Bump the npm_and_yarn group across 21 directories with 7 updates

[dependabot]

Bumps the npm_and_yarn group with 3 updates in the /example-app-abandoned-checkouts directory: next, ajv and minimatch.
Bumps the npm_and_yarn group with 5 updates in the /example-app-authorize.net directory:

Package	From	To
next	14.2.35	15.5.10
ajv	8.12.0	8.18.0
minimatch	3.1.2	3.1.5
webpack	5.88.2	5.104.1
qs	6.5.3	6.5.5

Bumps the npm_and_yarn group with 4 updates in the /example-app-checkout-prices directory: next, ajv, minimatch and rollup.
Bumps the npm_and_yarn group with 4 updates in the /example-app-crm directory: next, minimatch, qs and rollup.
Bumps the npm_and_yarn group with 4 updates in the /example-app-customer-insights directory: next, ajv, minimatch and rollup.
Bumps the npm_and_yarn group with 3 updates in the /example-app-invoices directory: next, minimatch and rollup.
Bumps the npm_and_yarn group with 4 updates in the /example-app-klarna directory: next, ajv, minimatch and webpack.
Bumps the npm_and_yarn group with 3 updates in the /example-app-sendgrid directory: next, minimatch and rollup.
Bumps the npm_and_yarn group with 4 updates in the /example-app-sequra directory: next, ajv, minimatch and rollup.
Bumps the npm_and_yarn group with 4 updates in the /example-app-shipstation directory: next, ajv, minimatch and rollup.
Bumps the npm_and_yarn group with 4 updates in the /example-app-similar-products-embeddings directory: next, ajv, minimatch and rollup.
Bumps the npm_and_yarn group with 2 updates in the /example-app-slack directory: next and minimatch.
Bumps the npm_and_yarn group with 3 updates in the /example-app-taxjar directory: next, minimatch and rollup.
Bumps the npm_and_yarn group with 3 updates in the /example-auth-nextjs-apollo-urql directory: next, ajv and minimatch.
Bumps the npm_and_yarn group with 3 updates in the /example-auth-nextjs-pages-router-apollo directory: next, ajv and minimatch.
Bumps the npm_and_yarn group with 4 updates in the /example-auth-openidconnect-nextjs-app-router-apollo directory: next, ajv, minimatch and tar.
Bumps the npm_and_yarn group with 4 updates in the /example-auth-openidconnect-nextjs-app-router-urql directory: next, ajv, minimatch and tar.
Bumps the npm_and_yarn group with 4 updates in the /example-auth-openidconnect-nextjs-pages-router-apollo directory: next, ajv, minimatch and tar.
Bumps the npm_and_yarn group with 3 updates in the /example-storefront-nextjs-app-router directory: next, ajv and minimatch.
Bumps the npm_and_yarn group with 3 updates in the /example-storefront-nextjs-klarna directory: next, ajv and minimatch.
Bumps the npm_and_yarn group with 3 updates in the /example-storefront-nextjs-sequra directory: next, ajv and minimatch.

Updates next from 12.3.1 to 15.5.10

Release notes

Sourced from next's releases.

v15.5.10

Please refer the following changelogs for more information about this security release:

• https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472
• https://vercel.com/changelog/summary-of-cve-2026-23864

v15.4.11

Please see this changelog for more information about this security patch.

v15.3.9

Please see this changelog for more information about this security patch.

v15.2.9

Please see this changelog for more information about this security patch.

v15.1.12

Please see this changelog for more information about this security patch.

v15.0.8

Please see this changelog for more information about this security patch.

Commits

• 60a2aa9 v15.5.10
• e5b834d fetch(next/image): reduce maximumResponseBody from 300MB to 50MB (#88588)
• 39a2f6a feat(next/image)!: add images.maximumResponseBody config (#88183)
• bf9f084 Sync DoS mitigations for React Flight
• c5de33e v15.5.9
• dd23399 Backport facebook/react#35351 for 15.5.8 (#87086)
• 7526cd6 v15.5.8
• 1e9ec41 Update React Version (#41)
• 16141e5 Update React Version (#30)
• e01e589 Backport Next.js changes to v15.5.8 (#23)
• Additional commits viewable in compare view

Updates ajv from 6.12.6 to 6.14.0

Commits

• e3af0a7 6.14.0
• b552ed6 add regExp option to address $data exploit via a regular expression (CVE-2025...
• 72f2286 docs: update v7 info
• 231e52b Merge pull request #1320 from philsturgeon/patch-1
• d3475fc Add spectral, an AJV util from a sponsor
• 413afe0 docs: v7.0.0-beta.3
• 11e997b update readme for v7
• See full diff in compare view

Updates minimatch from 3.1.2 to 3.1.5

Commits

• 7bba978 3.1.5
• bd25942 docs: add warning about ReDoS
• 1a9c27c fix partial matching of globstar patterns
• 1a2e084 3.1.4
• ae24656 update lockfile
• b100374 limit recursion for **, improve perf considerably
• 26ffeaa lockfile update
• 9eca892 lock node version to 14
• 00c323b 3.1.3
• 30486b2 update CI matrix and actions
• Additional commits viewable in compare view

Updates next from 14.2.35 to 15.5.10

Release notes

Sourced from next's releases.

v15.5.10

Please refer the following changelogs for more information about this security release:

• https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472
• https://vercel.com/changelog/summary-of-cve-2026-23864

v15.4.11

Please see this changelog for more information about this security patch.

v15.3.9

Please see this changelog for more information about this security patch.

v15.2.9

Please see this changelog for more information about this security patch.

v15.1.12

Please see this changelog for more information about this security patch.

v15.0.8

Please see this changelog for more information about this security patch.

Commits

• 60a2aa9 v15.5.10
• e5b834d fetch(next/image): reduce maximumResponseBody from 300MB to 50MB (#88588)
• 39a2f6a feat(next/image)!: add images.maximumResponseBody config (#88183)
• bf9f084 Sync DoS mitigations for React Flight
• c5de33e v15.5.9
• dd23399 Backport facebook/react#35351 for 15.5.8 (#87086)
• 7526cd6 v15.5.8
• 1e9ec41 Update React Version (#41)
• 16141e5 Update React Version (#30)
• e01e589 Backport Next.js changes to v15.5.8 (#23)
• Additional commits viewable in compare view

Updates ajv from 8.12.0 to 8.18.0

Commits

• e3af0a7 6.14.0
• b552ed6 add regExp option to address $data exploit via a regular expression (CVE-2025...
• 72f2286 docs: update v7 info
• 231e52b Merge pull request #1320 from philsturgeon/patch-1
• d3475fc Add spectral, an AJV util from a sponsor
• 413afe0 docs: v7.0.0-beta.3
• 11e997b update readme for v7
• See full diff in compare view

Updates minimatch from 3.1.2 to 3.1.5

Commits

• 7bba978 3.1.5
• bd25942 docs: add warning about ReDoS
• 1a9c27c fix partial matching of globstar patterns
• 1a2e084 3.1.4
• ae24656 update lockfile
• b100374 limit recursion for **, improve perf considerably
• 26ffeaa lockfile update
• 9eca892 lock node version to 14
• 00c323b 3.1.3
• 30486b2 update CI matrix and actions
• Additional commits viewable in compare view

Updates webpack from 5.88.2 to 5.104.1

Release notes

Sourced from webpack's releases.

v5.104.1

5.104.1

Patch Changes

• 2efd21b: Reexports runtime calculation should not accessing WEBPACK_IMPORT_KEY decl with var.
• c510070: Fixed a user information bypass vulnerability in the HttpUriPlugin plugin.

v5.104.0

5.104.0

Minor Changes

• d3dd841: Use method shorthand to render module content in __webpack_modules__ object.
• d3dd841: Enhance import.meta.env to support object access.
• 4baab4e: Optimize dependency sorting in updateParent: sort each module only once by deferring to finishUpdateParent(), and reduce traversal count in sortWithSourceOrder by caching WeakMap values upfront.
• 04cd530: Handle more at-rules for CSS modules.
• cafae23: Added options to control the renaming of at-rules and various identifiers in CSS modules.
• d3dd841: Added base64url, base62, base58, base52, base49, base36, base32 and base25 digests.
• 5983843: Provide a stable runtime function variable __webpack_global__.
• d3dd841: Improved localIdentName hashing for CSS.

Patch Changes

• 22c48fb: Added module existence check for informative error message in development mode.
• 50689e1: Use the fully qualified class name (or export name) for [fullhash] placeholder in CSS modules.
• d3dd841: Support universal lazy compilation.
• d3dd841: Fixed module library export definitions when multiple runtimes.
• d3dd841: Fixed CSS nesting and CSS custom properties parsing.
• d3dd841: Don't write fragment from URL to filename and apply fragment to module URL.
• aab1da9: Fixed bugs for css/global type.
• d3dd841: Compatibility import.meta.filename and import.meta.dirname with eval devtools.
• d3dd841: Handle nested __webpack_require__.
• 728ddb7: The speed of identifier parsing has been improved.
• 0f8b31b: Improve types.
• d3dd841: Don't corrupt debugId injection when hidden-source-map is used.
• 2179fdb: Re-validate HttpUriPlugin redirects against allowedUris, restrict to http(s) and add a conservative redirect limit to prevent SSRF and untrusted content inclusion. Redirects failing policy are rejected before caching/lockfile writes.
• d3dd841: Serialize HookWebpackError.
• d3dd841: Added ability to use built-in properties in dotenv and define plugin.
• 3c4319f: Optimizing the regular expression character class by specifying ranges for runtime code.
• d3dd841: Reduce collision for local indent name in CSS.
• d3dd841: Remove CSS link tags when CSS imports are removed.

v5.103.0

Features

• Added DotenvPlugin and top level dotenv option to enable this plugin
• Added WebpackManifestPlugin
• Added support the ignoreList option in devtool plugins
• Allow to use custom javascript parse function

... (truncated)

Changelog

Sourced from webpack's changelog.

5.104.1

Patch Changes

• 2efd21b: Reexports runtime calculation should not accessing WEBPACK_IMPORT_KEY decl with var.
• c510070: Fixed a user information bypass vulnerability in the HttpUriPlugin plugin.

5.104.0

Minor Changes

• d3dd841: Use method shorthand to render module content in __webpack_modules__ object.
• d3dd841: Enhance import.meta.env to support object access.
• 4baab4e: Optimize dependency sorting in updateParent: sort each module only once by deferring to finishUpdateParent(), and reduce traversal count in sortWithSourceOrder by caching WeakMap values upfront.
• 04cd530: Handle more at-rules for CSS modules.
• cafae23: Added options to control the renaming of at-rules and various identifiers in CSS modules.
• d3dd841: Added base64url, base62, base58, base52, base49, base36, base32 and base25 digests.
• 5983843: Provide a stable runtime function variable __webpack_global__.
• d3dd841: Improved localIdentName hashing for CSS.

Patch Changes

• 22c48fb: Added module existence check for informative error message in development mode.
• 50689e1: Use the fully qualified class name (or export name) for [fullhash] placeholder in CSS modules.
• d3dd841: Support universal lazy compilation.
• d3dd841: Fixed module library export definitions when multiple runtimes.
• d3dd841: Fixed CSS nesting and CSS custom properties parsing.
• d3dd841: Don't write fragment from URL to filename and apply fragment to module URL.
• aab1da9: Fixed bugs for css/global type.
• d3dd841: Compatibility import.meta.filename and import.meta.dirname with eval devtools.
• d3dd841: Handle nested __webpack_require__.
• 728ddb7: The speed of identifier parsing has been improved.
• 0f8b31b: Improve types.
• d3dd841: Don't corrupt debugId injection when hidden-source-map is used.
• 2179fdb: Re-validate HttpUriPlugin redirects against allowedUris, restrict to http(s) and add a conservative redirect limit to prevent SSRF and untrusted content inclusion. Redirects failing policy are rejected before caching/lockfile writes.
• d3dd841: Serialize HookWebpackError.
• d3dd841: Added ability to use built-in properties in dotenv and define plugin.
• 3c4319f: Optimizing the regular expression character class by specifying ranges for runtime code.
• d3dd841: Reduce collision for local indent name in CSS.
• d3dd841: Remove CSS link tags when CSS imports are removed.

Commits

• 24e3c2d chore(release): new release (#20253)
• 2efd21b fix(re-exports): reexports runtime calculation should not accessing `__WEBPAC...
• c510070 fix(security): userinfo bypass vulnerability in HttpUriPlugin allowedUris
• 4b0501c ci: fix release (#20252)
• 0c213ce ci: use \<@&1450591255485743204> over @here for discord notificationw
• 5bf8bc5 refactor: types for benchmarks and tests
• 505a5e7 chore(release): new release (#20188)
• 0c06680 refactor: update eslint configuration
• 2eb0d6a ci: release announcement (#20238)
• b2b2459 ci: cancel in progress (#20239)
• Additional commits viewable in compare view

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates qs from 6.5.3 to 6.5.5

Changelog

Sourced from qs's changelog.

6.5.5

• [Fix] fix regressions from robustness refactor
• [meta] add npmignore to autogenerate an npmignore file
• [actions] update reusable workflows

6.5.4

• [Robustness] avoid .push, use void
• [readme] clarify parseArrays and arrayLimit documentation (#543)
• [readme] document that addQueryPrefix does not add ? to empty output (#418)
• [readme] replace runkit CI badge with shields.io check-runs badge
• [actions] fix rebase workflow permissions

Commits

• 3a6d9f8 v6.5.5
• 48160e7 [actions] update reusable workflows
• 2fc004a [meta] add npmignore to autogenerate an npmignore file
• ddcc5d5 [Fix] fix regressions from robustness refactor
• c190488 v6.5.4
• 40b77c3 [actions] fix rebase workflow permissions
• 6e39e92 [readme] document that addQueryPrefix does not add ? to empty output
• 4e393de [readme] replace runkit CI badge with shields.io check-runs badge
• dbb0346 [readme] clarify parseArrays and arrayLimit documentation
• 6b8b4d8 [Robustness] avoid .push, use void
• See full diff in compare view

Updates next from 14.2.35 to 15.5.10

Release notes

Sourced from next's releases.

v15.5.10

Please refer the following changelogs for more information about this security release:

• https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472
• https://vercel.com/changelog/summary-of-cve-2026-23864

v15.4.11

Please see this changelog for more information about this security patch.

v15.3.9

Please see this changelog for more information about this security patch.

v15.2.9

Please see this changelog for more information about this security patch.

v15.1.12

Please see this changelog for more information about this security patch.

v15.0.8

Please see this changelog for more information about this security patch.

Commits

• 60a2aa9 v15.5.10
• e5b834d fetch(next/image): reduce maximumResponseBody from 300MB to 50MB (#88588)
• 39a2f6a feat(next/image)!: add images.maximumResponseBody config (#88183)
• bf9f084 Sync DoS mitigations for React Flight
• c5de33e v15.5.9
• dd23399 Backport facebook/react#35351 for 15.5.8 (#87086)
• 7526cd6 v15.5.8
• 1e9ec41 Update React Version (#41)
• 16141e5 Update React Version (#30)
• e01e589 Backport Next.js changes to v15.5.8 (#23)
• Additional commits viewable in compare view

Updates ajv from 6.12.6 to 6.14.0

Commits

• e3af0a7 6.14.0
• b552ed6 add regExp option to address $data exploit via a regular expression (CVE-2025...
• 72f2286 docs: update v7 info
• 231e52b Merge pull request #1320 from philsturgeon/patch-1
• d3475fc Add spectral, an AJV util from a sponsor
• 413afe0 docs: v7.0.0-beta.3
• 11e997b update readme for v7
• See full diff in compare view

Updates minimatch from 3.1.2 to 3.1.5

Commits

• 7bba978 3.1.5
• bd25942 docs: add warning about ReDoS
• 1a9c27c fix partial matching of globstar patterns
• 1a2e084 3.1.4
• ae24656 update lockfile
• b100374 limit recursion for **, improve perf considerably
• 26ffeaa lockfile update
• 9eca892 lock node version to 14
• 00c323b 3.1.3
• 30486b2 update CI matrix and actions
• Additional commits viewable in compare view

Updates rollup from 3.29.5 to 3.30.0

Release notes

Sourced from rollup's releases.

v3.30.0

3.30.0

2026-02-22

Features

• Throw when the generated bundle contains paths that would leave the output directory (#6276)

Pull Requests

• #6276: Validate bundle stays within output dir (@​lukastaegert)

Changelog

Sourced from rollup's changelog.

3.30.0

2026-02-22

Features

• Throw when the generated bundle contains paths that would leave the output directory (#6276)

Pull Requests

• #6276: Validate bundle stays within output dir (@​lukastaegert)

Commits

• d91d5e1 3.30.0
• 9677409 Update release script for backports
• c8cf1f9 Validate bundle stays within output dir (#6276)
• See full diff in compare view

Updates next from 14.2.35 to 15.5.10

Release notes

Sourced from next's releases.

v15.5.10

Please refer the following changelogs for more information about this security release:

• https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472
• https://vercel.com/changelog/summary-of-cve-2026-23864

v15.4.11

Please see this changelog for more information about this security patch.

v15.3.9

Please see this changelog for more information about this security patch.

v15.2.9

Please see this changelog for more information about this security patch.

v15.1.12

Please see this changelog for more information about this security patch.

v15.0.8

Please see this changelog for more information about this security patch.

Commits

• 60a2aa9 v15.5.10
• e5b834d fetch(next/image): reduce maximumResponseBody from 300MB to 50MB (#88588)
• 39a2f6a feat(next/image)!: add images.maximumResponseBody config (#88183)
• bf9f084 Sync DoS mitigations for React Flight
• c5de33e v15.5.9
• dd23399 Backport facebook/react#35351 for 15.5.8 (#87086)
• 7526cd6 v15.5.8
• 1e9ec41 Update React Version (#41)
• 16141e5 Update React Version (#30)
• e01e589 Backport Next.js changes to v15.5.8 (#23)
• Additional commits viewable in compare view

Updates minimatch from 3.1.2 to 3.1.5

Commits

• 7bba978 3.1.5
• bd25942 docs: add warning about ReDoS
• 1a9c27c fix partial matching of globstar patterns
• 1a2e084 3.1.4
• ae24656 update lockfile
• b100374 limit recursion for **, improve perf considerably
• 26ffeaa lockfile update
• 9eca892 lock node version to 14
• 00c323b 3.1.3
• 30486b2 update CI matrix and actions
• Additional commits viewable in compare view

Updates qs from 6.12.3 to 6.15.0

Changelog

Sourced from qs's changelog.

6.5.5

• [Fix] fix regressions from robustness refactor
• [meta] add npmignore to autogenerate an npmignore file
• [actions] update reusable workflows

6.5.4

• [Robustness] avoid .push, use void
• [readme] clarify parseArrays and arrayLimit documentation (#543)
• [readme] document that addQueryPrefix does not add ? to empty output (#418)
• [readme] replace runkit CI badge with shields.io check-runs badge
• [actions] fix rebase workflow permissions

Commits

• 3a6d9f8 v6.5.5
• 48160e7 [actions] update reusable workflows
• 2fc004a [meta] add npmignore to autogenerate an npmignore file
• ddcc5d5 [Fix] fix regressions from robustness refactor
• c190488 v6.5.4
• 40b77c3 [actions] fix rebase workflow permissions
• 6e39e92 [readme] document that addQueryPrefix does not add ? to empty output
• 4e393de [readme] replace runkit CI badge with shields.io check-runs badge
• dbb0346 [readme] clarify parseArrays and arrayLimit documentation
• 6b8b4d8 [Robustness] avoid .push, use void
• See full diff in compare view

Updates rollup from 4.19.2 to 4.59.0

Release notes

Sourced from rollup's releases.

v3.30.0

3.30.0

2026-02-22

Features

• Throw when the generated bundle contains paths that would leave the output directory (#6276)

Pull Requests

• #6276: Validate bundle stays within output dir (@​lukastaegert)

Changelog

Sourced from rollup's changelog.

3.30.0

2026-02-22

Features

• Throw when the generated bundle contains paths that would leave the output directory (#6276)

Pull Requests

• #6276: Validate bundle stays within output dir (@​lukastaegert)

Commits

• d91d5e1 3.30.0
• 9677409 Update release script for backports
• c8cf1f9 Validate bundle stays within output dir (#6276)
• See full diff in compare view

Updates next from 14.2.35 to 15.5.10

Release notes

Sourced from next's releases.

v15.5.10

Please refer the following changelogs for more information about this security release:

• https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472
• https://vercel.com/changelog/summary-of-cve-2026-23864

v15.4.11

Please see this changelog for more information about this security patch.

v15.3.9

Please see this changelog for more information about this security patch.

v15.2.9

Please see this changelog for more information about this security patch.

v15.1.12

Please see this changelog for more information about this security patch.

v15.0.8

Please see this changelog for more information about this security patch.

Commits

• 60a2aa9 v15.5.10
• e5b834d fetch(next/image): reduce maximumResponseBody from 300MB to 50MB (#88588)
• 39a2f6a feat(next/image)!: add images.maximumResponseBody config (#88183)
• bf9f084 Sync DoS mitigations for React Flight
• c5de33e v15.5.9
• dd23399 Backport facebook/react#35351 for 15.5.8 (#87086)
• 7526cd6 v15.5.8
• 1e9ec41 Update React Version (#41)
• 16141e5 Update React Version (#30)
• e01e589 Backport Next.js changes to v15.5.8 (#23)
• Additional commits viewable in compare view

Updates ajv from 6.12.6 to 6.14.0

Commits

• e3af0a7 6.14.0
• b552ed6 add regExp option to address $data exploit via a regular expression (CVE-2025...
• 72f2286 docs: update v7 info
• 231e52b Merge pull request #1320 from philsturgeon/patch-1
• d3475fc Add spectral, an AJV util from a sponsor
• 413afe0 docs: v7.0.0-beta.3
• 11e997b update readme for v7
• See full diff in compare view

Updates minimatch from 3.1.2 to 3.1.5

Commits

• 7bba978 3.1.5
• bd25942 docs: add warning about ReDoS
• 1a9c27c fix partial matching of globstar patterns
• 1a2e084 3.1.4
• ae24656 update lockfile
• b100374 limit recursion for **, improve perf considerably
• 26ffeaa lockfile update
• 9eca892 lock node version to 14
• 00c323b 3.1.3
• 30486b2 update CI matrix and actions
• Additional commits viewable in compare view

Updates rollup from 4.16.4 to 4.59.0

Release notes

Sourced from rollup's releases.

v3.30.0

3.30.0

2026-02-22

Features

• Throw when the generated bundle contains paths that would leave the output directory (#6276)

Pull Requests

• #6276: Validate bundle stays within output dir (@​lukastaegert)

Changelog

Sourced from rollup's changelog.

3.30.0

2026-02-22

Features

• Throw when the generated bundle contains paths that would leave the output directory (#6276)

Pull Requests

• #6276: Validate bundle stays within output dir (@​lukastaegert)

Commits

• d91d5e1 3.30.0
• 9677409 Update release script for backports
• c8cf1f9 Validate bundle stays within output dir (#6276)
• See full diff in compare view

Updates next from 14.2.35 to 15.5.10

Release notes

Sourced from next's releases.

v15.5.10

Please refer the following changelogs for more information about this security release:

• https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472
• https://vercel.com/changelog/summary-of-cve-2026-23864

v15.4.11

Please see this changelog for more information about this security patch.

v15.3.9

Please see this changelog for more information about this security patch.

v15.2.9

Please see this changelog for more information about this security patch.

v15.1.12

Please see this changelog for more information about this security patch.

v15.0.8

Please see this changelog for more information about this security patch.

Commits

• 60a2aa9 v15.5.10
• e5b834d fetch(next/image): reduce maximumResponseBody from 300MB to 50MB (#88588)
• 39a2f6a feat(next/image)!: add images.maximumResponseBody config (#88183)
• bf9f084 Sync DoS mitigations for React Flight
• c5de33e v15.5.9
• dd23399 Backport facebook/react#35351 for 15.5.8 (#87086)
• 7526cd6 v15.5.8
• 1e9ec41 Update React Version (#41)
• 16141e5 Update React Version (#30)
• e01e589 Backport Next.js changes to v15.5.8 (#23)
• Additional commits viewable in compare view

Updates minimatch from 3.1.2 to 3.1.5

Commits

• 7bba978 3.1.5
• bd25942 docs: add warning about ReDoS
• 1a9c27c fix partial matching of globstar patterns
• 1a2e084 3.1.4
• ae24656 update lockfile
• b100374 limit recursion for **, improve perf considerably
• 26ffeaa lockfile update
• 9eca892 lock node version to 14
• 00c...

  Description has been truncated

[github-actions]

Differences Found

⚠️ 20 packages or licenses were added.

Expand

License	Package
Apache-2.0	@img/sharp-linux-ppc64
Apache-2.0	@img/sharp-linux-riscv64
Apache-2.0	@img/sharp-win32-arm64
BSD-3-Clause	fast-uri
BlueOak-1.0.0	tar
LGPL-3.0-or-later	@img/sharp-libvips-linux-ppc64
LGPL-3.0-or-later	@img/sharp-libvips-linux-riscv64
LGPL-3.0-or-later	@img/sharp-win32-arm64
MIT	@esbuild/openharmony-arm64
MIT	@img/colour
MIT	@rollup/rollup-linux-loong64-gnu
MIT	@rollup/rollup-linux-loong64-musl
MIT	@rollup/rollup-linux-ppc64-musl
MIT	@rollup/rollup-openbsd-x64
MIT	@rollup/rollup-openharmony-arm64
MIT	@rollup/rollup-win32-x64-gnu
MIT	@standard-schema/spec
MIT	@types/deep-eql
MIT	acorn-import-phases
MIT	obug

Summary

Expand

License Name	Package Count	Packages
0BSD	1	Packages tslib
AFL-2.1	1	Packages json-schema
Apache 2.0	1	Packages @mailchimp/mailchimp_marketing
CC-BY-3.0	1	Packages spdx-exceptions
MIT (http://mootools.net/license.txt)	1	Packages slick
MIT-0	1	Packages nodemailer
Public Domain	1	Packages jsonify
Python-2.0	1	Packages argparse
SEE LICENSE IN LICENSE	1	Packages spawndamnit
WTFPL	1	Packages utf8-byte-length
CC-BY-4.0	2	Packages @saleor/macaw-ui caniuse-lite
CC0-1.0	3	Packages language-subtag-registry spdx-license-ids type-fest
Unlicense	3	Packages @zxing/text-encoding big-integer tweetnacl
<<missing>>	5	Packages busboy cycle example-nextjs-sequra eyes streamsearch
BlueOak-1.0.0	6	Packages chownr jackspeak package-json-from-dist path-scurry tar yallist
MPL-2.0	12	Packages axe-core lightningcss lightningcss-darwin-arm64 lightningcss-darwin-x64 lightningcss-freebsd-x64 lightningcss-linux-arm-gnueabihf lightningcss-linux-arm64-gnu lightningcss-linux-arm64-musl lightningcss-linux-x64-gnu lightningcss-linux-x64-musl lightningcss-win32-arm64-msvc lightningcss-win32-x64-msvc
LGPL-3.0-or-later	14	Packages @img/sharp-libvips-darwin-arm64 @img/sharp-libvips-darwin-x64 @img/sharp-libvips-linux-arm @img/sharp-libvips-linux-arm64 @img/sharp-libvips-linux-ppc64 @img/sharp-libvips-linux-riscv64 @img/sharp-libvips-linux-s390x @img/sharp-libvips-linux-x64 @img/sharp-libvips-linuxmusl-arm64 @img/sharp-libvips-linuxmusl-x64 @img/sharp-wasm32 @img/sharp-win32-arm64 @img/sharp-win32-ia32 @img/sharp-win32-x64
BSD-2-Clause	25	Packages @typescript-eslint/parser @typescript-eslint/typescript-estree cheerio-select css-select css-what damerau-levenshtein domelementtype domhandler domutils dotenv entities escodegen eslint-scope espree esprima esrecurse estraverse esutils glob-to-regexp normalize-package-data And 5 more...
BSD-3-Clause	31	Packages @humanwhocodes/object-schema @saleor/app-sdk @saleor/auth-sdk @saleor/eslint-plugin-saleor-app @sentry/cli @xtuc/ieee754 abab asn1js bcrypt-pbkdf diff esquery exenv fast-uri hoist-non-react-statics hyphenate-style-name ieee754 immutable istanbul-lib-coverage istanbul-lib-report istanbul-lib-source-maps And 11 more...
ISC	70	Packages @isaacs/cliui @isaacs/fs-minipass @saleor/app-sdk @saleor/json-schema-compiler @ungap/structured-clone abbrev anymatch ast-types-flow authorizenet boolbase cli-color cli-width cliui d electron-to-chromium es5-ext es6-symbol es6-weak-map eslint-import-resolver-typescript ext And 50 more...
Apache-2.0	79	Packages @ampproject/remapping @humanwhocodes/config-array @humanwhocodes/module-importer @img/sharp-darwin-arm64 @img/sharp-darwin-x64 @img/sharp-linux-arm @img/sharp-linux-arm64 @img/sharp-linux-ppc64 @img/sharp-linux-riscv64 @img/sharp-linux-s390x @img/sharp-linux-x64 @img/sharp-linuxmusl-arm64 @img/sharp-linuxmusl-x64 @img/sharp-wasm32 @img/sharp-win32-arm64 @img/sharp-win32-ia32 @img/sharp-win32-x64 @opentelemetry/api @opentelemetry/semantic-conventions @pollyjs/adapter And 59 more...
MIT	1442	Packages @0no-co/graphql.web @aashutoshrathi/word-wrap @adobe/css-tools @alloc/quick-lru @apidevtools/json-schema-ref-parser @apollo/client @ardatan/relay-compiler @ardatan/sync-fetch @babel/code-frame @babel/compat-data @babel/core @babel/generator @babel/helper-annotate-as-pure @babel/helper-compilation-targets @babel/helper-create-class-features-plugin @babel/helper-environment-visitor @babel/helper-function-name @babel/helper-globals @babel/helper-hoist-variables @babel/helper-member-expression-to-functions And 1422 more...