chore(deps): bump the npm_and_yarn group across 3 directories with 22 updates by dependabot[bot] · Pull Request #5 · ComposioHQ/clawdbot

dependabot · 2026-05-19T17:23:23Z

Bumps the npm_and_yarn group with 18 updates in the / directory:

Package	From	To
file-type	`21.3.0`	`21.3.2`
hono	`4.11.4`	`4.12.18`
tar	`7.5.4`	`7.5.11`
undici	`7.19.0`	`7.24.0`
yaml	`2.8.2`	`2.8.3`
dompurify	`3.3.1`	`3.4.0`
vite	`7.3.1`	`7.3.2`
@opentelemetry/sdk-node	`0.211.0`	`0.218.0`
music-metadata	`11.10.6`	`11.12.3`
@protobufjs/utf8	`1.1.0`	`1.1.1`
axios	`1.13.2`	`1.16.1`
brace-expansion	`2.0.2`	`4.0.1`
fast-uri	`3.1.0`	`3.1.2`
lodash	`4.17.23`	`4.18.1`
path-to-regexp	`0.1.12`	`8.4.2`
postcss	`8.5.6`	`8.5.15`
sanitize-html	`2.17.0`	`2.17.4`
simple-git	`3.30.0`	`3.36.0`

Bumps the npm_and_yarn group with 1 update in the /extensions/diagnostics-otel directory: @opentelemetry/sdk-node.
Bumps the npm_and_yarn group with 2 updates in the /ui directory: dompurify and vite.

Updates file-type from 21.3.0 to 21.3.2

Release notes

Sourced from file-type's releases.

v21.3.2

Fix ZIP bomb in known-size ZIP probing (GHSA-j47w-4g3g-c36v) a155cd7

Fix bound recursive BOM and ID3 detection 370ed91

sindresorhus/file-type@v21.3.1...v21.3.2

v21.3.1

Fix infinite loop in ASF parser on malformed input (GHSA-5v7r-6r5c-r473) 319abf8

sindresorhus/file-type@v21.3.0...v21.3.1

Commits

e18028c 21.3.2
a155cd7 Fix ZIP bomb in known-size ZIP probing
6954817 Harden parser more
370ed91 Fix bound recursive BOM and ID3 detection
d2ecea1 Add a few more safeguards
41fcff5 Update readme
a8f6934 Fix CI
ad5857e 21.3.1
5d2fedf Harden parser
319abf8 Fix infinite loop in ASF parser on malformed input
Additional commits viewable in compare view

Updates hono from 4.11.4 to 4.12.18

Release notes

Sourced from hono's releases.

v4.12.18

Security fixes

This release includes fixes for the following security issues:

Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage

Affects: Cache Middleware. Fixes missing cache-skip handling for Vary: Authorization and Vary: Cookie, where a response cached for one authenticated user could be served to other users. GHSA-p77w-8qqv-26rm

CSS Declaration Injection via Style Object Values in JSX SSR

Affects: hono/jsx. Fixes a missing CSS-context escape for style object values and property names, where untrusted input could inject additional CSS declarations. The impact is limited to CSS and does not allow JavaScript execution. GHSA-qp7p-654g-cw7p

Improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()

Affects: hono/utils/jwt. Fixes improper validation of exp, nbf, and iat claims, where falsy, non-finite, or non-numeric values could silently bypass time-based checks instead of being rejected per RFC 7519. GHSA-hm8q-7f3q-5f36

Users who use the JWT helper, hono/jsx, or the Cache middleware are strongly encouraged to upgrade to this version.

v4.12.17

What's Changed

fix(jsx): normalize SVG attributes on the root element by @kfly8 in honojs/hono#4893

fix(ssg): add atom+xml and rss+xml to defaultExtensionMap by @yuintei in honojs/hono#4899

fix(cors): make origin optional in CORSOptions by @truffle-dev in honojs/hono#4905

fix(types): propagate middleware response types to app.on overloads by @T4ko0522 in honojs/hono#4906

New Contributors

@kfly8 made their first contribution in honojs/hono#4893

@truffle-dev made their first contribution in honojs/hono#4905

Full Changelog: honojs/hono@v4.12.16...v4.12.17

v4.12.16

Security fixes

This release includes fixes for the following security issues:

Unvalidated JSX Tag Names in hono/jsx May Allow HTML Injection

Affects: hono/jsx. Fixes missing validation of JSX tag names when using jsx() or createElement(), which could allow HTML injection if untrusted input is used as the tag name. GHSA-69xw-7hcm-h432

bodyLimit() can be bypassed for chunked / unknown-length requests

Affects: Body Limit Middleware. Fixes late enforcement for request bodies without a reliable Content-Length (e.g. chunked requests), where oversized requests could reach handlers and return successful responses before being rejected. GHSA-9vqf-7f2p-gf9v

v4.12.15

What's Changed

fix(jwt): support single-line PEM keys by @hiendv in honojs/hono#4889

... (truncated)

Commits

f10dee8 4.12.18
a5bd9eb Merge commit from fork
58d3d3a Merge commit from fork
568c2ec Merge commit from fork
ff2b3d3 4.12.17
52aaaf9 fix(types): propagate middleware response types to app.on overloads (#4906)
76d5589 fix(cors): make origin optional in CORSOptions (#4905)
8f027e5 fix(ssg): add atom+xml and rss+xml to defaultExtensionMap (#4899)
bfba97c fix(jsx): normalize SVG attributes on the <svg> root element (#4893)
90d4182 4.12.16
Additional commits viewable in compare view

Updates tar from 7.5.4 to 7.5.11

Commits

bf776f6 7.5.11
f48b5fa prevent escaping symlinks with drive-relative paths
97cff15 docs: more security info
2b72abc 7.5.10
7bc755d parse root off paths before sanitizing .. parts
c8cb846 update deps
1f0c2c9 7.5.9
fbb0851 build minified version as default export
6b8eba0 7.5.8
2cb1120 fix(unpack): improve UnpackSync symlink error "into" path accuracy
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by isaacs, a new releaser for tar since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates undici from 7.19.0 to 7.24.0

Release notes

Sourced from undici's releases.

v7.24.0

Undici v7.24.0 Security Release Notes

This release addresses multiple security vulnerabilities in Undici.

Upgrade guidance

All users on v7 should upgrade to v7.24.0 or later.

Fixed advisories

GHSA-2mjp-6q6p-2qxm / CVE-2026-1525 (Medium)
Inconsistent interpretation of HTTP requests (request/response smuggling class issue).

GHSA-f269-vfmq-vjvj / CVE-2026-1528 (High)
Malicious WebSocket 64-bit frame length handling could crash the client.

GHSA-phc3-fgpg-7m6h / CVE-2026-2581 (Medium)
Unbounded memory consumption in deduplication interceptor response buffering (DoS risk).

GHSA-4992-7rv2-5pvq / CVE-2026-1527 (Medium)
CRLF injection via the upgrade option.

GHSA-v9p9-hfj2-hcw8 / CVE-2026-2229 (High)
Unhandled exception from invalid server_max_window_bits in WebSocket permessage-deflate negotiation.

GHSA-vrm6-8vpv-qv8q / CVE-2026-1526 (High)
Unbounded memory consumption in WebSocket permessage-deflate decompression.

Affected and patched ranges

CVE-2026-1525: affected 7.0.0 < 7.24.0, patched 7.24.0

CVE-2026-1528: affected 7.0.0 < 7.24.0, patched 7.24.0

CVE-2026-2581: affected >= 7.17.0 < 7.24.0, patched 7.24.0

CVE-2026-1527: affected 7.0.0 < 7.24.0, patched 7.24.0

CVE-2026-2229: affected 7.0.0 < 7.24.0, patched 7.24.0

CVE-2026-1526: affected 7.0.0 < 7.24.0, patched 7.24.0

References

GitHub Security Advisories: https://github.com/nodejs/undici/security/advisories

NVD CVE-2026-1525: https://nvd.nist.gov/vuln/detail/CVE-2026-1525

NVD CVE-2026-1528: https://nvd.nist.gov/vuln/detail/CVE-2026-1528

NVD CVE-2026-2581: https://nvd.nist.gov/vuln/detail/CVE-2026-2581

NVD CVE-2026-1527: https://nvd.nist.gov/vuln/detail/CVE-2026-1527

NVD CVE-2026-2229: https://nvd.nist.gov/vuln/detail/CVE-2026-2229

NVD CVE-2026-1526: https://nvd.nist.gov/vuln/detail/CVE-2026-1526

v7.23.0

What's Changed

... (truncated)

Commits

07a3906 Bumped v7.24.0 (#4887)
74495c6 fix: reject duplicate content-length and host headers
84235c6 Fix websocket 64-bit length overflow
77594f9 fix: validate upgrade header to prevent CRLF injection
cb79c57 fix: validate server_max_window_bits range in permessage-deflate
4147ce2 Merge commit '2ee00cb3'
2ee00cb fix(websocket): add maxDecompressedMessageSize limit for permessage-deflate
5890c7b fix(deduplicate): stream response chunks to waiting handlers
fbda3c1 Bumped v7.23.0 (#4884)
07276c9 fix: remove unused kSocketPath symbol
Additional commits viewable in compare view

Updates yaml from 2.8.2 to 2.8.3

Release notes

Sourced from yaml's releases.

v2.8.3

Add trailingComma ToString option for multiline flow formatting (#670)

Catch stack overflow during node composition (1e84ebb)

Commits

ce14587 2.8.3
1e84ebb fix: Catch stack overflow during node composition
6b24090 ci: Include Prettier check in lint action
9424dee chore: Refresh lockfile
d1aca82 Add trailingComma ToString option for multiline flow formatting (#670)
4321509 ci: Drop the branch filter from GitHub PR actions
47207d0 chore: Update docs-slate
5212fae chore: Update docs-slate
See full diff in compare view

Updates dompurify from 3.3.1 to 3.4.0

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.0

Most relevant changes:

Fixed a problem with FORBID_TAGS not winning over ADD_TAGS, thanks @kodareef5

Fixed several minor problems and typos regarding MathML attributes, thanks @DavidOliver

Fixed ADD_ATTR/ADD_TAGS function leaking into subsequent array-based calls, thanks @1Jesper1

Fixed a missing SAFE_FOR_TEMPLATES scrub in RETURN_DOM path, thanks @bencalif

Fixed a prototype pollution via CUSTOM_ELEMENT_HANDLING, thanks @trace37labs

Fixed an issue with ADD_TAGS function form bypassing FORBID_TAGS, thanks @eddieran

Fixed an issue with ADD_ATTR predicates skipping URI validation, thanks @christos-eth

Fixed an issue with USE_PROFILES prototype pollution, thanks @christos-eth

Fixed an issue leading to possible mXSS via Re-Contextualization, thanks @researchatfluidattacks and others

Fixed an issue with closing tags leading to possible mXSS, thanks @frevadiscor

Fixed a problem with the type dentition patcher after Node version bump

Fixed freezing BS runs by reducing the tested browsers array

Bumped several dependencies where possible

Added needed files for OpenSSF scorecard checks

Published Advisories are here: https://github.com/cure53/DOMPurify/security/advisories?state=published

DOMPurify 3.3.3

Fixed an engine requirement for Node 20 which caused hiccups, thanks @Rotzbua

DOMPurify 3.3.2

Fixed a possible bypass caused by jsdom's faulty raw-text tag parsing, thanks multiple reporters

Fixed a prototype pollution issue when working with custom elements, thanks @christos-eth

Fixed a lenient config parsing in _isValidAttribute, thanks @christos-eth

Bumped and removed several dependencies, thanks @Rotzbua

Fixed the test suite after bumping dependencies, thanks @Rotzbua

Commits

5b16e0b Getting 3.x branch ready for 3.4.0 release (#1250)
8bcbf73 chore: Preparing 3.3.3 release
5faddd6 fix: engine requirement (#1210)
0f91e3a Update README.md
d5ff1a8 Merge branch 'main' of github.com:cure53/DOMPurify
c3efd48 fix: moved back from jsdom 28 to jsdom 20
988b888 fix: moved back from jsdom 28 to jsdom 20
2726c74 chore: Preparing 3.3.2 release
6202c7e build(deps): bump @tootallnate/once and jsdom (#1204)
302b51d fix: Expanded the regex ever so slightly to also cover script
Additional commits viewable in compare view

Updates vite from 7.3.1 to 7.3.2

Release notes

Sourced from vite's releases.

v7.3.2

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

7.3.2 (2026-04-06)

Bug Fixes

avoid path traversal with optimize deps sourcemap handler (#22161) (09d8c90)

backport #22159, apply server.fs check to env transport (#22162) (19db0f2)

check server.fs after stripping query as well (#22160) (f8103cc)

Commits

cc383e0 release: v7.3.2
09d8c90 fix: avoid path traversal with optimize deps sourcemap handler (#22161)
f8103cc fix: check server.fs after stripping query as well (#22160)
19db0f2 fix: backport #22159, apply server.fs check to env transport (#22162)
See full diff in compare view

Updates @opentelemetry/sdk-node from 0.211.0 to 0.218.0

Release notes

Sourced from @opentelemetry/sdk-node's releases.

experimental/v0.218.0

0.218.0

🚀 Features

feat(otlp-transformer): replace protobufjs metrics serialization with custom implementation #6625 @pichlermarc

feat(configuration): show all config validation errors, if there are multiple #6683 @trentm

feat(sdk-node): allow startNodeSDK() without an arg #6688 @trentm

🏠 Internal

refactor(sdk-logs): alias LoggerProviderConfig to LoggerProviderOptions #6691 @david-luna

refactor(sdk-logs): use Logger.enabled() within Logger.emit() implementation #6680 @david-luna

experimental/v0.217.0

0.217.0

🚀 Features

feat(otlp-transformer): replace protobufjs trace serialization with custom implementation #6625 @pichlermarc

feat(configuration): auto-generate TypeScript types from OTel declarative config JSON schema (stable v1.0.0) using json-schema-to-typescript and ajv #6533 @MikeGoldsmith

feat(configuration, sdk-node): startNodeSDK() code path now uses log_level configuration to setup a DiagConsoleLogger #6668 @trentm

Note that allowed values for log_level in a configuration YAML file are not the same set as for OTEL_LOG_LEVEL. Use log_level: trace to see all logs (equivalent of OTEL_LOG_LEVEL=ALL). Use log_level: fatal to effectively disable the SDK's internal diagnostic logger (equivalent of OTEL_LOG_LEVEL=NONE).

If log_level is not specified, a diagnostic console logger at "info" level will be setup.

An invalid YAML config file will now result in a noop OTel SDK.

🐛 Bug Fixes

fix(configuration): do not validate OTEL_CONFIG_FILE value before using it for file config #6643 @trentm

fix(configuration): improve how 'additionalProperties' in JSON schema is translated to TS types #6650 @trentm

fix(configuration): remove stripMinItems and preprocessNullArrays from validation/parsing #6657 @trentm

fix(configuration): improve handling of enums in generated types #6659 @trentm

fix(configuration): improve the technique for removing '| null' on types the JSON Schema #6662 @trentm

fix(sampler-jaeger-remote): add missing axios dep #6656 @trentm

fix(exporter-prometheus): handle malformed URLs in Prometheus exporter request handler #6674 @homanp

experimental/v0.216.0

0.216.0

🚀 Features

feat(sdk-node): wire attribute_keys from declarative configuration to ViewOptions.attributesProcessors #6427 @ravitheja4531-cell

feat(sdk-node): set TracerProvider in startNodeSDK() #6607 @maryliag

🐛 Bug Fixes

fix(instrumentation-xml-http-request): avoid unwrapping XMLHttpRequest API when disabling #6611 @david-luna

fix(instrumentation-fetch): tolerate non-writable globalThis.fetch and fix premature _isEnabled / _isFetchPatched flips in enable() @brunorodmoreira

... (truncated)

Commits

06ad0ea chore: prepare next release (#6703)
38ca257 feat(otlp-transformer): replace protobufjs metrics serialization with custom ...
013c600 chore: prepare next release (#6699)
b7a0c63 feat(semantic-conventions): update semantic conventions to v1.41.1 (#6695)
774143b chore(renovate): add minimumReleaseAge to config (#6697)
e0dafe0 fix(otlp-exporter-base): remove brackets from IPv6 hostname in HTTP transport...
f804c93 chore(deps): update github/codeql-action digest to 68bde55 (#6682)
95e48e7 refactor(sdk-logs): alias LoggerProviderConfig to LoggerProviderOptions (...
907b627 feat(sdk-node): allow startNodeSDK() without an arg (#6688)
0d15261 docs: Add SIG meeting info and welcoming language (#6689)
Additional commits viewable in compare view

Updates music-metadata from 11.10.6 to 11.12.3

Release notes

Sourced from music-metadata's releases.

v11.12.3

Changes

🐛 Bug Fixes

Fix TypeScript decleration inclusion @Borewit (#2608)

📦 NPM release

NPM release: music-metadata@11.12.3

v11.12.2

⚠️ This release is missing TypeScript declarations, use v11.12.3 instead.

Changes

⚠️ Fix CWE-85 by avoiding infinite loop in ASF @Borewit (#2605)

🐛 Bug Fixes

Map .wma and .wmv. extension to AsfParser @Borewit (#2601)

⬆️ Dependencies

Bump @borewit/text-codec from 0.2.1 to 0.2.2 @dependabot (#2602)

📦 NPM release

NPM release: music-metadata@11.12.2

v11.12.1

Changes

🐛 Bug Fixes

Fix miscalculation Ogg/Vorbis, duration miscalculation @Borewit (#2583)

📦 NPM release

NPM release: music-metadata@11.12.1

v11.12.0

Changes

🚀 Enhancements

feat: Add support for multiple albumartists @ma225tq (#2577)

📦 NPM release

NPM release: music-metadata@11.12.0

v11.11.2

Changes

... (truncated)

Commits

894a9e8 11.12.3
2beb45c Fix TypeScript decleration inclusion
7f13e8e 11.12.2
7e5be08 Upgrade @biomejs/biome to 2.4.6
318e963 Fix CWE-85 by avoiding infinite loop in ASF
5b7e69c Simplify tsconfig.prod.json by removing unused options
1ffe9bf Bump tar from 7.5.7 to 7.5.11
20f4683 Bump c8 from 10.1.3 to 11.0.0
cfcf152 Bump @borewit/text-codec from 0.2.1 to 0.2.2
2e4e40c Bump minimatch from 9.0.5 to 9.0.9
Additional commits viewable in compare view

Updates @opentelemetry/exporter-prometheus from 0.211.0 to 0.218.0

Release notes

Sourced from @opentelemetry/exporter-prometheus's releases.

experimental/v0.218.0

0.218.0

🚀 Features

feat(otlp-transformer): replace protobufjs metrics serialization with custom implementation #6625 @pichlermarc

feat(configuration): show all config validation errors, if there are multiple #6683 @trentm

feat(sdk-node): allow startNodeSDK() without an arg #6688 @trentm

🏠 Internal

refactor(sdk-logs): alias LoggerProviderConfig to LoggerProviderOptions #6691 @david-luna

refactor(sdk-logs): use Logger.enabled() within Logger.emit() implementation #6680 @david-luna

experimental/v0.217.0

0.217.0

🚀 Features

feat(otlp-transformer): replace protobufjs trace serialization with custom implementation #6625 @pichlermarc

feat(configuration): auto-generate TypeScript types from OTel declarative config JSON schema (stable v1.0.0) using json-schema-to-typescript and ajv #6533 @MikeGoldsmith

feat(configuration, sdk-node): startNodeSDK() code path now uses log_level configuration to setup a DiagConsoleLogger #6668 @trentm

Note that allowed values for log_level in a configuration YAML file are not the same set as for OTEL_LOG_LEVEL. Use log_level: trace to see all logs (equivalent of OTEL_LOG_LEVEL=ALL). Use log_level: fatal to effectively disable the SDK's internal diagnostic logger (equivalent of OTEL_LOG_LEVEL=NONE).

If log_level is not specified, a diagnostic console logger at "info" level will be setup.

An invalid YAML config file will now result in a noop OTel SDK.

🐛 Bug Fixes

fix(configuration): do not validate OTEL_CONFIG_FILE value before using it for file config #6643 @trentm

fix(configuration): improve how 'additionalProperties' in JSON schema is translated to TS types #6650 @trentm

fix(configuration): remove stripMinItems and preprocessNullArrays from validation/parsing #6657 @trentm

fix(configuration): improve handling of enums in generated types #6659 @trentm

fix(configuration): improve the technique for removing '| null' on types the JSON Schema #6662 @trentm

fix(sampler-jaeger-remote): add missing axios dep #6656 @trentm

fix(exporter-prometheus): handle malformed URLs in Prometheus exporter request handler #6674 @homanp

experimental/v0.216.0

0.216.0

🚀 Features

feat(sdk-node): wire attribute_keys from declarative configuration to ViewOptions.attributesProcessors #6427 @ravitheja4531-cell

feat(sdk-node): set TracerProvider in startNodeSDK() #6607 @maryliag

🐛 Bug Fixes

fix(instrumentation-xml-http-request): avoid unwrapping XMLHttpRequest API when disabling #6611 @david-luna

fix(instrumentation-fetch): tolerate non-writable globalThis.fetch and fix premature _isEnabled / _isFetchPatched flips in enable() @brunorodmoreira

... (truncated)

Commits

06ad0ea chore: prepare next release (#6703)
38ca257 feat(otlp-transformer): replace protobufjs metrics serialization with custom ...
013c600 chore: prepare next release (#6699)
b7a0c63 feat(semantic-conventions): update semantic conventions to v1.41.1 (#6695)
774143b chore(renovate): add minimumReleaseAge to config (#6697)
e0dafe0 fix(otlp-exporter-base): remove brackets from IPv6 hostname in HTTP transport...
f804c93 chore(deps): update github/codeql-action digest to 68bde55 (#6682)
95e48e7 refactor(sdk-logs): alias LoggerProviderConfig to LoggerProviderOptions (...
907b627 feat(sdk-node): allow startNodeSDK() without an arg (#6688)
0d15261 docs: Add SIG meeting info and welcoming language (#6689)
Additional commits viewable in compare view

Updates @protobufjs/utf8 from 1.1.0 to 1.1.1

Release notes

Sourced from @protobufjs/utf8's releases.

protobufjs-cli: v1.1.1

1.1.1 (2023-02-02)

Bug Fixes

cli: fix relative path to Google pb files (#1859) (e42eea4)

Commits

ab3862d chore: release protobufjs-v7.x (#2255)
0853a62 fix: Backport bundler-safe optional module lookups (#2254)
d7035f9 chore: release protobufjs-v7.x (#2248)
54b593f fix: Backport parser hardening to 7.x (#2245)
e88fcea chore: release protobufjs-v7.x (#2239)
cc7d595 fix: Restore first-match namespace lookup (#2236)
3abc9b5 chore: release protobufjs-v7.x (#2190)
a0bf2df fix: Update CLI peer dependency (7.x) (#2189)
2189e5b chore: release protobufjs-v7.x (#2174)
75392ea fix: Backport input hardening and CLI fixes to 7.x (#2173)
Additional commits viewable in compare view

Updates axios from 1.13.2 to 1.16.1

Release notes

Sourced from axios's releases.

v1.16.1 — May 13, 2026

This release ships a defence-in-depth fix for prototype pollution in formDataToJSON, hardens proxy and CI workflows, restores Webpack 4 compatibility for the fetch adapter, and includes several small bug fixes and maintenance improvements.

🔒 Security Fixes

Prototype Pollution Defence-in-Depth: Hardened formDataToJSON against already-polluted Object.prototype by walking own properties only, so attacker-controlled keys inherited from a poisoned prototype cannot propagate through deserialization. (#7413)

Proxy Cleartext Leak: Fixed an issue where HTTPS request data could be transmitted in cleartext to an HTTP proxy under certain configurations. (#10858)

CI Cache Removal: Removed all GitHub Actions caches as a defence-in-depth measure against cache poisoning vectors in the build pipeline. (#10882)

🐛 Bug Fixes

Data URI Parsing: Updated the fromDataURI regex to match RFC 2397 more strictly, fixing edge cases in data: URL handling. (#10829)

Unicode Headers: Preserved Unicode header values when running through request interceptors, so non-ASCII header content is no longer corrupted before dispatch. (#10850)

XHR Upload Progress: Guarded against malformed ProgressEvent payloads emitted by some environments during XHR upload, preventing crashes when loaded / total are missing or invalid. (#10868)

Webpack 4 Fetch Adapter: Fixed an "unexpected token" error caused by syntax in the fetch adapter that Webpack 4 could not parse, restoring compatibility for legacy bundler users. (#10864)

Type Definitions: Made parseReviver context.source optional in the type definitions to align with the ES2023 specification. (#10837)

URL Object Support Reverted: Reverted the change that allowed passing a URL object as config.url (originally #10866) due to regressions; this support will be reintroduced in a later release once the underlying issues are addressed. (#10874)

🔧 Maintenance & Chores

Cycle Detection Refactor: Replaced the array-based cycle tracker in toJSONObject with a WeakSet, improving performance and memory behaviour on large nested structures. (#10832)

composeSignals Cleanup: Refactored composeSignals to use a clearer early-return structure, simplifying the cancellation/abort composition path. (#10844)

AI Readiness & Repo Docs: Added AGENTS.md and related contributor-guide updates for both human and AI agents, plus post-release documentation improvements. (#10835, #10841)

Docs Improvements: Clarified the GET request example, fixed the interceptor eject example to reference the correct instance, and corrected the Buzzoid sponsor description in the README. (#10836, #10853, #10856)

Sponsorship Tooling: Fixed empty sponsor arrays in the sponsor processing script, added the ability to inject additional sponsors, updated the sponsorship link, and added a Twicsy advertisement entry. (#10843, #10859, #10869)

Dependencies: Bumped @commitlint/cli from 20.5.0 to 20.5.2. (#10846)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

@hpinmetaverse (#10836)

@tommyhgunz14 (#7413)

@abhu85 (#10829)

@divyanshuraj1095 (#10853)

@sagodi97 (#10856)

@rkdfx (#10868)

@Liuwei1125 (#10866)

Full Changelog

v1.16.0 — May 2, 2026

This release adds support for the QUERY HTTP method and a new ECONNREFUSED error constant, lands a substantial wave of HTTP, fetch, and XHR adapter bug fixes around redirects, aborts, headers, and timeouts, and welcomes 23 new contributors.

⚠️ Notable Changes

A handful of fixes in this release are either security-adjacent or change observable behaviour. Please review before upgrading:

... (truncated)

Changelog

Sourced from axios's changelog.

Changelog

v1.16.0 — May 2, 2026

This release adds support for the QUERY HTTP method and a new ECONNREFUSED error constant, lands a substantial wave of HTTP, fetch, and XHR adapter bug fixes around redirects, aborts, headers, and timeouts, and welcomes 23 new contributors.

⚠️ Notable Changes

A handful of fixes in this release are either security-adjacent or change observable behaviour. Please review before upgrading:

Fetch adapter now enforces maxBodyLength and maxContentLength. These limits were silently ignored on the fetch adapter prior to 1.16.0 — anyone relying on them as a safety net (DoS protection, accidental large uploads) had no protection. (#10795)

Proxy requests now preserve user-supplied Host headers. Previously, the proxy path could overwrite a custom Host. Virtual-host-style routing through a proxy will now behave correctly. (#10822)

Basic auth credentials embedded in URLs are now URL-decoded. If you have percent-encoded credentials in a URL (e.g. https://user:p%40ss@host), the decoded value is what now goes on the wire. (#10825)

parseProtocol now strictly requires a colon in the protocol separator. Strings that loosely parsed as protocols before may no longer match. (#10729)

Deprecated unescape() replaced with modern UTF-8 encoding. Non-ASCII URL handling is now spec-correct; consumers depending on legacy unescape() quirks may see different output bytes. (#7378)

transformRequest input typing change was reverted. The typing change introduced in #10745 w...
Description has been truncated

… updates Bumps the npm_and_yarn group with 18 updates in the / directory: | Package | From | To | | --- | --- | --- | | [file-type](https://github.com/sindresorhus/file-type) | `21.3.0` | `21.3.2` | | [hono](https://github.com/honojs/hono) | `4.11.4` | `4.12.18` | | [tar](https://github.com/isaacs/node-tar) | `7.5.4` | `7.5.11` | | [undici](https://github.com/nodejs/undici) | `7.19.0` | `7.24.0` | | [yaml](https://github.com/eemeli/yaml) | `2.8.2` | `2.8.3` | | [dompurify](https://github.com/cure53/DOMPurify) | `3.3.1` | `3.4.0` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `7.3.1` | `7.3.2` | | [@opentelemetry/sdk-node](https://github.com/open-telemetry/opentelemetry-js) | `0.211.0` | `0.218.0` | | [music-metadata](https://github.com/Borewit/music-metadata) | `11.10.6` | `11.12.3` | | [@protobufjs/utf8](https://github.com/dcodeIO/protobuf.js) | `1.1.0` | `1.1.1` | | [axios](https://github.com/axios/axios) | `1.13.2` | `1.16.1` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `2.0.2` | `4.0.1` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.1.0` | `3.1.2` | | [lodash](https://github.com/lodash/lodash) | `4.17.23` | `4.18.1` | | [path-to-regexp](https://github.com/pillarjs/path-to-regexp) | `0.1.12` | `8.4.2` | | [postcss](https://github.com/postcss/postcss) | `8.5.6` | `8.5.15` | | [sanitize-html](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html) | `2.17.0` | `2.17.4` | | [simple-git](https://github.com/steveukx/git-js/tree/HEAD/simple-git) | `3.30.0` | `3.36.0` | Bumps the npm_and_yarn group with 1 update in the /extensions/diagnostics-otel directory: [@opentelemetry/sdk-node](https://github.com/open-telemetry/opentelemetry-js). Bumps the npm_and_yarn group with 2 updates in the /ui directory: [dompurify](https://github.com/cure53/DOMPurify) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). Updates `file-type` from 21.3.0 to 21.3.2 - [Release notes](https://github.com/sindresorhus/file-type/releases) - [Commits](sindresorhus/file-type@v21.3.0...v21.3.2) Updates `hono` from 4.11.4 to 4.12.18 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.11.4...v4.12.18) Updates `tar` from 7.5.4 to 7.5.11 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v7.5.4...v7.5.11) Updates `undici` from 7.19.0 to 7.24.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.19.0...v7.24.0) Updates `yaml` from 2.8.2 to 2.8.3 - [Release notes](https://github.com/eemeli/yaml/releases) - [Commits](eemeli/yaml@v2.8.2...v2.8.3) Updates `dompurify` from 3.3.1 to 3.4.0 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.3.1...3.4.0) Updates `vite` from 7.3.1 to 7.3.2 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v7.3.2/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v7.3.2/packages/vite) Updates `@opentelemetry/sdk-node` from 0.211.0 to 0.218.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.211.0...experimental/v0.218.0) Updates `music-metadata` from 11.10.6 to 11.12.3 - [Release notes](https://github.com/Borewit/music-metadata/releases) - [Commits](Borewit/music-metadata@v11.10.6...v11.12.3) Updates `@opentelemetry/exporter-prometheus` from 0.211.0 to 0.218.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.211.0...experimental/v0.218.0) Updates `@protobufjs/utf8` from 1.1.0 to 1.1.1 - [Release notes](https://github.com/dcodeIO/protobuf.js/releases) - [Changelog](https://github.com/protobufjs/protobuf.js/blob/master/CHANGELOG.md) - [Commits](protobufjs/protobuf.js@protobufjs-cli-v1.1.0...fetch-v1.1.1) Updates `axios` from 1.13.2 to 1.16.1 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.13.2...v1.16.1) Updates `brace-expansion` from 2.0.2 to 4.0.1 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v2.0.2...v4.0.1) Updates `fast-uri` from 3.1.0 to 3.1.2 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.0...v3.1.2) Updates `follow-redirects` from 1.15.11 to 1.16.0 - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.15.11...v1.16.0) Updates `lodash` from 4.17.23 to 4.18.1 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.23...4.18.1) Updates `path-to-regexp` from 0.1.12 to 8.4.2 - [Release notes](https://github.com/pillarjs/path-to-regexp/releases) - [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md) - [Commits](pillarjs/path-to-regexp@v0.1.12...v8.4.2) Updates `picomatch` from 2.3.1 to 2.3.2 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@2.3.1...2.3.2) Updates `postcss` from 8.5.6 to 8.5.15 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.6...8.5.15) Updates `protobufjs` from 6.8.8 to 7.5.4 - [Release notes](https://github.com/protobufjs/protobuf.js/releases) - [Changelog](https://github.com/protobufjs/protobuf.js/blob/master/CHANGELOG.md) - [Commits](protobufjs/protobuf.js@6.8.8...protobufjs-v7.5.4) Updates `sanitize-html` from 2.17.0 to 2.17.4 - [Changelog](https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md) - [Commits](https://github.com/apostrophecms/apostrophe/commits/HEAD/packages/sanitize-html) Updates `simple-git` from 3.30.0 to 3.36.0 - [Release notes](https://github.com/steveukx/git-js/releases) - [Changelog](https://github.com/steveukx/git-js/blob/main/simple-git/CHANGELOG.md) - [Commits](https://github.com/steveukx/git-js/commits/simple-git@3.36.0/simple-git) Updates `@opentelemetry/sdk-node` from 0.211.0 to 0.218.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.211.0...experimental/v0.218.0) Updates `dompurify` from 3.3.1 to 3.4.0 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.3.1...3.4.0) Updates `vite` from 7.3.1 to 7.3.2 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v7.3.2/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v7.3.2/packages/vite) --- updated-dependencies: - dependency-name: file-type dependency-version: 21.3.2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.12.18 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: tar dependency-version: 7.5.11 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 7.24.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: yaml dependency-version: 2.8.3 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: dompurify dependency-version: 3.4.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 7.3.2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@opentelemetry/sdk-node" dependency-version: 0.218.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: music-metadata dependency-version: 11.12.3 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@opentelemetry/exporter-prometheus" dependency-version: 0.218.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@protobufjs/utf8" dependency-version: 1.1.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: axios dependency-version: 1.16.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 4.0.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: follow-redirects dependency-version: 1.16.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.18.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: path-to-regexp dependency-version: 8.4.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 2.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.15 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: protobufjs dependency-version: 7.5.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: sanitize-html dependency-version: 2.17.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: simple-git dependency-version: 3.36.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@opentelemetry/sdk-node" dependency-version: 0.218.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: dompurify dependency-version: 3.4.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 7.3.2 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

socket-security · 2026-05-19T17:27:39Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability	Quality	Maintenance
npm/undici@7.24.0
npm/music-metadata@11.12.3
npm/file-type@21.3.2
npm/dompurify@3.4.0
npm/yaml@2.8.3
npm/tar@7.5.4 ⏵ 7.5.11	⁺²	⁺⁴⁰		⁺⁴³
npm/hono@4.11.4 ⏵ 4.12.18	⁺¹	⁺⁵⁰	⁺¹
npm/@opentelemetry/sdk-node@0.211.0 ⏵ 0.218.0		⁺¹⁶	⁺¹

View full report

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 19, 2026

dependabot Bot mentioned this pull request May 19, 2026

chore(deps): bump the npm_and_yarn group across 2 directories with 20 updates #4

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump the npm_and_yarn group across 3 directories with 22 updates#5

chore(deps): bump the npm_and_yarn group across 3 directories with 22 updates#5
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-e73c44f092

dependabot Bot commented on behalf of github May 19, 2026

Uh oh!

socket-security Bot commented May 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github May 19, 2026

v21.3.2

v21.3.1

v4.12.18

Security fixes

Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage

CSS Declaration Injection via Style Object Values in JSX SSR

Improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()

v4.12.17

What's Changed

New Contributors

v4.12.16

Security fixes

Unvalidated JSX Tag Names in hono/jsx May Allow HTML Injection

bodyLimit() can be bypassed for chunked / unknown-length requests

v4.12.15

What's Changed

v7.24.0

Undici v7.24.0 Security Release Notes

Upgrade guidance

Fixed advisories

Affected and patched ranges

References

v7.23.0

What's Changed

v2.8.3

DOMPurify 3.4.0

DOMPurify 3.3.3

DOMPurify 3.3.2

v7.3.2

7.3.2 (2026-04-06)

Bug Fixes

experimental/v0.218.0

0.218.0

🚀 Features

🏠 Internal

experimental/v0.217.0

0.217.0

🚀 Features

🐛 Bug Fixes

experimental/v0.216.0

0.216.0

🚀 Features

🐛 Bug Fixes

v11.12.3

Changes

🐛 Bug Fixes

📦 NPM release

v11.12.2

Changes

🐛 Bug Fixes

⬆️ Dependencies

📦 NPM release

v11.12.1

Changes

🐛 Bug Fixes

📦 NPM release

v11.12.0

Changes

🚀 Enhancements

📦 NPM release

v11.11.2

Changes

experimental/v0.218.0

0.218.0

🚀 Features

🏠 Internal

experimental/v0.217.0

0.217.0

🚀 Features

🐛 Bug Fixes

experimental/v0.216.0

0.216.0

🚀 Features

🐛 Bug Fixes

protobufjs-cli: v1.1.1

1.1.1 (2023-02-02)

Bug Fixes