build(deps): bump the npm_and_yarn group across 2 directories with 7 updates by dependabot[bot] · Pull Request #29 · Stakely/consolideth

dependabot · 2026-06-28T22:38:03Z

Bumps the npm_and_yarn group with 6 updates in the /api directory:

Package	From	To
joi	`17.13.3`	`17.13.4`
typeorm	`0.3.27`	`0.3.30`
form-data	`4.0.5`	`4.0.6`
qs	`6.15.0`	`6.15.3`
undici	`7.24.5`	`7.28.0`
ws	`8.18.2`	`8.21.0`

Bumps the npm_and_yarn group with 1 update in the /frontend directory: js-yaml.

Updates joi from 17.13.3 to 17.13.4

Commits

3d3ab76 17.13.4
4bcdf36 Merge pull request #3123 from hapijs/chore/backport-3113
97bd51d chore: backport #3113 to v17
See full diff in compare view

Updates typeorm from 0.3.27 to 0.3.30

Release notes

Sourced from typeorm's releases.

0.3.30

What's Changed

fix: scope invalidWhereValuesBehavior to high-level abstractions only by @naorpeled in typeorm/typeorm#11878

fix: scope computed-columns join to correct table in MSSQL schema query by @PreAgile in typeorm/typeorm#12288

fix: preserve user-defined shared join columns in change set by @PreAgile in typeorm/typeorm#12354

revert: fix up limit with joins by @alumni

fix(find-options): allow array values in JsonContains by @kyungseopk1m in typeorm/typeorm#12420

fix(cockroachdb): adjust join in loadTables to load correct table columns by @Cprakhar in typeorm/typeorm#12413

ci: use the v0.3 branch as base for detect-changes by @alumni

chore(release): release 0.3.30 by @alumni in typeorm/typeorm#12511

Full Changelog: typeorm/typeorm@0.3.29...0.3.30

0.3.29

What's Changed

fix: fix up aggregate methods ambiguous column by @Cprakhar in typeorm/typeorm#11822

fix: prevent eager-loaded entities from overwriting manual relations by @LeviHeber in typeorm/typeorm#11267

fix: release query runner when there is no migration to revert by @mjr128 in typeorm/typeorm#11232

fix: add async to the method using setFindOptions() by @bindon in typeorm/typeorm#10787

chore: disable eslint errors for chai assertions by @alumni in typeorm/typeorm#11833

ci(tests): Remove limitation of branches to run on by @OSA413 in typeorm/typeorm#11794

ci: upgrade actions to v6 by @pkuczynski in typeorm/typeorm#11844

docs(v0.3): add version dropdown (stable/dev) by @naorpeled in typeorm/typeorm#11863

fix(sap): QueryBuilder parameter of type JS Date not escaped correctly by @alumni in typeorm/typeorm#11867

feat(sap): add pool timeout by @alumni in typeorm/typeorm#11868

feat(qodo): enable new review experience in v0.3 by @naorpeled in typeorm/typeorm#11910

feat: add returning option to update/upsert operations by @naorpeled in typeorm/typeorm#11782

test: enable repository-returning test by @gioboa in typeorm/typeorm#11913

chore(qodo): disable in progress notification in v0.3 by @naorpeled in typeorm/typeorm#11928

ci(docs): add deploy Github Action to v0.3 branch by @naorpeled in typeorm/typeorm#11929

chore(qodo): disable persistent comments and inline code suggestions in v0.3 by @naorpeled in typeorm/typeorm#11989

chore(deps): update all dependencies to the latest minor version by @alumni in typeorm/typeorm#12015

fix(redis): redis cache version detection by @mguida22 in typeorm/typeorm#11936

ci: remove summary comments location policy by @naorpeled in typeorm/typeorm#12117

ci(qodo): remove /improve from pr and push commands by @naorpeled in typeorm/typeorm#12129

ci: migrate from npm to pnpm by @pkuczynski in typeorm/typeorm#12193

ci(qodo): sync qodo pr agent config from master by @naorpeled in typeorm/typeorm#12265

ci: remove docs indexing by @alumni in typeorm/typeorm#12435

fix(security): validate limit() in Update/SoftDelete query builders by @smith-xyz in typeorm/typeorm#12437

chore(deps): update all minor by @alumni in typeorm/typeorm#12443

chore(release): release 0.3.29 by @michaelbromley in typeorm/typeorm#12442

New Contributors

@LeviHeber made their first contribution in typeorm/typeorm#11267

@mjr128 made their first contribution in typeorm/typeorm#11232

@bindon made their first contribution in typeorm/typeorm#10787

Full Changelog: typeorm/typeorm@0.3.28...0.3.29

... (truncated)

Changelog

Sourced from typeorm's changelog.

0.3.30 (2026-05-18)

Bug Fixes

cockroachdb: adjust join in loadTables to load correct table columns (#12413) (d93402e)

find-options: allow array values in JsonContains (#12420) (90f169d)

preserve user-defined shared join columns in change set (#12354) (0aba011)

scope computed-columns join to correct table in MSSQL schema query (#12288) (6170be6)

scope invalidWhereValuesBehavior to high-level abstractions only (#11878) (1e10fb8)

Reverts

fix up limit with joins (#11987) (66f1ff8)

0.3.29 (2026-05-08)

Bug Fixes

add async to the method using setFindOptions() (#10787) (cc07c90)

change import for process dependency (#11248) (1c67c3b)

cli: init command loading non-existing package.json (#11947) (4d9d1a6)

fix up aggregate methods ambiguous column (#11822) (6e34756)

fix up limit with joins (#11987) (3657db8)

getPendingMigrations unnecessarily creating migrations table (#11672) (1dbc224)

postgres: execute queries sequentially to avoid pg 8.19.0 deprecation warning (#12105) (79829a0)

prevent columns with select false from being returned (#11944) (6b20831)

prevent eager-loaded entities from overwriting manual relations (#11267) (2d8c515)

propagate schema and database to closure junction table (#12110) (58b403f)

redis: redis cache version detection (#11936) (f22c7a2)

release query runner when there is no migration to revert (#11232) (a46eb0a)

sap: QueryBuilder parameter of type JS Date not escaped correctly (#11867) (5153436)

security: validate limit() in Update/SoftDelete query builders (#12437) (0d7991a)

virtual property handling in schema builder (#11000) (5bd3255)

Features

add returning option to update/upsert operations (#11782) (11d9767)

sap: add pool timeout (#11868) (b4e2ad2)

sap: support locking in select (#11996) (86a9e3e)

0.3.28 (2025-12-02)

Bug Fixes

add multiSubnetFailover option for mssql (#10804) (83e3a8a)

circular import in SapDriver.ts (#11750) (bed7913)

cli: init command reading package.json from two folders up (#11789) (dd55218)

deps: upgrade glob to fix CVE-2025-64756 (#11784) (dc74f53)

mongodb: add missing findBy method to MongoEntityManager (#11814) (38715bb)

redis: version detection logic (#11815) (6f486e5)

... (truncated)

Commits

4c91616 chore(release): release 0.3.30 (#12511)
7792d00 ci: use the v0.3 branch as base for detect-changes
d93402e fix(cockroachdb): adjust join in loadTables to load correct table columns (#1...
90f169d fix(find-options): allow array values in JsonContains (#12420)
66f1ff8 revert: fix up limit with joins (#11987)
0aba011 fix: preserve user-defined shared join columns in change set (#12354)
6170be6 fix: scope computed-columns join to correct table in MSSQL schema query (#12288)
1e10fb8 fix: scope invalidWhereValuesBehavior to high-level abstractions only (#11878)
0ed009a ci: add npm environment to publish job for trusted publishing
6ede38b chore: enable trusted publishing in publish workflow
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for typeorm since your current version.

Updates form-data from 4.0.5 to 4.0.6

Changelog

Sourced from form-data's changelog.

v4.0.6 - 2026-06-12

Commits

[Fix] escape CR, LF, and " in field names and filenames 8dff42c

[Dev Deps] update @ljharb/eslint-config, auto-changelog, tape f31d21e

[Deps] update hasown, mime-types 92ae0eb

[Dev Deps] update js-randomness-predictor 67b0f65

Commits

64190db v4.0.6
92ae0eb [Deps] update hasown, mime-types
f31d21e [Dev Deps] update @ljharb/eslint-config, auto-changelog, tape
8dff42c [Fix] escape CR, LF, and " in field names and filenames
67b0f65 [Dev Deps] update js-randomness-predictor
See full diff in compare view

Updates qs from 6.15.0 to 6.15.3

Changelog

Sourced from qs's changelog.

6.15.3

[Fix] parse: enforce throwOnLimitExceeded for cumulative array growth via combine/merge

[Fix] utils: respect encoding of surrogate pairs across chunks (#559)

[Robustness] parse: throw the arrayLimit error before splitting oversized comma values

[Robustness] utils.merge / utils.assign: avoid invoking __proto__ setter when copying own properties

[Robustness] utils: enforce arrayLimit consistently across merge's array paths

[Perf] utils: make compact O(n) via a side-channel visited-set instead of Array.indexOf

[Deps] update side-channel

[Dev Deps] update eslint, mock-property, tape

[Tests] parse: characterize current lenient handling of unbalanced bracket keys (#558)

6.15.2

[Fix] stringify: skip null/undefined entries in arrayFormat: 'comma' + encodeValuesOnly instead of crashing in encoder

[Fix] stringify: use configured delimiter after charsetSentinel (#555)

[Fix] stringify: apply formatter to encoded key under strictNullHandling (#554)

[Fix] stringify: skip null/undefined filter-array entries instead of crashing in encoder (#551)

[Fix] parse: handle nested bracket groups and add regression tests (#530)

[readme] fix grammar (#550)

[Dev Deps] update @ljharb/eslint-config

[Tests] add regression tests for keys containing percent-encoded bracket text

6.15.1

[Fix] parse: parameterLimit: Infinity with throwOnLimitExceeded: true silently drops all parameters

[Deps] update @ljharb/eslint-config

[Dev Deps] update @ljharb/eslint-config, iconv-lite

[Tests] increase coverage

Commits

18d085e v6.15.3
c38af42 [Deps] update side-channel
adce539 [Dev Deps] update eslint, mock-property, tape
74a0f6a [Robustness] utils: enforce arrayLimit consistently across merge's arra...
f4938f5 [Tests] parse: characterize current lenient handling of unbalanced bracket ...
5d5f723 [Perf] utils: make compact O(n) via a side-channel visited-set instead of...
52afe00 [Robustness] parse: throw the arrayLimit error before splitting oversized...
963e538 [Fix] parse: enforce throwOnLimitExceeded for cumulative array growth via...
59da434 [Fix] utils: respect encoding of surrogate pairs across chunks
9532969 [Robustness] utils.merge / utils.assign: avoid invoking __proto__ sette...
Additional commits viewable in compare view

Updates undici from 7.24.5 to 7.28.0

Release notes

Sourced from undici's releases.

v7.28.0

⚠️ Security Release

This release line addresses 7 security advisories, all shipped in v7.28.0.
Action required: Upgrade to undici 7.28.0 or later.
npm install undici@^7.28.0
The v7 line is not affected by GHSA-38rv-x7px-6hhq (CVE-2026-9675), which is an 8.x-only regression.

Note on GHSA-hm92-r4w5-c3mj: this fix shipped in v7.28.0, not the earlier 7.2x line — the vulnerable single-pool code was still present through v7.27.2. The per-origin pool fix is 3805b8f8 (#5041).

Summary

Advisory CVE Severity (CVSS) Fixed in Fix commit

GHSA-vxpw-j846-p89q CVE-2026-12151 High (7.5) 7.28.0 8cb10f98

GHSA-vmh5-mc38-953g CVE-2026-9697 High (7.4) 7.28.0 04201f89

GHSA-hm92-r4w5-c3mj CVE-2026-6734 High (7.5) 7.28.0 3805b8f8

GHSA-pr7r-676h-xcf6 CVE-2026-9678 Moderate (5.9) 7.28.0 85a24055

GHSA-p88m-4jfj-68fv CVE-2026-9679 Moderate (5.9) 7.28.0 d0574cc4

GHSA-g8m3-5g58-fq7m CVE-2026-11525 Low (3.7) 7.28.0 d0574cc4

GHSA-35p6-xmwp-9g52 CVE-2026-6733 Low (3.7) 7.28.0 ea8930cf

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

GHSA-vxpw-j846-p89q · CWE-400, CWE-770 Fix: 8cb10f98 websocket: limit the number of fragments in a message (part of backport a027a4a0 Backport WebSocket maxPayloadSize fixes to v7.x, #5423)

A malicious WebSocket server can stream a large number of small or empty continuation frames. Undici enforced a limit on cumulative payload size but did not limit the number of fragments per message, leading to unbounded memory growth and denial of service.

Affected: applications using new WebSocket(...) or WebSocketStream against untrusted endpoints.

Workaround: none — upgrade is required.

TLS certificate validation bypass in SOCKS5 ProxyAgent — CVE-2026-9697

GHSA-vmh5-mc38-953g · CWE-295

... (truncated)

Commits

f9eba0a Bumped v7.28.0 (#5430)
a027a4a Backport WebSocket maxPayloadSize fixes to v7.x (#5423)
8cb10f9 websocket: limit the number of fragments in a message
04201f8 fix: honor requestTls when proxy is SOCKS5
fcd642f fix(socks5): preserve dispatch backpressure return value (#5166)
bc98c97 fix(socks5): use configured connector in Socks5ProxyAgent (#5168)
9e1c743 fix(socks5): encode embedded IPv4 tails in IPv6 literals correctly (#5099)
376c8be fix(socks5): enforce authenticated state before CONNECT (#5097)
3805b8f fix(socks5-proxy-agent): use per-origin pools to prevent cross-origin routing...
85a2405 fix(cache): trim qualified field names
Additional commits viewable in compare view

Updates ws from 8.18.2 to 8.21.0

Release notes

Sourced from ws's releases.

8.21.0

Features

Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.
import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(client close - code: ${code} reason: ${reason.toString()});
});
});
wss.on('connection', function (ws) {
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(server close - code: ${code} reason: ${reason.toString()});
});
});
The vulnerability was responsibly disclosed and fixed by Nadav Magier.

In vulnerable versions, the issue can be mitigated by lowering the value of the maxPayload option if possible.

8.20.1

... (truncated)

Commits

bca91ad [dist] 8.21.0
2b2abd4 [security] Limit retained message parts
78eabe2 [security] Add latest vulnerability to SECURITY.md
5d9b316 [dist] 8.20.1
c0327ec [security] Fix uninitialized memory disclosure in websocket.close()
ce2a3d6 [ci] Test on node 26
58e45b8 [ci] Do not test on node 25
5f26c24 [ci] Run the lint step on node 24
8439255 [dist] 8.20.0
d3503c1 [minor] Export the PerMessageDeflate class and header utils
Additional commits viewable in compare view

Updates js-yaml from 4.1.1 to 4.3.0

Changelog

Sourced from js-yaml's changelog.

4.3.0 - 2026-06-27

Added

[backport] Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.

Fixed

Restore umd builds back to es5.

Removed

[backport] maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

[4.2.0] - 2026-06-01

Added

Added docs/safety.md with notes about processing untrusted YAML.

Added maxDepth (100) loader option. Not a problem, but gives a better exception instead of RangeError on stack overflow.

Added maxMergeSeqLength (20) loader option. Not a problem after merge fix, but an additional restriction for safety.

Added sourcemaps to dist/ builds.

Changed

Stop resolving numbers with underscores as numeric scalars, #627.

Switched dev toolchains to Vite / neostandard.

Updated demo.

Reorganized tests.

dist/ files are no longer kept in the repository.

Fixed

Fix parsing of properties on the first implicit block mapping key, #62.

Fix trailing whitespace handling when folding flow scalar lines, #307.

Reject top-level block scalars without content indentation, #280.

Ensure numbers survive round-trip, #737.

Fix test coverage for issue #221.

Fix flow scalar trailing whitespace folding, #307.

Fix digits in YAML named tag handles.

Security

Fix potential DoS via quadratic complexity in merge - deduplicate repeated elements (makes sense for malformed files > 10K).

[3.14.2] - 2025-11-15

Security

Backported v4.1.1 fix to v3

Commits

33d05b5 4.3.0 released
663bfab Drop demo publish, to not override new v5 one.
1cb8c7b Add v4-legacy tag for publish
02f27af Restore umd builds back to es5
8be84ed Fix es5 compatibility
59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
6842ef6 doc polish
590dbab 4.2.0 released
f944dc5 Add package.json funding field
f692719 Changelog update
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

…updates Bumps the npm_and_yarn group with 6 updates in the /api directory: | Package | From | To | | --- | --- | --- | | [joi](https://github.com/hapijs/joi) | `17.13.3` | `17.13.4` | | [typeorm](https://github.com/typeorm/typeorm) | `0.3.27` | `0.3.30` | | [form-data](https://github.com/form-data/form-data) | `4.0.5` | `4.0.6` | | [qs](https://github.com/ljharb/qs) | `6.15.0` | `6.15.3` | | [undici](https://github.com/nodejs/undici) | `7.24.5` | `7.28.0` | | [ws](https://github.com/websockets/ws) | `8.18.2` | `8.21.0` | Bumps the npm_and_yarn group with 1 update in the /frontend directory: [js-yaml](https://github.com/nodeca/js-yaml). Updates `joi` from 17.13.3 to 17.13.4 - [Commits](hapijs/joi@v17.13.3...v17.13.4) Updates `typeorm` from 0.3.27 to 0.3.30 - [Release notes](https://github.com/typeorm/typeorm/releases) - [Changelog](https://github.com/typeorm/typeorm/blob/master/CHANGELOG.md) - [Commits](typeorm/typeorm@0.3.27...0.3.30) Updates `form-data` from 4.0.5 to 4.0.6 - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v4.0.5...v4.0.6) Updates `qs` from 6.15.0 to 6.15.3 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.15.0...v6.15.3) Updates `undici` from 7.24.5 to 7.28.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.24.5...v7.28.0) Updates `ws` from 8.18.2 to 8.21.0 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.18.2...8.21.0) Updates `js-yaml` from 4.1.1 to 4.3.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.0/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.1...4.3.0) --- updated-dependencies: - dependency-name: joi dependency-version: 17.13.4 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: typeorm dependency-version: 0.3.30 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: form-data dependency-version: 4.0.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.15.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 7.28.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 8.21.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.3.0 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 28, 2026

dependabot Bot mentioned this pull request Jun 28, 2026

build(deps): bump the npm_and_yarn group across 1 directory with 5 updates #28

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

build(deps): bump the npm_and_yarn group across 2 directories with 7 updates#29

build(deps): bump the npm_and_yarn group across 2 directories with 7 updates#29
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/api/npm_and_yarn-e053eae4ba

dependabot Bot commented on behalf of github Jun 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Advisory	CVE	Severity (CVSS)	Fixed in	Fix commit
GHSA-vxpw-j846-p89q	CVE-2026-12151	High (7.5)	7.28.0	`8cb10f98`
GHSA-vmh5-mc38-953g	CVE-2026-9697	High (7.4)	7.28.0	`04201f89`
GHSA-hm92-r4w5-c3mj	CVE-2026-6734	High (7.5)	7.28.0	`3805b8f8`
GHSA-pr7r-676h-xcf6	CVE-2026-9678	Moderate (5.9)	7.28.0	`85a24055`
GHSA-p88m-4jfj-68fv	CVE-2026-9679	Moderate (5.9)	7.28.0	`d0574cc4`
GHSA-g8m3-5g58-fq7m	CVE-2026-11525	Low (3.7)	7.28.0	`d0574cc4`
GHSA-35p6-xmwp-9g52	CVE-2026-6733	Low (3.7)	7.28.0	`ea8930cf`

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jun 28, 2026

0.3.30

What's Changed

0.3.29

What's Changed

New Contributors

0.3.30 (2026-05-18)

Bug Fixes

Reverts

0.3.29 (2026-05-08)

Bug Fixes

Features

0.3.28 (2025-12-02)

Bug Fixes

v4.0.6 - 2026-06-12

Commits

6.15.3

6.15.2

6.15.1

v7.28.0

⚠️ Security Release

Summary

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

TLS certificate validation bypass in SOCKS5 ProxyAgent — CVE-2026-9697

8.21.0

Features

Bug fixes

8.20.1

4.3.0 - 2026-06-27

Added

Fixed

Removed

[4.2.0] - 2026-06-01

Added

Changed

Fixed

Security

[3.14.2] - 2025-11-15

Security

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants