Skip to content

build(deps): bump the npm_and_yarn group across 1 directory with 10 updates#426

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-2ebd8b53b0
Open

build(deps): bump the npm_and_yarn group across 1 directory with 10 updates#426
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-2ebd8b53b0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Mar 17, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 9 updates in the / directory:

Package From To
js-yaml 3.7.0 4.1.1
yargs-parser 7.0.0 20.2.9
got 9.6.0 12.6.1
form-data 0.2.0 removed
basic-ftp 5.0.5 5.2.0
braces 1.8.5 3.0.3
minimatch 3.1.2 3.1.5
minimatch 9.0.4 9.0.9
minimatch 5.1.6 5.1.9
ip 1.1.9 removed
nanoid 2.1.11 3.3.11

Updates js-yaml from 3.7.0 to 4.1.1

Changelog

Sourced from js-yaml's changelog.

[4.1.1] - 2025-11-12

Security

  • Fix prototype pollution issue in yaml merge (<<) operator.

[4.1.0] - 2021-04-15

Added

  • Types are now exported as yaml.types.XXX.
  • Every type now has options property with original arguments kept as they were (see yaml.types.int.options as an example).

Changed

  • Schema.extend() now keeps old type order in case of conflicts (e.g. Schema.extend([ a, b, c ]).extend([ b, a, d ]) is now ordered as abcd instead of cbad).

[4.0.0] - 2021-01-03

Changed

  • Check migration guide to see details for all breaking changes.
  • Breaking: "unsafe" tags !!js/function, !!js/regexp, !!js/undefined are moved to js-yaml-js-types package.
  • Breaking: removed safe* functions. Use load, loadAll, dump instead which are all now safe by default.
  • yaml.DEFAULT_SAFE_SCHEMA and yaml.DEFAULT_FULL_SCHEMA are removed, use yaml.DEFAULT_SCHEMA instead.
  • yaml.Schema.create(schema, tags) is removed, use schema.extend(tags) instead.
  • !!binary now always mapped to Uint8Array on load.
  • Reduced nesting of /lib folder.
  • Parse numbers according to YAML 1.2 instead of YAML 1.1 (01234 is now decimal, 0o1234 is octal, 1:23 is parsed as string instead of base60).
  • dump() no longer quotes :, [, ], (, ) except when necessary, #470, #557.
  • Line and column in exceptions are now formatted as (X:Y) instead of at line X, column Y (also present in compact format), #332.
  • Code snippet created in exceptions now contains multiple lines with line numbers.
  • dump() now serializes undefined as null in collections and removes keys with undefined in mappings, #571.
  • dump() with skipInvalid=true now serializes invalid items in collections as null.
  • Custom tags starting with ! are now dumped as !tag instead of !<!tag>, #576.
  • Custom tags starting with tag:yaml.org,2002: are now shorthanded using !!, #258.

Added

  • Added .mjs (es modules) support.
  • Added quotingType and forceQuotes options for dumper to configure string literal style, #290, #529.
  • Added styles: { '!!null': 'empty' } option for dumper (serializes { foo: null } as "foo: "), #570.
  • Added replacer option (similar to option in JSON.stringify), #339.
  • Custom Tag can now handle all tags or multiple tags with the same prefix, #385.

Fixed

... (truncated)

Commits

Updates yargs-parser from 7.0.0 to 20.2.9

Release notes

Sourced from yargs-parser's releases.

yargs-parser yargs-parser-v20.2.9

Bug Fixes

  • build: fixed automated release pipeline (1fe9135)

yargs-parser yargs-parser-v20.2.8

Bug Fixes

  • deno: force relese for Deno (6687c97)
  • locale: Turkish camelize and decamelize issues with toLocaleLowerCase/toLocaleUpperCase (2617303)
  • perf: address slow parse when using unknown-options-as-args (#394) (441f059)
  • string-utils: detect [0,1] ranged values as numbers (#388) (efcc32c)

yargs-parser yargs-parser-v15.0.3

Bug Fixes

  • build: should use releases_created when using manifest (49ea4ef)

yargs-parser yargs-parser-v15.0.2

Bug Fixes

  • perf: address slow parse when using unknown-options-as-args (#400) (bc387ec)
Changelog

Sourced from yargs-parser's changelog.

20.2.9 (2021-06-20)

Bug Fixes

  • build: fixed automated release pipeline (1fe9135)

20.2.8 (2021-06-20)

Bug Fixes

  • locale: Turkish camelize and decamelize issues with toLocaleLowerCase/toLocaleUpperCase (2617303)
  • perf: address slow parse when using unknown-options-as-args (#394) (441f059)
  • string-utils: detect [0,1] ranged values as numbers (#388) (efcc32c)

20.2.7 (2021-03-10)

Bug Fixes

  • deno: force release for Deno (6687c97)

20.2.6 (2021-02-22)

Bug Fixes

  • populate--: -- should always be array (#354) (585ae8f)

20.2.5 (2021-02-13)

Bug Fixes

20.2.4 (2020-11-09)

Bug Fixes

20.2.3 (2020-10-16)

Bug Fixes

  • exports: node 13.0 and 13.1 require the dotted object form with a string fallback (#336) (3ae7242)

... (truncated)

Commits
  • 3859e74 chore: release main (#404)
  • 1fe9135 fix(build): fixed automated release pipeline
  • 9eb9c2f chore: release main (#398)
  • 4b9e134 build: should be releases_created
  • 441f059 fix(perf): address slow parse when using unknown-options-as-args (#394)
  • fb22816 build: switch from master to main
  • a0a0814 build: switch to manifest based releases (#396)
  • 088481c docs: fix typos in README.md (#379)
  • 6877a2d test: add test for optimized output (#373)
  • 2cfab05 refactor: quote properties used for meta-programming
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by oss-bot, a new releaser for yargs-parser since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates got from 9.6.0 to 12.6.1

Release notes

Sourced from got's releases.

v12.6.1

  • Fix get-stream import statement (#2266) 67d5039

sindresorhus/got@v12.6.0...v12.6.1

v12.6.0

  • Update dependencies 88c88fb 979272e
  • Loosen URL validation strictness (#2200) 0ca0b7f

sindresorhus/got@v12.5.3...v12.6.0

v12.5.3

  • Fix abort event listeners not always being cleaned up (#2162) 3cc40b5

sindresorhus/got@v12.5.2...v12.5.3

v12.5.2

  • Improve TypeScript 4.9 compatibility (#2163) 39f83b6

sindresorhus/got@v12.5.1...v12.5.2

v12.5.1

  • Fix compatibility with TypeScript and ESM 3b3ea67
  • Fix request body not being properly cached (#2150) 3e9d3af

sindresorhus/got@v12.5.0...v12.5.1

v12.5.0

  • Disable method rewriting on 307 and 308 status codes (#2145) e049e94
  • Upgrade dependencies 8630815 f0ac0b3 4c3762a

sindresorhus/got@v12.4.1...v12.5.0

v12.4.1

Fixes

  • Fix options.context being not extensible b671480715dbbff908e9a385f5e714570c663cd7
  • Don't emit uploadProgress after promise cancelation 693de217b030816f574d6e4cb505ee2e77b21c29

sindresorhus/got@v12.4.0...v12.4.1

v12.4.0

Improvements

  • Support FormData without known length (#2120) 850773c

Fixes

  • Don&#39;t call beforeError hooks with HTTPError if the throwHttpErrors option is false (#2104) 3927348

... (truncated)

Commits
Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Removes form-data

Updates basic-ftp from 5.0.5 to 5.2.0

Release notes

Sourced from basic-ftp's releases.

5.2.0

  • Changed: Skip files with invalid name in downloadToDir.

5.1.0

  • Added: Add the option to prevent the use of separate transfer host IPs when using PASV. (#259)
Changelog

Sourced from basic-ftp's changelog.

5.2.0

5.1.0

  • Added: Add the option to prevent the use of separate transfer host IPs when using PASV. (#259)
Commits
Maintainer changes

This version was pushed to npm by patrickjuchli, a new releaser for basic-ftp since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates braces from 1.8.5 to 3.0.3

Changelog

Sourced from braces's changelog.

Release history

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

  • Changelogs are for humans, not machines.
  • There should be an entry for every single version.
  • The same types of changes should be grouped.
  • Versions and sections should be linkable.
  • The latest version comes first.
  • The release date of each versions is displayed.
  • Mention whether you follow Semantic Versioning.

Changelog entries are classified using the following labels (from keep-a-changelog):

  • Added for new features.
  • Changed for changes in existing functionality.
  • Deprecated for soon-to-be removed features.
  • Removed for now removed features.
  • Fixed for any bug fixes.
  • Security in case of vulnerabilities.

[3.0.0] - 2018-04-08

v3.0 is a complete refactor, resulting in a faster, smaller codebase, with fewer deps, and a more accurate parser and compiler.

Breaking Changes

  • The undocumented .makeRe method was removed
  • Require Node.js >= 8.3

Non-breaking changes

  • Caching was removed

[2.3.2] - 2018-04-08

  • start refactoring

... (truncated)

Commits

Updates cookie from 0.3.1 to 0.4.2

Release notes

Sourced from cookie's releases.

0.4.2

  • pref: read value only when assigning in parse
  • pref: remove unnecessary regexp in parse

0.4.1

  • Fix maxAge option to reject invalid values

0.4.0

  • Add SameSite=None support
Changelog

Sourced from cookie's changelog.

0.4.2 / 2022-02-02

  • pref: read value only when assigning in parse
  • pref: remove unnecessary regexp in parse

0.4.1 / 2020-04-21

  • Fix maxAge option to reject invalid values

0.4.0 / 2019-05-15

  • Add SameSite=None support
Commits
  • 55bac40 0.4.2
  • 519feb5 build: mocha@9.2.0
  • fadc4bc build: Node.js@14.19
  • 009b3cb pref: read value only when assigning in parse
  • 04be428 lint: remove deprecated String.prototype.substr
  • 2dc6662 bench: preserve decode behavior for top cookies
  • aa1a335 pref: remove unnecessary regexp in parse
  • 2bcee5a bench: add cookies from top 20 sites
  • 4f08c95 docs: update benchmark
  • f056356 build: mocha@9.1.4
  • Additional commits viewable in compare view

Updates minimatch from 3.1.2 to 3.1.5

Commits

Updates minimatch from 9.0.4 to 9.0.9

Commits

Updates minimatch from 5.1.6 to 5.1.9

Commits

Removes ip

Updates nanoid from 2.1.11 to 3.3.11

Release notes

Sourced from nanoid's releases.

3.3.11

  • Fixed React Native support.

3.3.10

3.3.9

  • Reduced npm package size.

3.0 Migration Guide

Nano ID 3.0 is the biggest release in the project history. Unfortunately, you will need to change the code of your application. But the changes are very small in most cases. In return, you will have better performance, smaller size, ES modules and TypeScript support.

Known Issues

  • Only Create React App 4.0 supports dual ESM/CJS modules.

Simple Case

In simple cases, you just need to change default import to named import.

- import nanoid from 'nanoid'
+ import { nanoid } from 'nanoid'
nanoid() //=> "sSAi9F8yakJZPxOCr_WFb"
nanoid(5) //=> "ISe9l"

If you support IE, you need to transpile node_modules by Babel.

Non-secure and asynchronous Nano ID need only import changes as well.

- import nanoid from 'nanoid/non-secure'
+ import { nanoid } from 'nanoid/non-secure'
nanoid() //=> "sSAi9F8yakJZPxOCr_WFb"

- import nanoid from 'nanoid/async'
+ import { nanoid } from 'nanoid/async'
nanoid().then(id => {
id //=> "sSAi9F8yakJZPxOCr_WFb"
})

TypeScript

... (truncated)

Changelog

Sourced from nanoid's changelog.

3.3.11

  • Fixed React Native support.

3.3.10

3.3.9

  • Reduced npm package size.

3.3.8

  • Fixed a way to break Nano ID by passing non-integer size (by @​myndzi).

3.3.7

  • Fixed node16 TypeScript support (by Saadi Myftija).

3.3.6

  • Fixed package.

3.3.5

  • Backport funding information.

3.3.4

3.3.3

  • Reduced size (by Anton Khlynovskiy).

3.3.2

  • Fixed enhanced-resolve support.

3.3.1

  • Reduced package size.

3.3

  • Added size argument to function from customAlphabet (by Stefan Sundin).

3.2

  • Added --size and --alphabet arguments to binary (by Vitaly Baev).

3.1.32

  • Reduced async exports size (by Artyom Arutyunyan).
  • Moved from Jest to uvu (by Vitaly Baev).

3.1.31

  • Fixed collision vulnerability on object in size (by Artyom Arutyunyan).

3.1.30

  • Reduced size for project with brotli compression (by Anton Khlynovskiy).

3.1.29

... (truncated)

Commits

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 17, 2026
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/npm_and_yarn-2ebd8b53b0 branch 11 times, most recently from 4ee32a6 to 494490f Compare March 24, 2026 00:52
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/npm_and_yarn-2ebd8b53b0 branch 5 times, most recently from 036bbbc to 1233c4a Compare March 30, 2026 23:06
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/npm_and_yarn-2ebd8b53b0 branch from 1233c4a to dc556ea Compare April 8, 2026 20:22
@dependabot
build(deps): bump the npm_and_yarn group across 1 directory with 10 u…
ee8563d 
…pdates

Bumps the npm_and_yarn group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [js-yaml](https://github.com/nodeca/js-yaml) | `3.7.0` | `4.1.1` |
| [yargs-parser](https://github.com/yargs/yargs-parser) | `7.0.0` | `20.2.9` |
| [got](https://github.com/sindresorhus/got) | `9.6.0` | `12.6.1` |
| [basic-ftp](https://github.com/patrickjuchli/basic-ftp) | `5.0.5` | `5.2.0` |
| [braces](https://github.com/micromatch/braces) | `1.8.5` | `3.0.3` |
| [minimatch](https://github.com/isaacs/minimatch) | `3.1.2` | `3.1.5` |
| [minimatch](https://github.com/isaacs/minimatch) | `9.0.4` | `9.0.9` |
| [minimatch](https://github.com/isaacs/minimatch) | `5.1.6` | `5.1.9` |
| [form-data](https://github.com/form-data/form-data) | `0.2.0` | `removed` |
| [ip](https://github.com/indutny/node-ip) | `1.1.9` | `removed` |
| [nanoid](https://github.com/ai/nanoid) | `2.1.11` | `3.3.11` |



Updates `js-yaml` from 3.7.0 to 4.1.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@3.7.0...4.1.1)

Updates `yargs-parser` from 7.0.0 to 20.2.9
- [Release notes](https://github.com/yargs/yargs-parser/releases)
- [Changelog](https://github.com/yargs/yargs-parser/blob/main/CHANGELOG.md)
- [Commits](yargs/yargs-parser@v7.0.0...yargs-parser-v20.2.9)

Updates `got` from 9.6.0 to 12.6.1
- [Release notes](https://github.com/sindresorhus/got/releases)
- [Commits](sindresorhus/got@v9.6.0...v12.6.1)

Updates `basic-ftp` from 5.0.5 to 5.2.0
- [Release notes](https://github.com/patrickjuchli/basic-ftp/releases)
- [Changelog](https://github.com/patrickjuchli/basic-ftp/blob/master/CHANGELOG.md)
- [Commits](patrickjuchli/basic-ftp@v5.0.5...v5.2.0)

Updates `braces` from 1.8.5 to 3.0.3
- [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md)
- [Commits](micromatch/braces@1.8.5...3.0.3)

Updates `cookie` from 0.3.1 to 0.4.2
- [Release notes](https://github.com/jshttp/cookie/releases)
- [Changelog](https://github.com/jshttp/cookie/blob/v0.4.2/HISTORY.md)
- [Commits](jshttp/cookie@v0.3.1...v0.4.2)

Updates `minimatch` from 3.1.2 to 3.1.5
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v3.1.2...v3.1.5)

Updates `minimatch` from 9.0.4 to 9.0.9
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v3.1.2...v3.1.5)

Updates `minimatch` from 5.1.6 to 5.1.9
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v3.1.2...v3.1.5)

Removes `form-data`

Removes `ip`

Updates `nanoid` from 2.1.11 to 3.3.11
- [Release notes](https://github.com/ai/nanoid/releases)
- [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md)
- [Commits](ai/nanoid@2.1.11...3.3.11)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.1.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: yargs-parser
  dependency-version: 20.2.9
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: got
  dependency-version: 12.6.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: basic-ftp
  dependency-version: 5.2.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: braces
  dependency-version: 3.0.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: cookie
  dependency-version: 0.4.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: minimatch
  dependency-version: 3.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: minimatch
  dependency-version: 9.0.9
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: minimatch
  dependency-version: 5.1.9
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: form-data
  dependency-version: 
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ip
  dependency-version: 
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: nanoid
  dependency-version: 3.3.11
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/npm_and_yarn-2ebd8b53b0 branch from dc556ea to ee8563d Compare April 9, 2026 22:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants