Skip to content

Bump the remaining-npm group across 1 directory with 4 updates - #412

Open
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/npm_and_yarn/remaining-npm-6a2f7f171e
Open

Bump the remaining-npm group across 1 directory with 4 updates#412
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/npm_and_yarn/remaining-npm-6a2f7f171e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the remaining-npm group with 4 updates in the / directory: isomorphic-git, jose, diff3 and dompurify.

Updates isomorphic-git from 1.40.5 to 1.41.9

Release notes

Sourced from isomorphic-git's releases.

v1.41.9

1.41.9 (2026-08-23)

Bug Fixes

  • match filepaths on path component boundaries (#2416) (89d641a)

v1.41.8

1.41.8 (2026-08-21)

Bug Fixes

  • throw when TREE is given a ref that cannot be resolved (#2407) (fe987eb)

v1.41.7

1.41.7 (2026-08-19)

Bug Fixes

  • return best merge bases for DAG histories (#2412) (a7f747f)

v1.41.5

1.41.5 (2026-08-17)

Bug Fixes

  • include file mode changes in filepath log (#2413) (07c6fe7)

v1.41.4

1.41.4 (2026-08-13)

Bug Fixes

  • restore checkout filepaths from the index (#2409) (25dc739)

v1.41.3

1.41.3 (2026-08-10)

Bug Fixes

  • don't split a CRLF that straddles two chunks in splitLines (#2397) (aa6812c)

v1.41.2

1.41.2 (2026-08-09)

... (truncated)

Commits
  • 89d641a fix: match filepaths on path component boundaries (#2416)
  • fe987eb fix: throw when TREE is given a ref that cannot be resolved (#2407)
  • 0730055 docs(readme): fix ES import example using unexported 'plugins' (#2408)
  • a7f747f fix: return best merge bases for DAG histories (#2412)
  • a760325 fix: validate readObject format consistently (#2406)
  • 07c6fe7 fix: include file mode changes in filepath log (#2413)
  • 25dc739 fix: restore checkout filepaths from the index (#2409)
  • aa6812c fix: don't split a CRLF that straddles two chunks in splitLines (#2397)
  • 39a3e22 chore: build docs (#2405)
  • 0d7c8e0 fix: expose internal git lock for tests (#2404)
  • Additional commits viewable in compare view

Updates jose from 6.2.8 to 6.2.10

Release notes

Sourced from jose's releases.

v6.2.10

Fixes

  • jose: consume serialization members once (9bee285)
  • jose: reject empty protected and JWE AAD members (8da4145)
  • jose: validate serialized header values (b711d8f)
  • jwe: conceal invalid decrypted CEK lengths (41fafe0)
  • jwe: enforce AES-GCM tag boundaries (9a5b744)
  • jwe: validate explicit encryption parameters (7a02697)
  • jwk: accept empty octet-sequence keys (3f871e7)
  • jwk: normalize key resolution inputs (f54ee7b)
  • jwks: enforce verification key metadata (f9ba510)
  • jwks: order overlapping remote reloads (9a1a913)
  • jwks: reject invalid remote duration values (7bdb9e5)
  • jwk: validate ext and key_ops parameters (4d91c37)
  • jws: reject mixed payload encoding modes (dc69713)
  • jws: validate unencoded payload strings (541f282)
  • jwt: enforce explicit verification policies (b347182)
  • jwt: prevent replacing protected headers (ae07d09)
  • jwt: reject invalid duration inputs (282f9aa)
  • jwt: validate builder claim values (ea03f83)
  • jwt: validate unsecured protected headers (230c14e)
  • key: validate generation and import options (15d880e)
  • reject mixed b64 modes for empty General JWS payloads (61a2ef7)
  • x509: reject DER truncated past its outer length (d8db9f6)

Documentation

  • jwks: correct cache timestamp units (01a44d9)

Refactor

  • jose: share binary input validation (eedb124)
  • jose: share compact token processing internals (85e30ed)
  • jwe: consolidate CBC decryption failures (1ee6f61)
  • jwe: specialize compact processing (a998927)
  • jwe: streamline single-recipient encryption (290aaa6)
  • jwks: compact JWK Set shape validation (930c7df), references Array#every
  • jwks: compact local key selection (4cb5ae5)
  • jwks: compact remote resolver state (ef5eaf4)
  • jws: specialize compact processing (021abf4)
  • jwt: compact claim validation helpers (f390683)
  • jwt: consolidate replicated claim checks (7dd5591)
  • jwt: share producer claim state (52ba159)
  • key: compact JWK algorithm selection (a6b29da)
  • key: compact secret length parsing (cc03be8)

v6.2.9

Fixes

... (truncated)

Changelog

Sourced from jose's changelog.

6.2.10 (2026-08-21)

Fixes

  • jose: consume serialization members once (9bee285)
  • jose: reject empty protected and JWE AAD members (8da4145)
  • jose: validate serialized header values (b711d8f)
  • jwe: conceal invalid decrypted CEK lengths (41fafe0)
  • jwe: enforce AES-GCM tag boundaries (9a5b744)
  • jwe: validate explicit encryption parameters (7a02697)
  • jwk: accept empty octet-sequence keys (3f871e7)
  • jwk: normalize key resolution inputs (f54ee7b)
  • jwks: enforce verification key metadata (f9ba510)
  • jwks: order overlapping remote reloads (9a1a913)
  • jwks: reject invalid remote duration values (7bdb9e5)
  • jwk: validate ext and key_ops parameters (4d91c37)
  • jws: reject mixed payload encoding modes (dc69713)
  • jws: validate unencoded payload strings (541f282)
  • jwt: enforce explicit verification policies (b347182)
  • jwt: prevent replacing protected headers (ae07d09)
  • jwt: reject invalid duration inputs (282f9aa)
  • jwt: validate builder claim values (ea03f83)
  • jwt: validate unsecured protected headers (230c14e)
  • key: validate generation and import options (15d880e)
  • reject mixed b64 modes for empty General JWS payloads (61a2ef7)
  • x509: reject DER truncated past its outer length (d8db9f6)

Documentation

  • jwks: correct cache timestamp units (01a44d9)

Refactor

  • jose: share binary input validation (eedb124)
  • jose: share compact token processing internals (85e30ed)
  • jwe: consolidate CBC decryption failures (1ee6f61)
  • jwe: specialize compact processing (a998927)
  • jwe: streamline single-recipient encryption (290aaa6)
  • jwks: compact JWK Set shape validation (930c7df), references Array#every
  • jwks: compact local key selection (4cb5ae5)
  • jwks: compact remote resolver state (ef5eaf4)
  • jws: specialize compact processing (021abf4)
  • jwt: compact claim validation helpers (f390683)
  • jwt: consolidate replicated claim checks (7dd5591)
  • jwt: share producer claim state (52ba159)
  • key: compact JWK algorithm selection (a6b29da)
  • key: compact secret length parsing (cc03be8)

6.2.9 (2026-08-15)

... (truncated)

Commits
  • 3eab152 chore(release): 6.2.10
  • 021abf4 refactor(jws): specialize compact processing
  • a998927 refactor(jwe): specialize compact processing
  • eedb124 refactor(jose): share binary input validation
  • 52ba159 refactor(jwt): share producer claim state
  • 85e30ed refactor(jose): share compact token processing internals
  • 0bd81d2 test(jose): cover hidden critical-header options
  • 9cf7876 test(jose): reject callable object impostors
  • f23cafd test(jose): preserve resolved key data properties
  • 1ee6f61 refactor(jwe): consolidate CBC decryption failures
  • Additional commits viewable in compare view

Updates diff3 from 0.0.3 to 0.0.4

Commits
Maintainer changes

This version was pushed to npm by gk-dev, a new releaser for diff3 since your current version.


Updates dompurify from 3.4.13 to 3.4.14

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.14

  • Fixed an issue with possible bypasses when risky tags are allow-listed, thanks @​AlirezaRouhbakhsh
  • Fixed a couple of edge cases with mixed document contexts, thanks @​fishjojo1
  • Added the SVG pointer-events and vector-effect presentation attributes to the allow-list, thanks @​Jaybhade
  • Conducted another refactoring run, removed dead branches and duplicated logic, flattened attribute validation
  • Updated the documentation in several spots, README, wiki, etc., thanks @​Akokonunes
  • Updated several development dependencies and CI workflow actions
Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 1, 2026
@github-actions github-actions Bot added kernel Changes to the Workshop kernel gatekeeper Changes to a gatekeeper integration labels Sep 1, 2026
devin-ai-integration[bot]
devin-ai-integration Bot reviewed Sep 1, 2026
View reviewed changes

@devin-ai-integration devin-ai-integration Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

Devin Review

@ndisidore

ndisidore commented Sep 1, 2026

Copy link
Copy Markdown
Member

@dependabot rebase

@dependabot dependabot Bot changed the title Bump the remaining-npm group with 4 updates Bump the remaining-npm group across 1 directory with 4 updates Sep 1, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/remaining-npm-6a2f7f171e branch from 835b9c8 to 1c88dd7 Compare September 1, 2026 16:56
@ndisidore

ndisidore commented Sep 1, 2026

Copy link
Copy Markdown
Member

/bonk review this - looks for changelog issues that will have impacts that may not be obvious

ask-bonk[bot]
ask-bonk Bot reviewed Sep 1, 2026
View reviewed changes
Comment thread packages/workshop-backend/package.json Outdated
@ask-bonk

ask-bonk Bot commented Sep 1, 2026

Copy link
Copy Markdown

Posted 1 actionable inline finding. No other changelog-related regressions found.

github run

dependabot Bot and others added 2 commits September 1, 2026 13:56
@dependabot @ndisidore
Bump the remaining-npm group across 1 directory with 4 updates
208ae70 
Bumps the remaining-npm group with 4 updates in the / directory: [isomorphic-git](https://github.com/isomorphic-git/isomorphic-git), [jose](https://github.com/panva/jose), [diff3](https://github.com/axosoft/diff3) and [dompurify](https://github.com/cure53/DOMPurify).


Updates `isomorphic-git` from 1.40.5 to 1.41.9
- [Release notes](https://github.com/isomorphic-git/isomorphic-git/releases)
- [Commits](isomorphic-git/isomorphic-git@v1.40.5...v1.41.9)

Updates `jose` from 6.2.8 to 6.2.10
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](panva/jose@v6.2.8...v6.2.10)

Updates `diff3` from 0.0.3 to 0.0.4
- [Commits](https://github.com/axosoft/diff3/commits)

Updates `dompurify` from 3.4.13 to 3.4.14
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.13...3.4.14)

---
updated-dependencies:
- dependency-name: diff3
  dependency-version: 0.0.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: remaining-npm
- dependency-name: dompurify
  dependency-version: 3.4.14
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: remaining-npm
- dependency-name: isomorphic-git
  dependency-version: 1.41.9
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: remaining-npm
- dependency-name: jose
  dependency-version: 6.2.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: remaining-npm
...

Signed-off-by: dependabot[bot] <support@github.com>
@ndisidore
fix(workshop-backend): pin diff3 to 0.0.3
e242547
@ndisidore
ndisidore force-pushed the dependabot/npm_and_yarn/remaining-npm-6a2f7f171e branch from 1c88dd7 to e242547 Compare September 1, 2026 18:57
@ask-bonk

ask-bonk Bot commented Sep 1, 2026

Copy link
Copy Markdown

LGTM!

github run

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@devin-ai-integration devin-ai-integration[bot] devin-ai-integration[bot] left review comments
@ask-bonk ask-bonk[bot] ask-bonk[bot] left review comments
@ndisidore ndisidore ndisidore approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file gatekeeper Changes to a gatekeeper integration javascript Pull requests that update javascript code kernel Changes to the Workshop kernel

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ndisidore