Bump the npm_and_yarn group across 1 directory with 5 updates by dependabot[bot] · Pull Request #337 · rzuppur/rekordfix

dependabot · 2025-05-06T23:42:09Z

Bumps the npm_and_yarn group with 5 updates in the / directory:

Package	From	To
happy-dom	`12.10.3`	`15.10.2`
braces	`3.0.2`	`3.0.3`
ejs	`3.1.8`	`3.1.10`
esbuild	`0.25.3`	`0.25.4`
rollup	`4.40.1`	`4.40.2`

Updates happy-dom from 12.10.3 to 15.10.2

Release notes

Sourced from happy-dom's releases.

v15.10.2

👷‍♂️ Patch fixes

Fixes a security vulnerability that allowed for server side code to be executed by a <script> tag - By @capricorn86 in task #1585

There was a case that was missed with the first patch

v15.10.1

👷‍♂️ Patch fixes

Fixes a security vulnerability that allowed for server side code to be executed by a <script> tag - By @capricorn86 in task #1585

v15.10.0

🎨 Features

Adds a new setting called disableSameOriginPolicy that makes it possible to bypass the same-origin policy in fetch requests - By @OlaviSau in task #1553

v15.9.0

🎨 Features

Adds support for "aspect-ratio" to CSSStyleDeclaration - By @yinm in task #1147

v15.8.5

👷‍♂️ Patch fixes

Fixes bug where Node.getRootNode() returned null when it was within a ShadowRoot that previously been disconnected from the Document - By @capricorn86 in task #1581

v15.8.4

👷‍♂️ Patch fixes

Fixes bug where child nodes of HTMLSelectElement and HTMLFormElement had the wrong reference to the parent - By @capricorn86 in task #1578

v15.8.3

👷‍♂️ Patch fixes

Toggle "open" attribute on HTMLDetailsElement when dispatching a click event on a summary element which is a child of the details element - By @mikedidomizio in task #1534

v15.8.2

👷‍♂️ Patch fixes

Use globalThis instead of global to make Happy DOM work in other runtimes such as Cloudflare workers - By @mattallty in task #1546

v15.8.1

👷‍♂️ Patch fixes

Always return Promise<Blob> from ClipboardItem.getType() - By @ezzatron in task #1538

v15.8.0

👷‍♂️ Patch fixes

Adds support for using non-ASCII characters in custom elements when parsing HTML - By @capricorn86 in task #1079

Fixes an issue where getHTML() and getInnerHTML() would return the slotted content of a shadow root before the template, but the template should be the first child - By @capricorn86 in task #1079

Fixes a bug where SVG elements would not be found by getElementsByTagName() - By @capricorn86 in task #1079

Improves performance when creating elements (e.g. during parsing of HTML) - By @capricorn86 in task #1550

Binding all methods to the target scope in Proxies caused a performance hit, so this is now done when calling a method the first time

🎨 Features

Adds support for all remaining SVG elements: SVGAnimateElement, SVGAnimateMotionElement, SVGAnimateTransformElement, SVGCircleElement, SVGClipPathElement, SVGDefsElement, SVGDescElement, SVGEllipseElement, SVGFEBlendElement, SVGFEColorMatrixElement, SVGFEComponentTransferElement, SVGFECompositeElement, SVGFEConvolveMatrixElement, SVGFEDiffuseLightingElement, SVGFEDisplacementMapElement, SVGFEDistantLightElement, SVGFEDropShadowElement, SVGFEFloodElement, SVGFEFuncAElement, SVGFEFuncBElement, SVGFEFuncGElement, SVGFEFuncRElement, SVGFEGaussianBlurElement, SVGFEImageElement, SVGFEMergeElement, SVGFEMergeNodeElement, SVGFEMorphologyElement, SVGFEOffsetElement, SVGFEPointLightElement, SVGFESpecularLightingElement, SVGFESpotLightElement, SVGFETileElement, SVGFETurbulenceElement, SVGFilterElement, SVGForeignObjectElement, SVGGElement, SVGImageElement, SVGLineElement, SVGLinearGradientElement, SVGMarkerElement, SVGMaskElement, SVGMetadataElement, SVGMPathElement, SVGPathElement, SVGPatternElement, SVGPolygonElement, SVGPolylineElement, SVGRadialGradientElement, SVGRectElement, SVGScriptElement, SVGSetElement, SVGStopElement, SVGStyleElement, SVGSwitchElement, SVGSymbolElement, SVGTextElement, SVGTextPathElement, SVGTitleElement, SVGTSpanElement, SVGUseElement and SVGViewElement - By @capricorn86 in task #1079

Adds support for DOMMatrix, DOMMatrixReadOnly, DOMPoint and DOMPointReadOnly - By @capricorn86 in task #1079

... (truncated)

Commits

d23834c fix: #1585 Fixes a security vulnerability that allowed for server side code...
5ee0b16 fix: #1585 Fixes security vulnerability that allowed for server side code t...
a20dba9 chore: #1542 Adds SECURITY.md file (#1584)
1625d40 feat: #1553 Adds setting disableSameOriginPolicy, to make it possible to by...
a78cd8f feat: #1147 Adds support for aspect-ratio to CSSStyleDeclaration (#1537)
e6f8b13 fix: #1581 Fixes bug where Node.getRootNode() returned null when it was wi...
38ab960 fix: #1578 Fixes bug where child nodes of HTMLSelectElement and HTMLFormEle...
8f74989 fix: #1534 Toggle open attribute on HTMLDetailsElement when dispatching a c...
7f57469 fix: #1546 Use globalThis instead of global to make Happy DOM work in o...
759b4fb fix: #1538 Always return Promise<Blob> from ClipboardItem.getType() (#1539)
Additional commits viewable in compare view

Updates braces from 3.0.2 to 3.0.3

Commits

74b2db2 3.0.3
88f1429 update eslint. lint, fix unit tests.
415d660 Snyk js braces 6838727 (#40)
190510f fix tests, skip 1 test in test/braces.expand
716eb9f readme bump
a5851e5 Merge pull request #37 from coderaiser/fix/vulnerability
2092bd1 feature: braces: add maxSymbols (https://github.com/micromatch/braces/issues/...
9f5b4cf fix: vulnerability (https://security.snyk.io/vuln/SNYK-JS-BRACES-6838727)
98414f9 remove funding file
665ab5d update keepEscaping doc (#27)
Additional commits viewable in compare view

Updates ejs from 3.1.8 to 3.1.10

Release notes

Sourced from ejs's releases.

v3.1.10

Version 3.1.10

v3.1.9

Version 3.1.9

Commits

d3f807d Version 3.1.10
9ee26dd Mocha TDD
e469741 Basic pollution protection
715e950 Merge pull request #756 from Jeffrey-mu/main
cabe314 Include advanced usage examples
29b076c Added header
11503c7 Merge branch 'main' of github.com:mde/ejs into main
7690404 Added security banner to README
f47d7ae Update SECURITY.md
828cea1 Update SECURITY.md
Additional commits viewable in compare view

Updates esbuild from 0.25.3 to 0.25.4

Release notes

Sourced from esbuild's releases.

v0.25.4
Add simple support for CORS to esbuild's development server (#4125)

Starting with version 0.25.0, esbuild's development server is no longer configured to serve cross-origin requests. This was a deliberate change to prevent any website you visit from accessing your running esbuild development server. However, this change prevented (by design) certain use cases such as "debugging in production" by having your production website load code from localhost where the esbuild development server is running.

To enable this use case, esbuild is adding a feature to allow Cross-Origin Resource Sharing (a.k.a. CORS) for simple requests. Specifically, passing your origin to the new cors option will now set the Access-Control-Allow-Origin response header when the request has a matching Origin header. Note that this currently only works for requests that don't send a preflight OPTIONS request, as esbuild's development server doesn't currently support OPTIONS requests.

Some examples:
CLI:
esbuild --servedir=. --cors-origin=https://example.com
JS:
const ctx = await esbuild.context({})
await ctx.serve({
  servedir: '.',
  cors: {
    origin: 'https://example.com',
  },
})
Go:
ctx, _ := api.Context(api.BuildOptions{})
ctx.Serve(api.ServeOptions{
  Servedir: ".",
  CORS: api.CORSOptions{
    Origin: []string{"https://example.com"},
  },
})
The special origin * can be used to allow any origin to access esbuild's development server. Note that this means any website you visit will be able to read everything served by esbuild.
Pass through invalid URLs in source maps unmodified (#4169)

This fixes a regression in version 0.25.0 where sources in source maps that form invalid URLs were not being passed through to the output. Version 0.25.0 changed the interpretation of sources from file paths to URLs, which means that URL parsing can now fail. Previously URLs that couldn't be parsed were replaced with the empty string. With this release, invalid URLs in sources should now be passed through unmodified.

Handle exports named __proto__ in ES modules (#4162, #4163)

In JavaScript, the special property name __proto__ sets the prototype when used inside an object literal. Previously esbuild's ESM-to-CommonJS conversion didn't special-case the property name of exports named __proto__ so the exported getter accidentally became the prototype of the object literal. It's unclear what this affects, if anything, but it's better practice to avoid this by using a computed property name in this case.

This fix was contributed by @magic-akari.

Changelog

Sourced from esbuild's changelog.

0.25.4
Add simple support for CORS to esbuild's development server (#4125)

Starting with version 0.25.0, esbuild's development server is no longer configured to serve cross-origin requests. This was a deliberate change to prevent any website you visit from accessing your running esbuild development server. However, this change prevented (by design) certain use cases such as "debugging in production" by having your production website load code from localhost where the esbuild development server is running.

To enable this use case, esbuild is adding a feature to allow Cross-Origin Resource Sharing (a.k.a. CORS) for simple requests. Specifically, passing your origin to the new cors option will now set the Access-Control-Allow-Origin response header when the request has a matching Origin header. Note that this currently only works for requests that don't send a preflight OPTIONS request, as esbuild's development server doesn't currently support OPTIONS requests.

Some examples:
CLI:
esbuild --servedir=. --cors-origin=https://example.com
JS:
const ctx = await esbuild.context({})
await ctx.serve({
  servedir: '.',
  cors: {
    origin: 'https://example.com',
  },
})
Go:
ctx, _ := api.Context(api.BuildOptions{})
ctx.Serve(api.ServeOptions{
  Servedir: ".",
  CORS: api.CORSOptions{
    Origin: []string{"https://example.com"},
  },
})
The special origin * can be used to allow any origin to access esbuild's development server. Note that this means any website you visit will be able to read everything served by esbuild.
Pass through invalid URLs in source maps unmodified (#4169)

This fixes a regression in version 0.25.0 where sources in source maps that form invalid URLs were not being passed through to the output. Version 0.25.0 changed the interpretation of sources from file paths to URLs, which means that URL parsing can now fail. Previously URLs that couldn't be parsed were replaced with the empty string. With this release, invalid URLs in sources should now be passed through unmodified.

Handle exports named __proto__ in ES modules (#4162, #4163)

In JavaScript, the special property name __proto__ sets the prototype when used inside an object literal. Previously esbuild's ESM-to-CommonJS conversion didn't special-case the property name of exports named __proto__ so the exported getter accidentally became the prototype of the object literal. It's unclear what this affects, if anything, but it's better practice to avoid this by using a computed property name in this case.

... (truncated)

Commits

218d29e publish 0.25.4 to npm
e66cd0b dev server: simple support for CORS requests (#4171)
8bf3368 js api: validate some options as arrays of strings
1e7375a js api: simplify comma-separated array validation
5f5964d release notes for #4163
adb5284 fix: handle __proto__ as a computed property in exports and add tests for s...
0aa9f7b fix #4169: keep invalid source map URLs unmodified
5959289 add additional guards for #4114 when using :is()
See full diff in compare view

Updates rollup from 4.40.1 to 4.40.2

Release notes

Sourced from rollup's releases.

v4.40.2

4.40.2

2025-05-06

Bug Fixes

Create correct IIFE/AMD/UMD bundles when using a mutable default export (#5934)

Fix execution order when using top-level await for dynamic imports with inlineDynamicImports (#5937)

Throw when the output is watched in watch mode (#5939)

Pull Requests

#5934: fix(exports): avoid "exports is not defined" ReferenceError (@dasa)

#5937: consider TLA imports have higher execution priority (@TrickyPi)

#5939: fix: watch mode input should not be an output subpath (@btea)

#5940: chore(deps): update dependency vite to v6.3.4 [security] (@renovate[bot])

#5941: chore(deps): update dependency eslint-plugin-unicorn to v59 (@renovate[bot])

#5942: fix(deps): lock file maintenance minor/patch updates (@renovate[bot])

#5943: fix(deps): lock file maintenance minor/patch updates (@renovate[bot])

Changelog

Sourced from rollup's changelog.

4.40.2

2025-05-06

Bug Fixes

Create correct IIFE/AMD/UMD bundles when using a mutable default export (#5934)

Fix execution order when using top-level await for dynamic imports with inlineDynamicImports (#5937)

Throw when the output is watched in watch mode (#5939)

Pull Requests

#5934: fix(exports): avoid "exports is not defined" ReferenceError (@dasa)

#5937: consider TLA imports have higher execution priority (@TrickyPi)

#5939: fix: watch mode input should not be an output subpath (@btea)

#5940: chore(deps): update dependency vite to v6.3.4 [security] (@renovate[bot])

#5941: chore(deps): update dependency eslint-plugin-unicorn to v59 (@renovate[bot])

#5942: fix(deps): lock file maintenance minor/patch updates (@renovate[bot])

#5943: fix(deps): lock file maintenance minor/patch updates (@renovate[bot])

Commits

02da7ef 4.40.2
d115fb2 fix: watch mode input should not be an output subpath (#5939)
9ea9093 fix(exports): avoid "exports is not defined" ReferenceError (#5934)
30f342d chore(deps): update dependency eslint-plugin-unicorn to v59 (#5941)
de2aefe fix(deps): lock file maintenance minor/patch updates (#5943)
4d018ae fix(deps): lock file maintenance minor/patch updates (#5942)
860df3f chore(deps): update dependency vite to v6.3.4 [security] (#5940)
cb8f815 consider TLA imports have higher execution priority (#5937)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the npm_and_yarn group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [happy-dom](https://github.com/capricorn86/happy-dom) | `12.10.3` | `15.10.2` | | [braces](https://github.com/micromatch/braces) | `3.0.2` | `3.0.3` | | [ejs](https://github.com/mde/ejs) | `3.1.8` | `3.1.10` | | [esbuild](https://github.com/evanw/esbuild) | `0.25.3` | `0.25.4` | | [rollup](https://github.com/rollup/rollup) | `4.40.1` | `4.40.2` | Updates `happy-dom` from 12.10.3 to 15.10.2 - [Release notes](https://github.com/capricorn86/happy-dom/releases) - [Commits](capricorn86/happy-dom@v12.10.3...v15.10.2) Updates `braces` from 3.0.2 to 3.0.3 - [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md) - [Commits](micromatch/braces@3.0.2...3.0.3) Updates `ejs` from 3.1.8 to 3.1.10 - [Release notes](https://github.com/mde/ejs/releases) - [Commits](mde/ejs@v3.1.8...v3.1.10) Updates `esbuild` from 0.25.3 to 0.25.4 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md) - [Commits](evanw/esbuild@v0.25.3...v0.25.4) Updates `rollup` from 4.40.1 to 4.40.2 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md) - [Commits](rollup/rollup@v4.40.1...v4.40.2) --- updated-dependencies: - dependency-name: happy-dom dependency-version: 15.10.2 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: braces dependency-version: 3.0.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ejs dependency-version: 3.1.10 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: esbuild dependency-version: 0.25.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: rollup dependency-version: 4.40.2 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2025-06-01T23:11:48Z

Looks like these dependencies are up-to-date now, so this is no longer needed.

dependabot Bot added dependencies javascript Pull requests that update javascript code labels May 6, 2025

dependabot Bot force-pushed the dependabot/npm_and_yarn/npm_and_yarn-b443e71551 branch 2 times, most recently from c9ccea0 to a320e6a Compare May 11, 2025 22:20

dependabot Bot force-pushed the dependabot/npm_and_yarn/npm_and_yarn-b443e71551 branch 2 times, most recently from 46f67d2 to a01b2fe Compare May 24, 2025 11:02

dependabot Bot force-pushed the dependabot/npm_and_yarn/npm_and_yarn-b443e71551 branch from a01b2fe to 001c927 Compare May 30, 2025 06:21

dependabot Bot closed this Jun 1, 2025

dependabot Bot deleted the dependabot/npm_and_yarn/npm_and_yarn-b443e71551 branch June 1, 2025 23:11

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the npm_and_yarn group across 1 directory with 5 updates#337

Bump the npm_and_yarn group across 1 directory with 5 updates#337
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm_and_yarn-b443e71551

dependabot Bot commented on behalf of github May 6, 2025 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Jun 1, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github May 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v15.10.2

👷‍♂️ Patch fixes

v15.10.1

👷‍♂️ Patch fixes

v15.10.0

🎨 Features

v15.9.0

🎨 Features

v15.8.5

👷‍♂️ Patch fixes

v15.8.4

👷‍♂️ Patch fixes

v15.8.3

👷‍♂️ Patch fixes

v15.8.2

👷‍♂️ Patch fixes

v15.8.1

👷‍♂️ Patch fixes

v15.8.0

👷‍♂️ Patch fixes

🎨 Features

v3.1.10

v3.1.9

v0.25.4

0.25.4

v4.40.2

4.40.2

Bug Fixes

Pull Requests

4.40.2

Bug Fixes

Pull Requests

Uh oh!

dependabot Bot commented on behalf of github Jun 1, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github May 6, 2025 •

edited

Loading