Latest Results
chore: Bump the npm_and_yarn group across 1 directory with 3 updates (#113)
Bumps the npm_and_yarn group with 3 updates in the / directory:
[http-cache-semantics](https://github.com/kornelski/http-cache-semantics),
[minimatch](https://github.com/isaacs/minimatch) and
[picomatch](https://github.com/micromatch/picomatch).
Updates `http-cache-semantics` from 4.2.0 to 4.3.0
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/kornelski/http-cache-semantics/commits">compare
view</a></li>
</ul>
</details>
<br />
Updates `minimatch` from 10.1.1 to 10.2.6
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/isaacs/minimatch/blob/main/changelog.md">minimatch's
changelog</a>.</em></p>
<blockquote>
<h1>change log</h1>
<h2>10.2</h2>
<ul>
<li>Add <code>braceExpandMax</code> option</li>
</ul>
<h2>10.1</h2>
<ul>
<li>Add <code>magicalBraces</code> option for <code>escape</code></li>
<li>Fix <code>makeRe</code> when <code>partial: true</code> is set.</li>
<li>Fix <code>makeRe</code> when pattern ends in a final <code>**</code>
path part.</li>
</ul>
<h2>10.0</h2>
<ul>
<li>Require node 20 or 22 and higher</li>
</ul>
<h2>9.0</h2>
<ul>
<li>No default export, only named exports.</li>
</ul>
<h2>8.0</h2>
<ul>
<li>Recursive descent parser for extglob, allowing correct support
for arbitrarily nested extglob expressions</li>
<li>Bump required Node.js version</li>
</ul>
<h2>7.4</h2>
<ul>
<li>Add <code>escape()</code> method</li>
<li>Add <code>unescape()</code> method</li>
<li>Add <code>Minimatch.hasMagic()</code> method</li>
</ul>
<h2>7.3</h2>
<ul>
<li>Add support for posix character classes in a unicode-aware way.</li>
</ul>
<h2>7.2</h2>
<ul>
<li>Add <code>windowsNoMagicRoot</code> option</li>
</ul>
<h2>7.1</h2>
<ul>
<li>Add <code>optimizationLevel</code> configuration option, and revert
the
default back to the 6.2 style minimal optimizations, making the
advanced transforms introduced in 7.0 opt-in. Also, process
provided file paths in the same way in optimizationLevel:2
mode, so <em>most</em> things that matched with optimizationLevel 1 or
0 <em>should</em> match with level 2 as well. However, level 1 is the
default, out of an abundance of caution.</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/isaacs/minimatch/commit/ded1bbd01beca62a5978bc1650ed0a1ccf9039d5"><code>ded1bbd</code></a>
10.2.6</li>
<li><a
href="https://github.com/isaacs/minimatch/commit/0215dfef073cb3ba933cc95911e6a31418f799f8"><code>0215dfe</code></a>
update deps and lint</li>
<li><a
href="https://github.com/isaacs/minimatch/commit/10968eae898cac1b6c5feedada0de793b1fed0bf"><code>10968ea</code></a>
improve test for .. eating drive letters</li>
<li><a
href="https://github.com/isaacs/minimatch/commit/693c82377d0948401be4c6d3220c9a74132ab112"><code>693c823</code></a>
10.2.5</li>
<li><a
href="https://github.com/isaacs/minimatch/commit/7953af1fac53267c05e362f036b70de898318faa"><code>7953af1</code></a>
do not allow .. to consume drive letter on Windows</li>
<li><a
href="https://github.com/isaacs/minimatch/commit/1caf91893b67586255c68e2e513b14ac66785a24"><code>1caf918</code></a>
lint and format</li>
<li><a
href="https://github.com/isaacs/minimatch/commit/7783ed6670442acb4d455b9b164a1b2a33507a45"><code>7783ed6</code></a>
ignore docs</li>
<li><a
href="https://github.com/isaacs/minimatch/commit/6d9b356cd59372de00e1d5f3b8907a3350b9b8e5"><code>6d9b356</code></a>
update deps etc</li>
<li><a
href="https://github.com/isaacs/minimatch/commit/c36addb94e33f14254b9ca9017e63ae9c9d80d1d"><code>c36addb</code></a>
10.2.4</li>
<li><a
href="https://github.com/isaacs/minimatch/commit/26b90027d5ad0c383b5253a4e45d6dc7da282db4"><code>26b9002</code></a>
docs: add warning about ReDoS</li>
<li>Additional commits viewable in <a
href="https://github.com/isaacs/minimatch/compare/v10.1.1...v10.2.6">compare
view</a></li>
</ul>
</details>
<br />
Updates `picomatch` from 4.0.3 to 4.0.7
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/micromatch/picomatch/releases">picomatch's
releases</a>.</em></p>
<blockquote>
<h2>4.0.7</h2>
<h2>What's Changed</h2>
<ul>
<li>fix: handle terminal globstars in parenthesized patterns by <a
href="https://github.com/mrmlnc"><code>@mrmlnc</code></a> in <a
href="https://redirect.github.com/micromatch/picomatch/pull/198">micromatch/picomatch#198</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/micromatch/picomatch/compare/4.0.6...4.0.7">https://github.com/micromatch/picomatch/compare/4.0.6...4.0.7</a></p>
<h2>4.0.6</h2>
<h2>What's Changed</h2>
<ul>
<li>fix: scan full pattern when tokens are requested by <a
href="https://github.com/mrmlnc"><code>@mrmlnc</code></a> in <a
href="https://redirect.github.com/micromatch/picomatch/pull/197">micromatch/picomatch#197</a></li>
<li>fix: return complete pattern parts from scan by <a
href="https://github.com/mrmlnc"><code>@mrmlnc</code></a> in <a
href="https://redirect.github.com/micromatch/picomatch/pull/199">micromatch/picomatch#199</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/micromatch/picomatch/compare/4.0.5...4.0.6">https://github.com/micromatch/picomatch/compare/4.0.5...4.0.6</a></p>
<h2>4.0.5</h2>
<h2>What's Changed</h2>
<ul>
<li>fix: preserve all branches when rewriting risky repeated extglobs by
<a href="https://github.com/MerlijnW70"><code>@MerlijnW70</code></a> in
<a
href="https://redirect.github.com/micromatch/picomatch/pull/182">micromatch/picomatch#182</a></li>
<li>fix: honor the windows option when matching basenames by <a
href="https://github.com/MerlijnW70"><code>@MerlijnW70</code></a> in <a
href="https://redirect.github.com/micromatch/picomatch/pull/183">micromatch/picomatch#183</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/MerlijnW70"><code>@MerlijnW70</code></a> made
their first contribution in <a
href="https://redirect.github.com/micromatch/picomatch/pull/182">micromatch/picomatch#182</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/micromatch/picomatch/compare/4.0.4...4.0.5">https://github.com/micromatch/picomatch/compare/4.0.4...4.0.5</a></p>
<h2>4.0.4</h2>
<p>This is a security release fixing several security relevant
issues.</p>
<h2>What's Changed</h2>
<ul>
<li>Fix for <a
href="https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj">CVE-2026-33671</a></li>
<li>Fix for <a
href="https://github.com/micromatch/picomatch/security/advisories/GHSA-3v7f-55p6-f55p">CVE-2026-33672</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/micromatch/picomatch/compare/4.0.3...4.0.4">https://github.com/micromatch/picomatch/compare/4.0.3...4.0.4</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md">picomatch's
changelog</a>.</em></p>
<blockquote>
<h2>4.0.7 (2026-08-24)</h2>
<h3>Fixed</h3>
<ul>
<li>Fixed terminal globstars in parenthesized patterns (<a
href="https://redirect.github.com/micromatch/picomatch/issues/142">#142</a>,
<a
href="https://github.com/micromatch/picomatch/commit/e279bd7">e279bd7</a>).</li>
</ul>
<h2>4.0.6 (2026-08-24)</h2>
<h3>Fixed</h3>
<ul>
<li><code>scan()</code> now scans the full pattern when tokens are
requested, instead of merging the remaining path segments into the final
token (<a
href="https://redirect.github.com/micromatch/picomatch/issues/62">#62</a>,
<a
href="https://github.com/micromatch/picomatch/commit/5f5819d">5f5819d</a>).</li>
<li><code>scan()</code> now returns complete pattern parts, including
leading and trailing empty segments, and handles nested and escaped
parentheses correctly (<a
href="https://redirect.github.com/micromatch/picomatch/issues/58">#58</a>,
<a
href="https://github.com/micromatch/picomatch/commit/f201165">f201165</a>).</li>
</ul>
<h2>4.0.5 (2026-07-02)</h2>
<h3>Fixed</h3>
<ul>
<li>Preserved every branch when safely rewriting repeated extglobs (<a
href="https://redirect.github.com/micromatch/picomatch/pull/182">#182</a>,
<a
href="https://github.com/micromatch/picomatch/commit/6289307">6289307</a>).</li>
<li>Honored the <code>windows</code> option when matching basenames (<a
href="https://redirect.github.com/micromatch/picomatch/pull/183">#183</a>,
<a
href="https://github.com/micromatch/picomatch/commit/ab8bc4d">ab8bc4d</a>).</li>
</ul>
<h2>4.0.4 (2026-03-23)</h2>
<h3>Security</h3>
<ul>
<li>Prevented regular expression denial of service (ReDoS) from crafted
repeated or nested extglob quantifiers by safely rewriting or treating
risky patterns as literals. The new <code>maxExtglobRecursion</code>
option defaults to <code>0</code>; positive numeric values allow limited
nesting, while <code>false</code> disables the safeguard (<a
href="https://github.com/advisories/GHSA-c2c7-rcm5-vvqj">CVE-2026-33671</a>,
<a
href="https://github.com/micromatch/picomatch/commit/5eceecd">5eceecd</a>).</li>
<li>Prevented inherited object properties from being interpreted as
POSIX character classes (<a
href="https://github.com/advisories/GHSA-3v7f-55p6-f55p">CVE-2026-33672</a>,
<a
href="https://github.com/micromatch/picomatch/commit/4516eb5">4516eb5</a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/micromatch/picomatch/commit/6bb40679c218cefba5d4e9662408c5fdf699a8bb"><code>6bb4067</code></a>
4.0.7</li>
<li><a
href="https://github.com/micromatch/picomatch/commit/fdfb1559e4ef761f95c3009c1fd7afceb8830f55"><code>fdfb155</code></a>
Merge pull request <a
href="https://redirect.github.com/micromatch/picomatch/issues/198">#198</a>
from micromatch/issue-142</li>
<li><a
href="https://github.com/micromatch/picomatch/commit/38c6b7aefe50af10cfa978f362120d295d39cfa2"><code>38c6b7a</code></a>
4.0.6</li>
<li><a
href="https://github.com/micromatch/picomatch/commit/ada9d3fe9eb5a606bb4f6d87bc5cd7ac87fe63a4"><code>ada9d3f</code></a>
Merge pull request <a
href="https://redirect.github.com/micromatch/picomatch/issues/199">#199</a>
from micromatch/issue-58</li>
<li><a
href="https://github.com/micromatch/picomatch/commit/9b74f6fc70ed828ea4ef7106833a31428b8d7329"><code>9b74f6f</code></a>
Merge pull request <a
href="https://redirect.github.com/micromatch/picomatch/issues/197">#197</a>
from micromatch/issue-62</li>
<li><a
href="https://github.com/micromatch/picomatch/commit/f2011653e8eaa13bae6dffed7e7016ea8e123485"><code>f201165</code></a>
fix: return complete pattern parts from scan</li>
<li><a
href="https://github.com/micromatch/picomatch/commit/e279bd7f34c4f8b5f9d0490cf7810a1f0c2de178"><code>e279bd7</code></a>
fix: handle terminal globstars in parenthesized patterns</li>
<li><a
href="https://github.com/micromatch/picomatch/commit/5f5819dd4c0572c87df9a8011dffa65df5b6879f"><code>5f5819d</code></a>
fix: scan full pattern when tokens are requested</li>
<li><a
href="https://github.com/micromatch/picomatch/commit/4f41a8edade7a5ab19832f7b40ecce46b288767f"><code>4f41a8e</code></a>
4.0.5</li>
<li><a
href="https://github.com/micromatch/picomatch/commit/02cfc1bf912c79ea75ef1fe7da2ce4efade39903"><code>02cfc1b</code></a>
Update .verb.md and run verb to generate README documentation</li>
<li>Additional commits viewable in <a
href="https://github.com/micromatch/picomatch/compare/4.0.3...4.0.7">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/cnpm/packument/network/alerts).
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> chore: Bump form-data from 4.0.5 to 4.0.6 (#112)
Bumps [form-data](https://github.com/form-data/form-data) from 4.0.5 to
4.0.6.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/form-data/form-data/blob/master/CHANGELOG.md">form-data's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/form-data/form-data/compare/v4.0.5...v4.0.6">v4.0.6</a>
- 2026-06-12</h2>
<h3>Commits</h3>
<ul>
<li>[Fix] escape CR, LF, and <code>"</code> in field names and
filenames <a
href="https://github.com/form-data/form-data/commit/8dff42c6da654ed4e7ad4acb7f8ccd3831217c99"><code>8dff42c</code></a></li>
<li>[Dev Deps] update <code>@ljharb/eslint-config</code>,
<code>auto-changelog</code>, <code>tape</code> <a
href="https://github.com/form-data/form-data/commit/f31d21ef10bf46e46344c3ee4f99acbef6be43e1"><code>f31d21e</code></a></li>
<li>[Deps] update <code>hasown</code>, <code>mime-types</code> <a
href="https://github.com/form-data/form-data/commit/92ae0eb5da94d6f01925d5f4fcffb2a1e50ed7cd"><code>92ae0eb</code></a></li>
<li>[Dev Deps] update <code>js-randomness-predictor</code> <a
href="https://github.com/form-data/form-data/commit/67b0f65c2e0b065a511d42227d35e4d367644e97"><code>67b0f65</code></a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435"><code>64190db</code></a>
v4.0.6</li>
<li><a
href="https://github.com/form-data/form-data/commit/92ae0eb5da94d6f01925d5f4fcffb2a1e50ed7cd"><code>92ae0eb</code></a>
[Deps] update <code>hasown</code>, <code>mime-types</code></li>
<li><a
href="https://github.com/form-data/form-data/commit/f31d21ef10bf46e46344c3ee4f99acbef6be43e1"><code>f31d21e</code></a>
[Dev Deps] update <code>@ljharb/eslint-config</code>,
<code>auto-changelog</code>, <code>tape</code></li>
<li><a
href="https://github.com/form-data/form-data/commit/8dff42c6da654ed4e7ad4acb7f8ccd3831217c99"><code>8dff42c</code></a>
[Fix] escape CR, LF, and <code>"</code> in field names and
filenames</li>
<li><a
href="https://github.com/form-data/form-data/commit/67b0f65c2e0b065a511d42227d35e4d367644e97"><code>67b0f65</code></a>
[Dev Deps] update <code>js-randomness-predictor</code></li>
<li>See full diff in <a
href="https://github.com/form-data/form-data/compare/v4.0.5...v4.0.6">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/cnpm/packument/network/alerts).
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Latest Branches
0%
renovate/cargo-bins-cargo-binstall-digest +22%
perf/reuse-validated-json 0%
dependabot/npm_and_yarn/npm_and_yarn-c94ad5f15b © 2026 CodSpeed Technology