Skip to content

chore(deps): bump the security-updates group across 1 directory with 11 updates #53

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
dependabot wants to merge 2 commits into
base: main
Choose a base branch
from
Open

chore(deps): bump the security-updates group across 1 directory with 11 updates #53

dependabot wants to merge 2 commits into from

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Dec 22, 2025 •
edited
Loading

Bumps the security-updates group with 11 updates in the / directory:

Package From To
@aws-sdk/client-lambda 3.906.0 3.957.0
axios 1.12.2 1.13.2
eciesjs 0.4.7 0.4.16
esbuild 0.27.0 0.27.2
files-from-path 1.0.0 1.1.4
lodash-es 4.17.21 4.17.22
ts-node 10.9.1 10.9.2
@changesets/cli 2.29.7 2.29.8
@tsconfig/node16 16.1.5 16.1.8
@types/estree 1.0.5 1.0.8
@types/lodash 4.17.20 4.17.21

Updates @aws-sdk/client-lambda from 3.906.0 to 3.957.0

Release notes

Sourced from @​aws-sdk/client-lambda's releases.

v3.957.0

3.957.0(2025-12-22)

Chores
  • move crc64NvmeCrtContainer to '@​aws-sdk/crc64-nvme' (#7600) (69196b71)
  • move e2e tests from cucumber to vitest (#7539) (561b8900)
  • build: replace lerna partial-tree build with turbo (#7597) (04bdba3e)
Documentation Changes
  • client-pcs: Change API Reference Documentation for default Mode in Accounting and SlurmRest (966f60ac)
New Features
  • client-config-service: Added supported resourceTypes for Config from July to November 2025 (2c7dab27)
  • client-ec2: Adds support for linkedGroupId on the CreatePlacementGroup and DescribePlacementGroups APIs. The linkedGroupId parameter is reserved for future use. (a492f734)
  • client-guardduty: Make accountIds a required field in GetRemainingFreeTrialDays API to reflect service behavior. (53e59c65)
  • middleware-flexible-checksums: use CRC64NVME JS implementation if CRT is not available (#7595) (4c6ad409)
Bug Fixes
  • middleware-flexible-checksums: advise user on InvalidChunkSizeError (#7598) (6fa3b4cc)

For list of updated packages, view updated-packages.md in assets-3.957.0.zip

v3.956.0

3.956.0(2025-12-19)

Chores
Documentation Changes
New Features
  • clients: update client endpoints as of 2025-12-19 (e0360a8f)
  • client-wickr: AWS Wickr now provides a suite of admin APIs to allow you to programmatically manage secure communication for Wickr networks at scale. These APIs enable you to automate administrative workflows including user lifecycle management, network configuration, and security group administration. (d105e0ef)
  • client-arc-region-switch: Automatic Plan Execution Reports allow customers to maintain a concise record of their Region switch Plan executions. This enables customer SREs and leadership to have a clear view of their recovery posture based on the generated reports for their Plan executions. (33dbf8d8)
  • client-workspaces-web: Add support for WebAuthn under user settings. (a42b84c4)

... (truncated)

Changelog

Sourced from @​aws-sdk/client-lambda's changelog.

3.957.0 (2025-12-22)

Note: Version bump only for package @​aws-sdk/client-lambda

3.956.0 (2025-12-19)

Note: Version bump only for package @​aws-sdk/client-lambda

3.955.0 (2025-12-18)

Note: Version bump only for package @​aws-sdk/client-lambda

3.954.0 (2025-12-17)

Note: Version bump only for package @​aws-sdk/client-lambda

3.953.0 (2025-12-16)

Features

  • clients: allow protocol selection by class constructor (#7568) (5c5fd2e)

3.952.0 (2025-12-15)

Note: Version bump only for package @​aws-sdk/client-lambda

... (truncated)

Commits

Updates axios from 1.12.2 to 1.13.2

Release notes

Sourced from axios's releases.

Release v1.13.2

Release notes:

Bug Fixes

  • http: fix 'socket hang up' bug for keep-alive requests when using timeouts; (#7206) (8d37233)
  • http: use default export for http2 module to support stubs; (#7196) (0588880)

Performance Improvements

Contributors to this release

Release v1.13.1

Release notes:

Bug Fixes

  • http: fixed a regression that caused the data stream to be interrupted for responses with non-OK HTTP statuses; (#7193) (bcd5581)

Contributors to this release

Release v1.13.0

Release notes:

Bug Fixes

  • fetch: prevent TypeError when config.env is undefined (#7155) (015faec)
  • resolve issue #7131 (added spacing in mergeConfig.js) (#7133) (9b9ec98)

Features

Contributors to this release

... (truncated)

Changelog

Sourced from axios's changelog.

1.13.2 (2025-11-04)

Bug Fixes

  • http: fix 'socket hang up' bug for keep-alive requests when using timeouts; (#7206) (8d37233)
  • http: use default export for http2 module to support stubs; (#7196) (0588880)

Performance Improvements

Contributors to this release

1.13.1 (2025-10-28)

Bug Fixes

  • http: fixed a regression that caused the data stream to be interrupted for responses with non-OK HTTP statuses; (#7193) (bcd5581)

Contributors to this release

1.13.0 (2025-10-27)

Bug Fixes

  • fetch: prevent TypeError when config.env is undefined (#7155) (015faec)
  • resolve issue #7131 (added spacing in mergeConfig.js) (#7133) (9b9ec98)

Features

Contributors to this release

... (truncated)

Commits
  • 08b84b5 chore(release): v1.13.2 (#7207)
  • 8d37233 fix(http): fix 'socket hang up' bug for keep-alive requests when using timeou...
  • 12c314b perf(http): fix early loop exit; (#7202)
  • f6d79e7 chore(sponsor): update sponsor block (#7203)
  • 0588880 fix(http): use default export for http2 module to support stubs; (#7196)
  • 1ef8e72 chore(release): v1.13.1 (#7194)
  • bcd5581 fix(http): fixed a regression that caused the data stream to be interrupted f...
  • c9b3371 chore: enhance styling and responsiveness in client.html (#7173)
  • 9ead04d [Release] v1.13.0 (#7189)
  • d000fbf fix(http2): fix possible race condition when handling http2 stream on almost ...
  • Additional commits viewable in compare view

Updates eciesjs from 0.4.7 to 0.4.16

Release notes

Sourced from eciesjs's releases.

v0.4.16

What's Changed

Full Changelog: ecies/js@v0.4.15...v0.4.16

v0.4.15

What's Changed

Full Changelog: ecies/js@v0.4.14...v0.4.15

v0.4.14

What's Changed

Full Changelog: ecies/js@v0.4.13...v0.4.14

v0.4.13

What's Changed

Full Changelog: ecies/js@v0.4.12...v0.4.13

v0.4.12

... (truncated)

Changelog

Sourced from eciesjs's changelog.

0.4.16

  • Bump dependencies
  • Drop Node 18 support
  • Remove deprecated @noble/curves usage

0.4.15

  • Bump dependencies
  • Revamp documentation
  • Make curve configurable in keys and utils via argument

0.4.14

  • Bump dependencies
  • Add details
  • Revamp documentation

0.4.13

  • Bump dependencies

0.4.12

  • Add PublicKey.toBytes and deprecate PublicKey.compressed and PublicKey.uncompressed
  • Save uncompressed public key data for secp256k1

0.4.11

  • Revamp encapsulate/decapsulate
  • Revamp symmetric encryption/decryption
  • Revamp elliptic utils
  • Add browser tests

0.4.10

  • Fix commonjs build

0.4.9

  • Add examples
  • Update documentation
  • Migrate to vitest
  • Export all modules to allow full customization
  • Introduce @ecies/ciphers as symmetric cipher adapter for different platforms
    • Use pure JS (@noble/ciphers) AES implementation if running in browsers to improve compatibility
    • Use node:crypto's chacha20 implementation on Node runtime to improve performance

0.4.1 ~ 0.4.8

... (truncated)

Commits

Updates esbuild from 0.27.0 to 0.27.2

Release notes

Sourced from esbuild's releases.

v0.27.2

  • Allow import path specifiers starting with #/ (#4361)

    Previously the specification for package.json disallowed import path specifiers starting with #/, but this restriction has recently been relaxed and support for it is being added across the JavaScript ecosystem. One use case is using it for a wildcard pattern such as mapping #/* to ./src/* (previously you had to use another character such as #_* instead, which was more confusing). There is some more context in nodejs/node#49182.

    This change was contributed by @​hybrist.

  • Automatically add the -webkit-mask prefix (#4357, #4358)

    This release automatically adds the -webkit- vendor prefix for the mask CSS shorthand property:

    /* Original code */
main {
  mask: url(x.png) center/5rem no-repeat
}
/* Old output (with --target=chrome110) */
main {
mask: url(x.png) center/5rem no-repeat;
}
/* New output (with --target=chrome110) */
main {
-webkit-mask: url(x.png) center/5rem no-repeat;
mask: url(x.png) center/5rem no-repeat;
}

    This change was contributed by @​BPJEnnova.

  • Additional minification of switch statements (#4176, #4359)

    This release contains additional minification patterns for reducing switch statements. Here is an example:

    // Original code
switch (x) {
  case 0:
    foo()
    break
  case 1:
  default:
    bar()
}
// Old output (with --minify)
switch(x){case 0:foo();break;case 1:default:bar()}
// New output (with --minify)

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.27.2

  • Allow import path specifiers starting with #/ (#4361)

    Previously the specification for package.json disallowed import path specifiers starting with #/, but this restriction has recently been relaxed and support for it is being added across the JavaScript ecosystem. One use case is using it for a wildcard pattern such as mapping #/* to ./src/* (previously you had to use another character such as #_* instead, which was more confusing). There is some more context in nodejs/node#49182.

    This change was contributed by @​hybrist.

  • Automatically add the -webkit-mask prefix (#4357, #4358)

    This release automatically adds the -webkit- vendor prefix for the mask CSS shorthand property:

    /* Original code */
main {
  mask: url(x.png) center/5rem no-repeat
}
/* Old output (with --target=chrome110) */
main {
mask: url(x.png) center/5rem no-repeat;
}
/* New output (with --target=chrome110) */
main {
-webkit-mask: url(x.png) center/5rem no-repeat;
mask: url(x.png) center/5rem no-repeat;
}

    This change was contributed by @​BPJEnnova.

  • Additional minification of switch statements (#4176, #4359)

    This release contains additional minification patterns for reducing switch statements. Here is an example:

    // Original code
switch (x) {
  case 0:
    foo()
    break
  case 1:
  default:
    bar()
}
// Old output (with --minify)
switch(x){case 0:foo();break;case 1:default:bar()}

... (truncated)

Commits
  • cd83297 publish 0.27.2 to npm
  • 2759721 additional tests for switch with break
  • fd2b4b3 update release notes
  • c8d93a7 fix #4357: -webkit- prefix for mask shorthand (#4358)
  • 92ff12c compat table: update @types/node
  • a35eceb compat table: fix a type error with the new types
  • f598984 fix make compat-table to install dependencies
  • f7f6df0 release notes for #4361
  • 6f8ec15 fix: allow subpath imports that start with #/ (#4361)
  • f7ae61f minify some switch statements to if-else statement
  • Additional commits viewable in compare view

Updates files-from-path from 1.0.0 to 1.1.4

Release notes

Sourced from files-from-path's releases.

v1.1.4

1.1.4 (2025-03-25)

Bug Fixes

v1.1.3

1.1.3 (2025-02-12)

Bug Fixes

v1.1.2

1.1.2 (2025-02-11)

Bug Fixes

  • Add missing types key to package entry point (#41) (b645e00)

v1.1.1

1.1.1 (2024-11-15)

Bug Fixes

v1.1.0

1.1.0 (2024-11-15)

Features

  • normalise paths for windows file paths (#38) (41bb5c5)

v1.0.4

1.0.4 (2023-12-07)

Bug Fixes

  • build step cannot be run in dist dir (198359f)

v1.0.3

1.0.3 (2023-11-29)

... (truncated)

Changelog

Sourced from files-from-path's changelog.

1.1.4 (2025-03-25)

Bug Fixes

1.1.3 (2025-02-12)

Bug Fixes

1.1.2 (2025-02-11)

Bug Fixes

  • Add missing types key to package entry point (#41) (b645e00)

1.1.1 (2024-11-15)

Bug Fixes

1.1.0 (2024-11-15)

Features

  • normalise paths for windows file paths (#38) (41bb5c5)

1.0.4 (2023-12-07)

Bug Fixes

  • build step cannot be run in dist dir (198359f)

1.0.3 (2023-11-29)

Bug Fixes

1.0.2 (2023-11-20)

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by it-dag-house, a new releaser for files-from-path since your current version.


Updates lodash-es from 4.17.21 to 4.17.22

Commits

Updates ts-node from 10.9.1 to 10.9.2

Release notes

Sourced from ts-node's releases.

Fix tsconfig.json file not found

Fixed

Commits

Updates @changesets/cli from 2.29.7 to 2.29.8

Commits

Updates @tsconfig/node16 from 16.1.5 to 16.1.8

Commits

Updates @types/estree from 1.0.5 to 1.0.8

Commits

Updates @types/lodash from 4.17.20 to 4.17.21

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the security-updates group across 1 directory with …
aedfdf6 
…11 updates

Bumps the security-updates group with 11 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@aws-sdk/client-lambda](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-lambda) | `3.906.0` | `3.957.0` |
| [axios](https://github.com/axios/axios) | `1.12.2` | `1.13.2` |
| [eciesjs](https://github.com/ecies/js) | `0.4.7` | `0.4.16` |
| [esbuild](https://github.com/evanw/esbuild) | `0.27.0` | `0.27.2` |
| [files-from-path](https://github.com/storacha/files-from-path) | `1.0.0` | `1.1.4` |
| [lodash-es](https://github.com/lodash/lodash) | `4.17.21` | `4.17.22` |
| [ts-node](https://github.com/TypeStrong/ts-node) | `10.9.1` | `10.9.2` |
| [@changesets/cli](https://github.com/changesets/changesets) | `2.29.7` | `2.29.8` |
| [@tsconfig/node16](https://github.com/tsconfig/bases/tree/HEAD/bases) | `16.1.5` | `16.1.8` |
| [@types/estree](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/estree) | `1.0.5` | `1.0.8` |
| [@types/lodash](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/lodash) | `4.17.20` | `4.17.21` |



Updates `@aws-sdk/client-lambda` from 3.906.0 to 3.957.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-lambda/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.957.0/clients/client-lambda)

Updates `axios` from 1.12.2 to 1.13.2
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.12.2...v1.13.2)

Updates `eciesjs` from 0.4.7 to 0.4.16
- [Release notes](https://github.com/ecies/js/releases)
- [Changelog](https://github.com/ecies/js/blob/master/CHANGELOG.md)
- [Commits](ecies/js@v0.4.7...v0.4.16)

Updates `esbuild` from 0.27.0 to 0.27.2
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md)
- [Commits](evanw/esbuild@v0.27.0...v0.27.2)

Updates `files-from-path` from 1.0.0 to 1.1.4
- [Release notes](https://github.com/storacha/files-from-path/releases)
- [Changelog](https://github.com/storacha/files-from-path/blob/main/CHANGELOG.md)
- [Commits](storacha/files-from-path@v1.0.0...v1.1.4)

Updates `lodash-es` from 4.17.21 to 4.17.22
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](https://github.com/lodash/lodash/commits)

Updates `ts-node` from 10.9.1 to 10.9.2
- [Release notes](https://github.com/TypeStrong/ts-node/releases)
- [Changelog](https://github.com/TypeStrong/ts-node/blob/main/development-docs/release-template.md)
- [Commits](TypeStrong/ts-node@v10.9.1...v10.9.2)

Updates `@changesets/cli` from 2.29.7 to 2.29.8
- [Release notes](https://github.com/changesets/changesets/releases)
- [Commits](https://github.com/changesets/changesets/commits)

Updates `@tsconfig/node16` from 16.1.5 to 16.1.8
- [Commits](https://github.com/tsconfig/bases/commits/HEAD/bases)

Updates `@types/estree` from 1.0.5 to 1.0.8
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/estree)

Updates `@types/lodash` from 4.17.20 to 4.17.21
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/lodash)

---
updated-dependencies:
- dependency-name: "@aws-sdk/client-lambda"
  dependency-version: 3.957.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: security-updates
- dependency-name: axios
  dependency-version: 1.13.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: security-updates
- dependency-name: eciesjs
  dependency-version: 0.4.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: security-updates
- dependency-name: esbuild
  dependency-version: 0.27.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: security-updates
- dependency-name: files-from-path
  dependency-version: 1.1.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: security-updates
- dependency-name: lodash-es
  dependency-version: 4.17.22
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: security-updates
- dependency-name: ts-node
  dependency-version: 10.9.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: security-updates
- dependency-name: "@changesets/cli"
  dependency-version: 2.29.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: security-updates
- dependency-name: "@tsconfig/node16"
  dependency-version: 16.1.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: security-updates
- dependency-name: "@types/estree"
  dependency-version: 1.0.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: security-updates
- dependency-name: "@types/lodash"
  dependency-version: 4.17.21
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: security-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added the security label Dec 22, 2025
@dependabot @github
Copy link
Author

dependabot bot commented on behalf of github Dec 22, 2025

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@github-actions
Copy link

github-actions bot commented Dec 22, 2025

Dependency Review

The following issues were found:

  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ✅ 0 package(s) with unknown licenses.
  • ⚠️ 1 packages with OpenSSF Scorecard issues.

View full job summary

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

security

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@actions-user