Skip to content

Bump the npm_and_yarn group across 1 directory with 7 updates - #221

Merged
joewyz merged 1 commit into
mainfrom
dependabot/npm_and_yarn/tutorials/full-stack-application/app/npm_and_yarn-30cda002b9
Nov 11, 2026
Merged

Bump the npm_and_yarn group across 1 directory with 7 updates#221
joewyz merged 1 commit into
mainfrom
dependabot/npm_and_yarn/tutorials/full-stack-application/app/npm_and_yarn-30cda002b9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 11, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 7 updates in the /tutorials/full-stack-application/app directory:

Package From To
next 15.5.21 15.5.28
brace-expansion 1.1.11 1.1.22
js-yaml 4.3.0 4.3.2
minimatch 3.1.2 3.1.5
nanoid 3.3.17 3.3.20
postcss-selector-parser 6.1.0 6.1.6
sharp 0.34.5 0.35.5

Updates next from 15.5.21 to 15.5.28

Release notes

Sourced from next's releases.

v15.5.28

This release contains security fixes for the following advisories:

Critical:

High:

v15.5.27

This release contains security fixes for the following advisories:

Medium:

v15.5.26

This release contains additional security hardening for next/og. For more information, check out https://nextjs.org/blog/nextjs-security-update-september-22-2026

Commits
  • 195cd6a v15.5.28
  • 1b53604 [cd] Allow branch to get published
  • 5e3b687 [lts-maintenance][next/image] Bump sharp (#232)
  • a2021b3 [lts-maintenance][react] Improve Server Component transport protocol (#194)
  • a836b53 [lts-maintenance] Fix google tag manager e2e test, assume GTM 200s instead of...
  • 9c1c1b1 [lts-maintenance][ci] Wire preview builds variables consistently (#99325)
  • def7eff v15.5.27
  • 52c94ab [lts-maintenance] Scope response cache keys to their source route (#219)
  • 785f4c2 [lts-maintenance] Match Next data paths case-sensitively (#197)
  • 7217d63 [lts-maintenance][webpack] Ensure dynamicParams is respected in `opengraph-...
  • Additional commits viewable in compare view

Updates brace-expansion from 1.1.11 to 1.1.22

Release notes

Sourced from brace-expansion's releases.

v1.1.15

  • Backport v5.0.6 change to v1 (#111) 0b09384

juliangruber/brace-expansion@v1.1.14...v1.1.15

v1.1.12

  • pkg: publish on tag 1.x c460dbd
  • fmt ccb8ac6
  • Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) c3c73c8

juliangruber/brace-expansion@v1.1.11...v1.1.12

Commits

Updates js-yaml from 4.3.0 to 4.3.2

Changelog

Sourced from js-yaml's changelog.

4.3.2 - 2026-08-26

Changed

  • [backport] Hard-limit merge sequence size to 100.

Security

  • [backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

4.3.1 - 2026-07-31

Security

  • [backport] Remove quadratic complexity from !!omap duplicate key detection.
Commits

Updates minimatch from 3.1.2 to 3.1.5

Commits

Updates nanoid from 3.3.17 to 3.3.20

Release notes

Sourced from nanoid's releases.

3.3.20

3.3.19

  • Fixed killing the app by setting huge user ID.

3.3.18

Changelog

Sourced from nanoid's changelog.

3.3.20

3.3.19

3.3.18

Commits

Updates postcss-selector-parser from 6.1.0 to 6.1.6

Release notes

Sourced from postcss-selector-parser's releases.

6.1.6

  • fix: parse selectors in linear time on four more kinds of crafted input, closing a CPU exhaustion vulnerability (reported by @​zachariah-mithani)
  • chore: replace the cssesc dependency with an internal copy, whose redundant space removal is linear

6.1.5

The 6.x line is now in security-only maintenance

This release exists because the advisory above covers every published 6.x version, and until now the only remediation on offer was an upgrade to 7.x. 6.1.5 is the patched version for the 6.x line.

The line is kept alive for the installed base that cannot move to 7 yet, Tailwind CSS 3 in particular, which depends on ^6.1.2. From here on it receives security fixes only: no features, no other bug fixes, no type changes. Everything else goes to 7.x, where this package is actively developed. Tailwind CSS 4 no longer depends on this package at all, so this line is expected to retire on its own.

6.1.5 is published under the legacy-v6 npm dist-tag, so npm install postcss-selector-parser keeps resolving to 7.x. Existing ^6 ranges pick up 6.1.5 as usual.

6.1.4

  • fix: tolerate non-node children when serializing selectors

6.1.3

v6.1.2

6.1.2

  • Fixed: erroneous trailing combinators in pseudos

v6.1.1

6.1.1

  • Fixed: improve typings of constructor helpers (#292)
Changelog

Sourced from postcss-selector-parser's changelog.

6.1.6 - 2026-11-08

  • fix: parse selectors in linear time on four more kinds of crafted input, closing a CPU exhaustion vulnerability (reported by @​zachariah-mithani)
  • chore: replace the cssesc dependency with an internal copy, whose redundant space removal is linear

6.1.5 - 2026-10-19

The 6.x line is now in security-only maintenance

This release exists because the advisory above covers every published 6.x version, and until now the only remediation on offer was an upgrade to 7.x. 6.1.5 is the patched version for the 6.x line.

The line is kept alive for the installed base that cannot move to 7 yet, Tailwind CSS 3 in particular, which depends on ^6.1.2. From here on it receives security fixes only: no features, no other bug fixes, no type changes. Everything else goes to 7.x, where this package is actively developed. Tailwind CSS 4 no longer depends on this package at all, so this line is expected to retire on its own.

6.1.5 is published under the legacy-v6 npm dist-tag, so npm install postcss-selector-parser keeps resolving to 7.x. Existing ^6 ranges pick up 6.1.5 as usual.

6.1.4 - 2026-06-11

  • fix: tolerate non-node children when serializing selectors

6.1.3 - 2026-06-11

6.1.2

  • Fixed: erroneous trailing combinators in pseudos

6.1.1

  • Fixed: improve typings of constructor helpers (#292)
Commits
Maintainer changes

This version was pushed to npm by moox, a new releaser for postcss-selector-parser since your current version.


Updates sharp from 0.34.5 to 0.35.5

Release notes

Sourced from sharp's releases.

v0.35.5

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4

  • Add upper bounds check on length of linear and GIF delay arrays.

  • Improve error handing when WebAssembly fallback also fails. #4593 @​lazerg

  • TypeScript: Allow multi-frame options for JXL output. #4602 @​ramin-010

  • TypeScript: Remove non-existent named export. #4604

  • Increase accepted dimensions when extending an image. #4605

  • Improve gain map support for extract and rotate operations. #4606

  • Tests: Ensure composite tests pass on big endian platforms. #4609

v0.35.5-rc.1

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4-rc.1

  • Add upper bounds check on length of linear and GIF delay arrays.

  • Improve error handing when WebAssembly fallback also fails. #4593 @​lazerg

  • TypeScript: Allow multi-frame options for JXL output. #4602 @​ramin-010

  • TypeScript: Remove non-existent named export. #4604

  • Increase accepted dimensions when extending an image. #4605

  • Improve gain map support for extract operation. #4606

... (truncated)

Commits
  • 51a990f Release v0.35.5
  • 96de105 Upgrade to sharp-libvips v1.3.4
  • 3a61390 CI: Configure Dependabot with all package.json locations
  • 4940c50 Improve gain map support for rotate/flip/flop ops
  • 20654aa Prerelease v0.35.5-rc.1
  • ef4f934 CI: Upgrade to Ubuntu 26.04
  • 358df95 Upgrade to libvips v8.18.7
  • 49f4903 Improve gain map support for rotate-then-extract #4606
  • 0e2e55e Silence a couple of compiler/static analysis warnings
  • cef3b8c Improve gain map support for extract operation #4606
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump the npm_and_yarn group across 1 directory with 7 updates
ae47e71 
Bumps the npm_and_yarn group with 7 updates in the /tutorials/full-stack-application/app directory:

| Package | From | To |
| --- | --- | --- |
| [next](https://github.com/vercel/next.js) | `15.5.21` | `15.5.28` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.11` | `1.1.22` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `4.3.0` | `4.3.2` |
| [minimatch](https://github.com/isaacs/minimatch) | `3.1.2` | `3.1.5` |
| [nanoid](https://github.com/ai/nanoid) | `3.3.17` | `3.3.20` |
| [postcss-selector-parser](https://github.com/postcss/postcss-selector-parser) | `6.1.0` | `6.1.6` |
| [sharp](https://github.com/lovell/sharp) | `0.34.5` | `0.35.5` |



Updates `next` from 15.5.21 to 15.5.28
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v15.5.21...v15.5.28)

Updates `brace-expansion` from 1.1.11 to 1.1.22
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@1.1.11...v1.1.22)

Updates `js-yaml` from 4.3.0 to 4.3.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.3.0...4.3.2)

Updates `minimatch` from 3.1.2 to 3.1.5
- [Release notes](https://github.com/isaacs/minimatch/releases)
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v3.1.2...v3.1.5)

Updates `nanoid` from 3.3.17 to 3.3.20
- [Release notes](https://github.com/ai/nanoid/releases)
- [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md)
- [Commits](ai/nanoid@3.3.17...3.3.20)

Updates `postcss-selector-parser` from 6.1.0 to 6.1.6
- [Release notes](https://github.com/postcss/postcss-selector-parser/releases)
- [Changelog](https://github.com/postcss/postcss-selector-parser/blob/6.1.6/CHANGELOG.md)
- [Commits](postcss/postcss-selector-parser@v6.1.0...6.1.6)

Updates `sharp` from 0.34.5 to 0.35.5
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](lovell/sharp@v0.34.5...v0.35.5)

---
updated-dependencies:
- dependency-name: next
  dependency-version: 15.5.28
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 1.1.22
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 4.3.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: minimatch
  dependency-version: 3.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: nanoid
  dependency-version: 3.3.20
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: postcss-selector-parser
  dependency-version: 6.1.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: sharp
  dependency-version: 0.35.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Nov 11, 2026
@joewyz
joewyz merged commit f7d476c into main Nov 11, 2026
2 checks passed
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/tutorials/full-stack-application/app/npm_and_yarn-30cda002b9 branch November 11, 2026 20:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@joewyz joewyz joewyz approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@joewyz