Skip to content

chore(deps): Bump the npm_and_yarn group across 3 directories with 6 updates - #169

Merged
josealekhine merged 1 commit into
mainfrom
dependabot/npm_and_yarn/ctx-desktop/npm_and_yarn-3f8797df61
Sep 10, 2026
Merged

chore(deps): Bump the npm_and_yarn group across 3 directories with 6 updates#169
josealekhine merged 1 commit into
mainfrom
dependabot/npm_and_yarn/ctx-desktop/npm_and_yarn-3f8797df61

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 9, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 2 updates in the /ctx-desktop directory: browserslist and postcss.
Bumps the npm_and_yarn group with 3 updates in the /editors/vscode directory: fast-uri, js-yaml and undici.
Bumps the npm_and_yarn group with 1 update in the /tools/typecheck/opencode directory: toml.

Updates browserslist from 4.28.2 to 4.28.9

Release notes

Sourced from browserslist's releases.

4.28.9

4.28.8

  • Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

4.28.6

4.28.5

4.28.4

  • Fixed SyntaxError regression of 4.28.3.

4.28.3

  • Fixed baseline query case-insensitivity (by @​swwind).
Changelog

Sourced from browserslist's changelog.

4.28.9

4.28.8

  • Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

4.28.6

4.28.5

4.28.4

  • Fixed SyntaxError regression of 4.28.3.

4.28.3

  • Fixed baseline query case-insensitivity (by @​swwind).
Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for browserslist since your current version.


Updates postcss from 8.5.15 to 8.5.28

Release notes

Sourced from postcss's releases.

8.5.28

  • Fixes types regression.

8.5.27

8.5.26

  • Fixed list.split() regression (by @​lazerg).
  • Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

  • Fixed 8.5.17 visitor regression.
  • Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

  • Preserve the BOM after the processing (by @​hdimer).

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

8.5.19

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

  • Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

  • Fixed Maximum call stack size exceeded error.
  • Fixed Prototype hijacking for postcss.fromJSON().
  • Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.28

  • Fixes types regression.

8.5.27

8.5.26

  • Fixed list.split() regression (by @​lazerg).
  • Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

  • Fixed 8.5.17 visitor regression.
  • Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

  • Preserve the BOM after the processing (by @​hdimer).

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

8.5.19

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.


Updates fast-uri from 3.1.4 to 3.1.7

Release notes

Sourced from fast-uri's releases.

v3.1.7

⚠️ Security Warning

This is a security release that fixes the following high-severity security advisories:

Users of the v3.x release line should upgrade to v3.1.7.

Full Changelog: fastify/fast-uri@v3.1.6...v3.1.7

v3.1.6

⚠️ Security Warning

This release addresses the following high-severity security advisories:

Users of the v3.x release line should upgrade to v3.1.6.

Full Changelog: fastify/fast-uri@v3.1.5...v3.1.6

v3.1.5

⚠️ Security Warning

Fix for GHSA-7p8r-x3mc-p8w7

Full Changelog: fastify/fast-uri@v3.1.4...v3.1.5

Commits
  • 412e40a Bumped v3.1.7
  • 9f4c943 fix: backport port and IP-literal validation to v3.x (#216)
  • 1eb3ce4 fix: treat unterminated bracket hosts as reg-names again (#214)
  • 6f970b2 Bumped v3.1.6
  • d941579 fix: never run IDN canonicalization on bracketed IP literals
  • c0f0279 test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)
  • 37f3417 Merge commit from fork
  • 607bfbe Merge commit from fork
  • ae92a4c Merge commit from fork
  • 444ecda Merge commit from fork
  • Additional commits viewable in compare view

Updates js-yaml from 4.2.0 to 4.3.2

Changelog

Sourced from js-yaml's changelog.

4.3.2 - 2026-08-26

Changed

  • [backport] Hard-limit merge sequence size to 100.

Security

  • [backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

4.3.1 - 2026-07-31

Security

  • [backport] Remove quadratic complexity from !!omap duplicate key detection.

4.3.0 - 2026-06-27

Added

  • [backport] Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.

Fixed

  • Restore umd builds back to es5.

Removed

  • [backport] maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.
Commits
  • 79ca68d 4.3.2 released
  • d90b661 Backport merge limits from v5.4.1
  • 86e91b8 4.3.1 released
  • c3cc4b0 Backport quadratic complexity fix for !!omap
  • 33d05b5 4.3.0 released
  • 663bfab Drop demo publish, to not override new v5 one.
  • 1cb8c7b Add v4-legacy tag for publish
  • 02f27af Restore umd builds back to es5
  • 8be84ed Fix es5 compatibility
  • 59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
  • Additional commits viewable in compare view

Updates undici from 7.28.0 to 7.29.1

Release notes

Sourced from undici's releases.

v7.29.1

⚠️ Security fixes

High severity

  • GHSA-w293-vg96-wgc3: BalancedPool could drop function-valued connection options while cloning its configuration, including custom TLS certificate validation callbacks. Undici now preserves connect and legacy tls options when creating upstreams. Fixed by f690157d.
  • GHSA-rfgv-xxqx-mfg5: a WebSocket server could select a subprotocol when none was requested, causing an uncaught TypeError that could terminate the process. Undici now rejects the handshake with protocol error 1002. Fixed by 6615e017.

Medium severity

  • GHSA-3wwx-pv8p-q78v: a malformed permessage-deflate payload exceeding the configured decompression limit could emit an unhandled zlib error and terminate the process. Undici now destroys the inflater after reaching the limit. Fixed by 63cf698b.
  • GHSA-rx4f-c7p8-82vq: an unclean WebSocketStream close could create an unobserved rejected promise when its writable stream was locked, potentially terminating the process. Undici now propagates the failure through the retained writable stream controller. Fixed by 1858656e.
  • GHSA-2jfj-6hjv-fm6j: shared caches could store and replay responses containing Set-Cookie, disclosing one user's cookies to another caller. Undici now excludes these responses from shared caches, including existing entries and revalidation paths. Fixed by b6c5a002.
  • GHSA-3xpg-4rpp-hhhm: the decompression interceptor did not bound decoded output, allowing compressed responses to consume excessive memory. Undici now limits every decompression stage to 64 MiB by default and supports a configurable maxSize. Fixed by 2c7d7e12.
  • GHSA-pmjh-fq2x-6v4x: a terminal retry failure after response headers were exposed could orphan the original response body, causing consumers to hang indefinitely. Undici now propagates the terminal error to the exposed body. Fixed by 3c672659.

Low severity

  • GHSA-8436-99hf-9mmv: cache interceptors could store and replay responses to unsafe HTTP methods such as POST or DELETE. Undici now restricts cache reads and writes to safe methods while preserving invalidation by successful unsafe requests. Fixed by b61d9432.
  • GHSA-2gqq-gqf2-x968: the dump interceptor could treat an oversized chunked response as successfully truncated when no Content-Length was present. Undici now enforces maxSize against received bytes and aborts oversized responses. Fixed by 21693f40.
  • GHSA-r53p-7pc4-xj5r: the retry interceptor could concatenate a resumed response with inconsistent framing into downstream output, enabling response splitting or corruption. Undici now validates Content-Range against the original response framing before resuming. Fixed by cd8af90b.

What's Changed

Full Changelog: nodejs/undici@v7.29.0...v7.29.1

v7.29.0

⚠️ Security fixes

High severity

  • GHSA-4cwx-7wf7-3272: malformed qualified private Cache-Control directives could cause cross-user information disclosure in shared caches or a parse-time crash. The cache parser now treats empty qualified directives conservatively and safely handles mixed qualified and unqualified directives. Fixed by 9f10f1e9, with regression coverage in 466e99d1.

Medium severity

  • GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 33928bc2.
  • GHSA-jr45-8vmc-qm54: optional whitespace around = in qualified no-cache and private directives could bypass shared-cache restrictions and disclose authenticated data across users. Cache-Control parsing now normalizes these forms and applies conservative cache decisions. Fixed by 98011a86.
  • GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by 1b5a5312, with corrected fixtures in 4a9dafb1.
  • GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by 3bf91ddb.

... (truncated)

Commits
  • d39a83e Bumped v7.29.1 (#5772)
  • 0d88464 fix(test): remove unused EventEmitter import
  • f57411b perf(h1): drop idle-socket timer floor with a ref'd setImmediate (#5707) (#5769)
  • 3c67265 fix(retry): settle exposed body on terminal failure
  • cd8af90 fix(retry): validate resumed response framing
  • 6615e01 fix(websocket): reject unrequested subprotocols
  • 2c7d7e1 fix(decompress): limit decompressed response size
  • b6c5a00 fix(cache): do not cache Set-Cookie in shared caches
  • 21693f4 fix(interceptor/dump): abort oversized chunked responses
  • f690157 fix: preserve BalancedPool connection options
  • Additional commits viewable in compare view

Updates toml from 4.1.1 to 4.3.0

Changelog

Sourced from toml's changelog.

4.3.0 - July 13 2026

  • Add opt-in Temporal support via toml.parse(input, { useTemporal: true }), mapping offset date-times to Temporal.ZonedDateTime and local date-times/dates/times to Temporal.PlainDateTime/PlainDate/PlainTime. An implementation can be supplied via the temporal option on runtimes without a Temporal global. (#69)

4.2.0 - July 13 2026

  • Address security advisory GHSA-82x6-q7mm-w9cf (CVE pending), in which deeply nested arrays or inline tables could overflow the call stack and crash the process with an uncatchable RangeError. Nesting is now bounded (default 500 levels), and input past the limit throws a normal parse error. The limit is configurable via toml.parse(input, { maxDepth }).

4.1.2 - June 30 2026

  • Address CVE-2026-63376, in which a specially crafted TOML string could pollute Object.prototype process-wide.
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): Bump the npm_and_yarn group across 3 directories with 6 …
a297d1e 
…updates

Bumps the npm_and_yarn group with 2 updates in the /ctx-desktop directory: [browserslist](https://github.com/browserslist/browserslist) and [postcss](https://github.com/postcss/postcss).
Bumps the npm_and_yarn group with 3 updates in the /editors/vscode directory: [fast-uri](https://github.com/fastify/fast-uri), [js-yaml](https://github.com/nodeca/js-yaml) and [undici](https://github.com/nodejs/undici).
Bumps the npm_and_yarn group with 1 update in the /tools/typecheck/opencode directory: [toml](https://github.com/BinaryMuse/toml-node).


Updates `browserslist` from 4.28.2 to 4.28.9
- [Release notes](https://github.com/browserslist/browserslist/releases)
- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md)
- [Commits](browserslist/browserslist@4.28.2...4.28.9)

Updates `postcss` from 8.5.15 to 8.5.28
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.15...8.5.28)

Updates `fast-uri` from 3.1.4 to 3.1.7
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.4...v3.1.7)

Updates `js-yaml` from 4.2.0 to 4.3.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.2.0...4.3.2)

Updates `undici` from 7.28.0 to 7.29.1
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.28.0...v7.29.1)

Updates `toml` from 4.1.1 to 4.3.0
- [Changelog](https://github.com/BinaryMuse/toml-node/blob/master/CHANGELOG.md)
- [Commits](BinaryMuse/toml-node@v4.1.1...v4.3.0)

---
updated-dependencies:
- dependency-name: browserslist
  dependency-version: 4.28.9
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: postcss
  dependency-version: 8.5.28
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fast-uri
  dependency-version: 3.1.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 4.3.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 7.29.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: toml
  dependency-version: 4.3.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from bilersan as a code owner September 9, 2026 23:59
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 9, 2026
@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Sep 9, 2026 •
edited
Loading

Copy link
Copy Markdown

Deploying ctx with  Cloudflare Pages  Cloudflare Pages

Latest commit: a297d1e
Status: ✅  Deploy successful!
Preview URL: https://0432c64a.ctx-bhl.pages.dev
Branch Preview URL: https://dependabot-npm-and-yarn-ctx-cs77.ctx-bhl.pages.dev

View logs

@josealekhine
josealekhine merged commit 3f72c32 into main Sep 10, 2026
10 checks passed
@josealekhine
josealekhine deleted the dependabot/npm_and_yarn/ctx-desktop/npm_and_yarn-3f8797df61 branch September 10, 2026 08:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bilersan bilersan Awaiting requested review from bilersan bilersan is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@josealekhine