chore(deps): bump the npm_and_yarn group across 1 directory with 20 updates by dependabot[bot] · Pull Request #1105 · Vets-Who-Code/vets-who-code-app

dependabot · 2026-05-02T21:58:43Z

Bumps the npm_and_yarn group with 19 updates in the / directory:

Package	From	To
axios	`1.7.9`	`1.16.0`
dompurify	`3.3.1`	`3.4.2`
next	`15.0.7`	`15.5.15`
next-auth	`4.24.11`	`4.24.14`
swiper	`8.4.7`	`12.1.2`
happy-dom	`20.5.0`	`20.9.0`
postcss	`8.5.6`	`8.5.10`
@isaacs/brace-expansion	`5.0.0`	`5.0.1`
brace-expansion	`2.0.2`	`2.1.0`
brace-expansion	`1.1.11`	`1.1.14`
brace-expansion	`2.0.1`	`2.1.0`
@tootallnate/once	`2.0.0`	`removed`
@xmldom/xmldom	`0.8.11`	`0.8.13`
js-yaml	`3.14.1`	`3.14.2`
js-yaml	`4.1.0`	`4.1.1`
mdast-util-to-hast	`13.2.0`	`13.2.1`
path-to-regexp	`0.1.12`	`0.1.13`
playwright	`1.49.1`	`1.59.1`
preact	`10.26.8`	`10.29.1`
rollup	`2.79.2`	`2.80.0`
rollup	`4.57.1`	`4.60.2`
socket.io-parser	`4.2.5`	`4.2.6`
svgo	`3.3.2`	`3.3.3`

Updates axios from 1.7.9 to 1.16.0

Release notes

Sourced from axios's releases.

v1.16.0 — May 2, 2026

This release adds support for the QUERY HTTP method and a new ECONNREFUSED error constant, lands a substantial wave of HTTP, fetch, and XHR adapter bug fixes around redirects, aborts, headers, and timeouts, and welcomes 23 new contributors.

⚠️ Notable Changes

A handful of fixes in this release are either security-adjacent or change observable behaviour. Please review before upgrading:

Fetch adapter now enforces maxBodyLength and maxContentLength. These limits were silently ignored on the fetch adapter prior to 1.16.0 — anyone relying on them as a safety net (DoS protection, accidental large uploads) had no protection. (#10795)

Proxy requests now preserve user-supplied Host headers. Previously, the proxy path could overwrite a custom Host. Virtual-host-style routing through a proxy will now behave correctly. (#10822)

Basic auth credentials embedded in URLs are now URL-decoded. If you have percent-encoded credentials in a URL (e.g. https://user:p%40ss@host), the decoded value is what now goes on the wire. (#10825)

parseProtocol now strictly requires a colon in the protocol separator. Strings that loosely parsed as protocols before may no longer match. (#10729)

Deprecated unescape() replaced with modern UTF-8 encoding. Non-ASCII URL handling is now spec-correct; consumers depending on legacy unescape() quirks may see different output bytes. (#7378)

transformRequest input typing change was reverted. The typing change introduced in #10745 was reverted in #10810 after follow-up review — net behavior is unchanged from 1.15.2. (#10745, #10810)

🚀 New Features

QUERY HTTP Method: Added support for the QUERY HTTP method across adapters and type definitions. (#10802)

ECONNREFUSED Error Constant: Exposed ECONNREFUSED as a constant on AxiosError so callers can match connection-refused failures without comparing string literals (closes #6485). (#10680)

Encode Helper Export: Exported the internal encode helper from buildURL so userland param serializers can reuse the same encoding logic that axios uses internally. (#6897)

🐛 Bug Fixes

HTTP Adapter — Redirects & Headers: Cleared stale headers when a redirect targets a no-proxy host, fixed the redirect listener chain so listeners no longer stack across hops, restored the missing requestDetails argument on beforeRedirect, preserved user-supplied Host headers when forwarding through a proxy, and properly URL-decoded basic auth credentials. (#10794, #10800, #6241, #10822, #10825)

HTTP Adapter — Streams & Timeouts: Preserved the partial response object on AxiosError when a stream is aborted after headers arrive, honoured the timeout option during the connect phase when redirects are disabled, and resolved an unsettled-promise hang when an aborted request was combined with compression and maxRedirects: 0. (#10708, #10819, #7149)

Fetch Adapter: Enforced maxBodyLength / maxContentLength in the fetch adapter, set the User-Agent header to match the HTTP adapter, preserved the original abort reason instead of replacing it with a generic error, and deferred global access so importing the module no longer throws a TypeError in restricted environments. (#10795, #10772, #10806, #7260)

XHR Adapter: Unsubscribed the cancelToken and AbortSignal listeners on the error, timeout, and abort code paths to prevent leaked subscriptions. (#10787)

Error Handling: Attached the parsed response to AxiosError when JSON.parse fails inside dispatchRequest, prevented settle from emitting undefined error codes, and tightened the parseProtocol regex to require a colon in the protocol separator. (#10724, #7276, #10729)

Types & Exports: Aligned the CommonJS CancelToken typings with the ESM build, fixed a compiler error caused by RawAxiosHeaders, and re-exported create from the package index. (#7414, #6389, #6460)

UTF-8 Encoding: Replaced the deprecated unescape() call with a modern UTF-8 encoding implementation. (#7378)

Misc Cleanup: Resolved a batch of small inconsistencies and gadget-level issues across the codebase. (#10833)

🔧 Maintenance & Chores

Refactor — ES6 Modernisation: Modernised the utils module and XHR adapter to use ES6 features, and tidied the multipart boundary error message. (#10588, #7419)

Tests: Hardened the HTTP test server lifecycle to fix flaky FormData EPIPE failures, fixed Win32 platform support for the pipe tests, and corrected an incorrect test assumption. (#10820, #10791, #10796)

Docs: Documented paramsSerializer.encode for strict RFC 3986 query encoding, updated the parseReviver TypeScript definitions and configuration docs for ES2023, added timeout guidance to the README's first async example, and expanded notes around the recent type changes. (#10821, #10782, #10759, #10804)

Reverted: Reverted the transformRequest input typing change from #10745 after follow-up review. (#10745, #10810)

Dependencies: Bumped actions/setup-node, the github-actions group, and postcss (in /docs) to their latest versions. (#10785, #10813, #10814)

Release: Updated changelog and packages, and prepared the 1.16.0 release. (#10790, #10834)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

@singhankit001 (#10588)

@cuiweixie (#7419)

@iruizsalinas (#10787)

@MarcosNocetti (#10680)

@deepview-autofix (#10729)

... (truncated)

Changelog

Sourced from axios's changelog.

Changelog

v1.15.2 - April 21, 2026

This release delivers prototype-pollution hardening for the Node HTTP adapter, adds an opt-in allowedSocketPaths allowlist to mitigate SSRF via Unix domain sockets, fixes a keep-alive socket memory leak, and ships supply-chain hardening across CI and security docs.

🔒 Security Fixes

Prototype Pollution Hardening (HTTP Adapter): Hardened the Node HTTP adapter and resolveConfig/mergeConfig/validator paths to read only own properties and use null-prototype config objects, preventing polluted auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser from influencing requests. (#10779)

SSRF via socketPath: Rejects non-string socketPath values and adds an opt-in allowedSocketPaths config option to restrict permitted Unix domain socket paths, returning AxiosError ERR_BAD_OPTION_VALUE on mismatch. (#10777)

Supply-chain Hardening: Added .npmrc with ignore-scripts=true, lockfile lint CI, non-blocking reproducible build diff, scoped CODEOWNERS, expanded SECURITY.md/THREATMODEL.md with provenance verification (npm audit signatures), 60-day resolution policy, and maintainer incident-response runbook. (#10776)

🚀 New Features

allowedSocketPaths Config Option: New request config option (and TypeScript types) to allowlist Unix domain socket paths used by the Node http adapter; backwards compatible when unset. (#10777)

🐛 Bug Fixes

Keep-alive Socket Memory Leak: Installs a single per-socket error listener tracking the active request via kAxiosSocketListener/kAxiosCurrentReq, eliminating per-request listener accumulation, MaxListenersExceededWarning, and linear heap growth under concurrent or long-running keep-alive workloads (fixes #10780). (#10788)

🔧 Maintenance & Chores

Changelog: Updated CHANGELOG.md with v1.15.1 release notes. (#10781)

Full Changelog

v1.15.1 - April 19, 2026

This release ships a coordinated set of security hardening fixes across headers, body/redirect limits, multipart handling, and XSRF/prototype-pollution vectors, alongside a broad sweep of bug fixes, test migrations, and threat-model documentation updates.

🔒 Security Fixes

Header Injection Hardening: Tightened validation and sanitisation across request header construction to close the header-injection attack surface. (#10749)

CRLF Stripping in Multipart Headers: Correctly strips CR/LF from multipart header values to prevent injection via field names and filenames. (#10758)

Prototype Pollution / Auth Bypass: Replaced unsafe in checks with hasOwnProperty to prevent authentication bypass via prototype pollution on config objects, with additional regression tests. (#10761, #10760)

withXSRFToken Truthy Bypass: Short-circuits on any truthy non-boolean value, so an ambiguous config no longer silently leaks the XSRF token cross-origin. (#10762)

maxBodyLength With Zero Redirects: Enforces maxBodyLength even when maxRedirects is set to 0, closing a bypass path for oversized request bodies. (#10753)

Streamed Response maxContentLength Bypass: Applies maxContentLength to streamed responses that previously bypassed the cap. (#10754)

Follow-up CVE Completion: Completes an earlier incomplete CVE fix to fully close the regression window. (#10755)

🚀 New Features

... (truncated)

Commits

df53d7d chore(release): prepare release 1.16.0 (#10834)
9d92bcd fix: gadgets and smaller issues (#10833)
5107ee6 fix: prevent undefined error codes in settle (#7276)
e573499 fix(fetch): defer global access in fetch adapter (#7260)
ad68e1a fix(http): honor timeout during connect without redirects (#10819)
2a51828 fix(http): decode URL basic auth credentials (#10825)
0e8b6bb fix(http): preserve user-supplied Host header when forwarding through a proxy...
79f39e1 docs: document paramsSerializer.encode for strict RFC 3986 query encoding (#1...
0fe3a5f [Docs/Types] Update parseReviver TypeScript definitions for ES2023 and add ...
cd6737f chore: matches the sibling responseStream.on(aborted) handler and added tests...
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for axios since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates dompurify from 3.3.1 to 3.4.2

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.2

Fixed an issue with URI validation on attributes allowed via ADD_ATTR callback, thanks @nelstrom

Fixed an issue with source maps referring to non-existing files, thanks @cmdcolin

Updated existing workflows, fuzzer, release signing, etc., added more tests

Bumped several dependencies where possible

DOMPurify 3.4.1

Fixed an issue with on-handler stripping for HTML-spec-reserved custom element names (font-face, color-profile, missing-glyph, font-face-src, font-face-uri, font-face-format, font-face-name) under permissive CUSTOM_ELEMENT_HANDLING

Fixed a case-sensitivity gap in the annotation-xml check that allowed mixed-case variants to bypass the basic-custom-element exclusion in XHTML mode

Fixed SANITIZE_NAMED_PROPS repeatedly prefixing already-prefixed id and name values on subsequent sanitization

Fixed the IN_PLACE root-node check to explicitly guard against non-string nodeName (DOM-clobbering robustness)

Removed a duplicate slot entry from the default HTML attribute allow-list

Strengthened the fast-check fuzz harness with explicit XSS invariants, an expanded seed-payload corpus, an additional idempotence property for SANITIZE_NAMED_PROPS, and a negative-control assertion ensuring the invariants actually fire

Added regression and pinning tests covering the above fixes and two accepted-behavior contracts (SAFE_FOR_TEMPLATES greedy scrub, hook-added attribute handling)

Extended CodeQL analysis to run on 3.x and 2.x maintenance branches

DOMPurify 3.4.0

Most relevant changes:

Fixed a problem with FORBID_TAGS not winning over ADD_TAGS, thanks @kodareef5

Fixed several minor problems and typos regarding MathML attributes, thanks @DavidOliver

Fixed ADD_ATTR/ADD_TAGS function leaking into subsequent array-based calls, thanks @1Jesper1

Fixed a missing SAFE_FOR_TEMPLATES scrub in RETURN_DOM path, thanks @bencalif

Fixed a prototype pollution via CUSTOM_ELEMENT_HANDLING, thanks @trace37labs

Fixed an issue with ADD_TAGS function form bypassing FORBID_TAGS, thanks @eddieran

Fixed an issue with ADD_ATTR predicates skipping URI validation, thanks @christos-eth

Fixed an issue with USE_PROFILES prototype pollution, thanks @christos-eth

Fixed an issue leading to possible mXSS via Re-Contextualization, thanks @researchatfluidattacks and others

Fixed an issue with closing tags leading to possible mXSS, thanks @frevadiscor

Fixed a problem with the type dentition patcher after Node version bump

Fixed freezing BS runs by reducing the tested browsers array

Bumped several dependencies where possible

Added needed files for OpenSSF scorecard checks

Published Advisories are here: https://github.com/cure53/DOMPurify/security/advisories?state=published

DOMPurify 3.3.3

Fixed an engine requirement for Node 20 which caused hiccups, thanks @Rotzbua

DOMPurify 3.3.2

Fixed a possible bypass caused by jsdom's faulty raw-text tag parsing, thanks multiple reporters

Fixed a prototype pollution issue when working with custom elements, thanks @christos-eth

Fixed a lenient config parsing in _isValidAttribute, thanks @christos-eth

Bumped and removed several dependencies, thanks @Rotzbua

Fixed the test suite after bumping dependencies, thanks @Rotzbua

Commits

6f67fd3 Sync/3.4.2 (#1322)
5b0cdbb chore: merge main into 3.x for 3.4.1 release (#1301)
09f5911 test: added three more browsers to test setup (OSX, mobile)
5b16e0b Getting 3.x branch ready for 3.4.0 release (#1250)
8bcbf73 chore: Preparing 3.3.3 release
5faddd6 fix: engine requirement (#1210)
0f91e3a Update README.md
d5ff1a8 Merge branch 'main' of github.com:cure53/DOMPurify
c3efd48 fix: moved back from jsdom 28 to jsdom 20
988b888 fix: moved back from jsdom 28 to jsdom 20
Additional commits viewable in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates next from 15.0.7 to 15.5.15

Release notes

Sourced from next's releases.

v15.5.15

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summary-of-cve-2026-23869

v15.5.14

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

feat(next/image): add lru disk cache and images.maximumDiskCacheSize (#91660)

Fix(pages-router): restore Content-Length and ETag for /_next/data/ JSON responses (#90304)

Credits

Huge thanks to @styfle and @lllomh for helping!

v15.5.13

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

fix: patch http-proxy to prevent request smuggling in rewrites (See: CVE-2026-29057)

Credits

Huge thanks to @ztanner for helping!

Commits

412eb90 v15.5.15
cb90de9 [15.x] Avoid consuming cyclic models multiple times (#74)
fffef9e Fix CI for glibc linux builds
d7b012d v15.5.14
2b05251 [backport] feat(next/image): add lru disk cache and `images.maximumDiskCacheS...
f88cee9 Backport: Fix(pages-router): restore Content-Length and ETag for /_next/data/...
cfd5f53 v15.5.13
15f2891 [backport]: fix: patch http-proxy to prevent request smuggling in rewrites (#...
d23f41c v15.5.12
8e75765 fix unlock in publish-native
Additional commits viewable in compare view

Updates next-auth from 4.24.11 to 4.24.14

Release notes

Sourced from next-auth's releases.

next-auth@4.24.14

Bugfixes

providers: add issuer to GitHub provider for RFC 9207 compliance (#13412)

GitHub now returns an iss parameter in OAuth callbacks. openid-client validates it unconditionally, which was breaking authentication for apps that didn't configure an issuer. This sets the default GitHub provider issuer to https://github.com/login/oauth.

Commits

e9a892a chore(release): bump version [skip ci]
0497da4 fix(providers): add issuer to github (#13412)
1a70ee8 chore(release): bump version [skip ci]
edafd21 chore: bump version
aafbfb9 chore: fix apps deps
1f48cf7 chore(release): bump version [skip ci]
4758a2f ci: add workflow_dispatch for release.yml
d3aecfe feat: add next 16 support (#13303)
82efcf8 fix: security issue from nodemailer (#13304)
798c3d5 docs: update banner
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by better-gustavo, a new releaser for next-auth since your current version.

Updates swiper from 8.4.7 to 12.1.2

Release notes

Sourced from swiper's releases.

v12.1.2

No release notes provided.

v12.1.1

Bug Fixes

a11y: fix focus in virtual mode enabled (3055008), closes #8147

core: avoid double-subtracting offsets in centerInsufficientSlides (#8158) (60b0052)

core: prevent duplicate module initialization in constructor (#8155) (#8156) (07738a2)

types: support boolean as a11y value (#8157) (6bf76d5)

v12.1.0

Bug Fixes

autoplay: broken custom delay percentages with pause/resume (#8133) (0afecde)

core: Don't use data-swiper-slide-index for realIndex when virtual module is enabled (#8142) (bd957f8)

core: Escape all CSS selector special characters (d35f41a), closes #8135

core: support slidesOffsetBefore and slidesOffsetAfert in cssMode (45b98d0), closes #7926

fix lazy preloader removal error in react in vue (332f5c7), closes #8149

thumbs: update slide classes on virtual swiper update (#8141) (9752771)

types: Add autoScroll to thumbs.update type signature (#8146) (5d91e6e)

zoom: initialize gesture state after programmatic zoom (#8112) (71e9511)

Features

keyboard: add support for custom speed parameter in keyboard navigation (#8148) (7a4a0e5)

new snapToSlideEdge parameter (de3131f), closes #8021 #4780

v12.0.3

Bug Fixes

element: fixed reference to nav arrows SVG (0b17ecf), closes #8115

Features

core: add 'getRotateFix' export to effect utils (c97ae5d), closes #8114

v12.0.2

Features

navigation: add styles for when buttons set before slider (4588c57), closes #8085

navigation: new addIcons parameter to add SVG icons to nav buttons (b955b0c), closes #8088 #8087

v12.0.1

Bug Fixes

navigation: tweak nav styles when adjacent (98440d9)

v12.0.0

Bug Fixes

... (truncated)

Changelog

Sourced from swiper's changelog.

Changelog

12.1.4 (2026-04-29)

Bug Fixes

remove redundant aria-disabled=false from swiper nav button (#8176) (6730929)

Features

package: add TS declarations for CSS files (ea3081b), closes #8055

react: expose isFullyVisible in SwiperSlide render props (#8175) (3af0002)

12.1.3 (2026-03-24)

Bug Fixes

core: use virtual slides count in onResize when virtual mode is enabled (#8163) (4400083)

grid: round down slidesPerView before calculating number of slides (#8172) (49a55ab)

Features

element: add navigation button slots (cc82241)

12.1.1 (2026-02-13)

Bug Fixes

a11y: fix focus in virtual mode enabled (3055008), closes #8147

core: avoid double-subtracting offsets in centerInsufficientSlides (#8158) (60b0052)

core: prevent duplicate module initialization in constructor (#8155) (#8156) (07738a2)

types: support boolean as a11y value (#8157) (6bf76d5)

12.1.0 (2026-01-28)

Bug Fixes

autoplay: broken custom delay percentages with pause/resume (#8133) (0afecde)

core: Don't use data-swiper-slide-index for realIndex when virtual module is enabled (#8142) (bd957f8)

core: Escape all CSS selector special characters (d35f41a), closes #8135

core: support slidesOffsetBefore and slidesOffsetAfert in cssMode (45b98d0), closes #7926

fix lazy preloader removal error in react in vue (332f5c7), closes #8149

thumbs: update slide classes on virtual swiper update (#8141) (9752771)

types: Add autoScroll to thumbs.update type signature (#8146) (5d91e6e)

zoom: initialize gesture state after programmatic zoom (#8112) (71e9511)

Features

keyboard: add support for custom speed parameter in keyboard navigation (#8148) (7a4a0e5)

new snapToSlideEdge parameter (de3131f), closes #8021 #4780

... (truncated)

Commits

2fd88b7 12.1.2
d3e6633 fix prototype pollution bypass in extend() util
70c48c1 12.1.1
3055008 fix(a11y): fix focus in virtual mode enabled
60b0052 fix(core): avoid double-subtracting offsets in centerInsufficientSlides (#8158)
6bf76d5 fix(types): support boolean as a11y value (#8157)
07738a2 fix(core): prevent duplicate module initialization in constructor (#8155) (#8...
3a1777a 12.1.0
3bc6cfe 12.1.0
45b98d0 fix(core): support slidesOffsetBefore and slidesOffsetAfert in cssMode
Additional commits viewable in compare view

Updates happy-dom from 20.5.0 to 20.9.0

Release notes

Sourced from happy-dom's releases.

v20.9.0

🎨 Features

Adds support for event listener properties on Window (e.g. Window.onkeydown) - By @capricorn86 in task #2131

v20.8.9

👷‍♂️ Patch fixes

Fixes issue where cookies from the current origin was being forwarded to the target origin in fetch requests - By @capricorn86 in task #2117

A security advisory (GHSA-w4gp-fjgq-3q4g) was reported for this security vulnerability. Big thanks to @r74tech for reporting this!

v20.8.8

👷‍♂️ Patch fixes

Fixes issue where export names can be interpolated as executable code in ESM - By @capricorn86 in task #2113

A security advisory (GHSA-6q6h-j7hj-3r64) has been reported that shows a security vulnerability where it may be possible to escape the VM context and get access to process level functionality in unsafe environments using CommonJS. Big thanks to @tndud042713 for reporting this!

v20.8.7

👷‍♂️ Patch fixes

Replace implementing Node.js Console with common IConsole interface to support latest version of Bun - By @YevheniiKotyrlo in task #1845

v20.8.6

👷‍♂️ Patch fixes

Request.formData() should honor "Content-Type" header - By @brianhelba in task #2106

v20.8.5

👷‍♂️ Patch fixes

Fixes error thrown when modifying DOM structure in connectedCallback() - By @capricorn86 in task #2110

v20.8.4

👷‍♂️ Patch fixes

Replace ConsoleConstructor import with indexed access type - By @YevheniiKotyrlo in task #1845

v20.8.3

👷‍♂️ Patch fixes

Throw error if event is not of type Event in EventTarget.dispatchEvent() - By @capricorn86 in task #2054

v20.8.2

👷‍♂️ Patch fixes

Resets Event.cancelBubble and Event.defaultPrevented when calling Event.initEvent() - By @capricorn86 in task #2090

v20.8.1

👷‍♂️ Patch fixes

Make "inert" attribute block focus interactions - By @coffeeandwork in task #1422

v20.8.0

🎨 Features

Adds support for setPointerCapture, hasPointerCapture, and releasePointerCapture to Element - By @coffeeandwork in task #1733

v20.7.2

👷‍♂️ Patch fixes

Properly decode CSS escape sequences in attribute selector values - By @silverwind

... (truncated)

Commits

4090ade fix: #0 Fix github release workflow (#2140)
c7c2bb5 fix: #0 Fix github release workflow (#2139)
d541143 fix: #0 Fix github release workflow (#2138)
a78d89e feat: #2131 Adds support for event listener properties on Window (#2132)
68324c2 fix: #2117 Fixes issue related to cookies from the current origin being for...
5437fdf fix: #2113 Fixes issue where export names can be interpolated as executable...
7e97acb fix: #1845 Replace implementing Node js Console with common IConsole interf...
3373929 fix: #2106 Request.formData() should honor Content-Type header (#2107)
55c17ba fix: #2110 Fixes error thrown when modifying DOM structure in connectedCall...
82a0888 fix: #1845 Replace ConsoleConstructor import with indexed access type (#2095)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for happy-dom since your current version.

Updates postcss from 8.5.6 to 8.5.10

Release notes

Sourced from postcss's releases.

8.5.10

Fixed XSS via unescaped </style> in non-bundler cases (by @TharVid).

8.5.9

Speed up source map encoding paring in case of the error.

8.5.8

Fixed Processor#version.

8.5.7

Improved source map annotation cleaning performance (by CodeAnt AI).

Changelog

Sourced from postcss's changelog.

8.5.10

Fixed XSS via unescaped </style> in non-bundler cases (by @TharVid).

8.5.9

Speed up source map encoding paring in case of the error.

8.5.8

Fixed Processor#version.

8.5.7

Improved source map annotation cleaning performance (by CodeAnt AI).

Commits

33b9790 Release 8.5.10 version
536c79e Escape </style> in CSS output (#2074)
afa96b2 Update dependencies (#2073)
effe88b Typo (#2072)
3ee79a2 Thread model (#2071)
2e0683d Create incident response docs (#2070)
fe88ac2 Release 8.5.9 version
c551632 Avoid RegExp when we can use simple JS
89a6b74 Move SECURITY.txt for docs folder to keep GitHub page cleaner
6ceb8a4 Create SECURITY.md
Additional commits viewable in compare view

Updates @isaacs/brace-expansion from 5.0.0 to 5.0.1

Updates brace-expansion from 2.0.2 to 2.1.0

Commits

1ee4a90 2.1.0
b0302ac Add opt-in { max } mitigation to v2 legacy line (#100)
73b5459 2.0.3
311ac0d Backport fix for GHSA-f886-m6hf-6m8v to v2 (#96)
See full diff in compare view

Updates brace-expansion from 1.1.11 to 1.1.14

Commits

1ee4a90 2...
Description has been truncated

…pdates Bumps the npm_and_yarn group with 19 updates in the / directory: | Package | From | To | | --- | --- | --- | | [axios](https://github.com/axios/axios) | `1.7.9` | `1.16.0` | | [dompurify](https://github.com/cure53/DOMPurify) | `3.3.1` | `3.4.2` | | [next](https://github.com/vercel/next.js) | `15.0.7` | `15.5.15` | | [next-auth](https://github.com/nextauthjs/next-auth) | `4.24.11` | `4.24.14` | | [swiper](https://github.com/nolimits4web/Swiper) | `8.4.7` | `12.1.2` | | [happy-dom](https://github.com/capricorn86/happy-dom) | `20.5.0` | `20.9.0` | | [postcss](https://github.com/postcss/postcss) | `8.5.6` | `8.5.10` | | @isaacs/brace-expansion | `5.0.0` | `5.0.1` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `2.0.2` | `2.1.0` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.11` | `1.1.14` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `2.0.1` | `2.1.0` | | [@tootallnate/once](https://github.com/TooTallNate/once) | `2.0.0` | `removed` | | [@xmldom/xmldom](https://github.com/xmldom/xmldom) | `0.8.11` | `0.8.13` | | [js-yaml](https://github.com/nodeca/js-yaml) | `3.14.1` | `3.14.2` | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.0` | `4.1.1` | | [mdast-util-to-hast](https://github.com/syntax-tree/mdast-util-to-hast) | `13.2.0` | `13.2.1` | | [path-to-regexp](https://github.com/pillarjs/path-to-regexp) | `0.1.12` | `0.1.13` | | [playwright](https://github.com/microsoft/playwright) | `1.49.1` | `1.59.1` | | [preact](https://github.com/preactjs/preact) | `10.26.8` | `10.29.1` | | [rollup](https://github.com/rollup/rollup) | `2.79.2` | `2.80.0` | | [rollup](https://github.com/rollup/rollup) | `4.57.1` | `4.60.2` | | [socket.io-parser](https://github.com/socketio/socket.io) | `4.2.5` | `4.2.6` | | [svgo](https://github.com/svg/svgo) | `3.3.2` | `3.3.3` | Updates `axios` from 1.7.9 to 1.16.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.7.9...v1.16.0) Updates `dompurify` from 3.3.1 to 3.4.2 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.3.1...3.4.2) Updates `next` from 15.0.7 to 15.5.15 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v15.0.7...v15.5.15) Updates `next-auth` from 4.24.11 to 4.24.14 - [Release notes](https://github.com/nextauthjs/next-auth/releases) - [Commits](https://github.com/nextauthjs/next-auth/compare/next-auth@4.24.11...next-auth@4.24.14) Updates `swiper` from 8.4.7 to 12.1.2 - [Release notes](https://github.com/nolimits4web/Swiper/releases) - [Changelog](https://github.com/nolimits4web/swiper/blob/master/CHANGELOG.md) - [Commits](nolimits4web/swiper@v8.4.7...v12.1.2) Updates `happy-dom` from 20.5.0 to 20.9.0 - [Release notes](https://github.com/capricorn86/happy-dom/releases) - [Commits](capricorn86/happy-dom@v20.5.0...v20.9.0) Updates `postcss` from 8.5.6 to 8.5.10 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.6...8.5.10) Updates `@isaacs/brace-expansion` from 5.0.0 to 5.0.1 Updates `brace-expansion` from 2.0.2 to 2.1.0 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v2.0.2...v2.1.0) Updates `brace-expansion` from 1.1.11 to 1.1.14 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v2.0.2...v2.1.0) Updates `brace-expansion` from 2.0.1 to 2.1.0 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v2.0.2...v2.1.0) Removes `@tootallnate/once` Updates `@xmldom/xmldom` from 0.8.11 to 0.8.13 - [Release notes](https://github.com/xmldom/xmldom/releases) - [Changelog](https://github.com/xmldom/xmldom/blob/master/CHANGELOG.md) - [Commits](xmldom/xmldom@0.8.11...0.8.13) Updates `follow-redirects` from 1.15.9 to 1.16.0 - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.15.9...v1.16.0) Updates `js-yaml` from 3.14.1 to 3.14.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.14.1...3.14.2) Updates `js-yaml` from 4.1.0 to 4.1.1 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.14.1...3.14.2) Updates `mdast-util-to-hast` from 13.2.0 to 13.2.1 - [Release notes](https://github.com/syntax-tree/mdast-util-to-hast/releases) - [Commits](syntax-tree/mdast-util-to-hast@13.2.0...13.2.1) Updates `path-to-regexp` from 0.1.12 to 0.1.13 - [Release notes](https://github.com/pillarjs/path-to-regexp/releases) - [Changelog](https://github.com/pillarjs/path-to-regexp/blob/v.0.1.13/History.md) - [Commits](pillarjs/path-to-regexp@v0.1.12...v.0.1.13) Updates `playwright` from 1.49.1 to 1.59.1 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.49.1...v1.59.1) Updates `preact` from 10.26.8 to 10.29.1 - [Release notes](https://github.com/preactjs/preact/releases) - [Commits](preactjs/preact@10.26.8...10.29.1) Updates `rollup` from 2.79.2 to 2.80.0 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/v2.80.0/CHANGELOG.md) - [Commits](rollup/rollup@v2.79.2...v2.80.0) Updates `rollup` from 4.57.1 to 4.60.2 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/v2.80.0/CHANGELOG.md) - [Commits](rollup/rollup@v2.79.2...v2.80.0) Updates `socket.io-parser` from 4.2.5 to 4.2.6 - [Release notes](https://github.com/socketio/socket.io/releases) - [Changelog](https://github.com/socketio/socket.io/blob/main/CHANGELOG.md) - [Commits](https://github.com/socketio/socket.io/compare/socket.io-parser@4.2.5...socket.io-parser@4.2.6) Updates `svgo` from 3.3.2 to 3.3.3 - [Release notes](https://github.com/svg/svgo/releases) - [Commits](svg/svgo@v3.3.2...v3.3.3) --- updated-dependencies: - dependency-name: axios dependency-version: 1.16.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: dompurify dependency-version: 3.4.2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.15 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next-auth dependency-version: 4.24.14 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: swiper dependency-version: 12.1.2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: happy-dom dependency-version: 20.9.0 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.10 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: "@isaacs/brace-expansion" dependency-version: 5.0.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 2.1.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.14 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 2.1.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@tootallnate/once" dependency-version: dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@xmldom/xmldom" dependency-version: 0.8.13 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: follow-redirects dependency-version: 1.16.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 3.14.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.1.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: mdast-util-to-hast dependency-version: 13.2.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: path-to-regexp dependency-version: 0.1.13 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: playwright dependency-version: 1.59.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: preact dependency-version: 10.29.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: rollup dependency-version: 2.80.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: rollup dependency-version: 4.60.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: socket.io-parser dependency-version: 4.2.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: svgo dependency-version: 3.3.3 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

vercel · 2026-05-02T21:58:46Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
vets-who-code-app	Error		May 2, 2026 9:59pm

Copilot

Pull request overview

This PR updates the project’s npm dependencies/lockfile to newer versions (including Next.js, axios, Swiper, Playwright, and Swagger UI React), aligning the app with upstream fixes and security releases.

Changes:

Bump multiple runtime and dev dependencies in package.json (e.g., axios, dompurify, express, next, next-auth, swagger-ui-react, swiper, @playwright/test, postcss, happy-dom).
Regenerate package-lock.json to reflect updated dependency graph, including new transitive packages.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
package.json	Updates top-level dependency versions (notably Next.js, Swiper, and Swagger UI React).
package-lock.json	Updates resolved versions/transitive dependency tree for the new package set.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

    "resend": "^6.6.0",
    "rss-parser": "^3.13.0",
-    "swagger-ui-react": "4.19.1",
-    "swiper": "^8.3.1",
+    "swagger-ui-react": "5.32.5",
+    "swiper": "^12.1.2",


dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 2, 2026

vercel Bot had a problem deploying to Preview May 2, 2026 21:58 Failure

jeromehardaway self-assigned this May 12, 2026

jeromehardaway requested a review from Copilot May 12, 2026 20:39

Copilot started reviewing on behalf of jeromehardaway May 12, 2026 20:40 View session

Copilot AI reviewed May 12, 2026

View reviewed changes

Comment thread package.json

Comment on lines 104 to +107

"resend": "^6.6.0",

"rss-parser": "^3.13.0",

"swagger-ui-react": "4.19.1",

"swiper": "^8.3.1",

"swagger-ui-react": "5.32.5",

"swiper": "^12.1.2",

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump the npm_and_yarn group across 1 directory with 20 updates#1105

chore(deps): bump the npm_and_yarn group across 1 directory with 20 updates#1105
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/npm_and_yarn-23c5eda20d

dependabot Bot commented on behalf of github May 2, 2026

Uh oh!

vercel Bot commented May 2, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github May 2, 2026

v1.16.0 — May 2, 2026

⚠️ Notable Changes

🚀 New Features

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

Changelog

v1.15.2 - April 21, 2026

🔒 Security Fixes

🚀 New Features

🐛 Bug Fixes

🔧 Maintenance & Chores

v1.15.1 - April 19, 2026

🔒 Security Fixes

🚀 New Features

DOMPurify 3.4.2

DOMPurify 3.4.1

DOMPurify 3.4.0

DOMPurify 3.3.3

DOMPurify 3.3.2

v15.5.15

v15.5.14

Core Changes

Credits

v15.5.13

Core Changes

Credits

next-auth@4.24.14

Bugfixes

v12.1.2

v12.1.1

Bug Fixes

v12.1.0

Bug Fixes

Features

v12.0.3

Bug Fixes

Features

v12.0.2

Features

v12.0.1

Bug Fixes

v12.0.0

Bug Fixes

Changelog

12.1.4 (2026-04-29)

Bug Fixes

Features

12.1.3 (2026-03-24)

Bug Fixes

Features

12.1.1 (2026-02-13)

Bug Fixes

12.1.0 (2026-01-28)

Bug Fixes

Features

v20.9.0

🎨 Features

v20.8.9

👷‍♂️ Patch fixes

v20.8.8

👷‍♂️ Patch fixes

v20.8.7

👷‍♂️ Patch fixes

v20.8.6

👷‍♂️ Patch fixes

v20.8.5

👷‍♂️ Patch fixes

v20.8.4

👷‍♂️ Patch fixes

v20.8.3

👷‍♂️ Patch fixes

v20.8.2

👷‍♂️ Patch fixes

v20.8.1

👷‍♂️ Patch fixes

v20.8.0

vercel Bot commented May 2, 2026 •

edited

Loading