Skip to content

build(deps): bump the npm-security group across 1 directory with 13 updates - #2372

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/chat2db-community-client/npm-security-d7f4b17f15
Open

build(deps): bump the npm-security group across 1 directory with 13 updates#2372
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/chat2db-community-client/npm-security-d7f4b17f15

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 1, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the npm-security group with 13 updates in the /chat2db-community-client directory:

Package From To
echarts 5.6.0 6.1.0
lodash 4.17.21 4.18.0
uuid 9.0.1 14.0.0
fast-uri 3.1.3 3.1.8
flatted 3.3.2 3.4.4
follow-redirects 1.15.9 1.16.1
form-data 4.0.2 4.0.6
js-cookie 3.0.5 3.0.8
piscina 4.8.0 4.9.4
postcss 8.5.2 8.5.29
protocol-buffers-schema 3.6.0 3.6.1
shell-quote 1.8.2 1.12.0
svgo 2.8.0 2.8.4

Updates echarts from 5.6.0 to 6.1.0

Release notes

Sourced from echarts's releases.

6.1.0

  • [Feature] [axis] Support dataMin and dataMax option for calculating a nice axis extent. #20838 (Justin-ZS, Ovilia)
  • [Feature] [axis] Comprehensively enable all types of axis (i.e., "value"/"time"/"category"/"log") to render series (typically "bar"/"pictorialBar"/"candlestick"/"boxplot") without overflow (including the case "category" axis with boundaryGap: false); provide containShape option; provide some corresponding clip option. dbfaf6a73 fe932a2aa 3973b21ee (100pah) #21511 (Akash Sonune)
  • [Feature] [axis] Automatically exclude non-positive series data values on "log" axis. dedc5dc18 (100pah)
  • [Feature] [axis] Enable axisLabel.formatter to receive its index for working with customValues. #21220 #21432 (Szymon Pachucki, Ovilia, plainheart)
  • [Feature] [line] Add triggerEvent option for more control over mouse event. #21001 (Steven Cobb, plainheart)
  • [Feature] [pie] Add tangential-noflip rotation mode to keep labels tangential without flipping. #21258 (春秋半夏, Ovilia)
  • [Feature] [gauge] progress.color supports 'auto'. #21224 (StNimmerlein, Ovilia)
  • [Feature] [radar] Add clockwise option. #21143 (Dai Xuezhou, Ovilia)
  • [Feature] [candlestick] [dataZoom] Add cursor option for candlestick series and add cursorGrab option & cursorGrabbing for 'inside' dataZoom. #21558 (zuming, Ovilia, 100pah)
  • [Feature] [scatter] [effectScatter] [geo] Enable clip option on "scatter"/"effectScatter" on geo. 417592289 (100pah)
  • [Feature] [visualMap] Add seriesTargets option for multiple series-dimension mappings. #20703 (Justin-ZS, plainheart)
  • [Feature] [matrix] Support matrix.x/y.length for conveniently creating a headless matrix without composing an array. #21191 (100pah, plainheart)
  • [Feature] [matrix] Add triggerEvent option to support triggering event on matrix cells. #21390 (Natsuo Kawai, 100pah)
  • [Feature] [i18n] add Latvian(LV) translation. #21546 (EPoikans)
  • [Fix] [axis] Change and clarify the rounding error and auto-precision utils and solutions. 479dcd454 (100pah)
  • [Fix] [axis] Fix chart does not work when using customValues with formatter in time axis (axis.type: 'time') label. #21352 (Srajan Sanjay Saxena, plainheart)
  • [Fix] [axis] Fix and clarify alignTick strategy, and fix LogScale precision. a6ab2458f ffcc636fb (100pah)
  • [Fix] [axis] Fix duplicate ticks when using time axis (axis.type: 'time') or customValues, which causes jitter of splitArea; fix the showMin/MaxLabel handling of a category axis (axis.type: 'category'); enable a uniform bandWidth calculation in numeric axis (axis.type: 'value' | 'time' | 'log'). 8de2b64fa 15af0db02 8ddaa5c69 (100pah)
  • [Fix] [axis] Fix time axis (axis.type: 'time') bug when value scale is in millisecond. 40b77b464 (100pah)
  • [Fix] [bar] Fix wrong label position when bar series has a 0 width/height. #21218 (Justin-ZS, Ovilia)
  • [Fix] [scatter] Fix jitter layout does not support progressive rendering and cause chart to be frozen and potential NPE. #21436 (plainheart)
  • [Fix] [lines] Fix effect symbol flip on unidirectional loop end when roundTrip is not enabled. #21320 (Mayank Mehta, plainheart)
  • [Fix] [candlestick] Fix candlestick render error with series.encode on horizontal layout. #21325 (Purbayan Pramanik, 100pah)
  • [Fix] [parallel] Fix incorrect axis extent when any subsequent series has a larger value than the first. #21387 (jackhickson, 100pah)
  • [Fix] [pie] Support axes extent union pie center automatically when pie is laid out on Cartesian (grid component). 18a23a875 (100pah)
  • [Fix] [treemap] Fix treemap can not be zoomed out after a zoom-in when scaleLimit is specified #21427 (TateLiu, 100pah)
  • [Fix] [lines] Fix potential tooltip XSS vulnerability in lines series (series.type: 'lines'). #21608 (plainheart)
  • [Fix] [map] [geo] Fix the failed synchronization and visual artifacts on geo roaming and animation. 417592289 (100pah)
  • [Fix] [tooltip] Fix tooltip content does not refresh when changing tooltip trigger from 'axis' to 'item'. #20710 (Justin-ZS, plainheart)
  • [Fix] [tooltip] valueFormatter callback param dataIndex should be rawDataIndex rather than dataZoom filtered dataIndex. #21479 (100pah, plainheart)
  • [Fix] [axisPointer] Fix axisPointer shadow and enable clipping - it is previously only applicable to "category" axis, but is buggy in numeric axis with "bar" series. 8de2b64fa (100pah)
  • [Fix] [axisPointer] Fix visual artifacts caused by failed axisPointer restoration. 56a32c0bb (100pah)
  • [Fix] [hoverLayer] Fix visual artifacts arisen on hover layer. zrender#1151 933585126 (100pah)
  • [Fix] [marker] Fix marker fails to render with dataset and encode. #21439 (plainheart, 100pah).
  • [Fix] [dataZoom] Fix wrong position of the dataZoom when the series has only one data point. #21196 (alesmit, Ovilia)
  • [Fix] [dataZoom] Fix dataZoom bug that data info disappears when dragging released; fix dataZoom dragging cursor style. 64305a4b8 (100pah)
  • [Fix] [dataZoom] Apply a better auto-precision method; fix unexpected behaviors when dataZoom controls axes with alignTicks: true. d168bf237 (100pah)
  • [Fix] [dataZoom] Fix AxisProxy can not be cleared when dataZoom option changed; fix related onZero behaviors. 52ceb924a 2e82d33c3 (100pah)
  • [Fix] [areaStyle] Fix areaStyle render error when dimension name is empty string. #21219 (Justin-ZS, Ovilia)
  • [Fix] [sunburst] Fix root node label may not be centered. #21306 (Akash Sonune, Ovilia)
  • [Fix] [matrix] Fix matrix label formatter does not work. #21410 (Justin-ZS, Ovilia)
  • [Fix] [toolbox] Fix emphasis color is the same as the default color. #21384 (Ovilia) b094f987d (100pah)
  • [Fix] [toolbox] Fix the dataView component does not fit the dark mode. #21176 (notthistrain, Ovilia)
  • [Fix] [progressive] Fix progressive rendering issues. 91a60fc76 (100pah)
  • [Fix] [labelLine] Fix labelLine.smooth can not be reset. #21425 (fanwww, plainheart)
  • [Fix] [graphic] Fix stroke corner gap due to not closing path in roundRect helper. zrender#1155 (plainheart)
  • [Fix] [svg] Enhance SVG encodeBase64 compatibility to make it available in more environments like Web Worker/NodeJS/Bun. zrender#1145 (plainheart)
  • [Fix] [core] Mark echarts instance object as raw in Vue. #21293 (plainheart)
  • [Fix] [chord] Add the missing export entry for chord chart. #21197 (plainheart, Ovilia)

... (truncated)

Commits
  • c5a48f5 Merge pull request #21612 from apache/release-dev
  • 77e5222 release 6.1.0-rc.2
  • 21f17be fixRegression(map,geo): Resolve circular dependencies introduced by this vers...
  • 830e8b6 chore: Supplement package.json (for module cjs declaration) to source release.
  • ed0e210 chore: Fix addHeader tool and add missing license headers.
  • cc78ada Merge pull request #21611 from apache/release-dev
  • 3f6e012 release: Build release.
  • d69405f chore: Add missing headers.
  • 6998ed0 release: Upgrade npm version.
  • 8cb374b fix(build): Fix build commands.
  • Additional commits viewable in compare view

Updates lodash from 4.17.21 to 4.18.0

Release notes

Sourced from lodash's releases.

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

  • Add security notice for _.template in threat model and API docs (#6099)
  • Document lower > upper behavior in _.random (#6115)
  • Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

Commits
  • 59be2de release(minor): bump to 4.18.0 (#6161)
  • af63457 fix: broken tests for _.template 879aaa9
  • 1073a76 fix: linting issues
  • 879aaa9 fix: validate imports keys in _.template
  • fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
  • 18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
  • b819080 ci: add dist sync validation workflow (#6137)
  • 0783181 docs(random): document lower > upper case (#6115)
  • 35bb1d9 docs: add security notice for _.template in threat model and API docs (#6099)
  • 62b439f doc: fix quotes in compact jsdoc (#6090)
  • Additional commits viewable in compare view

Updates uuid from 9.0.1 to 14.0.0

Release notes

Sourced from uuid's releases.

v14.0.0

14.0.0 (2026-04-19)

⚠ BREAKING CHANGES

  • expect crypto to be global everywhere (requires node@20+) (#935)
  • drop node@18 support (#934)

Features

Bug Fixes

  • expect crypto to be global everywhere (requires node@20+) (#935) (f2c235f)
  • Use GITHUB_TOKEN for release-please and enable npm provenance (#925) (ffa3138)

v13.0.2

13.0.2 (2026-05-04)

Bug Fixes

  • rerelease to fix provenance. (49ccb35)

v13.0.1

13.0.1 (2026-04-27)

Bug Fixes

v13.0.0

13.0.0 (2025-09-08)

⚠ BREAKING CHANGES

  • make browser exports the default (#901)

Bug Fixes

v12.0.1

12.0.1 (2026-04-29)

... (truncated)

Changelog

Sourced from uuid's changelog.

14.0.0 (2026-04-19)

Security

  • Fixes GHSA-w5hq-g745-h8pq: v3(), v5(), and v6() did not validate that writes would remain within the bounds of a caller-supplied buffer, allowing out-of-bounds writes when an invalid offset was provided. A RangeError is now thrown if offset < 0 or offset + 16 > buf.length.

⚠ BREAKING CHANGES

  • crypto is now expected to be globally defined (requires node@20+) (#935)
  • drop node@18 support (#934)
  • upgrade minimum supported TypeScript version to 5.4.3, in keeping with the project's policy of supporting TypeScript versions released within the last two years

13.0.0 (2025-09-08)

⚠ BREAKING CHANGES

  • make browser exports the default (#901)

Bug Fixes

12.0.0 (2025-09-05)

⚠ BREAKING CHANGES

  • update to typescript@5.2 (#887)
  • remove CommonJS support (#886)
  • drop node@16 support (#883)

Features

Bug Fixes

11.1.0 (2025-02-19)

... (truncated)

Commits
  • 7c1ea08 chore(main): release 14.0.0 (#926)
  • 3d2c5b0 Merge commit from fork
  • f2c235f fix!: expect crypto to be global everywhere (requires node@20+) (#935)
  • 529ef08 chore: upgrade TypeScript and fixup types (#927)
  • 086fd79 chore: update dependencies (#933)
  • dc4ddb8 feat!: drop node@18 support (#934)
  • 0f1f9c9 chore: switch to Biome for parsing and linting (#932)
  • e2879e6 chore: use maintained version of npm-run-all (#930)
  • ffa3138 fix: Use GITHUB_TOKEN for release-please and enable npm provenance (#925)
  • 0423d49 docs: remove obsolete v1 option notes (#915)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for uuid since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates fast-uri from 3.1.3 to 3.1.8

Release notes

Sourced from fast-uri's releases.

v3.1.8

⚠️ Security Warning

This security release fixes the following medium-severity security advisory:

Users of the v3.x release line should upgrade to v3.1.8.

Full Changelog: fastify/fast-uri@v3.1.7...v3.1.8

v3.1.7

⚠️ Security Warning

This is a security release that fixes the following high-severity security advisories:

Users of the v3.x release line should upgrade to v3.1.7.

Full Changelog: fastify/fast-uri@v3.1.6...v3.1.7

v3.1.6

⚠️ Security Warning

This release addresses the following high-severity security advisories:

Users of the v3.x release line should upgrade to v3.1.6.

Full Changelog: fastify/fast-uri@v3.1.5...v3.1.6

v3.1.5

⚠️ Security Warning

Fix for GHSA-7p8r-x3mc-p8w7

Full Changelog: fastify/fast-uri@v3.1.4...v3.1.5

v3.1.4

⚠️ Security Release

Fix for GHSA-v2hh-gcrm-f6hx

Full Changelog: fastify/fast-uri@v3.1.3...v3.1.4

Commits
  • ead3ab7 Bumped v3.1.8
  • c88b59e fix: normalize decoded reg-name case
  • 412e40a Bumped v3.1.7
  • 9f4c943 fix: backport port and IP-literal validation to v3.x (#216)
  • 1eb3ce4 fix: treat unterminated bracket hosts as reg-names again (#214)
  • 6f970b2 Bumped v3.1.6
  • d941579 fix: never run IDN canonicalization on bracketed IP literals
  • c0f0279 test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)
  • 37f3417 Merge commit from fork
  • 607bfbe Merge commit from fork
  • Additional commits viewable in compare view

Updates flatted from 3.3.2 to 3.4.4

Commits

Updates follow-redirects from 1.15.9 to 1.16.1

Commits
  • 4630125 Release version 1.16.1 of the npm package.
  • 9865ca4 Support key/value header arrays.
  • 080a76d Escape all RegExp modifiers.
  • 0c23a22 Release version 1.16.0 of the npm package.
  • 844c4d3 Add sensitiveHeaders option.
  • 5e8b8d0 ci: add Node.js 24.x to the CI matrix
  • 7953e22 ci: upgrade GitHub Actions to use setup-node@v6 and checkout@v6
  • 86dc1f8 Sanitizing input.
  • 21ef28a Release version 1.15.11 of the npm package.
  • 7c88135 Roll back tree shaking.
  • Additional commits viewable in compare view

Updates form-data from 4.0.2 to 4.0.6

Changelog

Sourced from form-data's changelog.

v4.0.6 - 2026-06-12

Commits

  • [Fix] escape CR, LF, and " in field names and filenames 8dff42c
  • [Dev Deps] update @ljharb/eslint-config, auto-changelog, tape f31d21e
  • [Deps] update hasown, mime-types 92ae0eb
  • [Dev Deps] update js-randomness-predictor 67b0f65

v4.0.5 - 2025-11-17

Commits

  • [Tests] Switch to newer v8 prediction library; enable node 24 testing 16e0076
  • [Dev Deps] update @ljharb/eslint-config, eslint 5822467
  • [Fix] set Symbol.toStringTag in the proper place 76d0dee

v4.0.4 - 2025-07-16

Commits

  • [meta] add auto-changelog 811f682
  • [Tests] handle predict-v8-randomness failures in node < 17 and node > 23 1d11a76
  • [Fix] Switch to using crypto random for boundary values 3d17230
  • [Tests] fix linting errors 5e34080
  • [meta] actually ensure the readme backup isn’t published 316c82b
  • [Dev Deps] update @ljharb/eslint-config 58c25d7
  • [meta] fix readme capitalization 2300ca1

v4.0.3 - 2025-06-05

Fixed

Commits

  • [eslint] use a shared config 426ba9a
  • [eslint] fix some spacing issues 2094191
  • [Refactor] use hasown 81ab41b
  • [Fix] validate boundary type in setBoundary() method 8d8e469
  • [Tests] add tests to check the behavior of getBoundary with non-strings 837b8a1
  • [Dev Deps] remove unused deps 870e4e6
  • [meta] remove local commit hooks e6e83cc
  • [Dev Deps] update eslint 4066fd6
  • [meta] fix scripts to use prepublishOnly c4bbb13
Commits
  • 64190db v4.0.6
  • 92ae0eb [Deps] update hasown, mime-types
  • f31d21e [Dev Deps] update @ljharb/eslint-config, auto-changelog, tape
  • 8dff42c [Fix] escape CR, LF, and " in field names and filenames
  • 67b0f65 [Dev Deps] update js-randomness-predictor
  • 68ff7dd v4.0.5
  • 5822467 [Dev Deps] update @ljharb/eslint-config, eslint
  • 76d0dee [Fix] set Symbol.toStringTag in the proper place
  • 16e0076 [Tests] Switch to newer v8 prediction library; enable node 24 testing
  • 41996f5 v4.0.4
  • Additional commits viewable in compare view
Install script changes

This version modifies prepublish script that runs during installation. Review the package contents before updating.


Updates js-cookie from 3.0.5 to 3.0.8

Release notes

Sourced from js-cookie's releases.

v3.0.8

  • Restore ES5 compatibility, inadvertently broken in 3.0.7 - #959
  • Lift Node version restriction, inadvertently restricted to >= 20 in 3.0.7 - #956

v3.0.7

  • Prevent cookie attribute injection: CVE-2026-46625 (eb3c40e)
  • Add Partitioned attribute to readme (b994768)
  • Publish to npm registry via trusted publisher exclusively (4dc71be)
  • Ensure consistent behaviour for get('name') + get() (1953d30)
Commits
  • d7a1096 Craft v3.0.8 release
  • 248e685 Use existing Chrome with puppeteer
  • fc04269 Remove QUnit related workaround in Grunt config
  • 265a685 Tidy up package lock file
  • 478e591 Disable Node deprecation DEP0044 for release workflow
  • 331d524 Fix node version config for E2E test job
  • 11d773d Ensure ECMAScript compatibility
  • d788646 Remove engines property from package
  • e7d9a4d Fix typo in test assertion message
  • b5fca24 Make credentials use explicit in release workflow
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for js-cookie since your current version.


Updates piscina from 4.8.0 to 4.9.4

Release notes

Sourced from piscina's releases.

v4.9.4

What's Changed

Full Changelog: piscinajs/piscina@v4.9.3...v4.9.4

v4.9.2

Full Changelog: piscinajs/piscina@v4.9.1...v4.9.2

v4.9.1

What's Changed

New Contributors

Full Changelog: piscinajs/piscina@v.4.9.0...v4.9.1

v.4.9.0

What's Changed

... (truncated)

Changelog

Sourced from piscina's changelog.

4.9.4 (2026-08-28)

⚠ BREAKING CHANGES

  • for consumers that call Object.prototype methods directly on pool.options (e.g. pool.options.hasOwnProperty(...)).

  • fix: use sanitized options for resourceLimits validation

  • fix: sanitize run/close options with withNullPrototype

Use the existing withNullPrototype helper instead of getOwn; address feedback from @​metcoder95

  • fix: avoid re-linking Object.prototype in Piscina constructor

(cherry picked from commit bebbda255c2981cecddd36b171b94be2fd41c9a6)

4.9.3 (2026-06-12)

4.9.2 (2025-03-18)

4.9.1 (2025-03-18)

Features

Bug Fixes

4.9.0 (2025-03-16)

Features

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 1, 2026
@dependabot
dependabot Bot requested a review from openai0229 as a code owner August 1, 2026 11:39
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 1, 2026
@openai0229 openai0229 moved this to In Review in Chat2DB Community Aug 1, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/chat2db-community-client/npm-security-d7f4b17f15 branch 23 times, most recently from 54eb594 to ca707e4 Compare August 6, 2026 13:22
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/chat2db-community-client/npm-security-d7f4b17f15 branch 7 times, most recently from 93ee4d9 to 6d2e673 Compare August 21, 2026 04:47
@dependabot
dependabot Bot requested a review from a team as a code owner August 21, 2026 04:47
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/chat2db-community-client/npm-security-d7f4b17f15 branch 14 times, most recently from 362c80b to e93e20f Compare August 28, 2026 06:39
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/chat2db-community-client/npm-security-d7f4b17f15 branch 2 times, most recently from df64879 to e58f685 Compare September 8, 2026 05:53
@dependabot dependabot Bot changed the title chore(deps): bump the npm-security group across 1 directory with 13 updates build(deps): bump the npm-security group across 1 directory with 13 updates Sep 15, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/chat2db-community-client/npm-security-d7f4b17f15 branch from e58f685 to b8c56a4 Compare September 15, 2026 05:54
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/chat2db-community-client/npm-security-d7f4b17f15 branch 2 times, most recently from 79cd8de to 9df9161 Compare September 29, 2026 05:53
@dependabot
build(deps): bump the npm-security group across 1 directory with 13 u…
2b07975 
…pdates

Bumps the npm-security group with 13 updates in the /chat2db-community-client directory:

| Package | From | To |
| --- | --- | --- |
| [echarts](https://github.com/apache/echarts) | `5.6.0` | `6.1.0` |
| [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.18.0` |
| [uuid](https://github.com/uuidjs/uuid) | `9.0.1` | `14.0.0` |
| [fast-uri](https://github.com/fastify/fast-uri) | `3.1.3` | `3.1.8` |
| [flatted](https://github.com/WebReflection/flatted) | `3.3.2` | `3.4.4` |
| [follow-redirects](https://github.com/follow-redirects/follow-redirects) | `1.15.9` | `1.16.1` |
| [form-data](https://github.com/form-data/form-data) | `4.0.2` | `4.0.6` |
| [js-cookie](https://github.com/js-cookie/js-cookie) | `3.0.5` | `3.0.8` |
| [piscina](https://github.com/piscinajs/piscina) | `4.8.0` | `4.9.4` |
| [postcss](https://github.com/postcss/postcss) | `8.5.2` | `8.5.29` |
| [protocol-buffers-schema](https://github.com/mafintosh/protocol-buffers-schema) | `3.6.0` | `3.6.1` |
| [shell-quote](https://github.com/ljharb/shell-quote) | `1.8.2` | `1.12.0` |
| [svgo](https://github.com/svg/svgo) | `2.8.0` | `2.8.4` |



Updates `echarts` from 5.6.0 to 6.1.0
- [Release notes](https://github.com/apache/echarts/releases)
- [Commits](apache/echarts@5.6.0...6.1.0)

Updates `lodash` from 4.17.21 to 4.18.0
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.18.0)

Updates `uuid` from 9.0.1 to 14.0.0
- [Release notes](https://github.com/uuidjs/uuid/releases)
- [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md)
- [Commits](uuidjs/uuid@v9.0.1...v14.0.0)

Updates `fast-uri` from 3.1.3 to 3.1.8
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.3...v3.1.8)

Updates `flatted` from 3.3.2 to 3.4.4
- [Commits](WebReflection/flatted@v3.3.2...v3.4.4)

Updates `follow-redirects` from 1.15.9 to 1.16.1
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](follow-redirects/follow-redirects@v1.15.9...v1.16.1)

Updates `form-data` from 4.0.2 to 4.0.6
- [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md)
- [Commits](form-data/form-data@v4.0.2...v4.0.6)

Updates `js-cookie` from 3.0.5 to 3.0.8
- [Release notes](https://github.com/js-cookie/js-cookie/releases)
- [Commits](js-cookie/js-cookie@v3.0.5...v3.0.8)

Updates `piscina` from 4.8.0 to 4.9.4
- [Release notes](https://github.com/piscinajs/piscina/releases)
- [Changelog](https://github.com/piscinajs/piscina/blob/v4.9.4/CHANGELOG.md)
- [Commits](piscinajs/piscina@v4.8.0...v4.9.4)

Updates `postcss` from 8.5.2 to 8.5.29
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.2...8.5.29)

Updates `protocol-buffers-schema` from 3.6.0 to 3.6.1
- [Commits](mafintosh/protocol-buffers-schema@v3.6.0...v3.6.1)

Updates `shell-quote` from 1.8.2 to 1.12.0
- [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md)
- [Commits](ljharb/shell-quote@v1.8.2...v1.12.0)

Updates `svgo` from 2.8.0 to 2.8.4
- [Release notes](https://github.com/svg/svgo/releases)
- [Commits](svg/svgo@v2.8.0...v2.8.4)

---
updated-dependencies:
- dependency-name: echarts
  dependency-version: 6.1.0
  dependency-type: direct:production
  dependency-group: npm-security
- dependency-name: fast-uri
  dependency-version: 3.1.5
  dependency-type: indirect
  dependency-group: npm-security
- dependency-name: flatted
  dependency-version: 3.4.4
  dependency-type: indirect
  dependency-group: npm-security
- dependency-name: follow-redirects
  dependency-version: 1.16.0
  dependency-type: indirect
  dependency-group: npm-security
- dependency-name: form-data
  dependency-version: 4.0.6
  dependency-type: indirect
  dependency-group: npm-security
- dependency-name: js-cookie
  dependency-version: 3.0.8
  dependency-type: indirect
  dependency-group: npm-security
- dependency-name: lodash
  dependency-version: 4.18.0
  dependency-type: direct:production
  dependency-group: npm-security
- dependency-name: piscina
  dependency-version: 4.9.3
  dependency-type: indirect
  dependency-group: npm-security
- dependency-name: postcss
  dependency-version: 8.5.25
  dependency-type: indirect
  dependency-group: npm-security
- dependency-name: protocol-buffers-schema
  dependency-version: 3.6.1
  dependency-type: indirect
  dependency-group: npm-security
- dependency-name: shell-quote
  dependency-version: 1.10.0
  dependency-type: indirect
  dependency-group: npm-security
- dependency-name: svgo
  dependency-version: 2.8.3
  dependency-type: indirect
  dependency-group: npm-security
- dependency-name: uuid
  dependency-version: 14.0.0
  dependency-type: direct:production
  dependency-group: npm-security
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/chat2db-community-client/npm-security-d7f4b17f15 branch from 9df9161 to 2b07975 Compare October 6, 2026 05:53

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@openai0229 openai0229 Awaiting requested review from openai0229 openai0229 is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

Chat2DB Community
Status: In Review

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@openai0229