Skip to content

build(deps): bump the npm_and_yarn group across 4 directories with 8 updates#1

Open
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/npm_and_yarn/pkgs/applications/editors/vim/plugins/patches/markdown-preview-nvim/npm_and_yarn-a731bda595
Open

build(deps): bump the npm_and_yarn group across 4 directories with 8 updates#1
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/npm_and_yarn/pkgs/applications/editors/vim/plugins/patches/markdown-preview-nvim/npm_and_yarn-a731bda595

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Aug 30, 2025

Bumps the npm_and_yarn group with 1 update in the /pkgs/applications/editors/vim/plugins/patches/markdown-preview-nvim directory: next.
Bumps the npm_and_yarn group with 4 updates in the /pkgs/by-name/re/react-static directory: axios, tar-fs, webpack-dev-server and react-dev-utils.
Bumps the npm_and_yarn group with 1 update in the /pkgs/servers/home-assistant/custom-lovelace-modules/button-card directory: semantic-release.
Bumps the npm_and_yarn group with 2 updates in the /pkgs/tools/admin/meshcentral directory: ws and aedes.

Updates next from 7.0.3 to 15.5.2

Release notes

Sourced from next's releases.

v15.5.2

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • fix: disable unknownatrules lint rule entirely (#83059)
  • revert: add ?dpl to fonts in /_next/static/media (#83062)

Credits

Huge thanks to @​bgub and @​ztanner for helping!

v15.5.1

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • fix: aliased navigations should apply scroll handling (#82900)
  • Turbopack: fix invalid NFT entry with file behind symlink (#82887)
  • fix: typesafe linking to route handlers and pages API routes (#82858)
  • fix: change "noUnknownAtRules" to "warn" for Biome (#82974)
  • fix: add path normalization to getRelativePath for Windows (#82918)
  • feat: add typesafety with config.typedRoutes to redirect() and permanentRedirect() (#82860)
  • fix: avoid importing types that will be unused (#82856)
  • fix: update the config.api.responseLimit type (#82852)
  • fix: update validation return types (#82854)

Credits

Huge thanks to @​bgub, @​mischnic, and @​ztanner for helping!

v15.5.1-canary.20

Misc Changes

  • Turbopack: hide blocking spans in trace server: #83167
  • Update Rspack production test manifest: #83207
  • [create-next-app] Generate route types after setup: #82956
  • Update Rspack development test manifest: #83208
  • docs: fix snippets in getting started: #83228

Credits

Huge thanks to @​sokra, @​vercel-release-bot, @​bgub, and @​icyJoseph for helping!

v15.5.1-canary.19

Core Changes

  • [sourcemaps] Always check for vendor chunks regardless of Node.js version: #83114
  • Turbopack: Remove undocumented legacy syntax for built-in conditions (e.g. foreign, browser): #83068
  • [metadata] update metadata routes cache headers: #83215

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by vercel-release-bot, a new releaser for next since your current version.


Updates axios from 0.21.4 to 1.11.0

Release notes

Sourced from axios's releases.

Release v1.11.0

Release notes:

Bug Fixes

  • form-data npm pakcage (#6970) (e72c193)
  • prevent RangeError when using large Buffers (#6961) (a2214ca)
  • types: resolve type discrepancies between ESM and CJS TypeScript declaration files (#6956) (8517aa1)

Contributors to this release

Release v1.10.0

Release notes:

Bug Fixes

  • adapter: pass fetchOptions to fetch function (#6883) (0f50af8)
  • form-data: convert boolean values to strings in FormData serialization (#6917) (5064b10)
  • package: add module entry point for React Native; (#6933) (3d343b8)

Features

Contributors to this release

Release v1.9.0

Release notes:

Bug Fixes

  • core: fix the Axios constructor implementation to treat the config argument as optional; (#6881) (6c5d4cd)
  • fetch: fixed ERR_NETWORK mapping for Safari browsers; (#6767) (dfe8411)
  • headers: allow iterable objects to be a data source for the set method; (#6873) (1b1f9cc)
  • headers: fix getSetCookie by using 'get' method for caseless access; (#6874) (d4f7df4)
  • headers: fixed support for setting multiple header values from an iterated source; (#6885) (f7a3b5e)
  • http: send minimal end multipart boundary (#6661) (987d2e2)
  • types: fix autocomplete for adapter config (#6855) (e61a893)

... (truncated)

Changelog

Sourced from axios's changelog.

1.11.0 (2025-07-22)

Bug Fixes

  • form-data npm pakcage (#6970) (e72c193)
  • prevent RangeError when using large Buffers (#6961) (a2214ca)
  • types: resolve type discrepancies between ESM and CJS TypeScript declaration files (#6956) (8517aa1)

Contributors to this release

1.10.0 (2025-06-14)

Bug Fixes

  • adapter: pass fetchOptions to fetch function (#6883) (0f50af8)
  • form-data: convert boolean values to strings in FormData serialization (#6917) (5064b10)
  • package: add module entry point for React Native; (#6933) (3d343b8)

Features

Contributors to this release

1.9.0 (2025-04-24)

Bug Fixes

  • core: fix the Axios constructor implementation to treat the config argument as optional; (#6881) (6c5d4cd)
  • fetch: fixed ERR_NETWORK mapping for Safari browsers; (#6767) (dfe8411)
  • headers: allow iterable objects to be a data source for the set method; (#6873) (1b1f9cc)
  • headers: fix getSetCookie by using 'get' method for caseless access; (#6874) (d4f7df4)

... (truncated)

Commits
  • b76c4ac chore(release): v1.11.0 (#6974)
  • e72c193 fix: form-data npm pakcage (#6970)
  • 8517aa1 fix(types): resolve type discrepancies between ESM and CJS TypeScript declara...
  • a2214ca fix: prevent RangeError when using large Buffers (#6961)
  • 6161947 refactor: use spread operator instead of '.apply()' (#6938)
  • a1d16dd refactor: use an object spread instead of Object.assign (#6939)
  • 07183cd chore(sponsor): update sponsor block (#6952)
  • ef36347 docs(CONTRIBUTING): update docs link for accuracy (#6894)
  • b29bd6a chore(sponsor): update sponsor block (#6948)
  • a406a93 chore(sponsor): update sponsor block (#6937)
  • Additional commits viewable in compare view

Updates tar-fs from 2.1.3 to 3.1.0

Commits

Updates webpack-dev-server from 3.11.3 to 5.2.2

Release notes

Sourced from webpack-dev-server's releases.

v5.2.2

5.2.2 (2025-06-03)

Bug Fixes

  • "Overlay enabled" false positive (18e72ee)
  • do not crush when error is null for runtime errors (#5447) (309991f)
  • remove unnecessary header X_TEST (#5451) (64a6124)
  • respect the allowedHosts option for cross-origin header check (#5510) (03d1214)

v5.2.1

5.2.1 (2025-03-26)

Security

  • cross-origin requests are not allowed unless allowed by Access-Control-Allow-Origin header
  • requests with an IP addresses in the Origin header are not allowed to connect to WebSocket server unless configured by allowedHosts or it different from the Host header

The above changes may make the dev server not work if you relied on such behavior, but unfortunately they carry security risks, so they were considered as fixes.

Bug Fixes

  • prevent overlay for errors caught by React error boundaries (#5431) (8c1abc9)
  • take the first network found instead of the last one, this restores the same behavior as 5.0.4 (#5411) (ffd0b86)

v5.2.0

5.2.0 (2024-12-11)

Features

  • added getClientEntry and getClientHotEntry methods to get clients entries (dc642a8)

Bug Fixes

  • speed up initial client bundling (145b5d0)

v5.1.0

5.1.0 (2024-09-03)

Features

  • add visual progress indicators (a8f40b7)
  • added the app option to be Function (by default only with connect compatibility frameworks) (3096148)
  • allow the server option to be Function (#5275) (02a1c6d)
  • http2 support for connect and connect compatibility frameworks which support HTTP2 (#5267) (6509a3f)

... (truncated)

Changelog

Sourced from webpack-dev-server's changelog.

5.2.2 (2025-06-03)

Bug Fixes

  • "Overlay enabled" false positive (18e72ee)
  • do not crush when error is null for runtime errors (#5447) (309991f)
  • remove unnecessary header X_TEST (#5451) (64a6124)
  • respect the allowedHosts option for cross-origin header check (#5510) (03d1214)

5.2.1 (2025-03-26)

Security

  • cross-origin requests are not allowed unless allowed by Access-Control-Allow-Origin header
  • requests with an IP addresses in the Origin header are not allowed to connect to WebSocket server unless configured by allowedHosts or it different from the Host header

The above changes may make the dev server not work if you relied on such behavior, but unfortunately they carry security risks, so they were considered as fixes.

Bug Fixes

  • prevent overlay for errors caught by React error boundaries (#5431) (8c1abc9)
  • take the first network found instead of the last one, this restores the same behavior as 5.0.4 (#5411) (ffd0b86)

5.2.0 (2024-12-11)

Features

  • added getClientEntry and getClientHotEntry methods to get clients entries (dc642a8)

Bug Fixes

  • speed up initial client bundling (145b5d0)

5.1.0 (2024-09-03)

Features

  • add visual progress indicators (a8f40b7)
  • added the app option to be Function (by default only with connect compatibility frameworks) (3096148)
  • allow the server option to be Function (#5275) (02a1c6d)
  • http2 support for connect and connect compatibility frameworks which support HTTP2 (#5267) (6509a3f)

Bug Fixes

  • check the platform property to determinate the target (#5269) (c3b532c)

... (truncated)

Commits
  • 195a7e6 chore(release): 5.2.2
  • 620bef1 chore(deps): update (#5511)
  • 03d1214 fix: respect the allowedHosts option for cross-origin header check (#5510)
  • 5ba862e chore(deps-dev): bump the dependencies group across 1 directory with 7 update...
  • f7fec94 chore: fix typo (#5508)
  • 6ee8cd0 ci: add Node.js v24 (#5492)
  • d30f963 chore: update http-proxy-middleware to ^2.0.9 (#5503)
  • 66cf033 chore(deps-dev): bump the dependencies group with 2 updates (#5504)
  • 4367a5c refactor: use 'String#startsWith' & replace if-then-else (#5501)
  • 8e6604f chore(deps): bump the dependencies group across 1 directory with 4 updates (#...
  • Additional commits viewable in compare view

Updates react-dev-utils from 9.1.0 to 12.0.1

Changelog

Sourced from react-dev-utils's changelog.

2.0.3 and Newer Versions

Please refer to CHANGELOG-2.x.md for the 2.x range, and https://github.com/facebook/create-react-app/blob/main/CHANGELOG.md for the newer versions.

1.1.5 (August 24, 2018)

  • react-scripts

    • Update the webpack-dev-server dependency

  • react-dev-utils

    • #4866 Fix a Windows-only vulnerability (CVE-2018-6342) in the development server (@​acdlite)
    • Update the sockjs-client dependency

Committers: 1

Migrating from 1.1.4 to 1.1.5

Inside any created project that has not been ejected, run:

npm install --save --save-exact react-scripts@1.1.5

or

yarn add --exact react-scripts@1.1.5

1.1.4 (April 3, 2018)

🐛 Bug Fix

Committers: 1

Migrating from 1.1.3 to 1.1.4

Inside any created project that has not been ejected, run:

</tr></table>

... (truncated)

Commits

Updates semantic-release from 17.4.7 to 24.2.7

Release notes

Sourced from semantic-release's releases.

v24.2.7

24.2.7 (2025-07-11)

Performance Improvements

v24.2.6

24.2.6 (2025-06-29)

Bug Fixes

  • deps: update @​semantic-release/npm to ^12.0.2 (#3791) (93177d0)

v24.2.5

24.2.5 (2025-05-23)

Bug Fixes

  • deps: raise the minimum of the defined range for marked-terminal (#3742) (fb1ccd4)

v24.2.4

24.2.4 (2025-05-16)

Bug Fixes

v24.2.3

24.2.3 (2025-02-15)

Bug Fixes

  • types: fixed typescript definition (0e08b5c), closes #3601

v24.2.2

24.2.2 (2025-02-09)

Bug Fixes

  • get-git-auth-url.js: Added debug for success (#3595) (2616d93)

v24.2.1

24.2.1 (2025-01-03)

... (truncated)

Commits
  • 85187e2 perf(get-tags.js): bulk get for tags notes (#3732)
  • 672f951 chore(deps): update dependency @​types/node to v22.16.3 (#3801)
  • de54db9 chore(deps): update dependency @​types/node to v22.16.2 (#3799)
  • c6da348 chore(deps): update dependency @​types/node to v22.16.1 (#3798)
  • fae2a78 chore(deps): lock file maintenance (#3797)
  • fb26b13 docs(plugins): add semantic-release-openapi community plugin (#3787)
  • 985f165 chore(deps): update dependency @​types/node to v22.16.0 (#3794)
  • c8fea35 ci(action): update github/codeql-action action to v3.29.2 (#3793)
  • fab4d88 chore(deps): lock file maintenance (#3792)
  • 93177d0 fix(deps): update @​semantic-release/npm to ^12.0.2 (#3791)
  • Additional commits viewable in compare view

Updates ws from 8.18.0 to 8.18.3

Release notes

Sourced from ws's releases.

8.18.3

Bug fixes

  • Fixed a spec violation where the Sec-WebSocket-Version header was not added to the HTTP response if the client requested version was either invalid or unacceptable (33f5dbaf).

8.18.2

Bug fixes

  • Fixed an issue that, during message decompression when the maximum size was exceeded, led to the emission of an inaccurate error and closure of the connection with an improper close code (#2285).

8.18.1

Bug fixes

  • The length of the UNIX domain socket paths in the tests has been shortened to make them work when run via CITGM (021f7b8b).
Commits

Updates aedes from 0.39.0 to 0.42.1

Release notes

Sourced from aedes's releases.

Release 0.42.1

  • fix: clean up the write callbacks in case of error (#492) (e11148d)
  • docs: sdd Kuzzle to made with aedes section (#500) (379182f)
  • fix: remove useless empty buff (#497) (e60f85d)
  • docs: authorizePublish clarification (#496) (86b6815)
  • fix: catch writeToStream errors (#493) (8d34ee5)
  • Bump markdownlint-cli from 0.22.0 to 0.23.1 (#490) (28c6cbb)

Release 0.42.0

  • fix: remove subs only when clean flag is false (#488) (684aa51)
  • Bump @​types/node from 13.13.6 to 14.0.1 (#485) (8494fe7)
  • Bump uuid from 7.0.3 to 8.0.0 (#481) (d5ab3de)
  • Bump deps and fixed tests (#479) (5fc092c)
  • fix: upgrade aedes in proxy example from 0.40.1 to 0.41.0 (#478) (49276ec)
  • Improved clusters example (#476) (b2393ab)
  • feat: emptyOutgoingQueue (#474) (ab81dce)
  • Update README.md (#471) (24cfa8d)
  • Return granted qos in broker subscribe event and better subAck docs (#468) (2955388)

Release 0.41.0

  • release script (#466) (1635fd5)
  • Fix typo (#463) (276fb0f)
  • Enhance subscription basic tests (#461) (d64faeb)
  • Add more badges (#460) (e3e5b1d)
  • Update README.md (f68cd77)
  • Update dependencies (#457) (d0991fa)
  • Expose protocol version in Client object (#456) (237d253)
  • Added test on unrecognised params in sub packet structure (#455) (76cdd8e)
  • Handle unsubscription safer while client closes (#454) (05d2ee3)
  • Update uuid & deps (#453) (209efd0)
  • Upgrade github actions/checkout to v2 (#452) (6d729b2)
  • Clusters docs (#448) (aaa5f0b)
  • Add a non-blocking concurrent connection test (#445) (fc45bc6)
  • Refactored validationTopics into utils (#447) (323d535)
  • Refactored EventEmitter (#446) (c5ee57e)
  • Enhanced retain.js tests by fake timers (#444) (e4b78df)
  • Enhanced auth.js test by fake timers (#443) (9176beb)
  • Enhanced keep-alive tests by fake timers (#442) (fbd800d)
  • Enhanced not-blocking tests by fake timers (#441) (8bdbb71)
  • docs: Made with Aedes (#440) (37b04b7)
  • Add MQTT spec reference in empty topic validation (#439) (1756d68)
  • Update README.md (#432) (a61f899)
  • Fix: Single-level wildcard match empty level (#433) (c6e049c)
  • Refactored Subscribe Handler (#408) (1c3aa35)
  • feat: Max clients Id length option for MQTT 3.1.0 (#435) (ade3c8a)
  • Extend coverage to 100% (#429) (9c90d2e)
  • Added opencollective links/images (#431) (2bba8cc)
  • Rewrite README.md & Fix typings (#430) (5d25741)
  • Update CoC (#427) (cfe8d1a)
  • Fixed tests & use readable-stream (#426) (903a449)

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by roberts_lando, a new releaser for aedes since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
build(deps): bump the npm_and_yarn group across 4 directories with 8 …
f4583fd 
…updates

Bumps the npm_and_yarn group with 1 update in the /pkgs/applications/editors/vim/plugins/patches/markdown-preview-nvim directory: [next](https://github.com/vercel/next.js).
Bumps the npm_and_yarn group with 4 updates in the /pkgs/by-name/re/react-static directory: [axios](https://github.com/axios/axios), [tar-fs](https://github.com/mafintosh/tar-fs), [webpack-dev-server](https://github.com/webpack/webpack-dev-server) and [react-dev-utils](https://github.com/facebook/create-react-app/tree/HEAD/packages/react-dev-utils).
Bumps the npm_and_yarn group with 1 update in the /pkgs/servers/home-assistant/custom-lovelace-modules/button-card directory: [semantic-release](https://github.com/semantic-release/semantic-release).
Bumps the npm_and_yarn group with 2 updates in the /pkgs/tools/admin/meshcentral directory: [ws](https://github.com/websockets/ws) and [aedes](https://github.com/moscajs/aedes).


Updates `next` from 7.0.3 to 15.5.2
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@7.0.3...v15.5.2)

Updates `axios` from 0.21.4 to 1.11.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v0.21.4...v1.11.0)

Updates `tar-fs` from 2.1.3 to 3.1.0
- [Commits](mafintosh/tar-fs@v2.1.3...v3.1.0)

Updates `webpack-dev-server` from 3.11.3 to 5.2.2
- [Release notes](https://github.com/webpack/webpack-dev-server/releases)
- [Changelog](https://github.com/webpack/webpack-dev-server/blob/master/CHANGELOG.md)
- [Commits](webpack/webpack-dev-server@v3.11.3...v5.2.2)

Updates `react-dev-utils` from 9.1.0 to 12.0.1
- [Release notes](https://github.com/facebook/create-react-app/releases)
- [Changelog](https://github.com/facebook/create-react-app/blob/main/CHANGELOG-1.x.md)
- [Commits](https://github.com/facebook/create-react-app/commits/react-dev-utils@12.0.1/packages/react-dev-utils)

Updates `semantic-release` from 17.4.7 to 24.2.7
- [Release notes](https://github.com/semantic-release/semantic-release/releases)
- [Commits](semantic-release/semantic-release@v17.4.7...v24.2.7)

Updates `ws` from 8.18.0 to 8.18.3
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.18.0...8.18.3)

Updates `aedes` from 0.39.0 to 0.42.1
- [Release notes](https://github.com/moscajs/aedes/releases)
- [Commits](moscajs/aedes@v0.39.0...v0.42.1)

---
updated-dependencies:
- dependency-name: next
  dependency-version: 15.5.2
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: axios
  dependency-version: 1.11.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: tar-fs
  dependency-version: 3.1.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: webpack-dev-server
  dependency-version: 5.2.2
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: react-dev-utils
  dependency-version: 12.0.1
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: semantic-release
  dependency-version: 24.2.7
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-version: 8.18.3
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: aedes
  dependency-version: 0.42.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 30, 2025
@socket-security
Copy link

socket-security bot commented Aug 30, 2025

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Addednpm/​node-windows@​0.1.14922510076100
Addednpm/​safer-buffer@​2.1.26110010051100
Addednpm/​set-function-length@​1.2.2661008351100
Addednpm/​safe-regex-test@​1.1.0671007951100
Addednpm/​side-channel@​1.1.0661008652100
Addednpm/​is-arguments@​1.2.0671008052100
Addednpm/​safe-buffer@​5.2.16710010052100
Addednpm/​node-sspi@​0.2.10621009977100
Addednpm/​process-nextick-args@​2.0.11001006676100
Addednpm/​shebang-command@​2.0.01001006676100
Addednpm/​shebang-regex@​3.0.01001006776100
Addednpm/​archiver-utils@​5.0.21001006877100
Addednpm/​@​duosecurity/​duo_universal@​3.0.06910010086100
Addednpm/​utils-merge@​1.0.11001006976100
Addednpm/​node-pushover@​1.0.0711009776100
Addednpm/​setprototypeof@​1.2.01001007176100
Updatednpm/​strip-ansi@​3.0.1 ⏵ 7.1.0100 +110072 +1179100
Addednpm/​@​crowdsec/​express-bouncer@​0.1.0741009976100
Addednpm/​process@​0.11.101001007480100
Addednpm/​bare-events@​2.6.01001007587100
Addednpm/​unpipe@​1.0.01001007775100
Addednpm/​random-bytes@​1.0.01001009175100
Addednpm/​@​isaacs/​cliui@​8.0.29910010076100
Addednpm/​connect-flash@​0.1.11001008976100
Addednpm/​ipcheck@​0.1.0841009776100
Addednpm/​wordwrap@​1.0.01001008976100
Addednpm/​input@​1.0.19210010076100
Addednpm/​util-deprecate@​1.0.21001008176100
Addednpm/​@​mysql/​xdevapi@​8.0.3376100907770
Addednpm/​is-fullwidth-code-point@​3.0.01001007676100
Addednpm/​tsscmp@​1.0.61001008076100
Addednpm/​eastasianwidth@​0.2.01001007676100
Addednpm/​loadavg-windows@​1.1.1861008376100
See 108 more rows in the dashboard

View full report

@socket-security
Copy link

socket-security bot commented Aug 30, 2025

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn Critical
npm/minimist@0.0.10 has a Critical CVE.

CVE: GHSA-xvch-5gv4-984h Prototype Pollution in minimist (CRITICAL)

Affected versions: >= 1.0.0 < 1.2.6; < 0.2.4

Patched version: 0.2.4

From: ? → npm/node-windows@0.1.14 → npm/minimist@0.0.10

ℹ Read more on: This package | This alert | What is a critical CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/minimist@0.0.10. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Critical
npm/node-windows@0.1.14 has a Critical CVE.

CVE: GHSA-53xv-c2hx-5w6q Command Injection in node-windows (CRITICAL)

Affected versions: < 1.0.0-beta.6

Patched version: 1.0.0-beta.6

From: pkgs/tools/admin/meshcentral/package.json → npm/node-windows@0.1.14

ℹ Read more on: This package | This alert | What is a critical CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/node-windows@0.1.14. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
npm/@duosecurity/duo_universal@3.0.0 has Obfuscated code.

Confidence: 0.98

Location: Package overview

From: pkgs/tools/admin/meshcentral/package.json → npm/@duosecurity/duo_universal@3.0.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@duosecurity/duo_universal@3.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
npm/@mysql/xdevapi@8.0.33 has Obfuscated code.

Confidence: 0.93

Location: Package overview

From: pkgs/tools/admin/meshcentral/package.json → npm/@mysql/xdevapi@8.0.33

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@mysql/xdevapi@8.0.33. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
npm/es5-ext@0.10.64 is Protestware or potentially unwanted behavior.

Note: This package prints a protestware console message on install regarding Ukraine for users with Russian language locale

From: ? → npm/es5-ext@0.10.64

ℹ Read more on: This package | This alert | What is protestware?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Consider that consuming this package may come along with functionality unrelated to its primary purpose.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/es5-ext@0.10.64. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
npm/es5-ext@0.10.64 is Protestware or potentially unwanted behavior.

Note: The script attempts to run a local post-install script, which could potentially contain malicious code. The error handling suggests that it is designed to fail silently, which is a common tactic in malicious scripts.

From: ? → npm/es5-ext@0.10.64

ℹ Read more on: This package | This alert | What is protestware?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Consider that consuming this package may come along with functionality unrelated to its primary purpose.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/es5-ext@0.10.64. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
npm/safer-buffer@2.1.2 has Obfuscated code.

Confidence: 0.94

Location: Package overview

From: pkgs/development/tools/yarn2nix-moretea/yarn2nix/yarn.lock → npm/safer-buffer@2.1.2

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/safer-buffer@2.1.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants