Bump the npm_and_yarn group across 1 directory with 8 updates #2

dependabot · 2025-09-09T19:24:29Z

Bumps the npm_and_yarn group with 7 updates in the / directory:

Package	From	To
json-schema	`0.2.3`	`0.4.0`
jsprim	`1.4.1`	`1.4.2`
jsonpointer	`4.1.0`	`5.0.1`
is-my-json-valid	`2.20.5`	`2.20.6`
lodash.merge	`3.3.2`	`4.6.2`
standard	`5.4.1`	`17.1.2`
qs	`6.5.2`	`6.5.3`

Updates json-schema from 0.2.3 to 0.4.0

Commits

f6f6a3b Use a little more robust method of checking instances
ef60987 Update version
b62f1da Protect against constructor modification, #84
fb427cd Link to json-schema-org repository in addition to site, fixes #54
22f1461 Don't allow proto property to be used for schema default/coerce, fixes #84
c52a27c Get basic test to pass
b3f42b3 Add security policy
3b0cec3 Update version
c28470f Update readme to acknowledge the state of the package
7dff9cd Merge pull request #81 from hodovani/patch-1
Additional commits viewable in compare view

Updates jsprim from 1.4.1 to 1.4.2

Changelog

Sourced from jsprim's changelog.

v1.4.2 (2021-11-29)

#35 Backport json-schema 0.4.0 to version 1.4.x

Commits

5c8475f joyent/node-jsprim#35 Backport json-schema 0.4.0 to version 1.4.x
See full diff in compare view

Maintainer changes

This version was pushed to npm by bahamat, a new releaser for jsprim since your current version.

Updates jsonpointer from 4.1.0 to 5.0.1

Release notes

Sourced from jsonpointer's releases.

Version 5.0.1

Changelog

Fix incorrect typings for compile get/set methods (#58, thanks to @haakemon)

Fix null values throwing exception when traversing over while getting (#50, thanks to @reckter)

Fix tests for null and undefined assertions (janl/node-jsonpointer@a5706e8)

v5.0.0

5.0.0 (2021-10-31)

Bug Fixes
Fix prototype pollution (#51)

The original, non-mutated objects are now returned if any of the keys __proto__, constructor or prototype are used in a json pointer.
// returns the unmodified input {}
jsonpointer.set({}, '/foo/__proto__/boo', 'polluted')
When passing non-string arrays to a .set operation, an error is thrown:
// throws `new Error('Invalid JSON pointer. Must be of type string or number.')`
jsonpointer.set({}, [['__proto__'], ['__proto__'], 'boo'], 'polluted')

Commits

4a253c0 Adopt strictEqual changes and only return null when the get succeeded
bad4983 Fix null values throwing exception when traversing over while getting
a5706e8 test: Always use strictEqual to ensure null and undefined values are asserted...
b8e1e6a fix incorrect typings for compile get/set methods
c4de620 Merge pull request #53 from janl/release/5.0.0
8dbf304 feat: v5
84cf173 Merge pull request #52 from janl/fix/test
f716e5c chore: more rip travis
e2ae355 chore: remove comment
d23693b chore: update primary branch
Additional commits viewable in compare view

Updates is-my-json-valid from 2.20.5 to 2.20.6

Commits

58d30cb 2.20.6
f76edf0 Merge pull request #188 from axelniklasson/master
4eef089 Upgrade jsonpointer to address security vulnerability
See full diff in compare view

Updates lodash.merge from 3.3.2 to 4.6.2

Release notes

Sourced from lodash.merge's releases.

4.0.0

lodash v4.0.0

2015 was big year! Lodash became the most depended on npm package, passed 1 billion downloads, & its v3 release saw massive adoption!

The year was also one of collaboration, as discussions began on merging Lodash & Underscore. Much of Lodash v4 is proofing out the ideas from those discussions. Lodash v4 would not be possible without the collaboration & contributions of the Underscore core team. In the spirit of merging our teams have blended with several members contributing to both libraries.

For 2016 & lodash v4.0.0 we wanted to cut loose, push forward, & take things up a notch!

Modern only

With v4 we’re breaking free from old projects, old environments, & dropping old IE < 9 support!

4 kB Core

Lodash’s kitchen-sink size will continue to grow as new methods & functionality are added. However, we now offer a 4 kB (gzipped) core build that’s compatible with Backbone v1.2.4 for folks who want Lodash without lugging around the kitchen sink.

More ES6

We’ve continued to embrace ES6 with methods like _.isSymbol, added support for cloning & comparing array buffers, maps, sets, & symbols, converting iterators to arrays, & iterable _(…).

In addition, we’ve published an es-build & pulled babel-plugin-lodash into core to make tree-shaking a breeze.

More Modular

Pop quiz! 📣

What category path does the bindAll method belong to? Is it

A) require('lodash/function/bindAll') B) require('lodash/utility/bindAll') C) require('lodash/util/bindAll')

Don’t know? Well, with v4 it doesn’t matter because now module paths are as simple as
var bindAll = require('lodash/bindAll');
We’ve also reduced module complexity making it easier to create smaller bundles. This has helped Lodash adoption with libraries like Async & Redux!

1st Class FP

With v3 we introduced lodash-fp. We learned a lot & with v4 we decided to pull it into core.

Now you can get immutable, auto-curried, iteratee-first, data-last methods as simply as
var _ = require('lodash/fp');
var object = { 'a': 1 };
</tr></table> 

... (truncated)

Commits

See full diff in compare view

Updates standard from 5.4.1 to 17.1.2

Release notes

Sourced from standard's releases.

v17.1.2

Unpin and bump eslint-plugin-react(#1976) 004e63b

standard/standard@v17.1.1...v17.1.2

v17.1.1

Pin eslint-plugin-react to 7.35.2 (#1976) d535d98

standard/standard@v17.1.0...v17.1.1

v17.1.0

Update dependencies and prepare release 17.1.0 (#1908) a4049f8

Add version-guard to silent failure on old node (#1829) 7dc2ab0 85316d1 26efe34 f635e4e 6dd2162

standard/standard@v17.0.0...v17.1.0

v17.0.0

We're super excited to announce standard 17!

This major release fully focuses on getting in sync with the wider ESLint ecosystem and doesn't in itself introduce any new rules or features.

When you upgrade, consider running standard --fix to automatically format your code to match the current set of rules.

This is the first release by two of our standard co-maintainers @theoludwig and @voxpelli. Buy them a cake if you run into them, thanks for getting this release out!

Major changes

eslint-config-node has been replaced with the up to date fork eslint-config-n. If you have used comments like // eslint-disable-line node/no-deprecated-api you now have to reference the n/ rules instead.

object-shorthand rule (as warning)

Use of ESLint 8, which allows for support for all of the latest syntax that ESLint 8 includes, such as top level await #1548 #1775

--verbose by default

Changed features

Update eslint from ~7.18.0 to ^8.13.0

Update eslint-config-standard from 16.0.3 to 17.0.0 to adapt to ESLint 8

Update eslint-config-standard-jsx from 10.0.0 to ^11.0.0 to adapt to ESLint 8

Update standard-engine from ^14 to ^15.0.0 to adapt to ESLint 8, see its CHANGELOG

Move from eslint-plugin-node@~11.1.0 to eslint-plugin-n@^15.1.0 to adapt to ESLint 8

Update eslint-plugin-import from ~2.24.2 to ^2.26.0

Update eslint-plugin-promise from ~5.1.0 to ^6.0.0

Update eslint-plugin-react from ~7.25.1 to ^7.28.0

standard/standard@v16.0.4...v17.0.0

v17.0.0-2

fix: update eslint-config-standard-jsx to fix #1548 (#1775) c120a60

... (truncated)

Changelog

Sourced from standard's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[17.1.0] - 2023-05-29

Update eslint-config-standard from 17.0.0 to 17.1.0

[17.0.0] - 2022-04-20

We're super excited to announce standard 17!

This major release fully focuses on getting in sync with the wider ESLint ecosystem and doesn't in itself introduce any new rules or features.

When you upgrade, consider running standard --fix to automatically format your code to match the current set of rules.

This is the first release by two of our standard co-maintainers @Divlo and @voxpelli. Buy them a cake if you run into them, thanks for getting this release out!

Major changes

eslint-config-node has been replaced with the up to date fork eslint-config-n. If you have used comments like // eslint-disable-line node/no-deprecated-api you now have to reference the n/ rules instead.

object-shorthand rule (as warning)

Use of ESLint 8, which allows for support for all of the latest syntax that ESLint 8 includes, such as top level await #1548 #1775

--verbose by default

Changed features

Update eslint from ~7.18.0 to ^8.13.0

Update eslint-config-standard from 16.0.3 to 17.0.0 to adapt to ESLint 8

Update eslint-config-standard-jsx from 10.0.0 to ^11.0.0 to adapt to ESLint 8

Update standard-engine from ^14 to ^15.0.0 to adapt to ESLint 8, see its CHANGELOG

Move from eslint-plugin-node@~11.1.0 to eslint-plugin-n@^15.1.0 to adapt to ESLint 8

Update eslint-plugin-import from ~2.24.2 to ^2.26.0

Update eslint-plugin-promise from ~5.1.0 to ^6.0.0

Update eslint-plugin-react from ~7.25.1 to ^7.28.0

[17.0.0-2] - 2022-02-03

Fix: Follow up to the fix of #1548 in 17.0.0-1 #1775

[17.0.0-1] - 2022-01-31

Fix: Ensure we support all of the latest syntax that ESLint 8 includes, such as top level await #1548

[17.0.0-0] - 2022-01-31

... (truncated)

Commits

be62115 17.1.2
004e63b Unpin and bump eslint-plugin-react
75a1877 17.1.1
d535d98 Pin eslint-plugin-react to 7.35.2
170a02f Deactivate cron on external tests
3b3c316 Merge pull request #1962 from SebastjanPrachovskij/feature/add-searchapi-logo
dbf1142 Add SearchApi logo to users
5ff8441 Merge pull request #1936 from poozhu/master
f40f923 Merge branch 'master' into master
3b6f95d Edit Discord badge. (#1954)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by voxpelli, a new releaser for standard since your current version.

Updates minimist from 1.2.5 to 1.2.8

Changelog

Sourced from minimist's changelog.

v1.2.8 - 2023-02-09

Merged

[Fix] Fix long option followed by single dash [#17](https://github.com/minimistjs/minimist/issues/17)

[Tests] Remove duplicate test [#12](https://github.com/minimistjs/minimist/issues/12)

[Fix] opt.string works with multiple aliases [#10](https://github.com/minimistjs/minimist/issues/10)

Fixed

[Fix] Fix long option followed by single dash (#17) [#15](https://github.com/minimistjs/minimist/issues/15)

[Tests] Remove duplicate test (#12) [#8](https://github.com/minimistjs/minimist/issues/8)

[Fix] Fix long option followed by single dash [#15](https://github.com/minimistjs/minimist/issues/15)

[Fix] opt.string works with multiple aliases (#10) [#9](https://github.com/minimistjs/minimist/issues/9)

[Fix] Fix handling of short option with non-trivial equals [#5](https://github.com/minimistjs/minimist/issues/5)

[Tests] Remove duplicate test [#8](https://github.com/minimistjs/minimist/issues/8)

[Fix] opt.string works with multiple aliases [#9](https://github.com/minimistjs/minimist/issues/9)

Commits

Merge tag 'v0.2.3' a026794

[eslint] fix indentation and whitespace 5368ca4

[eslint] fix indentation and whitespace e5f5067

[eslint] more cleanup 62fde7d

[eslint] more cleanup 36ac5d0

[meta] add auto-changelog 73923d2

[actions] add reusable workflows d80727d

[eslint] add eslint; rules to enable later are warnings 48bc06a

[eslint] fix indentation 34b0f1c

[readme] rename and add badges 5df0fe4

[Dev Deps] switch from covert to nyc a48b128

[Dev Deps] update covert, tape; remove unnecessary tap f0fb958

[meta] create FUNDING.yml; add funding in package.json 3639e0c

[meta] use npmignore to autogenerate an npmignore file be2e038

Only apps should have lockfiles 282b570

isConstructorOrProto adapted from PR ef9153f

[Dev Deps] update @ljharb/eslint-config, aud 098873c

[Dev Deps] update @ljharb/eslint-config, aud 3124ed3

[meta] add safe-publish-latest 4b927de

[Tests] add aud in posttest b32d9bd

[meta] update repo URLs f9fdfc0

[actions] Avoid 0.6 tests due to build failures ba92fe6

[Dev Deps] update tape 950eaa7

[Dev Deps] add missing npmignore dev dep 3226afa

Merge tag 'v0.2.2' 980d7ac

v1.2.7 - 2022-10-10

Commits

... (truncated)

Commits

6901ee2 v1.2.8
a026794 Merge tag 'v0.2.3'
c0b2661 v0.2.3
63b8fee [Fix] Fix long option followed by single dash (#17)
72239e6 [Tests] Remove duplicate test (#12)
34b0f1c [eslint] fix indentation
3226afa [Dev Deps] add missing npmignore dev dep
098873c [Dev Deps] update @ljharb/eslint-config, aud
9ec4d27 [Fix] Fix long option followed by single dash
ba92fe6 [actions] Avoid 0.6 tests due to build failures
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by ljharb, a new releaser for minimist since your current version.

Updates qs from 6.5.2 to 6.5.3

Changelog

Sourced from qs's changelog.

6.5.3

[Fix] parse: ignore __proto__ keys (#428)

[Fix] utils.merge: avoid a crash with a null target and a truthy non-array source

[Fix] correctly parse nested arrays

[Fix] stringify: fix a crash with strictNullHandling and a custom filter/serializeDate (#279)

[Fix] utils: merge: fix crash when source is a truthy primitive & no options are provided

[Fix] when parseArrays is false, properly handle keys ending in []

[Fix] fix for an impossible situation: when the formatter is called with a non-string value

[Fix] utils.merge: avoid a crash with a null target and an array source

[Refactor] utils: reduce observable [[Get]]s

[Refactor] use cached Array.isArray

[Refactor] stringify: Avoid arr = arr.concat(...), push to the existing instance (#269)

[Refactor] parse: only need to reassign the var once

[Robustness] stringify: avoid relying on a global undefined (#427)

[readme] remove travis badge; add github actions/codecov badges; update URLs

[Docs] Clean up license text so it’s properly detected as BSD-3-Clause

[Docs] Clarify the need for "arrayLimit" option

[meta] fix README.md (#399)

[meta] add FUNDING.yml

[actions] backport actions from main

[Tests] always use String(x) over x.toString()

[Tests] remove nonexistent tape option

[Dev Deps] backport from main

Commits

298bfa5 v6.5.3
ed0f5dc [Fix] parse: ignore __proto__ keys (#428)
691e739 [Robustness] stringify: avoid relying on a global undefined (#427)
1072d57 [readme] remove travis badge; add github actions/codecov badges; update URLs
12ac1c4 [meta] fix README.md (#399)
0338716 [actions] backport actions from main
5639c20 Clean up license text so it’s properly detected as BSD-3-Clause
51b8a0b add FUNDING.yml
45f6759 [Fix] fix for an impossible situation: when the formatter is called with a no...
f814a7f [Dev Deps] backport from main
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the npm_and_yarn group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [json-schema](https://github.com/kriszyp/json-schema) | `0.2.3` | `0.4.0` | | [jsprim](https://github.com/joyent/node-jsprim) | `1.4.1` | `1.4.2` | | [jsonpointer](https://github.com/janl/node-jsonpointer) | `4.1.0` | `5.0.1` | | [is-my-json-valid](https://github.com/mafintosh/is-my-json-valid) | `2.20.5` | `2.20.6` | | [lodash.merge](https://github.com/lodash/lodash) | `3.3.2` | `4.6.2` | | [standard](https://github.com/standard/standard) | `5.4.1` | `17.1.2` | | [qs](https://github.com/ljharb/qs) | `6.5.2` | `6.5.3` | Updates `json-schema` from 0.2.3 to 0.4.0 - [Commits](kriszyp/json-schema@v0.2.3...v0.4.0) Updates `jsprim` from 1.4.1 to 1.4.2 - [Changelog](https://github.com/TritonDataCenter/node-jsprim/blob/v1.4.2/CHANGES.md) - [Commits](TritonDataCenter/node-jsprim@v1.4.1...v1.4.2) Updates `jsonpointer` from 4.1.0 to 5.0.1 - [Release notes](https://github.com/janl/node-jsonpointer/releases) - [Commits](janl/node-jsonpointer@v4.1.0...v5.0.1) Updates `is-my-json-valid` from 2.20.5 to 2.20.6 - [Commits](mafintosh/is-my-json-valid@v2.20.5...v2.20.6) Updates `lodash.merge` from 3.3.2 to 4.6.2 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](https://github.com/lodash/lodash/commits) Updates `standard` from 5.4.1 to 17.1.2 - [Release notes](https://github.com/standard/standard/releases) - [Changelog](https://github.com/standard/standard/blob/master/CHANGELOG.md) - [Commits](standard/standard@v5.4.1...v17.1.2) Updates `minimist` from 1.2.5 to 1.2.8 - [Changelog](https://github.com/minimistjs/minimist/blob/main/CHANGELOG.md) - [Commits](minimistjs/minimist@v1.2.5...v1.2.8) Updates `qs` from 6.5.2 to 6.5.3 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.5.2...v6.5.3) --- updated-dependencies: - dependency-name: json-schema dependency-version: 0.4.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: jsprim dependency-version: 1.4.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: jsonpointer dependency-version: 5.0.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: is-my-json-valid dependency-version: 2.20.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: lodash.merge dependency-version: 4.6.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: standard dependency-version: 17.1.2 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: minimist dependency-version: 1.2.8 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.5.3 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 9, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump the npm_and_yarn group across 1 directory with 8 updates #2

Bump the npm_and_yarn group across 1 directory with 8 updates #2

Uh oh!

dependabot bot commented on behalf of github Sep 9, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Bump the npm_and_yarn group across 1 directory with 8 updates #2

Are you sure you want to change the base?

Bump the npm_and_yarn group across 1 directory with 8 updates #2

Uh oh!

Conversation

dependabot bot commented on behalf of github Sep 9, 2025

v1.4.2 (2021-11-29)

Version 5.0.1

Changelog

v5.0.0

5.0.0 (2021-10-31)

Bug Fixes

4.0.0

lodash v4.0.0

Modern only

4 kB Core

More ES6

More Modular

1st Class FP

v17.1.2

v17.1.1

v17.1.0

v17.0.0

Major changes

Changed features

v17.0.0-2

Changelog

[17.1.0] - 2023-05-29

[17.0.0] - 2022-04-20

Major changes

Changed features

[17.0.0-2] - 2022-02-03

[17.0.0-1] - 2022-01-31

[17.0.0-0] - 2022-01-31

v1.2.8 - 2023-02-09

Merged

Fixed

Commits

v1.2.7 - 2022-10-10

Commits

6.5.3

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant