Skip to content

build(deps): bump the npm_and_yarn group across 1 directory with 12 updates - #1021

Merged
willtheorangeguy merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-b547188454
Sep 21, 2026
Merged

build(deps): bump the npm_and_yarn group across 1 directory with 12 updates#1021
willtheorangeguy merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-b547188454

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 12 updates in the / directory:

Package From To
astro 7.1.4 7.3.3
sharp 0.35.0 0.35.4
@babel/core 7.29.0 7.29.7
@humanfs/node 0.16.7 0.16.8
baseline-browser-mapping 2.10.10 2.10.40
browserslist 4.28.1 4.28.4
devalue 5.8.1 5.9.4
hono 4.13.1 4.13.5
nanoid 3.3.16 3.3.19
postcss-selector-parser 7.1.1 7.1.6
smol-toml 1.6.1 1.8.0
svgo 4.0.2 4.1.0

Updates astro from 7.1.4 to 7.3.3

Release notes

Sourced from astro's releases.

astro@7.3.3

Patch Changes

  • #17651 504333c Thanks @​sxzz! - Refactors internal version handling to use a smaller, ESM-native dependency

  • #17942 0bc5715 Thanks @​matthewp! - Returns appropriate 400 and 404 responses from the image endpoint for invalid and missing local image paths

  • #17700 b2222fc Thanks @​winklemad! - Fixes Astro.preferredLocaleList returning an empty list when a locale is configured with the object form ({ path, codes }) and the browser sends the code with different casing or an underscore, such as en-US matching a configured en-us

  • #17941 394ff79 Thanks @​matthewp! - Fixes astro preview --ignore-lock (and astro dev --ignore-lock) being refused when run from an AI agent environment. The flag now starts the server in the foreground instead of erroring, since agent detection only inferred background mode and was never explicitly requested. An explicit --background combined with --ignore-lock still errors.

  • #17928 3277927 Thanks @​ArmandPhilippot! - Fixes TypeScript autocompletion for getImage() to suggest all available predefined options.

  • #17928 3277927 Thanks @​ArmandPhilippot! - Fixes a type error in getImage() options that allowed passing both widths and densities at the same time.

  • #17857 2637ed1 Thanks @​Princesseuh! - Improves rendering performance

  • #17943 2fc7ce9 Thanks @​matthewp! - Fixes a WebAssembly error when importing astro:actions in tests that run under @cloudflare/vitest-pool-workers

  • #18018 1b5a234 Thanks @​astro-factory! - Fixes trailing-slash redirect response body pointing to the incoming URL instead of the redirect target. The location header was correct, but the HTML body (<meta http-equiv="refresh">, <title>, and <a> tag) contained the original request path without the trailing-slash correction or query string.

  • #17905 eaf70fa Thanks @​SudoDevStudio! - Fixes custom dev toolbar apps losing their UI after client-side navigation with <ClientRouter />.

  • #18011 558b301 Thanks @​astro-factory! - Fixes prerendered Cloudflare pages rendering as [object Object] when nodejs_compat is enabled in wrangler.toml

  • #17944 ba08e35 Thanks @​matthewp! - Fixes a regression in astro dev where writes outside the module graph (for example, @astrojs/cloudflare's .wrangler/state files) invalidated the middleware on every request, causing repeated SSR reloads. Such writes no longer invalidate the middleware.

  • #17531 ae837db Thanks @​danilloestrela! - Updates svgo to 4.0.2 to resolve a security advisory

  • #17953 dbbf10e Thanks @​astro-factory! - Fixes a one-time page reload shortly after the first load on cold dev-server starts when a project has framework components imported from MDX content entries. MDX files are now included in the dev dependency pre-bundling scan, so their framework dependencies are bundled up front instead of being discovered (and reloaded for) at runtime.

  • #17955 4e8ad9a Thanks @​matthewp! - Improves dev server startup time. The content config and dev server app module graphs now begin compiling during server creation without blocking the server from listening. Request handling waits for the shared setup result when needed, cutting astro dev ready time by roughly a third on projects with a content config.

  • #17960 9838049 Thanks @​Chy-Zaber-Bin-Zahid! - Improves the diagnostics of some Astro errors.

  • #17998 0e5478d Thanks @​astro-factory! - Fixes SVG <style> elements nested inside <defs> or other container elements not being hashed for CSP

  • #17994 80f9f1d Thanks @​astro-factory! - Fixes experimental.incrementalBuild restoring pages with stale CSS after a preprocessor partial changes or missing original images referenced by restored pages

  • #17889 8ae6b46 Thanks @​ajfAfg! - Fixes a bug where the dev server stripped the configured base from URLs that only share a prefix with it. With base: '/s', requests to /src/... were rewritten to /rc/... and failed, breaking those pages during development.

  • #17980 cfccafa Thanks @​gameroman! - Improves JSDoc for fonts api

  • #17953 dbbf10e Thanks @​astro-factory! - Fixes CSS HMR for framework components rendered through content entries after ClientRouter navigation

  • #17970 0b4dc3a Thanks @​matthewp! - Improves serialization of transition animation values in generated CSS

  • #17999 30ef3cb Thanks @​astro-factory! - Fixes content collection HMR not updating prerendered pages when an adapter enables a separate prerender environment (e.g. @astrojs/cloudflare with prerenderEnvironment: 'node')

  • #18002 312ab49 Thanks @​shoutoutuoadi325! - Fixes redirect targets being corrupted when a dynamic route parameter value contains $ replacement patterns like $&

... (truncated)

Changelog

Sourced from astro's changelog.

7.3.3

Patch Changes

  • #17651 504333c Thanks @​sxzz! - Refactors internal version handling to use a smaller, ESM-native dependency

  • #17942 0bc5715 Thanks @​matthewp! - Returns appropriate 400 and 404 responses from the image endpoint for invalid and missing local image paths

  • #17700 b2222fc Thanks @​winklemad! - Fixes Astro.preferredLocaleList returning an empty list when a locale is configured with the object form ({ path, codes }) and the browser sends the code with different casing or an underscore, such as en-US matching a configured en-us

  • #17941 394ff79 Thanks @​matthewp! - Fixes astro preview --ignore-lock (and astro dev --ignore-lock) being refused when run from an AI agent environment. The flag now starts the server in the foreground instead of erroring, since agent detection only inferred background mode and was never explicitly requested. An explicit --background combined with --ignore-lock still errors.

  • #17928 3277927 Thanks @​ArmandPhilippot! - Fixes TypeScript autocompletion for getImage() to suggest all available predefined options.

  • #17928 3277927 Thanks @​ArmandPhilippot! - Fixes a type error in getImage() options that allowed passing both widths and densities at the same time.

  • #17857 2637ed1 Thanks @​Princesseuh! - Improves rendering performance

  • #17943 2fc7ce9 Thanks @​matthewp! - Fixes a WebAssembly error when importing astro:actions in tests that run under @cloudflare/vitest-pool-workers

  • #18018 1b5a234 Thanks @​astro-factory! - Fixes trailing-slash redirect response body pointing to the incoming URL instead of the redirect target. The location header was correct, but the HTML body (<meta http-equiv="refresh">, <title>, and <a> tag) contained the original request path without the trailing-slash correction or query string.

  • #17905 eaf70fa Thanks @​SudoDevStudio! - Fixes custom dev toolbar apps losing their UI after client-side navigation with <ClientRouter />.

  • #18011 558b301 Thanks @​astro-factory! - Fixes prerendered Cloudflare pages rendering as [object Object] when nodejs_compat is enabled in wrangler.toml

  • #17944 ba08e35 Thanks @​matthewp! - Fixes a regression in astro dev where writes outside the module graph (for example, @astrojs/cloudflare's .wrangler/state files) invalidated the middleware on every request, causing repeated SSR reloads. Such writes no longer invalidate the middleware.

  • #17531 ae837db Thanks @​danilloestrela! - Updates svgo to 4.0.2 to resolve a security advisory

  • #17953 dbbf10e Thanks @​astro-factory! - Fixes a one-time page reload shortly after the first load on cold dev-server starts when a project has framework components imported from MDX content entries. MDX files are now included in the dev dependency pre-bundling scan, so their framework dependencies are bundled up front instead of being discovered (and reloaded for) at runtime.

  • #17955 4e8ad9a Thanks @​matthewp! - Improves dev server startup time. The content config and dev server app module graphs now begin compiling during server creation without blocking the server from listening. Request handling waits for the shared setup result when needed, cutting astro dev ready time by roughly a third on projects with a content config.

  • #17960 9838049 Thanks @​Chy-Zaber-Bin-Zahid! - Improves the diagnostics of some Astro errors.

  • #17998 0e5478d Thanks @​astro-factory! - Fixes SVG <style> elements nested inside <defs> or other container elements not being hashed for CSP

  • #17994 80f9f1d Thanks @​astro-factory! - Fixes experimental.incrementalBuild restoring pages with stale CSS after a preprocessor partial changes or missing original images referenced by restored pages

  • #17889 8ae6b46 Thanks @​ajfAfg! - Fixes a bug where the dev server stripped the configured base from URLs that only share a prefix with it. With base: '/s', requests to /src/... were rewritten to /rc/... and failed, breaking those pages during development.

  • #17980 cfccafa Thanks @​gameroman! - Improves JSDoc for fonts api

  • #17953 dbbf10e Thanks @​astro-factory! - Fixes CSS HMR for framework components rendered through content entries after ClientRouter navigation

  • #17970 0b4dc3a Thanks @​matthewp! - Improves serialization of transition animation values in generated CSS

  • #17999 30ef3cb Thanks @​astro-factory! - Fixes content collection HMR not updating prerendered pages when an adapter enables a separate prerender environment (e.g. @astrojs/cloudflare with prerenderEnvironment: 'node')

... (truncated)

Commits
  • 8a3106e [ci] release (#17939)
  • 5efea1b Add a version field to the astro-client-only fixture
  • 80f9f1d Hash compiled CSS output in incremental build to detect Sass partial changes ...
  • bc6572f Revert "Forward user class to Picture's outer element" (#18004) (#18030)
  • 0e5478d Normalize CRLF line endings before computing CSP hashes (#17998)
  • 30ef3cb fix: invalidate prerender environment in invalidateDataStore (#17991) (#17999)
  • 312ab49 Fix redirect targets when a param value contains a $ replacement pattern (#...
  • 1b5a234 Fix trailing-slash redirect body to match the Location header target (#18018)
  • 558b301 Fix prerendered Cloudflare pages rendering as [object Object] with nodejs_com...
  • 4464b3a fix(assets): forward class to picture element in Picture component (#18003) (...
  • Additional commits viewable in compare view

Updates sharp from 0.35.0 to 0.35.4

Release notes

Sourced from sharp's releases.

v0.35.4

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.3

v0.35.4-rc.0

... (truncated)

Commits
  • 7f1a0a2 Release v0.35.4
  • f927818 Upgrade to sharp-libvips v1.3.3
  • e802092 Prerelease v0.35.4-rc.0
  • e13eb2f CI: Fix wasm32 build (#4589)
  • a82a0b3 Upgrade to libvips v8.18.6
  • 8044fe4 Bound resize dimensions to coordinate limit
  • 147f859 Docs: changelog entries for #4578 #4584
  • ee5bfb8 Tests: use yauzl directly rather than via extract-zip wrapper
  • 7a77889 Bump uraimo/run-on-arch-action from 3.1.0 to 3.2.0 (#4588)
  • ea5bef2 Improve support for input Streams finishing before output is requested (#4584)
  • Additional commits viewable in compare view

Updates @babel/core from 7.29.0 to 7.29.7

Release notes

Sourced from @​babel/core's releases.

v7.29.7 (2026-05-25)

Re-release all packages with npm provenance attestations

v7.29.6 (2026-05-25)

🐛 Bug Fix

Committers: 3

v7.29.5 (2026-05-05)

🏠 Internal

  • babel-preset-env
    • Update @babel/* dependencies

v7.29.4 (2026-05-05)

🐛 Bug Fix

  • babel-plugin-transform-modules-systemjs
    • #17974 [7.x backport]fix(systemjs): improve module string name support (@​JLHwung)

Committers: 1

v7.29.3 (2026-04-30)

👓 Spec Compliance

🐛 Bug Fix

  • babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators
    • #17931 fix(decorators): replace super within all removed static elements (@​JLHwung)
  • babel-register
  • babel-compat-data, babel-plugin-bugfix-safari-rest-destructuring-rhs-array, babel-preset-env

💅 Polish

  • babel-parser

... (truncated)

Commits

Updates @humanfs/node from 0.16.7 to 0.16.8

Release notes

Sourced from @​humanfs/node's releases.

node: v0.16.8

0.16.8 (2026-04-17)

Bug Fixes

  • Include type dependencies at runtime (956ce7a), closes #145

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • @​humanfs/core bumped from ^0.19.1 to ^0.19.2
Changelog

Sourced from @​humanfs/node's changelog.

0.16.8 (2026-04-17)

Bug Fixes

  • Ensure symlinks are copied as symlinks in copy() and copyAll() (22bbaa44)
  • Include type dependencies at runtime (956ce7a), closes #145

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • @​humanfs/core bumped from ^0.19.1 to ^0.19.2
Commits

Updates baseline-browser-mapping from 2.10.10 to 2.10.40

Commits
  • 54ceac6 Patch to 2.10.40 because browser or feature data changed
  • 8e2ffad Browser or feature data changed
  • fcd4fed Updating static site
  • 5938edd Patch to 2.10.39 because browser or feature data changed
  • 8a4923d Browser or feature data changed
  • 5b63e35 Updating static site
  • 2881d24 Updating static site
  • 37f3dae Patch to 2.10.38 because browser or feature data changed
  • c5c2841 Browser or feature data changed
  • 14903f7 Updating static site
  • Additional commits viewable in compare view

Updates browserslist from 4.28.1 to 4.28.4

Release notes

Sourced from browserslist's releases.

4.28.4

  • Fixed SyntaxError regression of 4.28.3.

4.28.3

  • Fixed baseline query case-insensitivity (by @​swwind).

4.28.2

Changelog

Sourced from browserslist's changelog.

4.28.4

  • Fixed SyntaxError regression of 4.28.3.

4.28.3

  • Fixed baseline query case-insensitivity (by @​swwind).

4.28.2

Commits
  • 3ea3c7e Release 4.28.4 version
  • 7bb43c8 Do not remove comments on publish
  • 2767d76 Release 4.28.3 version
  • bdc594d Avoid broken package.json in project
  • 509cf67 Update local file
  • d618c8c Fix old pnpm on CI
  • d509448 Update release method
  • a63a9f2 Update dependencies
  • d596dc6 Merge pull request #935 from swwind/fix-baseline-case-insensitive
  • 796ee66 Fix: treat baseline newly/widely available keywords case-insensitively
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for browserslist since your current version.


Updates devalue from 5.8.1 to 5.9.4

Release notes

Sourced from devalue's releases.

v5.9.4

Patch Changes

  • 067b125: perf: annotate module-level Object.freeze calls as pure so unused operation tables tree-shake

v5.9.3

Patch Changes

  • 6861dbb: fix: avoid scanning sparse array holes in uneval traversal and shared-array population
  • 9ec5130: fix: reject non-string null-prototype object keys in parse and unflatten to prevent bypassing the __proto__ check
  • dae8153: fix: prevent unhandled internal rejections in stringifyAsync when serializing multiple promises
  • 84f6f67: fix: prevent quadratic uneval output expansion for repeated strings and bigints
  • 6861dbb: fix: avoid eager allocation when evaluating sparse arrays emitted by uneval
  • 8f8d78e: fix: validate revived backing buffers before constructing typed arrays
  • 46dc877: fix: serialize only the visible bytes of Node Buffers in stringify, stringifyAsync and uneval, preventing disclosure of unrelated data from their shared allocation pool

v5.9.2

Patch Changes

  • 8b2a456: fix: reject out-of-bounds indices

v5.9.1

Patch Changes

  • 39457ce: fix: uneval emits valid JS for graphs with more than 65534 repeated references
  • 686e379: fix: emit valid JS for Node Buffer in uneval
  • 376b65c: fix: preserve -0 in float typed arrays in uneval

v5.9.0

Minor Changes

  • 07d6a38: feat: export filterArrayIndices, the array-index filtering used by the indicesOf stringify operation, so custom operations can reuse it instead of reimplementing it
  • 07d6a38: feat: add pluggable operations option to parse/unflatten, allowing customization of how values are constructed while reviving (e.g. cross-realm or foreign-runtime revival)
  • 5b53532: feat: add pluggable operations option to stringify/stringifyAsync, allowing customization of how values are introspected during serialization (e.g. side-effect-free or foreign-runtime serialization)

v5.8.2

Patch Changes

  • 48cc81f: fix: serialize DataView subviews with the correct byte offset and length
  • cd6da94: fix: resolve circular references through custom revivers when payload is already hydrated
  • 29a3382: fix: uneval now produces valid output for a repeated empty Map or Set
  • 8c0db06: fix: serialize Temporal values referenced more than once in uneval
  • 3770846: fix: emit valid JS for BigInt64Array and BigUint64Array in uneval
  • 756265a: fix: preserve shared-reference identity for Map keys in uneval
  • faa8a05: fix: emit uneval reconstructions before the statements that reference them
  • 06129ad: fix: do not grow sparse arrays by one slot in uneval
Changelog

Sourced from devalue's changelog.

5.9.4

Patch Changes

  • 067b125: perf: annotate module-level Object.freeze calls as pure so unused operation tables tree-shake

5.9.3

Patch Changes

  • 6861dbb: fix: avoid scanning sparse array holes in uneval traversal and shared-array population
  • 9ec5130: fix: reject non-string null-prototype object keys in parse and unflatten to prevent bypassing the __proto__ check
  • dae8153: fix: prevent unhandled internal rejections in stringifyAsync when serializing multiple promises
  • 84f6f67: fix: prevent quadratic uneval output expansion for repeated strings and bigints
  • 6861dbb: fix: avoid eager allocation when evaluating sparse arrays emitted by uneval
  • 8f8d78e: fix: validate revived backing buffers before constructing typed arrays
  • 46dc877: fix: serialize only the visible bytes of Node Buffers in stringify, stringifyAsync and uneval, preventing disclosure of unrelated data from their shared allocation pool

5.9.2

Patch Changes

  • 8b2a456: fix: reject out-of-bounds indices

5.9.1

Patch Changes

  • 39457ce: fix: uneval emits valid JS for graphs with more than 65534 repeated references
  • 686e379: fix: emit valid JS for Node Buffer in uneval
  • 376b65c: fix: preserve -0 in float typed arrays in uneval

5.9.0

Minor Changes

  • 07d6a38: feat: export filterArrayIndices, the array-index filtering used by the indicesOf stringify operation, so custom operations can reuse it instead of reimplementing it
  • 07d6a38: feat: add pluggable operations option to parse/unflatten, allowing customization of how values are constructed while reviving (e.g. cross-realm or foreign-runtime revival)
  • 5b53532: feat: add pluggable operations option to stringify/stringifyAsync, allowing customization of how values are introspected during serialization (e.g. side-effect-free or foreign-runtime serialization)

5.8.2

Patch Changes

  • 48cc81f: fix: serialize DataView subviews with the correct byte offset and length
  • cd6da94: fix: resolve circular references through custom revivers when payload is already hydrated
  • 29a3382: fix: uneval now produces valid output for a repeated empty Map or Set
  • 8c0db06: fix: serialize Temporal values referenced more than once in uneval
  • 3770846: fix: emit valid JS for BigInt64Array and BigUint64Array in uneval
  • 756265a: fix: preserve shared-reference identity for Map keys in uneval
  • faa8a05: fix: emit uneval reconstructions before the statements that reference them
  • 06129ad: fix: do not grow sparse arrays by one slot in uneval
Commits

Updates hono from 4.13.1 to 4.13.5

Release notes

Sourced from hono's releases.

v4.13.5

Security fixes

This release includes fixes for the following security issues:

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a ? after a # was treated as the start of a query string and the application could read parameters that the other component never saw. GHSA-crvj-82cr-hjcx

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path normalization gap where consecutive parent-directory segments in ssgParams values were not fully collapsed, bypassing the containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjv

Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

Affects: parseBody() when dot-notation parsing is enabled. Fixes unbounded expansion of dot-separated field names, where a small request body could allocate a disproportionately large object graph and concurrent requests could exhaust the heap. GHSA-g6gw-c38x-mqfc

Users who use Cache Middleware, deploy behind a proxy or WAF that inspects query strings, use Static Site Generation, or use parseBody({ dot: true }) are strongly encouraged to upgrade to this version.

v4.13.4

What's Changed

  • fix(request): handle params on unmatched requests in honojs/hono#5268
  • fix(jsx/dom): execute previous ref cleanup when ref prop changes on re-render in honojs/hono#5264
  • fix(reg-exp-router): associate wildcard middleware with matching routes in honojs/hono#5266
  • perf(router): share null object creation in honojs/hono#5267
  • fix(etag): match If-None-Match tags with optional whitespace before the comma in honojs/hono#5222
  • fix(client): skip undefined header and cookie values in honojs/hono#5244
  • fix(client): skip an undefined entry inside a query array in honojs/hono#5272
  • fix(client): skip an undefined entry inside a form array in honojs/hono#5280
  • fix(client): support custom buildSearchParams and filter undefined query in $ws() bin honojs/hono#5256
  • fix(accepts): support wildcard media types and specificity ordering in defaultMatch in honojs/hono#5255
  • fix(client): omit empty query delimiter in honojs/hono#5283
  • fix(request): drop stale content length for cloned FormData in honojs/hono#5282
  • fix(request): serialize cached JSON body in cloneRawRequest in honojs/hono#5288
  • fix(cookie): allow parsing signed cookies with empty string values in honojs/hono#5246
  • fix(utils/stream): do not let abort listeners crash abort() in honojs/hono#5274

Full Changelog: honojs/hono@v4.13.3...v4.13.4

v4.13.3

What's Changed

  • fix(client): prevent URL corruption when replaceUrlParam contains $ replacement tokens in honojs/hono#5227
  • fix(etag): copy pending stream bytes in honojs/hono#5239
  • fix(etag): avoid skipping headers when filtering 304 response headers in honojs/hono#5234
  • fix(cors): append Origin to Vary header on OPTIONS preflight in honojs/hono#5235
  • docs(context): add custom headers append option example to Context JSDoc in honojs/hono#5248
  • fix(trie-router): match suffix wildcard routes in honojs/hono#5236

... (truncated)

Commits
  • 06880c4 4.13.5
  • 531e9c5 Merge commit from fork
  • 3a67f7f Merge commit from fork
  • 9c28d72 Merge commit from fork
  • 017000d 4.13.4
  • 5e5b83d fix(utils/stream): do not let abort listeners crash abort() (#5274)
  • 241ae4c fix(cookie): allow parsing signed cookies with empty string values (#5246)
  • c409d85 fix(request): serialize cached JSON body in cloneRawRequest (#5288)
  • 612b59c fix(request): drop stale content length for cloned FormData (#5282)
  • 73794bd fix(client): omit empty query delimiter (#5283)
  • Additional commits viewable in compare view

Updates nanoid from 3.3.16 to 3.3.19

Release notes

Sourced from nanoid's releases.

3.3.19

  • Fixed killing the app by setting huge user ID.

3.3.18

3.3.17

  • Fixed infinite loop on zero size.
Changelog

Sourced from nanoid's changelog.

3.3.19

3.3.18

3.3.17

  • Fixed infinite loop on zero size.
Commits

Updates postcss-selector-parser from 7.1.1 to 7.1.6

Release notes

Sourced from postcss-selector-parser's releases.

7.1.6

  • fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (GHSA-rj75-hqrm-r3gf, reported by Wayde Shi)

7.1.5

  • fix: don't treat a non-prefix token before | as a namespace (#324 by @​spokodev)
  • fix: preserve whitespace before a * namespace in attribute selectors (#325 by @​spokodev)
  • fix: TypeError on unclosed [, ( and trailing | (#330 by @​theRizwan)

7.1.4

  • fix: tolerate non-node children when serializing selectors

7.1.3

  • Improve fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (clone/walk)

7.1.2

Changelog

Sourced from Description has been truncated

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Sep 21, 2026
@dependabot
build(deps): bump the npm_and_yarn group across 1 directory with 12 u…
b63b41b 
…pdates

Bumps the npm_and_yarn group with 12 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `7.1.4` | `7.3.3` |
| [sharp](https://github.com/lovell/sharp) | `0.35.0` | `0.35.4` |
| [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) | `7.29.0` | `7.29.7` |
| [@humanfs/node](https://github.com/humanwhocodes/humanfs/tree/HEAD/packages/node) | `0.16.7` | `0.16.8` |
| [baseline-browser-mapping](https://github.com/web-platform-dx/baseline-browser-mapping) | `2.10.10` | `2.10.40` |
| [browserslist](https://github.com/browserslist/browserslist) | `4.28.1` | `4.28.4` |
| [devalue](https://github.com/sveltejs/devalue) | `5.8.1` | `5.9.4` |
| [hono](https://github.com/honojs/hono) | `4.13.1` | `4.13.5` |
| [nanoid](https://github.com/ai/nanoid) | `3.3.16` | `3.3.19` |
| [postcss-selector-parser](https://github.com/postcss/postcss-selector-parser) | `7.1.1` | `7.1.6` |
| [smol-toml](https://github.com/squirrelchat/smol-toml) | `1.6.1` | `1.8.0` |
| [svgo](https://github.com/svg/svgo) | `4.0.2` | `4.1.0` |



Updates `astro` from 7.1.4 to 7.3.3
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.3.3/packages/astro)

Updates `sharp` from 0.35.0 to 0.35.4
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](lovell/sharp@v0.35.0...v0.35.4)

Updates `@babel/core` from 7.29.0 to 7.29.7
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.29.7/packages/babel-core)

Updates `@humanfs/node` from 0.16.7 to 0.16.8
- [Release notes](https://github.com/humanwhocodes/humanfs/releases)
- [Changelog](https://github.com/humanwhocodes/humanfs/blob/main/packages/node/CHANGELOG.md)
- [Commits](https://github.com/humanwhocodes/humanfs/commits/node-v0.16.8/packages/node)

Updates `baseline-browser-mapping` from 2.10.10 to 2.10.40
- [Release notes](https://github.com/web-platform-dx/baseline-browser-mapping/releases)
- [Commits](web-platform-dx/baseline-browser-mapping@v2.10.10...v2.10.40)

Updates `browserslist` from 4.28.1 to 4.28.4
- [Release notes](https://github.com/browserslist/browserslist/releases)
- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md)
- [Commits](browserslist/browserslist@4.28.1...4.28.4)

Updates `devalue` from 5.8.1 to 5.9.4
- [Release notes](https://github.com/sveltejs/devalue/releases)
- [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md)
- [Commits](sveltejs/devalue@v5.8.1...v5.9.4)

Updates `hono` from 4.13.1 to 4.13.5
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.1...v4.13.5)

Updates `nanoid` from 3.3.16 to 3.3.19
- [Release notes](https://github.com/ai/nanoid/releases)
- [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md)
- [Commits](ai/nanoid@3.3.16...3.3.19)

Updates `postcss-selector-parser` from 7.1.1 to 7.1.6
- [Release notes](https://github.com/postcss/postcss-selector-parser/releases)
- [Changelog](https://github.com/postcss/postcss-selector-parser/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss-selector-parser@v7.1.1...7.1.6)

Updates `smol-toml` from 1.6.1 to 1.8.0
- [Release notes](https://github.com/squirrelchat/smol-toml/releases)
- [Commits](squirrelchat/smol-toml@v1.6.1...v1.8.0)

Updates `svgo` from 4.0.2 to 4.1.0
- [Release notes](https://github.com/svg/svgo/releases)
- [Commits](svg/svgo@v4.0.2...v4.1.0)

---
updated-dependencies:
- dependency-name: "@babel/core"
  dependency-version: 7.29.7
  dependency-type: indirect
- dependency-name: "@humanfs/node"
  dependency-version: 0.16.8
  dependency-type: indirect
- dependency-name: astro
  dependency-version: 7.3.3
  dependency-type: direct:production
- dependency-name: baseline-browser-mapping
  dependency-version: 2.10.40
  dependency-type: indirect
- dependency-name: browserslist
  dependency-version: 4.28.4
  dependency-type: indirect
- dependency-name: devalue
  dependency-version: 5.9.4
  dependency-type: indirect
- dependency-name: hono
  dependency-version: 4.13.5
  dependency-type: indirect
- dependency-name: nanoid
  dependency-version: 3.3.19
  dependency-type: indirect
- dependency-name: postcss-selector-parser
  dependency-version: 7.1.6
  dependency-type: indirect
- dependency-name: sharp
  dependency-version: 0.35.4
  dependency-type: direct:production
- dependency-name: smol-toml
  dependency-version: 1.8.0
  dependency-type: indirect
- dependency-name: svgo
  dependency-version: 4.1.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/npm_and_yarn-b547188454 branch from 210eed8 to b63b41b Compare September 21, 2026 06:37
@willtheorangeguy
willtheorangeguy merged commit 459622c into main Sep 21, 2026
6 checks passed
@willtheorangeguy
willtheorangeguy deleted the dependabot/npm_and_yarn/npm_and_yarn-b547188454 branch September 21, 2026 17:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@willtheorangeguy