Bump the npm_and_yarn group across 1 directory with 6 updates #5

dependabot · 2025-07-22T14:16:28Z

Bumps the npm_and_yarn group with 6 updates in the / directory:

Package	From	To
@babel/traverse	`7.15.4`	`7.28.0`
braces	`3.0.2`	`3.0.3`
form-data	`3.0.1`	`3.0.4`
json5	`2.2.0`	`2.2.3`
tough-cookie	`4.0.0`	`4.1.4`
ws	`7.5.5`	`7.5.10`

Updates @babel/traverse from 7.15.4 to 7.28.0

Release notes

Sourced from @babel/traverse's releases.

v7.28.0 (2025-07-02)

🚀 New Feature

babel-node

#17147 Support top level await in node repl (@liuxingbaoyu)

babel-types

#17258 feat(matchesPattern): support super/private/meta (@JLHwung)

babel-compat-data, babel-preset-env

#17355 Add explicit resource management to preset-env (@JLHwung)

babel-core, babel-parser

#17390 Support sourceType: "commonjs" (@JLHwung)

babel-generator, babel-parser

#17346 Materialize explicitResourceManagement parser plugin (@JLHwung)

babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions, babel-plugin-transform-object-rest-spread, babel-traverse, babel-types

#17391 LVal coverage updates (Part 2) (@JLHwung)

babel-parser, babel-traverse, babel-types

#17378 Accept bigints in t.bigIntLiteral factory (@JLHwung)

babel-generator, babel-plugin-proposal-destructuring-private, babel-plugin-proposal-discard-binding, babel-plugin-transform-destructuring, babel-plugin-transform-explicit-resource-management, babel-plugin-transform-react-display-name, babel-types

#17277 Transform discard binding (@JLHwung)

babel-generator, babel-parser, babel-plugin-proposal-destructuring-private, babel-plugin-transform-block-scoping, babel-plugin-transform-object-rest-spread, babel-plugin-transform-typescript, babel-traverse, babel-types

#17163 Parse discard binding (@JLHwung)

🐛 Bug Fix

babel-helper-globals, babel-plugin-transform-classes, babel-traverse

#17297 Create babel-helper-globals (@JLHwung)

babel-types

#17009 feature: TSTypeOperator: keyof (#16799) (@coderaiser)

🏠 Internal

babel-compat-data, babel-plugin-proposal-decorators, babel-plugin-transform-async-generator-functions, babel-plugin-transform-json-modules, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs3

#17403 Update babel-polyfill packages (@nicolo-ribaudo)

Committers: 5

Babel Bot (@babel-bot)

Huáng Jùnliàng (@JLHwung)

Nicolò Ribaudo (@nicolo-ribaudo)

@liuxingbaoyu

coderaiser (@coderaiser)

v7.27.7 (2025-06-26)

Thanks @arthur-mountain and @evankanderson for your first PRs!

👓 Spec Compliance

babel-parser, babel-plugin-transform-classes

#17203 Interepret parser allow* options as top level only (@JLHwung)

babel-parser

#17371 fix: disable using in ambient context (@JLHwung)

🐛 Bug Fix

... (truncated)

Changelog

Sourced from @babel/traverse's changelog.

v7.28.0 (2025-07-02)

🚀 New Feature

babel-node

#17147 Support top level await in node repl (@liuxingbaoyu)

babel-types

#17258 feat(matchesPattern): support super/private/meta (@JLHwung)

babel-compat-data, babel-preset-env

#17355 Add explicit resource management to preset-env (@JLHwung)

babel-core, babel-parser

#17390 Support sourceType: "commonjs" (@JLHwung)

babel-generator, babel-parser

#17346 Materialize explicitResourceManagement parser plugin (@JLHwung)

babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions, babel-plugin-transform-object-rest-spread, babel-traverse, babel-types

#17391 LVal coverage updates (Part 2) (@JLHwung)

babel-parser, babel-traverse, babel-types

#17378 Accept bigints in t.bigIntLiteral factory (@JLHwung)

babel-generator, babel-plugin-proposal-destructuring-private, babel-plugin-proposal-discard-binding, babel-plugin-transform-destructuring, babel-plugin-transform-explicit-resource-management, babel-plugin-transform-react-display-name, babel-types

#17277 Transform discard binding (@JLHwung)

babel-generator, babel-parser, babel-plugin-proposal-destructuring-private, babel-plugin-transform-block-scoping, babel-plugin-transform-object-rest-spread, babel-plugin-transform-typescript, babel-traverse, babel-types

#17163 Parse discard binding (@JLHwung)

🐛 Bug Fix

babel-helper-globals, babel-plugin-transform-classes, babel-traverse

#17297 Create babel-helper-globals (@JLHwung)

babel-types

#17009 feature: TSTypeOperator: keyof (#16799) (@coderaiser)

🏠 Internal

babel-compat-data, babel-plugin-proposal-decorators, babel-plugin-transform-async-generator-functions, babel-plugin-transform-json-modules, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs3

#17403 Update babel-polyfill packages (@nicolo-ribaudo)

v7.27.7 (2025-06-26)

👓 Spec Compliance

babel-parser, babel-plugin-transform-classes

#17203 Interepret parser allow* options as top level only (@JLHwung)

babel-parser

#17371 fix: disable using in ambient context (@JLHwung)

🐛 Bug Fix

babel-core

#17392 Improve TS babel config loading (@JLHwung)

babel-types

#17376 fix: support negative bigint in valueToNode (@JLHwung)

babel-plugin-transform-parameters

#17352 fix: Params of async function* should throw synchronously (@liuxingbaoyu)

🏠 Internal

babel-plugin-transform-destructuring, babel-plugin-transform-object-rest-spread

#17389 Use NodePath#splitExportDeclaration in destructuring transforms (@JLHwung)

... (truncated)

Commits

ccc5fae v7.28.0
4b4e7e2 Create babel-helper-globals (#17297)
cf5ae03 LVal coverage updates (Part 2) (#17391)
6ca9df4 Accept bigints in t.bigIntLiteral factory (#17378)
75f0140 Parse discard binding (#17163)
4ce7dfd v7.27.7
6c8faf1 add generateUidBasedOnNode test cases (#17381)
f68ac51 chore: Avoid CITGM errors (#17382)
7d06930 v7.27.4
05f28c8 [Babel 8] Change scope.{references,uids} to Set (#16624)
Additional commits viewable in compare view

Updates braces from 3.0.2 to 3.0.3

Commits

74b2db2 3.0.3
88f1429 update eslint. lint, fix unit tests.
415d660 Snyk js braces 6838727 (#40)
190510f fix tests, skip 1 test in test/braces.expand
716eb9f readme bump
a5851e5 Merge pull request #37 from coderaiser/fix/vulnerability
2092bd1 feature: braces: add maxSymbols (https://github.com/micromatch/braces/issues/...
9f5b4cf fix: vulnerability (https://security.snyk.io/vuln/SNYK-JS-BRACES-6838727)
98414f9 remove funding file
665ab5d update keepEscaping doc (#27)
Additional commits viewable in compare view

Updates form-data from 3.0.1 to 3.0.4

Release notes

Sourced from form-data's releases.

v3.0.2

Fixes

npmignore temporary build files (#532)

move util.isArray to Array.isArray (#564)

Tests

migrate from travis to GHA

Changelog

Sourced from form-data's changelog.

v3.0.4 - 2025-07-16

Fixed

[Fix] append: avoid a crash on nullish values [#577](https://github.com/form-data/form-data/issues/577)

Commits

[eslint] update linting config f5e7eb0

[meta] add auto-changelog d2eb290

[Tests] handle predict-v8-randomness failures in node < 17 and node > 23 e8c574c

[Fix] Switch to using crypto random for boundary values c6ced61

[Refactor] use hasown 1a78b5d

[Fix] validate boundary type in setBoundary() method 70bbaa0

[Tests] add tests to check the behavior of getBoundary with non-strings b22a64e

[meta] actually ensure the readme backup isn’t published 0150851

[meta] remove local commit hooks fc42bb9

[Dev Deps] remove unused deps a14d09e

[meta] fix scripts to use prepublishOnly 11d9f73

[meta] fix readme capitalization fc38b48

v3.0.3 - 2025-02-14

Merged

[Fix] set Symbol.toStringTag when available [#573](https://github.com/form-data/form-data/issues/573)

Fixed

[Fix] set Symbol.toStringTag when available (#573) [#396](https://github.com/form-data/form-data/issues/396)

Commits

[Refactor] use Object.prototype.hasOwnProperty.call 7fecefe

[Dev Deps] update @types/node, browserify, coveralls, cross-spawn, eslint, formidable, in-publish, pkgfiles, pre-commit, puppeteer, request, tape, typescript 8261fcb

Only apps should have lockfiles b82f590

[Dev Deps] pin request which via tough-cookie ^2.4 depends on psl e5df7f2

[Deps] update mime-types 5a5bafe

v3.0.2 - 2024-10-10

Merged

fix (npmignore): ignore temporary build files [#532](https://github.com/form-data/form-data/issues/532)

Commits

[Tests] migrate from travis to GHA 8fdb3bc

[eslint] clean up ignores 3217b3d

fix: move util.isArray to Array.isArray (#564) edb555a

Commits

9c82fcd v3.0.4
e8c574c [Tests] handle predict-v8-randomness failures in node < 17 and node > 23
c6ced61 [Fix] Switch to using crypto random for boundary values
0150851 [meta] actually ensure the readme backup isn’t published
fc38b48 [meta] fix readme capitalization
d2eb290 [meta] add auto-changelog
fc42bb9 [meta] remove local commit hooks
a14d09e [Dev Deps] remove unused deps
002b9b0 [Fix] append: avoid a crash on nullish values
70bbaa0 [Fix] validate boundary type in setBoundary() method
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by ljharb, a new releaser for form-data since your current version.

Updates json5 from 2.2.0 to 2.2.3

Release notes

Sourced from json5's releases.

v2.2.3

Fix: json5@2.2.3 is now the 'latest' release according to npm instead of v1.0.2. (#299)

v2.2.2

Fix: Properties with the name __proto__ are added to objects and arrays. (#199) This also fixes a prototype pollution vulnerability reported by Jonathan Gregson! (#295).

v2.2.1

Fix: Removed dependence on minimist to patch CVE-2021-44906. (#266)

Changelog

Sourced from json5's changelog.

v2.2.3 [code, diff]

Fix: json5@2.2.3 is now the 'latest' release according to npm instead of v1.0.2. (#299)

v2.2.2 [code, diff]

Fix: Properties with the name __proto__ are added to objects and arrays. (#199) This also fixes a prototype pollution vulnerability reported by Jonathan Gregson! (#295).

v2.2.1 [code, diff]

Fix: Removed dependence on minimist to patch CVE-2021-44906. (#266)

Commits

c3a7524 2.2.3
94fd06d docs: update CHANGELOG for v2.2.3
3b8cebf docs(security): use GitHub security advisories
f0fd9e1 docs: publish a security policy
6a91a05 docs(template): bug -> bug report
14f8cb1 2.2.2
10cc7ca docs: update CHANGELOG for v2.2.2
7774c10 fix: add proto to objects and arrays
edde30a Readme: slight tweak to intro
97286f8 Improve example in readme
Additional commits viewable in compare view

Updates tough-cookie from 4.0.0 to 4.1.4

Release notes

Sourced from tough-cookie's releases.

v4.1.4

https://www.npmjs.com/package/tough-cookie/v/4.1.4

What's Changed

Add local alias for toString by @corvidism in salesforce/tough-cookie#409

Fix incorrect string validation for URL by @coditva in salesforce/tough-cookie#261

New Contributors

@corvidism made their first contribution in salesforce/tough-cookie#409

@coditva made their first contribution in salesforce/tough-cookie#261

Full Changelog: salesforce/tough-cookie@v4.1.3...v4.1.4

4.1.3

Security fix for Prototype Pollution discovery in #282. This is a minor release, although output from the inspect utility is affected by this change, we felt this change was important enough to be pushed into the next patch.

4.1.2 -- Patch and Bugfix Release

What's Changed

fix: allow set cookies with localhost by @colincasey in salesforce/tough-cookie#253

Full Changelog: salesforce/tough-cookie@v4.1.1...v4.1.2

4.1.1

Patch Release

What's Changed

fix: allow special use domains by default by @colincasey in salesforce/tough-cookie#249

4.1.1 Patch -- allow special use domains by default by @awaterma in salesforce/tough-cookie#250

Full Changelog: salesforce/tough-cookie@v4.1.0...v4.1.1

4.1.0

v4.1.0

Minor release, focused mainly on resolving reported issues and some minor feature work.

What's Changed

Create CHANGELOG.md by @ShivanKaul in salesforce/tough-cookie#189

Missing param validation issue145 by @medelibero-sfdc in salesforce/tough-cookie#193

Create SECURITY.md by @ShivanKaul in salesforce/tough-cookie#201

Create CODE_OF_CONDUCT.md by @ShivanKaul in salesforce/tough-cookie#200

Fix for issue #195 by @medelibero-sfdc in salesforce/tough-cookie#202

Add explanation and more special-use domains by @ShivanKaul in salesforce/tough-cookie#203

Sync of constructor options for serialization by @medelibero-sfdc in salesforce/tough-cookie#204

Returned null in case of empty cookie value by @vsin12 in salesforce/tough-cookie#196

132 str trim not a function by @awaterma in salesforce/tough-cookie#209

Fix for issue #153 by @medelibero-sfdc in salesforce/tough-cookie#210

Fix permuteDomain with trailing dot by @ruoho-sfdc in salesforce/tough-cookie#216

Issue #213 -- added gh-actions flow for building and testing tough-co… by @awaterma in salesforce/tough-cookie#218

... (truncated)

Commits

cacbc37 Bump version to 4.1.4
a48fb3a Add tests for url validation
50e69bf Merge pull request #261 from postmanlabs/fix/url-string-validation
1253d58 Merge pull request #409 from corvidism/validators-to-string
238367e Add local alias for toString
4ff4d29 4.1.3 release preparation, update the package and lib/version to 4.1.3. (#284)
12d4747 Prevent prototype pollution in cookie memstore (#283)
f06b72d Fix documentation for store.findCookies, missing allowSpecialUseDomain proper...
cf6debd Fix incorrect string validation for URL
b1a8898 fix: allow set cookies with localhost (#253)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by ccasey, a new releaser for tough-cookie since your current version.

Updates ws from 7.5.5 to 7.5.10

Release notes

Sourced from ws's releases.

7.5.10

Bug fixes

Backported e55e5106 to the 7.x release line (22c28763).

7.5.9

Bug fixes

Backported bc8bd34e to the 7.x release line (0435e6e1).

7.5.8

Bug fixes

Backported 0fdcc0af to the 7.x release line (2758ed35).

Backported d68ba9e1 to the 7.x release line (dc1781bc).

7.5.7

Bug fixes

Backported 6946f5fe to the 7.x release line (1f72e2e1).

7.5.6

Bug fixes

Backported b8186dd1 to the 7.x release line (73dec34b).

Backported ed2b8039 to the 7.x release line (22a26afb).

Commits

d962d70 [dist] 7.5.10
22c2876 [security] Fix crash when the Upgrade header cannot be read (#2231)
8a78f87 [dist] 7.5.9
0435e6e [security] Fix same host check for ws+unix: redirects
4271f07 [dist] 7.5.8
dc1781b [security] Drop sensitive headers when following insecure redirects
2758ed3 [fix] Abort the handshake if the Upgrade header is invalid
a370613 [dist] 7.5.7
1f72e2e [security] Drop sensitive headers when following redirects (#2013)
8ecd890 [dist] 7.5.6
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the npm_and_yarn group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@babel/traverse](https://github.com/babel/babel/tree/HEAD/packages/babel-traverse) | `7.15.4` | `7.28.0` | | [braces](https://github.com/micromatch/braces) | `3.0.2` | `3.0.3` | | [form-data](https://github.com/form-data/form-data) | `3.0.1` | `3.0.4` | | [json5](https://github.com/json5/json5) | `2.2.0` | `2.2.3` | | [tough-cookie](https://github.com/salesforce/tough-cookie) | `4.0.0` | `4.1.4` | | [ws](https://github.com/websockets/ws) | `7.5.5` | `7.5.10` | Updates `@babel/traverse` from 7.15.4 to 7.28.0 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.28.0/packages/babel-traverse) Updates `braces` from 3.0.2 to 3.0.3 - [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md) - [Commits](micromatch/braces@3.0.2...3.0.3) Updates `form-data` from 3.0.1 to 3.0.4 - [Release notes](https://github.com/form-data/form-data/releases) - [Changelog](https://github.com/form-data/form-data/blob/v3.0.4/CHANGELOG.md) - [Commits](form-data/form-data@v3.0.1...v3.0.4) Updates `json5` from 2.2.0 to 2.2.3 - [Release notes](https://github.com/json5/json5/releases) - [Changelog](https://github.com/json5/json5/blob/main/CHANGELOG.md) - [Commits](json5/json5@v2.2.0...v2.2.3) Updates `tough-cookie` from 4.0.0 to 4.1.4 - [Release notes](https://github.com/salesforce/tough-cookie/releases) - [Changelog](https://github.com/salesforce/tough-cookie/blob/master/CHANGELOG.md) - [Commits](salesforce/tough-cookie@v4.0.0...v4.1.4) Updates `ws` from 7.5.5 to 7.5.10 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@7.5.5...7.5.10) --- updated-dependencies: - dependency-name: "@babel/traverse" dependency-version: 7.28.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: braces dependency-version: 3.0.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: form-data dependency-version: 3.0.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: json5 dependency-version: 2.2.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tough-cookie dependency-version: 4.1.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 7.5.10 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 22, 2025

This was referenced Jul 22, 2025

Bump json5 from 2.2.0 to 2.2.3 #2

Closed

Bump tough-cookie from 4.0.0 to 4.1.3 #3

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump the npm_and_yarn group across 1 directory with 6 updates #5

Bump the npm_and_yarn group across 1 directory with 6 updates #5

Uh oh!

dependabot bot commented on behalf of github Jul 22, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Bump the npm_and_yarn group across 1 directory with 6 updates #5

Are you sure you want to change the base?

Bump the npm_and_yarn group across 1 directory with 6 updates #5

Uh oh!

Conversation

dependabot bot commented on behalf of github Jul 22, 2025

v7.28.0 (2025-07-02)

🚀 New Feature

🐛 Bug Fix

🏠 Internal

Committers: 5

v7.27.7 (2025-06-26)

👓 Spec Compliance

🐛 Bug Fix

v7.28.0 (2025-07-02)

🚀 New Feature

🐛 Bug Fix

🏠 Internal

v7.27.7 (2025-06-26)

👓 Spec Compliance

🐛 Bug Fix

🏠 Internal

v3.0.2

Fixes

Tests

v3.0.4 - 2025-07-16

Fixed

Commits

v3.0.3 - 2025-02-14

Merged

Fixed

Commits

v3.0.2 - 2024-10-10

Merged

Commits

v2.2.3

v2.2.2

v2.2.1

v2.2.3 [code, diff]

v2.2.2 [code, diff]

v2.2.1 [code, diff]

v4.1.4

What's Changed

New Contributors

4.1.3

4.1.2 -- Patch and Bugfix Release

What's Changed

4.1.1

Patch Release

What's Changed

4.1.0

What's Changed

7.5.10

Bug fixes

7.5.9

Bug fixes

7.5.8

Bug fixes

7.5.7

Bug fixes

7.5.6

Bug fixes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant