build(deps): Bump the npm_and_yarn group across 3 directories with 6 updates #199

dependabot · 2025-07-18T05:08:56Z

Bumps the npm_and_yarn group with 2 updates in the / directory: on-headers and compression.
Bumps the npm_and_yarn group with 3 updates in the /projects/microservices-project/src/currencyservice directory: brace-expansion, parse-duration and @google-cloud/profiler.
Bumps the npm_and_yarn group with 4 updates in the /projects/microservices-project/src/paymentservice directory: brace-expansion, parse-duration, @google-cloud/profiler and tar.

Updates on-headers from 1.0.2 to 1.1.0

Release notes

Sourced from on-headers's releases.

1.1.0

Important

Fix CVE-2025-7339 (GHSA-76c9-3jph-rj3q)

What's Changed

Migrate CI pipeline to GitHub actions by @carpasse in jshttp/on-headers#12

fix README.md badges by @carpasse in jshttp/on-headers#13

add OSSF scorecard action by @carpasse in jshttp/on-headers#14

fix: use ubuntu-latest as ci runner by @UlisesGascon in jshttp/on-headers#19

ci: apply OSSF Scorecard security best practices by @UlisesGascon in jshttp/on-headers#20

👷 add upstream change detection by @ctcpip in jshttp/on-headers#31

✨ add script to update known hashes by @ctcpip in jshttp/on-headers#32

💚 update CI - add newer node versions by @ctcpip in jshttp/on-headers#33

New Contributors

@carpasse made their first contribution in jshttp/on-headers#12

@UlisesGascon made their first contribution in jshttp/on-headers#19

@ctcpip made their first contribution in jshttp/on-headers#31

Full Changelog: jshttp/on-headers@v1.0.2...v1.1.0

Changelog

Sourced from on-headers's changelog.

1.1.0 / 2025-07-17

Fix CVE-2025-7339 (GHSA-76c9-3jph-rj3q)

Commits

4b017af 1.1.0
b636f2d ♻️ refactor header array code
3e2c2d4 ✨ ignore falsy header keys, matching node behavior
172eb41 ✨ support duplicate headers
c6e3849 🔒️ fix array handling
6893518 💚 update CI - add newer node versions
56a345d ✨ add script to update known hashes
175ab21 👷 add upstream change detection (#31)
ce0b2c8 ci: apply OSSF Scorecard security best practices (#20)
1a38c54 fix: use ubuntu-latest as ci runner (#19)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for on-headers since your current version.

Updates compression from 1.8.0 to 1.8.1

Release notes

Sourced from compression's releases.

v1.8.1

What's Changed

fix(docs): update multiple links from http to https by @Phillip9587 in expressjs/compression#222

ci: add dependabot for github actions by @bjohansebas in expressjs/compression#207

build(deps): bump github/codeql-action from 2.23.2 to 3.28.15 by @dependabot[bot] in expressjs/compression#228

build(deps): bump ossf/scorecard-action from 2.3.1 to 2.4.1 by @dependabot[bot] in expressjs/compression#229

build(deps-dev): bump eslint-plugin-import from 2.26.0 to 2.31.0 by @dependabot[bot] in expressjs/compression#230

build(deps-dev): bump supertest from 6.2.3 to 6.3.4 by @dependabot[bot] in expressjs/compression#231

[StepSecurity] ci: Harden GitHub Actions by @step-security-bot in expressjs/compression#235

build(deps): bump github/codeql-action from 3.28.15 to 3.29.2 by @dependabot[bot] in expressjs/compression#243

build(deps): bump actions/upload-artifact from 4.3.1 to 4.6.2 by @dependabot[bot] in expressjs/compression#239

build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by @dependabot[bot] in expressjs/compression#240

build(deps): bump actions/checkout from 4.1.1 to 4.2.2 by @dependabot[bot] in expressjs/compression#241

build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0 by @dependabot[bot] in expressjs/compression#244

deps: [email protected] by @UlisesGascon in expressjs/compression#246

Release: 1.8.1 by @UlisesGascon in expressjs/compression#247

New Contributors

@dependabot[bot] made their first contribution in expressjs/compression#228

@step-security-bot made their first contribution in expressjs/compression#235

Full Changelog: expressjs/compression@1.8.0...v1.8.1

Changelog

Sourced from compression's changelog.

1.8.1 / 2025-07-17

deps: on-headers@~1.1.0

Fix CVE-2025-7339 (GHSA-76c9-3jph-rj3q)

Commits

83a0c45 1.8.1
ce62713 deps: [email protected] (#246)
f4acb23 build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0 (#244)
6eaebe6 build(deps): bump actions/checkout from 4.1.1 to 4.2.2 (#241)
37e0623 build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 (#240)
bc436b2 build(deps): bump actions/upload-artifact from 4.3.1 to 4.6.2 (#239)
2f9f572 build(deps): bump github/codeql-action from 3.28.15 to 3.29.2 (#243)
5f13b14 [StepSecurity] ci: Harden GitHub Actions (#235)
76e0945 build(deps-dev): bump supertest from 6.2.3 to 6.3.4 (#231)
ae6ee80 build(deps-dev): bump eslint-plugin-import from 2.26.0 to 2.31.0 (#230)
Additional commits viewable in compare view

Updates brace-expansion from 1.1.11 to 1.1.12

Release notes

Sourced from brace-expansion's releases.

v1.1.12

pkg: publish on tag 1.x c460dbd

fmt ccb8ac6

Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) c3c73c8

juliangruber/brace-expansion@v1.1.11...v1.1.12

Commits

44f33b4 1.1.12
c460dbd pkg: publish on tag 1.x
ccb8ac6 fmt
c3c73c8 Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65)
See full diff in compare view

Removes parse-duration

Updates @google-cloud/profiler from 6.0.2 to 6.0.3

Release notes

Sourced from @google-cloud/profiler's releases.

v6.0.3

6.0.3 (2025-04-14)

Bug Fixes

Replace vulnerable parse-duration with CJS compatible ms library (ef0f58c)

Changelog

Sourced from @google-cloud/profiler's changelog.

6.0.3 (2025-04-14)

Bug Fixes

Replace vulnerable parse-duration with CJS compatible ms library (ef0f58c)

Commits

e43f412 chore(main): release 6.0.3 (#968)
1f32312 chore: add .release-please-manifest.json (#967)
c9c908b deps: empty PR to trigger release please after #963 (#965)
047afa1 test: add test for behavior with invalid duration returned (#964)
98d7448 chore: remove duplicate github workflow for system test (#962)
ef0f58c security: replace vulnerable parse-duration with CJS compatible ms library (#...
c55a8c4 deps: fix CI by setting @google-cloud/promisify version (#961)
3963822 chore: update links in github issue templates (#942)
See full diff in compare view

Updates brace-expansion from 1.1.11 to 1.1.12

Release notes

Sourced from brace-expansion's releases.

v1.1.12

pkg: publish on tag 1.x c460dbd

fmt ccb8ac6

Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) c3c73c8

juliangruber/brace-expansion@v1.1.11...v1.1.12

Commits

44f33b4 1.1.12
c460dbd pkg: publish on tag 1.x
ccb8ac6 fmt
c3c73c8 Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65)
See full diff in compare view

Removes parse-duration

Updates @google-cloud/profiler from 6.0.2 to 6.0.3

Release notes

Sourced from @google-cloud/profiler's releases.

v6.0.3

6.0.3 (2025-04-14)

Bug Fixes

Replace vulnerable parse-duration with CJS compatible ms library (ef0f58c)

Changelog

Sourced from @google-cloud/profiler's changelog.

6.0.3 (2025-04-14)

Bug Fixes

Replace vulnerable parse-duration with CJS compatible ms library (ef0f58c)

Commits

e43f412 chore(main): release 6.0.3 (#968)
1f32312 chore: add .release-please-manifest.json (#967)
c9c908b deps: empty PR to trigger release please after #963 (#965)
047afa1 test: add test for behavior with invalid duration returned (#964)
98d7448 chore: remove duplicate github workflow for system test (#962)
ef0f58c security: replace vulnerable parse-duration with CJS compatible ms library (#...
c55a8c4 deps: fix CI by setting @google-cloud/promisify version (#961)
3963822 chore: update links in github issue templates (#942)
See full diff in compare view

Updates tar from 6.1.12 to 6.2.1

Release notes

Sourced from tar's releases.

v6.1.13

6.1.13 (2022-12-07)

Dependencies

cc4e0dd #343 bump minipass from 3.3.6 to 4.0.0

Changelog

Sourced from tar's changelog.

Changelog

7.4

Deprecate onentry in favor of onReadEntry for clarity.

7.3

Add onWriteEntry option

7.2

DRY the command definitions into a single makeCommand method, and update the type signatures to more appropriately infer the return type from the options and arguments provided.

7.1

Update minipass to v7.1.0

Update the type definitions of write() and end() methods on Unpack and Parser classes to be compatible with the NodeJS.WritableStream type in the latest versions of @types/node.

7.0

Rewrite in TypeScript, provide ESM and CommonJS hybrid interface

Add tree-shake friendly exports, like import('tar/create') and import('tar/read-entry') to get individual functions or classes.

Add chmod option that defaults to false, and deprecate noChmod. That is, reverse the default option regarding explicitly setting file system modes to match tar entry settings.

Add processUmask option to avoid having to call process.umask() when chmod: true (or noChmod: false) is set.

6.2

Add support for brotli compression

Add maxDepth option to prevent extraction into excessively deep folders.

6.1

remove dead link to benchmarks (#313) (@yetzt)

add examples/explanation of using tar.t (@isaacs)

ensure close event is emited after stream has ended (@webark)

... (truncated)

Commits

bef7b1e 6.2.1
fe8cd57 prevent extraction in excessively deep subfolders
fe7ebfd remove security.md
5bc9d40 6.2.0
fe1ef5e changelog 6.2
e483220 get rid of npm lint stuff
689928a ci that works outside of npm org
db6f539 file inference improvements for .tbr and .tgz
336fa8f refactor: dry and other pr comments
eeba222 chore: lint fixes
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

…updates Bumps the npm_and_yarn group with 2 updates in the / directory: [on-headers](https://github.com/jshttp/on-headers) and [compression](https://github.com/expressjs/compression). Bumps the npm_and_yarn group with 3 updates in the /projects/microservices-project/src/currencyservice directory: [brace-expansion](https://github.com/juliangruber/brace-expansion), [parse-duration](https://github.com/jkroso/parse-duration) and [@google-cloud/profiler](https://github.com/googleapis/cloud-profiler-nodejs). Bumps the npm_and_yarn group with 4 updates in the /projects/microservices-project/src/paymentservice directory: [brace-expansion](https://github.com/juliangruber/brace-expansion), [parse-duration](https://github.com/jkroso/parse-duration), [@google-cloud/profiler](https://github.com/googleapis/cloud-profiler-nodejs) and [tar](https://github.com/isaacs/node-tar). Updates `on-headers` from 1.0.2 to 1.1.0 - [Release notes](https://github.com/jshttp/on-headers/releases) - [Changelog](https://github.com/jshttp/on-headers/blob/master/HISTORY.md) - [Commits](jshttp/on-headers@v1.0.2...v1.1.0) Updates `compression` from 1.8.0 to 1.8.1 - [Release notes](https://github.com/expressjs/compression/releases) - [Changelog](https://github.com/expressjs/compression/blob/master/HISTORY.md) - [Commits](expressjs/compression@1.8.0...v1.8.1) Updates `brace-expansion` from 1.1.11 to 1.1.12 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@1.1.11...v1.1.12) Removes `parse-duration` Updates `@google-cloud/profiler` from 6.0.2 to 6.0.3 - [Release notes](https://github.com/googleapis/cloud-profiler-nodejs/releases) - [Changelog](https://github.com/googleapis/cloud-profiler-nodejs/blob/main/CHANGELOG.md) - [Commits](googleapis/cloud-profiler-nodejs@v6.0.2...v6.0.3) Updates `brace-expansion` from 1.1.11 to 1.1.12 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@1.1.11...v1.1.12) Removes `parse-duration` Updates `@google-cloud/profiler` from 6.0.2 to 6.0.3 - [Release notes](https://github.com/googleapis/cloud-profiler-nodejs/releases) - [Changelog](https://github.com/googleapis/cloud-profiler-nodejs/blob/main/CHANGELOG.md) - [Commits](googleapis/cloud-profiler-nodejs@v6.0.2...v6.0.3) Updates `tar` from 6.1.12 to 6.2.1 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v6.1.12...v6.2.1) --- updated-dependencies: - dependency-name: on-headers dependency-version: 1.1.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: compression dependency-version: 1.8.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.12 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: parse-duration dependency-version: dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@google-cloud/profiler" dependency-version: 6.0.3 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.12 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: parse-duration dependency-version: dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@google-cloud/profiler" dependency-version: 6.0.3 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: tar dependency-version: 6.2.1 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 18, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

build(deps): Bump the npm_and_yarn group across 3 directories with 6 updates #199

build(deps): Bump the npm_and_yarn group across 3 directories with 6 updates #199

Uh oh!

dependabot bot commented on behalf of github Jul 18, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

build(deps): Bump the npm_and_yarn group across 3 directories with 6 updates #199

Are you sure you want to change the base?

build(deps): Bump the npm_and_yarn group across 3 directories with 6 updates #199

Uh oh!

Conversation

dependabot bot commented on behalf of github Jul 18, 2025

1.1.0

Important

What's Changed

New Contributors

1.1.0 / 2025-07-17

v1.8.1

What's Changed

New Contributors

1.8.1 / 2025-07-17

v1.1.12

v6.0.3

6.0.3 (2025-04-14)

Bug Fixes

6.0.3 (2025-04-14)

Bug Fixes

v1.1.12

v6.0.3

6.0.3 (2025-04-14)

Bug Fixes

6.0.3 (2025-04-14)

Bug Fixes

v6.1.13

6.1.13 (2022-12-07)

Dependencies

Changelog

7.4

7.3

7.2

7.1

7.0

6.2

6.1

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant