Skip to content

chore(deps): bump the npm_and_yarn group across 3 directories with 12 updates - #31

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-a57738279b
Open

chore(deps): bump the npm_and_yarn group across 3 directories with 12 updates#31
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-a57738279b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 7 updates in the / directory:

Package From To
axios 1.16.0 1.19.0
sharp 0.34.5 0.35.0
electron 41.5.0 41.10.3
brace-expansion 1.1.14 1.1.18
app-builder-lib 26.7.0 26.15.3
builder-util-runtime 9.5.1 9.7.0
shell-quote 1.8.4 1.9.0

Bumps the npm_and_yarn group with 6 updates in the /config directory:

Package From To
axios 1.16.0 1.19.0
electron 41.5.0 41.10.3
brace-expansion 1.1.14 1.1.18
app-builder-lib 26.7.0 26.15.3
builder-util-runtime 9.5.1 9.7.0
shell-quote 1.8.4 1.9.0

Bumps the npm_and_yarn group with 7 updates in the /creative-studio-ui directory:

Package From To
axios 1.16.0 1.18.0
electron 40.9.3 41.10.3
brace-expansion 1.1.14 1.1.18
js-yaml 4.3.0 4.3.1
postcss 8.5.13 8.5.26
dompurify 3.4.11 3.4.13
react-router 7.18.1 7.18.2

Updates axios from 1.16.0 to 1.19.0

Release notes

Sourced from axios's releases.

v1.19.0 - July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

  • Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

🚀 New Features

  • Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers. (#11043, #11081)
  • Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)
  • HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)

🐛 Bug Fixes

  • Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)
  • Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)
  • Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)
  • Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)
  • URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11024, #11038)
  • Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)
  • Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (#11044, #11059)
  • Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (#11061)
  • Synchronous Interceptors: Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (#11071)

🔧 Maintenance & Chores

  • Dependencies: Updated development and test tooling, the docs fixture's Axios version, and GitHub Actions integrations including Checkout, Setup Node, Setup Deno, and Zizmor. (#11031, #11055, #11056, #11058, #11079, #11080, #11088, #11089, #11090)
  • Build Outputs: Limited sourcemap generation to published minified bundles, removing broken map references from non-minified builds. (#11054)
  • Form Data Internals: Centralized FormData header handling and made the Node.js adapter tolerate getHeaders() returning undefined under the content-only policy. (#11062)
  • Developer Experience: Ignored common local AI-tooling directories and fixed a constant-reassignment crash when the development sandbox serves its root path. (#11032, #11073)
  • Documentation: Updated sponsor information, clarified that baseURL is not a path-security boundary, scoped provenance claims to attested releases, and corrected the configuration-defaults documentation. (#11041, #11068, #11076, #11078)
  • Publishing: Simplified v1 publishing to use the npm version bundled with Node.js 26 and updated package metadata for the 1.19.0 release. (#11083, #11095)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve Axios:

... (truncated)

Changelog

Sourced from axios's changelog.

v1.19.0 — July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

  • Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

🚀 New Features

  • Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers. (#11043, #11081)
  • Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)
  • HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)

🐛 Bug Fixes

  • Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)

  • Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)

  • Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)

  • Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)

  • URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11008, #11038)

  • Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)

  • Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (#11044, #11059)

  • Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (#11061)

  • Synchronous Interceptors: Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (#11071)

🔧 Maintenance & Chores

  • Dependencies: Updated development and test tooling, the docs fixture's Axios version, and GitHub Actions integrations including Checkout, Setup Node, Setup Deno, and Zizmor. (#11031, #11055, #11056, #11058, #11079, #11080, #11088, #11089, #11090)
  • Build Outputs: Limited sourcemap generation to published minified bundles, removing broken map references from non-minified builds. (#11054)
  • Form Data Internals: Centralized FormData header handling and made the Node.js adapter tolerate getHeaders() returning undefined under the content-only policy. (#11062)
  • Developer Experience: Ignored common local AI-tooling directories and fixed a constant-reassignment crash when the development sandbox serves its root path. (#11032, #11073)
  • Documentation: Updated sponsor information, clarified that baseURL is not a path-security boundary, scoped provenance claims to attested releases, and corrected the configuration-defaults documentation. (#11041, #11068, #11076, #11078)
  • Publishing: Simplified v1 publishing to use the npm version bundled with Node.js 26 and updated package metadata for the 1.19.0 release. (#11083, #11095)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve Axios:

... (truncated)

Commits
  • 311fcc5 chore(release): prepare release 1.19.0 (#11095)
  • cb4fd74 chore(deps): bump axios from 1.16.1 to 1.18.1 in /docs (#11088)
  • 004c93a chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 in the github-action...
  • 122edde chore(deps-dev): bump the development_dependencies group with 3 updates (#11089)
  • c44f8d0 ci: use bundled npm for v1 publish (#11083)
  • 878bb29 fix(sandbox): resolve TypeError on constant variable path assignment (#11073)
  • a092bae fix(core): synchronous interceptors swallow errors and proceed with request (...
  • 3041b8f feat(HttpStatusCode): add missing 520 status code (#11067)
  • 58b16c8 refactor(helpers): extract duplicated setFormDataHeaders into a shared helper...
  • 3077e62 feat(types): Allow the Params property to be typed, instead of any (#11081)
  • Additional commits viewable in compare view

Updates sharp from 0.34.5 to 0.35.0

Release notes

Sourced from sharp's releases.

v0.35.0

  • Breaking: Drop support for Node.js 18, now requires Node.js >= 20.9.0.

  • Breaking: Remove install script from package.json file. Compiling from source is now opt-in via the build script.

  • Breaking: Lossy AVIF output is now tuned using SSIMULACRA2-based iq quality metrics.

  • Breaking: Add limitInputChannels with a default value of 5.

  • Breaking: Remove deprecated failOnError constructor property.

  • Breaking: Remove deprecated paletteBitDepth from metadata response.

  • Breaking: Remove deprecated properties from sharpen operation.

  • Breaking: Rename format.jp2k as format.jp2 for API consistency.

  • Upgrade to libvips v8.18.3 for upstream bug fixes.

  • Remove experimental status from WebAssembly binaries.

  • Add prebuilt binaries for FreeBSD (WebAssembly).

  • Deprecate Windows 32-bit (win32-ia32) prebuilt binaries.

  • Ensure TIFF output bitdepth option is limited to 1, 2 or 4.

  • Add AVIF/HEIF tune option for control over quality metrics. #4227

  • Add keepGainMap and withGainMap to process HDR JPEG images with embedded gain maps. #4314

  • Add toUint8Array for output image as a TypedArray backed by a transferable ArrayBuffer. #4355

  • Require prebuilt binaries using static paths to aid code bundling. #4380

  • TypeScript: Ensure FormatEnum keys match reality. #4475

  • Add margin option to trim operation. #4480 @​eddienubes

  • Ensure HEIF primary item is used as default page/frame. #4487

... (truncated)

Commits
  • 2ed5af4 Release v0.35.0
  • 4475cf1 Tests: update locator hash for sharp-libvips v1.3.0
  • deb22dd Upgrade to sharp-libvips v1.3.0
  • 07f1be9 Prerelease v0.35.0-rc.8
  • df1109b Prerelease v0.35.0-rc.7
  • aca49b3 Upgrade to libvips v8.18.3
  • e9e86f5 Type-check density option before range validation (#4536)
  • 2f0bcf0 Docs: update supported image formats
  • 98e03b8 Revert "Guard heif bitdepth property for prebuilt binaries"
  • e4ea2f3 CI: Ignore package minimum age in smoke tests
  • Additional commits viewable in compare view

Updates electron from 41.5.0 to 41.10.3

Release notes

Sourced from electron's releases.

electron v41.10.3

Release Notes for v41.10.3

Fixes

  • Fixed app.disableHardwareAcceleration() not fully disabling GPU hardware usage on Windows starting from Electron 38. #52368 (Also in 42, 43, 44)
  • Fixed unnecessary autofill popup creation for fields without datalist suggestions, which could cause input latency on macOS. #52320 (Also in 42, 43, 44)

Other Changes

  • Backported fixes from upstream Chromium and V8. #52396

electron v41.10.2

Release Notes for v41.10.2

Fixes

  • Fixed a renderer crash when calling WebAssembly.compileStreaming() or WebAssembly.instantiateStreaming() with nodeIntegration enabled. #52240 (Also in 42, 43)

Other Changes

  • Backported fixes from upstream Chromium. #52304

electron v41.10.1

Release Notes for v41.10.1

Fixes

  • Fixed crash triggered by replacing an open application menu. #52278 (Also in 42, 43, 44)

electron v41.10.0

Release Notes for v41.10.0

Other Changes

  • Backported fixes from upstream Chromium, ANGLE, Dawn, Skia, and V8. #52231
  • Updated Node.js to v24.18.0. #52104

electron v41.9.2

Release Notes for v41.9.2

Fixes

  • Fixed an issue where clicking the maximize button could progressively shrink the window in some Wayland environments. #52074 (Also in 42, 43)

electron v41.9.1

Release Notes for v41.9.1

Fixes

  • Fixed ProtocolResponse.url requests being made through the default session instead of the session the protocol handler was registered on when ProtocolResponse.session was not set. #52134 (Also in 40, 42, 43)
  • Made "reload" menu items work with BaseWindow. #52118 (Also in 42, 43)

... (truncated)

Commits

Updates brace-expansion from 1.1.14 to 1.1.18

Release notes

Sourced from brace-expansion's releases.

v1.1.15

  • Backport v5.0.6 change to v1 (#111) 0b09384

juliangruber/brace-expansion@v1.1.14...v1.1.15

Commits

Updates app-builder-lib from 26.7.0 to 26.15.3

Release notes

Sourced from app-builder-lib's releases.

electron-builder@26.15.3

What's Changed

Full Changelog: https://github.com/electron-userland/electron-builder/compare/electron-builder@26.15.2...electron-builder@26.15.3

electron-builder@26.15.2

What's Changed

Full Changelog: https://github.com/electron-userland/electron-builder/compare/electron-builder@26.15.1...electron-builder@26.15.2

electron-builder@26.15.1

What's Changed

Full Changelog: https://github.com/electron-userland/electron-builder/compare/electron-builder@26.15.0...electron-builder@26.15.1

electron-builder@26.15.0

What's Changed

Full Changelog: https://github.com/electron-userland/electron-builder/compare/electron-builder@26.14.0...electron-builder@26.15.0

... (truncated)

Changelog

Sourced from app-builder-lib's changelog.

26.15.3

Patch Changes

818a89f 35bfdeb

  • electron-publish@26.15.3
  • builder-util@26.15.3
  • dmg-builder@26.15.3
  • electron-builder-squirrel-windows@26.15.3

26.15.2

Patch Changes

  • dmg-builder@26.15.2
  • electron-builder-squirrel-windows@26.15.2

26.15.1

Patch Changes

... (truncated)

Commits
  • 512a57e chore(deploy): Release v26.15.3 (#9858)
  • 9097daf fix(download): persist toolset archives in a predictable cache path (#9861)
  • 35bfdeb fix: add ELECTRON_BUILDER_BINARIES_ALLOW_HTTP opt-in for parsing env vars t...
  • a6117b3 chore(deploy): Release v26.15.2 (#9848)
  • f5ae163 fix(icons): replace png2icons with wasm-vips Lanczos3 resampling for high-qua...
  • 3951024 fix: retry package install on transient network errors (#9850)
  • e25f967 fix(mac): use native zip for macOS zip target to preserve .framework syml...
  • d57f094 chore(deploy): Release v26.15.1 (#9842)
  • db5d2f4 chore(deps): update and unpin @electron/rebuild package (#9845)
  • acd903e fix: ci:validate packages (#9838)
  • Additional commits viewable in compare view

Updates builder-util-runtime from 9.5.1 to 9.7.0

Changelog

Sourced from builder-util-runtime's changelog.

9.7.0

Minor Changes

Patch Changes

9.6.3

Patch Changes

9.6.2

Patch Changes

9.6.1

Patch Changes

9.6.0

Minor Changes

Commits

Updates shell-quote from 1.8.4 to 1.9.0

Changelog

Sourced from shell-quote's changelog.

v1.9.0 - 2026-06-24

Commits

  • [New] add types dca6e21
  • [Dev Deps] update eslint 9aa9e8f
  • [Fix] parse: finalize tokens in linear time (GHSA-395f-4hp3-45gv) 7ff5488
  • [actions] update workflows 75e8497
  • [actions] Windows + node 4/6/7: pin eslint to 9 before install, since npm 2/3 cannot stage eslint 10@types/esrecurse 3fb739d
  • [actions] retry npm install on Windows to survive npm 2/3 staging-rename flake abe0163
  • [actions] Windows + node 5/7: install deps with a modern node b4bafa2
  • [Fix] quote: escape leading ~ to prevent shell tilde-expansion 7a76c1a
  • [Dev Deps] update auto-changelog, tape 7184b44
  • [Dev Deps] apparently jackspeak is no longer in the graph 9ba368a
Commits
  • db09fc7 v1.9.0
  • 7ff5488 [Fix] parse: finalize tokens in linear time (GHSA-395f-4hp3-45gv)
  • b4bafa2 [actions] Windows + node 5/7: install deps with a modern node
  • 3fb739d [actions] Windows + node 4/6/7: pin eslint to 9 before install, since npm 2/3...
  • abe0163 [actions] retry npm install on Windows to survive npm 2/3 staging-rename flake
  • 7a76c1a [Fix] quote: escape leading ~ to prevent shell tilde-expansion
  • 75e8497 [actions] update workflows
  • dca6e21 [New] add types
  • 9aa9e8f [Dev Deps] update eslint
  • 9ba368a [Dev Deps] apparently jackspeak is no longer in the graph
  • Additional commits viewable in compare view

Updates undici from 7.28.0 to 6.28.0

Commits
  • 01a912e Bumped v6.28.0 (#5591)
  • 481ecfc Use Node 22 and npm 11 to release
  • 740a0b7 fix: validate blob body content type
  • 2698e49 fix: validate coerced header values for CRLF (#5579)
  • 4fd5a0c test(retry): correct broken content-range fixtures in retry-handler.js
  • cba3a52 fix(retry): reject partial content length mismatch
  • af74840 fix: harden cookie domain, path, and unparsed attribute validation
  • 551138c Bumped v6.27.0 (#5431)
  • b7f252e Backport WebSocket maxPayloadSize fixes to v7.x (#5423) (#5428)
  • 25efa44 fix(cookies): preserve values and parse SameSite strictly
  • Additional commits viewable in compare view

Updates electron from 41.5.0 to 41.10.3

Release notes

<...

Description has been truncated

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 12, 2026
@zedarvates ChatGPT Codex Connector

zedarvates commented Aug 13, 2026

Copy link
Copy Markdown
Owner

Dependency validation report — do not merge yet

This PR substantially reduces the current npm exposure, but it is a grouped major/minor upgrade across three trees and does not yet have complete regression proof.

Security result after clean lockfile installs

  • root: 4 vulnerable packages remain (1 low, 1 moderate, 2 high): @babel/core, joi, js-yaml, undici;
  • /config: 3 remain (1 low, 1 moderate, 1 high): @babel/core, joi, js-yaml;
  • /creative-studio-ui: 1 low remains: @babel/core.

This is a large improvement over the current #32/#33 trees (20 vulnerabilities at root and 18 in /config), but it is not a zero-vulnerability result.

Validated resolved/runtime versions:

  • root: Axios 1.19.0, Sharp 0.35.0 / libvips 8.18.3, Electron 41.10.3, app-builder-lib 26.15.3, builder-util-runtime 9.7.0, shell-quote 1.9.0;
  • config: Axios 1.19.0 and Electron/build tooling at the updated versions;
  • UI: Axios 1.18.0, Electron 41.10.3, PostCSS 8.5.26, React Router 7.18.2, js-yaml 4.3.1.

ip-address is no longer present in the installed root/config/UI trees, so this grouped update would supersede #32/#33 for that transitive dependency if it eventually passes all gates.

Validation evidence

  • clean installs succeeded in all three directories;
  • root CLI TypeScript build passed;
  • updated Axios, Sharp and Electron packages load and report the expected versions;
  • Sonar Quality Gate passed with 0 new issues/hotspots.

Existing repository blockers (not introduced by this PR)

  • Electron TypeScript build fails because tracked electron/main.ts imports missing/untracked electron/SplashWindow;
  • UI Vite build fails because tracked AppProviders.tsx imports missing/untracked src/providers/ComfyUIProvider;
  • /config currently contains no Jest tests and its tsconfig matches no source files;
  • the broad root Jest run and a targeted two-suite run exceeded bounded validation windows; neither produced a green result.

Therefore the PR is security-positive but not fully regression-validated. Keep it unmerged until the missing tracked files/base defects are resolved and the complete root/UI/config build and test matrix is green.

This was referenced Aug 13, 2026
Merged
Merged
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/npm_and_yarn-a57738279b branch from 29c7fd1 to f113cfc Compare August 13, 2026 11:14
@dependabot
chore(deps): bump the npm_and_yarn group across 3 directories with 12…
0849c55 
… updates

Bumps the npm_and_yarn group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [axios](https://github.com/axios/axios) | `1.16.0` | `1.19.0` |
| [sharp](https://github.com/lovell/sharp) | `0.34.5` | `0.35.0` |
| [electron](https://github.com/electron/electron) | `41.5.0` | `41.10.3` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.14` | `1.1.18` |
| [app-builder-lib](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/app-builder-lib) | `26.7.0` | `26.15.3` |
| [builder-util-runtime](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/builder-util-runtime) | `9.5.1` | `9.7.0` |
| [shell-quote](https://github.com/ljharb/shell-quote) | `1.8.4` | `1.9.0` |

Bumps the npm_and_yarn group with 6 updates in the /config directory:

| Package | From | To |
| --- | --- | --- |
| [axios](https://github.com/axios/axios) | `1.16.0` | `1.19.0` |
| [electron](https://github.com/electron/electron) | `41.5.0` | `41.10.3` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.14` | `1.1.18` |
| [app-builder-lib](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/app-builder-lib) | `26.7.0` | `26.15.3` |
| [builder-util-runtime](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/builder-util-runtime) | `9.5.1` | `9.7.0` |
| [shell-quote](https://github.com/ljharb/shell-quote) | `1.8.4` | `1.9.0` |

Bumps the npm_and_yarn group with 7 updates in the /creative-studio-ui directory:

| Package | From | To |
| --- | --- | --- |
| [axios](https://github.com/axios/axios) | `1.16.0` | `1.18.0` |
| [electron](https://github.com/electron/electron) | `40.9.3` | `41.10.3` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.14` | `1.1.18` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `4.3.0` | `4.3.1` |
| [postcss](https://github.com/postcss/postcss) | `8.5.13` | `8.5.26` |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.4.11` | `3.4.13` |
| [react-router](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router) | `7.18.1` | `7.18.2` |



Updates `axios` from 1.16.0 to 1.19.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.16.0...v1.19.0)

Updates `sharp` from 0.34.5 to 0.35.0
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](lovell/sharp@v0.34.5...v0.35.0)

Updates `electron` from 41.5.0 to 41.10.3
- [Release notes](https://github.com/electron/electron/releases)
- [Commits](electron/electron@v41.5.0...v41.10.3)

Updates `brace-expansion` from 1.1.14 to 1.1.18
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.14...v1.1.18)

Updates `app-builder-lib` from 26.7.0 to 26.15.3
- [Release notes](https://github.com/electron-userland/electron-builder/releases)
- [Changelog](https://github.com/electron-userland/electron-builder/blob/master/packages/app-builder-lib/CHANGELOG.md)
- [Commits](https://github.com/electron-userland/electron-builder/commits/electron-builder@26.15.3/packages/app-builder-lib)

Updates `builder-util-runtime` from 9.5.1 to 9.7.0
- [Release notes](https://github.com/electron-userland/electron-builder/releases)
- [Changelog](https://github.com/electron-userland/electron-builder/blob/master/packages/builder-util-runtime/CHANGELOG.md)
- [Commits](https://github.com/electron-userland/electron-builder/commits/HEAD/packages/builder-util-runtime)

Updates `shell-quote` from 1.8.4 to 1.9.0
- [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md)
- [Commits](ljharb/shell-quote@v1.8.4...v1.9.0)

Updates `undici` from 7.28.0 to 6.28.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.28.0...v6.28.0)

Updates `electron` from 41.5.0 to 41.10.3
- [Release notes](https://github.com/electron/electron/releases)
- [Commits](electron/electron@v41.5.0...v41.10.3)

Updates `brace-expansion` from 1.1.14 to 1.1.18
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.14...v1.1.18)

Updates `app-builder-lib` from 26.7.0 to 26.15.3
- [Release notes](https://github.com/electron-userland/electron-builder/releases)
- [Changelog](https://github.com/electron-userland/electron-builder/blob/master/packages/app-builder-lib/CHANGELOG.md)
- [Commits](https://github.com/electron-userland/electron-builder/commits/electron-builder@26.15.3/packages/app-builder-lib)

Updates `axios` from 1.16.0 to 1.19.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.16.0...v1.19.0)

Updates `builder-util-runtime` from 9.5.1 to 9.7.0
- [Release notes](https://github.com/electron-userland/electron-builder/releases)
- [Changelog](https://github.com/electron-userland/electron-builder/blob/master/packages/builder-util-runtime/CHANGELOG.md)
- [Commits](https://github.com/electron-userland/electron-builder/commits/HEAD/packages/builder-util-runtime)

Updates `shell-quote` from 1.8.4 to 1.9.0
- [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md)
- [Commits](ljharb/shell-quote@v1.8.4...v1.9.0)

Updates `axios` from 1.16.0 to 1.19.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.16.0...v1.19.0)

Updates `electron` from 41.5.0 to 41.10.3
- [Release notes](https://github.com/electron/electron/releases)
- [Commits](electron/electron@v41.5.0...v41.10.3)

Updates `brace-expansion` from 1.1.14 to 1.1.18
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.14...v1.1.18)

Updates `axios` from 1.16.0 to 1.19.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.16.0...v1.19.0)

Updates `electron` from 41.5.0 to 41.10.3
- [Release notes](https://github.com/electron/electron/releases)
- [Commits](electron/electron@v41.5.0...v41.10.3)

Updates `brace-expansion` from 1.1.14 to 1.1.18
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.14...v1.1.18)

Updates `app-builder-lib` from 26.7.0 to 26.15.3
- [Release notes](https://github.com/electron-userland/electron-builder/releases)
- [Changelog](https://github.com/electron-userland/electron-builder/blob/master/packages/app-builder-lib/CHANGELOG.md)
- [Commits](https://github.com/electron-userland/electron-builder/commits/electron-builder@26.15.3/packages/app-builder-lib)

Updates `builder-util-runtime` from 9.5.1 to 9.7.0
- [Release notes](https://github.com/electron-userland/electron-builder/releases)
- [Changelog](https://github.com/electron-userland/electron-builder/blob/master/packages/builder-util-runtime/CHANGELOG.md)
- [Commits](https://github.com/electron-userland/electron-builder/commits/HEAD/packages/builder-util-runtime)

Updates `shell-quote` from 1.8.4 to 1.9.0
- [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md)
- [Commits](ljharb/shell-quote@v1.8.4...v1.9.0)

Updates `electron` from 41.5.0 to 41.10.3
- [Release notes](https://github.com/electron/electron/releases)
- [Commits](electron/electron@v41.5.0...v41.10.3)

Updates `brace-expansion` from 1.1.14 to 1.1.18
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.14...v1.1.18)

Updates `app-builder-lib` from 26.7.0 to 26.15.3
- [Release notes](https://github.com/electron-userland/electron-builder/releases)
- [Changelog](https://github.com/electron-userland/electron-builder/blob/master/packages/app-builder-lib/CHANGELOG.md)
- [Commits](https://github.com/electron-userland/electron-builder/commits/electron-builder@26.15.3/packages/app-builder-lib)

Updates `axios` from 1.16.0 to 1.19.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.16.0...v1.19.0)

Updates `builder-util-runtime` from 9.5.1 to 9.7.0
- [Release notes](https://github.com/electron-userland/electron-builder/releases)
- [Changelog](https://github.com/electron-userland/electron-builder/blob/master/packages/builder-util-runtime/CHANGELOG.md)
- [Commits](https://github.com/electron-userland/electron-builder/commits/HEAD/packages/builder-util-runtime)

Updates `shell-quote` from 1.8.4 to 1.9.0
- [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md)
- [Commits](ljharb/shell-quote@v1.8.4...v1.9.0)

Updates `axios` from 1.16.0 to 1.19.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.16.0...v1.19.0)

Updates `electron` from 41.5.0 to 41.10.3
- [Release notes](https://github.com/electron/electron/releases)
- [Commits](electron/electron@v41.5.0...v41.10.3)

Updates `brace-expansion` from 1.1.14 to 1.1.18
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.14...v1.1.18)

Updates `axios` from 1.16.0 to 1.18.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.16.0...v1.19.0)

Updates `electron` from 40.9.3 to 41.10.3
- [Release notes](https://github.com/electron/electron/releases)
- [Commits](electron/electron@v41.5.0...v41.10.3)

Updates `brace-expansion` from 1.1.14 to 1.1.18
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.14...v1.1.18)

Updates `js-yaml` from 4.3.0 to 4.3.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.3.0...4.3.1)

Updates `electron` from 40.9.3 to 41.10.3
- [Release notes](https://github.com/electron/electron/releases)
- [Commits](electron/electron@v41.5.0...v41.10.3)

Updates `brace-expansion` from 1.1.14 to 1.1.18
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.14...v1.1.18)

Updates `js-yaml` from 4.3.0 to 4.3.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.3.0...4.3.1)

Updates `axios` from 1.16.0 to 1.18.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.16.0...v1.19.0)

Updates `axios` from 1.16.0 to 1.18.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.16.0...v1.19.0)

Updates `electron` from 40.9.3 to 41.10.3
- [Release notes](https://github.com/electron/electron/releases)
- [Commits](electron/electron@v41.5.0...v41.10.3)

Updates `postcss` from 8.5.13 to 8.5.26
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.13...8.5.26)

Updates `brace-expansion` from 1.1.14 to 1.1.18
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.14...v1.1.18)

Updates `dompurify` from 3.4.11 to 3.4.13
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.11...3.4.13)

Updates `js-yaml` from 4.3.0 to 4.3.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.3.0...4.3.1)

Updates `react-router` from 7.18.1 to 7.18.2
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/react-router@7.18.2/packages/react-router/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/react-router@7.18.2/packages/react-router)

---
updated-dependencies:
- dependency-name: app-builder-lib
  dependency-version: 26.15.3
  dependency-type: indirect
- dependency-name: app-builder-lib
  dependency-version: 26.15.3
  dependency-type: indirect
- dependency-name: axios
  dependency-version: 1.18.0
  dependency-type: direct:production
- dependency-name: axios
  dependency-version: 1.19.0
  dependency-type: direct:production
- dependency-name: axios
  dependency-version: 1.19.0
  dependency-type: indirect
- dependency-name: brace-expansion
  dependency-version: 1.1.18
  dependency-type: indirect
- dependency-name: brace-expansion
  dependency-version: 1.1.18
  dependency-type: indirect
- dependency-name: brace-expansion
  dependency-version: 1.1.18
  dependency-type: indirect
- dependency-name: builder-util-runtime
  dependency-version: 9.7.0
  dependency-type: indirect
- dependency-name: builder-util-runtime
  dependency-version: 9.7.0
  dependency-type: indirect
- dependency-name: dompurify
  dependency-version: 3.4.13
  dependency-type: indirect
- dependency-name: electron
  dependency-version: 41.10.3
  dependency-type: direct:development
- dependency-name: electron
  dependency-version: 41.10.3
  dependency-type: direct:development
- dependency-name: electron
  dependency-version: 41.10.3
  dependency-type: direct:development
- dependency-name: js-yaml
  dependency-version: 4.3.1
  dependency-type: indirect
- dependency-name: postcss
  dependency-version: 8.5.26
  dependency-type: direct:development
- dependency-name: react-router
  dependency-version: 7.18.2
  dependency-type: indirect
- dependency-name: sharp
  dependency-version: 0.35.0
  dependency-type: direct:production
- dependency-name: shell-quote
  dependency-version: 1.9.0
  dependency-type: indirect
- dependency-name: shell-quote
  dependency-version: 1.9.0
  dependency-type: indirect
- dependency-name: undici
  dependency-version: 6.28.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/npm_and_yarn-a57738279b branch from f113cfc to 0849c55 Compare August 13, 2026 11:22
@sonarqubecloud

sonarqubecloud Bot commented Aug 13, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@zedarvates