Bump the npm_and_yarn group across 1 directory with 7 updates by dependabot[bot] · Pull Request #96 · TaskarCenterAtUW/workspaces-frontend

dependabot · 2026-07-23T16:50:27Z

Bumps the npm_and_yarn group with 7 updates in the / directory:

Package	From	To
dompurify	`3.4.11`	`3.4.12`
esbuild	`0.27.7`	`0.28.1`
fast-uri	`3.1.2`	`3.1.4`
immutable	`4.3.8`	`4.3.9`
shell-quote	`1.8.4`	`1.10.0`
svgo	`4.0.1`	`4.0.2`
tar	`7.5.16`	`7.5.21`

Updates dompurify from 3.4.11 to 3.4.12

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.12

Fixed an issue where a hook would not get called for custom elements, thanks @Rikuxx0

Hardened the handling of hooks removing elements, @mkrause-bee360

Added support for a few new SVG attributes, thanks @cbn-falias & @Develop-KIM

Hardened the handling of declarative partial updates

Updated the documentation is several spots, README, wiki, etc.

Bumped several dependencies where possible

Commits

a9ca1e5 release: 3.4.12 (#1537)
See full diff in compare view

Updates esbuild from 0.27.7 to 0.28.1

Release notes

Sourced from esbuild's releases.

v0.28.1
Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

Thanks to @dellalibera for reporting this issue.

Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

Thanks to @sondt99 for reporting this issue.
Avoid inlining using and await using declarations (#4482)

Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:
// Original code
{
  using x = new Resource()
  x.activate()
}
// Old output (with --minify)
new Resource().activate();
// New output (with --minify)
{using e=new Resource;e.activate()}
Fix module evaluation when an error is thrown (#4461, #4467)

If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.
Fix some edge cases around the new operator (#4477)

Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:
// Original code
new (foo()`bar`)()
new (foo()?.bar)()
// Old output
new foo()bar();
new (foo())?.bar();

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.1
Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

Thanks to @dellalibera for reporting this issue.

Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

Thanks to @sondt99 for reporting this issue.
Avoid inlining using and await using declarations (#4482)

Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:
// Original code
{
  using x = new Resource()
  x.activate()
}
// Old output (with --minify)
new Resource().activate();
// New output (with --minify)
{using e=new Resource;e.activate()}
Fix module evaluation when an error is thrown (#4461, #4467)

If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.
Fix some edge cases around the new operator (#4477)

Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:
// Original code
new (foo()`bar`)()
new (foo()?.bar)()
// Old output
new foo()bar();
new (foo())?.bar();

... (truncated)

Commits

bb9db84 publish 0.28.1 to npm
9ff053e security: add integrity checks to the Deno API
0a9bf21 enforce non-negative size in gzip parser
e2a1a71 security: forbid \\ in local dev server requests
83a2cbf fix #4482: don't inline using declarations
308ad74 fix #4471: renaming of nested var declarations
f013f5f fix some typos
aafd6e4 chore: fix some minor issues in comments (#4462)
15300c3 follow up: cjs evaluation fixes
1bda0c3 fix #4461, fix #4467: esm evaluation fixes
Additional commits viewable in compare view

Updates fast-uri from 3.1.2 to 3.1.4

Release notes

Sourced from fast-uri's releases.

v3.1.4

⚠️ Security Release

Fix for GHSA-v2hh-gcrm-f6hx

Full Changelog: fastify/fast-uri@v3.1.3...v3.1.4

v3.1.3

⚠️ Security Release

Fixes: GHSA-4c8g-83qw-93j6

Full Changelog: fastify/fast-uri@v3.1.2...v3.1.3

Commits

6aeece6 Bumped v3.1.4
2d50fba fix: reject literal backslash in URI authority
0549fe3 Bumped v3.1.3
2a6d357 Merge commit from fork
See full diff in compare view

Updates immutable from 4.3.8 to 4.3.9

Release notes

Sourced from immutable's releases.

v4.3.9

What's changed

fix(List): guard oversized bounds in setListBounds. Fixes CVE GHSA-v56q-mh7h-f735

perf(Map): index large hash-collision buckets for faster lookups. Fixes CVE GHSA-xvcm-6775-5m9r

Full Changelog: immutable-js/immutable-js@v4.3.8...v4.3.9

Changelog

Sourced from immutable's changelog.

4.3.9

fix(List): guard oversized bounds in setListBounds. Fixes CVE GHSA-v56q-mh7h-f735

perf(Map): index large hash-collision buckets for faster lookups. Fixes CVE GHSA-xvcm-6775-5m9r

5.1.7

fix(Repeat): lastIndexOf returned size instead of size - 1 by @chatman-media in immutable-js/immutable-js#2227. Fixes CVE CVE-2026-29063

fix(IndexedCollection): has(index) on a lazy Seq of unknown size now checks index existence instead of searching for a value equal to the index #2203

[TypeScript]: reduce/reduceRight without an initial value now infer the result type from the collection's values when the reducer returns a value (e.g. list.reduce((a, b) => a + b) infers number), matching Array#reduce. Previously an explicit type argument was required. #2205

5.1.6

fix(reverseFactory): read reversedSequence.size in __iterator instead of this #2196

5.1.5

Fix Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

5.1.4

Migrate some files to TS by @jdeniau in immutable-js/immutable-js#2125

Iterator.ts

PairSorting.ts

toJS.ts

Math.ts

Hash.ts

Extract CollectionHelperMethods and convert to TS by @jdeniau in immutable-js/immutable-js#2131

Use npm trusted publishing only to avoid token stealing.

Documentation

Fix/a11y issues by @lyannel in immutable-js/immutable-js#2136

Doc add Map.get signature update by @borracciaBlu in immutable-js/immutable-js#2138

fix(doc):minor-issues#2132 by @JayMeDotDot in immutable-js/immutable-js#2133

Fix algolia search by @jdeniau in immutable-js/immutable-js#2135

Typo in OrderedMap by @jdeniau in immutable-js/immutable-js#2144

Internal

chore: Sort all imports and activate eslint import rule by @jdeniau in immutable-js/immutable-js#2119

5.1.3

TypeScript

fix: allow readonly map entry constructor by @septs in immutable-js/immutable-js#2123

Documentation

... (truncated)

Commits

5da7919 4.3.9
794a1a9 Merge commit from fork
3dd7e56 perf(Map): index large hash-collision buckets for faster lookups
62d0b58 fix ts in tests
8c0e5f8 Merge commit from fork
f0bc997 Merge commit from fork
8ac83f4 change tag
f7373e5 use id-token to deploy 4.x version
2f545ad changelog
See full diff in compare view

Updates shell-quote from 1.8.4 to 1.10.0

Changelog

Sourced from shell-quote's changelog.

v1.10.0 - 2026-07-10

Merged

[New] parse: add opt-in splitUnquoted option for shell field-splitting of unquoted expansions [#1](https://github.com/ljharb/shell-quote/issues/1)

Commits

[Fix] parse: match nested ${...} braces so nested parameter expansion is consumed as one substitution c0842c8

[Tests] parse: pin single-quote literalness and unmatched-quote handling a0d03e3

[readme] remove the space in js code fences so evalmd evaluates them 2116fa3

[Tests] quote: pin conservative escaping of =, @, ^, ,, :, ! (#11) 1c36f3f

[readme] document that quote outputs POSIX quoting, not cmd.exe/PowerShell 100e96e

[readme] document parse's supported parameter-expansion subset e1c75cd

[Fix] parse: a backslash inside single quotes must not escape the closing quote 5d460a3

[readme] fix stale example outputs 2de86f5

[Tests] quote: pin that a backslash with whitespace is not doubled in single quotes (#14) 190e236

[readme] quote: use output verbatim; do not re-quote it (#11) 1b36468

[Refactor] parse: fix swapped SINGLE_QUOTE/DOUBLE_QUOTE variable names 801af5c

[types] fix an error TS v6 ignores but v7 fails on 59bbf8b

[Dev Deps] update @arethetypeswrong/cli, evalmd a04d475

[Dev Deps] update @arethetypeswrong/ci, eslint d390f9a

[Tests] quote: the tilde test escapes every ~, not just a leading one (#9) 617d119

v1.9.0 - 2026-06-24

Commits

[New] add types dca6e21

[Dev Deps] update eslint 9aa9e8f

[Fix] parse: finalize tokens in linear time (GHSA-395f-4hp3-45gv) 7ff5488

[actions] update workflows 75e8497

[actions] Windows + node 4/6/7: pin eslint to 9 before install, since npm 2/3 cannot stage eslint 10@types/esrecurse 3fb739d

[actions] retry npm install on Windows to survive npm 2/3 staging-rename flake abe0163

[actions] Windows + node 5/7: install deps with a modern node b4bafa2

[Fix] quote: escape leading ~ to prevent shell tilde-expansion 7a76c1a

[Dev Deps] update auto-changelog, tape 7184b44

[Dev Deps] apparently jackspeak is no longer in the graph 9ba368a

Commits

64988d9 v1.10.0
617d119 [Tests] quote: the tilde test escapes every ~, not just a leading one (#9)
59bbf8b [types] fix an error TS v6 ignores but v7 fails on
190e236 [Tests] quote: pin that a backslash with whitespace is not doubled in singl...
a04d475 [Dev Deps] update @arethetypeswrong/cli, evalmd
b9545b3 [New] parse: add opt-in splitUnquoted option for shell field-splitting of...
1b36468 [readme] quote: use output verbatim; do not re-quote it (#11)
1c36f3f [Tests] quote: pin conservative escaping of =, @, ^, ,, :, ! (#11)
e1c75cd [readme] document parse's supported parameter-expansion subset
c0842c8 [Fix] parse: match nested ${...} braces so nested parameter expansion is ...
Additional commits viewable in compare view

Updates svgo from 4.0.1 to 4.0.2

Release notes

Sourced from svgo's releases.

v4.0.2

What's Changed

Security

removeScripts, remove JavaScript URIs case-insensitively and make <script> handling namespace aware. By @SethFalco

Bug Fixes

convertColors, skip case-normalization for CSS custom properties. By @SethFalco in svg/svgo#2213

convertPathData, improve handling of consecutive t commands. By @KTibow in svg/svgo#2156

convertPathData, safer handling of paths. By @KTibow in svg/svgo#2158

Improve parsing of negative (or +) arc radii. By @KTibow in svg/svgo#2205

When converting to a data URI, only encode it as a data URI once. By @johnkenny54 in svg/svgo#2053

Performance

mergePaths, speed up child node removal. By @mozzie in svg/svgo#2216

Other Changes

removeAttributesBySelector, log warning and noop if missing parameters. By @KTibow in svg/svgo#2215

Commits

b2309cf chore: sync version with api
f529cfc Merge commit from fork
581fe68 performance: speed up mergePath child node removal (#2216)
eb4c8b6 docs(removeAttributesBySelector): properly document and check types (#2215)
6fd5872 fix(convertColors): skip convertCase on css custom properties (#2213)
7414f73 fix: properly parse negative (or +) arc radii (#2205)
a8c19aa fix: only call encodeSVGDatauri once and add test case (#2053)
65548f4 fix(convertPathData): properly handle consecutive t commands (#2156)
a41a7c1 fix(convertPathData): introducing isSafeToRemove (#2164)
38625dd test: handle charm icons (#2203)
See full diff in compare view

Updates tar from 7.5.16 to 7.5.21

Commits

0cd9cc3 7.5.21
631ae59 list: prevent unbounded recursion
ebbb720 7.5.20
2f27196 fix: fully disable and dispose of unzip when aborting parser
be440da 7.5.19
2812e93 add maxDecompressionRatio guard against explosive decompression
9ecd4d2 7.5.18
9e78bf0 refuse to let header size be less than 0
e02a4e9 pax: parse values according to known types
9cbdb31 7.5.17
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the npm_and_yarn group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [dompurify](https://github.com/cure53/DOMPurify) | `3.4.11` | `3.4.12` | | [esbuild](https://github.com/evanw/esbuild) | `0.27.7` | `0.28.1` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.1.2` | `3.1.4` | | [immutable](https://github.com/immutable-js/immutable-js) | `4.3.8` | `4.3.9` | | [shell-quote](https://github.com/ljharb/shell-quote) | `1.8.4` | `1.10.0` | | [svgo](https://github.com/svg/svgo) | `4.0.1` | `4.0.2` | | [tar](https://github.com/isaacs/node-tar) | `7.5.16` | `7.5.21` | Updates `dompurify` from 3.4.11 to 3.4.12 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.4.11...3.4.12) Updates `esbuild` from 0.27.7 to 0.28.1 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md) - [Commits](evanw/esbuild@v0.27.7...v0.28.1) Updates `fast-uri` from 3.1.2 to 3.1.4 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.2...v3.1.4) Updates `immutable` from 4.3.8 to 4.3.9 - [Release notes](https://github.com/immutable-js/immutable-js/releases) - [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md) - [Commits](immutable-js/immutable-js@v4.3.8...v4.3.9) Updates `shell-quote` from 1.8.4 to 1.10.0 - [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md) - [Commits](ljharb/shell-quote@v1.8.4...v1.10.0) Updates `svgo` from 4.0.1 to 4.0.2 - [Release notes](https://github.com/svg/svgo/releases) - [Commits](svg/svgo@v4.0.1...v4.0.2) Updates `tar` from 7.5.16 to 7.5.21 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v7.5.16...v7.5.21) --- updated-dependencies: - dependency-name: dompurify dependency-version: 3.4.12 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: esbuild dependency-version: 0.28.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: immutable dependency-version: 4.3.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: shell-quote dependency-version: 1.10.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: svgo dependency-version: 4.0.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tar dependency-version: 7.5.21 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 23, 2026

dependabot Bot mentioned this pull request Jul 23, 2026

Bump esbuild from 0.27.7 to 0.28.1 in the npm_and_yarn group across 1 directory #95

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump the npm_and_yarn group across 1 directory with 7 updates#96

Bump the npm_and_yarn group across 1 directory with 7 updates#96
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/npm_and_yarn-71666f1c9c

dependabot Bot commented on behalf of github Jul 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 23, 2026

DOMPurify 3.4.12

v0.28.1

0.28.1

v3.1.4

⚠️ Security Release

v3.1.3

⚠️ Security Release

v4.3.9

What's changed

4.3.9

5.1.7

5.1.6

5.1.5

5.1.4

Documentation

Internal

5.1.3

TypeScript

Documentation

v1.10.0 - 2026-07-10

Merged

Commits

v1.9.0 - 2026-06-24

Commits

v4.0.2

What's Changed

Security

Bug Fixes

Performance

Other Changes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants