Skip to content

Bump brace-expansion, eslint, @cypress/code-coverage and tmp in /packages/end-to-end - #4269

Open
dependabot[bot] wants to merge 1 commit into
integrationfrom
dependabot/npm_and_yarn/packages/end-to-end/multi-21afe3c4e3
Open

Bump brace-expansion, eslint, @cypress/code-coverage and tmp in /packages/end-to-end#4269
dependabot[bot] wants to merge 1 commit into
integrationfrom
dependabot/npm_and_yarn/packages/end-to-end/multi-21afe3c4e3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps brace-expansion to 5.0.8 and updates ancestor dependencies brace-expansion, eslint, @cypress/code-coverage and tmp. These dependencies need to be updated together.

Updates brace-expansion from 1.1.11 to 5.0.8

Release notes

Sourced from brace-expansion's releases.

v4.0.1

  • fmt 5a5cc17
  • Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) 0b6a978

juliangruber/brace-expansion@v4.0.0...v4.0.1

v4.0.0

  • feat: use string replaces instead of splits (#64) 278132b
  • fmt dd72a59
  • add tea.yaml 70e4c1b

juliangruber/brace-expansion@v3.0.0...v4.0.0

As a precaution to not risk breaking anything with 278132b, this is a new semver major release

v3.0.1

  • pkg: publish on tag 3.x 3059c07
  • fmt 8229e6f
  • Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) 15f9b3c

juliangruber/brace-expansion@v3.0.0...v3.0.1

v3.0.0

  • Switch to ES Modules and balanced-match 3.0.0 (#62) c0360e8
  • added jsdoc (#55) 68c0e37
  • node 16 is EOL 9e781e9
  • add standard 3494c4d
  • use const and let (#57) dd5a4cb
  • docs 6dad209
  • remove test e3dd8ae
  • ci: update node versions d23ede9
  • docs: add @​lanodan to contributors 1eb3fa4
  • docs 1e7c9cd
  • switch from tape to test module (#60) 2520537
  • Bump minimist from 1.2.5 to 1.2.6 (#59) 61a94f1
  • Bump path-parse from 1.0.6 to 1.0.7 (#51) dc741cf
  • docs: add back ci badge 8ee5626
  • Add github actions, remove travis. Closes #52 (#53) 5c8756a
  • CI: Drop unused sudo: false Travis directive (#50) 05978a7

juliangruber/brace-expansion@v2.0.1...v3.0.0

v2.1.1

  • Backport v5.0.6 change to v2 (#109) c3a817c

... (truncated)

Commits
Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates eslint from 8.43.0 to 10.8.0

Release notes

Sourced from eslint's releases.

v10.8.0

Features

  • 2fee9bb feat: export ConfigObject from eslint/config (#21082) (sethamus)

Bug Fixes

  • 6b8d2f7 fix: escape reserved characters in rule id in html formatter (#21129) (Francesco Trotta)
  • 9091071 fix: prevent no-unreachable-loop crash when all loop types are ignored (#21116) (Pixel)
  • e23fafe fix: prefer-object-spread add semicolon when adding parenthesis (#21081) (synthex-byte)
  • 20b5ad0 fix: quadratic-time regex in prefer-template (#21096) (Milos Djermanovic)
  • 8b6f6c0 fix: apply ignore configs to computed methods in class-methods-use-this (#21094) (Pixel)
  • b2c608c fix: NewExpression with parenthesized callee in preserve-caught-error (#21083) (Francesco Trotta)

Documentation

  • 6ddf858 docs: fix broken Specify Parser Options anchor link (#21106) (Minsu)
  • 784dfbe docs: Clarify no-eq-null description (#21120) (Park Harin)
  • 7ec733a docs: Fix typos and grammar in glossary (#21095) (Marry (Subin Yang))
  • 92bb13f docs: replace quake link (#21108) (Jung Hyeon Jun)
  • 68eb4a5 docs: fix broken Specify Globals anchor links in rule pages (#21103) (Minsu)
  • d28f697 docs: replace Code Climate CLI links with Qlty CLI links (#21099) (Jung Hyeon Jun)
  • eccc68d docs: correct --suppressions-location option description (#21093) (Ga eun Lee)
  • c5963f7 docs: Update README (GitHub Actions Bot)

Chores

  • 4fbf46d test: pin webpack version to 5.108.4 (#21137) (Francesco Trotta)
  • 2d063e2 chore: update HTTP URLs to HTTPS in JSDoc and comments (#21101) (Bo Hyun Kim)
  • eccbe7b test: add error locations to no-class-assign (#21123) (devoil)
  • e7d1e43 ci: bump actions/setup-go from 6 to 7 (#21118) (dependabot[bot])
  • e9d66d0 ci: bump actions/setup-node from 6 to 7 (#21119) (dependabot[bot])
  • ee225b6 test: Add error location details to no-eq-null rule (#21117) (Park Harin)
  • 044a627 chore: update minimatch to ^10.2.5 (#21107) (김채영)
  • fb09aa8 chore: update ecosystem plugins (#21115) (ESLint Bot)
  • 5abd878 test: add error locations to no-proto (#21114) (Gihyeon Jeong / 정기현)
  • 9715887 test: Add error location details to no-div-regex (#21110) (Park Harin)
  • a746ec6 test: add error locations to no-new-wrappers (#21109) (Gihyeon Jeong / 정기현)
  • 8dde645 test: add error locations to no-ex-assign (#21102) (devoil)
  • 13ab0ec test: add error locations to no-label-var (#21098) (Gihyeon Jeong / 정기현)
  • a99906f test: Add error location details to no-delete-var rule (#21105) (Park Harin)
  • c47e8dc chore: add missing backticks to languages/js/index.js (#21104) (beeen)
  • 0174428 chore: add missing backticks to translate-cli-options.js (#21097) (dongkyu lee)
  • 3d36589 chore: add missing backticks to serialization.js (#21091) (이규환)
  • dcc9312 test: add error locations to eqeqeq (#21090) (Ga eun Lee)
  • 2710b18 ci: Add explicit permissions to rebuild-docs-sites workflow (#21089) (Marry (Subin Yang))
  • 5d2f866 chore: update dependency prettier to v3.9.5 (#21086) (renovate[bot])
  • d584e31 chore: fix failing ecosystem test for eslint-plugin-unicorn (#21084) (Francesco Trotta)
  • bf3eda0 chore: update ecosystem plugins (#21079) (ESLint Bot)

v10.7.0

Features

  • cf2a9bf feat: add errorClassNames option to preserve-caught-error rule (#21032) (sethamus)
  • f8b873a feat: max-nested-callbacks option for constructor callbacks (#21063) (fnx)

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by eslintbot, a new releaser for eslint since your current version.


Updates @cypress/code-coverage from 3.12.1 to 4.0.3

Release notes

Sourced from @​cypress/code-coverage's releases.

v4.0.3

4.0.3 (2026-03-23)

Bug Fixes

  • deps: update dependency debug to v4.4.3 (#990) (985dbdd)

v4.0.2

4.0.2 (2026-03-16)

Bug Fixes

  • deps: update dependency dayjs to v1.11.20 (#988) (0540776)

v4.0.1

4.0.1 (2026-02-26)

Bug Fixes

  • deps: update dependency dayjs to v1.11.19 (#983) (a9a10f4)

v4.0.0

4.0.0 (2026-02-10)

chore

BREAKING CHANGES

  • Configure with expose rather than env. Minimum Cypress version is now v15.10.0. Minimum node version is now 20.x.

v3.14.7

3.14.7 (2025-10-08)

Bug Fixes

v3.14.6

3.14.6 (2025-08-19)

Bug Fixes

... (truncated)

Commits
  • 995b23a chore(deps): update dependency @​types/debug to v4.1.13 (#989)
  • 985dbdd fix(deps): update dependency debug to v4.4.3 (#990)
  • 72e4299 chore(deps): update dependency serve to v14.2.6 (#987)
  • 0540776 fix(deps): update dependency dayjs to v1.11.20 (#988)
  • fbe9918 chore(deps): update dependency @​types/lodash to v4.17.24 (#984)
  • 649cf9d chore(deps): update nyc, babel-plugin-istanbul, rimraf, and semantic-release ...
  • a9a10f4 fix(deps): update dependency dayjs to v1.11.19 (#983)
  • 067c87c chore(deps): update dependency win to v5.1.1 (#982)
  • 67df880 chore(deps): update dependency lodash to v4.17.23 (#980)
  • fd56f59 chore(deps): update dependency serve to v14.2.5 (#981)
  • Additional commits viewable in compare view

Updates tmp from 0.2.1 to 0.2.7

Changelog

Sourced from tmp's changelog.

v0.2.2 (2024-02-28)

🐛 Bug Fix

📝 Documentation

Committers: 5

Commits

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Jul 23, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner July 23, 2026 02:12
@dependabot dependabot Bot added the javascript Pull requests that update javascript code label Jul 23, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner July 23, 2026 02:12
@dependabot
dependabot Bot requested review from SayakaOno and removed request for a team July 23, 2026 02:12
@socket-security

socket-security Bot commented Jul 23, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updated@​cypress/​code-coverage@​3.12.1 ⏵ 4.0.39910010084100
Updatedeslint@​8.43.0 ⏵ 10.8.097 +110010095 +45100

View full report

@socket-security

socket-security Bot commented Jul 23, 2026 •
edited
Loading

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm webpack is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: packages/end-to-end/package-lock.json → npm/@cypress/code-coverage@4.0.3 → npm/webpack@5.109.2

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/webpack@5.109.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/packages/end-to-end/multi-21afe3c4e3 branch 4 times, most recently from 43dad78 to 9e3b6b5 Compare July 27, 2026 22:59
@dependabot
Bump brace-expansion, eslint, @cypress/code-coverage and tmp
d5fb601 
Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) to 5.0.8 and updates ancestor dependencies [brace-expansion](https://github.com/juliangruber/brace-expansion), [eslint](https://github.com/eslint/eslint), [@cypress/code-coverage](https://github.com/cypress-io/code-coverage) and [tmp](https://github.com/raszi/node-tmp). These dependencies need to be updated together.


Updates `brace-expansion` from 1.1.11 to 5.0.8
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@1.1.11...v5.0.8)

Updates `eslint` from 8.43.0 to 10.8.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v8.43.0...v10.8.0)

Updates `@cypress/code-coverage` from 3.12.1 to 4.0.3
- [Release notes](https://github.com/cypress-io/code-coverage/releases)
- [Commits](cypress-io/code-coverage@v3.12.1...v4.0.3)

Updates `tmp` from 0.2.1 to 0.2.7
- [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md)
- [Commits](raszi/node-tmp@v0.2.1...v0.2.7)

---
updated-dependencies:
- dependency-name: "@cypress/code-coverage"
  dependency-version: 4.0.3
  dependency-type: direct:development
- dependency-name: brace-expansion
  dependency-version: 5.0.7
  dependency-type: indirect
- dependency-name: eslint
  dependency-version: 10.7.0
  dependency-type: direct:development
- dependency-name: tmp
  dependency-version: 0.2.7
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/packages/end-to-end/multi-21afe3c4e3 branch from 9e3b6b5 to d5fb601 Compare July 28, 2026 20:14
@SayakaOno SayakaOno mentioned this pull request Jul 28, 2026
Open
@SayakaOno

SayakaOno commented Jul 28, 2026

Copy link
Copy Markdown
Collaborator

Hold for manual cypress_tests.yml verification before merging — merge #4279 first.

@cypress/code-coverage 3.12.1→4.0.3 requires cypress >=15.10.0 per its peer dependencies; this repo currently pins ^13.2.0. #4279 bumps cypress to 15.19.0, satisfying that — merge it first or this bump will run against an unsupported Cypress version.

The rest of this PR is solid: brace-expansion fixes 4 HIGH ReDoS/DoS advisories, tmp fixes 2 HIGH advisories (arbitrary file write via symlink, path traversal), eslint 8→10 is routine with no CVE.

CI doesn't exercise Cypress itself on normal PR pushes — needs a workflow_dispatch run first.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@SayakaOno SayakaOno Awaiting requested review from SayakaOno SayakaOno is a code owner automatically assigned from LiteFarmOrg/reviewers

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@SayakaOno