chore(deps-dev): Bump the npm_and_yarn group across 1 directory with 5 updates by dependabot[bot] · Pull Request #85 · NeiRo21/solidmarks

dependabot · 2026-10-01T14:04:25Z

Bumps the npm_and_yarn group with 5 updates in the / directory:

Package	From	To
adm-zip	`0.6.0`	`0.6.1`
baseline-browser-mapping	`2.10.28`	`2.11.26`
browserslist	`4.28.2`	`4.29.3`
js-yaml	`4.3.1`	`4.3.2`
undici	`7.29.0`	`7.30.0`

Updates adm-zip from 0.6.0 to 0.6.1

Release notes

Sourced from adm-zip's releases.

v0.6.1

Full Changelog: cthackers/adm-zip@v0.6.0...v0.6.1

Updated dev dependencies

Fixed uncaught crash in async decompression on malformed DEFLATE data

Fixed addLocalFolder following symlinks out of the archived folder

Stripped setuid/setgid/sticky bits from extracted file permissions

Enforced the decompression size cap on the async path and for size 0

Rejected archives with duplicate entry names

Blocked extraction from writing through symlinks inside the target

Routed malformed-header parse errors through the async callback

Rejected zip entries whose declared data extent runs past the buffer

Fixed addLocalFolderPromise hanging on empty folders and swallowing errors

Fixed addLocalFolderAsync2 mangling local paths on Windows

Commits

cb2cf9b Fixed addLocalFolderAsync2 mangling local paths on Windows
54902b6 Fixed addLocalFolderPromise hanging on empty folders and swallowing errors
73131bd Fixed CI
758898d Rejected zip entries whose declared data extent runs past the buffer
74b6e9f Routed malformed-header parse errors through the async callback
eaa35fa Blocked extraction from writing through symlinks inside the target
1e015e3 Increment version
05101d4 Rejected archives with duplicate entry names
4916006 Enforced the decompression size cap on the async path and for size 0
6a63c33 Stripped setuid/setgid/sticky bits from extracted file permissions
Additional commits viewable in compare view

Updates baseline-browser-mapping from 2.10.28 to 2.11.26

Release notes

Sourced from baseline-browser-mapping's releases.

v2.11.0

What's Changed in 2.11.0

feat: Adds a new getTimeline() method for getting the series of minimum browser changes, either grouped by date or by browser.

refactor: Substantial refactoring of the data compression process that replaces the full list of browsers from @mdn/browser-compat-data and downstream-browsers.json and features from web-features (in their very pared down form) with a change-list timeline that reflects which versions supported Baseline (newly available) on a given date. Thanks to @swwind for the idea!

refactor: Some common functions have been moved to a util.ts module for use in other scripts.

fix: Removes process.exit() calls when unsupported option combinations are passed to getCompatibleVersions() and getAllVersions() in favour of throwing an Error. There is a small security risk with process.exit() calls that sites accepting unsanitised inputs could be the subject of attacks. Unsupported config options now throw and Error which should allow for more graceful handling. Thanks to @bnbdr for flagging this as vulnerability CVE-2026-45819 .

Fixes #134

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.10.44...v2.11.0

Commits

c1934c6 Patch to 2.11.26 because browser or feature data changed
4873684 Browser or feature data changed
9030798 Updating static site
a5df351 Updating static site
ecc5b54 Updating static site
719bf7a Patch to 2.11.25 because browser or feature data changed
c4f5b49 Browser or feature data changed
aa194af Updating static site
0d33c4a Patch to 2.11.24 because browser or feature data changed
1dac891 Browser or feature data changed
Additional commits viewable in compare view

Updates browserslist from 4.28.2 to 4.29.3

Release notes

Sourced from browserslist's releases.

4.29.3

Updated Firefox ESR.

4.29.2

Fixed ignoring null usage in cover X in Y query (by @wahidrizka).

4.29.1

Fixed config name loading protection on Windows (by @oss-security-shop).

Fixed case-insensitive negation queries (by @jakezwang).

Fixed percentage and supports queries case-insensitive (by @wahidrizka).

Fixed old Node.js tests (by @aaron-belenky).

Reduced code (by @charmander).

4.29.0

Added query continuations across lines and array entries (by @fzlzjerry).

4.28.9

Improve or parsing performance (by @NotAFlightRisk).

4.28.8

Fixed including kaios in baseline queries (by @Jaybhade).

4.28.7

Improved parsing performance.

Fixed unbounded memory growth (by @alanturing881).

Fixed prototype write issue (by @alanturing881).

4.28.6

Fixed Electron version queries (by @spokodev).

4.28.5

Fixed > and >= queries (by @spokodev).

4.28.4

Fixed SyntaxError regression of 4.28.3.

4.28.3

Fixed baseline query case-insensitivity (by @swwind).

Changelog

Sourced from browserslist's changelog.

4.29.3

Updated Firefox ESR.

4.29.2

Fixed ignoring null usage in cover X in Y query (by @wahidrizka).

4.29.1

Fixed config name loading protection on Windows (by @oss-security-shop).

Fixed case-insensitive negation queries (by @jakezwang).

Fixed percentage and supports queries case-insensitive (by @wahidrizka).

Fixed old Node.js tests (by @aaron-belenky).

Reduced code (by @charmander).

4.29.0

Added query continuations across lines and array entries (by @fzlzjerry).

4.28.9

Improved or parsing performance (by @NotAFlightRisk).

4.28.8

Fixed including kaios in baseline queries (by @Jaybhade).

4.28.7

Improved parsing performance.

Fixed unbounded memory growth (by @alanturing881).

Fixed prototype write issue (by @alanturing881).

4.28.6

Fixed Electron version queries (by @spokodev).

4.28.5

Fixed > and >= queries (by @spokodev).

4.28.4

Fixed SyntaxError regression of 4.28.3.

4.28.3

Fixed baseline query case-insensitivity (by @swwind).

Commits

b4809dd Release 4.29.3 version
9d844f8 Update Firefox ESR
0033f34 Update dependencies
906d329 Release 4.29.2 version
ff8c83f Update dependencies
067f4a1 Merge pull request #952 from wahidrizka/fix-cover-null-usage
f760921 Do not add versions without usage data to cover queries
5be63f5 Merge pull request #953 from wahidrizka/docs-android-latest-version
1e5356f Note that Android version queries return only the latest version
5b7e941 Add missed changes to ChangeLog
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for browserslist since your current version.

Updates js-yaml from 4.3.1 to 4.3.2

Changelog

Sourced from js-yaml's changelog.

4.3.2 - 2026-08-26

Changed

[backport] Hard-limit merge sequence size to 100.

Security

[backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

Commits

79ca68d 4.3.2 released
d90b661 Backport merge limits from v5.4.1
See full diff in compare view

Updates undici from 7.29.0 to 7.30.0

Release notes

Sourced from undici's releases.

v7.30.0

What's Changed

[Backport v7.x] fix: selectively re-enable SIMD for ppc64 by @github-actions[bot] in nodejs/undici#5794

Backport upgrade diagnostics lifecycle fixes to v7.x by @BridgeAR in nodejs/undici#5783

[Backport v7.x] fix: honor backpressure in decompression interceptor by @mcollina in nodejs/undici#5837

fix: close rejected HTTP/2 WebSocket streams on v7.x by @mcollina in nodejs/undici#5876

test(fetch): make pull-dont-push exceed any socket buffer by @mcollina in nodejs/undici#5889

Full Changelog: nodejs/undici@v7.29.1...v7.30.0

v7.29.1

⚠️ Security fixes

High severity

GHSA-w293-vg96-wgc3: BalancedPool could drop function-valued connection options while cloning its configuration, including custom TLS certificate validation callbacks. Undici now preserves connect and legacy tls options when creating upstreams. Fixed by f690157d.

GHSA-rfgv-xxqx-mfg5: a WebSocket server could select a subprotocol when none was requested, causing an uncaught TypeError that could terminate the process. Undici now rejects the handshake with protocol error 1002. Fixed by 6615e017.

Medium severity

GHSA-3wwx-pv8p-q78v: a malformed permessage-deflate payload exceeding the configured decompression limit could emit an unhandled zlib error and terminate the process. Undici now destroys the inflater after reaching the limit. Fixed by 63cf698b.

GHSA-rx4f-c7p8-82vq: an unclean WebSocketStream close could create an unobserved rejected promise when its writable stream was locked, potentially terminating the process. Undici now propagates the failure through the retained writable stream controller. Fixed by 1858656e.

GHSA-2jfj-6hjv-fm6j: shared caches could store and replay responses containing Set-Cookie, disclosing one user's cookies to another caller. Undici now excludes these responses from shared caches, including existing entries and revalidation paths. Fixed by b6c5a002.

GHSA-3xpg-4rpp-hhhm: the decompression interceptor did not bound decoded output, allowing compressed responses to consume excessive memory. Undici now limits every decompression stage to 64 MiB by default and supports a configurable maxSize. Fixed by 2c7d7e12.

GHSA-pmjh-fq2x-6v4x: a terminal retry failure after response headers were exposed could orphan the original response body, causing consumers to hang indefinitely. Undici now propagates the terminal error to the exposed body. Fixed by 3c672659.

Low severity

GHSA-8436-99hf-9mmv: cache interceptors could store and replay responses to unsafe HTTP methods such as POST or DELETE. Undici now restricts cache reads and writes to safe methods while preserving invalidation by successful unsafe requests. Fixed by b61d9432.

GHSA-2gqq-gqf2-x968: the dump interceptor could treat an oversized chunked response as successfully truncated when no Content-Length was present. Undici now enforces maxSize against received bytes and aborts oversized responses. Fixed by 21693f40.

GHSA-r53p-7pc4-xj5r: the retry interceptor could concatenate a resumed response with inconsistent framing into downstream output, enabling response splitting or corruption. Undici now validates Content-Range against the original response framing before resuming. Fixed by cd8af90b.

What's Changed

[v7.x] drop: remove Node.js 26 from shared-builtin CI build by @mcollina in nodejs/undici#5592

fix(h2): honour headersTimeout by @mcollina in nodejs/undici#5604

fix(h2): keep the connection ref'd while requests are outstanding by @mcollina in nodejs/undici#5605

ci: increase Windows workflow timeout on v7.x by @mcollina in nodejs/undici#5621

fix(h2): retire the request that completed, not the head of the queue by @mcollina in nodejs/undici#5618

fix(h2): settle a request whose stream is cancelled by @mcollina in nodejs/undici#5607

perf: reduce EventSourceStream parser allocations (#5032) by @mcollina in nodejs/undici#5646

fix(h2): handle GOAWAY for CONNECT streams by @mcollina in nodejs/undici#5640

[v7.x] perf(h1): drop idle-socket timer floor with a ref'd setImmediate (#5707) by @mcollina in nodejs/undici#5769

Full Changelog: nodejs/undici@v7.29.0...v7.29.1

Commits

6741f66 Bumped v7.30.0 (#5887)
8d2f2f0 test(fetch): make pull-dont-push exceed any socket buffer (#5889)
fad98ae fix: close rejected HTTP/2 WebSocket streams on v7.x (#5876)
369058e fix: honor backpressure in decompression interceptor (#5829) (#5837)
a7914e5 Backport upgrade diagnostics lifecycle fixes to v7.x (#5783)
48367af fix: selectively re-enable SIMD for ppc64 (#5776) (#5794)
d39a83e Bumped v7.29.1 (#5772)
0d88464 fix(test): remove unused EventEmitter import
f57411b perf(h1): drop idle-socket timer floor with a ref'd setImmediate (#5707) (#5769)
3c67265 fix(retry): settle exposed body on terminal failure
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

…5 updates Bumps the npm_and_yarn group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [adm-zip](https://github.com/cthackers/adm-zip) | `0.6.0` | `0.6.1` | | [baseline-browser-mapping](https://github.com/web-platform-dx/baseline-browser-mapping) | `2.10.28` | `2.11.26` | | [browserslist](https://github.com/browserslist/browserslist) | `4.28.2` | `4.29.3` | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.3.1` | `4.3.2` | | [undici](https://github.com/nodejs/undici) | `7.29.0` | `7.30.0` | Updates `adm-zip` from 0.6.0 to 0.6.1 - [Release notes](https://github.com/cthackers/adm-zip/releases) - [Changelog](https://github.com/cthackers/adm-zip/blob/master/history.md) - [Commits](cthackers/adm-zip@v0.6.0...v0.6.1) Updates `baseline-browser-mapping` from 2.10.28 to 2.11.26 - [Release notes](https://github.com/web-platform-dx/baseline-browser-mapping/releases) - [Commits](web-platform-dx/baseline-browser-mapping@v2.10.28...v2.11.26) Updates `browserslist` from 4.28.2 to 4.29.3 - [Release notes](https://github.com/browserslist/browserslist/releases) - [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md) - [Commits](browserslist/browserslist@4.28.2...4.29.3) Updates `js-yaml` from 4.3.1 to 4.3.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.1...4.3.2) Updates `undici` from 7.29.0 to 7.30.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.29.0...v7.30.0) --- updated-dependencies: - dependency-name: adm-zip dependency-version: 0.6.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: baseline-browser-mapping dependency-version: 2.11.26 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: browserslist dependency-version: 4.29.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 7.30.0 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]>

github-actions · 2026-10-01T14:04:40Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package

Version

Score

Details

npm/adm-zip

0.6.1

🟢 5.3

Details

Check	Score	Reason
Maintained	🟢 10	24 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Code-Review	⚠️ 0	Found 1/30 approved changesets -- score normalized to 0
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	🟢 3	branch protection is not maximal on development and all release branches
SAST	🟢 7	SAST tool detected but not run on all commits

npm/baseline-browser-mapping

2.11.26

Unknown

npm/browserslist

4.29.3

🟢 6.8

Details

Check	Score	Reason
Code-Review	🟢 4	Found 7/16 approved changesets -- score normalized to 4
Maintained	🟢 10	30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Security-Policy	🟢 10	security policy file detected
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 9	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 10	all dependencies are pinned
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	🟢 3	branch protection is not maximal on development and all release branches
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/caniuse-lite

1.0.30001814

🟢 4.6

Details

Check	Score	Reason
Code-Review	⚠️ 1	Found 3/26 approved changesets -- score normalized to 1
Maintained	🟢 10	14 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies	🟢 10	all dependencies are pinned
Binary-Artifacts	🟢 10	no binaries found in the repo
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/electron-to-chromium

1.5.443

Unknown

npm/js-yaml

4.3.2

🟢 6.7

Details

Check	Score	Reason
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Code-Review	⚠️ 0	Found 2/30 approved changesets -- score normalized to 0
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	🟢 10	project is fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Security-Policy	🟢 4	security policy file detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md

npm/node-releases

2.0.57

🟢 4

Details

Check	Score	Reason
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Code-Review	⚠️ 0	Found 0/30 approved changesets -- score normalized to 0
Maintained	🟢 10	14 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
Binary-Artifacts	🟢 10	no binaries found in the repo
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
SAST	⚠️ 0	no SAST tool detected
Security-Policy	⚠️ 0	security policy file not detected
Fuzzing	⚠️ 0	project is not fuzzed
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
License	🟢 10	license file detected

npm/undici

7.30.0

🟢 7.5

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Dependency-Update-Tool	🟢 10	update tool detected
Maintained	🟢 10	30 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Binary-Artifacts	🟢 6	binaries present in source code
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies	🟢 6	dependency not pinned by hash detected -- score normalized to 6
Vulnerabilities	⚠️ 0	10 existing vulnerabilities detected
SAST	🟢 10	SAST tool is run on all commits
License	🟢 10	license file detected
Fuzzing	🟢 10	project is fuzzed
Packaging	🟢 10	packaging workflow detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
CI-Tests	🟢 10	30 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 58 contributing companies or organizations

npm/update-browserslist-db

1.3.3

🟢 5.6

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Code-Review	⚠️ 2	Found 6/30 approved changesets -- score normalized to 2
Packaging	⚠️ -1	packaging workflow not detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Token-Permissions	🟢 9	detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies	🟢 10	all dependencies are pinned
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches

Scanned Files

package-lock.json

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 1, 2026

Navigation Menu

Repository navigation

chore(deps-dev): Bump the npm_and_yarn group across 1 directory with 5 updates - #85

chore(deps-dev): Bump the npm_and_yarn group across 1 directory with 5 updates#85
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-3ebbe48b9a

dependabot Bot commented on behalf of github Oct 1, 2026

Uh oh!

github-actions Bot commented Oct 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 1, 2026

v0.6.1

v2.11.0

What's Changed in 2.11.0

4.29.3

4.29.2

4.29.1

4.29.0

4.28.9

4.28.8

4.28.7

4.28.6

4.28.5

4.28.4

4.28.3

4.29.3

4.29.2

4.29.1

4.29.0

4.28.9

4.28.8

4.28.7

4.28.6

4.28.5

4.28.4

4.28.3

4.3.2 - 2026-08-26

Changed

Security

v7.30.0

What's Changed

v7.29.1

⚠️ Security fixes

High severity

Medium severity

Low severity

What's Changed

Uh oh!

github-actions Bot commented Oct 1, 2026

Dependency Review

OpenSSF Scorecard

Scanned Files

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants