Bump the npm_and_yarn group across 1 directory with 18 updates by dependabot[bot] · Pull Request #1502 · mdazfar2/HelpOps-Hub

dependabot · 2026-04-24T16:37:40Z

Bumps the npm_and_yarn group with 15 updates in the /website3.0 directory:

Package	From	To
axios	`1.7.4`	`1.15.0`
mongoose	`8.4.4`	`8.9.5`
next	`14.2.12`	`16.2.4`
next-auth	`4.24.7`	`4.24.12`
nodemailer	`6.9.14`	`8.0.5`
postcss	`8.4.39`	`8.5.10`
@babel/runtime	`7.24.7`	`7.29.2`
ajv	`6.12.6`	`6.15.0`
brace-expansion	`1.1.11`	`1.1.14`
brace-expansion	`2.0.1`	`2.1.0`
cross-spawn	`7.0.3`	`7.0.6`
minimatch	`3.1.2`	`3.1.5`
minimatch	`9.0.4`	`9.0.9`
glob	`10.4.1`	`10.5.0`
jws	`3.2.2`	`3.2.3`
lodash	`4.17.21`	`4.18.1`
picomatch	`2.3.1`	`2.3.2`

Updates axios from 1.7.4 to 1.15.0

Release notes

Sourced from axios's releases.

v1.15.0

This release delivers two critical security patches, adds runtime support for Deno and Bun, and includes significant CI hardening, documentation improvements, and routine dependency updates.

⚠️ Important Changes

Deprecation: url.parse() usage has been replaced to address Node.js deprecation warnings. If you are on a recent version of Node.js, this resolves console warnings you may have been seeing. (#10625)

🔒 Security Fixes

Proxy Handling: Fixed a no_proxy hostname normalisation bypass that could lead to Server-Side Request Forgery (SSRF). (#10661)

Header Injection: Fixed an unrestricted cloud metadata exfiltration vulnerability via a header injection chain. (#10660)

🚀 New Features

Runtime Support: Added compatibility checks and documentation for Deno and Bun environments. (#10652, #10653)

🔧 Maintenance & Chores

CI Security: Hardened workflow permissions to least privilege, added the zizmor security scanner, pinned action versions, and gated npm publishing with OIDC and environment protection. (#10618, #10619, #10627, #10637, #10666)

Dependencies: Bumped serialize-javascript, handlebars, picomatch, vite, and denoland/setup-deno to latest versions. Added a 7-day Dependabot cooldown period. (#10574, #10572, #10568, #10663, #10664, #10665, #10669, #10670, #10616)

Documentation: Unified docs, improved beforeRedirect credential leakage example, clarified withCredentials/withXSRFToken behaviour, HTTP/2 support notes, async/await timeout error handling, header case preservation, and various typo fixes. (#10649, #10624, #7452, #7471, #10654, #10644, #10589)

Housekeeping: Removed stale files, regenerated lockfile, and updated sponsor scripts and blocks. (#10584, #10650, #10582, #10640, #10659, #10668)

Tests: Added regression coverage for urlencoded Content-Type casing. (#10573)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve Axios:

@raashish1601 (#10573)

@Kilros0817 (#10625)

@ashstrc (#10624)

@Abhi3975 (#10589)

@theamodhshetty (#7452)

v1.14.0

This release focuses on compatibility fixes, adapter stability improvements, and test/tooling modernisation.

⚠️ Important Changes

Breaking Changes: None identified in this release.

Action Required: If you rely on env-based proxy behaviour or CJS resolution edge-cases, validate your integration after upgrade (notably proxy-from-env v2 alignment and main entry compatibility fix).

🚀 New Features

Runtime Features: No new end-user features were introduced in this release.

Test Coverage Expansion: Added broader smoke/module test coverage for CJS and ESM package usage. (#7510)

🐛 Bug Fixes

Headers: Trim trailing CRLF in normalised header values. (#7456)

HTTP/2: Close detached HTTP/2 sessions on timeout to avoid lingering sessions. (#7457)

Fetch Adapter: Cancel ReadableStream created during request-stream capability probing to prevent async resource leaks. (#7515)

Proxy Handling: Fixed env proxy behavior with proxy-from-env v2 usage. (#7499)

... (truncated)

Changelog

Sourced from axios's changelog.

v1.15.0 - April 7, 2026

This release delivers two critical security patches targeting header injection and SSRF via proxy bypass, adds official runtime support for Deno and Bun, and includes significant CI security hardening.

🔒 Security Fixes

Header Injection (CRLF): Rejects any header value containing \r or \n characters to block CRLF injection chains that could be used to exfiltrate cloud metadata (IMDS). Behavior change: headers with CR/LF now throw "Invalid character in header content". (#10660)

SSRF via no_proxy Bypass: Introduces a shouldBypassProxy helper that normalises hostnames (strips trailing dots, handles bracketed IPv6) before evaluating no_proxy/NO_PROXY rules, closing a gap that could cause loopback or internal hosts to be inadvertently proxied. (#10661)

🚀 New Features

Deno & Bun Runtime Support: Added full smoke test suites for Deno and Bun, with CI workflows that run both runtimes before any release is cut. (#10652)

🐛 Bug Fixes

Node.js v22 Compatibility: Replaced deprecated url.parse() calls with the WHATWG URL/URLSearchParams API across examples, sandbox, and tests, eliminating DEP0169 deprecation warnings on Node.js v22+. (#10625)

🔧 Maintenance & Chores

CI Security Hardening: Added zizmor GitHub Actions security scanner; switched npm publish to OIDC Trusted Publishing (removing the long-lived NODE_AUTH_TOKEN); pinned all action references to full commit SHAs; narrowed workflow permissions to least privilege; gated the publish step behind a dedicated npm-publish environment; and blocked the sponsor-block workflow from running on forks. (#10618, #10619, #10627, #10637, #10641, #10666)

Docs: Clarified HTTP/2 support and the unsupported httpVersion option; added documentation for header case preservation; improved the beforeRedirect example to prevent accidental credential leakage. (#10644, #10654, #10624)

Dependencies: Bumped picomatch, handlebars, serialize-javascript, vite (×3), denoland/setup-deno, and 4 additional dev dependencies to latest versions. (#10564, #10565, #10567, #10568, #10572, #10574, #10663, #10664, #10665, #10669, #10670)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

@Kilros0817 (#10625)

@shaanmajid (#10616, #10617, #10618, #10619, #10637, #10641, #10666)

@ashstrc (#10624, #10644)

@Abhi3975 (#10589)

@raashish1601 (#10573)

Full Changelog

v1.14.0 - March 27, 2026

This release fixes a security vulnerability in the formidable dependency, resolves a CommonJS compatibility regression, hardens proxy and HTTP/2 handling, and modernises the build and test toolchain.

🔒 Security Fixes

Formidable Vulnerability: Upgraded formidable from v2 to v3 to address a reported arbitrary-file vulnerability. Updated test server and assertions to align with the v3 API. (#7533)

🐛 Bug Fixes

... (truncated)

Commits

772a4e5 chore(release): prepare release 1.15.0 (#10671)
4b07137 chore(deps-dev): bump vite from 8.0.0 to 8.0.5 in /tests/smoke/esm (#10663)
51e57b3 chore(deps-dev): bump vite from 8.0.2 to 8.0.5 (#10664)
fba1a77 chore(deps-dev): bump vite from 8.0.2 to 8.0.5 in /tests/module/esm (#10665)
0bf6e28 chore(deps): bump denoland/setup-deno in the github-actions group (#10669)
8107157 chore(deps-dev): bump the development_dependencies group with 4 updates (#10670)
e66530e ci: require npm-publish environment for releases (#10666)
49f23cb chore(sponsor): update sponsor block (#10668)
3631854 fix: unrestricted cloud metadata exfiltration via header injection chain (#10...
fb3befb fix: no_proxy hostname normalization bypass leads to ssrf (#10661)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for axios since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates mongoose from 8.4.4 to 8.9.5

Release notes

Sourced from mongoose's releases.

8.9.5 / 2025-01-13

fix: disallow nested $where in populate match

fix(schema): handle bitwise operators on Int32 #15176 #15170

8.9.4 / 2025-01-09

fix(document): fix document not applying manual populate when using a function in schema.options.ref #15138 IchirokuXVI

fix(model): make Model.validate() static correctly cast document arrays #15169 #15164

fix(model): allow passing validateBeforeSave option to bulkSave() to skip validation #15161 #15156

fix(schema): allow multiple self-referencing discriminator schemas using Schema.prototype.discriminator #15142 #15120

types: avoid BufferToBinary<> wiping lean types when passed to generic functions #15160 #15158

docs: fix <code> in header ids #15159

docs: fix header in field-level-encryption.md #15137 damieng

8.9.3 / 2024-12-30

fix(schema): make duplicate index error a warning for now to prevent blocking upgrading #15135 #15112 #15109

fix(model): handle document array paths set to non-array values in Model.castObject() #15124 #15075

fix(document): avoid using childSchemas.path for compatibility with pre-Mongoose-8.8 schemas #15131 #15071

fix(model): avoid throwing unnecessary error if updateOne() returns null in save() #15126

perf(cursor): clear the stack every time if using populate with batchSize to avoid stack overflows with large docs #15136 #10449

types: make BufferToBinary avoid Document instances #15123 #15122

types(model+query): avoid stripping out virtuals when calling populate with paths generic #15132 #15111

types(schema): add missing removeIndex #15134

types: add cleanIndexes() to IndexManager interface #15127

docs: move search endpoint to netlify #15119

8.9.2 / 2024-12-19

fix(schema): avoid throwing duplicate index error if index spec keys have different order or index has a custom name #15112 #15109

fix(map): clean modified subpaths when overwriting values in map of subdocs #15114 #15108

fix(aggregate): pull session from transaction local storage for aggregation cursors #15094 IchirokuXVI

types: correctly handle union types in BufferToBinary and related helpers #15103 #15102 #15057

types: add UUID to RefType #15115 #15101

docs: remove link to Mongoose 5.x docs from dropdown #15116

docs(connection+document+model): remove remaining references to remove(), clarify that deleteOne() does not execute until then() or exec() #15113 #15107

8.9.1 / 2024-12-16

fix(connection): remove heartbeat check in load balanced mode #15089 #15042 #14812

fix(discriminator): gather childSchemas when creating discriminator to ensure $getAllSubdocs() can properly get all subdocs #15099 #15088 #15092

fix(model): handle discriminators in castObject() #15096 #15075

fix(schema): throw error if duplicate index definition using unique in schema path and subsequent .index() call #15093 #15056

fix: mark documents that are populated using hydratedPopulatedDocs option as populated in top-level doc #15080 #15048

fix(document+schema): improve error message for get() on invalid path #15098 #15071

docs: remove more callback doc references & some small other changes #15095

8.9.0 / 2024-12-13

... (truncated)

Changelog

Sourced from mongoose's changelog.

8.9.5 / 2025-01-13

fix: disallow nested $where in populate match CVE-2025-23061

fix(schema): handle bitwise operators on Int32 #15176 #15170

7.8.4 / 2025-01-13

fix: disallow nested $where in populate match CVE-2025-23061

6.13.6 / 2025-01-13

fix: disallow nested $where in populate match CVE-2025-23061

8.9.4 / 2025-01-09

fix(document): fix document not applying manual populate when using a function in schema.options.ref #15138 IchirokuXVI

fix(model): make Model.validate() static correctly cast document arrays #15169 #15164

fix(model): allow passing validateBeforeSave option to bulkSave() to skip validation #15161 #15156

fix(schema): allow multiple self-referencing discriminator schemas using Schema.prototype.discriminator #15142 #15120

types: avoid BufferToBinary<> wiping lean types when passed to generic functions #15160 #15158

docs: fix <code> in header ids #15159

docs: fix header in field-level-encryption.md #15137 damieng

8.9.3 / 2024-12-30

fix(schema): make duplicate index error a warning for now to prevent blocking upgrading #15135 #15112 #15109

fix(model): handle document array paths set to non-array values in Model.castObject() #15124 #15075

fix(document): avoid using childSchemas.path for compatibility with pre-Mongoose-8.8 schemas #15131 #15071

fix(model): avoid throwing unnecessary error if updateOne() returns null in save() #15126

perf(cursor): clear the stack every time if using populate with batchSize to avoid stack overflows with large docs #15136 #10449

types: make BufferToBinary avoid Document instances #15123 #15122

types(model+query): avoid stripping out virtuals when calling populate with paths generic #15132 #15111

types(schema): add missing removeIndex #15134

types: add cleanIndexes() to IndexManager interface #15127

docs: move search endpoint to netlify #15119

8.9.2 / 2024-12-19

fix(schema): avoid throwing duplicate index error if index spec keys have different order or index has a custom name #15112 #15109

fix(map): clean modified subpaths when overwriting values in map of subdocs #15114 #15108

fix(aggregate): pull session from transaction local storage for aggregation cursors #15094 IchirokuXVI

types: correctly handle union types in BufferToBinary and related helpers #15103 #15102 #15057

types: add UUID to RefType #15115 #15101

docs: remove link to Mongoose 5.x docs from dropdown #15116

docs(connection+document+model): remove remaining references to remove(), clarify that deleteOne() does not execute until then() or exec() #15113 #15107

8.9.1 / 2024-12-16

fix(connection): remove heartbeat check in load balanced mode #15089 #15042 #14812

fix(discriminator): gather childSchemas when creating discriminator to ensure $getAllSubdocs() can properly get all subdocs #15099 #15088 #15092

... (truncated)

Commits

5af0a10 chore: release 8.9.5
a42d8f5 Merge branch '7.x'
73e81ab chore: release 7.8.4
4fe9a90 Merge branch '6.x' into 7.x
e59e342 chore: release 6.13.6
64a9f97 fix: disallow nested $where in populate match
fa33717 Merge pull request #15176 from Automattic/vkarpov15/gh-15170
0728602 test: make test cast non-boolean value
0cad0d7 fix(schema): handle bitwise operators on Int32
39886fb docs: quick changelog formatting fix
Additional commits viewable in compare view

Updates next from 14.2.12 to 16.2.4

Release notes

Sourced from next's releases.

v16.2.4

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

chore: Bump reqwest to 0.13.2 (Fixes Google Fonts with Turbopack for Windows on ARM64) (#92713)

Turbopack: fix filesystem watcher config not applying follow_symlinks(false) (#92631)

Scope Safari ?ts= cache-buster to CSS/font assets only (Pages Router) (#92580)

Compiler: Support boolean and number primtives in next.config defines (#92731)

turbo-tasks: Fix recomputation loop by allowing cell cleanup on error during recomputation (#92725)

Turbopack: shorter error for ChunkGroupInfo::get_index_of (#92814)

Turbopack: shorter error message for ModuleBatchesGraph::get_entry_index (#92828)

Adding more system info to the 'initialize project' trace (#92427)

Credits

Huge thanks to @Badbird5907, @lukesandberg, @andrewimm, @sokra, and @mischnic for helping!

v16.2.3

[!NOTE] This release is backporting security and bug fixes. For more information about the fixed security vulnerability, please see https://vercel.com/changelog/summary-of-cve-2026-23869. The release does not include all pending features/changes on canary.

Core Changes

Ensure app-page reports stale ISR revalidation errors via onRequestError (#92282)

Fix [Bug]: manifest.ts breaks HMR in Next.js 16.2 (#91981 through #92273)

Deduplicate output assets and detect content conflicts on emit (#92292)

Fix styled-jsx race condition: styles lost due to concurrent rendering (#92459)

turbo-tasks-backend: stability fixes for task cancellation and error handling (#92254)

Credits

Huge thanks to @icyJoseph, @sokra, @wbinnssmith, @eps1lon and @ztanner for helping!

v16.2.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

backport: Move expanded adapters docs to API reference (#92115) (#92129)

Backport: TypeScript v6 deprecations for baseUrl and moduleResolution (#92130)

[create-next-app] Skip interactive prompts when CLI flags are provided (#91840)

next.config.js: Accept an option for serverFastRefresh (#91968)

Turbopack: enable server HMR for app route handlers (#91466)

Turbopack: exclude metadata routes from server HMR (#92034)

Fix CI for glibc linux builds

Backport: disable bmi2 in qfilter #92177

[backport] Fix CSS HMR on Safari (#92174)

... (truncated)

Commits

2275bd8 v16.2.4
e073983 Adding more system info to the 'initialize project' trace (#92427)
8a540b5 Turbopack: shorter error message for ModuleBatchesGraph::get_entry_index (#92...
2f5343f Turbopack: shorter error for ChunkGroupInfo::get_index_of (#92814)
2ad9d3f turbo-tasks: Fix recomputation loop by allowing cell cleanup on error during ...
6f3808e Compiler: Support boolean and number primtives in next.config defines (#92731)
fbc7684 Scope Safari ?ts= cache-buster to CSS/font assets only (Pages Router) (#92580)
805d758 Turbopack: fix filesystem watcher config not applying follow_symlinks(false) ...
1056fae chore: Bump reqwest to 0.13.2 (#92713)
d5f649b v16.2.3
Additional commits viewable in compare view

Updates next-auth from 4.24.7 to 4.24.12

Commits

1f48cf7 chore(release): bump version [skip ci]
4758a2f ci: add workflow_dispatch for release.yml
d3aecfe feat: add next 16 support (#13303)
82efcf8 fix: security issue from nodemailer (#13304)
798c3d5 docs: update banner
02d3480 chore: remove clerk ads
7f88fa0 chore: remove sponsors
46e01af chore(docs): update credentials.md app router route.js filename (#13025)
11939f2 feat(core): add default cache control headers for GET endpoints (#12627)
918a6ac docs: Update FAQ with allowDangerousEmailAccountLinking (#12586)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by himself_65, a new releaser for next-auth since your current version.

Updates nodemailer from 6.9.14 to 8.0.5

Release notes

Sourced from nodemailer's releases.

v8.0.5

8.0.5 (2026-04-07)

Bug Fixes

decode SMTP server responses as UTF-8 at line boundary (95876b1)

sanitize CRLF in transport name option to prevent SMTP command injection (GHSA-vvjj-xcjg-gr5g) (0a43876)

v8.0.4

8.0.4 (2026-03-25)

Bug Fixes

sanitize envelope size to prevent SMTP command injection (2d7b971)

v8.0.3

8.0.3 (2026-03-18)

Bug Fixes

clean up addressparser and fix group name fallback producing undefined (9d55877)

fix cookie bugs, remove dead code, and improve hot-path efficiency (e8c8b92)

refactor smtp-connection for clarity and add Node.js 6 syntax compat test (c5b48ea)

remove familySupportCache that broke DNS resolution tests (c803d90)

v8.0.2

8.0.2 (2026-03-09)

Bug Fixes

merge fragmented display names with unquoted commas in addressparser (fe27f7f)

v8.0.1

8.0.1 (2026-02-07)

Bug Fixes

absorb TLS errors during socket teardown (7f8dde4)

absorb TLS errors during socket teardown (381f628)

Add Gmail Workspace service configuration (#1787) (dc97ede)

v8.0.0

8.0.0 (2026-02-04)

... (truncated)

Changelog

Sourced from nodemailer's changelog.

8.0.5 (2026-04-07)

Bug Fixes

decode SMTP server responses as UTF-8 at line boundary (95876b1)

sanitize CRLF in transport name option to prevent SMTP command injection (GHSA-vvjj-xcjg-gr5g) (0a43876)

8.0.4 (2026-03-25)

Bug Fixes

sanitize envelope size to prevent SMTP command injection (2d7b971)

8.0.3 (2026-03-18)

Bug Fixes

clean up addressparser and fix group name fallback producing undefined (9d55877)

fix cookie bugs, remove dead code, and improve hot-path efficiency (e8c8b92)

refactor smtp-connection for clarity and add Node.js 6 syntax compat test (c5b48ea)

remove familySupportCache that broke DNS resolution tests (c803d90)

8.0.2 (2026-03-09)

Bug Fixes

merge fragmented display names with unquoted commas in addressparser (fe27f7f)

8.0.1 (2026-02-07)

Bug Fixes

absorb TLS errors during socket teardown (7f8dde4)

absorb TLS errors during socket teardown (381f628)

Add Gmail Workspace service configuration (#1787) (dc97ede)

8.0.0 (2026-02-04)

⚠ BREAKING CHANGES

Error code 'NoAuth' renamed to 'ENOAUTH'

Bug Fixes

... (truncated)

Commits

202cfb3 chore(master): release 8.0.5 (#1809)
b634abf docs: add CLAUDE.md with project conventions and release process
95876b1 fix: decode SMTP server responses as UTF-8 at line boundary
0a43876 fix: sanitize CRLF in transport name option to prevent SMTP command injection...
08e59e6 chore: update dev dependencies
2d31975 chore(master): release 8.0.4 (#1806)
2d7b971 fix: sanitize envelope size to prevent SMTP command injection
4e702e9 chore(master): release 8.0.3 (#1804)
c803d90 fix: remove familySupportCache that broke DNS resolution tests
e8c8b92 fix: fix cookie bugs, remove dead code, and improve hot-path efficiency
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nodemailer since your current version.

Updates postcss from 8.4.39 to 8.5.10

Release notes

Sourced from postcss's releases.

8.5.10

Fixed XSS via unescaped </style> in non-bundler cases (by @TharVid).

8.5.9

Speed up source map encoding paring in case of the error.

8.5.8

Fixed Processor#version.

8.5.7

Improved source map annotation cleaning performance (by CodeAnt AI).

8.5.6

Fixed ContainerWithChildren type discriminating (by @Goodwine).

8.5.5

Fixed package.json→exports compatibility with some tools (by @JounQin).

8.5.4

Fixed Parcel compatibility issue (by @git-sumitchaudhary).

8.5.3

Added more details to Unknown word error (by @hiepxanh).

Fixed types (by @romainmenke).

Fixed docs (by @catnipan).

8.5.2

Fixed end position of rules with semicolon (by @romainmenke).

8.5.1

Fixed backwards compatibility for complex cases (by @romainmenke).

8.5 “Duke Alloces”

PostCSS 8.5 brought API to work better with non-CSS sources like HTML, Vue.js/Svelte sources or CSS-in-JS.

@romainmenke during his work on Stylelint added Input#document in additional to Input#css.
root.source.input.document //=> "<p>Hello</p>
                           //    <style>
                           //    p {
                           //      color: green;
                           //    }
                           //    </style>"
root.source.input.css      //=> "p {
                           //      color: green;
                           //    }"
</tr></table>

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.10

Fixed XSS via unescaped </style> in non-bundler cases (by @TharVid).

8.5.9

Speed up source map encoding paring in case of the error.

8.5.8

Fixed Processor#version.

8.5.7

Improved source map annotation cleaning performance (by CodeAnt AI).

8.5.6

Fixed ContainerWithChildren type discriminating (by @Goodwine).

8.5.5

Fixed package.json→exports compatibility with some tools (by @JounQin).

8.5.4

Fixed Parcel compatibility issue (by @git-sumitchaudhary).

8.5.3

Added more details to Unknown word error (by @hiepxanh).

Fixed types (by @romainmenke).

Fixed docs (by @catnipan).

8.5.2

Fixed end position of rules with semicolon (by @romainmenke).

8.5.1

Fixed backwards compatibility for complex cases (by @romainmenke).

8.5 “Duke Alloces”

Added Input#document for sources like CSS-in-JS or HTML (by @romainmenke).

8.4.49

Fixed custom syntax without source.offset (by @romainmenke).

... (truncated)

Commits

33b9790 Release 8.5.10 version
536c79e Escape </style> in CSS output (#2074)
afa96b2 Update dependencies (#2073)
effe88b Typo (#2072)
3ee79a2 Thread model (#2071)
2e0683d Create incident response docs (#2070)
fe88ac2 Release 8.5.9 version
c551632 Avoid RegExp when we can use simple JS
89a6b74 Move SECURITY.txt for docs folder to keep GitHub page cleaner
6ceb8a4 Create SECURITY.md
Additional commits viewable in compare view

Updates @babel/runtime from 7.24.7 to 7.29.2

Release notes

Sourced from @babel/runtime's releases.

v7.29.2 (2026-03-16)

👓 Spec Compliance

babel-parser

#17840 [7.x backport] async x => {} must be in leading pos (@JLHwung)

🐛 Bug Fix

babel-helpers, babel-plugin-transform-async-generator-functions, babel-preset-env, babel-runtime-corejs3

#17805 [7.x backport] fix: Properly handle await in finally (@liuxingbaoyu)

babel-preset-env

#17789 [7.x backport] preset-env include/exclude should accept bugfix plugins (@JLHwung)

...
Description has been truncated

Bumps the npm_and_yarn group with 15 updates in the /website3.0 directory: | Package | From | To | | --- | --- | --- | | [axios](https://github.com/axios/axios) | `1.7.4` | `1.15.0` | | [mongoose](https://github.com/Automattic/mongoose) | `8.4.4` | `8.9.5` | | [next](https://github.com/vercel/next.js) | `14.2.12` | `16.2.4` | | [next-auth](https://github.com/nextauthjs/next-auth) | `4.24.7` | `4.24.12` | | [nodemailer](https://github.com/nodemailer/nodemailer) | `6.9.14` | `8.0.5` | | [postcss](https://github.com/postcss/postcss) | `8.4.39` | `8.5.10` | | [@babel/runtime](https://github.com/babel/babel/tree/HEAD/packages/babel-runtime) | `7.24.7` | `7.29.2` | | [ajv](https://github.com/ajv-validator/ajv) | `6.12.6` | `6.15.0` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.11` | `1.1.14` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `2.0.1` | `2.1.0` | | [cross-spawn](https://github.com/moxystudio/node-cross-spawn) | `7.0.3` | `7.0.6` | | [minimatch](https://github.com/isaacs/minimatch) | `3.1.2` | `3.1.5` | | [minimatch](https://github.com/isaacs/minimatch) | `9.0.4` | `9.0.9` | | [glob](https://github.com/isaacs/node-glob) | `10.4.1` | `10.5.0` | | [jws](https://github.com/brianloveswords/node-jws) | `3.2.2` | `3.2.3` | | [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.18.1` | | [picomatch](https://github.com/micromatch/picomatch) | `2.3.1` | `2.3.2` | Updates `axios` from 1.7.4 to 1.15.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.7.4...v1.15.0) Updates `mongoose` from 8.4.4 to 8.9.5 - [Release notes](https://github.com/Automattic/mongoose/releases) - [Changelog](https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md) - [Commits](Automattic/mongoose@8.4.4...8.9.5) Updates `next` from 14.2.12 to 16.2.4 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v14.2.12...v16.2.4) Updates `next-auth` from 4.24.7 to 4.24.12 - [Release notes](https://github.com/nextauthjs/next-auth/releases) - [Commits](https://github.com/nextauthjs/next-auth/compare/next-auth@4.24.7...next-auth@4.24.12) Updates `nodemailer` from 6.9.14 to 8.0.5 - [Release notes](https://github.com/nodemailer/nodemailer/releases) - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](nodemailer/nodemailer@v6.9.14...v8.0.5) Updates `postcss` from 8.4.39 to 8.5.10 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.4.39...8.5.10) Updates `@babel/runtime` from 7.24.7 to 7.29.2 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.2/packages/babel-runtime) Updates `ajv` from 6.12.6 to 6.15.0 - [Release notes](https://github.com/ajv-validator/ajv/releases) - [Commits](ajv-validator/ajv@v6.12.6...v6.15.0) Updates `brace-expansion` from 1.1.11 to 1.1.14 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@1.1.11...v1.1.14) Updates `brace-expansion` from 2.0.1 to 2.1.0 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@1.1.11...v1.1.14) Updates `cookie` from 0.5.0 to 0.7.2 - [Release notes](https://github.com/jshttp/cookie/releases) - [Commits](jshttp/cookie@v0.5.0...v0.7.2) Updates `cross-spawn` from 7.0.3 to 7.0.6 - [Changelog](https://github.com/moxystudio/node-cross-spawn/blob/master/CHANGELOG.md) - [Commits](moxystudio/node-cross-spawn@v7.0.3...v7.0.6) Updates `minimatch` from 3.1.2 to 3.1.5 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v3.1.2...v3.1.5) Updates `minimatch` from 9.0.4 to 9.0.9 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v3.1.2...v3.1.5) Updates `follow-redirects` from 1.15.6 to 1.16.0 - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.15.6...v1.16.0) Updates `glob` from 10.4.1 to 10.5.0 - [Changelog](https://github.com/isaacs/node-glob/blob/main/changelog.md) - [Commits](isaacs/node-glob@v10.4.1...v10.5.0) Updates `jws` from 3.2.2 to 3.2.3 - [Release notes](https://github.com/brianloveswords/node-jws/releases) - [Changelog](https://github.com/auth0/node-jws/blob/master/CHANGELOG.md) - [Commits](auth0/node-jws@v3.2.2...v3.2.3) Updates `lodash` from 4.17.21 to 4.18.1 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.18.1) Updates `nanoid` from 3.3.7 to 3.3.11 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](ai/nanoid@3.3.7...3.3.11) Updates `picomatch` from 2.3.1 to 2.3.2 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@2.3.1...2.3.2) --- updated-dependencies: - dependency-name: axios dependency-version: 1.15.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: mongoose dependency-version: 8.9.5 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 16.2.4 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next-auth dependency-version: 4.24.12 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: nodemailer dependency-version: 8.0.5 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.10 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: "@babel/runtime" dependency-version: 7.29.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ajv dependency-version: 6.15.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.14 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 2.1.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: cookie dependency-version: 0.7.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: cross-spawn dependency-version: 7.0.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: minimatch dependency-version: 3.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: minimatch dependency-version: 9.0.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: follow-redirects dependency-version: 1.16.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: glob dependency-version: 10.5.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: jws dependency-version: 3.2.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.18.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: nanoid dependency-version: 3.3.11 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 2.3.2 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

vercel · 2026-04-24T16:37:43Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
helpops-hub2	Error		Apr 24, 2026 4:37pm

github-actions

Thank you, dependabot[bot], for creating this pull request and contributing to HelpOps-Hub! 💗

The maintainers will review this Pull Request and provide feedback as soon as possible! 😇

We appreciate your patience and contribution, Keep up the great work! 😀

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 24, 2026

vercel Bot had a problem deploying to Preview April 24, 2026 16:37 Failure

github-actions Bot reviewed Apr 24, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump the npm_and_yarn group across 1 directory with 18 updates#1502

Bump the npm_and_yarn group across 1 directory with 18 updates#1502
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/website3.0/npm_and_yarn-ee2a433461

dependabot Bot commented on behalf of github Apr 24, 2026

Uh oh!

vercel Bot commented Apr 24, 2026 •

edited

Loading

Uh oh!

github-actions Bot left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Apr 24, 2026

v1.15.0

⚠️ Important Changes

🔒 Security Fixes

🚀 New Features

🔧 Maintenance & Chores

🌟 New Contributors

v1.14.0

⚠️ Important Changes

🚀 New Features

🐛 Bug Fixes

v1.15.0 - April 7, 2026

🔒 Security Fixes

🚀 New Features

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

v1.14.0 - March 27, 2026

🔒 Security Fixes

🐛 Bug Fixes

8.9.5 / 2025-01-13

8.9.4 / 2025-01-09

8.9.3 / 2024-12-30

8.9.2 / 2024-12-19

8.9.1 / 2024-12-16

8.9.0 / 2024-12-13

8.9.5 / 2025-01-13

7.8.4 / 2025-01-13

6.13.6 / 2025-01-13

8.9.4 / 2025-01-09

8.9.3 / 2024-12-30

8.9.2 / 2024-12-19

8.9.1 / 2024-12-16

v16.2.4

Core Changes

Credits

v16.2.3

Core Changes

Credits

v16.2.2

Core Changes

v8.0.5

8.0.5 (2026-04-07)

Bug Fixes

v8.0.4

8.0.4 (2026-03-25)

Bug Fixes

v8.0.3

8.0.3 (2026-03-18)

Bug Fixes

v8.0.2

8.0.2 (2026-03-09)

Bug Fixes

v8.0.1

8.0.1 (2026-02-07)

Bug Fixes

v8.0.0

8.0.0 (2026-02-04)

8.0.5 (2026-04-07)

Bug Fixes

8.0.4 (2026-03-25)

Bug Fixes

8.0.3 (2026-03-18)

Bug Fixes

8.0.2 (2026-03-09)

Bug Fixes

8.0.1 (2026-02-07)

Bug Fixes

8.0.0 (2026-02-04)

⚠ BREAKING CHANGES

Bug Fixes

8.5.10

8.5.9

8.5.8

8.5.7

8.5.6

8.5.5

8.5.4

vercel Bot commented Apr 24, 2026 •

edited

Loading