Bump the npm_and_yarn group across 17 directories with 14 updates by dependabot[bot] · Pull Request #35 · magnumquest39-cloud/vscode

dependabot · 2026-07-10T23:28:39Z

Bumps the npm_and_yarn group with 8 updates in the / directory:

Package	From	To
undici	`7.26.0`	`7.28.0`
ws	`7.5.10`	`7.5.11`
ws	`8.20.1`	`8.21.0`
tar	`7.5.15`	`7.5.19`
@koa/router	`14.0.0`	`15.7.0`
form-data	`4.0.5`	`4.0.6`
hono	`4.12.18`	`4.12.29`
linkify-it	`5.0.0`	`5.0.2`
markdown-it	`14.1.1`	`14.3.0`

Bumps the npm_and_yarn group with 4 updates in the /build directory: js-yaml, form-data, linkify-it and markdown-it.
Bumps the npm_and_yarn group with 1 update in the /build/npm/gyp directory: tar.
Bumps the npm_and_yarn group with 3 updates in the /build/rspack directory: ws, http-proxy-middleware and webpack-dev-server.
Bumps the npm_and_yarn group with 11 updates in the /extensions/copilot directory:

Package	From	To
undici	`7.24.1`	`7.28.0`
ws	`8.20.1`	`8.21.0`
tar	`7.5.11`	`7.5.16`
js-yaml	`4.1.1`	`4.3.0`
form-data	`4.0.4`	`4.0.6`
hono	`4.12.18`	`4.12.29`
linkify-it	`5.0.0`	`5.0.2`
markdown-it	`14.1.1`	`14.3.0`
dompurify	`3.4.1`	`3.4.11`
protobufjs	`7.5.8`	`7.6.5`
vite	`7.3.2`	`8.1.4`

Bumps the npm_and_yarn group with 2 updates in the /extensions/copilot/chat-lib directory: undici and vite.
Bumps the npm_and_yarn group with 2 updates in the /extensions/extension-editing directory: linkify-it and markdown-it.
Bumps the npm_and_yarn group with 1 update in the /extensions/github-authentication directory: form-data.
Bumps the npm_and_yarn group with 3 updates in the /extensions/markdown-language-features directory: linkify-it, markdown-it and dompurify.
Bumps the npm_and_yarn group with 1 update in the /extensions/mermaid-markdown-features directory: dompurify.
Bumps the npm_and_yarn group with 1 update in the /extensions/microsoft-authentication directory: form-data.
Bumps the npm_and_yarn group with 1 update in the /extensions/notebook-renderers directory: undici.
Bumps the npm_and_yarn group with 1 update in the /extensions/npm directory: js-yaml.
Bumps the npm_and_yarn group with 3 updates in the /remote directory: undici, ws and tar.
Bumps the npm_and_yarn group with 2 updates in the /test/mcp directory: form-data and hono.
Bumps the npm_and_yarn group with 1 update in the /test/sanity directory: js-yaml.
Bumps the npm_and_yarn group with 1 update in the /test/smoke directory: form-data.

Updates undici from 7.26.0 to 7.28.0

Release notes

Sourced from undici's releases.

v7.28.0

⚠️ Security Release

This release line addresses 7 security advisories, all shipped in v7.28.0.
Action required: Upgrade to undici 7.28.0 or later.
npm install undici@^7.28.0
The v7 line is not affected by GHSA-38rv-x7px-6hhq (CVE-2026-9675), which is an 8.x-only regression.

Note on GHSA-hm92-r4w5-c3mj: this fix shipped in v7.28.0, not the earlier 7.2x line — the vulnerable single-pool code was still present through v7.27.2. The per-origin pool fix is 3805b8f8 (#5041).

Summary

Advisory CVE Severity (CVSS) Fixed in Fix commit

GHSA-vxpw-j846-p89q CVE-2026-12151 High (7.5) 7.28.0 8cb10f98

GHSA-vmh5-mc38-953g CVE-2026-9697 High (7.4) 7.28.0 04201f89

GHSA-hm92-r4w5-c3mj CVE-2026-6734 High (7.5) 7.28.0 3805b8f8

GHSA-pr7r-676h-xcf6 CVE-2026-9678 Moderate (5.9) 7.28.0 85a24055

GHSA-p88m-4jfj-68fv CVE-2026-9679 Moderate (5.9) 7.28.0 d0574cc4

GHSA-g8m3-5g58-fq7m CVE-2026-11525 Low (3.7) 7.28.0 d0574cc4

GHSA-35p6-xmwp-9g52 CVE-2026-6733 Low (3.7) 7.28.0 ea8930cf

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

GHSA-vxpw-j846-p89q · CWE-400, CWE-770 Fix: 8cb10f98 websocket: limit the number of fragments in a message (part of backport a027a4a0 Backport WebSocket maxPayloadSize fixes to v7.x, #5423)

A malicious WebSocket server can stream a large number of small or empty continuation frames. Undici enforced a limit on cumulative payload size but did not limit the number of fragments per message, leading to unbounded memory growth and denial of service.

Affected: applications using new WebSocket(...) or WebSocketStream against untrusted endpoints.

Workaround: none — upgrade is required.

TLS certificate validation bypass in SOCKS5 ProxyAgent — CVE-2026-9697

GHSA-vmh5-mc38-953g · CWE-295

... (truncated)

Commits

f9eba0a Bumped v7.28.0 (#5430)
a027a4a Backport WebSocket maxPayloadSize fixes to v7.x (#5423)
8cb10f9 websocket: limit the number of fragments in a message
04201f8 fix: honor requestTls when proxy is SOCKS5
fcd642f fix(socks5): preserve dispatch backpressure return value (#5166)
bc98c97 fix(socks5): use configured connector in Socks5ProxyAgent (#5168)
9e1c743 fix(socks5): encode embedded IPv4 tails in IPv6 literals correctly (#5099)
376c8be fix(socks5): enforce authenticated state before CONNECT (#5097)
3805b8f fix(socks5-proxy-agent): use per-origin pools to prevent cross-origin routing...
85a2405 fix(cache): trim qualified field names
Additional commits viewable in compare view

Updates ws from 7.5.10 to 7.5.11

Release notes

Sourced from ws's releases.

7.5.11

Bug fixes

Backported 2b2abd45 to the 7.x release line (e14c4586).

Commits

fd36cd8 [dist] 7.5.11
e14c458 [security] Limit retained message parts
See full diff in compare view

Updates ws from 8.20.1 to 8.21.0

Release notes

Sourced from ws's releases.

7.5.11

Bug fixes

Backported 2b2abd45 to the 7.x release line (e14c4586).

Commits

fd36cd8 [dist] 7.5.11
e14c458 [security] Limit retained message parts
See full diff in compare view

Updates tar from 7.5.15 to 7.5.19

Commits

be440da 7.5.19
2812e93 add maxDecompressionRatio guard against explosive decompression
9ecd4d2 7.5.18
9e78bf0 refuse to let header size be less than 0
e02a4e9 pax: parse values according to known types
9cbdb31 7.5.17
7a635c2 terminate pax strings on nul bytes
cf21338 7.5.16
21a8220 do not apply PAX header fields to meta entries
52632cf update project deps
Additional commits viewable in compare view

Updates @koa/router from 14.0.0 to 15.7.0

Release notes

Sourced from @koa/router's releases.

v15.7.0

chore: bump all deps + format code 21cc4a2

koajs/router@v15.6.0...v15.7.0

v15.6.0

ci: drop node v20 from ci pipeline b5f9b6c

chore: update *.md docs files d586f45

chore: add more tests + bump deps 7148fd1

fix: hide internal rest param from prefixed middleware 99a6ae6

koajs/router@v15.5.0...v15.6.0

v15.5.0

feat(exclusive): add 'specificity' mode for OpenAPI-compliant route selection or related cases - feat #226 e2c772c

fix(prefix): guard strip with segment-boundary check to prevent path corruption - fix #232 8c60199

chore: bump deps 237e91b

chore(deps): bump flatted from 3.4.1 to 3.4.2 (#228) cd9920a

chore(deps): bump lodash from 4.17.23 to 4.18.1 (#230) 71471f7

chore(deps): bump path-to-regexp from 8.3.0 to 8.4.0 (#229) 58d7054

koajs/router@v15.4.0...v15.5.0

v15.4.0

feat: add router event system and ctx.routeMatched for not-found handling 54821e3

koajs/router@v15.3.2...v15.4.0

v15.3.2

chore: bump deps 0d4e9b3

Remove errant question mark for Optional parameter 6166894

koajs/router@v15.3.1...v15.3.2

v15.3.1

chore: add release script 8d83fb7

chore: bump devDeps to latest version and cleanup the yarn.lock file 2426f7c

chore: fix the c8 upgrade issue with cjs aedcd8c

chore: update devDeps d5240ad

... (truncated)

Commits

2db7278 v15.7.0
21cc4a2 chore: bump all deps + format code
5b989fe v15.6.0
b5f9b6c ci: drop node v20 from ci pipeline
d586f45 chore: update *.md docs files
7148fd1 chore: add more tests + bump deps
99a6ae6 fix: hide internal rest param from prefixed middleware
67fafbc v15.5.0
e2c772c feat(exclusive): add 'specificity' mode for OpenAPI-compliant route selection...
8c60199 fix(prefix): guard strip with segment-boundary check to prevent path corrupti...
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by 3imed-jaberi, a new releaser for @koa/router since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates form-data from 4.0.5 to 4.0.6

Changelog

Sourced from form-data's changelog.

v4.0.6 - 2026-06-12

Commits

[Fix] escape CR, LF, and " in field names and filenames 8dff42c

[Dev Deps] update @ljharb/eslint-config, auto-changelog, tape f31d21e

[Deps] update hasown, mime-types 92ae0eb

[Dev Deps] update js-randomness-predictor 67b0f65

Commits

64190db v4.0.6
92ae0eb [Deps] update hasown, mime-types
f31d21e [Dev Deps] update @ljharb/eslint-config, auto-changelog, tape
8dff42c [Fix] escape CR, LF, and " in field names and filenames
67b0f65 [Dev Deps] update js-randomness-predictor
See full diff in compare view

Updates hono from 4.12.18 to 4.12.29

Release notes

Sourced from hono's releases.

v4.12.29

What's Changed

fix(client): merge function headers with per-request headers by @yusukebe in honojs/hono#5092

chore: fix no-op tsc in test script by @yusukebe in honojs/hono#5093

fix(lambda-edge): resolve the handler with the value passed to the callback by @yusukebe in honojs/hono#5094

docs(language): add JSDoc @example to languageDetector by @codebybilal18 in honojs/hono#5081

test(workerd): add compatibilityDate by @yusukebe in honojs/hono#5100

fix(lambda-edge): base64 encode content-encoded response bodies by @yusukebe in honojs/hono#5099

fix(aws-lambda): treat any non-identity content-encoding as binary by @yusukebe in honojs/hono#5101

fix(types): strip extra properties from array types in JSONParsed by @Arman-Luthra in honojs/hono#5103

fix(trie-router): match empty wildcard remainder after regexp param by @usualoma in honojs/hono#5102

fix(etag): treat If-None-Match: * as a match by @yusukebe in honojs/hono#5084

New Contributors

@codebybilal18 made their first contribution in honojs/hono#5081

@Arman-Luthra made their first contribution in honojs/hono#5103

Full Changelog: honojs/hono@v4.12.28...v4.12.29

v4.12.28

What's Changed

fix(serve-static): treat empty string content as found by @yusukebe in honojs/hono#5062

docs(MIGRATION): fix req.raw.headers reference (property, not method) by @EduardF1 in honojs/hono#5047

chore: don't publish *.tsbuildinfo by @yusukebe in honojs/hono#5066

fix(utils/body,validator): normalize Content-Type media type for case-insensitive matching by @yusukebe in honojs/hono#5067

fix: avoid circular dependency between body.ts and request.ts by @usualoma in honojs/hono#5071

fix(bun): report the requested subprotocol on WSContext.protocol by @greymoth-jp in honojs/hono#5059

chore: bump devDependencies by @yusukebe in honojs/hono#5085

fix(aws-lambda): detect V2 events by request context, not rawPath alone by @VihaanAgarwal in honojs/hono#5033

docs(context-storage): fix JSDoc by @yusukebe in honojs/hono#5086

New Contributors

@EduardF1 made their first contribution in honojs/hono#5047

@greymoth-jp made their first contribution in honojs/hono#5059

@VihaanAgarwal made their first contribution in honojs/hono#5033

Full Changelog: honojs/hono@v4.12.27...v4.12.28

v4.12.27

Security fixes

This release includes fixes for the following security issues:

hono/jsx does not isolate context per request

Affects: hono/jsx, hono/jsx-renderer. During SSR, context was stored process-wide instead of per request, so useContext()/useRequestContext() read after an await in an async component could return another concurrent request's value — leading to cross-request data disclosure or authorization checks against the wrong request. GHSA-hvrm-45r6-mjfj

Server-Side XSS via JSX escaping bypass in cx()

Affects: hono/css. cx() marked its composed class name as already-escaped without escaping the input, so untrusted input passed as a class name could break out of the JSX class attribute during SSR and inject markup (XSS). GHSA-w62v-xxxg-mg59

... (truncated)

Commits

cda1af2 4.12.29
2126289 fix(etag): treat If-None-Match: * as a match (#5084)
0fc7ffc fix(trie-router): match empty wildcard remainder after regexp param (#5102)
ab590e4 fix(types): strip extra properties from array types in JSONParsed (#5103)
b93a254 fix(aws-lambda): treat any non-identity content-encoding as binary (#5101)
6217f4b fix(lambda-edge): base64 encode content-encoded response bodies (#5099)
ba89e97 test(workerd): add compatibilityDate (#5100)
46557ef docs(language): add JSDoc @example to languageDetector (#5081)
24547a6 fix(lambda-edge): resolve the handler with the value passed to the callback (...
9c6ccd7 chore: fix no-op tsc in test script (#5093)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for hono since your current version.

Updates linkify-it from 5.0.0 to 5.0.2

Changelog

Sourced from linkify-it's changelog.

5.0.2 / 2026-07-02

Fixed DoS in mailto: links (restrict user name to 64 chars).

Restricted user/pass part length in links.

5.0.1 / 2026-05-23

Fixed DoS in fuzzy links/emails search.

Reworked search logic - check each pattern separate, use g regexes instead of slice.

Removed internal cache - useless overcomplication.

Commits

50a0c91 5.0.2 released
de3b885 Update package hooks
13effaa Add package lock
39d748d Bump c8
00ce877 Drop tlds deps
ecde823 Update benchmark to mitata
23c62cd Refactor demo / doc build and publish
fd63f3b CI config update
f4ea5af demo: update bootstrap & layout
1454fb6 lint: dim warnings
Additional commits viewable in compare view

Updates markdown-it from 14.1.1 to 14.3.0

Changelog

Sourced from markdown-it's changelog.

[14.3.0] - 2026-07-02

Changed

Reworked build pipeline & tools.

Added source maps.

Bumped linkify-it to 5.0.2.

Fixed

Preserve backslash-space hard line breaks, matching CommonMark 6.7, #1185.

[14.2.0] - 2026-05-24

Added

isPunctCharCode to utilities.

Fixed

Don't end HTML comment blocks on a blank line, #1155.

Properly recognize astral chars (surrogates) in delimiter scans for emphasis-like markers, #1072. Big thanks to @tats-u for his global efforts with improving CJK support.

Preserve unicode whitespaces when trimm headings/paragraphs, #1074.

More strict entities decode to avoid false positives ;, #1096.

Restore block parser state on fail in lheading rule, #1131.

Security

Fixed poor smartquotes perfomance on > 70k quotes in single block

Bumped linkify-it to 5.0.1 with fixed potential perfomance issues.

Commits

ff0ee08 14.3.0 released
52e2749 Bump linkify-it / vite deps
56c2404 fix: keep backslash-space hard line break (CommonMark 6.7) (#1185)
0fbb18b Bump vite from 8.0.14 to 8.0.16 (#1181)
83450e2 Rework benchmark deps and bump versions
57a6863 benchmark => tinybench
7608db1 Update CI config
9d8eb42 Added package-lock and updated versions to latest possible
0aee70d lint: enable @stylistic/no-multi-spaces rule
8878985 lint => neostandard
Additional commits viewable in compare view

Updates js-yaml from 4.1.1 to 4.3.0

Changelog

Sourced from js-yaml's changelog.

4.3.0, 3.15.0 - 2026-06-27

Security

Backported maxTotalMergeKeys option.

[5.2.0] - 2026-06-26

Added

Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.

Added maxAliases (-1) loader option to limit the number of YAML aliases per document.

Removed

maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

Fixed

Round-trip of integers with exponential form (>= 1e21)

[5.1.0] - 2026-06-23

Added

Collection tags can finalize an incrementally populated carrier into a different result value.

Changed

[breaking] quoteStyle now selects the preferred quote style; use the restored forceQuotes option to force quoting non-key strings.

[5.0.0] - 2026-06-20

Added

Added named exports for schemas, tags, parser events and AST utilities.

Reworked JSON_SCHEMA and CORE_SCHEMA with spec-compliant scalar resolution rules, and added YAML11_SCHEMA.

Added realMapTag for lossless mappings with non-string and complex keys. Object-based mappings now reject complex keys instead of stringifying them.

Added dump() transform option for changing the generated AST before rendering.

Added dump() options seqInlineFirst, flowBracketPadding, flowSkipCommaSpace, flowSkipColonSpace, quoteFlowKeys, quoteStyle and tagBeforeAnchor.

Added formal data layers (events and AST) for modular data pipelines.

Added low-level parser (to events), presenter and visitor APIs.

Added the YAML Test Suite to the test set.

Changed

See the migration guide for upgrade notes.

Rewritten in TypeScript and reorganized the public API around flat named exports.

... (truncated)

Commits

33d05b5 4.3.0 released
663bfab Drop demo publish, to not override new v5 one.
1cb8c7b Add v4-legacy tag for publish
02f27af Restore umd builds back to es5
8be84ed Fix es5 compatibility
59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
6842ef6 doc polish
590dbab 4.2.0 released
f944dc5 Add package.json funding field
f692719 Changelog update
Additional commits viewable in compare view

Updates form-data from 4.0.5 to 4.0.6

Changelog

Sourced from form-data's changelog.

v4.0.6 - 2026-06-12

Commits

[Fix] escape CR, LF, and " in field names and filenames 8dff42c

[Dev Deps] update @ljharb/eslint-config, auto-changelog, tape f31d21e

[Deps] update hasown, mime-types 92ae0eb

[Dev Deps] update js-randomness-predictor 67b0f65

Commits

64190db v4.0.6
92ae0eb [Deps] update hasown, mime-types
f31d21e [Dev Deps] update @ljharb/eslint-config, auto-changelog, tape
8dff42c [Fix] escape CR, LF, and " in field names and filenames
67b0f65 [Dev Deps] update js-randomness-predictor
See full diff in compare view

Updates linkify-it from 5.0.0 to 5.0.2

Changelog

Sourced from linkify-it's changelog.

5.0.2 / 2026-07-02

Fixed DoS in mailto: links (restrict user name to 64 chars).

Restricted user/pass part length in links.

5.0.1 / 2026-05-23

Fixed DoS in fuzzy links/emails search.

Reworked search logic - check each pattern separate, use g regexes instead of slice.

Removed internal cache - useless overcomplication.

Commits

50a0c91 5.0.2 released
de3b885 Update package hooks
13effaa Add package lock
39d748d Bump c8
00ce877 Drop tlds deps
ecde823 Update benchmark to mitata
23c62cd Refactor demo / doc build and publish
fd63f3b CI config update
f4ea5af demo: update bootstrap & layout
1454fb6 lint: dim warnings
Additional commits viewable in compare view

Updates markdown-it from 14.1.1 to 14.3.0

Changelog

Sourced from markdown-it's changelog.

[14.3.0] - 2026-07-02

Changed

Reworked build pipeline & tools.

Added source maps.

Bumped linkify-it to 5.0.2.

Fixed

Preserve backslash-space hard line breaks, matching CommonMark 6.7, #1185.

[14.2.0] - 2026-05-24

Added

isPunctCharCode to utilities.

Fixed

Don't end HTML comment blocks on a blank line, #1155.

Properly recognize astral chars (surrogates) in delimiter scans for emphasis-like markers, #1072. Big thanks to @tats-u for his global efforts with improving CJK support.

Preserve unicode whitespaces when trimm headings/paragraphs, #1074.

More strict entities decode to avoid false positives ;, #1096.

Restore block parser state on fail in lheading rule, #1131.

Security

Fixed poor smartquotes perfomance on > 70k quotes in single block

Bumped linkify-it to 5.0.1 with fixed potential perfomance issues.

Commits

ff0ee08 14.3.0 released
52e2749 Bump linkify-it / vite deps
56c2404 fix: keep backslash-space hard line break (CommonMark 6.7) (#1185)
0fbb18b Bump vite from 8.0.14 to 8.0.16 (#1181)
83450e2 Rework benchmark deps and bump versions
57a6863 benchmark => tinybench
7608db1 Update CI config
9d8eb42 Added package-lock and updated versions to latest possible
0aee70d lint: enable @stylistic/no-multi-spaces rule
8878985 lint => neostandard
Additional commits viewable in compare view

Updates tar from 7.5.11 to 7.5.19

Commits

be440da 7.5.19
2812e93 add maxDecompressionRatio guard against explosive decompression
9ecd4d2 7.5.18
9e78bf0 refuse to let header size be less than 0
e02a4e9 pax: parse values according to known types
9cbdb31 7.5.17
7a635c2 terminate pax strings on nul bytes
cf21338 7.5.16
21a8220 do not apply PAX header fields to meta entries
52632cf update project deps
Additional commits viewable in compare view

Updates ws from 8.20.1 to 8.21.0

Release notes

Sourced from ws's releases.

7.5.11

Bug fixes

Backported 2b2abd45 to the 7.x release line (e14c4586).

Commits

fd36cd8 [dist] 7.5.11
e14c458 [security] Limit retained message parts
See full diff in compare view

Updates ws from 7.5.10 to 7.5.11

Release notes

Sourced from ws's releases.

7.5.11

Bug fixes

Backported 2b2abd45 to the 7.x release line (e14c4586).

Commits

fd36cd8 [dist] 7.5.11
e14c458 [security] Limit retained message parts
See full diff in compare view

Updates http-proxy-middleware from 2.0.9 to 2.0.10

Release notes

Sourced from http-proxy-middleware's releases.

v2.0.10-beta.0

What's Changed

fix: harden proxy-table matching to prevent routing bypass by @G-Rath in chimurai/http-proxy-middleware#1268

ci(github-actions): update publish.yml by @chimurai in chimurai/http-proxy-middleware#1270

New Contributors

@G-Rath made their first contribution in chimurai/http-proxy-middleware#1268

Full Changelog: chimurai/http-proxy-middleware@v2.0.9...v2.0.10-beta.0

Changelog

Sourced from http-proxy-middleware's changelog.

v2.0.10

fix(router): harden proxy-table matching (exact host for host+path keys, prefix-only path matching) to prevent routing bypass

Commits

f0be839 chore(package.json): v2.0.10 (#1271)
19c860d ci(github-actions): update publish.yml (#1270)
d0f7d63 fix: harden proxy-table matching to prevent routing bypass (#1268)
See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for http-proxy-middleware since your current version.

Removes webpack-dev-server

Updates undici from 7.24.1 to 7.28.0

Release notes

Sourced from undici's releases.

v7.28.0

⚠️ Security Release

This release line addresses 7 security advisories, all shipped in v7.28.0.
Action required: Upgrade to undici 7.28.0 or later.
npm install undici@^7.28.0
The v7 line is not affected by GHSA-38rv-x7px-6hhq (CVE-2026-9675), which is an 8.x-only regression.

Note on GHSA-hm92-r4w5-c3mj: this fix shipped in v7.28.0, not the earlier 7.2x line — the vulnerable single-pool code was still present through v7.27.2. The per-origin pool fix is 3805b8f8 (#5041).

Summary

Advisory CVE Severity (CVSS) Fixed in Fix commit

GHSA-vxpw-j846-p89q CVE-2026-12151 High (7.5) 7.28.0 8cb10f98

GHSA-vmh5-mc38-953g CVE-2026-9697 High (7.4) 7.28.0 04201f89

GHSA-hm92-r4w5-c3mj CVE-2026-6734 High (7.5) 7.28.0 3805b8f8

GHSA-pr7r-676h-xcf6 CVE-2026-9678 Moderate (5.9) 7.28.0 85a24055

GHSA-p88m-4jfj-68fv CVE-2026-9679 Moderate (5.9) 7.28.0 d0574cc4

GHSA-g8m3-5g58-fq7m CVE-2026-11525 Low (3.7) 7.28.0 d0574cc4

GHSA-35p6-xmwp-9g52 CVE-2026-6733 Low (3.7) 7.28.0 ea8930cf

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

GHSA-vxpw-j846-p89q · CWE-400, CWE-770 Fix: 8cb10f98 websocket: limit the number of fragments in a message (part of backport a027a4a0 Backport WebSocket maxPayloadSize fixes to v7.x, #5423)

A malicious WebSocket server can stream a large number of small or empty continuation frames. Undici enforced a limit on cumulative payload size but did not limit the number of fragments per message, leading to unbounded memory growth and denial of service.

Affected: applications using new WebSocket(...) or WebSocketStream against untrusted endpoints.

Workaround: none — upgrade is required.

TLS certificate validation bypass in SOCKS5 ProxyAgent — CVE-2026-9697

GHSA-vmh5-mc38-953g · CWE-295

... (truncated)

Commits

f9eba0a Bumped v7.28.0 (#5430)
a027a4a Backport WebSocket maxPayloadSize fixes to v7.x (#5423)
8cb10f9 websocket: limit the number of fragments in a message
04201f8 fix: honor requestTls when proxy is SOCKS5
fcd642f fix(socks5): preserve dispatch backpressure return value (#5166)
bc98c97 fix(socks5): use configured connector in Socks5ProxyAgent (#5168)
9e1c743 fix(socks5): encode embedded IPv4 tails in IPv6 literals correctly (#5099)
376c8be fix(socks5): enforce authenticated state before CONNECT (#5097)
3805b8f fix(socks5-proxy-agent): use per-origin pools to prevent cross-origin routing...
85a2405 fix(cache): trim qualified field names
Additional commits viewable in compare view

Updates ws from 8.20.1 to 8.21.0

Release notes

Sourced from ws's releases.Description has been truncated

Summary by cubic

Update dependencies across the repo to address recent security advisories and keep tooling current. Key upgrades include undici 7.28.0, ws 8.21.0/7.5.11, linkify-it 5.0.2, markdown-it 14.3.0, tar 7.5.19, and dompurify 3.4.11. Also removes webpack-dev-server from build/rspack and bumps @rspack/cli to 2.1.3.

Dependencies

undici → 7.28.0 (security release; WebSocket fragment limit, SOCKS5 TLS fix).

ws → 8.21.0 and 7.5.11 (security: limit retained message parts).

linkify-it → 5.0.2 (DoS fixes; stricter link parsing).

markdown-it → 14.3.0 (CommonMark 6.7 hard line breaks; updated linkify-it).

tar → 7.5.19 (adds maxDecompressionRatio; header parsing hardening).

js-yaml → 4.3.0 (new limits; drops esprima; uses argparse 2.x).

dompurify → 3.4.11 (bug/security fixes).

@koa/router → 15.7.0, koa → 3.2.1, path-to-regexp → 8.4.2.

http-proxy-middleware → 2.0.10 (router matching hardening).

Tooling: @vscode/test-web → 0.0.81, Playwright → 1.61.x, proxy-agents → 9.x.

Copilot: vite → 8.1.4, vitest → 4.1.10, @vitest/coverage-v8 → 4.1.10.

Rspack: @rspack/cli → 2.1.3; removed webpack-dev-server.

Migration

Ensure Node 20+ (required by undici, @koa/router, and updated tooling).

Verify markdown-it plugins with 14.x (mdurl 2.x, linkify-it 5.x).

Check vite 8.x and vitest 4.x configs in extensions/copilot.

Use @rspack/cli for dev server; remove any webpack-dev-server references.

^{Written for commit b0a6d6d. Summary will update on new commits.}

Bumps the npm_and_yarn group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [undici](https://github.com/nodejs/undici) | `7.26.0` | `7.28.0` | | [ws](https://github.com/websockets/ws) | `7.5.10` | `7.5.11` | | [ws](https://github.com/websockets/ws) | `8.20.1` | `8.21.0` | | [tar](https://github.com/isaacs/node-tar) | `7.5.15` | `7.5.19` | | [@koa/router](https://github.com/koajs/router) | `14.0.0` | `15.7.0` | | [form-data](https://github.com/form-data/form-data) | `4.0.5` | `4.0.6` | | [hono](https://github.com/honojs/hono) | `4.12.18` | `4.12.29` | | [linkify-it](https://github.com/markdown-it/linkify-it) | `5.0.0` | `5.0.2` | | [markdown-it](https://github.com/markdown-it/markdown-it) | `14.1.1` | `14.3.0` | Bumps the npm_and_yarn group with 4 updates in the /build directory: [js-yaml](https://github.com/nodeca/js-yaml), [form-data](https://github.com/form-data/form-data), [linkify-it](https://github.com/markdown-it/linkify-it) and [markdown-it](https://github.com/markdown-it/markdown-it). Bumps the npm_and_yarn group with 1 update in the /build/npm/gyp directory: [tar](https://github.com/isaacs/node-tar). Bumps the npm_and_yarn group with 3 updates in the /build/rspack directory: [ws](https://github.com/websockets/ws), [http-proxy-middleware](https://github.com/chimurai/http-proxy-middleware) and [webpack-dev-server](https://github.com/webpack/webpack-dev-server). Bumps the npm_and_yarn group with 11 updates in the /extensions/copilot directory: | Package | From | To | | --- | --- | --- | | [undici](https://github.com/nodejs/undici) | `7.24.1` | `7.28.0` | | [ws](https://github.com/websockets/ws) | `8.20.1` | `8.21.0` | | [tar](https://github.com/isaacs/node-tar) | `7.5.11` | `7.5.16` | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.1` | `4.3.0` | | [form-data](https://github.com/form-data/form-data) | `4.0.4` | `4.0.6` | | [hono](https://github.com/honojs/hono) | `4.12.18` | `4.12.29` | | [linkify-it](https://github.com/markdown-it/linkify-it) | `5.0.0` | `5.0.2` | | [markdown-it](https://github.com/markdown-it/markdown-it) | `14.1.1` | `14.3.0` | | [dompurify](https://github.com/cure53/DOMPurify) | `3.4.1` | `3.4.11` | | [protobufjs](https://github.com/protobufjs/protobuf.js) | `7.5.8` | `7.6.5` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `7.3.2` | `8.1.4` | Bumps the npm_and_yarn group with 2 updates in the /extensions/copilot/chat-lib directory: [undici](https://github.com/nodejs/undici) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). Bumps the npm_and_yarn group with 2 updates in the /extensions/extension-editing directory: [linkify-it](https://github.com/markdown-it/linkify-it) and [markdown-it](https://github.com/markdown-it/markdown-it). Bumps the npm_and_yarn group with 1 update in the /extensions/github-authentication directory: [form-data](https://github.com/form-data/form-data). Bumps the npm_and_yarn group with 3 updates in the /extensions/markdown-language-features directory: [linkify-it](https://github.com/markdown-it/linkify-it), [markdown-it](https://github.com/markdown-it/markdown-it) and [dompurify](https://github.com/cure53/DOMPurify). Bumps the npm_and_yarn group with 1 update in the /extensions/mermaid-markdown-features directory: [dompurify](https://github.com/cure53/DOMPurify). Bumps the npm_and_yarn group with 1 update in the /extensions/microsoft-authentication directory: [form-data](https://github.com/form-data/form-data). Bumps the npm_and_yarn group with 1 update in the /extensions/notebook-renderers directory: [undici](https://github.com/nodejs/undici). Bumps the npm_and_yarn group with 1 update in the /extensions/npm directory: [js-yaml](https://github.com/nodeca/js-yaml). Bumps the npm_and_yarn group with 3 updates in the /remote directory: [undici](https://github.com/nodejs/undici), [ws](https://github.com/websockets/ws) and [tar](https://github.com/isaacs/node-tar). Bumps the npm_and_yarn group with 2 updates in the /test/mcp directory: [form-data](https://github.com/form-data/form-data) and [hono](https://github.com/honojs/hono). Bumps the npm_and_yarn group with 1 update in the /test/sanity directory: [js-yaml](https://github.com/nodeca/js-yaml). Bumps the npm_and_yarn group with 1 update in the /test/smoke directory: [form-data](https://github.com/form-data/form-data). Updates `undici` from 7.26.0 to 7.28.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.26.0...v7.28.0) Updates `ws` from 7.5.10 to 7.5.11 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@7.5.10...7.5.11) Updates `ws` from 8.20.1 to 8.21.0 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@7.5.10...7.5.11) Updates `tar` from 7.5.15 to 7.5.19 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v7.5.15...v7.5.19) Updates `@koa/router` from 14.0.0 to 15.7.0 - [Release notes](https://github.com/koajs/router/releases) - [Commits](koajs/router@v14.0.0...v15.7.0) Updates `form-data` from 4.0.5 to 4.0.6 - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v4.0.5...v4.0.6) Updates `hono` from 4.12.18 to 4.12.29 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.18...v4.12.29) Updates `linkify-it` from 5.0.0 to 5.0.2 - [Changelog](https://github.com/markdown-it/linkify-it/blob/master/CHANGELOG.md) - [Commits](markdown-it/linkify-it@5.0.0...5.0.2) Updates `markdown-it` from 14.1.1 to 14.3.0 - [Changelog](https://github.com/markdown-it/markdown-it/blob/master/CHANGELOG.md) - [Commits](markdown-it/markdown-it@14.1.1...14.3.0) Updates `js-yaml` from 4.1.1 to 4.3.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.1...4.3.0) Updates `form-data` from 4.0.5 to 4.0.6 - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v4.0.5...v4.0.6) Updates `linkify-it` from 5.0.0 to 5.0.2 - [Changelog](https://github.com/markdown-it/linkify-it/blob/master/CHANGELOG.md) - [Commits](markdown-it/linkify-it@5.0.0...5.0.2) Updates `markdown-it` from 14.1.1 to 14.3.0 - [Changelog](https://github.com/markdown-it/markdown-it/blob/master/CHANGELOG.md) - [Commits](markdown-it/markdown-it@14.1.1...14.3.0) Updates `tar` from 7.5.11 to 7.5.19 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v7.5.15...v7.5.19) Updates `ws` from 8.20.1 to 8.21.0 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@7.5.10...7.5.11) Updates `ws` from 7.5.10 to 7.5.11 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@7.5.10...7.5.11) Updates `http-proxy-middleware` from 2.0.9 to 2.0.10 - [Release notes](https://github.com/chimurai/http-proxy-middleware/releases) - [Changelog](https://github.com/chimurai/http-proxy-middleware/blob/v2.0.10/CHANGELOG.md) - [Commits](chimurai/http-proxy-middleware@v2.0.9...v2.0.10) Removes `webpack-dev-server` Updates `undici` from 7.24.1 to 7.28.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.26.0...v7.28.0) Updates `ws` from 8.20.1 to 8.21.0 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@7.5.10...7.5.11) Updates `tar` from 7.5.11 to 7.5.16 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v7.5.15...v7.5.19) Updates `js-yaml` from 4.1.1 to 4.3.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.1...4.3.0) Updates `form-data` from 4.0.4 to 4.0.6 - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v4.0.5...v4.0.6) Updates `hono` from 4.12.18 to 4.12.29 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.18...v4.12.29) Updates `linkify-it` from 5.0.0 to 5.0.2 - [Changelog](https://github.com/markdown-it/linkify-it/blob/master/CHANGELOG.md) - [Commits](markdown-it/linkify-it@5.0.0...5.0.2) Updates `markdown-it` from 14.1.1 to 14.3.0 - [Changelog](https://github.com/markdown-it/markdown-it/blob/master/CHANGELOG.md) - [Commits](markdown-it/markdown-it@14.1.1...14.3.0) Updates `dompurify` from 3.4.1 to 3.4.11 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.4.1...3.4.11) Updates `protobufjs` from 7.5.8 to 7.6.5 - [Release notes](https://github.com/protobufjs/protobuf.js/releases) - [Changelog](https://github.com/protobufjs/protobuf.js/blob/protobufjs-v7.6.5/CHANGELOG.md) - [Commits](protobufjs/protobuf.js@protobufjs-v7.5.8...protobufjs-v7.6.5) Updates `vite` from 7.3.2 to 8.1.4 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.1.4/packages/vite) Updates `undici` from 7.24.1 to 7.28.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.26.0...v7.28.0) Updates `vite` from 7.3.2 to 7.3.6 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.1.4/packages/vite) Updates `linkify-it` from 3.0.3 to 5.0.2 - [Changelog](https://github.com/markdown-it/linkify-it/blob/master/CHANGELOG.md) - [Commits](markdown-it/linkify-it@5.0.0...5.0.2) Updates `markdown-it` from 12.3.2 to 14.3.0 - [Changelog](https://github.com/markdown-it/markdown-it/blob/master/CHANGELOG.md) - [Commits](markdown-it/markdown-it@14.1.1...14.3.0) Updates `markdown-it` from 12.3.2 to 14.3.0 - [Changelog](https://github.com/markdown-it/markdown-it/blob/master/CHANGELOG.md) - [Commits](markdown-it/markdown-it@14.1.1...14.3.0) Updates `form-data` from 3.0.4 to 3.0.5 - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v4.0.5...v4.0.6) Updates `linkify-it` from 3.0.3 to 5.0.2 - [Changelog](https://github.com/markdown-it/linkify-it/blob/master/CHANGELOG.md) - [Commits](markdown-it/linkify-it@5.0.0...5.0.2) Updates `markdown-it` from 12.3.2 to 14.3.0 - [Changelog](https://github.com/markdown-it/markdown-it/blob/master/CHANGELOG.md) - [Commits](markdown-it/markdown-it@14.1.1...14.3.0) Updates `markdown-it` from 12.3.2 to 14.3.0 - [Changelog](https://github.com/markdown-it/markdown-it/blob/master/CHANGELOG.md) - [Commits](markdown-it/markdown-it@14.1.1...14.3.0) Updates `dompurify` from 3.4.1 to 3.4.11 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.4.1...3.4.11) Updates `dompurify` from 3.4.1 to 3.4.11 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.4.1...3.4.11) Updates `form-data` from 3.0.4 to 3.0.5 - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v4.0.5...v4.0.6) Updates `undici` from 7.24.1 to 7.28.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.26.0...v7.28.0) Updates `js-yaml` from 3.14.2 to 3.15.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.1...4.3.0) Updates `undici` from 7.24.4 to 7.28.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.26.0...v7.28.0) Updates `ws` from 8.20.1 to 8.21.0 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@7.5.10...7.5.11) Updates `tar` from 7.5.13 to 7.5.19 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v7.5.15...v7.5.19) Updates `form-data` from 4.0.4 to 4.0.6 - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v4.0.5...v4.0.6) Updates `hono` from 4.12.18 to 4.12.29 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.18...v4.12.29) Updates `js-yaml` from 4.1.1 to 4.3.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.1...4.3.0) Updates `form-data` from 3.0.4 to 3.0.5 - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v4.0.5...v4.0.6) --- updated-dependencies: - dependency-name: undici dependency-version: 7.28.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 7.5.11 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 8.21.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: tar dependency-version: 7.5.19 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: "@koa/router" dependency-version: 15.7.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: form-data dependency-version: 4.0.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.12.29 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: linkify-it dependency-version: 5.0.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: markdown-it dependency-version: 14.3.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.3.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: form-data dependency-version: 4.0.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: linkify-it dependency-version: 5.0.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: markdown-it dependency-version: 14.3.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tar dependency-version: 7.5.19 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 8.21.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 7.5.11 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: http-proxy-middleware dependency-version: 2.0.10 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: webpack-dev-server dependency-version: dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 7.28.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 8.21.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tar dependency-version: 7.5.16 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.3.0 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: form-data dependency-version: 4.0.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.12.29 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: linkify-it dependency-version: 5.0.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: markdown-it dependency-version: 14.3.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: dompurify dependency-version: 3.4.11 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: protobufjs dependency-version: 7.6.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 8.1.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 7.28.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 7.3.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: linkify-it dependency-version: 5.0.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: markdown-it dependency-version: 14.3.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: markdown-it dependency-version: 14.3.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: form-data dependency-version: 3.0.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: linkify-it dependency-version: 5.0.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: markdown-it dependency-version: 14.3.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: markdown-it dependency-version: 14.3.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: dompurify dependency-version: 3.4.11 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: dompurify dependency-version: 3.4.11 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: form-data dependency-version: 3.0.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 7.28.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 3.15.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 7.28.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 8.21.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: tar dependency-version: 7.5.19 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: form-data dependency-version: 4.0.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.12.29 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.3.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: form-data dependency-version: 3.0.5 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 10, 2026

This was referenced Jul 10, 2026

Bump the npm_and_yarn group across 15 directories with 10 updates #32

Closed

Bump the npm_and_yarn group across 16 directories with 14 updates #34

Closed

Navigation Menu

Bump the npm_and_yarn group across 17 directories with 14 updates - #35

Bump the npm_and_yarn group across 17 directories with 14 updates#35
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-8acfa7f9a9

dependabot Bot commented on behalf of github Jul 10, 2026 •

edited by cubic-dev-ai Bot

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Advisory	CVE	Severity (CVSS)	Fixed in	Fix commit
GHSA-vxpw-j846-p89q	CVE-2026-12151	High (7.5)	7.28.0	`8cb10f98`
GHSA-vmh5-mc38-953g	CVE-2026-9697	High (7.4)	7.28.0	`04201f89`
GHSA-hm92-r4w5-c3mj	CVE-2026-6734	High (7.5)	7.28.0	`3805b8f8`
GHSA-pr7r-676h-xcf6	CVE-2026-9678	Moderate (5.9)	7.28.0	`85a24055`
GHSA-p88m-4jfj-68fv	CVE-2026-9679	Moderate (5.9)	7.28.0	`d0574cc4`
GHSA-g8m3-5g58-fq7m	CVE-2026-11525	Low (3.7)	7.28.0	`d0574cc4`
GHSA-35p6-xmwp-9g52	CVE-2026-6733	Low (3.7)	7.28.0	`ea8930cf`

Conversation

dependabot Bot commented on behalf of github Jul 10, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v7.28.0

⚠️ Security Release

Summary

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

TLS certificate validation bypass in SOCKS5 ProxyAgent — CVE-2026-9697

7.5.11

Bug fixes

7.5.11

Bug fixes

v15.7.0

v15.6.0

v15.5.0

v15.4.0

v15.3.2

v15.3.1

v4.0.6 - 2026-06-12

Commits

v4.12.29

What's Changed

New Contributors

v4.12.28

What's Changed

New Contributors

v4.12.27

Security fixes

hono/jsx does not isolate context per request

Server-Side XSS via JSX escaping bypass in cx()

5.0.2 / 2026-07-02

5.0.1 / 2026-05-23

[14.3.0] - 2026-07-02

Changed

Fixed

[14.2.0] - 2026-05-24

Added

Fixed

Security

4.3.0, 3.15.0 - 2026-06-27

Security

[5.2.0] - 2026-06-26

Added

Removed

Fixed

[5.1.0] - 2026-06-23

Added

Changed

[5.0.0] - 2026-06-20

Added

Changed

v4.0.6 - 2026-06-12

Commits

5.0.2 / 2026-07-02

5.0.1 / 2026-05-23

[14.3.0] - 2026-07-02

Changed

Fixed

[14.2.0] - 2026-05-24

Added

Fixed

Security

7.5.11

Bug fixes

7.5.11

Bug fixes

v2.0.10-beta.0

What's Changed

New Contributors

v2.0.10

v7.28.0

⚠️ Security Release

Summary

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

TLS certificate validation bypass in SOCKS5 ProxyAgent — CVE-2026-9697

Summary by cubic

Uh oh!

Reviewers

dependabot Bot commented on behalf of github Jul 10, 2026 •

edited by cubic-dev-ai Bot

Loading