Skip to content

Bump the frontend-minor-patch group across 1 directory with 8 updates#18

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/lightrag_webui/frontend-minor-patch-f75e530e0f
Open

Bump the frontend-minor-patch group across 1 directory with 8 updates#18
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/lightrag_webui/frontend-minor-patch-f75e530e0f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Apr 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the frontend-minor-patch group with 8 updates in the /lightrag_webui directory:

Package From To
@faker-js/faker 10.2.0 10.4.0
axios 1.13.4 1.15.2
react-error-boundary 6.1.0 6.1.1
react-number-format 5.4.4 5.4.5
react-syntax-highlighter 16.1.0 16.1.1
zustand 5.0.11 5.0.12
@types/node 25.1.0 25.6.0
globals 17.0.0 17.5.0

Updates @faker-js/faker from 10.2.0 to 10.4.0

Release notes

Sourced from @​faker-js/faker's releases.

v10.4.0

What's Changed

New Contributors

Full Changelog: faker-js/faker@v10.3.0...v10.4.0

v10.3.0

What's Changed

... (truncated)

Changelog

Sourced from @​faker-js/faker's changelog.

10.4.0 (2026-03-23)

New Locales

  • locale: add Japanese bear definitions (#3720) (2a4b15c)
  • locale: add Japanese bird definitions (#3719) (dc31ff8)
  • locale: add Japanese cat breed definitions (#3716) (54af8a8)
  • locale: add Japanese cattle breed definitions (#3717) (c2c7342)
  • locale: add Japanese fish definitions (#3721) (15fc361)
  • locale: add Japanese horse breed definitions (#3718) (e02536e)
  • locale: add Norwegian (nb_NO) country definition (#3714) (614b4e9)

Features

Changed Locales

  • locale: filter and cleanup PersonEntryDefintions data (#3266) (67defc8)

Bug Fixes

  • locales: correct typos and capitalization in es_MX street names (#3737) (2b32c28)

10.3.0 (2026-02-06)

New Locales

  • locale: add Japanese dog definition (#3715) (76c9df1)
  • locale: add Japanese color definitions (#3707) (bbbb215)
  • locale: add Japanese food module (#3706) (71d55c0)
  • locale: add Japanese internet definitions (#3708) (184a709)
  • locale: add Japanese job definitions for person module (#3705) (e7f3ccd)
  • locale: add Japanese suffix definitions for person module (#3704) (45ad7d8)
  • locale: add Norwegian (nb_NO) continent definitions (#3712) (c0f0f23)
  • locale: add Norwegian (nb_NO) direction definition (#3713) (43b18fa)
  • locale: add Norwegian (nb_NO) sex definitions (#3710) (76063f2)
  • locale: add Norwegian (nb_NO) vehicle definition (#3732) (d1c32b0)

Features

  • locales: add Norwegian (nb_NO) zodiac sign definitions (#3711) (e306542)
  • person: sexType can return 'generic' (#3259) (0e099a1)

... (truncated)

Commits

Updates axios from 1.13.4 to 1.15.2

Release notes

Sourced from axios's releases.

v1.15.2

This release delivers prototype-pollution hardening for the Node HTTP adapter, adds an opt-in allowedSocketPaths allowlist to mitigate SSRF via Unix domain sockets, fixes a keep-alive socket memory leak, and ships supply-chain hardening across CI and security docs.

🔒 Security Fixes

  • Prototype Pollution Hardening (HTTP Adapter): Hardened the Node HTTP adapter and resolveConfig/mergeConfig/validator paths to read only own properties and use null-prototype config objects, preventing polluted auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser from influencing requests. (#10779)
  • SSRF via socketPath: Rejects non-string socketPath values and adds an opt-in allowedSocketPaths config option to restrict permitted Unix domain socket paths, returning AxiosError ERR_BAD_OPTION_VALUE on mismatch. (#10777)
  • Supply-chain Hardening: Added .npmrc with ignore-scripts=true, lockfile lint CI, non-blocking reproducible build diff, scoped CODEOWNERS, expanded SECURITY.md/THREATMODEL.md with provenance verification (npm audit signatures), 60-day resolution policy, and maintainer incident-response runbook. (#10776)

🚀 New Features

  • allowedSocketPaths Config Option: New request config option (and TypeScript types) to allowlist Unix domain socket paths used by the Node http adapter; backwards compatible when unset. (#10777)

🐛 Bug Fixes

  • Keep-alive Socket Memory Leak: Installs a single per-socket error listener tracking the active request via kAxiosSocketListener/kAxiosCurrentReq, eliminating per-request listener accumulation, MaxListenersExceededWarning, and linear heap growth under concurrent or long-running keep-alive workloads (fixes #10780). (#10788)

🔧 Maintenance & Chores

  • Changelog: Updated CHANGELOG.md with v1.15.1 release notes. (#10781)

Full Changelog

v1.15.1

This release ships a coordinated set of security hardening fixes across headers, body/redirect limits, multipart handling, and XSRF/prototype-pollution vectors, alongside a broad sweep of bug fixes, test migrations, and threat-model documentation updates.

🔒 Security Fixes

  • Header Injection Hardening: Tightened validation and sanitisation across request header construction to close the header-injection attack surface. (#10749)
  • CRLF Stripping in Multipart Headers: Correctly strips CR/LF from multipart header values to prevent injection via field names and filenames. (#10758)
  • Prototype Pollution / Auth Bypass: Replaced unsafe in checks with hasOwnProperty to prevent authentication bypass via prototype pollution on config objects, with additional regression tests. (#10761, #10760)
  • withXSRFToken Truthy Bypass: Short-circuits on any truthy non-boolean value, so an ambiguous config no longer silently leaks the XSRF token cross-origin. (#10762)
  • maxBodyLength With Zero Redirects: Enforces maxBodyLength even when maxRedirects is set to 0, closing a bypass path for oversized request bodies. (#10753)
  • Streamed Response maxContentLength Bypass: Applies maxContentLength to streamed responses that previously bypassed the cap. (#10754)
  • Follow-up CVE Completion: Completes an earlier incomplete CVE fix to fully close the regression window. (#10755)

🚀 New Features

  • AI-Based Docs Translations: Initial scaffold for AI-assisted translations of the documentation site. (#10705)
  • Location Request Header Type: Adds Location to CommonRequestHeadersList for accurate typing of redirect-aware requests. (#7528)

🐛 Bug Fixes

  • FormData Handling: Removes Content-Type when no boundary is present on FormData fetch requests, supports multi-select fields, cancels request.body instead of the source stream on fetch abort, and fixes a recursion bug in form-data serialisation. (#7314, #10676, #10702, #10726)
  • HTTP Adapter: Handles socket-only request errors without leaking keep-alive listeners. (#10576)
  • Progress Events: Clamps loaded to total for computable upload/download progress events. (#7458)
  • Types: Aligns runWhen type with the runtime behaviour in InterceptorManager and makes response header keys case-insensitive. (#7529, #10677)
  • buildFullPath: Uses strict equality in the base/relative URL check. (#7252)
  • AxiosURLSearchParams Regex: Improves the regex used for param serialisation to avoid edge-case mismatches. (#10736)
  • Resilient Value Parsing: Parses out header/config values instead of throwing on malformed input. (#10687)

... (truncated)

Changelog

Sourced from axios's changelog.

v1.15.2 - April 21, 2026

This release delivers prototype-pollution hardening for the Node HTTP adapter, adds an opt-in allowedSocketPaths allowlist to mitigate SSRF via Unix domain sockets, fixes a keep-alive socket memory leak, and ships supply-chain hardening across CI and security docs.

🔒 Security Fixes

  • Prototype Pollution Hardening (HTTP Adapter): Hardened the Node HTTP adapter and resolveConfig/mergeConfig/validator paths to read only own properties and use null-prototype config objects, preventing polluted auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser from influencing requests. (#10779)
  • SSRF via socketPath: Rejects non-string socketPath values and adds an opt-in allowedSocketPaths config option to restrict permitted Unix domain socket paths, returning AxiosError ERR_BAD_OPTION_VALUE on mismatch. (#10777)
  • Supply-chain Hardening: Added .npmrc with ignore-scripts=true, lockfile lint CI, non-blocking reproducible build diff, scoped CODEOWNERS, expanded SECURITY.md/THREATMODEL.md with provenance verification (npm audit signatures), 60-day resolution policy, and maintainer incident-response runbook. (#10776)

🚀 New Features

  • allowedSocketPaths Config Option: New request config option (and TypeScript types) to allowlist Unix domain socket paths used by the Node http adapter; backwards compatible when unset. (#10777)

🐛 Bug Fixes

  • Keep-alive Socket Memory Leak: Installs a single per-socket error listener tracking the active request via kAxiosSocketListener/kAxiosCurrentReq, eliminating per-request listener accumulation, MaxListenersExceededWarning, and linear heap growth under concurrent or long-running keep-alive workloads (fixes #10780). (#10788)

🔧 Maintenance & Chores

  • Changelog: Updated CHANGELOG.md with v1.15.1 release notes. (#10781)

Full Changelog

v1.15.1 - April 19, 2026

This release ships a coordinated set of security hardening fixes across headers, body/redirect limits, multipart handling, and XSRF/prototype-pollution vectors, alongside a broad sweep of bug fixes, test migrations, and threat-model documentation updates.

🔒 Security Fixes

  • Header Injection Hardening: Tightened validation and sanitisation across request header construction to close the header-injection attack surface. (#10749)

  • CRLF Stripping in Multipart Headers: Correctly strips CR/LF from multipart header values to prevent injection via field names and filenames. (#10758)

  • Prototype Pollution / Auth Bypass: Replaced unsafe in checks with hasOwnProperty to prevent authentication bypass via prototype pollution on config objects, with additional regression tests. (#10761, #10760)

  • withXSRFToken Truthy Bypass: Short-circuits on any truthy non-boolean value, so an ambiguous config no longer silently leaks the XSRF token cross-origin. (#10762)

  • maxBodyLength With Zero Redirects: Enforces maxBodyLength even when maxRedirects is set to 0, closing a bypass path for oversized request bodies. (#10753)

  • Streamed Response maxContentLength Bypass: Applies maxContentLength to streamed responses that previously bypassed the cap. (#10754)

  • Follow-up CVE Completion: Completes an earlier incomplete CVE fix to fully close the regression window. (#10755)

🚀 New Features

  • AI-Based Docs Translations: Initial scaffold for AI-assisted translations of the documentation site. (#10705)

... (truncated)

Commits

Updates react-error-boundary from 6.1.0 to 6.1.1

Release notes

Sourced from react-error-boundary's releases.

6.1.1

  • Fixed a problem with project logo not displaying correctly in the README for the Firefox browser.
Commits
  • 2356daa 6.1.0 -> 6.1.1
  • 127a749 Fixed a problem with project logo not displaying correctly in the README for ...
  • See full diff in compare view

Updates react-number-format from 5.4.4 to 5.4.5

Release notes

Sourced from react-number-format's releases.

Bug fixes

What's Changed

Bug fixes Fixed #883, defaultValue not triggering onValueChange. Fix #882, deleting negative symbol when prefix is more than 1 character

Commits
  • 503a85e Formatting fix
  • 3e09057 Merge pull request #894 from s-yadav/bug-fixes-5.4.4
  • 74a4428 Fix logic on default value check.
  • 0d660b1 Revert "Fix #879, Treat empty mask as space."
  • 412bc69 Fix test which was not running
  • bc825e2 - Remove action status from readme.
  • e04fcb2 Fix #879, Treat empty mask as space.
  • 9b7ca03 Fix #882, deleting negative symbol when preix is more then 1 char
  • c7ae408 Fixed defaultValue not triggering onValueChange.
  • See full diff in compare view

Updates react-syntax-highlighter from 16.1.0 to 16.1.1

Release notes

Sourced from react-syntax-highlighter's releases.

v16.1.1

What's Changed

New Contributors

Full Changelog: react-syntax-highlighter/react-syntax-highlighter@v16.1.0...v16.1.1

Commits

Updates zustand from 5.0.11 to 5.0.12

Release notes

Sourced from zustand's releases.

v5.0.12

Two small fixes.

What's Changed

New Contributors

Full Changelog: pmndrs/zustand@v5.0.11...v5.0.12

Commits

Updates @types/node from 25.1.0 to 25.6.0

Commits

Updates globals from 17.0.0 to 17.5.0

Release notes

Sourced from globals's releases.

v17.5.0

  • Update globals (2026-04-12) (#342) 5d84602

sindresorhus/globals@v17.4.0...v17.5.0

v17.4.0

  • Update globals (2026-03-01) (#338) d43a051

sindresorhus/globals@v17.3.0...v17.4.0

v17.3.0

  • Update globals (2026-02-01) (#336) 295fba9

sindresorhus/globals@v17.2.0...v17.3.0

v17.2.0

  • jasmine: Add throwUnless and throwUnlessAsync globals (#335) 97f23a7

sindresorhus/globals@v17.1.0...v17.2.0

v17.1.0

  • Add webpack and rspack globals (#333) 65cae73

sindresorhus/globals@v17.0.0...v17.1.0

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the frontend-minor-patch group across 1 directory with 8 updates
c104ac6 
Bumps the frontend-minor-patch group with 8 updates in the /lightrag_webui directory:

| Package | From | To |
| --- | --- | --- |
| [@faker-js/faker](https://github.com/faker-js/faker) | `10.2.0` | `10.4.0` |
| [axios](https://github.com/axios/axios) | `1.13.4` | `1.15.2` |
| [react-error-boundary](https://github.com/bvaughn/react-error-boundary) | `6.1.0` | `6.1.1` |
| [react-number-format](https://github.com/s-yadav/react-number-format) | `5.4.4` | `5.4.5` |
| [react-syntax-highlighter](https://github.com/react-syntax-highlighter/react-syntax-highlighter) | `16.1.0` | `16.1.1` |
| [zustand](https://github.com/pmndrs/zustand) | `5.0.11` | `5.0.12` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.1.0` | `25.6.0` |
| [globals](https://github.com/sindresorhus/globals) | `17.0.0` | `17.5.0` |



Updates `@faker-js/faker` from 10.2.0 to 10.4.0
- [Release notes](https://github.com/faker-js/faker/releases)
- [Changelog](https://github.com/faker-js/faker/blob/next/CHANGELOG.md)
- [Commits](faker-js/faker@v10.2.0...v10.4.0)

Updates `axios` from 1.13.4 to 1.15.2
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.13.4...v1.15.2)

Updates `react-error-boundary` from 6.1.0 to 6.1.1
- [Release notes](https://github.com/bvaughn/react-error-boundary/releases)
- [Commits](bvaughn/react-error-boundary@6.1.0...6.1.1)

Updates `react-number-format` from 5.4.4 to 5.4.5
- [Release notes](https://github.com/s-yadav/react-number-format/releases)
- [Commits](s-yadav/react-number-format@v5.4.4...v5.4.5)

Updates `react-syntax-highlighter` from 16.1.0 to 16.1.1
- [Release notes](https://github.com/react-syntax-highlighter/react-syntax-highlighter/releases)
- [Changelog](https://github.com/react-syntax-highlighter/react-syntax-highlighter/blob/master/CHANGELOG.MD)
- [Commits](react-syntax-highlighter/react-syntax-highlighter@v16.1.0...v16.1.1)

Updates `zustand` from 5.0.11 to 5.0.12
- [Release notes](https://github.com/pmndrs/zustand/releases)
- [Commits](pmndrs/zustand@v5.0.11...v5.0.12)

Updates `@types/node` from 25.1.0 to 25.6.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `globals` from 17.0.0 to 17.5.0
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](sindresorhus/globals@v17.0.0...v17.5.0)

---
updated-dependencies:
- dependency-name: "@faker-js/faker"
  dependency-version: 10.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: frontend-minor-patch
- dependency-name: axios
  dependency-version: 1.15.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: frontend-minor-patch
- dependency-name: react-error-boundary
  dependency-version: 6.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: frontend-minor-patch
- dependency-name: react-number-format
  dependency-version: 5.4.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: frontend-minor-patch
- dependency-name: react-syntax-highlighter
  dependency-version: 16.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: frontend-minor-patch
- dependency-name: zustand
  dependency-version: 5.0.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: frontend-minor-patch
- dependency-name: "@types/node"
  dependency-version: 25.6.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: frontend-minor-patch
- dependency-name: globals
  dependency-version: 17.5.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: frontend-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Apr 30, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies, frontend. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants