build(deps): bump the npm_and_yarn group across 1 directory with 7 updates by dependabot[bot] · Pull Request #114 · mschlachter/turnip-queue

dependabot · 2026-08-19T16:37:36Z

Bumps the npm_and_yarn group with 7 updates in the / directory:

Package	From	To
brace-expansion	`1.1.12`	`1.1.18`
fast-uri	`3.1.2`	`3.1.5`
immutable	`5.1.5`	`5.1.9`
postcss	`8.5.14`	`8.5.26`
shell-quote	`1.8.4`	`1.10.0`
svgo	`2.8.2`	`2.8.3`
ws	`8.18.3`	`8.21.3`

Updates brace-expansion from 1.1.12 to 1.1.18

Release notes

Sourced from brace-expansion's releases.

v1.1.15

Backport v5.0.6 change to v1 (#111) 0b09384

juliangruber/brace-expansion@v1.1.14...v1.1.15

Commits

758fcd6 1.1.18
27fbeed Merge commit from fork
5c57cc2 1.1.17
d757f1d npm ignore .claude
cb4b9e4 fix: backport GHSA-mh99-v99m-4gvg (#129)
447763a 1.1.16
d74e630 fix: v1 backport for CVE-2026-13149 (#122)
2203f4f 1.1.15
0b09384 Backport v5.0.6 change to v1 (#111)
10c05fc 1.1.14
Additional commits viewable in compare view

Updates fast-uri from 3.1.2 to 3.1.5

Release notes

Sourced from fast-uri's releases.

v3.1.5

⚠️ Security Warning

Fix for GHSA-7p8r-x3mc-p8w7

Full Changelog: fastify/fast-uri@v3.1.4...v3.1.5

v3.1.4

⚠️ Security Release

Fix for GHSA-v2hh-gcrm-f6hx

Full Changelog: fastify/fast-uri@v3.1.3...v3.1.4

v3.1.3

⚠️ Security Release

Fixes: GHSA-4c8g-83qw-93j6

Full Changelog: fastify/fast-uri@v3.1.2...v3.1.3

Commits

5e179cb Bumped v3.1.5
2cad02d Merge commit from fork
6aeece6 Bumped v3.1.4
2d50fba fix: reject literal backslash in URI authority
0549fe3 Bumped v3.1.3
2a6d357 Merge commit from fork
See full diff in compare view

Updates immutable from 5.1.5 to 5.1.9

Release notes

Sourced from immutable's releases.

v5.1.9

What's Changed

fix(List): preserve undefined values when grown past 32 elements by @spokodev / @jdeniau in immutable-js/immutable-js#2235 (originated from immutable-js/immutable-js#2230 )

Full Changelog: immutable-js/immutable-js@v5.1.8...v5.1.9

v5.1.8

What's Changed

fix(List): guard oversized bounds in setListBounds. Fixes CVE GHSA-v56q-mh7h-f735

perf(Map): index large hash-collision buckets for faster lookups. Fixes CVE GHSA-xvcm-6775-5m9r

Full Changelog: immutable-js/immutable-js@v5.1.7...v5.1.8

v5.1.7

What's Changed

fix(Repeat): lastIndexOf returned size instead of size - 1 by @chatman-media in immutable-js/immutable-js#2227

internal

Backport tests from 6.x branch by @jdeniau in immutable-js/immutable-js#2199

fix(IndexedCollection): has(index) on a lazy Seq of unknown size now checks index existence instead of searching for a value equal to the index by @jdeniau in immutable-js/immutable-js#2203

Better type for reduce if not ininitial value is given by @jdeniau in immutable-js/immutable-js#2205

Backport test from #2193 by @jdeniau in immutable-js/immutable-js#2207

backport tests from 6.x by @jdeniau in immutable-js/immutable-js#2213

Firefox link to non-French page by @jdeniau in immutable-js/immutable-js#2219

Bump esbuild and @size-limit/preset-small-lib by @dependabot[bot] in immutable-js/immutable-js#2217

backport tests from #2210 by @jdeniau in immutable-js/immutable-js#2214

Bump shell-quote from 1.8.2 to 1.8.4 by @dependabot[bot] in immutable-js/immutable-js#2211

Bump @tootallnate/once from 2.0.0 to 2.0.1 by @dependabot[bot] in immutable-js/immutable-js#2190

Bump minimatch from 9.0.5 to 9.0.9 by @dependabot[bot] in immutable-js/immutable-js#2189

Bump @codemirror/theme-one-dark from 6.1.2 to 6.1.3 by @dependabot[bot] in immutable-js/immutable-js#2168

Bump form-data from 4.0.5 to 4.0.6 by @dependabot[bot] in immutable-js/immutable-js#2220

Bump typescript-eslint from 8.33.0 to 8.61.1 by @dependabot[bot] in immutable-js/immutable-js#2222

Bump @rollup/plugin-commonjs from 28.0.2 to 29.0.3 by @dependabot[bot] in immutable-js/immutable-js#2224

New Contributors

@chatman-media made their first contribution in immutable-js/immutable-js#2227

Full Changelog: immutable-js/immutable-js@v5.1.6...v5.1.7

v5.1.6

What's Changed

fix(reverseFactory): read reversedSequence.size in __iterator instead of this by @jdeniau in immutable-js/immutable-js#2196

... (truncated)

Changelog

Sourced from immutable's changelog.

5.1.9

fix(List): a List grown past 32 elements while all its values are undefined no longer reads those values back as null (affected get, iteration, toArray, equals and hashCode)

5.1.8

fix(List): guard oversized bounds in setListBounds. Fixes CVE GHSA-v56q-mh7h-f735

perf(Map): index large hash-collision buckets for faster lookups. Fixes CVE GHSA-xvcm-6775-5m9r

4.3.9

fix(List): guard oversized bounds in setListBounds. Fixes CVE GHSA-v56q-mh7h-f735

perf(Map): index large hash-collision buckets for faster lookups. Fixes CVE GHSA-xvcm-6775-5m9r

5.1.7

fix(Repeat): lastIndexOf returned size instead of size - 1 by @chatman-media in immutable-js/immutable-js#2227. Fixes CVE CVE-2026-29063

fix(IndexedCollection): has(index) on a lazy Seq of unknown size now checks index existence instead of searching for a value equal to the index #2203

[TypeScript]: reduce/reduceRight without an initial value now infer the result type from the collection's values when the reducer returns a value (e.g. list.reduce((a, b) => a + b) infers number), matching Array#reduce. Previously an explicit type argument was required. #2205

5.1.6

fix(reverseFactory): read reversedSequence.size in __iterator instead of this #2196

Commits

329f7a6 5.1.9
21fabd9 changelog
009164f Merge pull request #2235 from immutable-js/fix/avoid-null-when-setsize33
5b65bfb fix(List): preserve undefined values when grown past 32 elements
50bf39e Update CHANGELOG.md for versions 5.1.8 and 4.3.9
6496539 5.1.8
808a83a Merge commit from fork
e51d49f perf(Map): index large hash-collision buckets for faster lookups
25c58b0 fix typescript in tests
a1a1ee4 Merge commit from fork
Additional commits viewable in compare view

Updates postcss from 8.5.14 to 8.5.26

Release notes

Sourced from postcss's releases.

8.5.26

Fixed list.split() regression (by @lazerg).

Track symlinks in path protection in source map loading (by @drengir1).

8.5.25

Fixed 8.5.17 visitor regression.

Fixed list.split() for non-string values (by @amir-rezaei).

8.5.24

Preserve the BOM after the processing (by @hdimer).

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

Fixed declaration parsing performance (by @homanp).

Changelog

Sourced from postcss's changelog.

8.5.26

Fixed list.split() regression (by @lazerg).

Track symlinks in path protection in source map loading (by @drengir1).

8.5.25

Fixed 8.5.17 visitor regression.

Fixed list.split() for non-string values (by @amir-rezaei).

8.5.24

Preserve the BOM after the processing (by @hdimer).

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

... (truncated)

Commits

07b2577 Release 8.5.26 version
47de6b9 Update CI
1493a83 Fix Rule#selectors losing the empty selector (#2129)
180db16 Typo
29e9e00 Resolve symlinks before the previous-source-map containment check (#2125)
3ba8f84 Update dependencies
87e72f6 Update lock file
caaeeb9 Upgrade nanoid to fix infinite loop on zero size (#2124)
3609b6f Explain how to type plugin options
fbad419 docs: show ESM and TypeScript plugin declaration (#2118)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates shell-quote from 1.8.4 to 1.10.0

Changelog

Sourced from shell-quote's changelog.

v1.10.0 - 2026-07-10

Merged

[New] parse: add opt-in splitUnquoted option for shell field-splitting of unquoted expansions [#1](https://github.com/ljharb/shell-quote/issues/1)

Commits

[Fix] parse: match nested ${...} braces so nested parameter expansion is consumed as one substitution c0842c8

[Tests] parse: pin single-quote literalness and unmatched-quote handling a0d03e3

[readme] remove the space in js code fences so evalmd evaluates them 2116fa3

[Tests] quote: pin conservative escaping of =, @, ^, ,, :, ! (#11) 1c36f3f

[readme] document that quote outputs POSIX quoting, not cmd.exe/PowerShell 100e96e

[readme] document parse's supported parameter-expansion subset e1c75cd

[Fix] parse: a backslash inside single quotes must not escape the closing quote 5d460a3

[readme] fix stale example outputs 2de86f5

[Tests] quote: pin that a backslash with whitespace is not doubled in single quotes (#14) 190e236

[readme] quote: use output verbatim; do not re-quote it (#11) 1b36468

[Refactor] parse: fix swapped SINGLE_QUOTE/DOUBLE_QUOTE variable names 801af5c

[types] fix an error TS v6 ignores but v7 fails on 59bbf8b

[Dev Deps] update @arethetypeswrong/cli, evalmd a04d475

[Dev Deps] update @arethetypeswrong/ci, eslint d390f9a

[Tests] quote: the tilde test escapes every ~, not just a leading one (#9) 617d119

v1.9.0 - 2026-06-24

Commits

[New] add types dca6e21

[Dev Deps] update eslint 9aa9e8f

[Fix] parse: finalize tokens in linear time (GHSA-395f-4hp3-45gv) 7ff5488

[actions] update workflows 75e8497

[actions] Windows + node 4/6/7: pin eslint to 9 before install, since npm 2/3 cannot stage eslint 10@types/esrecurse 3fb739d

[actions] retry npm install on Windows to survive npm 2/3 staging-rename flake abe0163

[actions] Windows + node 5/7: install deps with a modern node b4bafa2

[Fix] quote: escape leading ~ to prevent shell tilde-expansion 7a76c1a

[Dev Deps] update auto-changelog, tape 7184b44

[Dev Deps] apparently jackspeak is no longer in the graph 9ba368a

Commits

64988d9 v1.10.0
617d119 [Tests] quote: the tilde test escapes every ~, not just a leading one (#9)
59bbf8b [types] fix an error TS v6 ignores but v7 fails on
190e236 [Tests] quote: pin that a backslash with whitespace is not doubled in singl...
a04d475 [Dev Deps] update @arethetypeswrong/cli, evalmd
b9545b3 [New] parse: add opt-in splitUnquoted option for shell field-splitting of...
1b36468 [readme] quote: use output verbatim; do not re-quote it (#11)
1c36f3f [Tests] quote: pin conservative escaping of =, @, ^, ,, :, ! (#11)
e1c75cd [readme] document parse's supported parameter-expansion subset
c0842c8 [Fix] parse: match nested ${...} braces so nested parameter expansion is ...
Additional commits viewable in compare view

Updates svgo from 2.8.2 to 2.8.3

Release notes

Sourced from svgo's releases.

v2.8.3

What's Changed

Security

removeScriptElement, make <script> handling namespace aware. By @SethFalco

Support

SVGO v2 is not officially supported, please consider upgrading to SVGO v4 instead. We've backported this fix as there are security implications, but there is no commitment to do this for more complex changes in future.

Consider reading our Migration Guide from v2 to v3 and Migration Guide from v3 to v4 which should ease the process.

Commits

628e3bc Merge commit from fork
See full diff in compare view

Updates ws from 8.18.3 to 8.21.3

Release notes

Sourced from ws's releases.

8.21.3

Bug fixes

The server now correctly rejects permessage-deflate offers if the incoming client_max_window_bits parameter value is smaller than its configured clientMaxWindowBits (e97a20ea).

8.21.2

Bug fixes

Fixed a test for CITGM (2eb3be0b).

8.21.1

Bug fixes

Empty fragments are now counted toward the limit (a2f4e7c0).

The default values of the maxBufferedChunks and maxFragments options have been reduced (f197ac65).

8.21.0

Features

Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.
import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});
</tr></table>

... (truncated)

Commits

c791e70 [dist] 8.21.3
e97a20e [fix] Reject offers with client_max_window_bits below config
787ebf2 [dist] 8.21.2
b4d62eb Revert "[ci] Trust Coveralls Homebrew tap"
e4bb883 [security] Use GitHub PVR as main reporting channel
2eb3be0 [test] Skip test on Node.js versions where it does not apply
ae1de54 [dist] 8.21.1
8e9511b [ci] Trust Coveralls Homebrew tap
f197ac6 [fix] Lower default values of maxBufferedChunks and maxFragments
8df8265 [ci] Update actions/checkout action to v7
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

…dates Bumps the npm_and_yarn group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.12` | `1.1.18` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.1.2` | `3.1.5` | | [immutable](https://github.com/immutable-js/immutable-js) | `5.1.5` | `5.1.9` | | [postcss](https://github.com/postcss/postcss) | `8.5.14` | `8.5.26` | | [shell-quote](https://github.com/ljharb/shell-quote) | `1.8.4` | `1.10.0` | | [svgo](https://github.com/svg/svgo) | `2.8.2` | `2.8.3` | | [ws](https://github.com/websockets/ws) | `8.18.3` | `8.21.3` | Updates `brace-expansion` from 1.1.12 to 1.1.18 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.18) Updates `fast-uri` from 3.1.2 to 3.1.5 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.2...v3.1.5) Updates `immutable` from 5.1.5 to 5.1.9 - [Release notes](https://github.com/immutable-js/immutable-js/releases) - [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md) - [Commits](immutable-js/immutable-js@v5.1.5...v5.1.9) Updates `postcss` from 8.5.14 to 8.5.26 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.14...8.5.26) Updates `shell-quote` from 1.8.4 to 1.10.0 - [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md) - [Commits](ljharb/shell-quote@v1.8.4...v1.10.0) Updates `svgo` from 2.8.2 to 2.8.3 - [Release notes](https://github.com/svg/svgo/releases) - [Commits](svg/svgo@v2.8.2...v2.8.3) Updates `ws` from 8.18.3 to 8.21.3 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.18.3...8.21.3) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 1.1.18 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: immutable dependency-version: 5.1.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.26 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: shell-quote dependency-version: 1.10.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: svgo dependency-version: 2.8.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 8.21.3 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

…9d4dc

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Aug 19, 2026

dependabot Bot mentioned this pull request Aug 19, 2026

build(deps): bump the npm_and_yarn group across 1 directory with 5 updates #112

Closed

mschlachter approved these changes Sep 8, 2026

View reviewed changes

mschlachter added 2 commits September 8, 2026 13:20

Merge branch 'master' into dependabot/npm_and_yarn/npm_and_yarn-9fec2…

69eac6c

…9d4dc

Merge branch 'master' into dependabot/npm_and_yarn/npm_and_yarn-9fec2…

7189fc1

…9d4dc

mschlachter merged commit 5b249ed into master Sep 8, 2026
1 check passed

mschlachter deleted the dependabot/npm_and_yarn/npm_and_yarn-9fec29d4dc branch September 8, 2026 17:22

Navigation Menu

Repository navigation

build(deps): bump the npm_and_yarn group across 1 directory with 7 updates - #114

build(deps): bump the npm_and_yarn group across 1 directory with 7 updates#114
mschlachter merged 3 commits into
masterfrom
dependabot/npm_and_yarn/npm_and_yarn-9fec29d4dc

dependabot Bot commented on behalf of github Aug 19, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Aug 19, 2026

v1.1.15

v3.1.5

⚠️ Security Warning

v3.1.4

⚠️ Security Release

v3.1.3

⚠️ Security Release

v5.1.9

What's Changed

v5.1.8

What's Changed

v5.1.7

What's Changed

internal

New Contributors

v5.1.6

What's Changed

5.1.9

5.1.8

4.3.9

5.1.7

5.1.6

8.5.26

8.5.25

8.5.24

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.17

8.5.16

8.5.15

8.5.26

8.5.25

8.5.24

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.17

8.5.16

v1.10.0 - 2026-07-10

Merged

Commits

v1.9.0 - 2026-06-24

Commits

v2.8.3

What's Changed

Security

Support

8.21.3

Bug fixes

8.21.2

Bug fixes

8.21.1

Bug fixes

8.21.0

Features

Bug fixes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant