chore(deps): bump the npm_and_yarn group across 2 directories with 14 updates by dependabot[bot] · Pull Request #87 · Agilo/fashion-starter

dependabot · 2026-10-01T09:19:17Z

Bumps the npm_and_yarn group with 11 updates in the /medusa directory:

Package	From	To
@babel/core	`7.29.0`	`7.29.7`
body-parser	`1.20.4`	`1.20.8`
browserslist	`4.28.1`	`4.29.3`
engine.io	`6.6.5`	`6.6.11`
fast-uri	`3.1.0`	`3.1.8`
form-data	`4.0.5`	`4.0.6`
ip-address	`10.1.0`	`10.7.4`
js-yaml	`3.14.2`	`3.15.2`
nanoid	`3.3.11`	`3.3.20`
protobufjs	`7.5.4`	`7.6.6`
socket.io-parser	`4.2.5`	`4.2.7`
browserslist	`4.28.1`	`4.29.3`
fast-uri	`3.1.0`	`3.1.8`
form-data	`4.0.5`	`4.0.6`
js-yaml	`3.14.2`	`3.15.2`
nanoid	`3.3.11`	`3.3.20`

Bumps the npm_and_yarn group with 8 updates in the /storefront directory:

Package	From	To
browserslist	`4.28.1`	`4.29.3`
fast-uri	`3.0.6`	`3.1.8`
form-data	`4.0.5`	`4.0.6`
js-yaml	`4.1.1`	`4.3.2`
nanoid	`3.3.8`	`3.3.20`
postcss	`8.5.3`	`8.5.23`
qs	`6.14.2`	`6.16.0`
qs	`6.14.2`	`6.16.0`
postcss	`8.5.3`	`8.5.23`
@humanfs/node	`0.16.6`	`0.16.8`
browserslist	`4.28.1`	`4.29.3`
fast-uri	`3.0.6`	`3.1.8`
form-data	`4.0.5`	`4.0.6`
js-yaml	`4.1.1`	`4.3.2`
nanoid	`3.3.8`	`3.3.20`

Updates @babel/core from 7.29.0 to 7.29.7

Release notes

Sourced from @babel/core's releases.

v7.29.7 (2026-05-25)

Re-release all packages with npm provenance attestations

v7.29.6 (2026-05-25)

🐛 Bug Fix

babel-generator

#18014 Catchup source map position in preserveFormat (@nicolo-ribaudo)

babel-core

#18001 [7.x packport]Improve input source map handling (@JLHwung)

babel-core, babel-generator

#17998 Preserve original identifier names from input sourcemaps (#17992) (@Andarist)

Committers: 3

Huáng Jùnliàng (@JLHwung)

Mateusz Burzyński (@Andarist)

Nicolò Ribaudo (@nicolo-ribaudo)

v7.29.5 (2026-05-05)

🏠 Internal

babel-preset-env

Update @babel/* dependencies

v7.29.4 (2026-05-05)

🐛 Bug Fix

babel-plugin-transform-modules-systemjs

#17974 [7.x backport]fix(systemjs): improve module string name support (@JLHwung)

Committers: 1

Huáng Jùnliàng (@JLHwung)

v7.29.3 (2026-04-30)

👓 Spec Compliance

babel-parser

#17923 Support flow extends bound (@JLHwung)

🐛 Bug Fix

babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators

#17931 fix(decorators): replace super within all removed static elements (@JLHwung)

babel-register

#17915 Fix thread synchronization issues in @babel/register (@liuxingbaoyu)

babel-compat-data, babel-plugin-bugfix-safari-rest-destructuring-rhs-array, babel-preset-env

#17788 Add bugfix plugin for Safari array rest destructuring bug (@JLHwung)

💅 Polish

babel-parser

... (truncated)

Commits

4fba754 v7.29.7
04ea6b2 v7.29.6
99f498a [7.x packport]Improve input source map handling (#18001)
feba0a3 Preserve original identifier names from input sourcemaps (#17992) (#17998)
See full diff in compare view

Updates body-parser from 1.20.4 to 1.20.8

Release notes

Sourced from body-parser's releases.

1.20.8

Important

Same code base as 1.20.7. This was created to test the new release process.

What's Changed

ci: backport npm-publish workflow from master by @UlisesGascon in expressjs/body-parser#769

1.20.8 by @UlisesGascon in expressjs/body-parser#770

Full Changelog: expressjs/body-parser@1.20.7...1.20.8

1.20.7

What's Changed

docs: include security fix in 1.20.6 changes by @UlisesGascon in expressjs/body-parser#747

deps: qs@~6.16.0 by @krzysdz in expressjs/body-parser#761

1.20.7 by @UlisesGascon in expressjs/body-parser#767

Full Changelog: expressjs/body-parser@1.20.6...1.20.7

1.20.6

Important: Security

Security fix for CVE-2026-12590 (GHSA-v422-hmwv-36x6)

What's Changed

fix: improve limit option validation by @Phillip9587 in expressjs/body-parser#741

Full Changelog: expressjs/body-parser@1.20.5...1.20.6

v1.20.5

What's Changed

The reason for this release is a fix to the extended urlencoded parser returning objects instead of arrays for large array inputs (> 100) on qs@6.14.2+. (expressjs/body-parser#716)

refactor(json): simplify strict mode error string construction by @jonchurch in expressjs/body-parser#692

fix: correct off-by-one error in parameterCount by @abhu85 in expressjs/body-parser#716

deps(qs): bump qs to 6.15.1 by @jonchurch in expressjs/body-parser#722

Release: 1.20.5 by @jonchurch in expressjs/body-parser#721

New Contributors

@abhu85 made their first contribution in expressjs/body-parser#716

Special thanks to triager @krzysdz for keeping this on our radar and effectively triaging the specific issue!

Full Changelog: expressjs/body-parser@1.20.4...1.20.5

Changelog

Sourced from body-parser's changelog.

1.20.8

Same code base as 1.20.7. This was created to test the new release process.

1.20.7

deps: qs@~6.16.0

1.20.6

Security fix for GHSA-v422-hmwv-36x6

fix: improve limit option validation (#698)

Invalid limit values (e.g. unparseable strings or NaN) now throw instead of being silently ignored, which previously disabled size limit enforcement

null and undefined fall back to the default 100kb limit

1.20.5

refactor(json): simplify strict mode error string construction

fix: extended urlencoded parsing of arrays with >100 elements (#716)

deps: qs@~6.15.1

Commits

5c08c20 1.20.8 (#770)
0cea4f4 ci: backport npm-publish workflow from master (#769)
0f0f0d7 1.20.7 (#767)
355eb04 deps: qs@~6.16.0 (#761)
8be369a docs: include security fix in 1.20.6 changes
5cc4fb8 1.20.6 (#746)
3492672 fix: improve limit option validation (#741)
0defdbe release(patch): 1.20.5
cd0e7a0 deps(qs): bump qs to 6.15.1
6f24d7e fix: correct off-by-one error in parameterCount (#716)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for body-parser since your current version.

Updates browserslist from 4.28.1 to 4.29.3

Release notes

Sourced from browserslist's releases.

4.29.3

Updated Firefox ESR.

4.29.2

Fixed ignoring null usage in cover X in Y query (by @wahidrizka).

4.29.1

Fixed config name loading protection on Windows (by @oss-security-shop).

Fixed case-insensitive negation queries (by @jakezwang).

Fixed percentage and supports queries case-insensitive (by @wahidrizka).

Fixed old Node.js tests (by @aaron-belenky).

Reduced code (by @charmander).

4.29.0

Added query continuations across lines and array entries (by @fzlzjerry).

4.28.9

Improve or parsing performance (by @NotAFlightRisk).

4.28.8

Fixed including kaios in baseline queries (by @Jaybhade).

4.28.7

Improved parsing performance.

Fixed unbounded memory growth (by @alanturing881).

Fixed prototype write issue (by @alanturing881).

4.28.6

Fixed Electron version queries (by @spokodev).

4.28.5

Fixed > and >= queries (by @spokodev).

4.28.4

Fixed SyntaxError regression of 4.28.3.

4.28.3

Fixed baseline query case-insensitivity (by @swwind).

4.28.2

Fix prototype pollution (by @chluo1997).

Changelog

Sourced from browserslist's changelog.

4.29.3

Updated Firefox ESR.

4.29.2

Fixed ignoring null usage in cover X in Y query (by @wahidrizka).

4.29.1

Fixed config name loading protection on Windows (by @oss-security-shop).

Fixed case-insensitive negation queries (by @jakezwang).

Fixed percentage and supports queries case-insensitive (by @wahidrizka).

Fixed old Node.js tests (by @aaron-belenky).

Reduced code (by @charmander).

4.29.0

Added query continuations across lines and array entries (by @fzlzjerry).

4.28.9

Improved or parsing performance (by @NotAFlightRisk).

4.28.8

Fixed including kaios in baseline queries (by @Jaybhade).

4.28.7

Improved parsing performance.

Fixed unbounded memory growth (by @alanturing881).

Fixed prototype write issue (by @alanturing881).

4.28.6

Fixed Electron version queries (by @spokodev).

4.28.5

Fixed > and >= queries (by @spokodev).

4.28.4

Fixed SyntaxError regression of 4.28.3.

4.28.3

Fixed baseline query case-insensitivity (by @swwind).

... (truncated)

Commits

b4809dd Release 4.29.3 version
9d844f8 Update Firefox ESR
0033f34 Update dependencies
906d329 Release 4.29.2 version
ff8c83f Update dependencies
067f4a1 Merge pull request #952 from wahidrizka/fix-cover-null-usage
f760921 Do not add versions without usage data to cover queries
5be63f5 Merge pull request #953 from wahidrizka/docs-android-latest-version
1e5356f Note that Android version queries return only the latest version
5b7e941 Add missed changes to ChangeLog
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for browserslist since your current version.

Updates engine.io from 6.6.5 to 6.6.11

Release notes

Sourced from engine.io's releases.

engine.io@6.6.11

Bug Fixes

refresh ping timeout on incoming packets (da008a5)

Dependencies

ws@~8.21.0 (no change)

engine.io@6.6.10

Bug Fixes

reject protocol mismatch for existing sessions (86db1fc)

restore compatibility with Node.js 10 (ae7fb46)

run the polling write callback when the client aborts a compressed response (#5540) (915a3ed)

Performance Improvements

optimize polling request body buffering (dcbd961)

stream compressed polling responses (91dd763)

Dependencies

ws@~8.21.0 (no change)

engine.io-client@6.6.6

The ws dependency was bumped to ~8.21.0 following CVE-2026-48779.

Bug Fixes

preserve transport literal suggestions (#5469) (d8f392e)

Dependencies

ws@~8.21.0 (diff)

engine.io@6.6.9

The ws dependency was bumped to ~8.21.0 following CVE-2026-48779.

Dependencies

ws@~8.21.0 (diff)

Commits

9738333 chore(release): engine.io@6.6.11
fc9dd90 docs(eio): rework README
da008a5 fix(eio): refresh ping timeout on incoming packets
3df3fed fix(eio-client): restore default transport resolution
aaf2af3 test: upgrade WebdriverIO to v9
b5da079 refactor(sio): simplify packet handling switch
45873ca docs(protocol): clarify namespace comma restriction for built-in parser (#5545)
551a3dc test: use execFile for fixture scripts (#5549)
ea5560c docs(examples): update create-react-app example docs links (#5535)
59f4f24 fix(sio): reject stateful regexps for dynamic namespaces
Additional commits viewable in compare view

Updates fast-uri from 3.1.0 to 3.1.8

Release notes

Sourced from fast-uri's releases.

v3.1.8

⚠️ Security Warning

This security release fixes the following medium-severity security advisory:

GHSA-hrr3-gc8f-f4qj — inconsistent host case normalization via percent-encoded octets

Users of the v3.x release line should upgrade to v3.1.8.

Full Changelog: fastify/fast-uri@v3.1.7...v3.1.8

v3.1.7

⚠️ Security Warning

This is a security release that fixes the following high-severity security advisories:

GHSA-qw65-cvwx-89v3 — authority injection via an unvalidated port in serialize()

GHSA-58mr-gqgx-xq4g — host confusion via unbalanced or misplaced IP-literal brackets

Users of the v3.x release line should upgrade to v3.1.7.

Full Changelog: fastify/fast-uri@v3.1.6...v3.1.7

v3.1.6

⚠️ Security Warning

This release addresses the following high-severity security advisories:

GHSA-5jgf-p345-68v8 — host confusion via skipped IDN canonicalization on scheme-relative references

GHSA-fph4-wmhf-6fwf — server-side request forgery via repeated hostname percent-decoding

GHSA-f65p-4m7j-42xc — server-side request forgery via malformed IPv6 normalization

GHSA-jqff-g426-hqxp — host confusion via percent-encoded scheme normalization

Users of the v3.x release line should upgrade to v3.1.6.

Full Changelog: fastify/fast-uri@v3.1.5...v3.1.6

v3.1.5

⚠️ Security Warning

Fix for GHSA-7p8r-x3mc-p8w7

Full Changelog: fastify/fast-uri@v3.1.4...v3.1.5

v3.1.4

⚠️ Security Release

Fix for GHSA-v2hh-gcrm-f6hx

Full Changelog: fastify/fast-uri@v3.1.3...v3.1.4

... (truncated)

Commits

ead3ab7 Bumped v3.1.8
c88b59e fix: normalize decoded reg-name case
412e40a Bumped v3.1.7
9f4c943 fix: backport port and IP-literal validation to v3.x (#216)
1eb3ce4 fix: treat unterminated bracket hosts as reg-names again (#214)
6f970b2 Bumped v3.1.6
d941579 fix: never run IDN canonicalization on bracketed IP literals
c0f0279 test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)
37f3417 Merge commit from fork
607bfbe Merge commit from fork
Additional commits viewable in compare view

Updates form-data from 4.0.5 to 4.0.6

Changelog

Sourced from form-data's changelog.

v4.0.6 - 2026-06-12

Commits

[Fix] escape CR, LF, and " in field names and filenames 8dff42c

[Dev Deps] update @ljharb/eslint-config, auto-changelog, tape f31d21e

[Deps] update hasown, mime-types 92ae0eb

[Dev Deps] update js-randomness-predictor 67b0f65

Commits

64190db v4.0.6
92ae0eb [Deps] update hasown, mime-types
f31d21e [Dev Deps] update @ljharb/eslint-config, auto-changelog, tape
8dff42c [Fix] escape CR, LF, and " in field names and filenames
67b0f65 [Dev Deps] update js-randomness-predictor
See full diff in compare view

Updates ip-address from 10.1.0 to 10.7.4

Release notes

Sourced from ip-address's releases.

v10.7.4

Full Changelog: beaugunderson/ip-address@v10.7.3...v10.7.4

v10.7.3

What's Changed

Reject an in-addr.arpa name longer than 32 characters before splitting it by @beaugunderson in beaugunderson/ip-address#228

Full Changelog: beaugunderson/ip-address@v10.7.2...v10.7.3

v10.7.2

What's Changed

Accept an arpa suffix in any case and without the root dot in fromArpa by @beaugunderson in beaugunderson/ip-address#227

Full Changelog: beaugunderson/ip-address@v10.7.1...v10.7.2

v10.7.1

What's Changed

Bump js-yaml and brace-expansion in the lockfile by @beaugunderson in beaugunderson/ip-address#226

Full Changelog: beaugunderson/ip-address@v10.7.0...v10.7.1

v10.7.0

What's Changed

Add offset() and nextNetwork(), accept prefix-length ip6.arpa names, correct the IPv6 end-address docs by @beaugunderson in beaugunderson/ip-address#225

Full Changelog: beaugunderson/ip-address@v10.6.0...v10.7.0

v10.6.0

What's Changed

Add isGlobal() and pin the classifiers to the IANA special-purpose registries by @beaugunderson in beaugunderson/ip-address#224

Full Changelog: beaugunderson/ip-address@v10.5.1...v10.6.0

v10.5.1

Full Changelog: beaugunderson/ip-address@v10.5.0...v10.5.1

v10.5.0

What's Changed

Honor the fromURL graceful-failure contract for non-IPv6 hosts by @beaugunderson in beaugunderson/ip-address#218

Correct the documentation where it disagreed with the library by @beaugunderson in beaugunderson/ip-address#219

Full Changelog: beaugunderson/ip-address@v10.4.0...v10.5.0

v10.4.0

... (truncated)

Commits

651c1dd 10.7.4
ec80fcd Find an IPv6 zone by index so a rejected zone costs one pass
e22eb4a Check generated docs without writing or hiding partial staging
c7f838e 10.7.3
09b8072 Reject an in-addr.arpa name longer than 32 characters before splitting it (#228)
974b48d 10.7.2
4dfe8e5 Accept an arpa suffix in any case and without the root dot in fromArpa (#227)
f0c25df 10.7.1
8b34a21 Merge commit from fork
13b6155 Merge commit from fork
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for ip-address since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates js-yaml from 3.14.2 to 3.15.2

Changelog

Sourced from js-yaml's changelog.

3.15.2 - 2026-08-26

Changed

[backport] Hard-limit merge sequence size to 100.

Security

[backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

3.15.1 - 2026-07-31

Security

[backport] Remove quadratic complexity from !!omap duplicate key detection.

3.15.0 - 2026-06-27

Added

Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one safeLoad() / safeLoadAll() call.

Commits

5c45bd6 3.15.2 released
5a708f9 dist rebuild
3485bc0 Backport merge limits from v5.4.1
f34812f Update .gitignore
ab85ae2 3.15.1 released
30a5e76 dist rebuild
22a8071 Backport quadratic complexity fix for !!omap
c34b6c4 3.15.0 released
21e13d3 dist rebuild
4165c62 Add v3-legacy tag for publish
Additional commits viewable in compare view

Updates nanoid from 3.3.11 to 3.3.20

Release notes

Sourced from nanoid's releases.

3.3.20

Fixed types (by @johnemau).

3.3.19

Fixed killing the app by setting huge user ID.

3.3.18

Fixed infinite loop on async for React Native (by @OvergrowthBeards-JB).

3.3.17

Fixed infinite loop on zero size.

3.3.16

Fixed infinite loop on negative size (by @greymoth-jp).

3.3.15

Fixed npm provenance error.

3.3.14

Fixed random pool corruption on big ID sizes.

3.3.13

Reduced npm package size.

3.3.12

Fixed breaking Nano ID by requesting big ID.

Changelog

Sourced from nanoid's changelog.

3.3.20

Fixed types (by @johnemau).

3.3.19

Fixed killing the app by setting huge user ID (by @geoffrey-diederichs).

3.3.18

Fixed infinite loop on async for React Native (by @OvergrowthBeards-JB).

3.3.17

Fixed infinite loop on zero size.

3.3.16

Fixed infinite loop on negative size (by @greymoth-jp).

3.3.15

Fixed npm provenance error.

3.3.14

Fixed random pool corruption on big ID sizes.

3.3.13

Reduced npm package size.

3.3.12

Fixed breaking Nano ID by requesting big ID.

Commits

d76f633 Release 3.3.20 version
ac09ff6 Fix: async return types are synchronous in v3 (#615)
eb63bd6 Release 3.3.19 version
9067e03 Sync CJS and ESM
9ad9805 Release 3.3.18 version
55e50a0 Update CI action
e10f8d4 Update index.native.js (#606)
73d6716 Release 3.3.17 version
f9d13f1 Sync 0 size behaviour with PostCSS 5
9760e11 Release 3.3.16 version
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nanoid since your current version.

Updates protobufjs from 7.5.4 to 7.6.6

Release notes

Sourced from protobufjs's releases.

protobufjs: v7.6.6

7.6.6 (2026-08-27)

Bug Fixes

Backport recent 8.x fixes to 7.x (#2422) (d3db676)

protobufjs: v7.6.5

7.6.5 (2026-07-04)

Bug Fixes

handle EOF during options parsing (#2352) (#2356) (10fba6d)

protobufjs: v7.6.4

7.6.4 (2026-06-12)

Bug Fixes

Reconfigure and speed up CI (#2329) (574f761)

Remove inquire submodule (#2327) (06ddd07)

protobufjs: v7.6.3

7.6.3 (2026-06-09)

Bug Fixes

Avoid name collisions in generated code (#2311) (78a9576)

Preserve null conversion behavior for fieldless messages (#2312) (df91652)

protobufjs: v7.6.2

7.6.2 (2026-05-30)

Bug Fixes

Backport consistency and correctness fixes (#2294) (a92f72e)

protobufjs: v7.6.1

7.6.1 (2026-05-22)

Bug Fixes

Backport misc utility hardening (#2280) (8a45c13)

Treat fixed64 as unsigned in converters (#2266) (479dfdc)

... (truncated)

Changelog

Sourced from protobufjs's changelog.

7.6.6 (2026-08-27)

Bug Fixes

Backport recent 8.x fixes to 7.x (#2422) (d3db676)

7.6.5 (2026-07-04)

Bug Fixes

handle EOF during options parsing (#2352) (#2356) (10fba6d)

7.6.4 (2026-06-12)

Bug Fixes

Reconfigure and speed up CI (#2329) (574f761)

Remove inquire submodule (#2327) (06ddd07)

7.6.3 (2026-06-09)

Bug Fixes

Avoid name collisions in generated code (#2311) (78a9576)

Preserve null conversion behavior for fieldless messages (#2312) (df91652)

7.6.2 (2026-05-30)

Bug Fixes

Backport consistency and correctness fixes (#2294) (a92f72e)

7.6.1 (2026-05-22)

Bug Fixes

Backport misc utility hardening (#2280) (8a45c13)

Treat fixed64 as unsigned in converters (#2266) (479dfdc)

7.6.0 (2026-05-18)

Features

... (truncated)

Commits

795704d chore: release protobufjs-v7.x (#2423)
d3db676 fix: Backport recent 8.x fixes to 7.x (#2422)
fe82f72 chore: Update micromodule repository urls (#2362)
d29ff67 chore: release protobufjs-v7.x (#2361)
d1ae3ce perf: Batch String.fromCharCode in @protobufjs/utf8 read (#2355)
89048ba chore: release protobufjs-v7.x (#2357)
10fba6d fix: handle EOF during options parsing (#2352) (#2356)
f8f64ef chore: release protobufjs-v7.x (#2330)
574f761 fix: Reconfigure and speed up CI (#2329)
06ddd07 fix: Remove inquire submodule (#2327)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for protobufjs since your current version.

Updates socket.io-parser from 4.2.5 to 4.2.7

Release notes

Sourced from socket.io-parser's releases.

socket.io-parser@4.2.7

Bug Fixes

honor toJSON() when deconstructing a binary packet (#5518) (57f1114)

reject binary packets with zero attachments (7c6ef57)

New Contributors

@spokodev made their first contribution in socketio/socket.io#5518

socket.io-parser@4.2.6

This release includes a fix for CVE-2026-33151. Please upgrade as soon as possible.

Bug Fixes

add a limit to the number of binary attachments (b25738c)

Commits

4054894 chore(release): socket.io-parser@4.2.7
7c6ef57 fix(parser): reject binary packets with zero attachments
57f1114 fix(parser): honor toJSON() when deconstructing a binary packet (#5518)
8d2e4f7 docs(security): add CVE-2026-59724 and CVE-2026-59725
d2d753f refactor(sio): align client file matching in Node.js HTTP server
dfb5ab3 fix(sio): prevent uWebSockets.js from serving missing client files
dcbd961 perf(eio): optimize polling request body buffering
6bb2e7f refactor(sio): internalize base64id dependency
a80711a refactor(eio): internalize base64id dependency
8bead0f chore: upgrade to TypeScript 6
Additional commits viewable in compare view

Updates browserslist from 4.28.1 to 4.29.3

Release notes

Sourced from browserslist's releases.

4.29.3

Updated Firefox ESR.

4.29.2

Fixed ignoring null usage in cover X in Y query (by @wahidrizka).

4.29.1

Fixed config name loading protection on Windows (by @oss-security-shop).

Fixed case-insensitive negation queries (by @jakezwang).

Fixed percentage and supports queries case-insensitive (by @wahidrizka).

Fixed old Node.js tests (by @aaron-belenky).

Reduced code (by @charmander).

4.29.0

Added query continuations across lines and array entries (by @fzlzjerry).

4.28.9

Improve or parsing performance (by @NotAFlightRisk).

4.28.8

Fixed including kaios in baseline queries (by @Jaybhade).

4.28.7

Improved parsing performance.

Fixed unbounded memory growth (by @alanturing881).

Fixed prototype write issue (by @alanturing881).

4.28.6

Fixed Electron version queries (by @spokodev).

4.28.5

Fixed > and >= que...
Description has been truncated

medusajs · 2026-10-01T09:19:23Z

Name	Backend Status	Storefront Status	Preview Link	Last Updated
agilo-dtc-starter	🔵 Pending	-	Review preview rules	Thu, 01 Oct 2026 09:19:22 GMT

anteprimorac · 2026-10-12T08:32:22Z

@dependabot rebase

… updates Bumps the npm_and_yarn group with 11 updates in the /medusa directory: | Package | From | To | | --- | --- | --- | | [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) | `7.29.0` | `7.29.7` | | [body-parser](https://github.com/expressjs/body-parser) | `1.20.4` | `1.20.8` | | [browserslist](https://github.com/browserslist/browserslist) | `4.28.1` | `4.29.3` | | [engine.io](https://github.com/socketio/socket.io) | `6.6.5` | `6.6.11` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.1.0` | `3.1.8` | | [form-data](https://github.com/form-data/form-data) | `4.0.5` | `4.0.6` | | [ip-address](https://github.com/beaugunderson/ip-address) | `10.1.0` | `10.7.4` | | [js-yaml](https://github.com/nodeca/js-yaml) | `3.14.2` | `3.15.2` | | [nanoid](https://github.com/ai/nanoid) | `3.3.11` | `3.3.20` | | [protobufjs](https://github.com/protobufjs/protobuf.js) | `7.5.4` | `7.6.6` | | [socket.io-parser](https://github.com/socketio/socket.io) | `4.2.5` | `4.2.7` | | [browserslist](https://github.com/browserslist/browserslist) | `4.28.1` | `4.29.3` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.1.0` | `3.1.8` | | [form-data](https://github.com/form-data/form-data) | `4.0.5` | `4.0.6` | | [js-yaml](https://github.com/nodeca/js-yaml) | `3.14.2` | `3.15.2` | | [nanoid](https://github.com/ai/nanoid) | `3.3.11` | `3.3.20` | Bumps the npm_and_yarn group with 8 updates in the /storefront directory: | Package | From | To | | --- | --- | --- | | [browserslist](https://github.com/browserslist/browserslist) | `4.28.1` | `4.29.3` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.0.6` | `3.1.8` | | [form-data](https://github.com/form-data/form-data) | `4.0.5` | `4.0.6` | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.1` | `4.3.2` | | [nanoid](https://github.com/ai/nanoid) | `3.3.8` | `3.3.20` | | [postcss](https://github.com/postcss/postcss) | `8.5.3` | `8.5.23` | | [qs](https://github.com/ljharb/qs) | `6.14.2` | `6.16.0` | | [qs](https://github.com/ljharb/qs) | `6.14.2` | `6.16.0` | | [postcss](https://github.com/postcss/postcss) | `8.5.3` | `8.5.23` | | [@humanfs/node](https://github.com/humanwhocodes/humanfs/tree/HEAD/packages/node) | `0.16.6` | `0.16.8` | | [browserslist](https://github.com/browserslist/browserslist) | `4.28.1` | `4.29.3` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.0.6` | `3.1.8` | | [form-data](https://github.com/form-data/form-data) | `4.0.5` | `4.0.6` | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.1` | `4.3.2` | | [nanoid](https://github.com/ai/nanoid) | `3.3.8` | `3.3.20` | Updates `@babel/core` from 7.29.0 to 7.29.7 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.7/packages/babel-core) Updates `body-parser` from 1.20.4 to 1.20.8 - [Release notes](https://github.com/expressjs/body-parser/releases) - [Changelog](https://github.com/expressjs/body-parser/blob/1.20.8/HISTORY.md) - [Commits](expressjs/body-parser@1.20.4...1.20.8) Updates `browserslist` from 4.28.1 to 4.29.3 - [Release notes](https://github.com/browserslist/browserslist/releases) - [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md) - [Commits](browserslist/browserslist@4.28.1...4.29.3) Updates `engine.io` from 6.6.5 to 6.6.11 - [Release notes](https://github.com/socketio/socket.io/releases) - [Changelog](https://github.com/socketio/socket.io/blob/main/CHANGELOG.md) - [Commits](https://github.com/socketio/socket.io/compare/engine.io@6.6.5...engine.io@6.6.11) Updates `fast-uri` from 3.1.0 to 3.1.8 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.0...v3.1.8) Updates `form-data` from 4.0.5 to 4.0.6 - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v4.0.5...v4.0.6) Updates `ip-address` from 10.1.0 to 10.7.4 - [Release notes](https://github.com/beaugunderson/ip-address/releases) - [Commits](beaugunderson/ip-address@v10.1.0...v10.7.4) Updates `js-yaml` from 3.14.2 to 3.15.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/3.15.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.14.2...3.15.2) Updates `nanoid` from 3.3.11 to 3.3.20 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](ai/nanoid@3.3.11...3.3.20) Updates `protobufjs` from 7.5.4 to 7.6.6 - [Release notes](https://github.com/protobufjs/protobuf.js/releases) - [Changelog](https://github.com/protobufjs/protobuf.js/blob/protobufjs-v7.6.6/CHANGELOG.md) - [Commits](protobufjs/protobuf.js@protobufjs-v7.5.4...protobufjs-v7.6.6) Updates `socket.io-parser` from 4.2.5 to 4.2.7 - [Release notes](https://github.com/socketio/socket.io/releases) - [Changelog](https://github.com/socketio/socket.io/blob/main/CHANGELOG.md) - [Commits](https://github.com/socketio/socket.io/compare/socket.io-parser@4.2.5...socket.io-parser@4.2.7) Updates `browserslist` from 4.28.1 to 4.29.3 - [Release notes](https://github.com/browserslist/browserslist/releases) - [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md) - [Commits](browserslist/browserslist@4.28.1...4.29.3) Updates `fast-uri` from 3.1.0 to 3.1.8 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.0...v3.1.8) Updates `form-data` from 4.0.5 to 4.0.6 - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v4.0.5...v4.0.6) Updates `js-yaml` from 3.14.2 to 3.15.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/3.15.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.14.2...3.15.2) Updates `nanoid` from 3.3.11 to 3.3.20 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](ai/nanoid@3.3.11...3.3.20) Updates `browserslist` from 4.28.1 to 4.29.3 - [Release notes](https://github.com/browserslist/browserslist/releases) - [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md) - [Commits](browserslist/browserslist@4.28.1...4.29.3) Updates `fast-uri` from 3.0.6 to 3.1.8 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.0...v3.1.8) Updates `form-data` from 4.0.5 to 4.0.6 - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v4.0.5...v4.0.6) Updates `js-yaml` from 4.1.1 to 4.3.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/3.15.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.14.2...3.15.2) Updates `nanoid` from 3.3.8 to 3.3.20 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](ai/nanoid@3.3.11...3.3.20) Updates `postcss` from 8.5.3 to 8.5.23 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.3...8.5.23) Updates `qs` from 6.14.2 to 6.16.0 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.14.2...v6.16.0) Updates `qs` from 6.14.2 to 6.16.0 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.14.2...v6.16.0) Updates `postcss` from 8.5.3 to 8.5.23 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.3...8.5.23) Updates `@humanfs/node` from 0.16.6 to 0.16.8 - [Release notes](https://github.com/humanwhocodes/humanfs/releases) - [Changelog](https://github.com/humanwhocodes/humanfs/blob/main/packages/node/CHANGELOG.md) - [Commits](https://github.com/humanwhocodes/humanfs/commits/node-v0.16.8/packages/node) Updates `browserslist` from 4.28.1 to 4.29.3 - [Release notes](https://github.com/browserslist/browserslist/releases) - [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md) - [Commits](browserslist/browserslist@4.28.1...4.29.3) Updates `fast-uri` from 3.0.6 to 3.1.8 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.0...v3.1.8) Updates `form-data` from 4.0.5 to 4.0.6 - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v4.0.5...v4.0.6) Updates `js-yaml` from 4.1.1 to 4.3.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/3.15.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.14.2...3.15.2) Updates `nanoid` from 3.3.8 to 3.3.20 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](ai/nanoid@3.3.11...3.3.20) --- updated-dependencies: - dependency-name: "@babel/core" dependency-version: 7.29.7 dependency-type: indirect - dependency-name: "@humanfs/node" dependency-version: 0.16.8 dependency-type: indirect - dependency-name: body-parser dependency-version: 1.20.8 dependency-type: indirect - dependency-name: browserslist dependency-version: 4.29.3 dependency-type: indirect - dependency-name: browserslist dependency-version: 4.29.3 dependency-type: indirect - dependency-name: browserslist dependency-version: 4.29.3 dependency-type: indirect - dependency-name: browserslist dependency-version: 4.29.3 dependency-type: indirect - dependency-name: engine.io dependency-version: 6.6.11 dependency-type: indirect - dependency-name: fast-uri dependency-version: 3.1.8 dependency-type: indirect - dependency-name: fast-uri dependency-version: 3.1.8 dependency-type: indirect - dependency-name: fast-uri dependency-version: 3.1.8 dependency-type: indirect - dependency-name: fast-uri dependency-version: 3.1.8 dependency-type: indirect - dependency-name: form-data dependency-version: 4.0.6 dependency-type: indirect - dependency-name: form-data dependency-version: 4.0.6 dependency-type: indirect - dependency-name: form-data dependency-version: 4.0.6 dependency-type: indirect - dependency-name: form-data dependency-version: 4.0.6 dependency-type: indirect - dependency-name: ip-address dependency-version: 10.7.2 dependency-type: indirect - dependency-name: js-yaml dependency-version: 3.15.2 dependency-type: indirect - dependency-name: js-yaml dependency-version: 3.15.2 dependency-type: indirect - dependency-name: js-yaml dependency-version: 4.3.2 dependency-type: indirect - dependency-name: js-yaml dependency-version: 4.3.2 dependency-type: indirect - dependency-name: nanoid dependency-version: 3.3.19 dependency-type: indirect - dependency-name: nanoid dependency-version: 3.3.19 dependency-type: indirect - dependency-name: nanoid dependency-version: 3.3.19 dependency-type: indirect - dependency-name: nanoid dependency-version: 3.3.19 dependency-type: indirect - dependency-name: postcss dependency-version: 8.5.23 dependency-type: direct:development - dependency-name: postcss dependency-version: 8.5.23 dependency-type: direct:development - dependency-name: protobufjs dependency-version: 7.6.6 dependency-type: indirect - dependency-name: qs dependency-version: 6.16.0 dependency-type: direct:production - dependency-name: qs dependency-version: 6.16.0 dependency-type: direct:production - dependency-name: socket.io-parser dependency-version: 4.2.7 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 1, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/medusa/npm_and_yarn-ade3bba7cf branch from 6a08901 to 218ca48 Compare October 12, 2026 08:41

Navigation Menu

Repository navigation

chore(deps): bump the npm_and_yarn group across 2 directories with 14 updates - #87

chore(deps): bump the npm_and_yarn group across 2 directories with 14 updates#87
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/medusa/npm_and_yarn-ade3bba7cf

dependabot Bot commented on behalf of github Oct 1, 2026 •

edited

Loading

Uh oh!

medusajs Bot commented Oct 1, 2026

Uh oh!

anteprimorac commented Oct 12, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v7.29.7 (2026-05-25)

v7.29.6 (2026-05-25)

🐛 Bug Fix

Committers: 3

v7.29.5 (2026-05-05)

🏠 Internal

v7.29.4 (2026-05-05)

🐛 Bug Fix

Committers: 1

v7.29.3 (2026-04-30)

👓 Spec Compliance

🐛 Bug Fix

💅 Polish

1.20.8

Important

What's Changed

1.20.7

What's Changed

1.20.6

Important: Security

What's Changed

v1.20.5

What's Changed

New Contributors

1.20.8

1.20.7

1.20.6

1.20.5

4.29.3

4.29.2

4.29.1

4.29.0

4.28.9

4.28.8

4.28.7

4.28.6

4.28.5

4.28.4

4.28.3

4.28.2

4.29.3

4.29.2

4.29.1

4.29.0

4.28.9

4.28.8

4.28.7

4.28.6

4.28.5

4.28.4

4.28.3

engine.io@6.6.11

Bug Fixes

Dependencies

engine.io@6.6.10

Bug Fixes

Performance Improvements

Dependencies

engine.io-client@6.6.6

Bug Fixes

Dependencies

engine.io@6.6.9

Dependencies

v3.1.8

⚠️ Security Warning

v3.1.7

⚠️ Security Warning

v3.1.6

⚠️ Security Warning

v3.1.5

⚠️ Security Warning

v3.1.4

⚠️ Security Release

v4.0.6 - 2026-06-12

Commits

v10.7.4

v10.7.3

dependabot Bot commented on behalf of github Oct 1, 2026 •

edited

Loading