chore(deps): bump the npm_and_yarn group across 1 directory with 11 updates

[dependabot]

Bumps the npm_and_yarn group with 4 updates in the / directory: @nuxt/ui, dompurify, nuxt and nuxt-og-image.

Updates @nuxt/ui from 4.7.0 to 4.8.0

Release notes

Sourced from @​nuxt/ui's releases.

v4.8.0

✨ Highlights

🎨 Theme component prop defaults

The Theme component can now override default prop values for all descendant components. Pass a props object where keys are component names and values are their prop overrides:

\<template>
  <UTheme
    :props="{
      tooltip: { delayDuration: 0, arrow: true },
      button: { color: 'neutral', variant: 'subtle', size: 'lg' },
      input: { size: 'lg' }
    }"
  >
    <UTooltip text="Tooltip">
      <UButton label="Save" />
    </UTooltip>
&lt;UInput placeholder=&quot;Search...&quot; /&gt;

</UTheme>
</template>

Explicit props on a component always take priority. Theme components can be nested (innermost wins) and propagate through the entire tree via provide / inject.

🔍 ContentSearch async search

The ContentSearch component now supports FTS5 full-text search via the new search prop and the useSearchCollection composable (nuxt/content#3787, released in @nuxt/content v3.14.0). Instead of loading all content upfront with files and filtering client-side with Fuse.js, you can now run async queries with highlighted snippets:

<script setup lang="ts">
const { search, status, init } = useSearchCollection('content', {
  immediate: false,
  ignoredTags: ['style']
})
const { open } = useContentSearch()
watch(open, (value) => {
if (value && status.value === 'idle') {
init()
}
})
</script>
&lt;template>
<UContentSearch :search="search" :search-status="status" />
</template>
</tr></table>

... (truncated)

Changelog

Sourced from @​nuxt/ui's changelog.

4.8.0 (2026-05-21)

⚠ BREAKING CHANGES

• InputMenu: rename autocomplete prop to mode to free up HTML attribute (#6474)

Features

• Avatar/AvatarGroup: add color prop (#6405) (6f2396f)
• Breadcrumb: add color prop (#6406) (955dac1)
• ChatMessage: add body slot and improve actions alignment (#6460) (48685b6)
• ChatMessage: add color prop and header slot (#6407) (c6ce8ca)
• ChatPrompt: add submitOnEnter prop to control Enter behavior (b597f90), closes #6177
• Checkbox/RadioGroup/Switch: add highlight prop for error ring styling (a0deee4)
• CommandPalette: search and highlight description field (524c34d)
• ContentSearch/DashboardSearch: enable Fuse.js token search by default (ba08220)
• ContentSearch: add async search support via useSearchCollection (#6432) (a1bef8b)
• DashboardGroup: add storageOptions prop (8f0101b), closes #6170
• Error: add icon prop and leading slot (e6ea707), closes #6119
• Separator: add position prop (#6415) (844660a)
• Theme: override component prop defaults (#6031) (71c008e)

Bug Fixes

• ChatMessage: add wrap-break-word to content slot (#6476) (eb468e6)
• CommandPalette: only split tokens in highlight when useTokenSearch is enabled (898fbce)
• CommandPalette: preserve relative order of ignoreFilter groups (e4c1787)
• CommandPalette: re-highlight first item after debounced results render (efd7b8e)
• CommandPalette: update default fuse keys in docs and search components (0d9cc0d)
• components: apply theme.prefix to hardcoded utility classes (f51b1e8)
• components: constrain popper content to available viewport height (007b136), closes #6449
• ContentSearch: preserve intermediate ancestors in breadcrumb prefix (#6466) (f639b19)
• ContentToc: apply ui.trigger prop to trigger elements (252b906), closes #6428
• defineShortcuts: use e.code for alt shortcuts to handle macOS key remapping (231f156), closes #6444
• FileUpload: pass disabled attribute to button variant (2890c83), closes #6420
• Form: improve errors type (#6208) (c1090ab)
• InputMenu/Select/SelectMenu: respect trailing: false over default trailingIcon (#6457) (65b47ce)
• InputMenu: rename autocomplete prop to mode to free up HTML attribute (#6474) (2799fa6)
• module: don't require @nuxtjs/mdc when using content option (89f7778)
• module: pass computed ref directly to useHead innerHTML (00b7476)
• module: ship stripped [#build](https://github.com/nuxt/ui/issues/build)/ui.css fallback for tooling (083c2a9), closes #5504
• ProseKbd: add default slot and make value optional (f317c7f)
• Textarea: autoresize on mount with pre-filled value (e96a0b6), closes #5962
• useComponentProps: treat array-typed theme values as ClassValue leaves (cac3860)

4.7.1 (2026-04-28)

Bug Fixes

• ChatMessage: make actions slot accessible on touch devices (f5a3349)

... (truncated)

Commits

• 24b23fd chore(release): v4.8.0
• eb468e6 fix(ChatMessage): add wrap-break-word to content slot (#6476)
• 48685b6 feat(ChatMessage): add body slot and improve actions alignment (#6460)
• fd24978 chore(repl): expose @nuxt/ui/composables subpath
• 2799fa6 fix(InputMenu)!: rename autocomplete prop to mode to free up HTML attribu...
• 9ea1b21 chore(deps): update pnpm to v11 (#6471)
• b0461e7 docs: preserve component-code implementation details in raw markdown (#6472)
• 527b438 chore(deps): update vite (#6263)
• 3736eee chore(deps): update nuxt framework to ^4.4.6 (#6408)
• 0523359 chore(deps): update all non-major dependencies (#6468)
• Additional commits viewable in compare view

Updates dompurify from 3.4.1 to 3.4.11

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.11

• Fixed an issue with a leaky config for hooks via setConfig, thanks @​trace37labs
• Bumped vulnerable development dependencies to arrive at plain 0 with npm audit
• Updated the osv-scanner suppression list as no vulnerable dependencies are left for now
• Updated up the linting tool-chain and removed now-redundant lint directives
• Updated the documentation is several spots, README, wiki, etc.
• Bumped several dependencies where possible

DOMPurify 3.4.10

• Refactored codebase for clarity: extracted the public type declarations into types.ts
• Decomposed the three largest sanitizer functions into focused helpers
• Removed duplicated defaults and dead branches, consolidated SAFE_FOR_TEMPLATES scrubbing into single shared path
• Improved per-node performance by hoisting the mXSS probe regexes and testing textContent before innerHTML
• Added a deterministic micro-benchmark harness (npm run bench) with a --compare mode
• Reduced CI cost by running the full three-engine browser suite once per PR
• Refreshed the demos/ folder so every demo runs again, and added a SVG-via-<img> demo
• Documented the bench and test:happydom scripts in the README
• Completed the Attack Classes & Bypass History wiki page
• Bumped several dependencies where possible

DOMPurify 3.4.9

• Further improved the handling of Trusted Types config options, thanks @​offset
• Further improved the handling of IN_PLACE sanitization, thanks @​mozfreddyb
• Added more test coverage for IN_PLACE and Trusted Types related usage
• Bumped several dependencies where possible
• Updated README and wiki with more accurate documentation & attack samples

DOMPurify 3.4.8

• Cleaned up the repository root, renamed some and removed unneeded files
• Fixed an issue with handling of Trusted Types policies, thanks @​fulstadev
• Fixed the node iterator for better template scrubbing, thanks @​IamLeandrooooo
• Included formerly missing LICENSE-MPL in published npm package, thanks @​asamuzaK
• Bumped several dependencies where possible

DOMPurify 3.4.7

• Hardened the handling of Shadow Roots when using IN_PLACE, thanks @​GameZoneHacker
• Removed a problem leading to permanent hook pollution, thanks @​offset
• Refactored the test suite and expanded test coverage significantly

DOMPurify 3.4.6

• Fixed several issues with DOM Clobbering in IN_PLACE mode, thanks @​offset & @​Bankde
• Hardened the checks for cross-realm IN_PLACE and Shadow DOM sanitization, thanks @​offset & @​Bankde
• Added more test coverage for IN_PLACE and general DOM Clobbering attacks
• Bumped several dependencies where possible

DOMPurify 3.4.5

• Fixed a bypass caused by the new HTML element selectedcontent added in 3.4.4, thanks @​KabirAcharya

Note that this is a security release for an issue introduced in 3.4.4 and should be upgraded to immediately.

... (truncated)

Commits

• 0cae518 release: 3.4.11 (#1494)
• 6ee5716 release: 3.4.10 (#1478)
• 5210247 release: 3.4.9 (#1459)
• bcdd828 release: 3.4.8 (#1439)
• ca30f07 release: 3.4.7 (#1414)
• bb7739e release: 3.4.6 (#1394)
• 011b0c7 release: 3.4.5 (#1382)
• 5817ad9 release: 3.4.4 (#1374)
• 520edb0 release: 3.4.3 (#1352)
• 6f67fd3 Sync/3.4.2 (#1322)
• See full diff in compare view

Updates nuxt from 4.4.2 to 4.4.7

Release notes

Sourced from nuxt's releases.

v4.4.7

4.4.7 is a security hotfix release.

👉 make sure to check https://github.com/nuxt/nuxt/security/advisories to view open advisories resolved by this release.

👉 Changelog

compare changes

🩹 Fixes

• nitro: Assign noSSR before deciding payload extraction (#35108)
• vite: Avoid filtering out dirs with shared prefix from allowDirs (#35112)
• nuxt: Use resolve from pathe for buildCache path boundary check (#35111)
• nuxt: Prevent sibling-directory traversal in test component wrapper (#35110)
• nitro: Pass event data to isValid in dev clipboard-copy listener (#35109)
• nuxt: Validate protocols in reloadNuxtApp path before reload (#35115)
• vite: Prefix public asset virtuals with null byte (9e303b438)
• nuxt: Re-run getCachedData after initial fetch (#35122)
• nuxt: Propagate useFetch/useAsyncData factory types (#35133)
• vite: Close vite dev server on nuxt close (a10a68abc)
• kit,nuxt: Handle cancelling prompts to install packages (e84813229)
• kit: Avoid excluding node-context files in legacy tsconfig (#35152)
• nuxt: Handle missing payload in chunkError listener (#35155)
• nuxt: Await in-lifght template generation when closing nuxt (#35181)
• nuxt: Clarify page and layout usage warnings (#35184)
• webpack: Surface compilation errors when stats.toString is empty (073b07851)
• nuxt: Reject prototype-chain keys in the island registry (#35205)
• nuxt: Apply isScriptProtocol guard to navigateTo open option (#35206)
• nuxt: Prevent server-only page island from recursing via <NuxtPage> (#35198)
• rspack,webpack: Require loopback host when missing same-origin signals (#35200)
• nitro: Gate chrome devtools workspace endpoint to local requests (#35201)
• nuxt: Escape props in <NuxtClientFallback> ssr output (#35199)
• kit: Improve TS extension stripping/substitutions (#35233)
• nuxt: Preserve .d.mts/.d.cts in resolveTypePaths (#35235)
• nuxt: Escape <NoScript> slot content (4b054e9d9)
• nuxt: Match route rules case-insensitively to mirror vue-router (07e39cd6f)
• nuxt: Reject script-capable protocols in <NuxtLink> href (0103ce06f)
• nuxt: Block path-normalization open redirect in navigateTo (2cce6fb02)
• nuxt: Reject cross-origin paths in reloadNuxtApp (e447a793c)
• vite: Bind vite-node IPC to a permissioned filesystem socket (1f9f4767a)

💅 Refactors

• kit,nuxt,vite: Use es2023 array methods (#34980)
• nuxt: Replace runInNewContext with AST walker (d72a89ef4)

📖 Documentation

• Document vite client and server options (#35090)
• Add dedicated module dependencies page (#35171)
• Add nodeTsConfig and sharedTsConfig options (#35231)
• Edit for clarity and grammar (#35214)

🏡 Chore

• Use execFileSync for safety in release scripts (1d7baaf01)
• Assert there is always a tag (e98c47c3c)

... (truncated)

Commits

• b7d5790 v4.4.7
• dbc5896 chore: lint
• e447a79 fix(nuxt): reject cross-origin paths in reloadNuxtApp
• d72a89e refactor(nuxt): replace runInNewContext with AST walker
• 2cce6fb fix(nuxt): block path-normalization open redirect in navigateTo
• 0103ce0 fix(nuxt): reject script-capable protocols in \<NuxtLink> href
• 07e39cd fix(nuxt): match route rules case-insensitively to mirror vue-router
• 4b054e9 fix(nuxt): escape \<NoScript> slot content
• 03d83bf fix(nuxt): preserve .d.mts/.d.cts in resolveTypePaths (#35235)
• 46960b2 fix(nuxt): escape props in \<NuxtClientFallback> ssr output (#35199)
• Additional commits viewable in compare view

Updates nuxt-og-image from 5.1.13 to 6.4.9

Release notes

Sourced from nuxt-og-image's releases.

v6.4.9

   🐞 Bug Fixes

• Runtime secret override via NUXT_OG_IMAGE_SECRET  -  by @​harlan-zw in nuxt-modules/og-image#593 (611af)
• Harden takumi WASM lock and expand Server-Timing instrumentation  -  by @​harlan-zw in nuxt-modules/og-image#592 (94fb6)
• security: Harden SSRF guard with redirect validation and IPv6 coverage  -  by @​harlan-zw in nuxt-modules/og-image#594 (79db6)

    View changes on GitHub

v6.4.8

   🐞 Bug Fixes

• takumi: Restore non-latin glyph support regressed in v6.2.0  -  by @​harlan-zw in nuxt-modules/og-image#587 (0b5e6)

    View changes on GitHub

v6.4.7

   🐞 Bug Fixes

• takumi: Dedupe variable fonts so weights vary correctly  -  by @​harlan-zw in nuxt-modules/og-image#585 (be325)

    View changes on GitHub

v6.4.6

   🐞 Bug Fixes

• IMessage Preview displaying multiple images  -  by @​captnCC and johanneskees in nuxt-modules/og-image#584 (55336)

    View changes on GitHub

v6.4.5

   🐞 Bug Fixes

• takumi: Serialize WASM calls  -  by @​harlan-zw in nuxt-modules/og-image#583 (7e935)

    View changes on GitHub

v6.4.4

   🐞 Bug Fixes

• devtools: Safe broadcasting  -  by @​harlan-zw (0fbb5)

    View changes on GitHub

v6.4.3

   🐞 Bug Fixes

• Dispose prior og:image head entry on client navigation  -  by @​harlan-zw (d709e)
• Add image fetch timeouts and Server-Timing instrumentation  -  by @​harlan-zw in nuxt-modules/og-image#581 (6ae9a)

... (truncated)

Changelog

Sourced from nuxt-og-image's changelog.

Changelog

v6.7.2...main

compare changes

🩹 Fixes

• Takumi v2 stable (e9c55d28)
• Source island hash from Nuxt (#641)

📖 Documentation

• Content audit sweep (grammar, links, structure) (#640)

🏡 Chore

• Bump (2e25076b)
• Sync pnpm lockfile (085d4dfc)
• Bump deps (2c311a2a)
• Bump deps (bd24d920)
• Ts issue (69ae0368)

❤️ Contributors

• Harlan Wilton (@​harlan-zw)

v6.7.0...main

compare changes

🩹 Fixes

• Support takumi v2 rc (d74273de)

🏡 Chore

• Bump deps (fe267f40)

❤️ Contributors

• Harlan Wilton (@​harlan-zw)

v6.6.0...main

compare changes

🚀 Enhancements

... (truncated)

Commits

• d10ece5 chore: release v6.4.9
• 94fb65d fix: harden takumi WASM lock and expand Server-Timing instrumentation (#592)
• 79db60f fix(security): harden SSRF guard with redirect validation and IPv6 coverage (...
• 611af82 fix: runtime secret override via NUXT_OG_IMAGE_SECRET (#593)
• 9a4ca09 chore: broken test
• 294e39d chore: CI
• 8a0be5b chore: CI
• 0fa3bad chore: bump
• dabcfa8 test: bump e2e hook timeout to 240s (#590)
• c67c2d4 chore: add hookable types explicitly (#588)
• Additional commits viewable in compare view

Updates devalue from 5.7.1 to 5.8.2

Release notes

Sourced from devalue's releases.

v5.8.2

Patch Changes

• 48cc81f: fix: serialize DataView subviews with the correct byte offset and length
• cd6da94: fix: resolve circular references through custom revivers when payload is already hydrated
• 29a3382: fix: uneval now produces valid output for a repeated empty Map or Set
• 8c0db06: fix: serialize Temporal values referenced more than once in uneval
• 3770846: fix: emit valid JS for BigInt64Array and BigUint64Array in uneval
• 756265a: fix: preserve shared-reference identity for Map keys in uneval
• faa8a05: fix: emit uneval reconstructions before the statements that reference them
• 06129ad: fix: do not grow sparse arrays by one slot in uneval

v5.8.1

Patch Changes

• 206ca67: fix: force sparse arrays to allocate sparsely

v5.8.0

Minor Changes

• c5115b0: feat: add stringifyAsync for async serialization

Changelog

Sourced from devalue's changelog.

5.8.2

Patch Changes

• 48cc81f: fix: serialize DataView subviews with the correct byte offset and length
• cd6da94: fix: resolve circular references through custom revivers when payload is already hydrated
• 29a3382: fix: uneval now produces valid output for a repeated empty Map or Set
• 8c0db06: fix: serialize Temporal values referenced more than once in uneval
• 3770846: fix: emit valid JS for BigInt64Array and BigUint64Array in uneval
• 756265a: fix: preserve shared-reference identity for Map keys in uneval
• faa8a05: fix: emit uneval reconstructions before the statements that reference them
• 06129ad: fix: do not grow sparse arrays by one slot in uneval

5.8.1

Patch Changes

• 206ca67: fix: force sparse arrays to allocate sparsely

5.8.0

Minor Changes

• c5115b0: feat: add stringifyAsync for async serialization

Commits

• d4e10da Version Packages (#167)
• faa8a05 fix: uneval loses a repeated typed array/DataView referenced inside a cycle (...
• 3770846 fix: emit valid JS for BigInt64Array and BigUint64Array in uneval (#171)
• b9ed985 chore(ci): set permissions on ci workflow (#157)
• cd6da94 fix: resolve circular references through custom revivers (#154)
• 06129ad fix: uneval grows sparse arrays by one slot when first hole is past index 0 (...
• 756265a fix: preserve shared-reference identity for Map keys in uneval (#164)
• 8c0db06 fix: serialize Temporal values referenced more than once in uneval (#165)
• 29a3382 fix: uneval emits valid JS for repeated empty Map/Set (#168)
• 48cc81f fix: serialize DataView subviews with correct byte offset and length (#166)
• Additional commits viewable in compare view

Updates launch-editor from 2.13.2 to 2.14.1

Commits

• 3f97c64 v2.14.1
• 0cc9550 fix: reject UNC paths (#138)
• afd1ab9 ci: run tests on mac and windows (#136)
• 0bfa328 test: add some tests for launch-editor package (#135)
• 1b006ae chore: add README (#134)
• 383ef26 v2.14.0
• 6277209 ci: harden publish settings
• 520b2f7 fix(deps): update all non-major dependencies (#129)
• 475ac66 chore(deps): update dependency lint-staged to v17 (#130)
• 247bf1d chore(deps): update dependency yorkie to v2 (#131)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for launch-editor since your current version.

Updates nitropack from 2.13.3 to 2.13.4

Release notes

Sourced from nitropack's releases.

v2.13.4

compare changes

[!IMPORTANT] This release patches two medium-severity vulnerabilities in proxy and redirect route rules. Users relying on either are strongly encouraged to upgrade. See GHSA-5w89-w975-hf9q and GHSA-9phm-9p8f-hw5m for details.

🚀 Enhancements

• Add version meta (#4194)

🩹 Fixes

• route-rules: Reject out-of-scope requests (#4223)
• route-rules: Prevent open redirect via protocol-relative url bypass (8d6bfb0b)

🏡 Chore

❤️ Contributors

• Pooya Parsa (@​pi0)
• Rihan Arfan (@​RihanArfan)

Commits

• f92e684 chore: apply automated updates
• 112e215 chore: basic dist-diff script
• 932f628 chore: ignore vite7 from pnpm outdated
• 705069f chore: update deps
• bc1dd9d fix(route-rules): prevent open redirect via protocol-relative url bypass (#4236)
• 6edbf84 chore(deps): update all non-major dependencies (#4227)
• feebdc1 refactor: use built-in escapeRegExp util (#4109)
• f8cf6cc feat(tracing): enable tracing channels for unstorage (#4226)
• 0bbbb79 docs: improve jsdocs (#4199)
• d0d8d91 types(vite): make experimental.vite optional (#4225)
• Additional commits viewable in compare view

Updates shell-quote from 1.8.3 to 1.10.0

Changelog

Sourced from shell-quote's changelog.

v1.10.0 - 2026-07-10

Merged

• [New] parse: add opt-in splitUnquoted option for shell field-splitting of unquoted expansions [#1](https://github.com/ljharb/shell-quote/issues/1)

Commits

• [Fix] parse: match nested ${...} braces so nested parameter expansion is consumed as one substitution c0842c8
• [Tests] parse: pin single-quote literalness and unmatched-quote handling a0d03e3
• [readme] remove the space in js code fences so evalmd evaluates them 2116fa3
• [Tests] quote: pin conservative escaping of =, @, ^, ,, :, ! (#11) 1c36f3f
• [readme] document that quote outputs POSIX quoting, not cmd.exe/PowerShell 100e96e
• [readme] document parse's supported parameter-expansion subset e1c75cd
• [Fix] parse: a backslash inside single quotes must not escape the closing quote 5d460a3
• [readme] fix stale example outputs 2de86f5
• [Tests] quote: pin that a backslash with whitespace is not doubled in single quotes (#14) 190e236
• [readme] quote: use output verbatim; do not re-quote it (#11) 1b36468
• [Refactor] parse: fix swapped SINGLE_QUOTE/DOUBLE_QUOTE variable names 801af5c
• [types] fix an error TS v6 ignores but v7 fails on 59bbf8b
• [Dev Deps] update @arethetypeswrong/cli, evalmd a04d475
• [Dev Deps] update @arethetypeswrong/ci, eslint d390f9a
• [Tests] quote: the tilde test escapes every ~, not just a leading one (#9) 617d119

v1.9.0 - 2026-06-24

Commits

• [New] add types dca6e21
• [Dev Deps] update eslint 9aa9e8f
• [Fix] parse: finalize tokens in linear time (GHSA-395f-4hp3-45gv) 7ff5488
• [actions] update workflows 75e8497
• [actions] Windows + node 4/6/7: pin eslint to 9 before install, since npm 2/3 cannot stage eslint 10@types/esrecurse 3fb739d
• [actions] retry npm install on Windows to survive npm 2/3 staging-rename flake abe0163
• [actions] Windows + node 5/7: install deps with a modern node b4bafa2
• [Fix] quote: escape leading ~ to prevent shell tilde-expansion 7a76c1a
• [Dev Deps] update auto-changelog, tape 7184b44
• [Dev Deps] apparently jackspeak is no longer in the graph 9ba368a

v1.8.4 - 2026-05-22

Commits

• [Fix] quote: validate object-token shapes 4378a6e
• [Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint, npmignore 22ebec0
• [Tests] increase coverage 9f3caa3
• [readme] replace runkit CI badge with shields.io check-runs badge 3344a04
• [Dev Deps] update @ljharb/eslint-config 699c511

Commits

• 64988d9 v1.10.0
• 617d119 [Tests] quote: the tilde test escapes every ~, not just a leading one (#9)
• 59bbf8b [types] fix an error TS v6 ignores but v7 fails on
• 190e236 [Tests] quote: pin that a backslash with whitespace is not doubled in singl...
• a04d475 [Dev Deps] update @arethetypeswrong/cli, evalmd
• b9545b3 [New] parse: add opt-in splitUnquoted option for shell field-splitting of...
• 1b36468 [readme] quote: use output verbatim; do not re-quote it (#11)
• 1c36f3f [Tests] quote: pin conservative escaping of =, @, ^, ,, :, ! (#11)
• e1c75cd [readme] document parse's supported parameter-expansion subset
• c0842c8 [Fix] parse: match nested ${...} braces so nested parameter expansion is ...
• Additional commits viewable in compare view

Updates tar from 7.5.13 to 7.5.20

Commits

• ebbb720 7.5.20
• 2f27196 fix: fully disable and dispose of unzip when aborting parser
• be440da 7.5.19
• 2812e93 add maxDecompressionRatio guard against explosive decompression
• 9ecd4d2 7.5.18
• 9e78bf0 refuse to let header size be less than 0
• e02a4e9 pax: parse values according to known types
• 9cbdb31 7.5.17
• 7a635c2 terminate pax strings on nul bytes
• cf21338 7.5.16
• Additional commits viewable in compare view

Updates undici from 7.25.0 to 7.28.0

Release notes

Sourced from undici's releases.

v7.28.0

⚠️ Security Release

This release line addresses 7 security advisories, all shipped in v7.28.0.

Action required: Upgrade to undici 7.28.0 or later.

npm install undici@^7.28.0

The v7 line is not affected by GHSA-38rv-x7px-6hhq (CVE-2026-9675), which is an 8.x-only regression.

Note on GHSA-hm92-r4w5-c3mj: this fix shipped in v7.28.0, not the earlier 7.2x line — the vulnerable single-pool code was still present through v7.27.2. The per-origin pool fix is 3805b8f8 (#5041).

Summary

Advisory	CVE	Severity (CVSS)	Fixed in	Fix commit
GHSA-vxpw-j846-p89q	CVE-2026-12151	High (7.5)	7.28.0	8cb10f98
GHSA-vmh5-mc38-953g	CVE-2026-9697	High (7.4)	7.28.0	04201f89
GHSA-hm92-r4w5-c3mj	CVE-2026-6734	High (7.5)	7.28.0	3805b8f8
GHSA-pr7r-676h-xcf6	CVE-2026-9678	Moderate (5.9)	7.28.0	85a24055
GHSA-p88m-4jfj-68fv	CVE-2026-9679	Moderate (5.9)	7.28.0	d0574cc4
... Description has been truncated

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
nuxt-theme-builder	Error		Jul 21, 2026 4:25am

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 3 package(s) with unknown licenses.
• ⚠️ 3 packages with OpenSSF Scorecard issues.

View full job summary