Bump the npm_and_yarn group across 1 directory with 5 updates - #13
Conversation
Bumps the npm_and_yarn group with 3 updates in the /URLShortener_electron directory: [axios](https://github.com/axios/axios), [electron](https://github.com/electron/electron) and [minimatch](https://github.com/isaacs/minimatch). Updates `axios` from 1.11.0 to 1.18.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.11.0...v1.18.0) Updates `electron` from 39.1.1 to 39.8.10 - [Release notes](https://github.com/electron/electron/releases) - [Commits](electron/electron@v39.1.1...v39.8.10) Updates `follow-redirects` from 1.15.9 to 1.16.0 - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.15.9...v1.16.0) Updates `form-data` from 4.0.4 to 4.0.6 - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v4.0.4...v4.0.6) Updates `minimatch` from 10.1.2 to 10.2.6 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v10.1.2...v10.2.6) --- updated-dependencies: - dependency-name: axios dependency-version: 1.18.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: electron dependency-version: 39.8.10 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: follow-redirects dependency-version: 1.16.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: form-data dependency-version: 4.0.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: minimatch dependency-version: 10.2.6 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
Skipping PR review because a bot author is detected. If you want to trigger CodeAnt AI, comment |
|
🤖 Review skipped: reviews for bot-created pull requests are not allowed on free accounts. Upgrade to a paid plan to enable bot reviews. |
|
Bito Automatic Review Skipped - Files Excluded |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
|
Bito Automatic Review Skipped - Files Excluded |
|
Up to standards ✅🟢 Issues
|
| Metric | Results |
|---|---|
| Duplication | 0 |
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
![llamapreview[bot]](https://avatars.githubusercontent.com/in/1023541?s=60&v=4){kind=small}
There was a problem hiding this comment.
LlamaPReview — Conditional code-review clear
Dependency bump to axios 1.18.0 and Electron 39.8.10 is safe to merge: the only axios call site passes no proxy/redirect options and Electron's API surface is free of changes that would affect this app.
Exact-head CI reports 2 failed; retained exact evidence attributes those failures outside this change.
Review details and evidence
Material unknowns
- The complete package-lock.json content was not read byte-for-byte; only the full diff and two exact-head slices were examined. If an unchanged lockfile section were later shown to conflict with the changed dependency graph, this would reframe the merge decision.
- Check: Optionally spot-check the full lockfile for coherence before or after merging.
LlamaPReview checks
- Read the complete PR-head file
URLShortener_electron/main.js. - Inspected matching PR-head repository snippets in
URLShortener_electron/main.js. - Inspected bounded directory inventory under
URLShortener_electron,URLShortener_electron/index.html,URLShortener_electron/main.jsand 3 more path(s). - Reviewed changed regions in
URLShortener_electron/package-lock.json. - Read bounded PR-head context from
URLShortener_electron/package-lock.json.
LlamaPReview is an open-source pull request reviewer. See exactly what it will and will not publish.
Bumps the npm_and_yarn group with 3 updates in the /URLShortener_electron directory: axios, electron and minimatch.
Updates
axiosfrom 1.11.0 to 1.18.0Release notes
Sourced from axios's releases.
... (truncated)
Changelog
Sourced from axios's changelog.
... (truncated)
Commits
2d06f96chore(release): prepare release 1.18.0 (#11003)32fc489fix: malformed http urls (#11000)b40ce49chore(deps-dev): bump the development_dependencies group with 10 updates (#10...fe964f9docs: mark proxy config as Node.js only (#10995)5f229d2chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions ...fae9d4edocs: clarify package update PR policy (#10992)28ab2cechore(deps-dev): bump the development_dependencies group with 2 updates (#10989)a8e4f13fix(core): keep default validateStatus when request passes undefined (#10899)614f455docs: publish v1.17.0 release notes (#10988)6bb12c1fix: custom auth headers not stripped on cross-origin redirects (#10892)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for axios since your current version.
Install script changes
This version modifies
preparescript that runs during installation. Review the package contents before updating.Updates
electronfrom 39.1.1 to 39.8.10Release notes
Sourced from electron's releases.
Commits
d7c42ebchore: backport removal of private macOS APIs (#51502)c76d48cbuild: replace spec dep fork with transitive resolution (#51490)3ff23c5fix: respect iframe sandbox flags on the OpenURL navigation path (#51437)01faabffix: resolve target bundle path once at start of install (#50766)8287d59build(deps): bump dorny/paths-filter from 3.0.2 to 4.0.1 (#51409)a8a79eaci: backport secondary siso patch (#51390)593607echore: cherry-pick 1 change from chromium (#51327)aa7791fbuild: restrict npm tarball contents to an explicit allowlist (#51307)5392e9afix: ensure corsEnabled: false protocol handlers do not work across protocols...2c24640fix: validate OSR frame geometry against shared-memory mapping size (39-x-y) ...Updates
follow-redirectsfrom 1.15.9 to 1.16.0Commits
0c23a22Release version 1.16.0 of the npm package.844c4d3Add sensitiveHeaders option.5e8b8d0ci: add Node.js 24.x to the CI matrix7953e22ci: upgrade GitHub Actions to use setup-node@v6 and checkout@v686dc1f8Sanitizing input.21ef28aRelease version 1.15.11 of the npm package.7c88135Roll back tree shaking.6e389baRelease version 1.15.10 of the npm package.5bc496eShake me up before you go-go.694d6b4Bump minimist from 1.2.5 to 1.2.8Updates
form-datafrom 4.0.4 to 4.0.6Changelog
Sourced from form-data's changelog.
Commits
64190dbv4.0.692ae0eb[Deps] updatehasown,mime-typesf31d21e[Dev Deps] update@ljharb/eslint-config,auto-changelog,tape8dff42c[Fix] escape CR, LF, and"in field names and filenames67b0f65[Dev Deps] updatejs-randomness-predictor68ff7ddv4.0.55822467[Dev Deps] update@ljharb/eslint-config,eslint76d0dee[Fix] set Symbol.toStringTag in the proper place16e0076[Tests] Switch to newer v8 prediction library; enable node 24 testingUpdates
minimatchfrom 10.1.2 to 10.2.6Changelog
Sourced from minimatch's changelog.
... (truncated)
Commits
ded1bbd10.2.60215dfeupdate deps and lint10968eaimprove test for .. eating drive letters693c82310.2.57953af1do not allow .. to consume drive letter on Windows1caf918lint and format7783ed6ignore docs6d9b356update deps etcc36addb10.2.426b9002docs: add warning about ReDoSDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.
Summary by cubic
Updates the
npm_and_yarngroup inURLShortener_electron, bumpingaxios,electron,minimatch,follow-redirects, andform-data. Theaxiosandelectronreleases include security fixes.Dependencies
axios1.11.0 → 1.18.0,electron39.1.1 → 39.8.10,minimatch10.1.2 → 10.2.6,follow-redirects1.15.9 → 1.16.0,form-data4.0.4 → 4.0.6.Migration
axios1.18.0 changesvalidateStatus: undefinedhandling; opt in viatransitional.validateStatusUndefinedResolvesto preserve old behavior.Written for commit 579aad2. Summary will update on new commits.