chore(deps): bump form-data from 4.0.2 to 4.0.4 in /templates/typescript/stagehand in the npm_and_yarn group across 1 directory#50
Conversation
Bumps the npm_and_yarn group with 1 update in the /templates/typescript/stagehand directory: [form-data](https://github.com/form-data/form-data). Updates `form-data` from 4.0.2 to 4.0.4 - [Release notes](https://github.com/form-data/form-data/releases) - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v4.0.2...v4.0.4) --- updated-dependencies: - dependency-name: form-data dependency-version: 4.0.4 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
added
dependencies
![mesa-dot-dev[bot]](https://avatars.githubusercontent.com/in/1050077?s=60&v=4){kind=small}
There was a problem hiding this comment.
What Changed
This PR bumps the form-data dependency from 4.0.2 to 4.0.4 in the package-lock.json for the /templates/typescript/stagehand template. This is an indirect dependency update that brings in fixes for handling nullish values and improves the randomness of form boundaries.
Risks / Concerns
This is a routine patch-level dependency update managed by Dependabot. The changes consist of bug fixes and security improvements, such as using the crypto module for boundary generation. The risk associated with this update is minimal. Nice work keeping dependencies up to date.
1 files reviewed | 0 comments | Review on Mesa | Edit Reviewer Settings
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Bug: Unintended Major Dependency Upgrade
The commit introduces an unmentioned major version update for the @onkernel/sdk dependency, changing it from 0.1.0-alpha.16 to ">=0.8.0" (resolved to 0.8.0). This significant jump from an alpha to a stable version could introduce breaking changes. The PR title and description state that the commit only updates form-data (from 4.0.2 to 4.0.4), indicating this @onkernel/sdk change is likely unintended.
templates/typescript/stagehand/package-lock.json#L9-L380
Was this report helpful? Give feedback by reacting with 👍 or 👎
Bumps the npm_and_yarn group with 1 update in the /templates/typescript/stagehand directory: form-data.
Updates
form-datafrom 4.0.2 to 4.0.4Changelog
Sourced from form-data's changelog.
Commits
41996f5v4.0.4316c82b[meta] actually ensure the readme backup isn’t published2300ca1[meta] fix readme capitalization811f682[meta] addauto-changelog5e34080[Tests] fix linting errors1d11a76[Tests] handle predict-v8-randomness failures in node < 17 and node > 2358c25d7[Dev Deps] update@ljharb/eslint-config3d17230[Fix] Switch to usingcryptorandom for boundary valuesd8d67dcv4.0.3e6e83cc[meta] remove local commit hooksYou can trigger a rebase of this PR by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.
TL;DR
Bumped
form-datafrom 4.0.2 to 4.0.4 in the TypeScript Stagehand template.Why we made these changes
To incorporate bug fixes, such as preventing crashes with nullish values, and improve robustness by using
cryptofor boundary values in theform-datalibrary.What changed?
templates/typescript/stagehand/package-lock.json: Updated to reflect theform-dataversion bump to 4.0.4.Validation