Skip to content

chore(deps): bump the npm_and_yarn group across 1 directory with 15 updates#4

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/archive/v2/npm_and_yarn-e1b1b3c022
Open

chore(deps): bump the npm_and_yarn group across 1 directory with 15 updates#4
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/archive/v2/npm_and_yarn-e1b1b3c022

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 15, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the npm_and_yarn group with 12 updates in the /archive/v2 directory:

Package From To
axios 1.7.9 1.16.0
@smithy/config-resolver 3.0.12 3.0.13
brace-expansion 1.1.11 1.1.15
esbuild 0.23.1 0.28.1
fast-xml-parser 4.4.1 5.7.3
flatted 3.3.2 3.4.2
js-yaml 4.1.0 4.2.0
lodash 4.17.21 4.18.1
minimatch 3.1.2 3.1.5
path-to-regexp 0.1.10 8.4.2
undici 6.19.8 6.24.1
ws 8.18.0 8.21.0

Updates axios from 1.7.9 to 1.16.0

Release notes

Sourced from axios's releases.

v1.16.0 — May 2, 2026

This release adds support for the QUERY HTTP method and a new ECONNREFUSED error constant, lands a substantial wave of HTTP, fetch, and XHR adapter bug fixes around redirects, aborts, headers, and timeouts, and welcomes 23 new contributors.

⚠️ Notable Changes

A handful of fixes in this release are either security-adjacent or change observable behaviour. Please review before upgrading:

  • Fetch adapter now enforces maxBodyLength and maxContentLength. These limits were silently ignored on the fetch adapter prior to 1.16.0 — anyone relying on them as a safety net (DoS protection, accidental large uploads) had no protection. (#10795)
  • Proxy requests now preserve user-supplied Host headers. Previously, the proxy path could overwrite a custom Host. Virtual-host-style routing through a proxy will now behave correctly. (#10822)
  • Basic auth credentials embedded in URLs are now URL-decoded. If you have percent-encoded credentials in a URL (e.g. https://user:p%40ss@host), the decoded value is what now goes on the wire. (#10825)
  • parseProtocol now strictly requires a colon in the protocol separator. Strings that loosely parsed as protocols before may no longer match. (#10729)
  • Deprecated unescape() replaced with modern UTF-8 encoding. Non-ASCII URL handling is now spec-correct; consumers depending on legacy unescape() quirks may see different output bytes. (#7378)
  • transformRequest input typing change was reverted. The typing change introduced in #10745 was reverted in #10810 after follow-up review — net behavior is unchanged from 1.15.2. (#10745, #10810)

🚀 New Features

  • QUERY HTTP Method: Added support for the QUERY HTTP method across adapters and type definitions. (#10802)
  • ECONNREFUSED Error Constant: Exposed ECONNREFUSED as a constant on AxiosError so callers can match connection-refused failures without comparing string literals (closes #6485). (#10680)
  • Encode Helper Export: Exported the internal encode helper from buildURL so userland param serializers can reuse the same encoding logic that axios uses internally. (#6897)

🐛 Bug Fixes

  • HTTP Adapter — Redirects & Headers: Cleared stale headers when a redirect targets a no-proxy host, fixed the redirect listener chain so listeners no longer stack across hops, restored the missing requestDetails argument on beforeRedirect, preserved user-supplied Host headers when forwarding through a proxy, and properly URL-decoded basic auth credentials. (#10794, #10800, #6241, #10822, #10825)
  • HTTP Adapter — Streams & Timeouts: Preserved the partial response object on AxiosError when a stream is aborted after headers arrive, honoured the timeout option during the connect phase when redirects are disabled, and resolved an unsettled-promise hang when an aborted request was combined with compression and maxRedirects: 0. (#10708, #10819, #7149)
  • Fetch Adapter: Enforced maxBodyLength / maxContentLength in the fetch adapter, set the User-Agent header to match the HTTP adapter, preserved the original abort reason instead of replacing it with a generic error, and deferred global access so importing the module no longer throws a TypeError in restricted environments. (#10795, #10772, #10806, #7260)
  • XHR Adapter: Unsubscribed the cancelToken and AbortSignal listeners on the error, timeout, and abort code paths to prevent leaked subscriptions. (#10787)
  • Error Handling: Attached the parsed response to AxiosError when JSON.parse fails inside dispatchRequest, prevented settle from emitting undefined error codes, and tightened the parseProtocol regex to require a colon in the protocol separator. (#10724, #7276, #10729)
  • Types & Exports: Aligned the CommonJS CancelToken typings with the ESM build, fixed a compiler error caused by RawAxiosHeaders, and re-exported create from the package index. (#7414, #6389, #6460)
  • UTF-8 Encoding: Replaced the deprecated unescape() call with a modern UTF-8 encoding implementation. (#7378)
  • Misc Cleanup: Resolved a batch of small inconsistencies and gadget-level issues across the codebase. (#10833)

🔧 Maintenance & Chores

  • Refactor — ES6 Modernisation: Modernised the utils module and XHR adapter to use ES6 features, and tidied the multipart boundary error message. (#10588, #7419)
  • Tests: Hardened the HTTP test server lifecycle to fix flaky FormData EPIPE failures, fixed Win32 platform support for the pipe tests, and corrected an incorrect test assumption. (#10820, #10791, #10796)
  • Docs: Documented paramsSerializer.encode for strict RFC 3986 query encoding, updated the parseReviver TypeScript definitions and configuration docs for ES2023, added timeout guidance to the README's first async example, and expanded notes around the recent type changes. (#10821, #10782, #10759, #10804)
  • Reverted: Reverted the transformRequest input typing change from #10745 after follow-up review. (#10745, #10810)
  • Dependencies: Bumped actions/setup-node, the github-actions group, and postcss (in /docs) to their latest versions. (#10785, #10813, #10814)
  • Release: Updated changelog and packages, and prepared the 1.16.0 release. (#10790, #10834)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

... (truncated)

Changelog

Sourced from axios's changelog.

v1.16.0 — May 2, 2026

This release adds support for the QUERY HTTP method and a new ECONNREFUSED error constant, lands a substantial wave of HTTP, fetch, and XHR adapter bug fixes around redirects, aborts, headers, and timeouts, and welcomes 23 new contributors.

⚠️ Notable Changes

A handful of fixes in this release are either security-adjacent or change observable behaviour. Please review before upgrading:

  • Fetch adapter now enforces maxBodyLength and maxContentLength. These limits were silently ignored on the fetch adapter prior to 1.16.0 — anyone relying on them as a safety net (DoS protection, accidental large uploads) had no protection. (#10795)
  • Proxy requests now preserve user-supplied Host headers. Previously, the proxy path could overwrite a custom Host. Virtual-host-style routing through a proxy will now behave correctly. (#10822)
  • Basic auth credentials embedded in URLs are now URL-decoded. If you have percent-encoded credentials in a URL (e.g. https://user:p%40ss@host), the decoded value is what now goes on the wire. (#10825)
  • parseProtocol now strictly requires a colon in the protocol separator. Strings that loosely parsed as protocols before may no longer match. (#10729)
  • Deprecated unescape() replaced with modern UTF-8 encoding. Non-ASCII URL handling is now spec-correct; consumers depending on legacy unescape() quirks may see different output bytes. (#7378)
  • transformRequest input typing change was reverted. The typing change introduced in #10745 was reverted in #10810 after follow-up review — net behavior is unchanged from 1.15.2. (#10745, #10810)

🚀 New Features

  • QUERY HTTP Method: Added support for the QUERY HTTP method across adapters and type definitions. (#10802)
  • ECONNREFUSED Error Constant: Exposed ECONNREFUSED as a constant on AxiosError so callers can match connection-refused failures without comparing string literals (closes #6485). (#10680)
  • Encode Helper Export: Exported the internal encode helper from buildURL so userland param serializers can reuse the same encoding logic that axios uses internally. (#6897)

🐛 Bug Fixes

  • HTTP Adapter — Redirects & Headers: Cleared stale headers when a redirect targets a no-proxy host, fixed the redirect listener chain so listeners no longer stack across hops, restored the missing requestDetails argument on beforeRedirect, preserved user-supplied Host headers when forwarding through a proxy, and properly URL-decoded basic auth credentials. (#10794, #10800, #6241, #10822, #10825)
  • HTTP Adapter — Streams & Timeouts: Preserved the partial response object on AxiosError when a stream is aborted after headers arrive, honoured the timeout option during the connect phase when redirects are disabled, and resolved an unsettled-promise hang when an aborted request was combined with compression and maxRedirects: 0. (#10708, #10819, #7149)
  • Fetch Adapter: Enforced maxBodyLength / maxContentLength in the fetch adapter, set the User-Agent header to match the HTTP adapter, preserved the original abort reason instead of replacing it with a generic error, and deferred global access so importing the module no longer throws a TypeError in restricted environments. (#10795, #10772, #10806, #7260)
  • XHR Adapter: Unsubscribed the cancelToken and AbortSignal listeners on the error, timeout, and abort code paths to prevent leaked subscriptions. (#10787)
  • Error Handling: Attached the parsed response to AxiosError when JSON.parse fails inside dispatchRequest, prevented settle from emitting undefined error codes, and tightened the parseProtocol regex to require a colon in the protocol separator. (#10724, #7276, #10729)
  • Types & Exports: Aligned the CommonJS CancelToken typings with the ESM build, fixed a compiler error caused by RawAxiosHeaders, and re-exported create from the package index. (#7414, #6389, #6460)
  • UTF-8 Encoding: Replaced the deprecated unescape() call with a modern UTF-8 encoding implementation. (#7378)
  • Misc Cleanup: Resolved a batch of small inconsistencies and gadget-level issues across the codebase. (#10833)

🔧 Maintenance & Chores

  • Refactor — ES6 Modernisation: Modernised the utils module and XHR adapter to use ES6 features, and tidied the multipart boundary error message. (#10588, #7419)
  • Tests: Hardened the HTTP test server lifecycle to fix flaky FormData EPIPE failures, fixed Win32 platform support for the pipe tests, and corrected an incorrect test assumption. (#10820, #10791, #10796)
  • Docs: Documented paramsSerializer.encode for strict RFC 3986 query encoding, updated the parseReviver TypeScript definitions and configuration docs for ES2023, added timeout guidance to the README's first async example, and expanded notes around the recent type changes. (#10821, #10782, #10759, #10804)
  • Reverted: Reverted the transformRequest input typing change from #10745 after follow-up review. (#10745, #10810)
  • Dependencies: Bumped actions/setup-node, the github-actions group, and postcss (in /docs) to their latest versions. (#10785, #10813, #10814)
  • Release: Updated changelog and packages, and prepared the 1.16.0 release. (#10790, #10834)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

... (truncated)

Commits
  • df53d7d chore(release): prepare release 1.16.0 (#10834)
  • 9d92bcd fix: gadgets and smaller issues (#10833)
  • 5107ee6 fix: prevent undefined error codes in settle (#7276)
  • e573499 fix(fetch): defer global access in fetch adapter (#7260)
  • ad68e1a fix(http): honor timeout during connect without redirects (#10819)
  • 2a51828 fix(http): decode URL basic auth credentials (#10825)
  • 0e8b6bb fix(http): preserve user-supplied Host header when forwarding through a proxy...
  • 79f39e1 docs: document paramsSerializer.encode for strict RFC 3986 query encoding (#1...
  • 0fe3a5f [Docs/Types] Update parseReviver TypeScript definitions for ES2023 and add ...
  • cd6737f chore: matches the sibling responseStream.on(aborted) handler and added tests...
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for axios since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates @smithy/config-resolver from 3.0.12 to 3.0.13

Changelog

Sourced from @​smithy/config-resolver's changelog.

3.0.13

Patch Changes

  • Updated dependencies [b52b4e8]
    • @​smithy/types@​3.7.2
    • @​smithy/node-config-provider@​3.1.12
    • @​smithy/util-middleware@​3.0.11
Commits

Updates brace-expansion from 1.1.11 to 1.1.15

Release notes

Sourced from brace-expansion's releases.

v1.1.15

  • Backport v5.0.6 change to v1 (#111) 0b09384

juliangruber/brace-expansion@v1.1.14...v1.1.15

v1.1.12

  • pkg: publish on tag 1.x c460dbd
  • fmt ccb8ac6
  • Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) c3c73c8

juliangruber/brace-expansion@v1.1.11...v1.1.12

Commits

Updates esbuild from 0.23.1 to 0.28.1

Release notes

Sourced from esbuild's releases.

v0.28.1

  • Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

    This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

    Thanks to @​dellalibera for reporting this issue.

  • Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

    The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

    Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

    Thanks to @​sondt99 for reporting this issue.

  • Avoid inlining using and await using declarations (#4482)

    Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

    // Original code
{
  using x = new Resource()
  x.activate()
}
// Old output (with --minify)
new Resource().activate();
// New output (with --minify)
{using e=new Resource;e.activate()}

  • Fix module evaluation when an error is thrown (#4461, #4467)

    If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

  • Fix some edge cases around the new operator (#4477)

    Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

    // Original code
new (foo()`bar`)()
new (foo()?.bar)()
// Old output
new foo()bar();
new (foo())?.bar();

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2024

This changelog documents all esbuild versions published in the year 2024 (versions 0.19.12 through 0.24.2).

0.24.2

  • Fix regression with --define and import.meta (#4010, #4012, #4013)

    The previous change in version 0.24.1 to use a more expression-like parser for define values to allow quoted property names introduced a regression that removed the ability to use --define:import.meta=.... Even though import is normally a keyword that can't be used as an identifier, ES modules special-case the import.meta expression to behave like an identifier anyway. This change fixes the regression.

    This fix was contributed by @​sapphi-red.

0.24.1

  • Allow es2024 as a target in tsconfig.json (#4004)

    TypeScript recently added es2024 as a compilation target, so esbuild now supports this in the target field of tsconfig.json files, such as in the following configuration file:

    {
  "compilerOptions": {
    "target": "ES2024"
  }
}

    As a reminder, the only thing that esbuild uses this field for is determining whether or not to use legacy TypeScript behavior for class fields. You can read more in the documentation.

    This fix was contributed by @​billyjanitsch.

  • Allow automatic semicolon insertion after get/set

    This change fixes a grammar bug in the parser that incorrectly treated the following code as a syntax error:

    class Foo {
  get
  *x() {}
  set
  *y() {}
}

    The above code will be considered valid starting with this release. This change to esbuild follows a similar change to TypeScript which will allow this syntax starting with TypeScript 5.7.

  • Allow quoted property names in --define and --pure (#4008)

    The define and pure API options now accept identifier expressions containing quoted property names. Previously all identifiers in the identifier expression had to be bare identifiers. This change now makes --define and --pure consistent with --global-name, which already supported quoted property names. For example, the following is now possible:

    

    • 






... (truncated)





Commits





Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for esbuild since your current version.






Updates fast-xml-parser from 4.4.1 to 5.7.3



Release notes

Sourced from fast-xml-parser's releases.




fix minor old bugs and update builder


    

  • fix: alwaysCreateTextNode should create text node when attributes are present for self closing node
    • 

  • fix stop node expression when ns prefix is removed (found by iruizsalinas)
    • 

  • update XML Builder to 1.1.7
    • 

  • mark addEntity deprecated
    • 



backward compatibility for numerical external entity, fix #705, #817


    

  • allow numerical external entity for backward compatibility
    • 

  • fix #705: attributesGroupName working with preserveOrder
    • 

  • fix #817: stackoverflow when tag expression is very long
    • 



upgrade @​nodable/entities and FXB


    

  • Use @nodable/entities v2.1.0

      

    • breaking changes

        

      • single entity scan. You're not allowed to use entity value to form another entity name.
        • 

      • you cant add numeric external entity
        • 

      • entity error message when expantion limit is crossed might change
        • 

      

      • 

    • typings are updated for new options related to process entity
      • 

    • please follow documentation of @nodable/entities for more detail.
      • 

    • performance

        

      • if processEntities is false, then there should not be impact on performance.
        • 

      • if processEntities is true, but you dont pass entity decoder separately then performance may degrade by approx 8-10%
        • 

      • if processEntities is true, and you pass entity decoder separately

          

        • if no entity then performance should be same as before
          • 

        • if there are entities then performance should be increased from past versions
          • 

        

        • 

      

      • 

    • ignoreAttributes is not required to be set to set xml version for NCR entity value
      • 

    

    • 

  • update 'fast-xml-builder' to sanitize malicious CDATA and comment's content
    • 



use @​nodable/entities to replace entities


    

  • No API change
    • 

  • No change in performance for basic usage
    • 

  • No typing change
    • 

  • No config change
    • 

  • new dependency
    • 

  • breaking: error messages for entities might have been changed.
    • 

  • 



Full Changelog: NaturalIntelligence/fast-xml-parser@v5.5.12...v5.6.0


performance improvment, increase entity expansion default limit


    

  • increase default entity explansion limit as many projects demand for that
    • 



maxEntitySize: 10000,
maxExpansionDepth: 10000,
maxTotalExpansions: Infinity,
maxExpandedLength: 100000,
maxEntityCount: 1000,



    

  • performance improvement

      

    • reduce calls to toString
      • 

    • early return when entities are not present
      • 

    

    • 






... (truncated)





Changelog

Sourced from fast-xml-parser's changelog.




Note: If you find missing information about particular minor version, that version must have been changed without any functional change in this library.


Note: Due to some last quick changes on v4, detail of v4.5.3 & v4.5.4 are not updated here. v4.5.4x is the last tag of v4 in github repository. I'm extremely sorry for the confusion


*5.9.0 / 2026-06-15 (not released yet)


    

  • update strnum to 2.3.0

      

    • you can set hex, binary, enotation, infinity, unicode
      • 

    

    • 

  • validate unsafe HTML or XML data in doctype entities unsing 'is-unsafe' library.
User can override rules by overriding EntityDecoder.
    • 



*5.8.0 / 2026-05-12


    

  • integrate xml-naming to validate DOCTYPE entity name and notation name (using qname becaue of backward compatibility)

      

    • This will consider xml-version as well. '1.0' is default
      • 

    

    • 

  • update strnum to 2.3.0

      

    • You can set octal and binary parsing which is bydeault off
      • 

    

    • 

  • update fast-xml-builder to 1.2.0

      

    • can sanitize tag names if found invalid
      • 

    • fix format output
      • 

    

    • 



5.7.3 / 2006-05-05


    

  • fix: alwaysCreateTextNode should create text node when attributes are present for self closing node
    • 

  • fix stop node expression when ns prefix is removed (found by iruizsalinas)
    • 

  • update XML Builder to 1.1.7
    • 

  • mark addEntity deprecated
    • 



5.7.2 / 2026-04-25


    

  • allow numerical external entity for backward compatibility
    • 

  • fix #705: attributesGroupName working with preserveOrder
    • 

  • fix #817: stackoverflow when tag expression is very long
    • 



5.7.1 / 2026-04-20


    

  • fix typo in CJS typing file
    • 



5.7.0 / 2026-04-17


    

  • Use @nodable/entities v2.1.0

      

    • breaking changes

        

      • single entity scan. You're not allowed to user entity value to form another entity name.
        • 

      • you cant add numeric external entity
        • 

      • entity error message when expantion limit is crossed might change
        • 

      

      • 

    • typings are updated for new options related to process entity
      • 

    • please follow documentation of @nodable/entities for more detail.
      • 

    • performance

        

      • if processEntities is false, then there should not be impact on performance.
        • 

      • if processEntities is true, but you dont pass entity decoder separately then performance may degrade by approx 8-10%
        • 

      • if processEntities is true, and you pass entity decoder separately

          

        • if no entity then performance should be same as before
          • 

        • if there are entities then performance should be increased from past versions
          • 

        

        • 

      

      • 

    • ignoreAttributes is not required to be set to set xml version for NCR entity value
      • 

    

    • 

  • update 'fast-xml-builder' to sanitize malicious CDATA and comment's content
    • 






... (truncated)





Commits

    

  • d6d8042 update to release
    • 

  • d263370 remove dev dependency 'he'
    • 

  • f9c9a2c update builder to 1.1.7
    • 

  • b65da87 update changelog and mark addEntity deprecated
    • 

  • c2ca631 update fxb
    • 

  • da75191 fix stop node expression when ns prefix is removed
    • 

  • 31bbc99 fix: alwaysCreateTextNode should create text node when attributes are present...
    • 

  • dab327a remove unnecessary
    • 

  • ab04eeb update docs
    • 

  • 383cb3f Revise security information for v6 release
    • 

  • Additional commits viewable in compare view
    • 







Updates flatted from 3.3.2 to 3.4.2



Commits

    

  • 3bf0909 3.4.2
    • 

  • 885ddcc fix CWE-1321
    • 

  • 0bdba70 added flatted-view to the benchmark
    • 

  • 2a02dce 3.4.1
    • 

  • fba4e8f Merge pull request #89 from WebReflection/python-fix
    • 

  • 5fe8648 added "when in Rome" also a test for PHP
    • 

  • 53517ad some minor improvement
    • 

  • b3e2a0c Fixing recursion issue in Python too
    • 

  • c4b46db Add SECURITY.md for security policy and reporting
    • 

  • f86d071 Create dependabot.yml for version updates
    • 

  • Additional commits viewable in compare view
    • 







Updates follow-redirects from 1.15.9 to 1.16.0



Commits

    

  • 0c23a22 Release version 1.16.0 of the npm package.
    • 

  • 844c4d3 Add sensitiveHeaders option.
    • 

  • 5e8b8d0 ci: add Node.js 24.x to the CI matrix
    • 

  • 7953e22 ci: upgrade GitHub Actions to use setup-node@v6 and checkout@v6
    • 

  • 86dc1f8 Sanitizing input.
    • 

  • 21ef28a Release version 1.15.11 of the npm package.
    • 

  • 7c88135 Roll back tree shaking.
    • 

  • 6e389ba Release version 1.15.10 of the npm package.
    • 

  • 5bc496e Shake me up before you go-go.
    • 

  • 694d6b4 Bump minimist from 1.2.5 to 1.2.8
    • 

  • See full diff in compare view
    • 







Updates form-data from 4.0.1 to 4.0.6



Release notes

Sourced from form-data's releases.




v4.0.4


v4.0.4 - 2025-07-16


Commits


    

  • [meta] add auto-changelog 811f682
    • 

  • [Tests] handle predict-v8-randomness failures in node < 17 and node > 23 1d11a76
    • 

  • [Fix] Switch to using crypto random for boundary values 3d17230
    • 

  • [Tests] fix linting errors 5e34080
    • 

  • [meta] actually ensure the readme backup isn’t published 316c82b
    • 

  • [Dev Deps] update @ljharb/eslint-config 58c25d7
    • 

  • [meta] fix readme capitalization 2300ca1
    • 



v4.0.3


v4.0.3 - 2025-06-05


Fixed



Commits


    

  • [eslint] use a shared config 426ba9a
    • 

  • [eslint] fix some spacing issues 2094191
    • 

  • [Refactor] use hasown 81ab41b
    • 

  • [Fix] validate boundary type in setBoundary() method 8d8e469
    • 

  • [Tests] add tests to check the behavior of getBoundary with non-strings 837b8a1
    • 

  • [Dev Deps] remove unused deps 870e4e6
    • 

  • [meta] remove local commit hooks e6e83cc
    • 

  • [Dev Deps] update eslint 4066fd6
    • 

  • [meta] fix scripts to use prepublishOnly c4bbb13
    • 



v4.0.2


v4.0.2 - 2025-02-14


Merged



Fixed



Commits





... (truncated)





Changelog

Sourced from form-data's changelog.




v4.0.6 - 2026-06-12


Commits


    

  • [Fix] escape CR, LF, and " in field names and filenames 8dff42c
    • 

  • [Dev Deps] update @ljharb/eslint-config, auto-changelog, tape f31d21e
    • 

  • [Deps] update hasown, mime-types 92ae0eb
    • 

  • [Dev Deps] update js-randomness-predictor 67b0f65
    • 



v4.0.5 - 2025-11-17


Commits


    

  • [Tests] Switch to newer v8 prediction library; enable node 24 testing 16e0076
    • 

  • [Dev Deps] update @ljharb/eslint-config, eslint 5822467
    • 

  • [Fix] set Symbol.toStringTag in the proper place 76d0dee
    • 



v4.0.4 - 2025-07-16


Commits


    

  • [meta] add auto-changelog 811f682
    • 

  • [Tests] handle predict-v8-randomness failures in node < 17 and node > 23 1d11a76
    • 

  • [Fix] Switch to using crypto random for boundary values 3d17230
    • 

  • [Tests] fix linting errors 5e34080
    • 

  • [meta] actually ensure the readme backup isn’t published 316c82b
    • 

  • [Dev Deps] update @ljharb/eslint-config 58c25d7
    • 

  • [meta] fix readme capitalization 2300ca1
    • 



v4.0.3 - 2025-06-05


Fixed



Commits


    

  • [eslint] use a shared config 426ba9a
    • 

  • [eslint] fix some spacing issues 2094191
    • 

  • [Refactor] use hasown 

    

  
  



      


          

          
  
  

    
  
    
    

  

  

  



                    

          
        





  





    



      

  
            

    

      
    

    


      


          @dependabot
dependabot
Bot



            added
      

  dependencies

  Pull requests that update a dependency file

      

  javascript

  Pull requests that update javascript code

  labels


      Jun 15, 2026

    

  








      

  
        

  

      

  
  

  
          

  

    

      


  

      
        @dependabot
  




      

        
          chore(deps): bump the npm_and_yarn group across 1 directory with 15 u…
        

          
                        
      


      

        

    
    
    

  

    


      


      

        

          

    
    
    

  

  

    
  



        

      


      

        
          d27a4e4
        
      

    

  

    

      
…pdates

Bumps the npm_and_yarn group with 12 updates in the /archive/v2 directory:

| Package | From | To |
| --- | --- | --- |
| [axios](https://github.com/axios/axios) | `1.7.9` | `1.16.0` |
| [@smithy/config-resolver](https://github.com/smithy-lang/smithy-typescript/tree/HEAD/packages/config-resolver) | `3.0.12` | `3.0.13` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.11` | `1.1.15` |
| [esbuild](https://github.com/evanw/esbuild) | `0.23.1` | `0.28.1` |
| [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) | `4.4.1` | `5.7.3` |
| [flatted](https://github.com/WebReflection/flatted) | `3.3.2` | `3.4.2` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.0` | `4.2.0` |
| [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.18.1` |
| [minimatch](https://github.com/isaacs/minimatch) | `3.1.2` | `3.1.5` |
| [path-to-regexp](https://github.com/pillarjs/path-to-regexp) | `0.1.10` | `8.4.2` |
| [undici](https://github.com/nodejs/undici) | `6.19.8` | `6.24.1` |
| [ws](https://github.com/websockets/ws) | `8.18.0` | `8.21.0` |



Updates `axios` from 1.7.9 to 1.16.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.7.9...v1.16.0)

Updates `@smithy/config-resolver` from 3.0.12 to 3.0.13
- [Release notes](https://github.com/smithy-lang/smithy-typescript/releases)
- [Changelog](https://github.com/smithy-lang/smithy-typescript/blob/@smithy/config-resolver@3.0.13/packages/config-resolver/CHANGELOG.md)
- [Commits](https://github.com/smithy-lang/smithy-typescript/commits/@smithy/config-resolver@3.0.13/packages/config-resolver)

Updates `brace-expansion` from 1.1.11 to 1.1.15
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@1.1.11...v1.1.15)

Updates `esbuild` from 0.23.1 to 0.28.1
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2024.md)
- [Commits](evanw/esbuild@v0.23.1...v0.28.1)

Updates `fast-xml-parser` from 4.4.1 to 5.7.3
- [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases)
- [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md)
- [Commits](NaturalIntelligence/fast-xml-parser@v4.4.1...v5.7.3)

Updates `flatted` from 3.3.2 to 3.4.2
- [Commits](WebReflection/flatted@v3.3.2...v3.4.2)

Updates `follow-redirects` from 1.15.9 to 1.16.0
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](follow-redirects/follow-redirects@v1.15.9...v1.16.0)

Updates `form-data` from 4.0.1 to 4.0.6
- [Release notes](https://github.com/form-data/form-data/releases)
- [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md)
- [Commits](form-data/form-data@v4.0.1...v4.0.6)

Updates `js-yaml` from 4.1.0 to 4.2.0
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/commits)

Updates `lodash` from 4.17.21 to 4.18.1
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.18.1)

Updates `minimatch` from 3.1.2 to 3.1.5
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v3.1.2...v3.1.5)

Updates `path-to-regexp` from 0.1.10 to 8.4.2
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v0.1.10...v8.4.2)

Updates `qs` from 6.13.0 to 6.15.2
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.13.0...v6.15.2)

Updates `undici` from 6.19.8 to 6.24.1
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.19.8...v6.24.1)

Updates `ws` from 8.18.0 to 8.21.0
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.18.0...8.21.0)

---
updated-dependencies:
- dependency-name: "@smithy/config-resolver"
  dependency-version: 3.0.13
  dependency-type: indirect
- dependency-name: axios
  dependency-version: 1.16.0
  dependency-type: direct:production
- dependency-name: brace-expansion
  dependency-version: 1.1.15
  dependency-type: indirect
- dependency-name: esbuild
  dependency-version: 0.28.1
  dependency-type: indirect
- dependency-name: fast-xml-parser
  dependency-version: 5.7.3
  dependency-type: indirect
- dependency-name: flatted
  dependency-version: 3.4.2
  dependency-type: indirect
- dependency-name: follow-redirects
  dependency-version: 1.16.0
  dependency-type: indirect
- dependency-name: form-data
  dependency-version: 4.0.6
  dependency-type: indirect
- dependency-name: js-yaml
  dependency-version: 4.2.0
  dependency-type: indirect
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: indirect
- dependency-name: minimatch
  dependency-version: 3.1.5
  dependency-type: indirect
- dependency-name: path-to-regexp
  dependency-version: 8.4.2
  dependency-type: indirect
- dependency-name: qs
  dependency-version: 6.15.2
  dependency-type: indirect
- dependency-name: undici
  dependency-version: 6.24.1
  dependency-type: indirect
- dependency-name: ws
  dependency-version: 8.21.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

    







  








      

  
          

  
  

  
      @dependabot
  dependabot
Bot

        force-pushed
    the
        
      
  dependabot/npm_and_yarn/archive/v2/npm_and_yarn-e1b1b3c022


    
 branch
    from
    8043f82    to
    d27a4e4      
    Compare
  



    June 16, 2026 15:35    
    













  
  

    

      

  










  








  
      

  
    Sign up for free
    to join this conversation on GitHub.
    Already have an account?
    Sign in to comment


  










      

  

    
    

    

  

    Reviewers
  


    

    No reviews






    

  


      
  

    Assignees
  



        


    No one assigned







      


  


  

    Labels
  



    

      

    dependencies

  Pull requests that update a dependency file
  

    javascript

  Pull requests that update javascript code








      

  

    

        

    Projects
  


        




    None yet




  



      


  

    
  

    Milestone
  


      No milestone





    
      
          


  

    

      
        

          
  

    Development
  



            


Successfully merging this pull request may close these issues.





  
  



      
    

  




      

    

  
        

  

    

      0 participants