chore(deps): Bump the npm_and_yarn group across 2 directories with 9 updates by dependabot[bot] · Pull Request #98 · Corvidae-Coding-Projects/crosslink

dependabot · 2026-09-12T15:02:53Z

Bumps the npm_and_yarn group with 5 updates in the /dashboard directory:

Package	From	To
react-router	`7.18.0`	`7.18.3`
@humanfs/node	`0.16.7`	`0.16.8`
brace-expansion	`1.1.16`	`1.1.18`
js-yaml	`4.3.0`	`4.3.2`
postcss	`8.5.15`	`8.5.28`

Bumps the npm_and_yarn group with 5 updates in the /vscode-extension directory:

Package	From	To
@humanfs/node	`0.16.7`	`0.16.8`
js-yaml	`4.3.1`	`4.3.2`
picomatch	`4.0.3`	`4.0.7`
picomatch	`2.3.1`	`2.3.2`
fast-uri	`3.1.5`	`3.1.7`
linkify-it	`5.0.1`	`5.0.2`

Updates react-router from 7.18.0 to 7.18.3

Release notes

Sourced from react-router's releases.

v7.18.3

See the changelog for release notes: https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7183

v7.18.2

See the changelog for release notes: https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7182

v7.18.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7181

Changelog

Sourced from react-router's changelog.

v7.18.3

Patch Changes

Improve route matching performance for long paths (#15423)

Improve validation of action request origins (#15420)

Add additional URL validation on client side navigations/redirects (#15446)

v7.18.2

Patch Changes

Harden RSC CSRF codepaths. (#15353)

v7.18.1

Patch Changes

No changes

Commits

23166df Release v7.18.3 (#15424)
38af67f Validate client-side navigation targets (#15446)
df78a29 Revert "fix: normalize control characters in relative URLs (#15422)" (#15441)
d1a4b1d fix: normalize control characters in relative URLs (#15422)
e7c2d94 Revert "fix: normalize RSC server redirects (#15421)" (#15434)
e4b70d6 fix: validate schemeful action origins (#15420)
b137cab fix: normalize RSC server redirects (#15421)
6cc6f7a fix: improve matching perf (#15423)
69a653e Release v7.18.2 (#15354)
8ebd5df Harden RSC CSRF codepaths (backport of #15311) (#15353)
Additional commits viewable in compare view

Updates @humanfs/node from 0.16.7 to 0.16.8

Release notes

Sourced from @humanfs/node's releases.

node: v0.16.8

0.16.8 (2026-04-17)

Bug Fixes

Include type dependencies at runtime (956ce7a), closes #145

Dependencies

The following workspace dependencies were updated

dependencies

@humanfs/core bumped from ^0.19.1 to ^0.19.2

Changelog

Sourced from @humanfs/node's changelog.

0.16.8 (2026-04-17)

Bug Fixes

Ensure symlinks are copied as symlinks in copy() and copyAll() (22bbaa44)

Include type dependencies at runtime (956ce7a), closes #145

Dependencies

The following workspace dependencies were updated

dependencies

@humanfs/core bumped from ^0.19.1 to ^0.19.2

Commits

e96070e chore: release main (#146)
22bbaa4 Merge commit from fork
956ce7a fix: Include type dependencies at runtime
See full diff in compare view

Updates brace-expansion from 1.1.16 to 1.1.18

Commits

758fcd6 1.1.18
27fbeed Merge commit from fork
5c57cc2 1.1.17
d757f1d npm ignore .claude
cb4b9e4 fix: backport GHSA-mh99-v99m-4gvg (#129)
See full diff in compare view

Updates @vitest/mocker from 4.1.9 to 5.0.0

Release notes

Sourced from @vitest/mocker's releases.

v5.0.0

Vitest 5 is officially out! This release focuses on performance and brings a lot of new features while fixing long-standing bugs. See our blog post for the official announcement.

🚨 Breaking Changes

Replace loupe.inspect with pretty-format - by @hi-ogawa, Claude Opus 5 (1M context) and OpenAI Codex in vitest-dev/vitest#9609 (3f802)

Remove quotes from string values in test.for/each title $ variable (take 2) - by @hi-ogawa in vitest-dev/vitest#10170 (04d37)

Default attachmentsDir from .vitest-attachements/ to .vitest/attachments/ - by @MdSadiqMd in vitest-dev/vitest#10186 (1ba73)

Remove sequential test/suite options in favor of concurrent - by @hi-ogawa and OpenAI Codex in vitest-dev/vitest#10198 (9229f)

Represent locator as an object instead of a string - by @sheremet-va in vitest-dev/vitest#10212 (80f07)

Inline expect package - by @sheremet-va in vitest-dev/vitest#10221 (ad162)

Remove deprecated entry points - by @sheremet-va in vitest-dev/vitest#10222 (994c6)

Require Node.js 22 and Vite 6.4 - by @sheremet-va in vitest-dev/vitest#10178 (38762)

Fail expect.poll when function didn't resolve in time - by @hi-ogawa and OpenAI Codex in vitest-dev/vitest#10233 (4df04)

Throw an error if hoistable methods are outside the top level scope - by @sheremet-va in vitest-dev/vitest#10460 (d0b4f)

toHaveTextContent is strict, add toMatchTextContent as alternative - by @sheremet-va in vitest-dev/vitest#10473 (18f30)

Don't lookup config file from ancestor directories - by @hi-ogawa, OpenAI Codex and Hiroshi Ogawa in vitest-dev/vitest#10428 (945d9)

Inline @vitest/runner package, do not publish it anymore - by @sheremet-va in vitest-dev/vitest#10511 (6d6e4)

Allow mutating happy-dom/jsdom window object - by @hi-ogawa, Hiroshi Ogawa and OpenAI Codex in vitest-dev/vitest#10373 (206e8)

Expose concurrencyId/workerId on TestModule's diagnostics, make id 1-based - by @sheremet-va in vitest-dev/vitest#10516 (bdd98)

Add screenshotDirectory config to browser.expect.toMatchScreenshot - by @macarie in vitest-dev/vitest#10592 (a60de)

Update @sinonjs/fake-timers and support mocking Temporal - by @hi-ogawa, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in vitest-dev/vitest#10654 (f8b15)

Remove webdriverio package - by @sheremet-va in vitest-dev/vitest#10675 (5fed6)

Clear mocks by default before each test - by @sheremet-va in vitest-dev/vitest#10613 (0f646)

Don't emit localStorage warnings on Node 26, fail gracefully when worker fails to start - by @sheremet-va in vitest-dev/vitest#10293 (334ed)

Separate config resolution from the server creation - by @sheremet-va in vitest-dev/vitest#10554 (1c0ec)

Inline projects extend the root config by default - by @sheremet-va in vitest-dev/vitest#10750 (fec00)

Enable mocking Temporal without fake timers - by @fabon-f, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in vitest-dev/vitest#10757 (ac2d4)

Support nested projects - by @sheremet-va in vitest-dev/vitest#10846 (ec367)

Use > as separator in -t, calculate only once - by @sheremet-va in vitest-dev/vitest#10686 (a0b20)

Fail the test when an asynchronous assertion is not awaited - by @sheremet-va in vitest-dev/vitest#10868 (86d4a)

Share the Vite server between inline projects - by @sheremet-va in vitest-dev/vitest#10848 (d87c9)

Parse files statically in vitest list by default - by @sheremet-va in vitest-dev/vitest#11088 (51e94)

benchmark:

Rewrite the public API - by @sheremet-va in vitest-dev/vitest#10113 (19f6e)

browser:

Iframe scale - by @macarie in vitest-dev/vitest#9745 (b6398)

Enable locators.exact by default - by @sheremet-va in vitest-dev/vitest#10430 (e2032)

Require sessionId for orchestrator html request - by @hi-ogawa, Hiroshi Ogawa and OpenAI Codex in vitest-dev/vitest#10522 (79b7d)

Save failure screenshots in attachmentsDir - by @macarie in vitest-dev/vitest#10917 (3b5bb)

coverage:

include/exclude globs too eager - by @AriPerkkio in vitest-dev/vitest#9818 (edacb)

Allow thresholds.perFile to accept an object - by @vladlenskiy and @AriPerkkio in vitest-dev/vitest#10190 (13b78)

expect:

Fix toThrow("") behavior by reverting #6710 - by @hi-ogawa in vitest-dev/vitest#9643 and vitest-dev/vitest#6710 (6c3e4)

mocker:

Deserialize automock as automock - by @nami8824 in vitest-dev/vitest#10192 (2f892)

reporters:

blob reporter and --merge-reports default to .vitest/blob/ - by @AriPerkkio in vitest-dev/vitest#10232 (d22b0)

Write json and junit reporter output files to .vitest by default - by @hi-ogawa, Hiroshi Ogawa, OpenCode (gpt-5.6-sol) and @AriPerkkio in vitest-dev/vitest#10621 (58577)

... (truncated)

Commits

f441c6f chore: release v5.0.0 (#11130)
897f51f chore: release v5.0.0-rc.4 (#11107)
7db80dc chore: release v5.0.0-rc.3 (#11089)
732df2c fix(deps): update all non-major dependencies (#11043)
1e9f80e perf(vm): don't prewarm modules the worker never requests (#11033)
af83d1b chore: release v5.0.0-rc.2 (#10976)
8ff9b9a fix(mocker): restrict redirect mocks to the fs allowlist (#10972)
65263d7 fix(deps): update all non-major dependencies (#10966)
a7fa111 chore: release v5.0.0-rc.1 (#10920)
0553851 chore: add Knip checks (#10847)
Additional commits viewable in compare view

Updates js-yaml from 4.3.0 to 4.3.2

Changelog

Sourced from js-yaml's changelog.

4.3.2 - 2026-08-26

Changed

[backport] Hard-limit merge sequence size to 100.

Security

[backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

4.3.1 - 2026-07-31

Security

[backport] Remove quadratic complexity from !!omap duplicate key detection.

Commits

79ca68d 4.3.2 released
d90b661 Backport merge limits from v5.4.1
86e91b8 4.3.1 released
c3cc4b0 Backport quadratic complexity fix for !!omap
See full diff in compare view

Updates postcss from 8.5.15 to 8.5.28

Release notes

Sourced from postcss's releases.

8.5.28

Fixes types regression.

8.5.27

Fixed removing any comments starting with /*# (by @dylanpulver).

Fixed * hack before a comment in Custom Properties (by @Jaybhade).

Fixed empty values in the middle of list.comma() (by @MahinAnowar).

Fixed whitespace-only values in list.space() (by @MahinAnowar).

Fixed rule’s end position on space before semicolon (by @maximilliangrand).

Fixed types (by @romainmenke).

Fixed Chinese text in deprecation warning (by @Jesse205).

8.5.26

Fixed list.split() regression (by @lazerg).

Track symlinks in path protection in source map loading (by @drengir1).

8.5.25

Fixed 8.5.17 visitor regression.

Fixed list.split() for non-string values (by @amir-rezaei).

8.5.24

Preserve the BOM after the processing (by @hdimer).

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.28

Fixes types regression.

8.5.27

Fixed removing any comments starting with /*# (by @dylanpulver).

Fixed * hack before a comment in Custom Properties (by @Jaybhade).

Fixed empty values in the middle of list.comma() (by @MahinAnowar).

Fixed whitespace-only values in list.space() (by @MahinAnowar).

Fixed rule’s end position on space before semicolon (by @maximilliangrand).

Fixed types (by @romainmenke).

Fixed Chinese text in deprecation warning (by @Jesse205).

8.5.26

Fixed list.split() regression (by @lazerg).

Track symlinks in path protection in source map loading (by @drengir1).

8.5.25

Fixed 8.5.17 visitor regression.

Fixed list.split() for non-string values (by @amir-rezaei).

8.5.24

Preserve the BOM after the processing (by @hdimer).

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

... (truncated)

Commits

e544bff Release 8.5.28 version
f8fc252 Typo
5039fd7 Add missed release notes
ae40ca4 Release 8.5.27 version
62b1626 Fix linter
1dba938 Update dependencies
3e82edc Keep non-annotation comments when the processor has no plugins (#2150)
6d23bc3 Fix link
508e997 Add GitHub Sponsors link
e993739 Add CodeRabbit sponsor (#2145)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates @humanfs/node from 0.16.7 to 0.16.8

Release notes

Sourced from @humanfs/node's releases.

node: v0.16.8

0.16.8 (2026-04-17)

Bug Fixes

Include type dependencies at runtime (956ce7a), closes #145

Dependencies

The following workspace dependencies were updated

dependencies

@humanfs/core bumped from ^0.19.1 to ^0.19.2

Changelog

Sourced from @humanfs/node's changelog.

0.16.8 (2026-04-17)

Bug Fixes

Ensure symlinks are copied as symlinks in copy() and copyAll() (22bbaa44)

Include type dependencies at runtime (956ce7a), closes #145

Dependencies

The following workspace dependencies were updated

dependencies

@humanfs/core bumped from ^0.19.1 to ^0.19.2

Commits

e96070e chore: release main (#146)
22bbaa4 Merge commit from fork
956ce7a fix: Include type dependencies at runtime
See full diff in compare view

Updates js-yaml from 4.3.1 to 4.3.2

Changelog

Sourced from js-yaml's changelog.

4.3.2 - 2026-08-26

Changed

[backport] Hard-limit merge sequence size to 100.

Security

[backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

4.3.1 - 2026-07-31

Security

[backport] Remove quadratic complexity from !!omap duplicate key detection.

Commits

79ca68d 4.3.2 released
d90b661 Backport merge limits from v5.4.1
86e91b8 4.3.1 released
c3cc4b0 Backport quadratic complexity fix for !!omap
See full diff in compare view

Updates picomatch from 4.0.3 to 4.0.7

Release notes

Sourced from picomatch's releases.

4.0.7

What's Changed

fix: handle terminal globstars in parenthesized patterns by @mrmlnc in micromatch/picomatch#198

Full Changelog: micromatch/picomatch@4.0.6...4.0.7

4.0.6

What's Changed

fix: scan full pattern when tokens are requested by @mrmlnc in micromatch/picomatch#197

fix: return complete pattern parts from scan by @mrmlnc in micromatch/picomatch#199

Full Changelog: micromatch/picomatch@4.0.5...4.0.6

4.0.5

What's Changed

fix: preserve all branches when rewriting risky repeated extglobs by @MerlijnW70 in micromatch/picomatch#182

fix: honor the windows option when matching basenames by @MerlijnW70 in micromatch/picomatch#183

New Contributors

@MerlijnW70 made their first contribution in micromatch/picomatch#182

Full Changelog: micromatch/picomatch@4.0.4...4.0.5

4.0.4

This is a security release fixing several security relevant issues.

What's Changed

Fix for CVE-2026-33671

Fix for CVE-2026-33672

Full Changelog: micromatch/picomatch@4.0.3...4.0.4

Changelog

Sourced from picomatch's changelog.

4.0.7 (2026-08-24)

Fixed

Fixed terminal globstars in parenthesized patterns (#142, e279bd7).

4.0.6 (2026-08-24)

Fixed

scan() now scans the full pattern when tokens are requested, instead of merging the remaining path segments into the final token (#62, 5f5819d).

scan() now returns complete pattern parts, including leading and trailing empty segments, and handles nested and escaped parentheses correctly (#58, f201165).

4.0.5 (2026-07-02)

Fixed

Preserved every branch when safely rewriting repeated extglobs (#182, 6289307).

Honored the windows option when matching basenames (#183, ab8bc4d).

4.0.4 (2026-03-23)

Security

Prevented regular expression denial of service (ReDoS) from crafted repeated or nested extglob quantifiers by safely rewriting or treating risky patterns as literals. The new maxExtglobRecursion option defaults to 0; positive numeric values allow limited nesting, while false disables the safeguard (CVE-2026-33671, 5eceecd).

Prevented inherited object properties from being interpreted as POSIX character classes (CVE-2026-33672, 4516eb5).

Commits

6bb4067 4.0.7
fdfb155 Merge pull request #198 from micromatch/issue-142
38c6b7a 4.0.6
ada9d3f Merge pull request #199 from micromatch/issue-58
9b74f6f Merge pull request #197 from micromatch/issue-62
f201165 fix: return complete pattern parts from scan
e279bd7 fix: handle terminal globstars in parenthesized patterns
5f5819d fix: scan full pattern when tokens are requested
4f41a8e 4.0.5
02cfc1b Update .verb.md and run verb to generate README documentation
Additional commits viewable in compare view

Updates picomatch from 2.3.1 to 2.3.2

Release notes

Sourced from picomatch's releases.

4.0.7

What's Changed

fix: handle terminal globstars in parenthesized patterns by @mrmlnc in micromatch/picomatch#198

Full Changelog: micromatch/picomatch@4.0.6...4.0.7

4.0.6

What's Changed

fix: scan full pattern when tokens are requested by @mrmlnc in micromatch/picomatch#197

fix: return complete pattern parts from scan by @mrmlnc in micromatch/picomatch#199

Full Changelog: micromatch/picomatch@4.0.5...4.0.6

4.0.5

What's Changed

fix: preserve all branches when rewriting risky repeated extglobs by @MerlijnW70 in micromatch/picomatch#182

fix: honor the windows option when matching basenames by @MerlijnW70 in micromatch/picomatch#183

New Contributors

@MerlijnW70 made their first contribution in micromatch/picomatch#182

Full Changelog: micromatch/picomatch@4.0.4...4.0.5

4.0.4

This is a security release fixing several security relevant issues.

What's Changed

Fix for CVE-2026-33671

Fix for CVE-2026-33672

Full Changelog: micromatch/picomatch@4.0.3...4.0.4

Changelog

Sourced from picomatch's changelog.

4.0.7 (2026-08-24)

Fixed

Fixed terminal globstars in parenthesized patterns (#142, e279bd7).

4.0.6 (2026-08-24)

Fixed

scan() now scans the full pattern when tokens are requested, instead of merging the remaining path segments into the final token (#62, 5f5819d).

scan() now returns complete pattern parts, including leading and trailing empty segments, and handles nested and escaped parentheses correctly (#58, f201165).

4.0.5 (2026-07-02)

Fixed

Preserved every branch when safely rewriting repeated extglobs (#182, 6289307).

Honored the windows option when matching basenames (#183, ab8bc4d).

4.0.4 (2026-03-23)

Security

Prevented regular expression denial of service (ReDoS) from crafted repeated or nested extglob quantifiers by safely rewriting or treating risky patterns as literals. The new maxExtglobRecursion option defaults to 0; positive numeric values allow limited nesting, while false disables the safeguard (CVE-2026-33671, 5eceecd).

Prevented inherited object properties from being interpreted as POSIX character classes (CVE-2026-33672, 4516eb5).

Commits

6bb4067 4.0.7
fdfb155 Merge pull request #198 from micromatch/issue-142
38c6b7a 4.0.6
ada9d3f Merge pull request #199 from micromatch/issue-58
9b74f6f Merge pull request #197 from micromatch/issue-62
f201165 fix: return complete pattern parts from scan
e279bd7 fix: handle terminal globstars in parenthesized patterns
5f5819d fix: scan full pattern when tokens are requested
4f41a8e 4.0.5
02cfc1b Update .verb.md and run verb to generate README documentation
Additional commits viewable in compare view

Updates fast-uri from 3.1.5 to 3.1.7

Release notes

Sourced from fast-uri's releases.

v3.1.7

⚠️ Security Warning

This is a security release that fixes the following high-severity security advisories:

GHSA-qw65-cvwx-89v3 — authority injection via an unvalidated port in serialize()

GHSA-58mr-gqgx-xq4g — host confusion via unbalanced or misplaced IP-literal brackets

Users of the v3.x release line should upgrade to v3.1.7.

Full Changelog: fastify/fast-uri@v3.1.6...v3.1.7

v3.1.6

⚠️ Security Warning

This release addresses the following high-severity security advisories:

GHSA-5jgf-p345-68v8 — host confusion via skipped IDN canonicalization on scheme-relative references

GHSA-fph4-wmhf-6fwf — server-side request forgery via repeated hostname percent-decoding

GHSA-f65p-4m7j-42xc — server-side request forgery via malformed IPv6 normalization

GHSA-jqff-g426-hqxp — host confusion via percent-encoded scheme normalization

Users of the v3.x release line should upgrade to v3.1.6.

Full Changelog: fastify/fast-uri@v3.1.5...v3.1.6

Commits

412e40a Bumped v3.1.7
9f4c943 fix: backport port and IP-literal validation to v3.x (#216)
1eb3ce4 fix: treat unterminated bracket hosts as reg-names again (#214)
6f970b2 Bumped v3.1.6
d941579 fix: never run IDN canonicalization on bracketed IP literals
c0f0279 test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)
37f3417 Merge commit from fork
607bfbe Merge commit from fork
ae92a4c Merge commit from fork
444ecda Merge commit from fork
Additional commits viewable in compare view

Updates linkify-it from 5.0.1 to 5.0.2

Changelog

Sourced from linkify-it's changelog.

5.0.2 / 2026-07-02

Fixed DoS in mailto: links (restrict user name to 64 chars).

Restricted user/pass part length in links.

Commits

50a0c91 5.0.2 released
de3b885 Update package hooks
13effaa Add package lock
39d748d Bump c8
00ce877 Drop tlds deps
ecde823 Update benchmark to mitata
23c62cd Refactor demo / doc build and publish
fd63f3b CI config update
f4ea5af demo: update bootstrap & layout
1454fb6 lint: dim warnings
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
`@depe...

Description has been truncated

…updates Bumps the npm_and_yarn group with 5 updates in the /dashboard directory: | Package | From | To | | --- | --- | --- | | [react-router](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router) | `7.18.0` | `7.18.3` | | [@humanfs/node](https://github.com/humanwhocodes/humanfs/tree/HEAD/packages/node) | `0.16.7` | `0.16.8` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.16` | `1.1.18` | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.3.0` | `4.3.2` | | [postcss](https://github.com/postcss/postcss) | `8.5.15` | `8.5.28` | Bumps the npm_and_yarn group with 5 updates in the /vscode-extension directory: | Package | From | To | | --- | --- | --- | | [@humanfs/node](https://github.com/humanwhocodes/humanfs/tree/HEAD/packages/node) | `0.16.7` | `0.16.8` | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.3.1` | `4.3.2` | | [picomatch](https://github.com/micromatch/picomatch) | `4.0.3` | `4.0.7` | | [picomatch](https://github.com/micromatch/picomatch) | `2.3.1` | `2.3.2` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.1.5` | `3.1.7` | | [linkify-it](https://github.com/markdown-it/linkify-it) | `5.0.1` | `5.0.2` | Updates `react-router` from 7.18.0 to 7.18.3 - [Release notes](https://github.com/remix-run/react-router/releases) - [Changelog](https://github.com/remix-run/react-router/blob/react-router@7.18.3/packages/react-router/CHANGELOG.md) - [Commits](https://github.com/remix-run/react-router/commits/react-router@7.18.3/packages/react-router) Updates `@humanfs/node` from 0.16.7 to 0.16.8 - [Release notes](https://github.com/humanwhocodes/humanfs/releases) - [Changelog](https://github.com/humanwhocodes/humanfs/blob/main/packages/node/CHANGELOG.md) - [Commits](https://github.com/humanwhocodes/humanfs/commits/node-v0.16.8/packages/node) Updates `brace-expansion` from 1.1.16 to 1.1.18 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.16...v1.1.18) Updates `@vitest/mocker` from 4.1.9 to 5.0.0 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.0/packages/mocker) Updates `js-yaml` from 4.3.0 to 4.3.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.0...4.3.2) Updates `postcss` from 8.5.15 to 8.5.28 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.15...8.5.28) Updates `@humanfs/node` from 0.16.7 to 0.16.8 - [Release notes](https://github.com/humanwhocodes/humanfs/releases) - [Changelog](https://github.com/humanwhocodes/humanfs/blob/main/packages/node/CHANGELOG.md) - [Commits](https://github.com/humanwhocodes/humanfs/commits/node-v0.16.8/packages/node) Updates `js-yaml` from 4.3.1 to 4.3.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.0...4.3.2) Updates `picomatch` from 4.0.3 to 4.0.7 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@4.0.3...4.0.7) Updates `picomatch` from 2.3.1 to 2.3.2 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@4.0.3...4.0.7) Updates `fast-uri` from 3.1.5 to 3.1.7 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.5...v3.1.7) Updates `linkify-it` from 5.0.1 to 5.0.2 - [Changelog](https://github.com/markdown-it/linkify-it/blob/master/CHANGELOG.md) - [Commits](markdown-it/linkify-it@5.0.1...5.0.2) --- updated-dependencies: - dependency-name: react-router dependency-version: 7.18.3 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@humanfs/node" dependency-version: 0.16.8 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.18 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@vitest/mocker" dependency-version: 5.0.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.28 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@humanfs/node" dependency-version: 0.16.8 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 4.0.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 2.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: linkify-it dependency-version: 5.0.2 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 12, 2026

Navigation Menu

Uh oh!

chore(deps): Bump the npm_and_yarn group across 2 directories with 9 updates - #98

chore(deps): Bump the npm_and_yarn group across 2 directories with 9 updates#98
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dashboard/npm_and_yarn-382a819aea

dependabot Bot commented on behalf of github Sep 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 12, 2026

v7.18.3

v7.18.2

v7.18.1

v7.18.3

Patch Changes

v7.18.2

Patch Changes

v7.18.1

Patch Changes

node: v0.16.8

0.16.8 (2026-04-17)

Bug Fixes

Dependencies

0.16.8 (2026-04-17)

Bug Fixes

Dependencies

v5.0.0

🚨 Breaking Changes

4.3.2 - 2026-08-26

Changed

Security

4.3.1 - 2026-07-31

Security

8.5.28

8.5.27

8.5.26

8.5.25

8.5.24

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.17

8.5.16

8.5.28

8.5.27

8.5.26

8.5.25

8.5.24

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

node: v0.16.8

0.16.8 (2026-04-17)

Bug Fixes

Dependencies

0.16.8 (2026-04-17)

Bug Fixes

Dependencies

4.3.2 - 2026-08-26

Changed

Security

4.3.1 - 2026-07-31

Security

4.0.7

What's Changed

4.0.6

What's Changed

4.0.5

What's Changed

New Contributors

4.0.4

What's Changed

4.0.7 (2026-08-24)

Fixed

4.0.6 (2026-08-24)

Fixed

4.0.5 (2026-07-02)

Fixed

4.0.4 (2026-03-23)

Security

4.0.7

What's Changed