Skip to content

Bump the npm_and_yarn group across 1 directory with 16 updates#52

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-e463328765
Open

Bump the npm_and_yarn group across 1 directory with 16 updates#52
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-e463328765

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github May 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 9 updates in the / directory:

Package From To
electron 27.1.0 40.10.1
webpack-dev-server 5.2.0 5.2.4
@xmldom/xmldom 0.8.10 0.8.13
brace-expansion 1.1.11 5.0.6
ip-address 9.0.5 10.2.0
lodash 4.17.21 4.18.1
picomatch 2.3.1 4.0.4
serialize-javascript 6.0.2 7.0.5
tar 6.2.1 7.5.15

Updates electron from 27.1.0 to 40.10.1

Release notes

Sourced from electron's releases.

electron v40.10.1

Release Notes for v40.10.1

Other Changes

  • Backported a batch of upstream fixes for memory-safety and validation issues across media, GPU, networking, accessibility, compositing and the ANGLE GL backend. #51671
  • Backported fixes for several use-after-free and object-lifetime issues in input, UI, Aura, HID and file-system teardown paths, and a runtime-effect validation gap in Skia. #51648
  • Security: backported 20 High-severity fixes from Chrome 148 stable release. #51618

electron v40.10.0

Release Notes for v40.10.0

Fixes

  • Fixed app.getLoginItemSettings() returning undefined for executableWillLaunchAtLogin on macOS; the property is now always a boolean. #51509 (Also in 41, 42)

Other Changes

  • Updated Node.js to v24.15.0. #51087

electron v40.9.3

Release Notes for v40.9.3

Fixes

  • Ensured cross-origin fetch() and XHR are blocked for custom protocols registered with supportFetchAPI: true unless corsEnabled: true is also set; cross-origin mode: 'no-cors' requests now receive an opaque response. #51271 (Also in 39, 41, 42)
  • Fixed webContents.printToPDF rejecting on all subsequent calls after a prior call was rejected with an invalid pageRanges value. #51220 (Also in 41, 42)
  • Fixed a crash when providing invalid HTTP header names or values in the webRequest.onBeforeSendHeaders() callback. #51364 (Also in 41, 42)
  • Fixed a crash that could occur when an autofill suggestion popup was shown while a window was closing. #51334 (Also in 41, 42)
  • Fixed an issue where app-region: drag inside a hidden WebContentsView would still drag the parent window on Windows. #51247 (Also in 41, 42)
  • Fixed an issue where an Electron macOS update would not be applied if another app was previously blocking the macOS system update loop. #51211 (Also in 41, 42)
  • Fixed buggy behavior where Backspace would accept macOS text replacements inside contenteditable elements. #51345 (Also in 41, 42)

Other Changes

  • Backported a fix for route_id validation in the GPU command buffer. #51320
  • Backported security fixes for 493319454, 494158331, 493234757, 492736100, 493413432, 492668885, 496281816. #51258
  • Backported several fixes in Skia, ANGLE, and WebRTC from upstream. #51265

electron v40.9.2

Release Notes for v40.9.2

Fixes

  • Fixed an issue where nodeIntegrationInWorker didn't always work in AudioWorklet. #51004 (Also in 41, 42)
  • Fixed bug that could occasionally cause browserWindow's always-on-top-changed even to fire with incorrect values. #51134 (Also in 41, 42)
  • Fixed test scaffolding bug when running tests locally on Linux. #51151 (Also in 41, 42)

Other Changes

... (truncated)

Commits
  • 0ba898f fix: don't let tests hang for an hour (#51687)
  • 23d8ece fix: skip current instance's child processes in Windows orphan killer (#51683)
  • b687fe8 chore: cherry-pick 20 changes from chromium, angle (40-x-y) (#51671)
  • fbe40a8 chore: cherry-pick 7 changes from chromium, skia (40-x-y) (#51648)
  • cda7083 test: wait for navigation to settle in loadURL tests (#51641)
  • 8455e0d chore: cherry-pick 20 security fixes for 40-x-y (#51618)
  • 064f0e2 test: make sure there are no orphaned electron processes running (#51585)
  • 08f4bb8 ci: pin Homebrew version in CI runs (#51555)
  • cdecff0 chore: use oxfmt and oxlint in 40-x-y (#51500)
  • c9e5205 ci: skip job in rerun apply patches if too old (#51525)
  • Additional commits viewable in compare view

Updates webpack-dev-server from 5.2.0 to 5.2.4

Release notes

Sourced from webpack-dev-server's releases.

v5.2.4

5.2.4 (2026-05-11)

Bug Fixes

  • set Cross-Origin-Resource-Policy header to prevent source code theft over HTTP

v5.2.3

5.2.3 (2026-01-12)

Bug Fixes

  • add cause for errorObject (#5518) (37b033d)
  • compatibility with event target and universal target and lazy compilation (574026c)
  • overlay: add ESC key to dismiss overlay (#5598) (f91baa8)
  • progress indicator styles (#5557) (41a53a1)
  • upgrade selfsigned to v5

v5.2.2

5.2.2 (2025-06-03)

Bug Fixes

  • "Overlay enabled" false positive (18e72ee)
  • do not crush when error is null for runtime errors (#5447) (309991f)
  • remove unnecessary header X_TEST (#5451) (64a6124)
  • respect the allowedHosts option for cross-origin header check (#5510) (03d1214)

v5.2.1

5.2.1 (2025-03-26)

Security

  • cross-origin requests are not allowed unless allowed by Access-Control-Allow-Origin header
  • requests with an IP addresses in the Origin header are not allowed to connect to WebSocket server unless configured by allowedHosts or it different from the Host header

The above changes may make the dev server not work if you relied on such behavior, but unfortunately they carry security risks, so they were considered as fixes.

Bug Fixes

  • prevent overlay for errors caught by React error boundaries (#5431) (8c1abc9)
  • take the first network found instead of the last one, this restores the same behavior as 5.0.4 (#5411) (ffd0b86)
Changelog

Sourced from webpack-dev-server's changelog.

5.2.4 (2026-05-11)

Bug Fixes

  • set Cross-Origin-Resource-Policy header to prevent source code theft over HTTP

5.2.3 (2026-01-12)

Bug Fixes

  • add cause for errorObject (#5518) (37b033d)
  • compatibility with event target and universal target and lazy compilation (574026c)
  • overlay: add ESC key to dismiss overlay (#5598) (f91baa8)
  • progress indicator styles (#5557) (41a53a1)
  • upgrade selfsigned to v5

5.2.2 (2025-06-03)

Bug Fixes

  • "Overlay enabled" false positive (18e72ee)
  • do not crush when error is null for runtime errors (#5447) (309991f)
  • remove unnecessary header X_TEST (#5451) (64a6124)
  • respect the allowedHosts option for cross-origin header check (#5510) (03d1214)

5.2.1 (2025-03-26)

Security

  • cross-origin requests are not allowed unless allowed by Access-Control-Allow-Origin header
  • requests with an IP addresses in the Origin header are not allowed to connect to WebSocket server unless configured by allowedHosts or it different from the Host header

The above changes may make the dev server not work if you relied on such behavior, but unfortunately they carry security risks, so they were considered as fixes.

Bug Fixes

  • prevent overlay for errors caught by React error boundaries (#5431) (8c1abc9)
  • take the first network found instead of the last one, this restores the same behavior as 5.0.4 (#5411) (ffd0b86)
Commits

Updates @babel/plugin-transform-modules-systemjs from 7.25.0 to 7.25.9

Release notes

Sourced from @​babel/plugin-transform-modules-systemjs's releases.

v7.25.9 (2024-10-22)

Thanks @​victorenator for your first PR!

🐛 Bug Fix

  • babel-parser, babel-template, babel-types
  • babel-helper-compilation-targets, babel-preset-env
  • Other

🏠 Internal

🏃‍♀️ Performance

Committers: 4

v7.25.8 (2024-10-10)

🐛 Bug Fix

🏠 Internal

  • babel-parser, babel-plugin-proposal-async-do-expressions, babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions, babel-plugin-proposal-explicit-resource-management, babel-plugin-proposal-export-default-from, babel-plugin-proposal-function-bind, babel-plugin-proposal-function-sent, babel-plugin-proposal-import-defer, babel-plugin-proposal-partial-application, babel-plugin-proposal-throw-expressions, babel-plugin-transform-async-generator-functions, babel-plugin-transform-class-static-block, babel-plugin-transform-dynamic-import, babel-plugin-transform-export-namespace-from, babel-plugin-transform-json-strings, babel-plugin-transform-logical-assignment-operators, babel-plugin-transform-nullish-coalescing-operator, babel-plugin-transform-numeric-separator, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-catch-binding, babel-plugin-transform-optional-chaining, babel-plugin-transform-private-property-in-object, babel-preset-env

Committers: 3

v7.25.7 (2024-10-02)

Thanks @​DylanPiercey and @​YuHyeonWook for your first PRs!

🐛 Bug Fix

  • babel-helper-validator-identifier

... (truncated)

Commits

Updates @xmldom/xmldom from 0.8.10 to 0.8.13

Release notes

Sourced from @​xmldom/xmldom's releases.

0.8.13

Commits

Fixed

  • Security: XMLSerializer.serializeToString() (and Node.toString(), NodeList.toString()) now accept a requireWellFormed option (fourth argument, after isHtml and nodeFilter). When { requireWellFormed: true } is passed, the serializer throws InvalidStateError for injection-prone node content, preventing XML injection via attacker-controlled node data. GHSA-j759-j44w-7fr8 GHSA-x6wf-f3px-wcqx GHSA-f6ww-3ggp-fr8h
    • Comment: throws when data contains -->
    • ProcessingInstruction: throws when data contains ?>
    • DocumentType: throws when publicId fails PubidLiteral, systemId fails SystemLiteral, or internalSubset contains ]>
  • Security: DOM traversal operations (XMLSerializer.serializeToString(), Node.prototype.normalize(), Node.prototype.cloneNode(true), Document.prototype.importNode(node, true), node.textContent getter, getElementsByTagName() / getElementsByTagNameNS() / getElementsByClassName() / getElementById()) are now iterative. Previously, deeply nested DOM trees would exhaust the JavaScript call stack and throw an unrecoverable RangeError. GHSA-2v35-w6hq-6mfw

Thank you, @​Jvr2022, @​praveen-kv, @​TharVid, @​decsecre583, @​tlsbollei, @​KarimTantawey, for your contributions

0.8.12

Commits

Fixed

Code that passes a string containing "]]>" to createCDATASection and relied on the previously unsafe behavior will now receive InvalidCharacterError. Use a mutation method such as appendData if you intentionally need "]]>" in a CDATASection node's data.

Thank you, @​thesmartshadow, @​stevenobiajulu, for your contributions

xmldom/xmldom#357

0.8.11

0.8.11

Fixed

Thank you, @​shunkica, for your contributions

Changelog

Sourced from @​xmldom/xmldom's changelog.

0.8.13

Fixed

  • Security: XMLSerializer.serializeToString() (and Node.toString(), NodeList.toString()) now accept a requireWellFormed option (fourth argument, after isHtml and nodeFilter). When { requireWellFormed: true } is passed, the serializer throws InvalidStateError for injection-prone node content, preventing XML injection via attacker-controlled node data. GHSA-j759-j44w-7fr8 GHSA-x6wf-f3px-wcqx GHSA-f6ww-3ggp-fr8h
    • Comment: throws when data contains -->
    • ProcessingInstruction: throws when data contains ?>
    • DocumentType: throws when publicId fails PubidLiteral, systemId fails SystemLiteral, or internalSubset contains ]>
  • Security: DOM traversal operations (XMLSerializer.serializeToString(), Node.prototype.normalize(), Node.prototype.cloneNode(true), Document.prototype.importNode(node, true), node.textContent getter, getElementsByTagName() / getElementsByTagNameNS() / getElementsByClassName() / getElementById()) are now iterative. Previously, deeply nested DOM trees would exhaust the JavaScript call stack and throw an unrecoverable RangeError. GHSA-2v35-w6hq-6mfw

Thank you, @​Jvr2022, @​praveen-kv, @​TharVid, @​decsecre583, @​tlsbollei, @​KarimTantawey, for your contributions

0.9.9

Added

Fixed

Code that passes a string containing "]]>" to createCDATASection and relied on the previously unsafe behavior will now receive InvalidCharacterError. Use a mutation method such as appendData if you intentionally need "]]>" in a CDATASection node's data.

Chore

  • updated dependencies

Thank you, @​stevenobiajulu, @​yoshi389111, @​thesmartshadow, for your contributions

0.8.12

Fixed

... (truncated)

Commits
  • e5c1480 0.8.13
  • 9611e20 style: drop unused import in test file
  • dc4dff3 docs: add 0.8.13 changelog entry
  • 842fa38 fix: prevent stack overflow in normalize (GHSA-2v35-w6hq-6mfw)
  • aeff69f test: add normalize behavioral coverage to node.test.js
  • cbdb0d7 fix: make walkDOM iterative to prevent stack overflow (GHSA-2v35-w6hq-6mfw)
  • 0b543d3 test: assert namespace declarations are isolated between siblings in serializ...
  • c007c51 refactor: migrate serializeToString to walkDOM
  • 2bb3899 test: add serializeToString coverage for uncovered branches
  • e69f38d refactor: migrate importNode to walkDOM
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by karfau, a new releaser for @​xmldom/xmldom since your current version.


Updates brace-expansion from 1.1.11 to 5.0.6

Release notes

Sourced from brace-expansion's releases.

v4.0.1

  • fmt 5a5cc17
  • Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) 0b6a978

juliangruber/brace-expansion@v4.0.0...v4.0.1

v4.0.0

  • feat: use string replaces instead of splits (#64) 278132b
  • fmt dd72a59
  • add tea.yaml 70e4c1b

juliangruber/brace-expansion@v3.0.0...v4.0.0

As a precaution to not risk breaking anything with 278132b, this is a new semver major release

v3.0.1

  • pkg: publish on tag 3.x 3059c07
  • fmt 8229e6f
  • Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) 15f9b3c

juliangruber/brace-expansion@v3.0.0...v3.0.1

v3.0.0

  • Switch to ES Modules and balanced-match 3.0.0 (#62) c0360e8
  • added jsdoc (#55) 68c0e37
  • node 16 is EOL 9e781e9
  • add standard 3494c4d
  • use const and let (#57) dd5a4cb
  • docs 6dad209
  • remove test e3dd8ae
  • ci: update node versions d23ede9
  • docs: add @​lanodan to contributors 1eb3fa4
  • docs 1e7c9cd
  • switch from tape to test module (#60) 2520537
  • Bump minimist from 1.2.5 to 1.2.6 (#59) 61a94f1
  • Bump path-parse from 1.0.6 to 1.0.7 (#51) dc741cf
  • docs: add back ci badge 8ee5626
  • Add github actions, remove travis. Closes #52 (#53) 5c8756a
  • CI: Drop unused sudo: false Travis directive (#50) 05978a7

juliangruber/brace-expansion@v2.0.1...v3.0.0

v2.0.2

  • pkg: publish on tag 2.x 14f1d91
  • fmt ed7780a
  • Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) 36603d5

... (truncated)

Commits
Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates fast-uri from 3.0.1 to 3.0.6

Release notes

Sourced from fast-uri's releases.

v3.0.6

What's Changed

Full Changelog: fastify/fast-uri@v3.0.5...v3.0.6

v3.0.5

What's Changed

Full Changelog: fastify/fast-uri@v3.0.4...v3.0.5

v3.0.4

What's Changed

Full Changelog: fastify/fast-uri@v3.0.3...v3.0.4

v3.0.3

What's Changed

New Contributors

Full Changelog: fastify/fast-uri@v3.0.2...v3.0.3

v3.0.2

What's Changed

... (truncated)

Commits

Updates flatted from 3.3.1 to 3.3.2

Commits

Updates follow-redirects from 1.15.9 to 1.16.0

Commits
  • 0c23a22 Release version 1.16.0 of the npm package.
  • 844c4d3 Add sensitiveHeaders option.
  • 5e8b8d0 ci: add Node.js 24.x to the CI matrix
  • 7953e22 ci: upgrade GitHub Actions to use setup-node@v6 and checkout@v6
  • 86dc1f8 Sanitizing input.
  • 21ef28a Release version 1.15.11 of the npm package.
  • 7c88135 Roll back tree shaking.
  • 6e389ba Release version 1.15.10 of the npm package.
  • 5bc496e Shake me up before you go-go.
  • 694d6b4 Bump minimist from 1.2.5 to 1.2.8
  • See full diff in compare view

Updates immutable from 4.3.7 to 5.0.3

Release notes

Sourced from immutable's releases.

v5.0.3

What's Changed

New Contributors

Full Changelog: immutable-js/immutable-js@v5.0.2...v5.0.3

v5.0.2

Changed

  • Fix wrong path for esm module after fix in 5.0.1

Full Changelog: immutable-js/immutable-js@v5.0.1...v5.0.2

v5.0.1

What's Changed

Fixes

Internal

Full Changelog: immutable-js/immutable-js@v5.0.0...v5.0.1

v5.0.0

Breaking changes

To sum up, the big change in 5.0 is a Typescript change related to Map that is typed closer to the JS object. This is a huge change for TS users, but do not impact the runtime behavior. (see Improve TypeScript definition for Map for more details)

Other breaking changes are:

[BREAKING] Remove deprecated methods:

Released in 5.0.0-rc.1

  • Map.of('k', 'v'): use Map([ [ 'k', 'v' ] ]) or Map({ k: 'v' })
  • Collection.isIterable: use isIterable directly
  • Collection.isKeyed: use isKeyed directly
  • Collection.isIndexed: use isIndexed directly
  • Collection.isAssociative: use isAssociative directly
  • Collection.isOrdered: use isOrdered directly

[BREAKING] OrdererMap and OrderedSet hashCode implementation has been fixed

... (truncated)

Changelog

Sourced from immutable's changelog.

[5.0.3]

  • Fix List.VNode.removeAfter() / removeBefore() issue on some particular case #2030 by @​alexvictoor

[5.0.2]

  • Fix wrong path for esm module after fix in 5.0.1

[5.0.1]

[5.0.0]

Breaking changes

To sum up, the big change in 5.0 is a Typescript change related to Map that is typed closer to the JS object. This is a huge change for TS users, but do not impact the runtime behavior. (see Improve TypeScript definition for Map for more details)

Other breaking changes are:

[BREAKING] Remove deprecated methods:

Released in 5.0.0-rc.1

  • Map.of('k', 'v'): use Map([ [ 'k', 'v' ] ]) or Map({ k: 'v' })
  • Collection.isIterable: use isIterable directly
  • Collection.isKeyed: use isKeyed directly
  • Collection.isIndexed: use isIndexed directly
  • Collection.isAssociative: use isAssociative directly
  • Collection.isOrdered: use isOrdered directly

[BREAKING] OrdererMap and OrderedSet hashCode implementation has been fixed

Released in 5.0.0-rc.1

Fix issue implementation of hashCode for OrdererMap and OrderedSet where equal objects might not return the same hashCode.

Changed in #2005

[BREAKING] Range function needs at least two defined parameters

Released in 5.0.0-beta.5

Range with undefined would end in an infinite loop. Now, you need to define at least the start and end values.

If you need an infinite range, you can use Range(0, Infinity).

Changed in #1967 by @​jdeniau

[Minor BC break] Remove default export

... (truncated)

Commits
  • 0fc45d3 5....

    Description has been truncated

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 20, 2026
@dependabot
Bump the npm_and_yarn group across 1 directory with 16 updates
824e064 
Bumps the npm_and_yarn group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [electron](https://github.com/electron/electron) | `27.1.0` | `40.10.1` |
| [webpack-dev-server](https://github.com/webpack/webpack-dev-server) | `5.2.0` | `5.2.4` |
| [@xmldom/xmldom](https://github.com/xmldom/xmldom) | `0.8.10` | `0.8.13` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.11` | `5.0.6` |
| [ip-address](https://github.com/beaugunderson/ip-address) | `9.0.5` | `10.2.0` |
| [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.18.1` |
| [picomatch](https://github.com/micromatch/picomatch) | `2.3.1` | `4.0.4` |
| [serialize-javascript](https://github.com/yahoo/serialize-javascript) | `6.0.2` | `7.0.5` |
| [tar](https://github.com/isaacs/node-tar) | `6.2.1` | `7.5.15` |



Updates `electron` from 27.1.0 to 40.10.1
- [Release notes](https://github.com/electron/electron/releases)
- [Commits](electron/electron@v27.1.0...v40.10.1)

Updates `webpack-dev-server` from 5.2.0 to 5.2.4
- [Release notes](https://github.com/webpack/webpack-dev-server/releases)
- [Changelog](https://github.com/webpack/webpack-dev-server/blob/main/CHANGELOG.md)
- [Commits](webpack/webpack-dev-server@v5.2.0...v5.2.4)

Updates `@babel/plugin-transform-modules-systemjs` from 7.25.0 to 7.25.9
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.25.9/packages/babel-plugin-transform-modules-systemjs)

Updates `@xmldom/xmldom` from 0.8.10 to 0.8.13
- [Release notes](https://github.com/xmldom/xmldom/releases)
- [Changelog](https://github.com/xmldom/xmldom/blob/master/CHANGELOG.md)
- [Commits](xmldom/xmldom@0.8.10...0.8.13)

Updates `brace-expansion` from 1.1.11 to 5.0.6
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@1.1.11...v5.0.6)

Updates `fast-uri` from 3.0.1 to 3.0.6
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.0.1...v3.0.6)

Updates `flatted` from 3.3.1 to 3.3.2
- [Commits](WebReflection/flatted@v3.3.1...v3.3.2)

Updates `follow-redirects` from 1.15.9 to 1.16.0
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](follow-redirects/follow-redirects@v1.15.9...v1.16.0)

Updates `immutable` from 4.3.7 to 5.0.3
- [Release notes](https://github.com/immutable-js/immutable-js/releases)
- [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md)
- [Commits](immutable-js/immutable-js@v4.3.7...v5.0.3)

Updates `ip-address` from 9.0.5 to 10.2.0
- [Commits](https://github.com/beaugunderson/ip-address/commits)

Updates `lodash` from 4.17.21 to 4.18.1
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.18.1)

Updates `path-to-regexp` from 0.1.7 to 0.1.13
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/v.0.1.13/History.md)
- [Commits](pillarjs/path-to-regexp@v0.1.7...v.0.1.13)

Updates `picomatch` from 2.3.1 to 4.0.4
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@2.3.1...4.0.4)

Updates `serialize-javascript` from 6.0.2 to 7.0.5
- [Release notes](https://github.com/yahoo/serialize-javascript/releases)
- [Commits](yahoo/serialize-javascript@v6.0.2...v7.0.5)

Updates `tar` from 6.2.1 to 7.5.15
- [Release notes](https://github.com/isaacs/node-tar/releases)
- [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md)
- [Commits](isaacs/node-tar@v6.2.1...v7.5.15)

Updates `yaml` from 2.5.1 to 2.7.0
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.5.1...v2.7.0)

---
updated-dependencies:
- dependency-name: "@babel/plugin-transform-modules-systemjs"
  dependency-version: 7.25.9
  dependency-type: indirect
- dependency-name: "@xmldom/xmldom"
  dependency-version: 0.8.13
  dependency-type: indirect
- dependency-name: brace-expansion
  dependency-version: 5.0.6
  dependency-type: indirect
- dependency-name: electron
  dependency-version: 40.10.1
  dependency-type: direct:development
- dependency-name: fast-uri
  dependency-version: 3.0.6
  dependency-type: indirect
- dependency-name: flatted
  dependency-version: 3.3.2
  dependency-type: indirect
- dependency-name: follow-redirects
  dependency-version: 1.16.0
  dependency-type: indirect
- dependency-name: immutable
  dependency-version: 5.0.3
  dependency-type: indirect
- dependency-name: ip-address
  dependency-version: 10.2.0
  dependency-type: indirect
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: indirect
- dependency-name: path-to-regexp
  dependency-version: 0.1.13
  dependency-type: indirect
- dependency-name: picomatch
  dependency-version: 4.0.4
  dependency-type: indirect
- dependency-name: serialize-javascript
  dependency-version: 7.0.5
  dependency-type: indirect
- dependency-name: tar
  dependency-version: 7.5.15
  dependency-type: indirect
- dependency-name: webpack-dev-server
  dependency-version: 5.2.4
  dependency-type: direct:development
- dependency-name: yaml
  dependency-version: 2.7.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/npm_and_yarn-e463328765 branch from 3f10aad to 824e064 Compare May 21, 2026 00:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants