Bump the npm_and_yarn group across 7 directories with 14 updates by dependabot[bot] · Pull Request #504 · docknetwork/wallet-sdk

dependabot · 2026-04-16T18:33:14Z

Bumps the npm_and_yarn group with 2 updates in the / directory: axios and follow-redirects.
Bumps the npm_and_yarn group with 4 updates in the /examples/angular-example directory: @angular/compiler, @angular/core, liquidjs and node-forge.
Bumps the npm_and_yarn group with 4 updates in the /examples/nodejs-example directory: axios, picomatch, follow-redirects and lodash.
Bumps the npm_and_yarn group with 9 updates in the /examples/react-native-example directory:

Package	From	To
undici	`5.29.0`	`6.24.1`
picomatch	`2.3.1`	`2.3.2`
brace-expansion	`1.1.12`	`1.1.14`
serialize-javascript	`6.0.2`	`removed`
flatted	`3.3.3`	`3.4.2`
follow-redirects	`1.15.9`	`1.16.0`
lodash	`4.17.21`	`4.18.1`
path-to-regexp	`0.1.12`	`0.1.13`
sjcl	`1.0.8`	`1.0.9`

Bumps the npm_and_yarn group with 3 updates in the /examples/web-example directory: axios, path-to-regexp and liquidjs.
Bumps the npm_and_yarn group with 2 updates in the /examples/webview-server directory: axios and path-to-regexp.
Bumps the npm_and_yarn group with 1 update in the /packages/wasm directory: axios.

Updates axios from 0.25.0 to 0.31.0

Release notes

Sourced from axios's releases.

v0.31.0

This release backports security fixes from v1.x, hardens the CI/CD supply chain with OIDC publishing and zizmor scanning, resolves TypeScript typing issues in AxiosInstance, and fixes a performance regression in isEmptyObject().

🔒 Security Fixes

Header Injection & Proxy Bypass: Backports v1 security hardening — sanitizes outgoing header values to strip invalid bytes, CRLF sequences, and boundary whitespace (including array values); adds proper NO_PROXY/no_proxy enforcement covering wildcards, explicit ports, loopback aliases (localhost, 127.0.0.1, ::1), bracketed IPv6, and trailing-dot hostnames. Proxy bypass is now checked before the proxy URL is parsed, and parsed.host is used for correct port and IPv6 handling. (#10688)

CI Security: SHA-pins all actions and disables credential persistence in v0.x CI, introduces zizmor security scanning with SARIF upload to code scanning, adds an OIDC Trusted Publishing workflow with npm provenance attestations, and gates all publishes behind a required npm-publish GitHub Environment with configurable reviewer protections. (#10638, #10639, #10667)

🐛 Bug Fixes

TypeScript — AxiosInstance Return Types: Fixes return types in AxiosInstance methods to correctly resolve to Promise<R> (matching AxiosPromise<T> semantics), and corrects the generic call signature so TypeScript properly enforces the response data type. TypeScript-only changes; no runtime impact. (#6253, #7328)

Performance: Fixes a performance regression in isEmptyObject() that caused excessive computation when the argument was a large string. (#6484)

🔧 Maintenance & Chores

Versioning & CI Workflow: Adds an automated versioning flow for v0.x, renames the CI workflow for consistency with the v1.x naming convention, and corrects the branch name reference in CI config. (#10690, #10691, #10692)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

@nakataki17 (#6253)

@gmasclet (#6484)

@shaanmajid (#10638, #10639, #10667)

@ivan-churakov (#7328)

Full Changelog

Release notes - v0.30.3

This is a critical security maintenance release for the v0.x branch. It addresses a high-priority vulnerability involving prototype pollution that could lead to a Denial of Service (DoS).

Recommendation: All users currently on the 0.x release line should upgrade to this version immediately to ensure environment stability.

🛡️ Security Fixes

Backport: Fix DoS via proto key in merge config

Patched a vulnerability where specifically crafted configuration objects using the proto key could cause a Denial of Service during the merge process. - by @FeBe95 in [PR #7388](axios/axios#7388)

⚙️ Maintenance & CI

CI Infrastructure Update

Updated Continuous Integration workflows for the v0.x branch to maintain long-term support and build reliability. - by @jasonsaayman in [PR #7407](axios/axios#7407)

⚠️ Breaking Changes

Configuration Merging Behavior:

As part of the security fix, Axios now restricts the merging of the proto key within configuration objects. If your codebase relies on unconventional deep-merging patterns that target the object prototype via Axios config, those operations will now be blocked. This is a necessary change to prevent prototype pollution.

... (truncated)

Commits

5073eca chore: release v0.31.0 (#10697)
b57eb1a ci: update branch name (#10692)
00ab2af refactor: change name to have a unified workflow (#10691)
9a66c09 chore: added a versioning flow (#10690)
03cdfc9 fix: backport the fixes from the v1 branch (#10688)
71be4e5 fix: return types in AxiosInstance methods should be Promise<R> (#6253)
62610f6 fix: fixed performance issue in isEmptyObject() (#6484)
68f97f7 ci: require npm-publish environment for releases (#10667)
58a6043 ci: add zizmor and harden v0.x CI (#10638)
b560d41 ci: add OIDC publish workflow for v0.x (#10639)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for axios since your current version.

Updates follow-redirects from 1.15.11 to 1.16.0

Commits

0c23a22 Release version 1.16.0 of the npm package.
844c4d3 Add sensitiveHeaders option.
5e8b8d0 ci: add Node.js 24.x to the CI matrix
7953e22 ci: upgrade GitHub Actions to use setup-node@v6 and checkout@v6
86dc1f8 Sanitizing input.
See full diff in compare view

Updates @angular/compiler from 19.2.14 to 19.2.18

Release notes

Sourced from @angular/compiler's releases.

19.2.18

core

Commit Description

sanitize sensitive attributes on SVG script elements

19.2.17

compiler

Commit Description

prevent XSS via SVG animation attributeName and MathML/SVG URLs

19.2.16

http

Commit Description

prevent XSRF token leakage to protocol-relative URLs

19.2.15

core

Commit Description

introduce BootstrapContext for improved server bootstrapping (#63639)

Breaking Changes

core
The server-side bootstrapping process has been changed to eliminate the reliance on a global platform injector.

Before:
const bootstrap = () => bootstrapApplication(AppComponent, config);
After:
const bootstrap = (context: BootstrapContext) =>
  bootstrapApplication(AppComponent, config, context);
A schematic is provided to automatically update main.server.ts files to pass the BootstrapContext to the bootstrapApplication call.

In addition, getPlatform() and destroyPlatform() will now return null and be a no-op respectively when running in a server environment.
For more information please see: GHSA-68x2-mx4q-78m7

Changelog

Sourced from @angular/compiler's changelog.

19.2.18 (2026-01-07)

core

Commit Type Description

26cdc53d9c fix sanitize sensitive attributes on SVG script elements

21.0.7 (2026-01-07)

compiler

Commit Type Description

8e808740c9 fix better types for a few expression AST nodes

63b1cdcf70 fix produce accurate span for typeof and void expressions

3c3ae0cb64 fix provide location information for literal map keys

523dbaf1c3 fix stop ThisReceiver inheritance from ImplicitReceiver

compiler-cli

Commit Type Description

4d9c4567ed fix ensure component import diagnostics are reported within the imports expression

cd405685af fix fix up spelling of diagnostic

778460fcca fix support qualified names in typeof type references

core

Commit Type Description

7c74674eb0 fix avoid leaking view data in animations

0edbee4550 fix explicitly cast signal node value to String

f9c29572d2 fix sanitize sensitive attributes on SVG script elements

forms

Commit Type Description

e3fba182f9 feat add [formField] directive

561772b152 fix allow custom controls to require dirty input

f0fb1d8581 fix allow custom controls to require hidden input

ec110f170b fix allow custom controls to require pending input

ae1dc16bb0 fix clean up abort listener after timeout

9748b0d5da fix support custom controls with non signal-based models

6bd22df987 fix Support readonly arrays in signal forms

router

Commit Type Description

41cd4a6af8 fix Fix RouterLink href not updating with queryParamsHandling

5e9e09aee0 fix handle errors from view transition updateCallbackDone promise

21.0.6 (2025-12-17)

Breaking Changes (affecting only experimental features)

... (truncated)

Commits

26cdc53 fix(core): sanitize sensitive attributes on SVG script elements
7c42e2e fix(compiler): prevent XSS via SVG animation attributeName and MathML/SVG URLs
See full diff in compare view

Updates @angular/core from 19.2.14 to 19.2.20

Release notes

Sourced from @angular/core's releases.

19.2.20

compiler

Commit Description

disallow translations of iframe src

core

Commit Description

sanitize translated attribute bindings with interpolations

sanitize translated form attributes

19.2.19

core

Commit Description

block creation of sensitive URI attributes from ICU messages

Breaking Changes

core

Angular now only applies known attributes from HTML in translated ICU content. Unknown attributes are dropped and not rendered.

(cherry picked from commit 03da204b6daa5e4583e0d0968c2107390bbd8235)

19.2.18

core

Commit Description

sanitize sensitive attributes on SVG script elements

19.2.17

compiler

Commit Description

prevent XSS via SVG animation attributeName and MathML/SVG URLs

19.2.16

http

Commit Description

prevent XSRF token leakage to protocol-relative URLs

19.2.15

core

Commit Description

introduce BootstrapContext for improved server bootstrapping (#63639)

Breaking Changes

core

The server-side bootstrapping process has been changed to eliminate the reliance on a global platform injector.

Before:

... (truncated)

Changelog

Sourced from @angular/core's changelog.

19.2.20 (2026-03-12)

compiler

Commit Type Description

5be912eb55 fix disallow translations of iframe src

core

Commit Type Description

b89b0a83a4 fix sanitize translated attribute bindings with interpolations

621c7071ad fix sanitize translated form attributes

20.3.18 (2026-03-12)

compiler

Commit Type Description

02fbf08890 fix disallow translations of iframe src

core

Commit Type Description

72126f9a08 fix sanitize translated attribute bindings with interpolations

626bc8bc20 fix sanitize translated form attributes

22.0.0-next.3 (2026-03-12)

compiler

Commit Type Description

78dea55351 fix disallow translations of iframe src

core

Commit Type Description

999c14eaab fix reverts "feat(core): add support for nested animations"

de0eb4c656 fix sanitize translated form attributes

21.2.4 (2026-03-12)

compiler

Commit Type Description

ed2d324f9c fix disallow translations of iframe src

core

Commit Type Description

... (truncated)

Commits

621c707 fix(core): sanitize translated form attributes
b89b0a8 fix(core): sanitize translated attribute bindings with interpolations
7475487 fix(core): block creation of sensitive URI attributes from ICU messages
26cdc53 fix(core): sanitize sensitive attributes on SVG script elements
7c42e2e fix(compiler): prevent XSS via SVG animation attributeName and MathML/SVG URLs
70d0639 fix(core): introduce BootstrapContext for improved server bootstrapping (#6...
See full diff in compare view

Updates liquidjs from 10.21.1 to 10.25.5

Release notes

Sourced from liquidjs's releases.

v10.25.5

10.25.5 (2026-04-07)

Bug Fixes

enforce root containment for renderFile/parseFile lookups (#870) (f41c1fc)

null date should return empty (#868) (#872) (4f9a499)

rounding negative away from zero when half (#873) (1cdf10b)

v10.25.4

10.25.4 (2026-04-07)

Bug Fixes

sort and sort_natural filters bypass ownPropertyOnly (#869) (e743da0)

v10.25.3

10.25.3 (2026-04-06)

Bug Fixes

precise memoryLimit for string replace (abc058b)

use realpath for fs.contains (#867) (529dd67)

v10.25.2

10.25.2 (2026-03-25)

Bug Fixes

handle undefined replacement argument in replace filter (#864) (0ad2b11)

v10.25.1

10.25.1 (2026-03-22)

Bug Fixes

mem limiter for invalid ranges (95ddefc)

treat args for replace_first as literal (35d5230)

v10.25.0

10.25.0 (2026-03-07)

Bug Fixes

... (truncated)

Changelog

Sourced from liquidjs's changelog.

10.25.5 (2026-04-07)

Bug Fixes

enforce root containment for renderFile/parseFile lookups (#870) (f41c1fc)

null date should return empty (#868) (#872) (4f9a499)

rounding negative away from zero when half (#873) (1cdf10b)

10.25.4 (2026-04-07)

Bug Fixes

sort and sort_natural filters bypass ownPropertyOnly (#869) (e743da0)

10.25.3 (2026-04-06)

Bug Fixes

precise memoryLimit for string replace (abc058b)

use realpath for fs.contains (#867) (529dd67)

10.25.2 (2026-03-25)

Bug Fixes

handle undefined replacement argument in replace filter (#864) (0ad2b11)

10.25.1 (2026-03-22)

Bug Fixes

mem limiter for invalid ranges (95ddefc)

treat args for replace_first as literal (35d5230)

10.25.0 (2026-03-07)

Bug Fixes

path traversal vulnerability, #851 (#855) (3cd024d)

Features

export error types, resolving #837 (#840) (71aa1b1)

... (truncated)

Commits

4af7be6 chore(release): 10.25.5 [skip ci]
05c47da refactor: replace shell scripts with JS for cross-platform support (#875)
66011d1 docs: add timbze as a contributor for code (#874)
1cdf10b fix: rounding negative away from zero when half (#873)
4f9a499 fix: null date should return empty (#868) (#872)
f41c1fc fix: enforce root containment for renderFile/parseFile lookups (#870)
db43485 chore(release): 10.25.4 [skip ci]
e743da0 fix: sort and sort_natural filters bypass ownPropertyOnly (#869)
8f69a08 chore(release): 10.25.3 [skip ci]
529dd67 fix: use realpath for fs.contains (#867)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for liquidjs since your current version.

Updates node-forge from 1.3.1 to 1.4.0

Changelog

Sourced from node-forge's changelog.

1.4.0 - 2026-03-24

Security

HIGH: Denial of Service in BigInteger.modInverse()

A Denial of Service (DoS) vulnerability exists due to an infinite loop in the BigInteger.modInverse() function (inherited from the bundled jsbn library). When modInverse() is called with a zero value as input, the internal Extended Euclidean Algorithm enters an unreachable exit condition, causing the process to hang indefinitely and consume 100% CPU.

Reported by Kr0emer.

CVE ID: CVE-2026-33891

GHSA ID: GHSA-5gfm-wpxj-wjgq

HIGH: Signature forgery in RSA-PKCS due to ASN.1 extra field.

RSASSA PKCS#1 v1.5 signature verification accepts forged signatures for low public exponent keys (e=3). Attackers can forge signatures by stuffing "garbage" bytes within the ASN.1 structure in order to construct a signature that passes verification, enabling Bleichenbacher style forgery. This issue is similar to CVE-2022-24771, but adds bytes in an addition field within the ASN.1 structure, rather than outside of it.

Additionally, forge does not validate that signatures include a minimum of 8 bytes of padding as defined by the specification, providing attackers additional space to construct Bleichenbacher forgeries.

Reported as part of a U.C. Berkeley security research project by:

Austin Chu, Sohee Kim, and Corban Villa.

CVE ID: CVE-2026-33894

GHSA ID: GHSA-ppp5-5v6c-4jwp

HIGH: Signature forgery in Ed25519 due to missing S < L check.

Ed25519 signature verification accepts forged non-canonical signatures where the scalar S is not reduced modulo the group order (S >= L). A valid signature and its S + L variant both verify in forge, while Node.js crypto.verify (OpenSSL-backed) rejects the S + L variant, as defined by the specification. This class of signature malleability has been exploited in practice to bypass authentication and authorization logic (see CVE-2026-25793, CVE-2022-35961). Applications relying on signature uniqueness (i.e., dedup by signature bytes, replay tracking, signed-object canonicalization checks) may be bypassed.

Reported as part of a U.C. Berkeley security research project by:

Austin Chu, Sohee Kim, and Corban Villa.

CVE ID: CVE-2026-33895

GHSA ID: GHSA-q67f-28xg-22rw

HIGH: basicConstraints bypass in certificate chain verification.

pki.verifyCertificateChain() does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the basicConstraints and keyUsage extensions. This allows any leaf certificate (without these extensions) to act as a CA and sign other certificates, which node-forge will accept as valid.

Reported by Doruk Tan Ozturk (@peaktwilight) - doruk.ch

CVE ID: CVE-2026-33896

GHSA ID: GHSA-2328-f5f3-gj25

... (truncated)

Commits

fa385f9 Release 1.4.0.
07d4e16 Update changelog.
cb90fd9 Update changelog.
963e7c5 Add unit test for "pseudonym"
f0b6f5b Add pseudonym OID
3df48a3 Fix missing CVE ID.
2e49283 Add x509 basicConstraints check.
bdecf11 Add canonical signature scaler check for S < L.
af094e6 Add RSA padding and DigestInfo length checks.
796eeb1 Improve jsbn fix.
Additional commits viewable in compare view

Updates axios from 1.12.2 to 1.15.0

Release notes

Sourced from axios's releases.

v0.31.0

This release backports security fixes from v1.x, hardens the CI/CD supply chain with OIDC publishing and zizmor scanning, resolves TypeScript typing issues in AxiosInstance, and fixes a performance regression in isEmptyObject().

🔒 Security Fixes

Header Injection & Proxy Bypass: Backports v1 security hardening — sanitizes outgoing header values to strip invalid bytes, CRLF sequences, and boundary whitespace (including array values); adds proper NO_PROXY/no_proxy enforcement covering wildcards, explicit ports, loopback aliases (localhost, 127.0.0.1, ::1), bracketed IPv6, and trailing-dot hostnames. Proxy bypass is now checked before the proxy URL is parsed, and parsed.host is used for correct port and IPv6 handling. (#10688)

CI Security: SHA-pins all actions and disables credential persistence in v0.x CI, introduces zizmor security scanning with SARIF upload to code scanning, adds an OIDC Trusted Publishing workflow with npm provenance attestations, and gates all publishes behind a required npm-publish GitHub Environment with configurable reviewer protections. (#10638, #10639, #10667)

🐛 Bug Fixes

TypeScript — AxiosInstance Return Types: Fixes return types in AxiosInstance methods to correctly resolve to Promise<R> (matching AxiosPromise<T> semantics), and corrects the generic call signature so TypeScript properly enforces the response data type. TypeScript-only changes; no runtime impact. (#6253, #7328)

Performance: Fixes a performance regression in isEmptyObject() that caused excessive computation when the argument was a large string. (#6484)

🔧 Maintenance & Chores

Versioning & CI Workflow: Adds an automated versioning flow for v0.x, renames the CI workflow for consistency with the v1.x naming convention, and corrects the branch name reference in CI config. (#10690, #10691, #10692)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

@nakataki17 (#6253)

@gmasclet (#6484)

@shaanmajid (#10638, #10639, #10667)

@ivan-churakov (#7328)

Full Changelog

Release notes - v0.30.3

This is a critical security maintenance release for the v0.x branch. It addresses a high-priority vulnerability involving prototype pollution that could lead to a Denial of Service (DoS).

Recommendation: All users currently on the 0.x release line should upgrade to this version immediately to ensure environment stability.

🛡️ Security Fixes

Backport: Fix DoS via proto key in merge config

Patched a vulnerability where specifically crafted configuration objects using the proto key could cause a Denial of Service during the merge process. - by @FeBe95 in [PR #7388](axios/axios#7388)

⚙️ Maintenance & CI

CI Infrastructure Update

Updated Continuous Integration workflows for the v0.x branch to maintain long-term support and build reliability. - by @jasonsaayman in [PR #7407](axios/axios#7407)

⚠️ Breaking Changes

Configuration Merging Behavior:

As part of the security fix, Axios now restricts the merging of the proto key within configuration objects. If your codebase relies on unconventional deep-merging patterns that target the object prototype via Axios config, those operations will now be blocked. This is a necessary change to prevent prototype pollution.

... (truncated)

Commits

5073eca chore: release v0.31.0 (#10697)
b57eb1a ci: update branch name (#10692)
00ab2af refactor: change name to have a unified workflow (#10691)
9a66c09 chore: added a versioning flow (#10690)
03cdfc9 fix: backport the fixes from the v1 branch (#10688)
71be4e5 fix: return types in AxiosInstance methods should be Promise<R> (#6253)
62610f6 fix: fixed performance issue in isEmptyObject() (#6484)
68f97f7 ci: require npm-publish environment for releases (#10667)
58a6043 ci: add zizmor and harden v0.x CI (#10638)
b560d41 ci: add OIDC publish workflow for v0.x (#10639)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for axios since your current version.

Updates picomatch from 2.3.1 to 2.3.2

Release notes

Sourced from picomatch's releases.

2.3.2

This is a security release fixing several security relevant issues.

What's Changed

fix: exception when glob pattern contains constructor by @Jason3S in micromatch/picomatch#144

Fix for CVE-2026-33671

Fix for CVE-2026-33672

Full Changelog: micromatch/picomatch@2.3.1...2.3.2

Changelog

Sourced from picomatch's changelog.

Release history

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

Changelogs are for humans, not machines.

There should be an entry for every single version.

The same types of changes should be grouped.

Versions and sections should be linkable.

The latest version comes first.

The release date of each versions is displayed.

Mention whether you follow Semantic Versioning.

Changelog entries are classified using the following labels (from keep-a-changelog):

Added for new features.

Changed for changes in existing functionality.

Deprecated for soon-to-be removed features.

Removed for now removed features.

Fixed for any bug fixes.

Security in case of vulnerabilities.

4.0.0 (2024-02-07)

Fixes

Fix bad text values in parse #126, thanks to @connor4312

Changed

Remove process global to work outside of node #129, thanks to @styfle

Add sideEffects to package.json #128, thanks to @frandiox

Removed os, make compatible browser environment. See #124, thanks to @gwsbhqt

3.0.1

Fixes

... (truncated)

Commits

81cba8d Publish 2.3.2
fc1f6b6 Merge commit from fork
eec17ae Merge commit from fork
78f8ca4 Merge pull request #156 from micromatch/backport-144
3f4f10e Merge pull request #144 from Jason3S/jdent-object-properties
See full diff in compare view

Updates follow-redirects from 1.15.11 to 1.16.0

Commits

0c23a22 Release version 1.16.0 of the npm package.
844c4d3 Add sensitiveHeaders option.
5e8b8d0 ci: add Node.js 24.x to the CI matrix
7953e22 ci: upgrade GitHub Actions to use setup-node@v6 and checkout@v6
86dc1f8 Sanitizing input.
See full diff in compare view

Updates lodash from 4.17.21 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

lodash: lodash/lodash@4.18.0-npm...4.18.1-npm

lodash-es: lodash/lodash@4.18.0-es...4.18.1-es

lodash-amd: lodash/lodash@4.18.0-amd...4.18.1-amd

lodash.templatelodash/lodash@4.18.0-npm-packages...4.18.1-npm-packages

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

Add security notice for _.template in threat model and API docs (#6099)

Document lower > upper behavior in _.random (#6115)

Fix quotes...
Description has been truncated

Bumps the npm_and_yarn group with 2 updates in the / directory: [axios](https://github.com/axios/axios) and [follow-redirects](https://github.com/follow-redirects/follow-redirects). Bumps the npm_and_yarn group with 4 updates in the /examples/angular-example directory: [@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler), [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core), [liquidjs](https://github.com/harttle/liquidjs) and [node-forge](https://github.com/digitalbazaar/forge). Bumps the npm_and_yarn group with 4 updates in the /examples/nodejs-example directory: [axios](https://github.com/axios/axios), [picomatch](https://github.com/micromatch/picomatch), [follow-redirects](https://github.com/follow-redirects/follow-redirects) and [lodash](https://github.com/lodash/lodash). Bumps the npm_and_yarn group with 9 updates in the /examples/react-native-example directory: | Package | From | To | | --- | --- | --- | | [undici](https://github.com/nodejs/undici) | `5.29.0` | `6.24.1` | | [picomatch](https://github.com/micromatch/picomatch) | `2.3.1` | `2.3.2` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.12` | `1.1.14` | | [serialize-javascript](https://github.com/yahoo/serialize-javascript) | `6.0.2` | `removed` | | [flatted](https://github.com/WebReflection/flatted) | `3.3.3` | `3.4.2` | | [follow-redirects](https://github.com/follow-redirects/follow-redirects) | `1.15.9` | `1.16.0` | | [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.18.1` | | [path-to-regexp](https://github.com/pillarjs/path-to-regexp) | `0.1.12` | `0.1.13` | | [sjcl](https://github.com/bitwiseshiftleft/sjcl) | `1.0.8` | `1.0.9` | Bumps the npm_and_yarn group with 3 updates in the /examples/web-example directory: [axios](https://github.com/axios/axios), [path-to-regexp](https://github.com/pillarjs/path-to-regexp) and [liquidjs](https://github.com/harttle/liquidjs). Bumps the npm_and_yarn group with 2 updates in the /examples/webview-server directory: [axios](https://github.com/axios/axios) and [path-to-regexp](https://github.com/pillarjs/path-to-regexp). Bumps the npm_and_yarn group with 1 update in the /packages/wasm directory: [axios](https://github.com/axios/axios). Updates `axios` from 0.25.0 to 0.31.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v0.25.0...v0.31.0) Updates `follow-redirects` from 1.15.11 to 1.16.0 - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.15.11...v1.16.0) Updates `@angular/compiler` from 19.2.14 to 19.2.18 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v19.2.18/packages/compiler) Updates `@angular/core` from 19.2.14 to 19.2.20 - [Release notes](https://github.com/angular/angular/releases) - [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md) - [Commits](https://github.com/angular/angular/commits/v19.2.20/packages/core) Updates `liquidjs` from 10.21.1 to 10.25.5 - [Release notes](https://github.com/harttle/liquidjs/releases) - [Changelog](https://github.com/harttle/liquidjs/blob/master/CHANGELOG.md) - [Commits](harttle/liquidjs@v10.21.1...v10.25.5) Updates `node-forge` from 1.3.1 to 1.4.0 - [Changelog](https://github.com/digitalbazaar/forge/blob/main/CHANGELOG.md) - [Commits](digitalbazaar/forge@v1.3.1...v1.4.0) Updates `axios` from 1.12.2 to 1.15.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v0.25.0...v0.31.0) Updates `picomatch` from 2.3.1 to 2.3.2 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@2.3.1...2.3.2) Updates `follow-redirects` from 1.15.11 to 1.16.0 - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.15.11...v1.16.0) Updates `lodash` from 4.17.21 to 4.18.1 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.18.1) Updates `undici` from 5.29.0 to 6.24.1 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v5.29.0...v6.24.1) Updates `picomatch` from 2.3.1 to 2.3.2 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@2.3.1...2.3.2) Updates `brace-expansion` from 1.1.12 to 1.1.14 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.14) Removes `serialize-javascript` Updates `flatted` from 3.3.3 to 3.4.2 - [Commits](WebReflection/flatted@v3.3.3...v3.4.2) Updates `follow-redirects` from 1.15.9 to 1.16.0 - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.15.11...v1.16.0) Updates `lodash` from 4.17.21 to 4.18.1 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.18.1) Updates `path-to-regexp` from 0.1.12 to 0.1.13 - [Release notes](https://github.com/pillarjs/path-to-regexp/releases) - [Changelog](https://github.com/pillarjs/path-to-regexp/blob/v.0.1.13/History.md) - [Commits](pillarjs/path-to-regexp@v0.1.12...v.0.1.13) Updates `sjcl` from 1.0.8 to 1.0.9 - [Release notes](https://github.com/bitwiseshiftleft/sjcl/releases) - [Commits](https://github.com/bitwiseshiftleft/sjcl/commits) Updates `axios` from 1.10.0 to 1.15.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v0.25.0...v0.31.0) Updates `follow-redirects` from 1.15.9 to 1.16.0 - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.15.11...v1.16.0) Updates `path-to-regexp` from 0.1.12 to 0.1.13 - [Release notes](https://github.com/pillarjs/path-to-regexp/releases) - [Changelog](https://github.com/pillarjs/path-to-regexp/blob/v.0.1.13/History.md) - [Commits](pillarjs/path-to-regexp@v0.1.12...v.0.1.13) Updates `liquidjs` from 10.25.2 to 10.25.5 - [Release notes](https://github.com/harttle/liquidjs/releases) - [Changelog](https://github.com/harttle/liquidjs/blob/master/CHANGELOG.md) - [Commits](harttle/liquidjs@v10.21.1...v10.25.5) Updates `axios` from 1.10.0 to 1.15.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v0.25.0...v0.31.0) Updates `follow-redirects` from 1.15.9 to 1.16.0 - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.15.11...v1.16.0) Updates `path-to-regexp` from 0.1.12 to 0.1.13 - [Release notes](https://github.com/pillarjs/path-to-regexp/releases) - [Changelog](https://github.com/pillarjs/path-to-regexp/blob/v.0.1.13/History.md) - [Commits](pillarjs/path-to-regexp@v0.1.12...v.0.1.13) Updates `axios` from 0.25.0 to 1.15.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v0.25.0...v0.31.0) --- updated-dependencies: - dependency-name: axios dependency-version: 0.31.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: follow-redirects dependency-version: 1.16.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@angular/compiler" dependency-version: 19.2.18 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@angular/core" dependency-version: 19.2.20 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: liquidjs dependency-version: 10.25.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: node-forge dependency-version: 1.4.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: axios dependency-version: 1.15.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 2.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: follow-redirects dependency-version: 1.16.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.18.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 6.24.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 2.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.14 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: serialize-javascript dependency-version: dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: flatted dependency-version: 3.4.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: follow-redirects dependency-version: 1.16.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.18.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: path-to-regexp dependency-version: 0.1.13 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: sjcl dependency-version: 1.0.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: axios dependency-version: 1.15.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: follow-redirects dependency-version: 1.16.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: path-to-regexp dependency-version: 0.1.13 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: liquidjs dependency-version: 10.25.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: axios dependency-version: 1.15.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: follow-redirects dependency-version: 1.16.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: path-to-regexp dependency-version: 0.1.13 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: axios dependency-version: 1.15.0 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-04-30T19:24:40Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 16, 2026

dependabot Bot closed this Apr 30, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/npm_and_yarn-de285988c7 branch April 30, 2026 19:24

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the npm_and_yarn group across 7 directories with 14 updates#504

Bump the npm_and_yarn group across 7 directories with 14 updates#504
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/npm_and_yarn-de285988c7

dependabot Bot commented on behalf of github Apr 16, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Apr 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Commit	Type	Description
8e808740c9	fix	better types for a few expression AST nodes
63b1cdcf70	fix	produce accurate span for typeof and void expressions
3c3ae0cb64	fix	provide location information for literal map keys
523dbaf1c3	fix	stop ThisReceiver inheritance from ImplicitReceiver

Commit	Type	Description
4d9c4567ed	fix	ensure component import diagnostics are reported within the `imports` expression
cd405685af	fix	fix up spelling of diagnostic
778460fcca	fix	support qualified names in `typeof` type references

Commit	Type	Description
7c74674eb0	fix	avoid leaking view data in animations
0edbee4550	fix	explicitly cast signal node value to String
f9c29572d2	fix	sanitize sensitive attributes on SVG script elements

Commit	Type	Description
e3fba182f9	feat	add `[formField]` directive
561772b152	fix	allow custom controls to require `dirty` input
f0fb1d8581	fix	allow custom controls to require `hidden` input
ec110f170b	fix	allow custom controls to require `pending` input
ae1dc16bb0	fix	clean up abort listener after timeout
9748b0d5da	fix	support custom controls with non signal-based models
6bd22df987	fix	Support readonly arrays in signal forms

Commit	Type	Description
41cd4a6af8	fix	Fix RouterLink href not updating with `queryParamsHandling`
5e9e09aee0	fix	handle errors from view transition `updateCallbackDone` promise

Commit	Description
	sanitize translated attribute bindings with interpolations
	sanitize translated form attributes

Commit	Type	Description
b89b0a83a4	fix	sanitize translated attribute bindings with interpolations
621c7071ad	fix	sanitize translated form attributes

Commit	Type	Description
72126f9a08	fix	sanitize translated attribute bindings with interpolations
626bc8bc20	fix	sanitize translated form attributes

Commit	Type	Description
999c14eaab	fix	reverts "feat(core): add support for nested animations"
de0eb4c656	fix	sanitize translated form attributes

Conversation

dependabot Bot commented on behalf of github Apr 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v0.31.0

🔒 Security Fixes

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

Release notes - v0.30.3

🛡️ Security Fixes

⚙️ Maintenance & CI

⚠️ Breaking Changes

19.2.18

core

19.2.17

compiler

19.2.16

http

19.2.15

core

Breaking Changes

core

19.2.18 (2026-01-07)

core

21.0.7 (2026-01-07)

compiler

compiler-cli

core

forms

router

21.0.6 (2025-12-17)

Breaking Changes (affecting only experimental features)

19.2.20

compiler

core

19.2.19

core

Breaking Changes

core

19.2.18

core

19.2.17

compiler

19.2.16

http

19.2.15

core

Breaking Changes

core

19.2.20 (2026-03-12)

compiler

core

20.3.18 (2026-03-12)

compiler

core

22.0.0-next.3 (2026-03-12)

compiler

core

21.2.4 (2026-03-12)

compiler

core

v10.25.5

10.25.5 (2026-04-07)

Bug Fixes

v10.25.4

10.25.4 (2026-04-07)

Bug Fixes

v10.25.3

10.25.3 (2026-04-06)

Bug Fixes

v10.25.2

10.25.2 (2026-03-25)

Bug Fixes

v10.25.1

10.25.1 (2026-03-22)

Bug Fixes

v10.25.0

10.25.0 (2026-03-07)

Bug Fixes

10.25.5 (2026-04-07)

dependabot Bot commented on behalf of github Apr 16, 2026 •

edited

Loading