.com/markdown-it/linkify-it) | `5.0.1` | `5.0.2` | | [nanoid](https://github.com/ai/nanoid) | `3.3.11` | `3.3.18` | | [postcss](https://github.com/postcss/postcss) | `8.5.14` | `8.5.26` | Updates `adm-zip` from 0.5.16 to 0.6.0 - [Release notes](https://github.com/cthackers/adm-zip/releases) - [Changelog](https://github.com/cthackers/adm-zip/blob/master/history.md) - [Commits](cthackers/adm-zip@v0.5.16...v0.6.0) Updates `axios` from 1.16.1 to 1.19.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.16.1...v1.19.0) Updates `fast-uri` from 3.1.2 to 3.1.5 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.2...v3.1.5) Updates `hono` from 4.12.26 to 4.13.3 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.26...v4.13.3) Updates `ip-address` from 10.2.0 to 10.5.0 - [Release notes](https://github.com/beaugunderson/ip-address/releases) - [Commits](beaugunderson/ip-address@v10.2.0...v10.5.0) Updates `linkify-it` from 5.0.1 to 5.0.2 - [Changelog](https://github.com/markdown-it/linkify-it/blob/master/CHANGELOG.md) - [Commits](markdown-it/linkify-it@5.0.1...5.0.2) Updates `nanoid` from 3.3.11 to 3.3.18 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/3.3.18/CHANGELOG.md) - [Commits](ai/nanoid@3.3.11...3.3.18) Updates `postcss` from 8.5.14 to 8.5.26 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.14...8.5.26) Updates `socket.io-parser` from 4.2.6 to 4.2.7 - [Release notes](https://github.com/socketio/socket.io/releases) - [Changelog](https://github.com/socketio/socket.io/blob/main/CHANGELOG.md) - [Commits](https://github.com/socketio/socket.io/compare/socket.io-parser@4.2.6...socket.io-parser@4.2.7) Updates `tar` from 7.5.15 to 7.5.21 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v7.5.15...v7.5.21) --- updated-dependencies: - dependency-name: adm-zip dependency-version: 0.6.0 dependency-type: indirect dependency-group: npm-security - dependency-name: axios dependency-version: 1.19.0 dependency-type: indirect dependency-group: npm-security - dependency-name: fast-uri dependency-version: 3.1.5 dependency-type: indirect dependency-group: npm-security - dependency-name: hono dependency-version: 4.13.3 dependency-type: indirect dependency-group: npm-security - dependency-name: ip-address dependency-version: 10.5.0 dependency-type: indirect dependency-group: npm-security - dependency-name: linkify-it dependency-version: 5.0.2 dependency-type: indirect dependency-group: npm-security - dependency-name: nanoid dependency-version: 3.3.18 dependency-type: indirect dependency-group: npm-security - dependency-name: postcss dependency-version: 8.5.26 dependency-type: indirect dependency-group: npm-security - dependency-name: socket.io-parser dependency-version: 4.2.7 dependency-type: indirect dependency-group: npm-security - dependency-name: tar dependency-version: 7.5.21 dependency-type: indirect dependency-group: npm-security ... Signed-off-by: dependabot[bot] <support@github.com>

vercel · 2026-08-21T04:52:44Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
api	Ready	Preview	Aug 21, 2026 4:53am

greptile-apps · 2026-08-21T04:52:46Z

PR author is in the excluded authors list.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 21, 2026

dependabot Bot added the javascript Pull requests that update javascript code label Aug 21, 2026

vercel Bot deployed to Preview August 21, 2026 04:53 View deployment

Navigation Menu

Uh oh!

chore(deps): bump the npm-security group across 1 directory with 10 updates - #334

chore(deps): bump the npm-security group across 1 directory with 10 updates#334
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-security-ff69d77ea0

dependabot Bot commented on behalf of github Aug 21, 2026 •

edited by blacksmith-sh Bot

Loading

Uh oh!

vercel Bot commented Aug 21, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot commented Aug 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 21, 2026 • edited by blacksmith-sh Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v0.6.0

v0.5.18

What's Changed

New Contributors

v0.5.17

What's Changed

New Contributors

0.6.0 / 2026-07-10

0.5.4 / 2021-03-08

0.5.3 / 2021-02-07

0.5.2 / 2021-01-27

0.5.1 / 2020-11-27

0.5.0 / 2020-11-19

v1.19.0 - July 22, 2026

🔒 Security Fixes

🚀 New Features

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

v1.19.0 — July 22, 2026

🔒 Security Fixes

🚀 New Features

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

v3.1.5

⚠️ Security Warning

v3.1.4

⚠️ Security Release

v3.1.3

⚠️ Security Release

v4.13.3

What's Changed

v4.13.2

What's Changed

v4.13.1

What's Changed

New Contributors

v4.13.0

Performance improvements

v10.5.0

What's Changed

v10.4.0

What's Changed

v10.3.1

v10.3.0

v10.2.2

v10.2.1

5.0.2 / 2026-07-02

3.3.18

3.3.17

3.3.16

3.3.15

3.3.14

3.3.13

3.3.12

3.3.18

3.3.17

3.3.16

3.3.15

3.3.14

3.3.13

3.3.12

8.5.26

8.5.25

8.5.24

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.17

8.5.16

8.5.15

8.5.26

dependabot Bot commented on behalf of github Aug 21, 2026 •

edited by blacksmith-sh Bot

Loading

vercel Bot commented Aug 21, 2026 •

edited

Loading