Bump the npm_and_yarn group across 1 directory with 2 updates by dependabot[bot] · Pull Request #34 · UB-Mannheim/escriptorium

dependabot · 2026-01-29T07:39:57Z

Bumps the npm_and_yarn group with 2 updates in the /front directory: axios and @babel/runtime.

Updates axios from 0.21.4 to 0.30.2

Release notes

v0.30.2

What's Changed

Backport maxContentLength vulnerability fix to v0.x by @FeBe95 in axios/axios#7034

New Contributors

@FeBe95 made their first contribution in axios/axios#7034

Full Changelog: axios/axios@v0.30.1...v0.30.2

Release v0.30.1

Release notes:

Bug Fixes

chore(deps): bump form-data from 4.0.0 to 4.0.4 for v0.x by @wolandec in axios/axios#6978

Contributors to this release

@wolandec made their first contribution in axios/axios#6978

Full Changelog: axios/axios@v0.30.0...v0.30.1

Release v0.30.0

Release notes:

Bug Fixes

fix: modify log while request is aborted by @mori5321 in axios/axios#4917

fix: update CHANGELOG.md for v0.x by @TehZarathustra in axios/axios#6271

fix: modify upgrade guide for 0.28.1's breaking change by @nafeger in axios/axios#6787

fix: backport allowAbsoluteUrls vulnerability fix to v0.x by @thatguyinabeanie in axios/axios#6829

fix: add allowAbsoluteUrls type by @thatguyinabeanie in axios/axios#6849

Contributors to this release

@mori5321 made their first contribution in axios/axios#4917

@TehZarathustra made their first contribution in axios/axios#6271

@nafeger made their first contribution in axios/axios#6787

@thatguyinabeanie made their first contribution in axios/axios#6829

Full Changelog: axios/axios@v0.29.0...v0.30.0

v0.29.0

Release notes:

Bug Fixes

fix(backport): backport security fixes in commits #6167 and #6163 to v0.x by @Sean-Powell in axios/axios#6402

fix: omit nulls in params by @Willshaw in axios/axios#6394

fix(backport): fix paramsSerializer function validation by @solonzhu in axios/axios#6361

fix: Regular Expression Denial of Service (ReDoS) by @qiongshusheng in axios/axios#6708

Contributors to this release

@Sean-Powell made their first contribution in axios/axios#6402

@Willshaw made their first contribution in axios/axios#6394

@solonzhu made their first contribution in axios/axios#6361

... (truncated)

Commits

2fcb4ec chore: v0.30.2
153f483 chore: preversion
ee548ff fix: tests failing
a1b1d3f fix: backport maxContentLength vulnerability fix to v0.x (#7034)
b17c4de chore: build latest version
ad6b82a chore: build latest version
da447d5 chore(deps): bump form-data from 4.0.0 to 4.0.4 (#6978)
6e922e4 chore: added build artifacts
a06ed1e chore: added pre-release artifacts
c010622 feat: add type for allowAbsoluteUrls (#6849)
Additional commits viewable in compare view

Updates @babel/runtime from 7.7.2 to 7.28.6

Release notes

Sourced from @babel/runtime's releases.

v7.28.6 (2026-01-12)

Thanks @kadhirash and @kolvian for your first PRs!

🐛 Bug Fix

babel-cli, babel-code-frame, babel-core, babel-helper-check-duplicate-nodes, babel-helper-fixtures, babel-helper-plugin-utils, babel-node, babel-plugin-transform-flow-comments, babel-plugin-transform-modules-commonjs, babel-plugin-transform-property-mutators, babel-preset-env, babel-traverse, babel-types

#17589 Improve Unicode handling in code-frame tokenizer (@JLHwung)

babel-plugin-transform-regenerator

#17556 fix: transform-regenerator correctly handles scope (@liuxingbaoyu)

babel-plugin-transform-react-jsx

#17538 fix: Keep jsx comments (@liuxingbaoyu)

💅 Polish

babel-core, babel-standalone

#17606 Polish(standalone): improve message on invalid preset/plugin (@JLHwung)

🏠 Internal

babel-plugin-bugfix-v8-static-class-fields-redefine-readonly, babel-plugin-proposal-decorators, babel-plugin-proposal-import-attributes-to-assertions, babel-plugin-proposal-import-wasm-source, babel-plugin-syntax-async-do-expressions, babel-plugin-syntax-decorators, babel-plugin-syntax-destructuring-private, babel-plugin-syntax-do-expressions, babel-plugin-syntax-explicit-resource-management, babel-plugin-syntax-export-default-from, babel-plugin-syntax-flow, babel-plugin-syntax-function-bind, babel-plugin-syntax-function-sent, babel-plugin-syntax-import-assertions, babel-plugin-syntax-import-attributes, babel-plugin-syntax-import-defer, babel-plugin-syntax-import-source, babel-plugin-syntax-jsx, babel-plugin-syntax-module-blocks, babel-plugin-syntax-optional-chaining-assign, babel-plugin-syntax-partial-application, babel-plugin-syntax-pipeline-operator, babel-plugin-syntax-throw-expressions, babel-plugin-syntax-typescript, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-class-properties, babel-plugin-transform-class-static-block, babel-plugin-transform-dotall-regex, babel-plugin-transform-duplicate-named-capturing-groups-regex, babel-plugin-transform-explicit-resource-management, babel-plugin-transform-exponentiation-operator, babel-plugin-transform-json-strings, babel-plugin-transform-logical-assignment-operators, babel-plugin-transform-nullish-coalescing-operator, babel-plugin-transform-numeric-separator, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-catch-binding, babel-plugin-transform-optional-chaining, babel-plugin-transform-private-methods, babel-plugin-transform-private-property-in-object, babel-plugin-transform-regexp-modifiers, babel-plugin-transform-unicode-property-regex, babel-plugin-transform-unicode-sets-regex

#17580 Allow Babel 8 in compatible Babel 7 plugins (@nicolo-ribaudo)

🏃‍♀️ Performance

babel-plugin-transform-react-jsx

#17555 perf: Use lighter traversal for jsx __source,__self (@liuxingbaoyu)

Committers: 7

Babel Bot (@babel-bot)

Eliot Pontarelli (@kolvian)

Huáng Jùnliàng (@JLHwung)

Kadhirash Sivakumar (@kadhirash)

Nicolò Ribaudo (@nicolo-ribaudo)

@liuxingbaoyu

coderaiser (@coderaiser)

v7.28.5 (2025-10-23)

Thank you @CO0Ki3, @Olexandr88, and @youthfulhps for your first PRs!

👓 Spec Compliance

babel-parser

#17446 Allow Runtime Errors for Function Call Assignment Targets (@liuxingbaoyu)

babel-helper-validator-identifier

#17501 fix: update identifier to unicode 17 (@fisker)

🐛 Bug Fix

babel-plugin-proposal-destructuring-private

#17534 Allow mixing private destructuring and rest (@CO0Ki3)

babel-parser

#17521 Improve @babel/parser error typing (@JLHwung)

#17491 fix: improve ts-only declaration parsing (@JLHwung)

babel-plugin-proposal-discard-binding, babel-plugin-transform-destructuring

... (truncated)

Changelog

Sourced from @babel/runtime's changelog.

Changelog

Tags:

💥 [Breaking Change]

👓 [Spec Compliance]

🚀 [New Feature]

🐛 [Bug Fix]

📝 [Documentation]

🏠 [Internal]

💅 [Polish]

Note: Gaps between patch versions are faulty, broken or test releases.

This file contains the changelog starting from v7.15.0.

See CHANGELOG - v7.0.0 to v7.14.9 for v7.0.0 to v7.14.9 changes.

See CHANGELOG - v7 prereleases for v7.0.0-alpha.1 to v7.0.0-rc.4 changes.

See CHANGELOG - v4, CHANGELOG - v5, and CHANGELOG - v6 for v4.x-v6.x changes.

See CHANGELOG - 6to5 for the pre-4.0.0 version changelog.

See Babylon's CHANGELOG for the Babylon pre-7.0.0-beta.29 version changelog.

See babel-eslint's releases for the changelog before @babel/eslint-parser 7.8.0.

See eslint-plugin-babel's releases for the changelog before @babel/eslint-plugin 7.8.0.

v7.28.5 (2025-10-23)

👓 Spec Compliance

babel-parser

#17446 Allow Runtime Errors for Function Call Assignment Targets (@liuxingbaoyu)

babel-helper-validator-identifier

#17501 fix: update identifier to unicode 17 (@fisker)

🐛 Bug Fix

babel-plugin-proposal-destructuring-private

#17534 Allow mixing private destructuring and rest (@CO0Ki3)

babel-parser

#17521 Improve @babel/parser error typing (@JLHwung)

#17491 fix: improve ts-only declaration parsing (@JLHwung)

babel-plugin-proposal-discard-binding, babel-plugin-transform-destructuring

#17519 fix: rest correctly returns plain array (@liuxingbaoyu)

babel-helper-create-class-features-plugin, babel-helper-member-expression-to-functions, babel-plugin-transform-block-scoping, babel-plugin-transform-optional-chaining, babel-traverse, babel-types

#17503 Fix JSXIdentifier handling in isReferencedIdentifier (@JLHwung)

babel-traverse

#17504 fix: ensure scope.push register in anonymous fn (@JLHwung)

🏠 Internal

babel-types

#17494 Type checking babel-types scripts (@JLHwung)

... (truncated)

Commits

d7f4008 v7.28.6
35055e3 v7.28.4
ef155f5 v7.28.3
cac0ff4 v7.28.2
f68ac51 chore: Avoid CITGM errors (#17382)
baa4cb8 v7.27.6
7d06930 v7.27.4
5b9468d Reduce regenerator size more (#17287)
cb78b5b [babel 8] Do not replace global regeneratorRuntime references in regenerato...
a0690e3 Split regeneratorRuntime into multiple helpers (#17238)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @babel/runtime since your current version.

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

Signed-off-by: Stefan Weil <sw@weilnetz.de>

The Python module opensearch-py is newer and well maintained. It supports Elasticsearch and OpenSearch databases. The new code uses "Elasticsearch/OpenSearch" in messages and replaces "ESCRIPTORIUM" in several settings by "ES" which now means eScriptorium: DISABLE_ELASTICSEARCH -> DISABLE_ES_SEARCH ELASTICSEARCH_COMMON_INDEX -> ES_SEARCH_COMMON_INDEX ELASTICSEARCH_URL -> ES_SEARCH_URL Signed-off-by: Stefan Weil <sw@weilnetz.de>

Signed-off-by: Stefan Weil <sw@weilnetz.de>

Remaining issues: npm warn deprecated @npmcli/move-file@1.1.2: This functionality has been moved to @npmcli/fs npm warn deprecated stable@0.1.8: Modern JS already guarantees Array#sort() is a stable sort, so this library is deprecated. See the compatibility table on MDN: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/sort#browser_compatibility npm warn deprecated source-map-url@0.4.1: See https://github.com/lydell/source-map-url#deprecated npm warn deprecated urix@0.1.0: Please see https://github.com/lydell/urix#deprecated npm warn deprecated resolve-url@0.2.1: https://github.com/lydell/resolve-url#deprecated npm warn deprecated source-map-resolve@0.5.3: See https://github.com/lydell/source-map-resolve#deprecated npm warn deprecated querystring@0.2.1: The querystring API is considered Legacy. new code should use the URLSearchParams API instead. npm warn deprecated sourcemap-codec@1.4.8: Please use @jridgewell/sourcemap-codec instead npm warn deprecated sane@4.1.0: some dependency vulnerabilities fixed, support for node < 10 dropped, and newer ECMAScript syntax/features added npm warn deprecated fsevents@1.2.13: fsevents 1 will break on node v14+ and could be using insecure binaries. Upgrade to fsevents 2. npm warn deprecated chokidar@2.1.8: Chokidar 2 does not receive security updates since 2019. Upgrade to chokidar 3 with 15x fewer dependencies npm warn deprecated querystring@0.2.0: The querystring API is considered Legacy. new code should use the URLSearchParams API instead. npm warn deprecated uuid@3.4.0: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details. npm warn deprecated popper.js@1.16.1: You can find the new Popper v2 at @popperjs/core, this package is dedicated to the legacy v1 npm warn deprecated vue@2.7.16: Vue 2 has reached EOL and is no longer actively maintained. See https://v2.vuejs.org/eol/ for more details. added 2050 packages, and audited 2051 packages in 14s 297 packages are looking for funding run `npm fund` for details 60 vulnerabilities (1 low, 33 moderate, 26 high) Signed-off-by: Stefan Weil <sw@weilnetz.de>

Signed-off-by: Stefan Weil <sw@weilnetz.de>

npm warn deprecated @npmcli/move-file@1.1.2: This functionality has been moved to @npmcli/fs npm warn deprecated querystring@0.2.1: The querystring API is considered Legacy. new code should use the URLSearchParams API instead. npm warn deprecated sourcemap-codec@1.4.8: Please use @jridgewell/sourcemap-codec instead npm warn deprecated querystring@0.2.0: The querystring API is considered Legacy. new code should use the URLSearchParams API instead. npm warn deprecated uuid@3.4.0: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details. npm warn deprecated vue@2.7.16: Vue 2 has reached EOL and is no longer actively maintained. See https://v2.vuejs.org/eol/ for more details. 64 vulnerabilities (6 low, 29 moderate, 29 high) Signed-off-by: Stefan Weil <sw@weilnetz.de>

Signed-off-by: Stefan Weil <sw@weilnetz.de>

Bumps the npm_and_yarn group with 2 updates in the /front directory: [axios](https://github.com/axios/axios) and [@babel/runtime](https://github.com/babel/babel/tree/HEAD/packages/babel-runtime). Updates `axios` from 0.21.4 to 0.30.2 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v0.21.4...v0.30.2) Updates `@babel/runtime` from 7.7.2 to 7.28.6 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.28.6/packages/babel-runtime) --- updated-dependencies: - dependency-name: axios dependency-version: 0.30.2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@babel/runtime" dependency-version: 7.28.6 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

stweil added 30 commits October 9, 2025 16:53

Remove empty Norwegian translation

2e7fa62

Signed-off-by: Stefan Weil <sw@weilnetz.de>

Remove compiled message files

5aa17b8

Signed-off-by: Stefan Weil <sw@weilnetz.de>

Update English texts in en/LC_MESSAGES/django.pot

e6aaafb

Signed-off-by: Stefan Weil <sw@weilnetz.de>

Update German translation

c1d0f23

Signed-off-by: Stefan Weil <sw@weilnetz.de>

Update French translation

df158f6

Signed-off-by: Stefan Weil <sw@weilnetz.de>

CI: Install missing Python requirements before running tests

2fc5e08

Signed-off-by: Stefan Weil <sw@weilnetz.de>

Create codeql.yml

cbaaa7d

Downgrade docker-compose.yml

2349fa5

Signed-off-by: Stefan Weil <sw@weilnetz.de>

Add start script for systemd

417fd77

Signed-off-by: Stefan Weil <sw@weilnetz.de>

Add local settings for UB Mannheim installation

10281e5

Signed-off-by: Stefan Weil <sw@weilnetz.de>

Enable text alignment

5a1d6b3

Signed-off-by: Stefan Weil <sw@weilnetz.de>

Run only a single OMP thread and increase concurrency to 4

fa78b06

Signed-off-by: Stefan Weil <sw@weilnetz.de>

Update local settings (CPU costs, version date)

eef1fae

Signed-off-by: Stefan Weil <sw@weilnetz.de>

Update start script (number of threads and workers)

b552d5e

Signed-off-by: Stefan Weil <sw@weilnetz.de>

Add local settings for UB Mannheim installation

f2b0a3f

Signed-off-by: Stefan Weil <sw@weilnetz.de>

Update start script (more workers)

9f8f88e

Signed-off-by: Stefan Weil <sw@weilnetz.de>

Update startup script for Python 3.11

868459c

Signed-off-by: Stefan Weil <sw@weilnetz.de>

Use special heading for test instance

2a37c33

Signed-off-by: Stefan Weil <sw@weilnetz.de>

Improve hint on start page by adding a link to the production instance

81b814b

Signed-off-by: Stefan Weil <sw@weilnetz.de>

Accept old models

c47c4fb

Signed-off-by: Stefan Weil <sw@weilnetz.de>

git: Ignore virtual environments

2bdaf20

Signed-off-by: Stefan Weil <sw@weilnetz.de>

Test urlpatterns for media (w.i.p.)

c3b4b4d

Signed-off-by: Stefan Weil <sw@weilnetz.de>

Fix invalid PAGE export

8c9b10e

Signed-off-by: Stefan Weil <sw@weilnetz.de>

Use escriptorium.local_settings by default

3f74e2e

Signed-off-by: Stefan Weil <sw@weilnetz.de>

Try to fix W3C validator HTML error in contact page

7198885

Signed-off-by: Stefan Weil <sw@weilnetz.de>

Update for new Django version

9cf5041

Signed-off-by: Stefan Weil <sw@weilnetz.de>

Add TODO

06d1f86

Signed-off-by: Stefan Weil <sw@weilnetz.de>

Update Homepage (additional icons)

443647e

Signed-off-by: Stefan Weil <sw@weilnetz.de>

Update local footer

be31611

Signed-off-by: Stefan Weil <sw@weilnetz.de>

stweil and others added 10 commits October 9, 2025 16:54

Update local settings

e8d4b73

Signed-off-by: Stefan Weil <sw@weilnetz.de>

Use more compact presentation of images

f1acf3c

Signed-off-by: Stefan Weil <sw@weilnetz.de>

Enable more logging

29d535a

Signed-off-by: Stefan Weil <sw@weilnetz.de>

front: Add script name prefix for running website in non-root

970b3ce

Signed-off-by: Stefan Weil <sw@weilnetz.de>

Update version of popper.js (avoids two different versions)

45db2b9

Signed-off-by: Stefan Weil <sw@weilnetz.de>

Update packages (only one version of popper.js)

88a89b9

Signed-off-by: Stefan Weil <sw@weilnetz.de>

Update package-lock.json

c454bfa

Signed-off-by: Stefan Weil <sw@weilnetz.de>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jan 29, 2026

stweil force-pushed the develop branch from c454bfa to 04fa78b Compare April 21, 2026 09:26

stweil force-pushed the develop branch from 04fa78b to 9fb450c Compare July 9, 2026 12:40

Navigation Menu

Uh oh!

Bump the npm_and_yarn group across 1 directory with 2 updates - #34

Bump the npm_and_yarn group across 1 directory with 2 updates#34
dependabot[bot] wants to merge 40 commits into
developfrom
dependabot/npm_and_yarn/front/npm_and_yarn-73c73edf4a

dependabot Bot commented on behalf of github Jan 29, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jan 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v0.30.2

What's Changed

New Contributors

Release v0.30.1

Release notes:

Bug Fixes

Contributors to this release

Release v0.30.0

Release notes:

Bug Fixes

Contributors to this release

v0.29.0

Release notes:

Bug Fixes

Contributors to this release

v7.28.6 (2026-01-12)

🐛 Bug Fix

💅 Polish

🏠 Internal

🏃‍♀️ Performance

Committers: 7

v7.28.5 (2025-10-23)

👓 Spec Compliance

🐛 Bug Fix

Changelog

v7.28.5 (2025-10-23)

👓 Spec Compliance

🐛 Bug Fix

🏠 Internal

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Jan 29, 2026 •

edited

Loading