Skip to content

build(deps): bump the npm_and_yarn group across 1 directory with 14 updates - #4141

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/docs.openc3.com/npm_and_yarn-6f9dc630db
Open

build(deps): bump the npm_and_yarn group across 1 directory with 14 updates#4141
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/docs.openc3.com/npm_and_yarn-6f9dc630db

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 23, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 14 updates in the /docs.openc3.com directory:

Package From To
@swc/html 1.15.40 1.16.20
body-parser 1.20.5 1.20.9
brace-expansion 1.1.15 1.1.21
http-proxy-middleware 2.0.9 2.0.10
image-size 2.0.2 2.0.4
joi 17.13.3 17.13.8
js-yaml 4.1.1 4.3.2
launch-editor 2.13.2 2.14.2
postcss 8.5.15 8.5.31
qs 6.15.2 6.15.3
shell-quote 1.8.4 1.12.0
undici 7.24.7 7.30.1
webpack-dev-server 5.2.4 5.2.7
websocket-driver 0.7.4 0.7.5

Updates @swc/html from 1.15.40 to 1.16.20

Changelog

Sourced from @​swc/html's changelog.

[1.16.20] - 2026-10-22

Bug Fixes

  • (es/codegen) Disambiguate TSX generic arrows (#12505) (2c9d198)

  • (es/codegen) Preserve non-null token boundaries (#12504) (410ae3a)

  • (es/codegen) Parenthesize typed arrow parameters (#12503) (aa1ffd6)

  • (es/codegen) Preserve TypeScript token boundaries (#12523) (9f36ae0)

  • (es/codegen) Emit space after div if rhs starts with a regex (#12544) (dddf716)

  • (es/codegen) Preserve optional call type arguments (#12549) (f7bef4d)

  • (es/compat) Scope private access modes to each member (#12526) (c0e3fa1)

  • (es/fixer) Preserve TypeScript expression grouping (#12518) (b9d3f8f)

  • (es/fixer) Preserve TypeScript operand grouping (#12539) (7c4a214)

  • (es/fixer) Avoid panicking on recovered parenthesized assignment targets (#12551) (ec34371)

  • (es/fixer) Preserve optional chain boundaries (#12550) (01d5630)

  • (es/fixer) Wrap function declarations in sloppy-mode loop bodies (#12567) (76ff943)

  • (es/minifier) Bound literal expressions copied by the sequential inliner (#12521) (60c700f)

  • (es/minifier) Preserve rest array identity when its reference runs more than once (#12546) (4768dbe)

  • (es/minifier) Keep trimLeft and trimRight on string literals (#12574) (663ffb0)

... (truncated)

Commits
  • 566c595 chore: Publish 1.16.20 with swc_core v82.2.0
  • 196ac57 chore: Publish 1.16.20-nightly-20261022.1 with swc_core v82.2.0
  • 6d71046 chore: Publish 1.16.19-nightly-20261015.1 with swc_core v82.1.1
  • 63ced3b chore: Publish 1.16.18 with swc_core v82.0.2
  • ff4257e chore: Publish 1.16.18-nightly-20261011.1 with swc_core v82.0.2
  • d2bfb94 chore: Publish 1.16.17 with swc_core v82.0.1
  • 5274627 chore: Publish 1.16.17-nightly-20261011.1 with swc_core v82.0.1
  • f8269e6 chore: Publish 1.16.16-nightly-20261007.1 with swc_core v82.0.0
  • 3e034f2 chore: Publish 1.16.15-nightly-20261007.1 with swc_core v82.0.0
  • d6b897c chore: Publish 1.16.14-nightly-20261006.1 with swc_core v82.0.0
  • Additional commits viewable in compare view

Updates body-parser from 1.20.5 to 1.20.9

Release notes

Sourced from body-parser's releases.

1.20.9

Important: Security

What's Changed

Full Changelog: expressjs/body-parser@1.20.8...1.20.9

1.20.8

Important

Same code base as 1.20.7. This was created to test the new release process.

What's Changed

Full Changelog: expressjs/body-parser@1.20.7...1.20.8

1.20.7

What's Changed

Full Changelog: expressjs/body-parser@1.20.6...1.20.7

1.20.6

Important: Security

What's Changed

Full Changelog: expressjs/body-parser@1.20.5...1.20.6

Changelog

Sourced from body-parser's changelog.

1.20.9

1.20.8

  • Same code base as 1.20.7. This was created to test the new release process.

1.20.7

  • deps: qs@~6.16.0

1.20.6

  • Security fix for GHSA-v422-hmwv-36x6
  • fix: improve limit option validation (#698)
    • Invalid limit values (e.g. unparseable strings or NaN) now throw instead of being silently ignored, which previously disabled size limit enforcement
    • null and undefined fall back to the default 100kb limit
Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for body-parser since your current version.


Updates brace-expansion from 1.1.15 to 1.1.21

Commits

Updates http-proxy-middleware from 2.0.9 to 2.0.10

Release notes

Sourced from http-proxy-middleware's releases.

v2.0.10

What's Changed

New Contributors

Full Changelog: chimurai/http-proxy-middleware@v2.0.9...v2.0.10

v2.0.10-beta.0

What's Changed

New Contributors

Full Changelog: chimurai/http-proxy-middleware@v2.0.9...v2.0.10-beta.0

Changelog

Sourced from http-proxy-middleware's changelog.

v2.0.10

  • fix(router): harden proxy-table matching (exact host for host+path keys, prefix-only path matching) to prevent routing bypass
Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for http-proxy-middleware since your current version.


Updates image-size from 2.0.2 to 2.0.4

Commits

Updates joi from 17.13.3 to 17.13.8

Commits

Updates js-yaml from 4.1.1 to 4.3.2

Changelog

Sourced from js-yaml's changelog.

4.3.2 - 2026-08-26

Changed

  • [backport] Hard-limit merge sequence size to 100.

Security

  • [backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

4.3.1 - 2026-07-31

Security

  • [backport] Remove quadratic complexity from !!omap duplicate key detection.

4.3.0 - 2026-06-27

Added

  • [backport] Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.

Fixed

  • Restore umd builds back to es5.

Removed

  • [backport] maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

[4.2.0] - 2026-06-01

Added

  • Added docs/safety.md with notes about processing untrusted YAML.
  • Added maxDepth (100) loader option. Not a problem, but gives a better exception instead of RangeError on stack overflow.
  • Added maxMergeSeqLength (20) loader option. Not a problem after merge fix, but an additional restriction for safety.
  • Added sourcemaps to dist/ builds.

Changed

  • Stop resolving numbers with underscores as numeric scalars, #627.
  • Switched dev toolchains to Vite / neostandard.
  • Updated demo.
  • Reorganized tests.
  • dist/ files are no longer kept in the repository.

Fixed

  • Fix parsing of properties on the first implicit block mapping key, #62.
  • Fix trailing whitespace handling when folding flow scalar lines, #307.
  • Reject top-level block scalars without content indentation, #280.
  • Ensure numbers survive round-trip, #737.
  • Fix test coverage for issue #221.
  • Fix flow scalar trailing whitespace folding, #307.

... (truncated)

Commits
  • 79ca68d 4.3.2 released
  • d90b661 Backport merge limits from v5.4.1
  • 86e91b8 4.3.1 released
  • c3cc4b0 Backport quadratic complexity fix for !!omap
  • 33d05b5 4.3.0 released
  • 663bfab Drop demo publish, to not override new v5 one.
  • 1cb8c7b Add v4-legacy tag for publish
  • 02f27af Restore umd builds back to es5
  • 8be84ed Fix es5 compatibility
  • 59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
  • Additional commits viewable in compare view

Updates launch-editor from 2.13.2 to 2.14.2

Commits
  • b533489 v2.14.2
  • f13cd83 fix: check file existence after path resolution (#157)
  • f6e6701 fix: ensure filenames passed to editors are not considered as flags (#156)
  • 3c2f9bf fix: reject paths containing % on windows (#155)
  • ecdfce1 refactor: extract constructWindowsLaunchCommand (#154)
  • 24d5d84 fix: correctly show error when the third parameter is not passed (#153)
  • 7bae9bc refactor: merge statements
  • 571fe00 chore(deps): update actions/setup-node action to v7 (#149)
  • d8ed423 chore(deps): update actions/checkout action to v7 (#148)
  • 75b3e6c fix(deps): update all non-major dependencies (#146)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for launch-editor since your current version.


Updates postcss from 8.5.15 to 8.5.31

Release notes

Sourced from postcss's releases.

8.5.31

8.5.30

  • Fix broken map on </style> escaping (by @​Rufflet).

8.5.29

8.5.28

  • Fixes types regression.

8.5.27

8.5.26

  • Fixed list.split() regression (by @​lazerg).
  • Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

  • Fixed 8.5.17 visitor regression.
  • Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

  • Preserve the BOM after the processing (by @​hdimer).

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

8.5.19

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.31

8.5.30

  • Fix broken map on </style> escaping (by @​Rufflet).

8.5.29

8.5.28

  • Fixes types regression.

8.5.27

8.5.26

  • Fixed list.split() regression (by @​lazerg).
  • Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

  • Fixed 8.5.17 visitor regression.
  • Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

  • Preserve the BOM after the processing (by @​hdimer).

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.


Updates qs from 6.15.2 to 6.15.3

Changelog

Sourced from qs's changelog.

6.15.3

  • [Fix] parse: enforce throwOnLimitExceeded for cumulative array growth via combine/merge
  • [Fix] utils: respect encoding of surrogate pairs across chunks (#559)
  • [Robustness] parse: throw the arrayLimit error before splitting oversized comma values
  • [Robustness] utils.merge / utils.assign: avoid invoking __proto__ setter when copying own properties
  • [Robustness] utils: enforce arrayLimit consistently across merge's array paths
  • [Perf] utils: make compact O(n) via a side-channel visited-set instead of Array.indexOf
  • [Deps] update side-channel
  • [Dev Deps] update eslint, mock-property, tape
  • [Tests] parse: characterize current lenient handling of unbalanced bracket keys (#558)
Commits
  • 18d085e v6.15.3
  • c38af42 [Deps] update side-channel
  • adce539 [Dev Deps] update eslint, mock-property, tape
  • 74a0f6a [Robustness] utils: enforce arrayLimit consistently across merge's arra...
  • f4938f5 [Tests] parse: characterize current lenient handling of unbalanced bracket ...
  • 5d5f723 [Perf] utils: make compact O(n) via a side-channel visited-set instead of...
  • 52afe00 [Robustness] parse: throw the arrayLimit error before splitting oversized...
  • 963e538 [Fix] parse: enforce throwOnLimitExceeded for cumulative array growth via...
  • 59da434 [Fix] utils: respect encoding of surrogate pairs across chunks
  • 9532969 [Robustness] utils.merge / utils.assign: avoid invoking __proto__ sette...
  • See full diff in compare view

Updates shell-quote from 1.8.4 to 1.12.0

Changelog

Sourced from shell-quote's changelog.

v1.12.0 - 2026-10-02

Fixed

Commits

  • [New] parse: support tab-stripping here-documents (&lt;&lt;-) dbfac37
  • [New] parse: support output process substitution (&gt;() 2053315
  • [New] parse: support the case test-next terminator (;;&) 7d688b9
  • [New] parse: support the case fall-through terminator (;&) f27010e
  • [New] parse: support redirecting output despite noclobber (&gt;|) b78d19c
  • [New] parse: support opening a file for reading and writing (&lt;&gt;) 21cc333
  • [New] parse: support redirecting stdout and stderr (&&gt;) 6ad6cd2
  • [New] parse: support appending stdout and stderr (&&gt;&gt;) 90cde9c
  • [Dev Deps] update @ljharb/eslint-config 3a7b4ae

v1.11.0 - 2026-09-29

Fixed

Commits

  • [Fix] quote: reject line terminators in tokens after a comment 6002b2e
  • [Fix] parse: preserve text after special shell parameters 81b08a5
  • [Fix] parse: an escaped backslash does not escape the character after it d708019
  • [Fix] quote: preserve ! in arguments that also contain ' ad39927
  • [Fix] parse: treat $_name as a variable name, not $_ followed by text 28f88cd
  • [Fix] quote: preserve empty glob patterns 35c9b97
  • [Fix] quote: escape ~ in glob patterns to prevent shell tilde-expansion 239d49c
  • [Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint, evalmd b1e406e
  • [meta] npmignore some files ebfc308
  • [actions] add permissions 3429b0d
  • [actions] set least-privilege cache-mode 36f2394
  • [Dev Deps] update eslint 6de9a41

v1.10.0 - 2026-07-10

Merged

Commits

  • [Fix] parse: match nested ${...} braces so nested parameter expansion is consumed as one substitution c0842c8
  • [Tests] parse: pin single-quote literalness and unmatched-quote handling a0d03e3

... (truncated)

Commits
  • 6ecb8aa v1.12.0
  • 3a7b4ae [Dev Deps] update @ljharb/eslint-config
  • 7d688b9 [New] parse: support the case test-next terminator (;;&)
  • f27010e [New] parse: support the case fall-through terminator (;&)
  • 90cde9c [New] parse: support appending stdout and stderr (&>>)
  • 6ad6cd2 [New] parse: support redirecting stdout and stderr (&>)
  • 2053315 [New] parse: support output process substitution (>()
  • b78d19c [New] parse: support redirecting output despite noclobber (>|)
  • 21cc333 [New] parse: support opening a file for reading and writing (\<>)
  • dbfac37 [New] parse: support tab-stripping here-documents (<<-)
  • Additional commits viewable in compare view

Updates undici from 7.24.7 to 7.30.1

Release notes

Sourced from undici's releases.

v7.30.1

Security fixes

High severity

Denial of service via TLS 1.2 certificate-changing renegotiation

CVE-2026-87018 · GHSA-qrxm-fqhp-jwvm

A malicious or compromised HTTPS server could crash the Node.js process by initiating TLS 1.2 renegotiation and presenting a different, CA-trusted certificate whose hostname did not match the requested host. The resulting socket error reached an assertion in undici's HTTP/1.1 and HTTP/2 connection handling. This release handles post-connect certificate errors without terminating the process.

TLS certificate validation bypass through dropped Agent options

CVE-2026-109383 · GHSA-2m5v-pch6-74hx

Agent used a JSON-based clone for constructor options, which silently removed function-valued TLS options such as checkServerIdentity. Applications relying on custom certificate or public-key verification could therefore accept a certificate that the callback was intended to reject. This release preserves TLS options when creating per-origin dispatchers.

Cache poisoning and cross-user disclosure through cross-origin redirects

CVE-2026-109829 · GHSA-4w7w-5xrc-9h26

When an originless Agent combined redirect and shared-cache interceptors as compose(redirect(), cache()), a response from a cross-origin redirect could be stored under the original URL. This could allow persistent cache poisoning or disclosure of user-specific responses to later callers. This release verifies the response origin before caching and preserves redirect-hop cache-control policy.

Denial of service through excessive Content-Encoding values

CVE-2026-109869 · GHSA-xjj6-f33q-929c

A malicious HTTP server could crash the Node.js process by returning more than five content codings and closing the connection before sending the body. Although fetch() rejected the response, an error from an orphaned internal stream could remain unhandled. This release validates the content-encoding chain before creating the body stream and aborts oversized chains safely.

Medium severity

Denial of service through the decompress interceptor

CVE-2026-87029 · GHSA-55wc-3pg8-jfw6

An exception thrown by a downstream response handler from an asynchronous decompression callback could escape as an uncaught exception. A server could trigger this when decompress was composed with a handler such as dump with a size limit. This release converts downstream handler exceptions into per-request errors.

Subresource Integrity bypass with non-lowercase algorithm tokens

CVE-2026-109841 · GHSA-f72v-6w45-q472

fetch() treated valid mixed-case or uppercase SRI algorithm tokens, such as SHA256, as unknown and could accept a response whose body did not match the configured digest. This release normalizes algorithm tokens before validation and digest selection.

Denial of service through unbounded EventSource parser state

CVE-2026-109924 · GHSA-4qv8-2p9j-2685

A malicious Server-Sent Events endpoint could exhaust process memory by sending many tiny data: fields without completing an event, or by splitting an unfinished line across many chunks. This release bounds retained EventSource parser state, including field counts, buffered chunks, unfinished-line length, and retained field data.

Denial of service through unbounded automatic WebSocket PONG buffering

... (truncated)

Commits
  • 7507102 Bumped v7.30.1 (#6022)
  • 7d60c7b [v7.x] fix(cookies): backport #5663, #5808 and #5832 (#6019)
  • 0227d5d fix: avoid unbounded recursion in Set-Cookie attribute parser (#5757) (#5997)
  • 5394462 fix(websocket): bound automatic PONG writes under backpressure
  • 2991627 fix(eventsource): bound retained SSE parser state
  • 18bc8a1 fix(sri): accept non-lowercase algorithm tokens
  • 63cba77 fix(decompress): converge downstream handler throws to per-request errors
  • 07ded49 fix(fetch): abort excessive content encoding responses
  • b20b82a fix(cache): prevent cross-origin redirect cache confusion
  • 04cb74b fix: preserve Agent connection options
  • Additional commits viewable in compare view

Updates webpack-dev-server from 5.2.4 to 5.2.7

Release notes

Sourced from webpack-dev-server's releases.

v5.2.7

Patch Changes

  • Validate the Host and Origin headers and enforce same-origin checks on WebSocket upgrade requests handled by proxies with ws: true. This prevents cross-origin pages from connecting to proxied WebSocket services through the development server. (by @​github-actions in #5766)

  • Validate Host and HTTP/2 authority headers independently of Origin protocol exceptions, including when allowedHosts is "all". Handle malformed open-editor URLs with a controlled response and parse their query without relying on the Host header. (by @​bjohansebas in #5772)

v5.2.6

Patch Changes

  • fix: allow undefined as the Server constructor options argument again (by @​bjohansebas in #5695)

    Restores accepting undefined (defaulting it to {}) for the options argument, so passing a webpack config's optional devServer field type-checks and works as before.

  • Protect the built-in state-changing routes (/webpack-dev-server/invalidate and /webpack-dev-server/open-editor) against cross-site request forgery. Requests are now checked with Sec-Fetch-Site (falling back to an Origin/Host comparison when it is absent), so a cross-site page can no longer trigger a rebuild or open a file in the editor. Same-origin requests, user-initiated navigations, and non-browser clients (e.g. curl) are unaffected. (by @​bjohansebas in #5698)

  • Handle malformed Host and Origin header values gracefully when validating requests. (by @​bjohansebas in #5699)

v5.2.5

Patch Changes

  • Skip the HMR WebSocket path when forwarding upgrade requests to user-defined proxies, so custom proxy WebSocket upgrades are no longer intercepted by the dev server. (by @​bjohansebas in #5680)
Changelog

Sourced from webpack-dev-server's changelog.

5.2.7

Patch Changes

  • Validate the Host and Origin headers and enforce same-origin checks on WebSocket upgrade requests handled by proxies with ws: true. This prevents cross-origin pages from connecting to proxied WebSocket services through the development server. (by @​github-actions in #5766)

  • Validate Host and HTTP/2 authority headers independently of Origin protocol exceptions, including when allowedHosts is "all". Handle malformed open-editor URLs with a controlled response and parse their query without relying on the Host header. (by @​bjohansebas in #5772)

5.2.6

Patch Changes

  • fix: allow undefined as the Server constructor options argument again (by @​bjohansebas in #5695)

    Restores accepting undefined (defaulting it to {}) for the options argument, so passing a webpack config's optional devServer field type-checks and works as before.

  • Protect the built-in state-changing routes (/webpack-dev-server/invalidate and /webpack-dev-server/open-editorDescription has been truncated

@dependabot
build(deps): bump the npm_and_yarn group across 1 directory with 14 u…
1c4dd42 
…pdates

Bumps the npm_and_yarn group with 14 updates in the /docs.openc3.com directory:

| Package | From | To |
| --- | --- | --- |
| [@swc/html](https://github.com/swc-project/swc/tree/HEAD/packages/html) | `1.15.40` | `1.16.20` |
| [body-parser](https://github.com/expressjs/body-parser) | `1.20.5` | `1.20.9` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.15` | `1.1.21` |
| [http-proxy-middleware](https://github.com/chimurai/http-proxy-middleware) | `2.0.9` | `2.0.10` |
| [image-size](https://github.com/image-size/image-size) | `2.0.2` | `2.0.4` |
| [joi](https://github.com/hapijs/joi) | `17.13.3` | `17.13.8` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.1` | `4.3.2` |
| [launch-editor](https://github.com/vitejs/launch-editor) | `2.13.2` | `2.14.2` |
| [postcss](https://github.com/postcss/postcss) | `8.5.15` | `8.5.31` |
| [qs](https://github.com/ljharb/qs) | `6.15.2` | `6.15.3` |
| [shell-quote](https://github.com/ljharb/shell-quote) | `1.8.4` | `1.12.0` |
| [undici](https://github.com/nodejs/undici) | `7.24.7` | `7.30.1` |
| [webpack-dev-server](https://github.com/webpack/webpack-dev-server) | `5.2.4` | `5.2.7` |
| [websocket-driver](https://github.com/faye/websocket-driver-node) | `0.7.4` | `0.7.5` |



Updates `@swc/html` from 1.15.40 to 1.16.20
- [Release notes](https://github.com/swc-project/swc/releases)
- [Changelog](https://github.com/swc-project/swc/blob/main/CHANGELOG.md)
- [Commits](https://github.com/swc-project/swc/commits/v1.16.20/packages/html)

Updates `body-parser` from 1.20.5 to 1.20.9
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/1.20.9/HISTORY.md)
- [Commits](expressjs/body-parser@1.20.5...1.20.9)

Updates `brace-expansion` from 1.1.15 to 1.1.21
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.15...v1.1.21)

Updates `http-proxy-middleware` from 2.0.9 to 2.0.10
- [Release notes](https://github.com/chimurai/http-proxy-middleware/releases)
- [Changelog](https://github.com/chimurai/http-proxy-middleware/blob/v2.0.10/CHANGELOG.md)
- [Commits](chimurai/http-proxy-middleware@v2.0.9...v2.0.10)

Updates `image-size` from 2.0.2 to 2.0.4
- [Release notes](https://github.com/image-size/image-size/releases)
- [Commits](https://github.com/image-size/image-size/commits)

Updates `joi` from 17.13.3 to 17.13.8
- [Commits](hapijs/joi@v17.13.3...v17.13.8)

Updates `js-yaml` from 4.1.1 to 4.3.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.1...4.3.2)

Updates `launch-editor` from 2.13.2 to 2.14.2
- [Commits](vitejs/launch-editor@v2.13.2...v2.14.2)

Updates `postcss` from 8.5.15 to 8.5.31
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.15...8.5.31)

Updates `qs` from 6.15.2 to 6.15.3
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.15.2...v6.15.3)

Updates `shell-quote` from 1.8.4 to 1.12.0
- [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md)
- [Commits](ljharb/shell-quote@v1.8.4...v1.12.0)

Updates `undici` from 7.24.7 to 7.30.1
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.24.7...v7.30.1)

Updates `webpack-dev-server` from 5.2.4 to 5.2.7
- [Release notes](https://github.com/webpack/webpack-dev-server/releases)
- [Changelog](https://github.com/webpack/webpack-dev-server/blob/v5.2.7/CHANGELOG.md)
- [Commits](webpack/webpack-dev-server@v5.2.4...v5.2.7)

Updates `websocket-driver` from 0.7.4 to 0.7.5
- [Changelog](https://github.com/faye/websocket-driver-node/blob/main/CHANGELOG.md)
- [Commits](faye/websocket-driver-node@0.7.4...0.7.5)

---
updated-dependencies:
- dependency-name: "@swc/html"
  dependency-version: 1.16.20
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: body-parser
  dependency-version: 1.20.9
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 1.1.21
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: http-proxy-middleware
  dependency-version: 2.0.10
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: image-size
  dependency-version: 2.0.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: joi
  dependency-version: 17.13.8
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 4.3.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: launch-editor
  dependency-version: 2.14.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: postcss
  dependency-version: 8.5.31
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.15.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: shell-quote
  dependency-version: 1.12.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 7.30.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: webpack-dev-server
  dependency-version: 5.2.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: websocket-driver
  dependency-version: 0.7.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Oct 23, 2026
@dependabot dependabot Bot mentioned this pull request Oct 23, 2026
Closed
@coderabbitai

coderabbitai Bot commented Oct 23, 2026

Copy link
Copy Markdown

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters: 1
  • docs.openc3.com/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: a48a867d-f3eb-4893-aa81-6a7533fe6c0d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

@sonarqubecloud

sonarqubecloud Bot commented Oct 23, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants