Skip to content

Bump the npm_and_yarn group across 1 directory with 12 updates - #1

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/npm_and_yarn-2828fd5227
Open

Bump the npm_and_yarn group across 1 directory with 12 updates#1
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/npm_and_yarn-2828fd5227

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github May 3, 2026

Copy link
Copy Markdown

Bumps the npm_and_yarn group with 12 updates in the / directory:

Package From To
semver 5.3.0 5.7.2
shelljs 0.7.7 0.8.5
terminal-kit 0.26.2 2.1.8
brace-expansion 1.1.7 1.1.14
fsevents 1.1.1 1.2.13
handlebars 4.0.6 4.7.9
lodash 4.17.4 4.18.1
minimatch 3.0.3 3.1.5
path-parse 1.0.5 1.0.7
stringstream 0.0.5 0.0.6
tmpl 1.0.4 1.0.5
y18n 3.2.1 3.2.2

Updates semver from 5.3.0 to 5.7.2

Release notes

Sourced from semver's releases.

v5.7.2

5.7.2 (2023-07-10)

Bug Fixes

Changelog

Sourced from semver's changelog.

5.7.2 (2023-07-10)

Bug Fixes

5.7

  • Add minVersion method

5.6

  • Move boolean loose param to an options object, with backwards-compatibility protection.
  • Add ability to opt out of special prerelease version handling with the includePrerelease option flag.

5.5

  • Add version coercion capabilities

5.4

  • Add intersection checking

5.3

  • Add minSatisfying method

5.2

  • Add prerelease(v) that returns prerelease components

5.1

  • Add Backus-Naur for ranges
  • Remove excessively cute inspection methods

5.0

  • Remove AMD/Browserified build artifacts
  • Fix ltr and gtr when using the * range
  • Fix for range * with a prerelease identifier
Commits
Maintainer changes

This version was pushed to npm by lukekarrys, a new releaser for semver since your current version.


Updates shelljs from 0.7.7 to 0.8.5

Release notes

Sourced from shelljs's releases.

v0.8.5

This was a small security fix for #1058.

v0.8.4

Small patch release to fix a circular dependency warning in node v14. See #973.

v0.8.3

Closed issues:

  • Shelljs print stderr to console even if exec-only "silent" is true #905
  • refactor: remove common.state.tempDir #902
  • Can't suppress stdout for echo #899
  • exec() doesn't apply the arguments correctly #895
  • shell.exec('npm pack') painfully slow #885
  • shelljs.exec cannot find app.asar/node_modules/shelljs/src/exec-child.js #881
  • test infra: mocks and skipOnWin conflict #862
  • Support for shell function completion on IDE #859
  • echo command shows options in stdout #855
  • silent does not always work #851
  • Appveyor installs the latest npm, instead of the latest compatible npm #844
  • Force symbolic link (ln -sf) does not overwrite/recreate existing destination #830
  • inconsistent result when trying to echo to a file #798
  • Prevent require()ing executable-only files #789
  • Cannot set property to of [object String] which has only a getter #752
  • which() should check executability before returning a value #657
  • Bad encoding experience #456
  • phpcs very slow #440
  • Error shown when triggering a sigint during shelljs.exec if process.on sigint is defined #254
  • .to\(file\) does not mute STDIO output #146
  • Escaping shell arguments to exec() #143
  • Allow multiple string arguments for exec() #103
  • cp does not recursively copy from readonly location #98
  • Handling permissions errors on file I/O #64

Merged pull requests:

... (truncated)

Changelog

Sourced from shelljs's changelog.

v0.8.5 (2022-01-13)

Full Changelog

This was a small security fix for #1058.

v0.8.4 (2020-04-24)

Full Changelog

Small patch release to fix a circular dependency warning in node v14. See #973.

v0.8.3 (2018-11-13)

Full Changelog

Closed issues:

  • Shelljs print stderr to console even if exec-only "silent" is true #905
  • refactor: remove common.state.tempDir #902
  • Can't suppress stdout for echo #899
  • exec() doesn't apply the arguments correctly #895
  • shell.exec('npm pack') painfully slow #885
  • shelljs.exec cannot find app.asar/node_modules/shelljs/src/exec-child.js #881
  • test infra: mocks and skipOnWin conflict #862
  • Support for shell function completion on IDE #859
  • echo command shows options in stdout #855
  • silent does not always work #851
  • Appveyor installs the latest npm, instead of the latest compatible npm #844
  • Force symbolic link (ln -sf) does not overwrite/recreate existing destination #830
  • inconsistent result when trying to echo to a file #798
  • Prevent require()ing executable-only files #789
  • Cannot set property to of [object String] which has only a getter #752
  • which() should check executability before returning a value #657
  • Bad encoding experience #456
  • phpcs very slow #440
  • Error shown when triggering a sigint during shelljs.exec if process.on sigint is defined #254
  • .to\(file\) does not mute STDIO output #146
  • Escaping shell arguments to exec() #143
  • Allow multiple string arguments for exec() #103
  • cp does not recursively copy from readonly location #98
  • Handling permissions errors on file I/O #64

Merged pull requests:

... (truncated)

Commits

Updates terminal-kit from 0.26.2 to 2.1.8

Changelog

Sourced from terminal-kit's changelog.

v2.1.8

Fix a possible ReDoS

v2.1.7

Fix inline table behavior (#186)

v2.1.6

Fix a circular require error (#181)

v2.1.5

Fix no lazy require mode

v2.1.4

Add a browser build (#176)

v2.1.3

New: use require('terminal-kit/lib/termkit-no-lazy-require.js') if lazy loading is troublesome (#176)

v2.1.2

Fix TextTable 'autoWidth' bug (#177)

v2.1.1

TextTable fix: when providing a custom 'borderChars', check that all character types exists (#173)

v2.1.0

... (truncated)

Commits
  • a2e446c Fix a possible ReDoS
  • 6e529a5 Fix inline table behavior (#186)
  • 88b3d83 Fix a circular require error (#181)
  • a34beb3 Fix no lazy require mode
  • d32f77a Add a browser build (#176)
  • 786a281 New: use require('terminal-kit/lib/termkit-no-lazy-require.js') if lazy loadi...
  • fe37289 Fix TextTable 'autoWidth' bug (#177)
  • ac1b3da TextTable fix: when providing a custom 'borderChars', check that all characte...
  • 74b30c1 Better TextTable sample code
  • b38ff36 New TextTable methods: .setCellAttr() and variations (methods named: set/rese...
  • Additional commits viewable in compare view

Updates brace-expansion from 1.1.7 to 1.1.14

Release notes

Sourced from brace-expansion's releases.

v1.1.12

  • pkg: publish on tag 1.x c460dbd
  • fmt ccb8ac6
  • Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) c3c73c8

juliangruber/brace-expansion@v1.1.11...v1.1.12

v1.1.11

brace-expansion

Brace expansion, as known from sh/bash, in JavaScript.

build status downloads Greenkeeper badge

testling badge

Example

var expand = require('brace-expansion');
expand('file-{a,b,c}.jpg')
// => ['file-a.jpg', 'file-b.jpg', 'file-c.jpg']
expand('-v{,,}')
// => ['-v', '-v', '-v']
expand('file{0..2}.jpg')
// => ['file0.jpg', 'file1.jpg', 'file2.jpg']
expand('file-{a..c}.jpg')
// => ['file-a.jpg', 'file-b.jpg', 'file-c.jpg']
expand('file{2..0}.jpg')
// => ['file2.jpg', 'file1.jpg', 'file0.jpg']
expand('file{0..4..2}.jpg')
// => ['file0.jpg', 'file2.jpg', 'file4.jpg']
expand('file-{a..e..2}.jpg')
// => ['file-a.jpg', 'file-c.jpg', 'file-e.jpg']
expand('file{00..10..5}.jpg')
// => ['file00.jpg', 'file05.jpg', 'file10.jpg']
</tr></table>

... (truncated)

Commits

Updates fsevents from 1.1.1 to 1.2.13

Release notes

Sourced from fsevents's releases.

Release v1.2.13

Only build on Mac-OSX

Release v1.2.11

Removing node-pre-gyp so that building fsevents becomes easier and enabled without the download of binaries.

The credentials to the AWS store have been lost. Releasing to AWS is both insecure and no longer possible due to the lost credentials.

Intermediate Release

No release notes provided.

Release v1.2.9 - Node v12 compatibility

No release notes provided.

Release Pre-NAPI v1.2.8

No release notes provided.

Version Bump (bundle node-pre-gyp)

No release notes provided.

Prebuilt v11.x

No release notes provided.

v1.2.3

  • Added node v10 for pre-built binaries
  • C++ tuning to fix potential SIGILL and cyclic dependency (#204)

v1.2.2

Fixed node-pre-gyp bundling issue

v1.2.1

[unpublished because of errors during publish process]

v1.2.0

  • BREAKING: End support for Node v0.12. If you are using Node v0.12 please pin your fsevents dependencies to v1.1.3. Not bumping semver major for this release was a compromise solution discussed in #199 and #201.
    • Node v0.10 should continue to work with local compilation for now, but hosted pre-built binaries will no longer be provided. If this is a constraint for you, please pin to an earlier version.
  • Fixed security vulnerability warnings by updating node-pre-gyp to ^0.9.0
  • Compatibility updates for nan v2.9.0

v1.1.3

  • Added node v9 for pre-built binaries
  • Fixed bug related to using --no-bin-links option on install
  • Updated node-pre-gyp to latest version (0.6.39)

v1.1.2

  • Added Node.js v8 to the prebuild binary assets.
  • Stopped prebuilding for io.js (can still be built locally)
  • Updated node-pre-gyp to latest version (0.6.36)
Commits

Updates handlebars from 4.0.6 to 4.7.9

Release notes

Sourced from handlebars's releases.

v4.7.9

Commits

v4.7.8

  • Make library compatible with workers (#1894) - 3d3796c
  • Don't rely on Node.js global object (#1776) - 2954e7e
  • Fix compiling of each block params in strict mode (#1855) - 30dbf04
  • Fix rollup warning when importing Handlebars as ESM - 03d387b
  • Fix bundler issue with webpack 5 (#1862) - c6c6bbb
  • Use https instead of git for mustache submodule - 88ac068

Commits

Changelog

Sourced from handlebars's changelog.

v4.7.9 - March 26th, 2026

  • fix: enable shell mode for spawn to resolve Windows EINVAL issue - e0137c2
  • fix type "RuntimeOptions" also accepting string partials - eab1d14
  • feat(types): set hash to be a Record<string, any> - de4414d
  • fix non-contiguous program indices - 4512766
  • refactor: rename i to startPartIndex - e497a35
  • security: fix security issues - 68d8df5

Commits

v4.7.8 - July 27th, 2023

  • Make library compatible with workers (#1894) - 3d3796c
  • Don't rely on Node.js global object (#1776) - 2954e7e
  • Fix compiling of each block params in strict mode (#1855) - 30dbf04
  • Fix rollup warning when importing Handlebars as ESM - 03d387b
  • Fix bundler issue with webpack 5 (#1862) - c6c6bbb
  • Use https instead of git for mustache submodule - 88ac068

Commits

v4.7.7 - February 15th, 2021

  • fix weird error in integration tests - eb860c0
  • fix: check prototype property access in strict-mode (#1736) - b6d3de7
  • fix: escape property names in compat mode (#1736) - f058970
  • refactor: In spec tests, use expectTemplate over equals and shouldThrow (#1683) - 77825f8
  • chore: start testing on Node.js 12 and 13 - 3789a30

(POSSIBLY) BREAKING CHANGES:

  • the changes from version 4.6.0 now also apply in when using the compile-option "strict: true". Access to prototype properties is forbidden completely by default, specific properties or methods can be allowed via runtime-options. See #1633 for details. If you are using Handlebars as documented, you should not be accessing prototype properties from your template anyway, so the changes should not be a problem for you. Only the use of undocumented features can break your build.

That is why we only bump the patch version despite mentioning breaking changes.

Commits

v4.7.6 - April 3rd, 2020

Chore/Housekeeping:

Compatibility notes:

  • Restored Node.js compatibility

... (truncated)

Commits
  • dce542c v4.7.9
  • 8a41389 Update release notes
  • 68d8df5 Fix security issues
  • b2a0831 Fix browser tests
  • 9f98c16 Fix release script
  • 45443b4 Revert "Improve partial indenting performance"
  • 8841a5f Fix CI errors with linting
  • e0137c2 fix: enable shell mode for spawn to resolve Windows EINVAL issue
  • e914d60 Improve rendering performance
  • 7de4b41 Upgrade GitHub Actions checkout and setup-node on 4.x branch
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by jaylinski, a new releaser for handlebars since your current version.


Updates lodash from 4.17.4 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

  • Add security notice for _.template in threat model and API docs (#6099)
  • Document lower > upper behavior in _.random (#6115)
  • Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

Commits
  • cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
  • 75535f5 chore: prune stale advisory refs (#6170)
  • 62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
  • 59be2de release(minor): bump to 4.18.0 (#6161)
  • af63457 fix: broken tests for _.template 879aaa9
  • 1073a76 fix: linting issues
  • 879aaa9 fix: validate imports keys in _.template
  • fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
  • 18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
  • b819080 ci: add dist sync validation workflow (#6137)
  • Additional commits viewable in compare view

Updates minimatch from 3.0.3 to 3.1.5

Commits

Updates path-parse from 1.0.5 to 1.0.7

Commits

Updates stringstream from 0.0.5 to 0.0.6

Commits

Updates tmpl from 1.0.4 to 1.0.5

Commits

Updates y18n from 3.2.1 to 3.2.2

Release notes

Sourced from y18n's releases.

y18n y18n-v4.0.3

Bug Fixes

  • release: 4.x.x should not enforce Node 10 (#126) (1e21a53)

y18n y18n-v4.0.2

Bug Fixes

  • security: ensure entry exists for backport (#120) (b22c0df)
Commits
Maintainer changes

This version was pushed to npm by oss-bot, a new releaser for y18n since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump the npm_and_yarn group across 1 directory with 12 updates
6fdef70 
Bumps the npm_and_yarn group with 12 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [semver](https://github.com/npm/node-semver) | `5.3.0` | `5.7.2` |
| [shelljs](https://github.com/shelljs/shelljs) | `0.7.7` | `0.8.5` |
| [terminal-kit](https://github.com/cronvel/terminal-kit) | `0.26.2` | `2.1.8` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.7` | `1.1.14` |
| [fsevents](https://github.com/fsevents/fsevents) | `1.1.1` | `1.2.13` |
| [handlebars](https://github.com/handlebars-lang/handlebars.js) | `4.0.6` | `4.7.9` |
| [lodash](https://github.com/lodash/lodash) | `4.17.4` | `4.18.1` |
| [minimatch](https://github.com/isaacs/minimatch) | `3.0.3` | `3.1.5` |
| [path-parse](https://github.com/jbgutierrez/path-parse) | `1.0.5` | `1.0.7` |
| [stringstream](https://github.com/mhart/StringStream) | `0.0.5` | `0.0.6` |
| [tmpl](https://github.com/daaku/nodejs-tmpl) | `1.0.4` | `1.0.5` |
| [y18n](https://github.com/yargs/y18n) | `3.2.1` | `3.2.2` |



Updates `semver` from 5.3.0 to 5.7.2
- [Release notes](https://github.com/npm/node-semver/releases)
- [Changelog](https://github.com/npm/node-semver/blob/v5.7.2/CHANGELOG.md)
- [Commits](npm/node-semver@v5.3.0...v5.7.2)

Updates `shelljs` from 0.7.7 to 0.8.5
- [Release notes](https://github.com/shelljs/shelljs/releases)
- [Changelog](https://github.com/shelljs/shelljs/blob/main/CHANGELOG.md)
- [Commits](shelljs/shelljs@v0.7.7...v0.8.5)

Updates `terminal-kit` from 0.26.2 to 2.1.8
- [Changelog](https://github.com/cronvel/terminal-kit/blob/master/CHANGELOG)
- [Commits](cronvel/terminal-kit@v0.26.2...v2.1.8)

Updates `brace-expansion` from 1.1.7 to 1.1.14
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.7...v1.1.14)

Updates `fsevents` from 1.1.1 to 1.2.13
- [Release notes](https://github.com/fsevents/fsevents/releases)
- [Commits](fsevents/fsevents@v1.1.1...v1.2.13)

Updates `handlebars` from 4.0.6 to 4.7.9
- [Release notes](https://github.com/handlebars-lang/handlebars.js/releases)
- [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/v4.7.9/release-notes.md)
- [Commits](handlebars-lang/handlebars.js@v4.0.6...v4.7.9)

Updates `lodash` from 4.17.4 to 4.18.1
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.4...4.18.1)

Updates `minimatch` from 3.0.3 to 3.1.5
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v3.0.3...v3.1.5)

Updates `path-parse` from 1.0.5 to 1.0.7
- [Commits](https://github.com/jbgutierrez/path-parse/commits/v1.0.7)

Updates `stringstream` from 0.0.5 to 0.0.6
- [Commits](mhart/StringStream@v0.0.5...v0.0.6)

Updates `tmpl` from 1.0.4 to 1.0.5
- [Commits](https://github.com/daaku/nodejs-tmpl/commits/v1.0.5)

Updates `y18n` from 3.2.1 to 3.2.2
- [Release notes](https://github.com/yargs/y18n/releases)
- [Changelog](https://github.com/yargs/y18n/blob/master/CHANGELOG.md)
- [Commits](https://github.com/yargs/y18n/commits)

---
updated-dependencies:
- dependency-name: semver
  dependency-version: 5.7.2
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: shelljs
  dependency-version: 0.8.5
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: terminal-kit
  dependency-version: 2.1.8
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 1.1.14
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fsevents
  dependency-version: 1.2.13
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: handlebars
  dependency-version: 4.7.9
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: minimatch
  dependency-version: 3.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: path-parse
  dependency-version: 1.0.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: stringstream
  dependency-version: 0.0.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: tmpl
  dependency-version: 1.0.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: y18n
  dependency-version: 3.2.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants