Skip to content

Bump the npm_and_yarn group across 1 directory with 14 updates - #179

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-4796d2bb44
Open

Bump the npm_and_yarn group across 1 directory with 14 updates#179
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-4796d2bb44

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 18, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 14 updates in the / directory:

Package From To
swagger-typescript-api 13.2.13 13.12.2
@babel/core 7.28.4 7.29.7
baseline-browser-mapping 2.8.6 2.11.25
brace-expansion 1.1.12 1.1.21
brace-expansion 2.0.2 2.1.7
browserslist 4.26.2 4.29.0
defu 6.1.4 6.1.7
diff 4.0.2 4.0.4
glob 10.4.5 10.5.0
handlebars 4.7.8 4.7.9
picomatch 2.3.1 2.3.2
js-yaml 3.14.1 3.15.2
minimatch 3.1.2 3.1.5
minimatch 9.0.5 9.0.9
nanoid 5.1.6 5.1.16
yaml 1.10.2 1.10.3

Updates swagger-typescript-api from 13.2.13 to 13.12.2

Release notes

Sourced from swagger-typescript-api's releases.

v13.12.2

Patch Changes

  • #1779 306d59a Thanks @​js2me! - Fix code injection via unescaped enum string values in generated TypeScript enums

    Malicious OpenAPI specs could embed arbitrary JavaScript in components.schemas.*.enum string values. Ts.StringValue wrapped values in double quotes without escaping, allowing attackers to break out of generated enum declarations and inject code that executes at module load when consumers import the generated client. Enum string values are now properly escaped.

    Reported by @​thegr1ffyn: GHSA-5f94-x226-ccpm.

  • #1779 306d59a Thanks @​js2me! - Fix code injection via unescaped servers[0].url in generated axios and fetch HTTP clients

    Malicious OpenAPI specs could embed arbitrary JavaScript in servers[0].url. The value was interpolated raw into string literals in generated client constructors, allowing computed-property-key injection and arbitrary code execution when consumers instantiated HttpClient or Api (axios) or imported the generated module (fetch). apiConfig.baseUrl is now escaped once at the source before template rendering.

    Reported by @​thegr1ffyn: GHSA-38c3-wv3c-v3xj (axios), GHSA-hqj5-cw9f-rx67 (fetch).

  • #1779 306d59a Thanks @​js2me! - Fix code injection via unescaped OpenAPI path strings in generated method bodies

    Malicious OpenAPI specs could embed arbitrary JavaScript in path keys. Values were interpolated raw into template literals in generated API methods, so ${…} expressions ran with full process privileges on every call to the affected method. Route paths are now escaped for template-literal insertion while preserving deliberate ${paramName} interpolations for declared path parameters.

    Reported by @​thegr1ffyn: GHSA-w284-33mx-6g9v.

  • #1779 306d59a Thanks @​js2me! - Fix authorization-token exfiltration and SSRF via spec $ref during remote schema resolution

    When generating from a remote OpenAPI spec, the generator walked every external $ref and fetched any http(s):// URL without validating the target. A malicious spec could force HTTP requests to loopback, RFC-1918, link-local (including cloud metadata at 169.254.169.254), or internal hostnames reachable from the generator process. Redirect chains were also followed without re-validation.

    Remote schema fetches now enforce a defense-in-depth policy:

    • Block private, link-local, and loopback addresses (IPv4 and IPv6), including localhost
    • Allow cross-origin fetches only to public hosts; same-origin $ref targets remain allowed
    • Allow the explicit --url spec source even on loopback (local development)
    • Follow redirects manually (max 5) and re-validate each hop
    • Forward authorizationToken only to same-origin remote URLs, not cross-origin $ref targets

    Reported by @​thegr1ffyn: GHSA-h754-fxp7-88wx, GHSA-x36r-4347-pm5x.

v13.12.1

Patch Changes

  • caa2874 Thanks @​js2me! - update all deps to latest (patch + minor deps, no major updates)

v13.12.0

Minor Changes

  • 691559a Thanks @​js2me! - Add enumStyle: "const-enum" to generate TypeScript const enum declarations for schema enums and the built-in ContentType.

v13.11.2

Patch Changes

  • 691d07d Thanks @​js2me! - Fix schema type name resolution when preferExistingSchemaNamesForExternalRefs is false

... (truncated)

Changelog

Sourced from swagger-typescript-api's changelog.

13.12.2

Patch Changes

  • #1779 306d59a Thanks @​js2me! - Fix code injection via unescaped enum string values in generated TypeScript enums

    Malicious OpenAPI specs could embed arbitrary JavaScript in components.schemas.*.enum string values. Ts.StringValue wrapped values in double quotes without escaping, allowing attackers to break out of generated enum declarations and inject code that executes at module load when consumers import the generated client. Enum string values are now properly escaped.

    Reported by @​thegr1ffyn: GHSA-5f94-x226-ccpm.

  • #1779 306d59a Thanks @​js2me! - Fix code injection via unescaped servers[0].url in generated axios and fetch HTTP clients

    Malicious OpenAPI specs could embed arbitrary JavaScript in servers[0].url. The value was interpolated raw into string literals in generated client constructors, allowing computed-property-key injection and arbitrary code execution when consumers instantiated HttpClient or Api (axios) or imported the generated module (fetch). apiConfig.baseUrl is now escaped once at the source before template rendering.

    Reported by @​thegr1ffyn: GHSA-38c3-wv3c-v3xj (axios), GHSA-hqj5-cw9f-rx67 (fetch).

  • #1779 306d59a Thanks @​js2me! - Fix code injection via unescaped OpenAPI path strings in generated method bodies

    Malicious OpenAPI specs could embed arbitrary JavaScript in path keys. Values were interpolated raw into template literals in generated API methods, so ${…} expressions ran with full process privileges on every call to the affected method. Route paths are now escaped for template-literal insertion while preserving deliberate ${paramName} interpolations for declared path parameters.

    Reported by @​thegr1ffyn: GHSA-w284-33mx-6g9v.

  • #1779 306d59a Thanks @​js2me! - Fix authorization-token exfiltration and SSRF via spec $ref during remote schema resolution

    When generating from a remote OpenAPI spec, the generator walked every external $ref and fetched any http(s):// URL without validating the target. A malicious spec could force HTTP requests to loopback, RFC-1918, link-local (including cloud metadata at 169.254.169.254), or internal hostnames reachable from the generator process. Redirect chains were also followed without re-validation.

    Remote schema fetches now enforce a defense-in-depth policy:

    • Block private, link-local, and loopback addresses (IPv4 and IPv6), including localhost
    • Allow cross-origin fetches only to public hosts; same-origin $ref targets remain allowed
    • Allow the explicit --url spec source even on loopback (local development)
    • Follow redirects manually (max 5) and re-validate each hop
    • Forward authorizationToken only to same-origin remote URLs, not cross-origin $ref targets

    Reported by @​thegr1ffyn: GHSA-h754-fxp7-88wx, GHSA-x36r-4347-pm5x.

13.12.1

Patch Changes

  • caa2874 Thanks @​js2me! - update all deps to latest (patch + minor deps, no major updates)

13.12.0

Minor Changes

  • 691559a Thanks @​js2me! - Add enumStyle: "const-enum" to generate TypeScript const enum declarations for schema enums and the built-in ContentType.

13.11.2

... (truncated)

Commits

Updates @babel/core from 7.28.4 to 7.29.7

Release notes

Sourced from @​babel/core's releases.

v7.29.7 (2026-05-25)

Re-release all packages with npm provenance attestations

v7.29.6 (2026-05-25)

🐛 Bug Fix

Committers: 3

v7.29.5 (2026-05-05)

🏠 Internal

  • babel-preset-env
    • Update @babel/* dependencies

v7.29.4 (2026-05-05)

🐛 Bug Fix

  • babel-plugin-transform-modules-systemjs
    • #17974 [7.x backport]fix(systemjs): improve module string name support (@​JLHwung)

Committers: 1

v7.29.3 (2026-04-30)

👓 Spec Compliance

🐛 Bug Fix

  • babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators
    • #17931 fix(decorators): replace super within all removed static elements (@​JLHwung)
  • babel-register
  • babel-compat-data, babel-plugin-bugfix-safari-rest-destructuring-rhs-array, babel-preset-env

💅 Polish

  • babel-parser

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​babel/core since your current version.


Updates baseline-browser-mapping from 2.8.6 to 2.11.25

Release notes

Sourced from baseline-browser-mapping's releases.

v2.11.0

What's Changed in 2.11.0

  • feat: Adds a new getTimeline() method for getting the series of minimum browser changes, either grouped by date or by browser.
  • refactor: Substantial refactoring of the data compression process that replaces the full list of browsers from @mdn/browser-compat-data and downstream-browsers.json and features from web-features (in their very pared down form) with a change-list timeline that reflects which versions supported Baseline (newly available) on a given date. Thanks to @​swwind for the idea!
  • refactor: Some common functions have been moved to a util.ts module for use in other scripts.
  • fix: Removes process.exit() calls when unsupported option combinations are passed to getCompatibleVersions() and getAllVersions() in favour of throwing an Error. There is a small security risk with process.exit() calls that sites accepting unsanitised inputs could be the subject of attacks. Unsupported config options now throw and Error which should allow for more graceful handling. Thanks to @​bnbdr for flagging this as vulnerability CVE-2026-45819 .

Fixes #134

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.10.44...v2.11.0

v2.10.0

What's Changed

  • Introduces support for Node 6 by refactoring all Object.entries and Object.values instances and lowering ES target in Rollup to es2015.
  • Adds specified Node version support in package.json for >=6.0.0.
  • Refactors CLI code to avoid parseArgs which is not supported by versions of Node prior to 18, changes import to require and changes Rollup export to cjs to allow execution on older versions of Node.
  • Adds a new legacy-test.js file that allows basic testing on older versions of Node where current versions of Jasmine and ESLint are not supported.
  • Adds a test matrix to run tests on all even-numbered Node versions from 6 to 24.
  • refactor publish workflows to support NPM's new OIDC integration

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.9.24...v2.10.0

v2.9.3 - remove process.loadEnvFile()

What's Changed

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.9.2...v2.9.3

v2.9.2 - fix browser support bug

What's Changed

v2.9.0 - Reduce frequency of data staleness warnings

This version introduces a number of changes to data staleness warnings in response to #105 , #107 and #109

  • Data staleness warnings are now only shown if the getCompatibleVersions() or getAllVersions() functions are called - previously they were shown whenever the module was loaded, which meant many browserslist consumers were seeing the warning despite not targeting Baseline, especially those who were consuming browserslist in a pre-compiled format via next.js.
  • Adds new conditions for these warnings to be displayed which should only warn users for whom data freshness is critical:
    • The feature cut off data must be within the last two months, i.e. widelyAvailableOnDate: today + >2 years and 4 months or newly available in a browserslist query.
    • The module data must be more than 2 months old.
  • Introduces suppression options for these warning via the options objects and environment variables:
    • Adds a new suppressWarnings boolean to the getCompatibleVersions() and getAllVersions()
    • Respects the existing BROWSERSLIST_IGNORE_OLD_DATA environment variable.
    • Respects a new BASELINE_BROWSER_MAPPING_IGNORE_OLD_DATA environment variable.
  • Adds explanatory text to the README for how to avoid such warnings when reproducible builds are a requirement.
  • Change warning text to be package manager agnostic and mention the possibility of pre-compiled data.
Commits
  • 719bf7a Patch to 2.11.25 because browser or feature data changed
  • c4f5b49 Browser or feature data changed
  • aa194af Updating static site
  • 0d33c4a Patch to 2.11.24 because browser or feature data changed
  • 1dac891 Browser or feature data changed
  • aff3369 Updating static site
  • ebdc72f Patch to 2.11.23 because browser or feature data changed
  • 55fa3a1 Browser or feature data changed
  • 5ac60db Updating static site
  • af7c3c4 Patch to 2.11.22 because browser or feature data changed
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for baseline-browser-mapping since your current version.


Updates brace-expansion from 1.1.12 to 1.1.21

Release notes

Sourced from brace-expansion's releases.

v1.1.15

  • Backport v5.0.6 change to v1 (#111) 0b09384

juliangruber/brace-expansion@v1.1.14...v1.1.15

Commits

Updates brace-expansion from 2.0.2 to 2.1.7

Release notes

Sourced from brace-expansion's releases.

v1.1.15

  • Backport v5.0.6 change to v1 (#111) 0b09384

juliangruber/brace-expansion@v1.1.14...v1.1.15

Commits

Updates browserslist from 4.26.2 to 4.29.0

Release notes

Sourced from browserslist's releases.

4.29.0

  • Added query continuations across lines and array entries (by @​fzlzjerry).

4.28.9

4.28.8

  • Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

4.28.6

4.28.5

4.28.4

  • Fixed SyntaxError regression of 4.28.3.

4.28.3

  • Fixed baseline query case-insensitivity (by @​swwind).

4.28.2

4.28.1

  • Removed Baseline warning since we have it own warning.

4.27.0

  • Added BROWSERSLIST_TRACE_WARNING environment variable.

4.26.3

Changelog

Sourced from browserslist's changelog.

4.29.0

  • Added query continuations across lines and array entries (by @​fzlzjerry).

4.28.9

4.28.8

  • Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

4.28.6

4.28.5

4.28.4

  • Fixed SyntaxError regression of 4.28.3.

4.28.3

  • Fixed baseline query case-insensitivity (by @​swwind).

4.28.2

4.28.1

  • Removed Baseline warning since we have it own warning.

4.48.0

4.27.0

  • Added BROWSERSLIST_TRACE_WARNING environment variable.

... (truncated)

Commits
  • e6dd578 Release 4.29.0 version
  • 8987b7d Typo
  • 47fefe6 Move from actions-up to pnpm
  • 17b1e23 Update dependencies
  • df16b26 Merge pull request #944 from fzlzjerry/fix/757-query-continuations
  • a2673d7 Support query continuations across entries
  • f46a5b7 Merge pull request #942 from agilgur5/fix-docs-typo-security-table
  • 989c8c9 docs: fix typo in table rendering for SECURITY.md
  • 12ed525 Release 4.28.9 version
  • b1d8cf9 Update dependencies
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for browserslist since your current version.


Updates defu from 6.1.4 to 6.1.7

Release notes

Sourced from defu's releases.

v6.1.7

compare changes

📦 Build

  • Correct the types export entry (#160)
  • Export Defu types (#157)

❤️ Contributors

v6.1.6

compare changes

📦 Build

v6.1.5

compare changes

🩹 Fixes

  • Prevent prototype pollution via __proto__ in defaults (#156)
  • Ignore inherited enumerable properties (11ba022)

✅ Tests

  • Add more tests for plain objects (b65f603)

❤️ Contributors

Changelog

Sourced from defu's changelog.

v6.1.7

compare changes

🩹 Fixes

  • defu.d.cts: Export Defu types (#157)

📦 Build

  • Correct the types export entry (#160)

❤️ Contributors

v6.1.6

compare changes

📦 Build

❤️ Contributors

v6.1.5

compare changes

🩹 Fixes

  • Prevent prototype pollution via __proto__ in defaults (#156)
  • Ignore inherited enumerable properties (11ba022)

🏡 Chore

✅ Tests

  • Add more tests for plain objects (b65f603)

🤖 CI

... (truncated)

Commits
  • 80c0146 chore(release): v6.1.7
  • 40d7ef4 fix(defu.d.cts): export Defu types (#157)
  • 3d3a7c8 build: correct the types export entry (#160)
  • 001c290 chore(release): v6.1.6
  • 407b516 build: fix mixed types
  • 23e59e6 chore(release): v6.1.5
  • 11ba022 fix: ignore inherited enumerable properties
  • 3942bfb fix: prevent prototype pollution via __proto__ in defaults (#156)
  • d3ef16d chore(deps): update actions/checkout action to v6 (#151)
  • 869a053 chore(deps): update actions/setup-node action to v6 (#149)
  • Additional commits viewable in compare view

Updates diff from 4.0.2 to 4.0.4

Changelog

Sourced from diff's changelog.

v4.0.4 - January 2026

Only change from 4.0.2 is a backport of the fix to GHSA-73rr-hh4g-fpgx.

v4.0.3 (deprecated)

Accidental release - do not use.

Commits
Maintainer changes

This version was pushed to npm by explodingcabbage, a new releaser for diff since your current version.


Updates glob from 10.4.5 to 10.5.0

Commits

Updates handlebars from 4.7.8 to 4.7.9

Release notes

Sourced from handlebars's releases.

v4.7.9

Commits

Changelog

Sourced from handlebars's changelog.

v4.7.9 - March 26th, 2026

  • fix: enable shell mode for spawn to resolve Windows EINVAL issue - e0137c2
  • fix type "RuntimeOptions" also accepting string partials - eab1d14
  • feat(types): set hash to be a Record<string, any> - de4414d
  • fix non-contiguous program indices - 4512766
  • refactor: rename i to startPartIndex - e497a35
  • security: fix security issues - 68d8df5

Commits

Commits
  • dce542c v4.7.9
  • 8a41389 Update release notes
  • 68d8df5 Fix security issues
  • b2a0831 Fix browser tests
  • 9f98c16 Fix release script
  • 45443b4 Revert "Improve partial indenting performance"
  • 8841a5f Fix CI errors with linting
  • e0137c2 fix: enable shell mode for spawn to resolve Windows EINVAL issue
  • e914d60 Improve rendering performance
  • 7de4b41 Upgrade GitHub Actions checkout and setup-node on 4.x branch
  • Additional commits viewable in compare view

Updates picomatch from 2.3.1 to 2.3.2

Release notes

Sourced from picomatch's releases.

2.3.2

This is a security release fixing several security relevant issues.

What's Changed

Full Changelog: micromatch/picomatch@2.3.1...2.3.2

Changelog

Sourced from picomatch's changelog.

2.3.2 (2026-03-23)

Fixed

  • Avoided an exception when a glob pattern contains constructor (#144, 3f4f10e).

Security

  • Backported the extglob-quantifier ReDoS fix from 4.0.4. Risky repeated extglobs are now safely rewritten or treated as literals by default; positive numeric maxExtglobRecursion values allow limited nesting, while false disables the safeguard (CVE-2026-33671, eec17ae).
  • Prevented inherited object properties from being interpreted as POSIX character classes (CVE-2026-33672, fc1f6b6).
Commits

Updates js-yaml from 3.14.1 to 3.15.2

Changelog

Sourced from js-yaml's changelog.

3.15.2 - 2026-08-26

Changed

  • [backport] Hard-limit merge sequence size to 100.

Security

  • [backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

3.15.1 - 2026-07-31

Security

  • [backport] Remove quadratic complexity from !!omap duplicate key detection.

3.15.0 - 2026-06-27

Added

  • Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one safeLoad() / safeLoadAll() call.

[3.14.2] - 2025-11-15

Security

  • Fix prototype pollution in merge (<<).
Commits

Updates minimatch from 3.1.2 to 3.1.5

Commits

Updates minimatch from 9.0.5 to 9.0.9

Commits

@dependabot
Bump the npm_and_yarn group across 1 directory with 14 updates
fa9bd16 
Bumps the npm_and_yarn group with 14 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [swagger-typescript-api](https://github.com/acacode/swagger-typescript-api) | `13.2.13` | `13.12.2` |
| [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) | `7.28.4` | `7.29.7` |
| [baseline-browser-mapping](https://github.com/web-platform-dx/baseline-browser-mapping) | `2.8.6` | `2.11.25` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.12` | `1.1.21` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `2.0.2` | `2.1.7` |
| [browserslist](https://github.com/browserslist/browserslist) | `4.26.2` | `4.29.0` |
| [defu](https://github.com/unjs/defu) | `6.1.4` | `6.1.7` |
| [diff](https://github.com/kpdecker/jsdiff) | `4.0.2` | `4.0.4` |
| [glob](https://github.com/isaacs/node-glob) | `10.4.5` | `10.5.0` |
| [handlebars](https://github.com/handlebars-lang/handlebars.js) | `4.7.8` | `4.7.9` |
| [picomatch](https://github.com/micromatch/picomatch) | `2.3.1` | `2.3.2` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `3.14.1` | `3.15.2` |
| [minimatch](https://github.com/isaacs/minimatch) | `3.1.2` | `3.1.5` |
| [minimatch](https://github.com/isaacs/minimatch) | `9.0.5` | `9.0.9` |
| [nanoid](https://github.com/ai/nanoid) | `5.1.6` | `5.1.16` |
| [yaml](https://github.com/eemeli/yaml) | `1.10.2` | `1.10.3` |



Updates `swagger-typescript-api` from 13.2.13 to 13.12.2
- [Release notes](https://github.com/acacode/swagger-typescript-api/releases)
- [Changelog](https://github.com/acacode/swagger-typescript-api/blob/main/CHANGELOG.md)
- [Commits](acacode/swagger-typescript-api@13.2.13...v13.12.2)

Updates `@babel/core` from 7.28.4 to 7.29.7
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.29.7/packages/babel-core)

Updates `baseline-browser-mapping` from 2.8.6 to 2.11.25
- [Release notes](https://github.com/web-platform-dx/baseline-browser-mapping/releases)
- [Commits](web-platform-dx/baseline-browser-mapping@v2.8.6...v2.11.25)

Updates `brace-expansion` from 1.1.12 to 1.1.21
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.21)

Updates `brace-expansion` from 2.0.2 to 2.1.7
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.21)

Updates `browserslist` from 4.26.2 to 4.29.0
- [Release notes](https://github.com/browserslist/browserslist/releases)
- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md)
- [Commits](browserslist/browserslist@4.26.2...4.29.0)

Updates `defu` from 6.1.4 to 6.1.7
- [Release notes](https://github.com/unjs/defu/releases)
- [Changelog](https://github.com/unjs/defu/blob/main/CHANGELOG.md)
- [Commits](unjs/defu@v6.1.4...v6.1.7)

Updates `diff` from 4.0.2 to 4.0.4
- [Changelog](https://github.com/kpdecker/jsdiff/blob/master/release-notes.md)
- [Commits](kpdecker/jsdiff@v4.0.2...v4.0.4)

Updates `glob` from 10.4.5 to 10.5.0
- [Changelog](https://github.com/isaacs/node-glob/blob/main/changelog.md)
- [Commits](isaacs/node-glob@v10.4.5...v10.5.0)

Updates `handlebars` from 4.7.8 to 4.7.9
- [Release notes](https://github.com/handlebars-lang/handlebars.js/releases)
- [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/v4.7.9/release-notes.md)
- [Commits](handlebars-lang/handlebars.js@v4.7.8...v4.7.9)

Updates `picomatch` from 2.3.1 to 2.3.2
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@2.3.1...2.3.2)

Updates `js-yaml` from 3.14.1 to 3.15.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/3.15.2/CHANGELOG.md)
- [Commits](nodeca/js-yaml@3.14.1...3.15.2)

Updates `minimatch` from 3.1.2 to 3.1.5
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v3.1.2...v3.1.5)

Updates `minimatch` from 9.0.5 to 9.0.9
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v3.1.2...v3.1.5)

Updates `nanoid` from 5.1.6 to 5.1.16
- [Release notes](https://github.com/ai/nanoid/releases)
- [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md)
- [Commits](ai/nanoid@5.1.6...5.1.16)

Updates `yaml` from 1.10.2 to 1.10.3
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v1.10.2...v1.10.3)

---
updated-dependencies:
- dependency-name: swagger-typescript-api
  dependency-version: 13.12.2
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: "@babel/core"
  dependency-version: 7.29.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: baseline-browser-mapping
  dependency-version: 2.11.25
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 1.1.21
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 2.1.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: browserslist
  dependency-version: 4.29.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: defu
  dependency-version: 6.1.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: diff
  dependency-version: 4.0.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: glob
  dependency-version: 10.5.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: handlebars
  dependency-version: 4.7.9
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: picomatch
  dependency-version: 2.3.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 3.15.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: minimatch
  dependency-version: 3.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: minimatch
  dependency-version: 9.0.9
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: nanoid
  dependency-version: 5.1.16
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: yaml
  dependency-version: 1.10.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 18, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants