chore(deps): Bump the npm_and_yarn group across 13 directories with 11 updates by dependabot[bot] · Pull Request #368 · WhatIfWeDigDeeper/application-tracker

dependabot · 2026-07-28T05:31:45Z

Bumps the npm_and_yarn group with 5 updates in the /angular-spring-ui directory:

Package	From	To
body-parser	`1.20.5`	`1.20.6`
body-parser	`2.2.2`	`2.3.0`
hono	`4.12.18`	`4.12.32`
immutable	`5.1.5`	`5.1.9`
shell-quote	`1.8.3`	`1.10.0`
tar	`7.5.13`	`7.5.22`

Bumps the npm_and_yarn group with 5 updates in the /angular-ui directory:

Package	From	To
body-parser	`1.20.5`	`1.20.6`
body-parser	`2.2.2`	`2.3.0`
hono	`4.12.18`	`4.12.32`
immutable	`5.1.5`	`5.1.9`
shell-quote	`1.8.3`	`1.10.0`
tar	`7.5.13`	`7.5.22`

Bumps the npm_and_yarn group with 2 updates in the /api directory: @hono/node-server and body-parser.
Bumps the npm_and_yarn group with 3 updates in the /hono-api directory: brace-expansion, @hono/node-server and hono.
Bumps the npm_and_yarn group with 3 updates in the /lambda-api directory: brace-expansion, @hono/node-server and hono.
Bumps the npm_and_yarn group with 1 update in the /lambda-api/cdk directory: aws-cdk-lib.
Bumps the npm_and_yarn group with 2 updates in the /lambda-react-ui directory: brace-expansion and js-yaml.
Bumps the npm_and_yarn group with 1 update in the /nest-history-api directory: brace-expansion.
Bumps the npm_and_yarn group with 4 updates in the /nuxt-api directory: brace-expansion, shell-quote, tar and svgo.
Bumps the npm_and_yarn group with 1 update in the /react-ui directory: brace-expansion.
Bumps the npm_and_yarn group with 1 update in the /tanstack-start-ui directory: brace-expansion.
Bumps the npm_and_yarn group with 1 update in the /ui directory: next.
Bumps the npm_and_yarn group with 2 updates in the /yoga-api directory: brace-expansion and @hono/node-server.

Updates body-parser from 1.20.5 to 1.20.6

Release notes

Sourced from body-parser's releases.

1.20.6

Important: Security

Security fix for CVE-2026-12590 (GHSA-v422-hmwv-36x6)

What's Changed

fix: improve limit option validation by @Phillip9587 in expressjs/body-parser#741

Full Changelog: expressjs/body-parser@1.20.5...1.20.6

Changelog

Sourced from body-parser's changelog.

1.20.6 / 2026-07-09

Security fix for GHSA-v422-hmwv-36x6

fix: improve limit option validation (#698)

Invalid limit values (e.g. unparseable strings or NaN) now throw instead of being silently ignored, which previously disabled size limit enforcement

null and undefined fall back to the default 100kb limit

Commits

5cc4fb8 1.20.6 (#746)
3492672 fix: improve limit option validation (#741)
See full diff in compare view

Updates body-parser from 2.2.2 to 2.3.0

Release notes

Sourced from body-parser's releases.

1.20.6

Important: Security

Security fix for CVE-2026-12590 (GHSA-v422-hmwv-36x6)

What's Changed

fix: improve limit option validation by @Phillip9587 in expressjs/body-parser#741

Full Changelog: expressjs/body-parser@1.20.5...1.20.6

Changelog

Sourced from body-parser's changelog.

1.20.6 / 2026-07-09

Security fix for GHSA-v422-hmwv-36x6

fix: improve limit option validation (#698)

Invalid limit values (e.g. unparseable strings or NaN) now throw instead of being silently ignored, which previously disabled size limit enforcement

null and undefined fall back to the default 100kb limit

Commits

5cc4fb8 1.20.6 (#746)
3492672 fix: improve limit option validation (#741)
See full diff in compare view

Updates hono from 4.12.18 to 4.12.32

Release notes

Sourced from hono's releases.

v4.12.32

What's Changed

ci: enable reports for type & bundle size check in honojs/hono#5148

fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 in honojs/hono#5142

fix(sse): emit empty id field to reset Last-Event-ID in honojs/hono#5138

test(cloudflare-workers): add coverage for onClose, onError, send, and close in Cloudflare Workers websocket adapter in honojs/hono#5145

fix: use Object.create(null) when parsing query, headers, and params in honojs/hono#5161

fix(secure-headers): keep CSP callbacks scoped to their header in honojs/hono#5147

Full Changelog: honojs/hono@v4.12.31...v4.12.32

v4.12.31

What's Changed

test(context): assert case-insensitive header names in response helpers by @yusukebe in honojs/hono#5116

chore(benchmark): add app.fetch() overhead benchmark by @yusukebe in honojs/hono#5117

refactor(aws-lambada): remove FIXME in @ts-expect-error by @yusukebe in honojs/hono#5130

fix(utils/body): reuse cached formData in parseBody() by @yusukebe in honojs/hono#5131

fix(request): fix multipart boundary mismatch in cloneRawRequest by @yusukebe in honojs/hono#5133

fix(sse): emit retry feild when retry is 0 by @yusukebe in honojs/hono#5135

test(validator): fix misspelled identifier in transform type test by @yusukebe in honojs/hono#5136

Full Changelog: honojs/hono@v4.12.30...v4.12.31

v4.12.30

What's Changed

chore(benchmark/routers): bump deps in honojs/hono#5107

chore(benchmark): remove not used benchmarks in honojs/hono#5108

chore: update to ts6 in prep for ts7 in honojs/hono#5104

fix(cache): deduplicate Cache-Control directives case-insensitively in honojs/hono#5025

fix(compress): do not compress 206 Partial Content responses in honojs/hono#5020

fix(client): replaceUrlParam should not match a param that prefixes another in honojs/hono#5096

fix(method-override): set duplex when forwarding a stream body in query mode in honojs/hono#5110

Full Changelog: honojs/hono@v4.12.29...v4.12.30

v4.12.29

What's Changed

fix(client): merge function headers with per-request headers by @yusukebe in honojs/hono#5092

chore: fix no-op tsc in test script by @yusukebe in honojs/hono#5093

fix(lambda-edge): resolve the handler with the value passed to the callback by @yusukebe in honojs/hono#5094

docs(language): add JSDoc @example to languageDetector by @codebybilal18 in honojs/hono#5081

test(workerd): add compatibilityDate by @yusukebe in honojs/hono#5100

fix(lambda-edge): base64 encode content-encoded response bodies by @yusukebe in honojs/hono#5099

fix(aws-lambda): treat any non-identity content-encoding as binary by @yusukebe in honojs/hono#5101

fix(types): strip extra properties from array types in JSONParsed by @Arman-Luthra in honojs/hono#5103

fix(trie-router): match empty wildcard remainder after regexp param by @usualoma in honojs/hono#5102

fix(etag): treat If-None-Match: * as a match by @yusukebe in honojs/hono#5084

New Contributors

@codebybilal18 made their first contribution in honojs/hono#5081

... (truncated)

Commits

26d8e42 4.12.32
402eb3a fix(secure-headers): keep CSP callbacks scoped to their header (#5147)
c85aead fix: use Object.create(null) when parsing query, headers, and params (#5161)
a88c89d test(cloudflare-workers): add coverage for onClose, onError, send, and close ...
44f8843 fix(sse): emit empty id field to reset Last-Event-ID (#5138)
e36f57d fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 (#5142)
bf8608c ci: enable reports for type & bundle size check (#5148)
cadff88 4.12.31
64c613a test(validator): fix misspelled identifier in transform type test (#5136)
aeba9ec fix(sse): emit retry feild when retry is 0 (#5135)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for hono since your current version.

Updates immutable from 5.1.5 to 5.1.9

Release notes

Sourced from immutable's releases.

v5.1.9

What's Changed

fix(List): preserve undefined values when grown past 32 elements by @spokodev / @jdeniau in immutable-js/immutable-js#2235 (originated from immutable-js/immutable-js#2230 )

Full Changelog: immutable-js/immutable-js@v5.1.8...v5.1.9

v5.1.8

What's Changed

fix(List): guard oversized bounds in setListBounds. Fixes CVE GHSA-v56q-mh7h-f735

perf(Map): index large hash-collision buckets for faster lookups. Fixes CVE GHSA-xvcm-6775-5m9r

Full Changelog: immutable-js/immutable-js@v5.1.7...v5.1.8

v5.1.7

What's Changed

fix(Repeat): lastIndexOf returned size instead of size - 1 by @chatman-media in immutable-js/immutable-js#2227

internal

Backport tests from 6.x branch by @jdeniau in immutable-js/immutable-js#2199

fix(IndexedCollection): has(index) on a lazy Seq of unknown size now checks index existence instead of searching for a value equal to the index by @jdeniau in immutable-js/immutable-js#2203

Better type for reduce if not ininitial value is given by @jdeniau in immutable-js/immutable-js#2205

Backport test from #2193 by @jdeniau in immutable-js/immutable-js#2207

backport tests from 6.x by @jdeniau in immutable-js/immutable-js#2213

Firefox link to non-French page by @jdeniau in immutable-js/immutable-js#2219

Bump esbuild and @size-limit/preset-small-lib by @dependabot[bot] in immutable-js/immutable-js#2217

backport tests from #2210 by @jdeniau in immutable-js/immutable-js#2214

Bump shell-quote from 1.8.2 to 1.8.4 by @dependabot[bot] in immutable-js/immutable-js#2211

Bump @tootallnate/once from 2.0.0 to 2.0.1 by @dependabot[bot] in immutable-js/immutable-js#2190

Bump minimatch from 9.0.5 to 9.0.9 by @dependabot[bot] in immutable-js/immutable-js#2189

Bump @codemirror/theme-one-dark from 6.1.2 to 6.1.3 by @dependabot[bot] in immutable-js/immutable-js#2168

Bump form-data from 4.0.5 to 4.0.6 by @dependabot[bot] in immutable-js/immutable-js#2220

Bump typescript-eslint from 8.33.0 to 8.61.1 by @dependabot[bot] in immutable-js/immutable-js#2222

Bump @rollup/plugin-commonjs from 28.0.2 to 29.0.3 by @dependabot[bot] in immutable-js/immutable-js#2224

New Contributors

@chatman-media made their first contribution in immutable-js/immutable-js#2227

Full Changelog: immutable-js/immutable-js@v5.1.6...v5.1.7

v5.1.6

What's Changed

fix(reverseFactory): read reversedSequence.size in __iterator instead of this by @jdeniau in immutable-js/immutable-js#2196

... (truncated)

Changelog

Sourced from immutable's changelog.

5.1.9

fix(List): a List grown past 32 elements while all its values are undefined no longer reads those values back as null (affected get, iteration, toArray, equals and hashCode)

5.1.8

fix(List): guard oversized bounds in setListBounds. Fixes CVE GHSA-v56q-mh7h-f735

perf(Map): index large hash-collision buckets for faster lookups. Fixes CVE GHSA-xvcm-6775-5m9r

4.3.9

fix(List): guard oversized bounds in setListBounds. Fixes CVE GHSA-v56q-mh7h-f735

perf(Map): index large hash-collision buckets for faster lookups. Fixes CVE GHSA-xvcm-6775-5m9r

5.1.7

fix(Repeat): lastIndexOf returned size instead of size - 1 by @chatman-media in immutable-js/immutable-js#2227. Fixes CVE CVE-2026-29063

fix(IndexedCollection): has(index) on a lazy Seq of unknown size now checks index existence instead of searching for a value equal to the index #2203

[TypeScript]: reduce/reduceRight without an initial value now infer the result type from the collection's values when the reducer returns a value (e.g. list.reduce((a, b) => a + b) infers number), matching Array#reduce. Previously an explicit type argument was required. #2205

5.1.6

fix(reverseFactory): read reversedSequence.size in __iterator instead of this #2196

Commits

329f7a6 5.1.9
21fabd9 changelog
009164f Merge pull request #2235 from immutable-js/fix/avoid-null-when-setsize33
5b65bfb fix(List): preserve undefined values when grown past 32 elements
50bf39e Update CHANGELOG.md for versions 5.1.8 and 4.3.9
6496539 5.1.8
808a83a Merge commit from fork
e51d49f perf(Map): index large hash-collision buckets for faster lookups
25c58b0 fix typescript in tests
a1a1ee4 Merge commit from fork
Additional commits viewable in compare view

Updates shell-quote from 1.8.3 to 1.10.0

Changelog

Sourced from shell-quote's changelog.

v1.10.0 - 2026-07-10

Merged

[New] parse: add opt-in splitUnquoted option for shell field-splitting of unquoted expansions [#1](https://github.com/ljharb/shell-quote/issues/1)

Commits

[Fix] parse: match nested ${...} braces so nested parameter expansion is consumed as one substitution c0842c8

[Tests] parse: pin single-quote literalness and unmatched-quote handling a0d03e3

[readme] remove the space in js code fences so evalmd evaluates them 2116fa3

[Tests] quote: pin conservative escaping of =, @, ^, ,, :, ! (#11) 1c36f3f

[readme] document that quote outputs POSIX quoting, not cmd.exe/PowerShell 100e96e

[readme] document parse's supported parameter-expansion subset e1c75cd

[Fix] parse: a backslash inside single quotes must not escape the closing quote 5d460a3

[readme] fix stale example outputs 2de86f5

[Tests] quote: pin that a backslash with whitespace is not doubled in single quotes (#14) 190e236

[readme] quote: use output verbatim; do not re-quote it (#11) 1b36468

[Refactor] parse: fix swapped SINGLE_QUOTE/DOUBLE_QUOTE variable names 801af5c

[types] fix an error TS v6 ignores but v7 fails on 59bbf8b

[Dev Deps] update @arethetypeswrong/cli, evalmd a04d475

[Dev Deps] update @arethetypeswrong/ci, eslint d390f9a

[Tests] quote: the tilde test escapes every ~, not just a leading one (#9) 617d119

v1.9.0 - 2026-06-24

Commits

[New] add types dca6e21

[Dev Deps] update eslint 9aa9e8f

[Fix] parse: finalize tokens in linear time (GHSA-395f-4hp3-45gv) 7ff5488

[actions] update workflows 75e8497

[actions] Windows + node 4/6/7: pin eslint to 9 before install, since npm 2/3 cannot stage eslint 10@types/esrecurse 3fb739d

[actions] retry npm install on Windows to survive npm 2/3 staging-rename flake abe0163

[actions] Windows + node 5/7: install deps with a modern node b4bafa2

[Fix] quote: escape leading ~ to prevent shell tilde-expansion 7a76c1a

[Dev Deps] update auto-changelog, tape 7184b44

[Dev Deps] apparently jackspeak is no longer in the graph 9ba368a

v1.8.4 - 2026-05-22

Commits

[Fix] quote: validate object-token shapes 4378a6e

[Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint, npmignore 22ebec0

[Tests] increase coverage 9f3caa3

[readme] replace runkit CI badge with shields.io check-runs badge 3344a04

[Dev Deps] update @ljharb/eslint-config 699c511

Commits

64988d9 v1.10.0
617d119 [Tests] quote: the tilde test escapes every ~, not just a leading one (#9)
59bbf8b [types] fix an error TS v6 ignores but v7 fails on
190e236 [Tests] quote: pin that a backslash with whitespace is not doubled in singl...
a04d475 [Dev Deps] update @arethetypeswrong/cli, evalmd
b9545b3 [New] parse: add opt-in splitUnquoted option for shell field-splitting of...
1b36468 [readme] quote: use output verbatim; do not re-quote it (#11)
1c36f3f [Tests] quote: pin conservative escaping of =, @, ^, ,, :, ! (#11)
e1c75cd [readme] document parse's supported parameter-expansion subset
c0842c8 [Fix] parse: match nested ${...} braces so nested parameter expansion is ...
Additional commits viewable in compare view

Updates tar from 7.5.13 to 7.5.22

Commits

2a22bfc 7.5.22
df1cd8d Allow transform to be falsey
0cd9cc3 7.5.21
631ae59 list: prevent unbounded recursion
ebbb720 7.5.20
2f27196 fix: fully disable and dispose of unzip when aborting parser
be440da 7.5.19
2812e93 add maxDecompressionRatio guard against explosive decompression
9ecd4d2 7.5.18
9e78bf0 refuse to let header size be less than 0
Additional commits viewable in compare view

Updates body-parser from 1.20.5 to 1.20.6

Release notes

Sourced from body-parser's releases.

1.20.6

Important: Security

Security fix for CVE-2026-12590 (GHSA-v422-hmwv-36x6)

What's Changed

fix: improve limit option validation by @Phillip9587 in expressjs/body-parser#741

Full Changelog: expressjs/body-parser@1.20.5...1.20.6

Changelog

Sourced from body-parser's changelog.

1.20.6 / 2026-07-09

Security fix for GHSA-v422-hmwv-36x6

fix: improve limit option validation (#698)

Invalid limit values (e.g. unparseable strings or NaN) now throw instead of being silently ignored, which previously disabled size limit enforcement

null and undefined fall back to the default 100kb limit

Commits

5cc4fb8 1.20.6 (#746)
3492672 fix: improve limit option validation (#741)
See full diff in compare view

Updates body-parser from 2.2.2 to 2.3.0

Release notes

Sourced from body-parser's releases.

1.20.6

Important: Security

Security fix for CVE-2026-12590 (GHSA-v422-hmwv-36x6)

What's Changed

fix: improve limit option validation by @Phillip9587 in expressjs/body-parser#741

Full Changelog: expressjs/body-parser@1.20.5...1.20.6

Changelog

Sourced from body-parser's changelog.

1.20.6 / 2026-07-09

Security fix for GHSA-v422-hmwv-36x6

fix: improve limit option validation (#698)

Invalid limit values (e.g. unparseable strings or NaN) now throw instead of being silently ignored, which previously disabled size limit enforcement

null and undefined fall back to the default 100kb limit

Commits

5cc4fb8 1.20.6 (#746)
3492672 fix: improve limit option validation (#741)
See full diff in compare view

Updates hono from 4.12.18 to 4.12.32

Release notes

Sourced from hono's releases.

v4.12.32

What's Changed

ci: enable reports for type & bundle size check in honojs/hono#5148

fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 in honojs/hono#5142

fix(sse): emit empty id field to reset Last-Event-ID in honojs/hono#5138

test(cloudflare-workers): add coverage for onClose, onError, send, and close in Cloudflare Workers websocket adapter in honojs/hono#5145

fix: use Object.create(null) when parsing query, headers, and params in honojs/hono#5161

fix(secure-headers): keep CSP callbacks scoped to their header in honojs/hono#5147

Full Changelog: honojs/hono@v4.12.31...v4.12.32

v4.12.31

What's Changed

test(context): assert case-insensitive header names in response helpers by @yusukebe in honojs/hono#5116

chore(benchmark): add app.fetch() overhead benchmark by @yusukebe in honojs/hono#5117

refactor(aws-lambada): remove FIXME in @ts-expect-error by @yusukebe in honojs/hono#5130

fix(utils/body): reuse cached formData in parseBody() by @yusukebe in honojs/hono#5131

fix(request): fix multipart boundary mismatch in cloneRawRequest by @yusukebe in honojs/hono#5133

fix(sse): emit retry feild when retry is 0 by @yusukebe in honojs/hono#5135

test(validator): fix misspelled identifier in transform type test by @yusukebe in honojs/hono#5136

Full Changelog: honojs/hono@v4.12.30...v4.12.31

v4.12.30

What's Changed

chore(benchmark/routers): bump deps in honojs/hono#5107

chore(benchmark): remove not used benchmarks in honojs/hono#5108

chore: update to ts6 in prep for ts7 in honojs/hono#5104

fix(cache): deduplicate Cache-Control directives case-insensitively in honojs/hono#5025

fix(compress): do not compress 206 Partial Content responses in honojs/hono#5020

fix(client): replaceUrlParam should not match a param that prefixes another in honojs/hono#5096

fix(method-override): set duplex when forwarding a stream body in query mode in honojs/hono#5110

Full Changelog: honojs/hono@v4.12.29...v4.12.30

v4.12.29

What's Changed

fix(client): merge function headers with per-request headers by @yusukebe in honojs/hono#5092

chore: fix no-op tsc in test script by @yusukebe in honojs/hono#5093

fix(lambda-edge): resolve the handler with the value passed to the callback by @yusukebe in honojs/hono#5094

docs(language): add JSDoc @example to languageDetector by @codebybilal18 in honojs/hono#5081

test(workerd): add compatibilityDate by @yusukebe in honojs/hono#5100

fix(lambda-edge): base64 encode content-encoded response bodies by @yusukebe in honojs/hono#5099

fix(aws-lambda): treat any non-identity content-encoding as binary by @yusukebe in honojs/hono#5101

fix(types): strip extra properties from array types in JSONParsed by @Arman-Luthra in honojs/hono#5103

fix(trie-router): match empty wildcard remainder after regexp param by @usualoma in honojs/hono#5102

fix(etag): treat If-None-Match: * as a match by @yusukebe in honojs/hono#5084

New Contributors

@codebybilal18 made their first contribution in honojs/hono#5081

... (truncated)

Commits

26d8e42 4.12.32
402eb3a fix(secure-headers): keep CSP callbacks scoped to their header (#5147)
c85aead fix: use Object.create(null) when parsing query, headers, and params (#5161)
a88c89d test(cloudflare-workers): add coverage for onClose, onError, send, and close ...
44f8843 fix(sse): emit empty id field to reset Last-Event-ID (#5138)
e36f57d fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 (#5142)
bf8608c ci: enable reports for type & bundle size check (#5148)
cadff88 4.12.31
64c613a test(validator): fix misspelled identifier in transform type test (#5136)
aeba9ec fix(sse): emit retry feild when retry is 0 (#5135)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for hono since your current version.

Updates immutable from 5.1.5 to 5.1.9

Release notes

Sourced from immutable's releases.

v5.1.9

What's Changed

fix(List): preserve undefined values when grown past 32 elements by @spokodev / @jdeniau in immutable-js/immutable-js#2235 (originated from immutable-js/immutable-js#2230 )

Full Changelog: immutable-js/immutable-js@v5.1.8...v5.1.9

v5.1.8

What's Changed

fix(List): guard oversized bounds in setListBounds. Fixes CVE GHSA-v56q-mh7h-f735

perf(Map): index large hash-collision buckets for faster lookups. Fixes CVE GHSA-xvcm-6775-5m9r

Full Changelog: immutable-js/immutable-js@v5.1.7...v5.1.8

v5.1.7

What's Changed

fix(Repeat): lastIndexOf returned size instead of size - 1 by @chatman-media in immutable-js/immutable-js#2227

internal

Backport tests from 6.x branch by @jdeniau in immutable-js/immutable-js#2199

fix(IndexedCollection): has(index) on a lazy Seq of unknown size now checks index existence instead of searching for a value equal to the index by @jdeniau in immutable-js/immutable-js#2203

Better type for reduce if not ininitial value is given by @jdeniau in immutable-js/immutable-js#2205

Backport test from #2193 by @jdeniau in immutable-js/immutable-js#2207

backport tests from 6.x by @jdeniau in immutable-js/immutable-js#2213

Firefox link to non-French page by @jdeniau in immutable-js/immutable-js#2219

Bump esbuild and @size-limit/preset-small-lib by @dependabot[bot] in immutable-js/immutable-js#2217

backport tests from #2210 by @jdeniau in immutable-js/immutable-js#2214

Bump shell-quote from 1.8.2 to 1.8.4 by @dependabot[bot] in immutable-js/immutable-js#2211

Bump @tootallnate/once from 2.0.0 to 2.0.1 by @dependabot[bot] in immutable-js/immutable-js#2190

Bump minimatch from 9.0.5 to 9.0.9 by @dependabot[bot] in immutable-js/immutable-js#2189

Bump @codemirror/theme-one-dark from 6.1.2 to 6.1.3 by @dependabot[bot] in immutable-js/immutable-js#2168

Bump form-data from 4.0.5 to 4.0.6 by @dependabot[bot] in immutable-js/immutable-js#2220

Bump typescript-eslint from 8.33.0 to 8.61.1 by @dependabot[bot] in immutable-js/immutable-js#2222

Bump @rollup/plugin-commonjs from 28.0.2 to 29.0.3 by @dependabot[bot] in immutable-js/immutable-js#2224

New Contributors

@chatman-media made their first contribution in immutable-js/immutable-js#2227

Full Changelog: immutable-js/immutable-js@v5.1.6...v5.1.7

v5.1.6

What's Changed

fix(reverseFactory): read reversedSequence.size in __iterator instead of this by @jdeniau in immutable-js/immutable-js#2196

... (truncated)

Changelog

Sourced from immutable's changelog.

5.1.9

fix(List): a List grown past 32 elements while all its values are undefined no longer reads those values back as null (affected get, iteration, toArray, equals and hashCode)

5.1.8

fix(List): guard oversized bounds in setListBounds. Fixes CVE GHSA-v56q-mh7h-f735

perf(Map): index large hash-collision buckets for faster lookups. Fixes CVE GHSA-xvcm-6775-5m9r

4.3.9

fix(List): guard oversized bounds in setListBounds. Fixes CVE GHSA-v56q-mh7h-f735

perf(Map): index large hash-collision buckets for faster lookups. Fixes CVE GHSA-xvcm-6775-5m9r

5.1.7

fix(Repeat): lastIndexOf returned size instead of size - 1 by @chatman-media in immutable-js/immutable-js#2227. Fixes CVE CVE-2026-29063

fix(IndexedCollection): has(index) on a lazy Seq of unknown size now checks index existence instead of searching for a value equal to the index #2203

[TypeScript]: reduce/reduceRight without an initial value now infer the result type from the collection's values when the reducer returns a value (e.g. list.reduce((a, b) => a + b) infers number), matching Array#reduce. Previously an explicit type argument was required. #2205

5.1.6
Description has been truncated

…1 updates Bumps the npm_and_yarn group with 5 updates in the /angular-spring-ui directory: | Package | From | To | | --- | --- | --- | | [body-parser](https://github.com/expressjs/body-parser) | `1.20.5` | `1.20.6` | | [body-parser](https://github.com/expressjs/body-parser) | `2.2.2` | `2.3.0` | | [hono](https://github.com/honojs/hono) | `4.12.18` | `4.12.32` | | [immutable](https://github.com/immutable-js/immutable-js) | `5.1.5` | `5.1.9` | | [shell-quote](https://github.com/ljharb/shell-quote) | `1.8.3` | `1.10.0` | | [tar](https://github.com/isaacs/node-tar) | `7.5.13` | `7.5.22` | Bumps the npm_and_yarn group with 5 updates in the /angular-ui directory: | Package | From | To | | --- | --- | --- | | [body-parser](https://github.com/expressjs/body-parser) | `1.20.5` | `1.20.6` | | [body-parser](https://github.com/expressjs/body-parser) | `2.2.2` | `2.3.0` | | [hono](https://github.com/honojs/hono) | `4.12.18` | `4.12.32` | | [immutable](https://github.com/immutable-js/immutable-js) | `5.1.5` | `5.1.9` | | [shell-quote](https://github.com/ljharb/shell-quote) | `1.8.3` | `1.10.0` | | [tar](https://github.com/isaacs/node-tar) | `7.5.13` | `7.5.22` | Bumps the npm_and_yarn group with 2 updates in the /api directory: [@hono/node-server](https://github.com/honojs/node-server) and [body-parser](https://github.com/expressjs/body-parser). Bumps the npm_and_yarn group with 3 updates in the /hono-api directory: [brace-expansion](https://github.com/juliangruber/brace-expansion), [@hono/node-server](https://github.com/honojs/node-server) and [hono](https://github.com/honojs/hono). Bumps the npm_and_yarn group with 3 updates in the /lambda-api directory: [brace-expansion](https://github.com/juliangruber/brace-expansion), [@hono/node-server](https://github.com/honojs/node-server) and [hono](https://github.com/honojs/hono). Bumps the npm_and_yarn group with 1 update in the /lambda-api/cdk directory: [aws-cdk-lib](https://github.com/aws/aws-cdk/tree/HEAD/packages/aws-cdk-lib). Bumps the npm_and_yarn group with 2 updates in the /lambda-react-ui directory: [brace-expansion](https://github.com/juliangruber/brace-expansion) and [js-yaml](https://github.com/nodeca/js-yaml). Bumps the npm_and_yarn group with 1 update in the /nest-history-api directory: [brace-expansion](https://github.com/juliangruber/brace-expansion). Bumps the npm_and_yarn group with 4 updates in the /nuxt-api directory: [brace-expansion](https://github.com/juliangruber/brace-expansion), [shell-quote](https://github.com/ljharb/shell-quote), [tar](https://github.com/isaacs/node-tar) and [svgo](https://github.com/svg/svgo). Bumps the npm_and_yarn group with 1 update in the /react-ui directory: [brace-expansion](https://github.com/juliangruber/brace-expansion). Bumps the npm_and_yarn group with 1 update in the /tanstack-start-ui directory: [brace-expansion](https://github.com/juliangruber/brace-expansion). Bumps the npm_and_yarn group with 1 update in the /ui directory: [next](https://github.com/vercel/next.js). Bumps the npm_and_yarn group with 2 updates in the /yoga-api directory: [brace-expansion](https://github.com/juliangruber/brace-expansion) and [@hono/node-server](https://github.com/honojs/node-server). Updates `body-parser` from 1.20.5 to 1.20.6 - [Release notes](https://github.com/expressjs/body-parser/releases) - [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md) - [Commits](expressjs/body-parser@1.20.5...1.20.6) Updates `body-parser` from 2.2.2 to 2.3.0 - [Release notes](https://github.com/expressjs/body-parser/releases) - [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md) - [Commits](expressjs/body-parser@1.20.5...1.20.6) Updates `hono` from 4.12.18 to 4.12.32 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.18...v4.12.32) Updates `immutable` from 5.1.5 to 5.1.9 - [Release notes](https://github.com/immutable-js/immutable-js/releases) - [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md) - [Commits](immutable-js/immutable-js@v5.1.5...v5.1.9) Updates `shell-quote` from 1.8.3 to 1.10.0 - [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md) - [Commits](ljharb/shell-quote@v1.8.3...v1.10.0) Updates `tar` from 7.5.13 to 7.5.22 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v7.5.13...v7.5.22) Updates `body-parser` from 1.20.5 to 1.20.6 - [Release notes](https://github.com/expressjs/body-parser/releases) - [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md) - [Commits](expressjs/body-parser@1.20.5...1.20.6) Updates `body-parser` from 2.2.2 to 2.3.0 - [Release notes](https://github.com/expressjs/body-parser/releases) - [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md) - [Commits](expressjs/body-parser@1.20.5...1.20.6) Updates `hono` from 4.12.18 to 4.12.32 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.18...v4.12.32) Updates `immutable` from 5.1.5 to 5.1.9 - [Release notes](https://github.com/immutable-js/immutable-js/releases) - [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md) - [Commits](immutable-js/immutable-js@v5.1.5...v5.1.9) Updates `shell-quote` from 1.8.3 to 1.10.0 - [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md) - [Commits](ljharb/shell-quote@v1.8.3...v1.10.0) Updates `tar` from 7.5.13 to 7.5.22 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v7.5.13...v7.5.22) Removes `@hono/node-server` Updates `body-parser` from 2.2.2 to 2.3.0 - [Release notes](https://github.com/expressjs/body-parser/releases) - [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md) - [Commits](expressjs/body-parser@1.20.5...1.20.6) Updates `brace-expansion` from 5.0.5 to 5.0.8 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v5.0.5...v5.0.8) Updates `@hono/node-server` from 2.0.0 to 2.0.10 - [Release notes](https://github.com/honojs/node-server/releases) - [Commits](https://github.com/honojs/node-server/commits) Updates `hono` from 4.12.15 to 4.12.32 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.18...v4.12.32) Updates `brace-expansion` from 5.0.5 to 5.0.8 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v5.0.5...v5.0.8) Updates `@hono/node-server` from 2.0.0 to 2.0.10 - [Release notes](https://github.com/honojs/node-server/releases) - [Commits](https://github.com/honojs/node-server/commits) Updates `hono` from 4.12.15 to 4.12.32 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.18...v4.12.32) Updates `aws-cdk-lib` from 2.254.0 to 2.260.0 - [Release notes](https://github.com/aws/aws-cdk/releases) - [Changelog](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.alpha.md) - [Commits](https://github.com/aws/aws-cdk/commits/v2.260.0/packages/aws-cdk-lib) Updates `brace-expansion` from 1.1.13 to 1.1.16 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v5.0.5...v5.0.8) Updates `js-yaml` from 4.1.1 to 4.3.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.1...4.3.0) Updates `brace-expansion` from 5.0.6 to 5.0.8 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v5.0.5...v5.0.8) Updates `brace-expansion` from 2.0.3 to 2.1.2 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v5.0.5...v5.0.8) Updates `shell-quote` from 1.8.3 to 1.10.0 - [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md) - [Commits](ljharb/shell-quote@v1.8.3...v1.10.0) Updates `tar` from 7.5.13 to 7.5.22 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v7.5.13...v7.5.22) Updates `svgo` from 4.0.1 to 4.0.2 - [Release notes](https://github.com/svg/svgo/releases) - [Commits](svg/svgo@v4.0.1...v4.0.2) Updates `brace-expansion` from 5.0.5 to 5.0.8 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v5.0.5...v5.0.8) Updates `brace-expansion` from 5.0.5 to 5.0.8 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v5.0.5...v5.0.8) Updates `next` from 16.2.6 to 16.2.11 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.2.6...v16.2.11) Updates `brace-expansion` from 5.0.5 to 5.0.8 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v5.0.5...v5.0.8) Removes `@hono/node-server` --- updated-dependencies: - dependency-name: body-parser dependency-version: 1.20.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: body-parser dependency-version: 2.3.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.12.32 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: immutable dependency-version: 5.1.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: shell-quote dependency-version: 1.10.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tar dependency-version: 7.5.22 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: body-parser dependency-version: 1.20.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: body-parser dependency-version: 2.3.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.12.32 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: immutable dependency-version: 5.1.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: shell-quote dependency-version: 1.10.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tar dependency-version: 7.5.22 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@hono/node-server" dependency-version: dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: body-parser dependency-version: 2.3.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 5.0.8 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@hono/node-server" dependency-version: 2.0.10 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.12.32 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 5.0.8 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@hono/node-server" dependency-version: 2.0.10 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.12.32 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: aws-cdk-lib dependency-version: 2.260.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.16 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.3.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 5.0.8 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 2.1.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: shell-quote dependency-version: 1.10.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tar dependency-version: 7.5.22 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: svgo dependency-version: 4.0.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 5.0.8 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 5.0.8 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: next dependency-version: 16.2.11 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 5.0.8 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@hono/node-server" dependency-version: dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-07-28T05:38:51Z

Superseded by #369.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 28, 2026

dependabot Bot closed this Jul 28, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/angular-spring-ui/npm_and_yarn-4c989b83a4 branch July 28, 2026 05:38

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): Bump the npm_and_yarn group across 13 directories with 11 updates - #368

chore(deps): Bump the npm_and_yarn group across 13 directories with 11 updates#368
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/angular-spring-ui/npm_and_yarn-4c989b83a4

dependabot Bot commented on behalf of github Jul 28, 2026

Uh oh!

dependabot Bot commented on behalf of github Jul 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Jul 28, 2026

1.20.6

Important: Security

What's Changed

1.20.6 / 2026-07-09

1.20.6

Important: Security

What's Changed

1.20.6 / 2026-07-09

v4.12.32

What's Changed

v4.12.31

What's Changed

v4.12.30

What's Changed

v4.12.29

What's Changed

New Contributors

v5.1.9

What's Changed

v5.1.8

What's Changed

v5.1.7

What's Changed

internal

New Contributors

v5.1.6

What's Changed

5.1.9

5.1.8

4.3.9

5.1.7

5.1.6

v1.10.0 - 2026-07-10

Merged

Commits

v1.9.0 - 2026-06-24

Commits

v1.8.4 - 2026-05-22

Commits

1.20.6

Important: Security

What's Changed

1.20.6 / 2026-07-09

1.20.6

Important: Security

What's Changed

1.20.6 / 2026-07-09

v4.12.32

What's Changed

v4.12.31

What's Changed

v4.12.30

What's Changed

v4.12.29

What's Changed

New Contributors

v5.1.9

What's Changed

v5.1.8

What's Changed

v5.1.7

What's Changed

internal

New Contributors

v5.1.6

What's Changed

5.1.9

5.1.8

4.3.9

5.1.7

5.1.6

Uh oh!

dependabot Bot commented on behalf of github Jul 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects