Build(deps): Bump the npm_and_yarn group across 2 directories with 25 updates #1

dependabot · 2025-12-10T12:07:24Z

Bumps the npm_and_yarn group with 20 updates in the /web directory:

Package	From	To
axios	`1.7.2`	`1.12.0`
dompurify	`3.1.6`	`3.2.4`
mammoth	`1.7.2`	`1.11.0`
@babel/helpers	`7.24.6`	`7.28.4`
js-yaml	`3.14.1`	`3.14.2`
brace-expansion	`1.1.11`	`1.1.12`
body-parser	`1.20.2`	`1.20.4`
express	`4.19.2`	`4.22.1`
cipher-base	`1.0.4`	`1.0.7`
elliptic	`6.5.5`	`6.6.1`
rollup	`3.29.4`	`3.29.5`
katex	`0.16.11`	`0.16.27`
mdast-util-to-hast	`13.1.0`	`13.2.1`
min-document	`2.19.0`	`2.19.2`
nanoid	`3.3.7`	`3.3.11`
on-headers	`1.0.2`	`1.1.0`
pbkdf2	`3.1.2`	`3.1.5`
prismjs	`1.29.0`	`1.30.0`
pdfjs-dist	`2.16.105`	`4.4.168`
webpack	`5.89.0`	`5.103.0`

Bumps the npm_and_yarn group with 1 update in the /sandbox/sandbox_base_image/nodejs directory: axios.

Updates axios from 1.7.2 to 1.12.0

Release notes

Sourced from axios's releases.

Release v1.12.0

Release notes:

Bug Fixes

adding build artifacts (9ec86de)

dont add dist on release (a2edc36)

fetch-adapter: set correct Content-Type for Node FormData (#6998) (a9f47af)

node: enforce maxContentLength for data: URLs (#7011) (945435f)

package exports (#5627) (aa78ac2)

params: removing '[' and ']' from URL encode exclude characters (#3316) (#5715) (6d84189)

release pr run (fd7f404)

types: change the type guard on isCancel (#5595) (0dbb7fd)

Features

adapter: surface low‑level network error details; attach original error via cause (#6982) (78b290c)

fetch: add fetch, Request, Response env config variables for the adapter; (#7003) (c959ff2)

support reviver on JSON.parse (#5926) (2a97634), closes #5924

types: extend AxiosResponse interface to include custom headers type (#6782) (7960d34)

Contributors to this release

Willian Agostini

Dmitriy Mozgovoy

khani

Ameer Assadi

Emiedonmokumo Dick-Boro

Zeroday BYTE

Jason Saayman

최예찬

Gligor Kotushevski

Aleksandar Dimitrov

Release v1.11.0

Release notes:

Bug Fixes

form-data npm pakcage (#6970) (e72c193)

prevent RangeError when using large Buffers (#6961) (a2214ca)

types: resolve type discrepancies between ESM and CJS TypeScript declaration files (#6956) (8517aa1)

Contributors to this release

izzy goldman

Manish Sahani

Noritaka Kobayashi

James Nail

Tejaswi1305

... (truncated)

Changelog

Sourced from axios's changelog.

1.12.0 (2025-09-11)

Bug Fixes

adding build artifacts (9ec86de)

dont add dist on release (a2edc36)

fetch-adapter: set correct Content-Type for Node FormData (#6998) (a9f47af)

node: enforce maxContentLength for data: URLs (#7011) (945435f)

package exports (#5627) (aa78ac2)

params: removing '[' and ']' from URL encode exclude characters (#3316) (#5715) (6d84189)

release pr run (fd7f404)

types: change the type guard on isCancel (#5595) (0dbb7fd)

Features

adapter: surface low‑level network error details; attach original error via cause (#6982) (78b290c)

fetch: add fetch, Request, Response env config variables for the adapter; (#7003) (c959ff2)

support reviver on JSON.parse (#5926) (2a97634), closes #5924

types: extend AxiosResponse interface to include custom headers type (#6782) (7960d34)

Contributors to this release

Willian Agostini

Dmitriy Mozgovoy

khani

Ameer Assadi

Emiedonmokumo Dick-Boro

Zeroday BYTE

Jason Saayman

최예찬

Gligor Kotushevski

Aleksandar Dimitrov

1.11.0 (2025-07-22)

Bug Fixes

form-data npm pakcage (#6970) (e72c193)

prevent RangeError when using large Buffers (#6961) (a2214ca)

types: resolve type discrepancies between ESM and CJS TypeScript declaration files (#6956) (8517aa1)

Contributors to this release

izzy goldman

Manish Sahani

Noritaka Kobayashi

James Nail

... (truncated)

Commits

0d8ad6e chore(release): v1.12.0 (#7013)
fd7f404 fix: release pr run
a2edc36 fix: dont add dist on release
9ec86de fix: adding build artifacts
945435f fix(node): enforce maxContentLength for data: URLs (#7011)
28e5e30 chore(sponsor): update sponsor block (#7005)
d03f245 chore(CI): fixed release info script to use npm registry instead of git as fi...
a0bc911 chore: removing dist files from src (#7002)
c959ff2 feat(fetch): add fetch, Request, Response env config variables for the adapte...
a9f47af fix(fetch-adapter): set correct Content-Type for Node FormData (#6998)
Additional commits viewable in compare view

Updates dompurify from 3.1.6 to 3.2.4

Release notes

Sourced from dompurify's releases.

DOMPurify 3.2.4

Fixed a conditional and config dependent mXSS-style bypass reported by @nsysean

Added a new feature to allow specific hook removal, thanks @davecardwell

Added purify.js and purify.min.js to exports, thanks @Aetherinox

Added better logic in case no window object is president, thanks @yehuya

Updated some dependencies called out by dependabot

Updated license files etc to show the correct year

DOMPurify 3.2.3

Fixed two conditional sanitizer bypasses discovered by @parrot409 and @Slonser

Updated the attribute clobbering checks to prevent future bypasses, thanks @parrot409

DOMPurify 3.2.2

Fixed a possible bypass in case a rather specific config for custom elements is set, thanks @yaniv-git

Fixed several minor issues with the type definitions, thanks again @reduckted

Fixed a minor issue with the types reference for trusted types, thanks @reduckted

Fixed a minor problem with the template detection regex on some systems, thanks @svdb99

DOMPurify 3.2.1

Fixed several minor issues with the type definitions, thanks @reduckted @ghiscoding @asamuzaK @MiniDigger

Fixed an issue with non-minified dist files and order of imports, thanks @reduckted

DOMPurify 3.2.0

Added type declarations, thanks @reduckted , @philmayfield, @aloisklink, @ssi02014 and others

Fixed a minor issue with the handling of hooks, thanks @kevin-mizu

DOMPurify 3.1.7

Fixed an issue with comment detection and possible bypasses with specific config settings, thanks @masatokinugawa

Fixed several smaller typos in documentation and test & build files, thanks @christianhg

Added better support for Angular compiler, thanks @jeroen1602

Added several new attributes to HTML and SVG allow-list, thanks @Gigabyte5671 and @Rotzbua

Removed the foreignObject element from the list of HTML entry-points, thanks @masatokinugawa

Bumped several dependencies to be more up to date

Commits

ec29e65 Merge pull request #1062 from cure53/main
1c1b183 chore: Preparing 3.2.4 release
d18ffcb fix: Changed the template literal regex to avoid a config-dependent bypass
0d64d2b Merge pull request #1060 from yehuya/initializeTestImprovements
9ad7933 tests: DOMPurify custom window tests improvements
72760ca Merge pull request #1059 from yehuya/fixMissingWindowElement
bc72d44 Fix tests
363a89d fix: handle undefined Element in DOMPurify initialization
f41b45d Update LICENSE
b25bf26 Update README.md
Additional commits viewable in compare view

Updates mammoth from 1.7.2 to 1.11.0

Changelog

Sourced from mammoth's changelog.

1.11.0

Ignore style definitions using a style ID that has already been used.

Disable external file accesses by default. External file access can be enabled using the externalFileAccess option.

Handle numbering levels defined without an index.

1.10.0

Add "Heading" and "Body" styles, as found in documents created by Apple Pages, to the default style map.

Handle structured document tags representing checkboxes wrapped in other elements, such as table cells. Previously, the wrapping elements would have been ignored.

Ignore deleted table rows.

Add notes on security.

Revert the change to explicitly use commonjs modules. This appeared to cause issues with some bundlers such as webpack when using mammoth.browser.js.

1.9.1

Ignore AlternateContent elements when there is no Fallback element.

Explicitly use commonjs modules. Since the modules should have previously been implicitly treated as commonjs modules, this shouldn't affect behaviour.

1.9.0

Update lop to 0.4.2, which removes the use of the util module when there are errors during parsing. This should remove the need to polyfill util in the browser.

Detect checkboxes, both as complex fields and structured document tags, and convert them to checkbox inputs.

1.8.0

Add style mapping for highlights.

Commits

3261fbb Bump version to 1.11.0
c54aaeb Disable external file access by default
c6f5169 Avoid duplicating default level index
cee62ee Handle numbering levels defined without an index
660da13 Recommend externalFileAccess with untrusted user input
2ae2402 Move externalFileAccess docs into docs for options
1494d3c Support disabling external file access
162324e Remove Files.relativeToFile() in favour of options argument
3705a9d Extract files variable
116d0ed Use transforms.getDescendantsOfType for safer vmerge removal
Additional commits viewable in compare view

Updates @babel/helpers from 7.24.6 to 7.28.4

Release notes

Sourced from @babel/helpers's releases.

v7.28.4 (2025-09-05)

Thanks @gwillen and @mrginglymus for your first PRs!

🏠 Internal

babel-core, babel-helper-check-duplicate-nodes, babel-traverse, babel-types

#17493 Update Jest to v30.1.1 (@JLHwung)

babel-plugin-transform-regenerator

#17455 chore: Clean up transform-regenerator (@liuxingbaoyu)

babel-core

#17474 Switch to @jridgewell/remapping (@mrginglymus)

Committers: 5

Babel Bot (@babel-bot)

Bill Collins (@mrginglymus)

Glenn Willen (@gwillen)

Huáng Jùnliàng (@JLHwung)

@liuxingbaoyu

v7.28.3 (2025-08-14)

👓 Spec Compliance

babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators, babel-plugin-transform-class-static-block, babel-preset-env

#17443 [static blocks] Do not inject new static fields after static code (@nicolo-ribaudo)

🐛 Bug Fix

babel-parser

#17465 fix(parser/typescript): parse import("./a", {with:{},}) (@easrng)

#17478 fix(parser): stop subscript parsing on async arrow (@JLHwung)

💅 Polish

babel-plugin-transform-regenerator, babel-plugin-transform-runtime

#17363 Do not save last yield in call in temp var (@nicolo-ribaudo)

📝 Documentation

#17448 move eslint-{parser,plugin} docs to the website (@JLHwung)

🏠 Internal

#17454 Enable type checking for scripts and babel-worker.cjs (@JLHwung)

🔬 Output optimization

babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions

#17444 Optimize do expression output (@JLHwung)

Committers: 5

Babel Bot (@babel-bot)

Huáng Jùnliàng (@JLHwung)

Jam Balaya (@JamBalaya56562)

Nicolò Ribaudo (@nicolo-ribaudo)

easrng (@easrng)

... (truncated)

Changelog

Sourced from @babel/helpers's changelog.

v7.28.4 (2025-09-05)

🏠 Internal

babel-core, babel-helper-check-duplicate-nodes, babel-traverse, babel-types

#17493 Update Jest to v30.1.1 (@JLHwung)

babel-plugin-transform-regenerator

#17455 chore: Clean up transform-regenerator (@liuxingbaoyu)

babel-core

#17474 Switch to @jridgewell/remapping (@mrginglymus)

v7.28.3 (2025-08-14)

👓 Spec Compliance

babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators, babel-plugin-transform-class-static-block, babel-preset-env

#17443 [static blocks] Do not inject new static fields after static code (@nicolo-ribaudo)

🐛 Bug Fix

babel-parser

#17465 fix(parser/typescript): parse import("./a", {with:{},}) (@easrng)

#17478 fix(parser): stop subscript parsing on async arrow (@JLHwung)

💅 Polish

babel-plugin-transform-regenerator, babel-plugin-transform-runtime

#17363 Do not save last yield in call in temp var (@nicolo-ribaudo)

📝 Documentation

#17448 move eslint-{parser,plugin} docs to the website (@JLHwung)

🏠 Internal

#17454 Enable type checking for scripts and babel-worker.cjs (@JLHwung)

🔬 Output optimization

babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions

#17444 Optimize do expression output (@JLHwung)

v7.28.2 (2025-07-24)

🐛 Bug Fix

babel-types

#17445 [babel 7] Make operator param in t.tsTypeOperator optional (@nicolo-ribaudo)

babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-regenerator, babel-preset-env, babel-runtime-corejs3

#17441 fix: regeneratorDefine compatibility with es5 strict mode (@liuxingbaoyu)

v7.28.1 (2025-07-12)

🐛 Bug Fix

babel-plugin-transform-async-generator-functions, babel-plugin-transform-regenerator

#17426 fix: regenerator correctly handles throw outside of try (@liuxingbaoyu)

📝 Documentation

babel-types

#17422 Add missing FunctionParameter docs (@JLHwung)

... (truncated)

Commits

35055e3 v7.28.4
18d88b8 Improve @babel/core typings (#17471)
ef155f5 v7.28.3
741cbd2 chore: fix various typos across codebase (#17476)
cac0ff4 v7.28.2
f743094 fix: regeneratorDefine compatibility with es5 strict mode (#17441)
baa4cb8 v7.27.6
fdbf1b3 fix: finally causes unexpected return value (#17366)
7d06930 v7.27.4
5b9468d Reduce regenerator size more (#17287)
Additional commits viewable in compare view

Updates js-yaml from 3.14.1 to 3.14.2

Changelog

Sourced from js-yaml's changelog.

[3.14.2] - 2025-11-15

Security

Backported v4.1.1 fix to v3

[4.1.1] - 2025-11-12

Security

Fix prototype pollution issue in yaml merge (<<) operator.

[4.1.0] - 2021-04-15

Added

Types are now exported as yaml.types.XXX.

Every type now has options property with original arguments kept as they were (see yaml.types.int.options as an example).

Changed

Schema.extend() now keeps old type order in case of conflicts (e.g. Schema.extend([ a, b, c ]).extend([ b, a, d ]) is now ordered as abcd instead of cbad).

[4.0.0] - 2021-01-03

Changed

Check migration guide to see details for all breaking changes.

Breaking: "unsafe" tags !!js/function, !!js/regexp, !!js/undefined are moved to js-yaml-js-types package.

Breaking: removed safe* functions. Use load, loadAll, dump instead which are all now safe by default.

yaml.DEFAULT_SAFE_SCHEMA and yaml.DEFAULT_FULL_SCHEMA are removed, use yaml.DEFAULT_SCHEMA instead.

yaml.Schema.create(schema, tags) is removed, use schema.extend(tags) instead.

!!binary now always mapped to Uint8Array on load.

Reduced nesting of /lib folder.

Parse numbers according to YAML 1.2 instead of YAML 1.1 (01234 is now decimal, 0o1234 is octal, 1:23 is parsed as string instead of base60).

dump() no longer quotes :, [, ], (, ) except when necessary, #470, #557.

Line and column in exceptions are now formatted as (X:Y) instead of at line X, column Y (also present in compact format), #332.

Code snippet created in exceptions now contains multiple lines with line numbers.

dump() now serializes undefined as null in collections and removes keys with undefined in mappings, #571.

dump() with skipInvalid=true now serializes invalid items in collections as null.

Custom tags starting with ! are now dumped as !tag instead of !<!tag>, #576.

Custom tags starting with tag:yaml.org,2002: are now shorthanded using !!, #258.

Added

Added .mjs (es modules) support.

Added quotingType and forceQuotes options for dumper to configure string literal style, #290, #529.

Added styles: { '!!null': 'empty' } option for dumper (serializes { foo: null } as "foo: "), #570.

... (truncated)

Commits

9963d36 3.14.2 released
10d3c8e dist rebuild
5278870 fix prototype pollution in merge (<<) (#731)
See full diff in compare view

Updates brace-expansion from 1.1.11 to 1.1.12

Release notes

Sourced from brace-expansion's releases.

v1.1.12

pkg: publish on tag 1.x c460dbd

fmt ccb8ac6

Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) c3c73c8

juliangruber/brace-expansion@v1.1.11...v1.1.12

Commits

44f33b4 1.1.12
c460dbd pkg: publish on tag 1.x
ccb8ac6 fmt
c3c73c8 Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65)
See full diff in compare view

Updates body-parser from 1.20.2 to 1.20.4

Release notes

Sourced from body-parser's releases.

1.20.4

What's Changed

Remove redundant depth check by @blakeembrey in expressjs/body-parser#538

ci: add support for Node.js v23 by @Phillip9587 in expressjs/body-parser#553

ci: restore CI for 1.x branch by @bjohansebas in expressjs/body-parser#665

deps: qs@^6.14.0 by @bjohansebas in expressjs/body-parser#664

deps: use tilde notation and update certain dependencies by @Phillip9587 in expressjs/body-parser#668

chore: remove SECURITY.md by @Phillip9587 in expressjs/body-parser#669

ci: add CodeQL (SAST) by @Phillip9587 in expressjs/body-parser#670

Release: 1.20.4 by @UlisesGascon in expressjs/body-parser#672

Full Changelog: expressjs/body-parser@1.20.3...1.20.4

1.20.3

What's Changed

Important

deps: [email protected]

add depth option to customize the depth level in the parser

IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity). Documentation

Other changes

chore: add support for OSSF scorecard reporting by @inigomarquinez in expressjs/body-parser#522

ci: fix errors in ci github action for node 8 and 9 by @inigomarquinez in expressjs/body-parser#523

fix: pin to [email protected] by @wesleytodd in expressjs/body-parser#527

deps: [email protected] by @melikhov-dev in expressjs/body-parser#521

Add OSSF Scorecard badge by @bjohansebas in expressjs/body-parser#531

Linter by @UlisesGascon in expressjs/body-parser#534

Release: 1.20.3 by @UlisesGascon in expressjs/body-parser#535

New Contributors

@inigomarquinez made their first contribution in expressjs/body-parser#522

@melikhov-dev made their first contribution in expressjs/body-parser#521

@bjohansebas made their first contribution in expressjs/body-parser#531

@UlisesGascon made their first contribution in expressjs/body-parser#534

Full Changelog: expressjs/body-parser@1.20.2...1.20.3

Changelog

Sourced from body-parser's changelog.

1.20.4 / 2025-12-01

deps: qs@~6.14.0

deps: use tilde notation for dependencies

deps: http-errors@~2.0.1

deps: raw-body@~2.5.3

1.20.3 / 2024-09-10

deps: [email protected]

add depth option to customize the depth level in the parser

IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)

Commits

7db202c 1.20.4 (#672)
d8f8adb ci: add CodeQL (SAST) (#670)
6d133c1 chore: remove SECURITY.md (#669)
fcd1535 deps: use tilde notation and update certain dependencies (#668)
ec5fa29 deps: qs@~6.14.0 (#664)
ffb95c1 ci: restore CI for 1.x branch (#665)
48a5f07 ci: add support for Node.js v23 (#553)
f20f6ad Remove redundant depth check (#538)
1752951 1.20.3
39744cf chore: linter (#534)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for body-parser since your current version.

Updates express from 4.19.2 to 4.22.1

Release notes

Sourced from express's releases.

v4.22.1

What's Changed

[!IMPORTANT]
The prior release (4.22.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

Release: 4.22.1 by @UlisesGascon in expressjs/express#6934

Full Changelog: expressjs/express@4.22.0...v4.22.1

4.22.0

Important: Security

Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)

What's Changed

Refactor: improve readability by @sazk07 in expressjs/express#6190

ci: add support for [email protected] by @UlisesGascon in expressjs/express#6080

Method functions with no path should error by @wesleytodd in expressjs/express#5957

ci: updated github actions ci workflow by @Phillip9587 in expressjs/express#6323

ci: reorder npm i steps to fix ci for older node versions by @Phillip9587 in expressjs/express#6336

Backport: ci: add node.js 24 to test matrix by @Phillip9587 in expressjs/express#6506

chore(4.x): wider range for query test skip by @jonchurch in expressjs/express#6513

use tilde notation for certain dependencies by @UlisesGascon in expressjs/express#6905

deps: [email protected] by @UlisesGascon in expressjs/express#6909

deps: use tilde notation for qs by @Phillip9587 in expressjs/express#6919

Release: 4.22.0 by @UlisesGascon in expressjs/express#6921

Full Changelog: expressjs/express@4.21.2...4.22.0

4.21.2

What's Changed

Add funding field (v4) by @bjohansebas in expressjs/express#6065

deps: [email protected] by @blakeembrey in expressjs/express#5956

deps: bump [email protected] by @jonchurch in expressjs/express#6209

Release: 4.21.2 by @UlisesGascon in expressjs/express#6094

Full Changelog: expressjs/express@4.21.1...4.21.2

4.21.1

What's Changed

Backport a fix for CVE-2024-47764 to the 4.x branch by @joshbuker in expressjs/express#6029

Release: 4.21.1 by @UlisesGascon in expressjs/express#6031

Full Changelog: expressjs/express@4.21.0...4.21.1

... (truncated)

Changelog

Sourced from express's changelog.

4.22.1 / 2025-12-01

Revert security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)

4.22.0 / 2025-12-01

Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)

deps: use tilde notation for dependencies

deps: [email protected]

4.21.2 / 2024-11-06

deps: [email protected]

Fix backtracking protection

deps: [email protected]

Throws an error on invalid path values

4.21.1 / 2024-10-08

Backported a fix for CVE-2024-47764

4.21.0 / 2024-09-11

Deprecate res.location("back") and res.redirect("back") magic string

deps: [email protected]

includes [email protected]

deps: [email protected]

deps: [email protected]

4.20.0 / 2024-09-10

deps: [email protected]

Remove link renderization in html while redirecting

deps: [email protected]

Remove link renderization in html while redirecting

deps: [email protected]

add depth option to customize the depth level in the parser

IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)

Remove link renderization in html while using res.redirect

deps: [email protected]

Adds support for named matching groups in the routes using a regex

Adds backtracking protection to parameters without regexes defined

deps: encodeurl@~2.0.0

Removes encoding of \, |, and ^ to align better with URL spec

Deprecate passing options.maxAge and options.expires to res.clearCookie

... (truncated)

Commits

12fae14 4.22.1
5ddf311 Revert "sec: security patch for CVE-2024-51999"
49744ab 4.22.0 (#6921)
6e97452 sec: security patch for CVE-2024-51999
6a23d34 deps: use tilde notation for qs (#6919)
8c12cdf deps: [email protected] (#6909)
7fea74f deps: use tilde notation for certain dependencies (#6905)
dac7a04 chore: wider range for query test skip (#6513)
997919b ci: add node.js 24 to test matrix (#6506)
36fb59c fix(ci): reorder npm i steps to fix ci for older node versions (#6336)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by jonchurch, a new releaser for express since your current version.

Updates cipher-base from 1.0.4 to 1.0.7

Changelog

Sourced from Description has been truncated

Summary by cubic

Refreshes dependencies in web and sandbox to pick up security fixes and stability improvements. Highlights include axios, DOMPurify, Express, js‑yaml, mammoth, and a major pdfjs-dist upgrade that may need testing.

Dependencies

axios to 1.12.0 (web and sandbox)

dompurify to 3.2.4 (security fixes)

express to 4.22.1 (reverts prior breaking change)

body-parser to 1.20.4 (qs update; depth option retained)

js-yaml to 3.14.2 (security backport)

pdfjs-dist to 4.4.168 (major)

mammoth to 1.11.0 (external file access disabled by default)

webpack to 5.103.0

react-pdf-highlighter to 8.0.0-rc.0

react-syntax-highlighter to 16.1.0

@antv/g2 to 5.4.7

Migration

Verify PDF rendering and annotations after pdfjs-dist/react-pdf-highlighter upgrades.

If mammoth needs external images/files, enable externalFileAccess in usage.

Review URL-encoded parsing depth if you rely on deeply nested form data.

Run full app tests across web and sandbox to catch adapter/type changes (e.g., axios).

^{Written for commit d24aa48. Summary will update automatically on new commits.}

… updates Bumps the npm_and_yarn group with 20 updates in the /web directory: | Package | From | To | | --- | --- | --- | | [axios](https://github.com/axios/axios) | `1.7.2` | `1.12.0` | | [dompurify](https://github.com/cure53/DOMPurify) | `3.1.6` | `3.2.4` | | [mammoth](https://github.com/mwilliamson/mammoth.js) | `1.7.2` | `1.11.0` | | [@babel/helpers](https://github.com/babel/babel/tree/HEAD/packages/babel-helpers) | `7.24.6` | `7.28.4` | | [js-yaml](https://github.com/nodeca/js-yaml) | `3.14.1` | `3.14.2` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.11` | `1.1.12` | | [body-parser](https://github.com/expressjs/body-parser) | `1.20.2` | `1.20.4` | | [express](https://github.com/expressjs/express) | `4.19.2` | `4.22.1` | | [cipher-base](https://github.com/crypto-browserify/cipher-base) | `1.0.4` | `1.0.7` | | [elliptic](https://github.com/indutny/elliptic) | `6.5.5` | `6.6.1` | | [rollup](https://github.com/rollup/rollup) | `3.29.4` | `3.29.5` | | [katex](https://github.com/KaTeX/KaTeX) | `0.16.11` | `0.16.27` | | [mdast-util-to-hast](https://github.com/syntax-tree/mdast-util-to-hast) | `13.1.0` | `13.2.1` | | [min-document](https://github.com/Raynos/min-document) | `2.19.0` | `2.19.2` | | [nanoid](https://github.com/ai/nanoid) | `3.3.7` | `3.3.11` | | [on-headers](https://github.com/jshttp/on-headers) | `1.0.2` | `1.1.0` | | [pbkdf2](https://github.com/browserify/pbkdf2) | `3.1.2` | `3.1.5` | | [prismjs](https://github.com/PrismJS/prism) | `1.29.0` | `1.30.0` | | [pdfjs-dist](https://github.com/mozilla/pdf.js) | `2.16.105` | `4.4.168` | | [webpack](https://github.com/webpack/webpack) | `5.89.0` | `5.103.0` | Bumps the npm_and_yarn group with 1 update in the /sandbox/sandbox_base_image/nodejs directory: [axios](https://github.com/axios/axios). Updates `axios` from 1.7.2 to 1.12.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.7.2...v1.12.0) Updates `dompurify` from 3.1.6 to 3.2.4 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.1.6...3.2.4) Updates `mammoth` from 1.7.2 to 1.11.0 - [Release notes](https://github.com/mwilliamson/mammoth.js/releases) - [Changelog](https://github.com/mwilliamson/mammoth.js/blob/master/NEWS) - [Commits](mwilliamson/mammoth.js@1.7.2...1.11.0) Updates `@babel/helpers` from 7.24.6 to 7.28.4 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.28.4/packages/babel-helpers) Updates `js-yaml` from 3.14.1 to 3.14.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.14.1...3.14.2) Updates `brace-expansion` from 1.1.11 to 1.1.12 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@1.1.11...v1.1.12) Updates `body-parser` from 1.20.2 to 1.20.4 - [Release notes](https://github.com/expressjs/body-parser/releases) - [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md) - [Commits](expressjs/body-parser@1.20.2...1.20.4) Updates `express` from 4.19.2 to 4.22.1 - [Release notes](https://github.com/expressjs/express/releases) - [Changelog](https://github.com/expressjs/express/blob/v4.22.1/History.md) - [Commits](expressjs/express@4.19.2...v4.22.1) Updates `cipher-base` from 1.0.4 to 1.0.7 - [Changelog](https://github.com/browserify/cipher-base/blob/master/CHANGELOG.md) - [Commits](browserify/cipher-base@v1.0.4...v1.0.7) Updates `cookie` from 0.6.0 to 0.7.2 - [Release notes](https://github.com/jshttp/cookie/releases) - [Commits](jshttp/cookie@v0.6.0...v0.7.2) Updates `elliptic` from 6.5.5 to 6.6.1 - [Commits](indutny/elliptic@v6.5.5...v6.6.1) Updates `express` from 4.19.2 to 4.22.1 - [Release notes](https://github.com/expressjs/express/releases) - [Changelog](https://github.com/expressjs/express/blob/v4.22.1/History.md) - [Commits](expressjs/express@4.19.2...v4.22.1) Updates `rollup` from 3.29.4 to 3.29.5 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG-3.md) - [Commits](rollup/rollup@v3.29.4...v3.29.5) Updates `form-data` from 4.0.0 to 4.0.5 - [Release notes](https://github.com/form-data/form-data/releases) - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v4.0.0...v4.0.5) Updates `katex` from 0.16.11 to 0.16.27 - [Release notes](https://github.com/KaTeX/KaTeX/releases) - [Changelog](https://github.com/KaTeX/KaTeX/blob/main/CHANGELOG.md) - [Commits](KaTeX/KaTeX@v0.16.11...v0.16.27) Updates `mdast-util-to-hast` from 13.1.0 to 13.2.1 - [Release notes](https://github.com/syntax-tree/mdast-util-to-hast/releases) - [Commits](syntax-tree/mdast-util-to-hast@13.1.0...13.2.1) Updates `min-document` from 2.19.0 to 2.19.2 - [Commits](Raynos/min-document@v2.19.0...v2.19.2) Updates `nanoid` from 3.3.7 to 3.3.11 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](ai/nanoid@3.3.7...3.3.11) Updates `on-headers` from 1.0.2 to 1.1.0 - [Release notes](https://github.com/jshttp/on-headers/releases) - [Changelog](https://github.com/jshttp/on-headers/blob/master/HISTORY.md) - [Commits](jshttp/on-headers@v1.0.2...v1.1.0) Updates `pbkdf2` from 3.1.2 to 3.1.5 - [Changelog](https://github.com/browserify/pbkdf2/blob/master/CHANGELOG.md) - [Commits](browserify/pbkdf2@v3.1.2...v3.1.5) Updates `prismjs` from 1.29.0 to 1.30.0 - [Release notes](https://github.com/PrismJS/prism/releases) - [Changelog](https://github.com/PrismJS/prism/blob/v2/CHANGELOG.md) - [Commits](PrismJS/prism@v1.29.0...v1.30.0) Updates `pdfjs-dist` from 2.16.105 to 4.4.168 - [Release notes](https://github.com/mozilla/pdf.js/releases) - [Commits](mozilla/pdf.js@v2.16.105...v4.4.168) Updates `send` from 0.18.0 to 0.19.0 - [Release notes](https://github.com/pillarjs/send/releases) - [Changelog](https://github.com/pillarjs/send/blob/master/HISTORY.md) - [Commits](pillarjs/send@0.18.0...0.19.0) Updates `serve-static` from 1.15.0 to 1.16.2 - [Release notes](https://github.com/expressjs/serve-static/releases) - [Changelog](https://github.com/expressjs/serve-static/blob/v1.16.2/HISTORY.md) - [Commits](expressjs/serve-static@v1.15.0...v1.16.2) Updates `sha.js` from 2.4.11 to 2.4.12 - [Changelog](https://github.com/browserify/sha.js/blob/master/CHANGELOG.md) - [Commits](browserify/sha.js@v2.4.11...v2.4.12) Updates `webpack` from 5.89.0 to 5.103.0 - [Release notes](https://github.com/webpack/webpack/releases) - [Commits](webpack/webpack@v5.89.0...v5.103.0) Updates `axios` from 1.9.0 to 1.12.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.7.2...v1.12.0) Updates `form-data` from 4.0.2 to 4.0.5 - [Release notes](https://github.com/form-data/form-data/releases) - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v4.0.0...v4.0.5) --- updated-dependencies: - dependency-name: axios dependency-version: 1.12.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: dompurify dependency-version: 3.2.4 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: mammoth dependency-version: 1.11.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@babel/helpers" dependency-version: 7.28.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 3.14.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.12 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: body-parser dependency-version: 1.20.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: express dependency-version: 4.22.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: cipher-base dependency-version: 1.0.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: cookie dependency-version: 0.7.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: elliptic dependency-version: 6.6.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: express dependency-version: 4.22.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: rollup dependency-version: 3.29.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: form-data dependency-version: 4.0.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: katex dependency-version: 0.16.27 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: mdast-util-to-hast dependency-version: 13.2.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: min-document dependency-version: 2.19.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: nanoid dependency-version: 3.3.11 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: on-headers dependency-version: 1.1.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: pbkdf2 dependency-version: 3.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: prismjs dependency-version: 1.30.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: pdfjs-dist dependency-version: 4.4.168 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: send dependency-version: 0.19.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: serve-static dependency-version: 1.16.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: sha.js dependency-version: 2.4.12 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: webpack dependency-version: 5.103.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: axios dependency-version: 1.12.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: form-data dependency-version: 4.0.5 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]>

coderabbitai · 2025-12-10T12:07:36Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Dec 10, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Build(deps): Bump the npm_and_yarn group across 2 directories with 25 updates #1

Build(deps): Bump the npm_and_yarn group across 2 directories with 25 updates #1

Uh oh!

dependabot bot commented on behalf of github Dec 10, 2025 •

edited by cubic-dev-ai bot

Loading

Uh oh!

coderabbitai bot commented Dec 10, 2025

Review skipped

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Build(deps): Bump the npm_and_yarn group across 2 directories with 25 updates #1

Are you sure you want to change the base?

Build(deps): Bump the npm_and_yarn group across 2 directories with 25 updates #1

Uh oh!

Conversation

dependabot bot commented on behalf of github Dec 10, 2025 • edited by cubic-dev-ai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release v1.12.0

Release notes:

Bug Fixes

Features

Contributors to this release

Release v1.11.0

Release notes:

Bug Fixes

Contributors to this release

1.12.0 (2025-09-11)

Bug Fixes

Features

Contributors to this release

1.11.0 (2025-07-22)

Bug Fixes

Contributors to this release

DOMPurify 3.2.4

DOMPurify 3.2.3

DOMPurify 3.2.2

DOMPurify 3.2.1

DOMPurify 3.2.0

DOMPurify 3.1.7

1.11.0

1.10.0

1.9.1

1.9.0

1.8.0

v7.28.4 (2025-09-05)

🏠 Internal

Committers: 5

v7.28.3 (2025-08-14)

👓 Spec Compliance

🐛 Bug Fix

💅 Polish

📝 Documentation

🏠 Internal

🔬 Output optimization

Committers: 5

v7.28.4 (2025-09-05)

🏠 Internal

v7.28.3 (2025-08-14)

👓 Spec Compliance

🐛 Bug Fix

💅 Polish

📝 Documentation

🏠 Internal

🔬 Output optimization

v7.28.2 (2025-07-24)

🐛 Bug Fix

v7.28.1 (2025-07-12)

🐛 Bug Fix

📝 Documentation

[3.14.2] - 2025-11-15

Security

[4.1.1] - 2025-11-12

Security

[4.1.0] - 2021-04-15

Added

Changed

[4.0.0] - 2021-01-03

Changed

Added

v1.1.12

1.20.4

What's Changed

1.20.3

What's Changed

Important

Other changes

New Contributors

1.20.4 / 2025-12-01

1.20.3 / 2024-09-10

v4.22.1

dependabot bot commented on behalf of github Dec 10, 2025 •

edited by cubic-dev-ai bot

Loading