Skip to content

chore(deps): bump the npm_and_yarn group across 1 directory with 13 updates - #55

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-c9acc4824f
Open

chore(deps): bump the npm_and_yarn group across 1 directory with 13 updates#55
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-c9acc4824f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 8 updates in the / directory:

Package From To
postcss 8.5.6 8.5.15
minimatch 3.1.2 3.1.5
@modelcontextprotocol/sdk 1.21.0 1.29.0
file-type 21.0.0 21.3.4
flatted 3.3.3 3.4.2
js-yaml 4.1.0 4.2.0
picomatch 2.3.1 4.0.4
undici 7.16.0 7.27.2

Updates postcss from 8.5.6 to 8.5.15

Release notes

Sourced from postcss's releases.

8.5.15

  • Fixed declaration parsing performance (by @​homanp).

8.5.14

8.5.13

  • Fixed postcss-scss commend regression.

8.5.12

  • Fixed reading any file via user-generated CSS.
  • Added opts.unsafeMap to disable checks.

8.5.11

  • Fixed nested brackets parsing performance (by @​offset).

8.5.10

  • Fixed XSS via unescaped </style> in non-bundler cases (by @​TharVid).

8.5.9

  • Speed up source map encoding paring in case of the error.

8.5.8

  • Fixed Processor#version.

8.5.7

  • Improved source map annotation cleaning performance (by CodeAnt AI).
Changelog

Sourced from postcss's changelog.

8.5.15

  • Fixed declaration parsing performance (by @​homanp).

8.5.14

8.5.13

  • Fixed postcss-scss commend regression.

8.5.12

  • Fixed reading any file via user-generated CSS.
  • Added opts.unsafeMap to disable checks.

8.5.11

  • Fixed nested brackets parsing performance (by @​offset).

8.5.10

  • Fixed XSS via unescaped </style> in non-bundler cases (by @​TharVid).

8.5.9

  • Speed up source map encoding paring in case of the error.

8.5.8

  • Fixed Processor#version.

8.5.7

  • Improved source map annotation cleaning performance (by CodeAnt AI).
Commits
  • eae46db Release 8.5.15 version
  • 79508ff Update CI actions
  • b128e21 Speed up declaration parsing by avoiding creating new array on each token
  • 9825dca Fix code format
  • 55789c8 Update dependencies
  • 84fbbe9 Install older pnpm action for old Node.js
  • 9f860bd Revert pnpm action for old Node.js
  • 0877198 Update CI actions
  • b2d1a33 Fix linter warnings
  • 0700dac Merge pull request #2088 from rootvector2/add-oss-fuzz-harness
  • Additional commits viewable in compare view

Updates uuid from 11.1.0 to 14.0.0

Release notes

Sourced from uuid's releases.

v14.0.0

14.0.0 (2026-04-19)

⚠ BREAKING CHANGES

  • expect crypto to be global everywhere (requires node@20+) (#935)
  • drop node@18 support (#934)

Features

Bug Fixes

  • expect crypto to be global everywhere (requires node@20+) (#935) (f2c235f)
  • Use GITHUB_TOKEN for release-please and enable npm provenance (#925) (ffa3138)

v13.0.2

13.0.2 (2026-05-04)

Bug Fixes

  • rerelease to fix provenance. (49ccb35)

v13.0.1

13.0.1 (2026-04-27)

Bug Fixes

v13.0.0

13.0.0 (2025-09-08)

⚠ BREAKING CHANGES

  • make browser exports the default (#901)

Bug Fixes

v12.0.1

12.0.1 (2026-04-29)

... (truncated)

Changelog

Sourced from uuid's changelog.

14.0.0 (2026-04-19)

Security

  • Fixes GHSA-w5hq-g745-h8pq: v3(), v5(), and v6() did not validate that writes would remain within the bounds of a caller-supplied buffer, allowing out-of-bounds writes when an invalid offset was provided. A RangeError is now thrown if offset < 0 or offset + 16 > buf.length.

⚠ BREAKING CHANGES

  • crypto is now expected to be globally defined (requires node@20+) (#935)
  • drop node@18 support (#934)
  • upgrade minimum supported TypeScript version to 5.4.3, in keeping with the project's policy of supporting TypeScript versions released within the last two years

13.0.0 (2025-09-08)

⚠ BREAKING CHANGES

  • make browser exports the default (#901)

Bug Fixes

12.0.0 (2025-09-05)

⚠ BREAKING CHANGES

  • update to typescript@5.2 (#887)
  • remove CommonJS support (#886)
  • drop node@16 support (#883)

Features

Bug Fixes

Commits
  • 7c1ea08 chore(main): release 14.0.0 (#926)
  • 3d2c5b0 Merge commit from fork
  • f2c235f fix!: expect crypto to be global everywhere (requires node@20+) (#935)
  • 529ef08 chore: upgrade TypeScript and fixup types (#927)
  • 086fd79 chore: update dependencies (#933)
  • dc4ddb8 feat!: drop node@18 support (#934)
  • 0f1f9c9 chore: switch to Biome for parsing and linting (#932)
  • e2879e6 chore: use maintained version of npm-run-all (#930)
  • ffa3138 fix: Use GITHUB_TOKEN for release-please and enable npm provenance (#925)
  • 0423d49 docs: remove obsolete v1 option notes (#915)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for uuid since your current version.


Updates ws from 8.18.3 to 8.21.0

Release notes

Sourced from ws's releases.

8.21.0

Features

  • Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

  • Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.

import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(client close - code: ${code} reason: ${reason.toString()});
});
});
wss.on('connection', function (ws) {
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(server close - code: ${code} reason: ${reason.toString()});
});
});

The vulnerability was responsibly disclosed and fixed by Nadav Magier.

In vulnerable versions, the issue can be mitigated by lowering the value of the maxPayload option if possible.

8.20.1

... (truncated)

Commits
  • bca91ad [dist] 8.21.0
  • 2b2abd4 [security] Limit retained message parts
  • 78eabe2 [security] Add latest vulnerability to SECURITY.md
  • 5d9b316 [dist] 8.20.1
  • c0327ec [security] Fix uninitialized memory disclosure in websocket.close()
  • ce2a3d6 [ci] Test on node 26
  • 58e45b8 [ci] Do not test on node 25
  • 5f26c24 [ci] Run the lint step on node 24
  • 8439255 [dist] 8.20.0
  • d3503c1 [minor] Export the PerMessageDeflate class and header utils
  • Additional commits viewable in compare view

Updates esbuild from 0.20.2 to 0.25.12

Release notes

Sourced from esbuild's releases.

v0.25.12

  • Fix a minification regression with CSS media queries (#4315)

    The previous release introduced support for parsing media queries which unintentionally introduced a regression with the removal of duplicate media rules during minification. Specifically the grammar for @media <media-type> and <media-condition-without-or> { ... } was missing an equality check for the <media-condition-without-or> part, so rules with different suffix clauses in this position would incorrectly compare equal and be deduplicated. This release fixes the regression.

  • Update the list of known JavaScript globals (#4310)

    This release updates esbuild's internal list of known JavaScript globals. These are globals that are known to not have side-effects when the property is accessed. For example, accessing the global Array property is considered to be side-effect free but accessing the global scrollY property can trigger a layout, which is a side-effect. This is used by esbuild's tree-shaking to safely remove unused code that is known to be side-effect free. This update adds the following global properties:

    From ES2017:

    • Atomics
    • SharedArrayBuffer

    From ES2020:

    • BigInt64Array
    • BigUint64Array

    From ES2021:

    • FinalizationRegistry
    • WeakRef

    From ES2025:

    • Float16Array
    • Iterator

    Note that this does not indicate that constructing any of these objects is side-effect free, just that accessing the identifier is side-effect free. For example, this now allows esbuild to tree-shake classes that extend from Iterator:

    // This can now be tree-shaken by esbuild:
class ExampleIterator extends Iterator {}

  • Add support for the new @view-transition CSS rule (#4313)

    With this release, esbuild now has improved support for pretty-printing and minifying the new @view-transition rule (which esbuild was previously unaware of):

    /* Original code */
@view-transition {
  navigation: auto;
  types: check;
}
/* Old output */
@​view-transition { navigation: auto; types: check; }
/* New output */
@​view-transition {
navigation: auto;
types: check;

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2024

This changelog documents all esbuild versions published in the year 2024 (versions 0.19.12 through 0.24.2).

0.24.2

  • Fix regression with --define and import.meta (#4010, #4012, #4013)

    The previous change in version 0.24.1 to use a more expression-like parser for define values to allow quoted property names introduced a regression that removed the ability to use --define:import.meta=.... Even though import is normally a keyword that can't be used as an identifier, ES modules special-case the import.meta expression to behave like an identifier anyway. This change fixes the regression.

    This fix was contributed by @​sapphi-red.

0.24.1

  • Allow es2024 as a target in tsconfig.json (#4004)

    TypeScript recently added es2024 as a compilation target, so esbuild now supports this in the target field of tsconfig.json files, such as in the following configuration file:

    {
  "compilerOptions": {
    "target": "ES2024"
  }
}

    As a reminder, the only thing that esbuild uses this field for is determining whether or not to use legacy TypeScript behavior for class fields. You can read more in the documentation.

    This fix was contributed by @​billyjanitsch.

  • Allow automatic semicolon insertion after get/set

    This change fixes a grammar bug in the parser that incorrectly treated the following code as a syntax error:

    class Foo {
  get
  *x() {}
  set
  *y() {}
}

    The above code will be considered valid starting with this release. This change to esbuild follows a similar change to TypeScript which will allow this syntax starting with TypeScript 5.7.

  • Allow quoted property names in --define and --pure (#4008)

    The define and pure API options now accept identifier expressions containing quoted property names. Previously all identifiers in the identifier expression had to be bare identifiers. This change now makes --define and --pure consistent with --global-name, which already supported quoted property names. For example, the following is now possible:

    

    • 






... (truncated)





Commits

    

  • 208f539 publish 0.25.12 to npm
    • 

  • 5f03afd update release notes
    • 

  • 6b2ee78 minify: remove css rules containing empty :is()
    • 

  • f361deb add some additional known static methods
    • 

  • 07aa646 automatically mark "RegExp.escape()" calls as pure
    • 

  • 9039c46 simplify some call expression checks
    • 

  • 188944d add some additional known static methods
    • 

  • d3c67f9 fix #4310: add Iterator and other known globals
    • 

  • 4a51f0b fix: escape dev server breadcrumb hrefs properly (#4316)
    • 

  • 26b29ed fix #4315: @media deduplication bug edge case
    • 

  • Additional commits viewable in compare view
    • 







Updates minimatch from 3.1.2 to 3.1.5



Commits






Updates @modelcontextprotocol/sdk from 1.21.0 to 1.29.0



Release notes

Sourced from @​modelcontextprotocol/sdk's releases.




v1.29.0


What's Changed



New Contributors



Full Changelog: modelcontextprotocol/typescript-sdk@v1.28.0...v1.29.0


v1.28.0


What's Changed



New Contributors



Full Changelog: modelcontextprotocol/typescript-sdk@v1.27.1...v1.28.0


v1.27.1


What's Changed



New Contributors



Full Changelog: modelcontextprotocol/typescript-sdk@v1.27.0...v1.27.1


v1.27.0


What's Changed





... (truncated)





Commits





Maintainer changes

This version was pushed to npm by pcarleton, a new releaser for @​modelcontextprotocol/sdk since your current version.






Updates qs from 6.13.0 to 6.15.2



Changelog

Sourced from qs's changelog.




6.15.2


    

  • [Fix] stringify: skip null/undefined entries in arrayFormat: 'comma' + encodeValuesOnly instead of crashing in encoder
    • 

  • [Fix] stringify: use configured delimiter after charsetSentinel (#555)
    • 

  • [Fix] stringify: apply formatter to encoded key under strictNullHandling (#554)
    • 

  • [Fix] stringify: skip null/undefined filter-array entries instead of crashing in encoder (#551)
    • 

  • [Fix] parse: handle nested bracket groups and add regression tests (#530)
    • 

  • [readme] fix grammar (#550)
    • 

  • [Dev Deps] update @ljharb/eslint-config
    • 

  • [Tests] add regression tests for keys containing percent-encoded bracket text
    • 



6.15.1


    

  • [Fix] parse: parameterLimit: Infinity with throwOnLimitExceeded: true silently drops all parameters
    • 

  • [Deps] update @ljharb/eslint-config
    • 

  • [Dev Deps] update @ljharb/eslint-config, iconv-lite
    • 

  • [Tests] increase coverage
    • 



6.15.0


    

  • [New] parse: add strictMerge option to wrap object/primitive conflicts in an array (#425, #122)
    • 

  • [Fix] duplicates option should not apply to bracket notation keys (#514)
    • 



6.14.2


    

  • [Fix] parse: mark overflow objects for indexed notation exceeding arrayLimit (#546)
    • 

  • [Fix] arrayLimit means max count, not max index, in combine/merge/parseArrayValue
    • 

  • [Fix] parse: throw on arrayLimit exceeded with indexed notation when throwOnLimitExceeded is true (#529)
    • 

  • [Fix] parse: enforce arrayLimit on comma-parsed values
    • 

  • [Fix] parse: fix error message to reflect arrayLimit as max index; remove extraneous comments (#545)
    • 

  • [Robustness] avoid .push, use void
    • 

  • [readme] document that addQueryPrefix does not add ? to empty output (#418)
    • 

  • [readme] clarify parseArrays and arrayLimit documentation (#543)
    • 

  • [readme] replace runkit CI badge with shields.io check-runs badge
    • 

  • [meta] fix changelog typo (arrayLength → arrayLimit)
    • 

  • [actions] fix rebase workflow permissions
    • 



6.14.1


    

  • [Fix] ensure arrayLimit applies to [] notation as well
    • 

  • [Fix] parse: when a custom decoder returns null for a key, ignore that key
    • 

  • [Refactor] parse: extract key segment splitting helper
    • 

  • [meta] add threat model
    • 

  • [actions] add workflow permissions
    • 

  • [Tests] stringify: increase coverage
    • 

  • [Dev Deps] update eslint, @ljharb/eslint-config, npmignore, es-value-fixtures, for-each, object-inspect
    • 



6.14.0


    

  • [New] parse: add throwOnParameterLimitExceeded option (#517)
    • 

  • [Refactor] parse: use utils.combine more
    • 

  • [patch] parse: add explicit throwOnLimitExceeded default
    • 

  • [actions] use shared action; re-add finishers
    • 

  • [meta] Fix changelog formatting bug
    • 

  • [Deps] update side-channel
    • 

  • [Dev Deps] update es-value-fixtures, has-bigints, has-proto, has-symbols
    • 






... (truncated)





Commits

    

  • 9aca407 v6.15.2
    • 

  • 5e33d33 [Dev Deps] update @ljharb/eslint-config
    • 

  • 21f80b3 [Fix] stringify: skip null/undefined entries in arrayFormat: 'comma' + `e...
    • 

  • a0a81ea [Fix] stringify: use configured delimiter after charsetSentinel
    • 

  • e3062f7 [Fix] stringify: apply formatter to encoded key under strictNullHandling
    • 

  • 0c180a4 [Fix] stringify: skip null/undefined filter-array entries instead of crashi...
    • 

  • 3a8b94a [Tests] add regression tests for keys containing percent-encoded bracket text
    • 

  • 96755ab [readme] fix grammar
    • 

  • a419ce5 [Fix] parse: handle nested bracket groups and add regression tests
    • 

  • 3f5e1c5 v6.15.1
    • 

  • Additional commits viewable in compare view
    • 







Updates file-type from 21.0.0 to 21.3.4



Release notes

Sourced from file-type's releases.




v21.3.4


    

  • Harden parser more  aec20a0
    • 





sindresorhus/file-type@v21.3.3...v21.3.4


v21.3.3


    

  • Harden parser  c48c90b 135f91b
    • 





sindresorhus/file-type@v21.3.2...v21.3.3


v21.3.2


    

  • Fix ZIP bomb in known-size ZIP probing (GHSA-j47w-4g3g-c36v)  a155cd7
    • 

  • Fix bound recursive BOM and ID3 detection  370ed91
    • 





sindresorhus/file-type@v21.3.1...v21.3.2


v21.3.1





sindresorhus/file-type@v21.3.0...v21.3.1


v21.3.0


    

  • Add support for Mach-O Universal (aka "Fat") binaries and additional architectures (#779)  d223491
    • 





sindresorhus/file-type@v21.2.0...v21.3.0


v21.2.0


    

  • Add support for SPSS data files (#787)  889f638
    • 

  • Add support for JMP (#784)  093dba0
    • 





sindresorhus/file-type@v21.1.1...v21.2.0


v21.1.1


    

  • Fix handling of partial Gunzip file (#783)  710e053
    • 





sindresorhus/file-type@v21.1.0...v21.1.1





... (truncated)





Commits






Updates flatted from 3.3.3 to 3.4.2



Commits

    

  • 3bf0909 3.4.2
    • 

  • 885ddcc fix CWE-1321
    • 

  • 0bdba70 added flatted-view to the benchmark
    • 

  • 2a02dce 3.4.1
    • 

  • fba4e8f Merge pull request #89 from WebReflection/python-fix
    • 

  • 5fe8648 added "when in Rome" also a test for PHP
    • 

  • 53517ad some minor improvement
    • 

  • b3e2a0c Fixing recursion issue in Python too
    • 

  • c4b46db Add SECURITY.md for security policy and reporting
    • 

  • f86d071 Create dependabot.yml for version updates
    • 

  • Additional commits viewable in compare view
    • 







Updates js-yaml from 4.1.0 to 4.2.0



Changelog

Sourced from js-yaml's changelog.




[4.2.0] - 2026-06-01


Added


    

  • Added docs/safety.md with notes about processing untrusted YAML.
    • 

  • Added maxDepth (100) loader option. Not a problem, but gives a better
exception instead of RangeError on stack overflow.
    • 

  • Added maxMergeSeqLength (20) loader option. Not a problem after merge fix,
but an additional restriction for safety.
    • 

  • Added sourcemaps to dist/ builds.
    • 



Changed


    

  • Stop resolving numbers with underscores as numeric scalars, #627.
    • 

  • Switched dev toolchains to Vite / neostandard.
    • 

  • Updated demo.
    • 

  • Reorganized tests.
    • 

  • dist/ files are no longer kept in the repository.
    • 



Fixed


    

  • Fix parsing of properties on the first implicit block mapping key, #62.
    • 

  • Fix trailing whitespace handling when folding flow scalar lines, #307.
    • 

  • Reject top-level block scalars without content indentation, #280.
    • 

  • Ensure numbers survive round-trip, #737.
    • 

  • Fix test coverage for issue #221.
    • 

  • Fix flow scalar trailing whitespace folding, #307.
    • 

  • Fix digits in YAML named tag handles.
    • 



Security


    

  • Fix potential DoS via quadratic complexity in merge - deduplicate repeated
elements (makes sense for malformed files > 10K).
    • 



[3.14.2] - 2025-11-15


Security


    

  • Backported v4.1.1 fix to v3
    • 



[4.1.1] - 2025-11-12


Security


    

  • Fix prototype pollution issue in yaml merge (<<) operator.
    • 








Commits






Updates path-to-regexp from 0.1.12 to 8.3.0



Release notes

Sourced from path-to-regexp's releases.




v8.3.0


Changed


    

  • Add custom error class (#398)  2a7f2a4
    • 

  • Allow plain objects for TokenData (#391)  687a9bb
    • 

  • Escape text should escape backslash (#390)  a4a8552
    • 

  • Improved error messages and stack size (#363)  a6bdf40
    • 



Other


    

  • Minifying the parser

      

    • PR (#401)  9df2448
      • 

    • PR (#395)  4a91505
      • 

    • Shaving some bytes  d63f44b
      • 

    • Remove optional operator  973d15c
      • 

    

    • 



pillarjs/path-to-regexp@v8.2.0...v8.3.0







Changelog

Sourced from path-to-regexp's changelog.




Moved to GitHub Releases


3.0.0 / 2019-01-13


    

  • Always use prefix character as delimiter token, allowing any character to be a delimiter (e.g. /:att1-:att2-:att3-:att4-:att5)
    • 

  • Remove partial support, prefer escaping the prefix delimiter explicitly (e.g. \\/(apple-)?icon-:res(\\d+).png)
    • 



2.4.0 / 2018-08-26


    

  • Support start option to disable anchoring from beginning of the string
    • 



2.3.0 / 2018-08-20


    

  • Use delimiter when processing repeated matching groups (e.g. foo/bar has no prefix, but has a delimiter)
    • 



2.2.1 / 2018-04-24


    

  • Allow empty string with end: false to match both relative and absolute paths
    • 



2.2.0 / 2018-03-06


    

  • Pass token as second argument to encode option (e.g. encode(value, token))
    • 



2.1.0 / 2017-10-20


    

  • Handle non-ending paths where the final character is a delimiter

      

    • E.g. /foo/ before required either /foo/ or /foo// to match in non-ending mode
      • 

    

    • 



2.0.0 / 2017-08-23


    

  • New option! Ability to set endsWith to match paths like /test?query=string up to the query string
    • 

  • New option! Set delimiters for specific characters to be treated as parameter prefixes (e.g. /:test)
    • 

  • Remove isarray dependency
    • 

  • Explicitly handle trailing delimiters instead of trimming them (e.g. /test/ is now treated as /test/ instead of /test when matching)
    • 

  • Remove overloaded keys argument that accepted options
    • 

  • Remove keys list attached to the RegExp output
    • 

  • Remove asterisk functionality (it's a real pain to properly encode)
    • 

  • Change tokensToFunction (e.g. compile) to accept an encode function for pretty encoding (e.g. pass your own implementation)
    • 



1.7.0 / 2016-11-08


    

  • Allow a delimiter option to be passed in with tokensToRegExp which will be used for "non-ending" token match situations
    • 



1.6.0 / 2016-10-03


    

  • Populate RegExp.keys when using the tokensToRegExp method (making it consistent with the main export)
    • 

  • Allow a delimiter option to be passed in with parse
    • 

  • Updated TypeScript definition with Keys and Options updated
    • 



1.5.3 / 2016-06-15





... (truncated)





Commits





Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.






Updates picomatch from 2.3.1 to 4.0.4



Release notes

Sourced from picomatch's releases.




4.0.4


This is a security release fixing several security relevant issues.


What's Changed



Full Changelog: micromatch/picomatch@4.0.3...4.0.4


4.0.3


What's Changed



New Contributors



Full Changelog: micromatch/picomatch@4.0.2...4.0.3


3.0.2


This is a security release fixing several security releva...

Description has been truncated

    

  
  



      


          

          
  
  

    
  
    
    

  

  

  



                    

          
        





  





    



      

  
            

    

      
    

    


      


          @dependabot
dependabot
Bot



            added
      
  dependencies

  Pull requests that update a dependency file

      
  javascript

  Pull requests that update javascript code

  labels


      Jun 12, 2026

    

  



  

  
  

  
    

        

              @dependabot


        

      

            dependabot
Bot

            force-pushed
    the
        
      
  dependabot/npm_and_yarn/npm_and_yarn-c9acc4824f


    
 branch
    from
    ce7ba9f    to
    4ef4338      
    Compare
  



        June 14, 2026 02:44        
        
      

    










      

  
        

  

      

  
  

  
          

  

    

      


  

        
          @dependabot
  




      

        
          chore(deps): bump the npm_and_yarn group across 1 directory with 13 u…
        

          
                        
      


      

        

    
    
    

  

    


      


      

        

          

    
    
    

  

  

    
  



        

      


      

        
          8934b85
        
      

    

  

    

      
…pdates

Bumps the npm_and_yarn group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [postcss](https://github.com/postcss/postcss) | `8.5.6` | `8.5.15` |
| [minimatch](https://github.com/isaacs/minimatch) | `3.1.2` | `3.1.5` |
| [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.21.0` | `1.29.0` |
| [file-type](https://github.com/sindresorhus/file-type) | `21.0.0` | `21.3.4` |
| [flatted](https://github.com/WebReflection/flatted) | `3.3.3` | `3.4.2` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.0` | `4.2.0` |
| [picomatch](https://github.com/micromatch/picomatch) | `2.3.1` | `4.0.4` |
| [undici](https://github.com/nodejs/undici) | `7.16.0` | `7.27.2` |



Updates `postcss` from 8.5.6 to 8.5.15
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.6...8.5.15)

Updates `uuid` from 11.1.0 to 14.0.0
- [Release notes](https://github.com/uuidjs/uuid/releases)
- [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md)
- [Commits](uuidjs/uuid@v11.1.0...v14.0.0)

Updates `ws` from 8.18.3 to 8.21.0
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.18.3...8.21.0)

Updates `esbuild` from 0.20.2 to 0.25.12
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2024.md)
- [Commits](evanw/esbuild@v0.20.2...v0.25.12)

Updates `minimatch` from 3.1.2 to 3.1.5
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v3.1.2...v3.1.5)

Updates `@modelcontextprotocol/sdk` from 1.21.0 to 1.29.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@1.21.0...v1.29.0)

Updates `qs` from 6.13.0 to 6.15.2
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.13.0...v6.15.2)

Updates `file-type` from 21.0.0 to 21.3.4
- [Release notes](https://github.com/sindresorhus/file-type/releases)
- [Commits](sindresorhus/file-type@v21.0.0...v21.3.4)

Updates `flatted` from 3.3.3 to 3.4.2
- [Commits](WebReflection/flatted@v3.3.3...v3.4.2)

Updates `js-yaml` from 4.1.0 to 4.2.0
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/commits)

Updates `path-to-regexp` from 0.1.12 to 8.3.0
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v0.1.12...v8.3.0)

Updates `picomatch` from 2.3.1 to 4.0.4
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@2.3.1...4.0.4)

Updates `undici` from 7.16.0 to 7.27.2
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.16.0...v7.27.2)

---
updated-dependencies:
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.29.0
  dependency-type: indirect
- dependency-name: esbuild
  dependency-version: 0.25.12
  dependency-type: direct:development
- dependency-name: file-type
  dependency-version: 21.3.4
  dependency-type: indirect
- dependency-name: flatted
  dependency-version: 3.4.2
  dependency-type: indirect
- dependency-name: js-yaml
  dependency-version: 4.2.0
  dependency-type: indirect
- dependency-name: minimatch
  dependency-version: 3.1.5
  dependency-type: indirect
- dependency-name: path-to-regexp
  dependency-version: 8.3.0
  dependency-type: indirect
- dependency-name: picomatch
  dependency-version: 4.0.4
  dependency-type: indirect
- dependency-name: postcss
  dependency-version: 8.5.15
  dependency-type: direct:production
- dependency-name: qs
  dependency-version: 6.15.2
  dependency-type: indirect
- dependency-name: undici
  dependency-version: 7.27.2
  dependency-type: indirect
- dependency-name: uuid
  dependency-version: 14.0.0
  dependency-type: direct:production
- dependency-name: ws
  dependency-version: 8.21.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

    







  








      

  
          

  
  

  
    

        

              @dependabot


        

      

            dependabot
Bot

            force-pushed
    the
        
      
  dependabot/npm_and_yarn/npm_and_yarn-c9acc4824f


    
 branch
    from
    4ef4338    to
    8934b85      
    Compare
  



        June 14, 2026 02:49        
        
      

    














  
  

    

      

  










  








  
      

  
    Sign up for free
    to join this conversation on GitHub.
    Already have an account?
    Sign in to comment


  










    
        

  

    
    

    

  

    Reviewers
  


    

    No reviews







  
      

  


      
  

    Assignees
  



        


    No one assigned







  
        


  


  

    Labels
  



    

      
    dependencies

  Pull requests that update a dependency file
  
    javascript

  Pull requests that update javascript code








  
        

  

    

        

    Projects
  


        




    None yet




  



  
        


  

    
  

    Milestone
  


      No milestone





    
      
          


  

    

      
        

          
  

    Development
  



            


Successfully merging this pull request may close these issues.





  
  



      
    

  




      

  
  
        

  

    

      0 participants