Skip to content
This repository was archived by the owner on Mar 19, 2026. It is now read-only.

Bump the npm_and_yarn group across 1 directory with 6 updates - #8

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/npm_and_yarn-b1f43c3034
Open

Bump the npm_and_yarn group across 1 directory with 6 updates#8
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/npm_and_yarn-b1f43c3034

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Mar 19, 2026

Copy link
Copy Markdown

Bumps the npm_and_yarn group with 6 updates in the / directory:

Package From To
express 3.3.1 4.22.0
socket.io 0.9.10 2.5.0
mongoose 3.0.3 6.13.6
ws 0.4.27 1.1.5
superagent 0.15.4 10.2.2
underscore 1.5.2 1.13.8

Updates express from 3.3.1 to 4.22.0

Release notes

Sourced from express's releases.

4.22.0

Important: Security

What's Changed

Full Changelog: expressjs/express@4.21.2...4.22.0

4.21.2

What's Changed

Full Changelog: expressjs/express@4.21.1...4.21.2

4.21.1

What's Changed

Full Changelog: expressjs/express@4.21.0...4.21.1

4.21.0

What's Changed

New Contributors

... (truncated)

Changelog

Sourced from express's changelog.

4.22.0 / 2025-12-01

4.21.2 / 2024-11-06

  • deps: path-to-regexp@0.1.12
    • Fix backtracking protection
  • deps: path-to-regexp@0.1.11
    • Throws an error on invalid path values

4.21.1 / 2024-10-08

4.21.0 / 2024-09-11

  • Deprecate res.location("back") and res.redirect("back") magic string
  • deps: serve-static@1.16.2
    • includes send@0.19.0
  • deps: finalhandler@1.3.1
  • deps: qs@6.13.0

4.20.0 / 2024-09-10

  • deps: serve-static@0.16.0
    • Remove link renderization in html while redirecting
  • deps: send@0.19.0
    • Remove link renderization in html while redirecting
  • deps: body-parser@0.6.0
    • add depth option to customize the depth level in the parser
    • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)
  • Remove link renderization in html while using res.redirect
  • deps: path-to-regexp@0.1.10
    • Adds support for named matching groups in the routes using a regex
    • Adds backtracking protection to parameters without regexes defined
  • deps: encodeurl@~2.0.0
    • Removes encoding of \, |, and ^ to align better with URL spec
  • Deprecate passing options.maxAge and options.expires to res.clearCookie
    • Will be ignored in v5, clearCookie will set a cookie with an expires in the past to instruct clients to delete the cookie

4.19.2 / 2024-03-25

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for express since your current version.


Updates socket.io from 0.9.10 to 2.5.0

Changelog

Sourced from socket.io's changelog.

2.5.0 (2022-06-26)

Bug Fixes

  • fix race condition in dynamic namespaces (05e1278)
  • ignore packet received after disconnection (22d4bdf)
  • only set 'connected' to true after middleware execution (226cc16)
  • prevent the socket from joining a room after disconnection (f223178)

2.4.1 (2021-01-07)

Reverts

  • fix(security): do not allow all origins by default (a169050)

2.4.0 (2021-01-04)

Bug Fixes

  • security: do not allow all origins by default (f78a575)
  • properly overwrite the query sent in the handshake (d33a619)
Commits
  • baa6804 chore(release): 2.5.0
  • f223178 fix: prevent the socket from joining a room after disconnection
  • 226cc16 fix: only set 'connected' to true after middleware execution
  • 05e1278 fix: fix race condition in dynamic namespaces
  • 22d4bdf fix: ignore packet received after disconnection
  • dfded53 chore: update engine.io version to 3.6.0
  • e6b8697 chore(release): 2.4.1
  • a169050 revert: fix(security): do not allow all origins by default
  • 873fdc5 chore(release): 2.4.0
  • f78a575 fix(security): do not allow all origins by default
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by darrachequesne, a new releaser for socket.io since your current version.


Updates mongoose from 3.0.3 to 6.13.6

Release notes

Sourced from mongoose's releases.

6.13.6 / 2025-01-13

  • fix: disallow nested $where in populate match
Changelog

Sourced from mongoose's changelog.

6.13.6 / 2025-01-13

8.9.4 / 2025-01-09

  • fix(document): fix document not applying manual populate when using a function in schema.options.ref #15138 IchirokuXVI
  • fix(model): make Model.validate() static correctly cast document arrays #15169 #15164
  • fix(model): allow passing validateBeforeSave option to bulkSave() to skip validation #15161 #15156
  • fix(schema): allow multiple self-referencing discriminator schemas using Schema.prototype.discriminator #15142 #15120
  • types: avoid BufferToBinary<> wiping lean types when passed to generic functions #15160 #15158
  • docs: fix <code> in header ids #15159
  • docs: fix header in field-level-encryption.md #15137 damieng

8.9.3 / 2024-12-30

  • fix(schema): make duplicate index error a warning for now to prevent blocking upgrading #15135 #15112 #15109
  • fix(model): handle document array paths set to non-array values in Model.castObject() #15124 #15075
  • fix(document): avoid using childSchemas.path for compatibility with pre-Mongoose-8.8 schemas #15131 #15071
  • fix(model): avoid throwing unnecessary error if updateOne() returns null in save() #15126
  • perf(cursor): clear the stack every time if using populate with batchSize to avoid stack overflows with large docs #15136 #10449
  • types: make BufferToBinary avoid Document instances #15123 #15122
  • types(model+query): avoid stripping out virtuals when calling populate with paths generic #15132 #15111
  • types(schema): add missing removeIndex #15134
  • types: add cleanIndexes() to IndexManager interface #15127
  • docs: move search endpoint to netlify #15119

8.9.2 / 2024-12-19

  • fix(schema): avoid throwing duplicate index error if index spec keys have different order or index has a custom name #15112 #15109
  • fix(map): clean modified subpaths when overwriting values in map of subdocs #15114 #15108
  • fix(aggregate): pull session from transaction local storage for aggregation cursors #15094 IchirokuXVI
  • types: correctly handle union types in BufferToBinary and related helpers #15103 #15102 #15057
  • types: add UUID to RefType #15115 #15101
  • docs: remove link to Mongoose 5.x docs from dropdown #15116
  • docs(connection+document+model): remove remaining references to remove(), clarify that deleteOne() does not execute until then() or exec() #15113 #15107

8.9.1 / 2024-12-16

  • fix(connection): remove heartbeat check in load balanced mode #15089 #15042 #14812
  • fix(discriminator): gather childSchemas when creating discriminator to ensure $getAllSubdocs() can properly get all subdocs #15099 #15088 #15092
  • fix(model): handle discriminators in castObject() #15096 #15075
  • fix(schema): throw error if duplicate index definition using unique in schema path and subsequent .index() call #15093 #15056
  • fix: mark documents that are populated using hydratedPopulatedDocs option as populated in top-level doc #15080 #15048
  • fix(document+schema): improve error message for get() on invalid path #15098 #15071
  • docs: remove more callback doc references & some small other changes #15095

8.9.0 / 2024-12-13

  • feat: upgrade mongodb -> 6.12

... (truncated)

Commits
  • e59e342 chore: release 6.13.6
  • 64a9f97 fix: disallow nested $where in populate match
  • 15bdccf chore: release 6.13.5
  • 33679bc fix: disallow using $where in match
  • 22210b1 chore: release 6.13.4
  • d21a239 Merge pull request #15043 from Automattic/vkarpov15/gh-15039
  • 68377ff fix: save execution stack in query as string
  • 6fbe9f0 Merge pull request #14998 from markstos/UT-8434-doc-strict-query-flipflop
  • 3e3dc2e docs: clarify strictQuery default will flip-flop in "Migrating to 6.x"
  • d98b2e7 docs: Add missing closing tag for Lodash entry.
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by vkarpov15, a new releaser for mongoose since your current version.


Updates ws from 0.4.27 to 1.1.5

Release notes

Sourced from ws's releases.

1.1.5

Bug fixes

  • Fixed a DoS vulnerability (f8fdcd4).

1.1.4

Notable changes

  • Removed istanbul coverage folder from npm package (fac50ac).

1.1.3

Notable changes

  • Added support for bufferutil@>1 and utf-8-validate@>2 (b4cf110).
Commits
  • 24edef5 [dist] 1.1.5
  • f8fdcd4 [security] Fix DoS vulnerability
  • f7cfc51 [pkg] Remove .npmignore in favor of files package.json field
  • 19106a1 [dist] 1.1.4
  • fac50ac [ignore] Add coverage folder to .npmignore
  • 3213205 [dist] 1.1.3
  • b4cf110 [fix] Add compatibility with bufferutil@>1 and utf-8-validate@>2
  • 98f0d21 [dist] 1.1.2
  • b6ac431 [minor] Avoid using process.nextTick()
  • c1f3b21 [fix] Fix stack overflow crash
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by lpinca, a new releaser for ws since your current version.


Updates superagent from 0.15.4 to 10.2.2

Release notes

Sourced from superagent's releases.

v10.2.2

  • fix: fixed ci 5c2b13d
  • fix: fixed README badge 28167d1
  • fix: drop node v14 from ci 2ed5ac6
  • Revert "fix: fixed ci" 583939f
  • Revert "fix: remove husky folder" 17e059b
  • fix: remove husky folder 1633f64
  • fix: fixed ci 6409480
  • fix: added package lock 57d6b35
  • feat: fix formidable v3 compatibility with PassThrough bridge for multipart parsing c40db6d
  • fix: fixed package version fe58239

forwardemail/superagent@list...v10.2.2

v10.2.1

  • Merge pull request #1832 from mureinik/formidble-3.5.2 5425b28
  • fix: Bump formidable version to ^3.5.4 5feb4c9

forwardemail/superagent@v10.2.0...v10.2.1

v10.2.0

  • Merge pull request #1829 from perrin4869/fix/http2/ipv6-addresses 02cad6a
  • fix(https2): ipv6 addresses url e29fd25
  • Merge pull request #1805 from perrin4869/fix/ipv6-addresses 150eb6c
  • fix? 07954a1
  • attempt support ipv6 d688596
  • attempt support ipv6 a2f11f8
  • re-add test 10a2e40
  • remove regression test 15e9de6
  • fix: ipv6 addresses parsing ec50f5a

forwardemail/superagent@v10.1.1...v10.2.0

v10.1.1

  • Merge pull request #1817 from icholy/master 2f8e191
  • fix: &#39;hexoid is not a function&#39; when using webpack 5ffe5ed

forwardemail/superagent@v10.1.0...v10.1.1

v10.1.0

  • fix: fixed eslint issue 63b009f
  • Merge pull request #1808 from MaoShizhong/fix/unify-body-query-serialisation-behaviour bfb2d00
  • test: add test for serialising duplicated keys bef7b08
  • fix: unify urlencoded body serialisation with current query serialisation b8ec936

forwardemail/superagent@v10.0.2...v10.1.0

v10.0.2

... (truncated)

Changelog

Sourced from superagent's changelog.

This HISTORY log is deprecated

Please see GitHub releases page for the current changelog.

4.1.0 (2018-12-26)

  • .connect() IP/DNS override option (Kornel)
  • .trustLocalhost() option for allowing broken HTTPS on localhost
  • .abort() used with promises rejects the promise.

4.0.0 (2018-11-17)

Breaking changes

  • Node.js v4 has reached it's end of life, so we no longer support it. It's v6+ or later. We recommend Node.js 10.
  • We now use ES6 in the browser code, too.
    • If you're using Browserify or Webpack to package code for Internet Explorer, you will also have to use Babel.
    • The pre-built node_modules/superagent.js is still ES5-compatible.
  • .end(…) returns undefined instead of the request. If you need the request object after calling .end() (and you probably don't), save it in a variable and call request.end(…). Consider not using .end() at all, and migrating to promises by calling .then() instead.
  • In Node, responses with unknown MIME type are buffered by default. To get old behavior, if you use custom unbuffered parsers, add .buffer(false) to requests or set superagent.buffer[yourMimeType] = false.
  • Invalid uses of .pipe() throw.

Minor changes

  • Throw if req.abort().end() is called
  • Throw if using unsupported mix of send and field
  • Reject .end() promise on all error events (Kornel Lesiński)
  • Set https.servername from the Host header (Kornel Lesiński)
  • Leave backticks unencoded in query strings where possible (Ethan Resnick)
  • Update node-mime to 2.x (Alexey Kucherenko)
  • Allow default buffer settings based on response-type (shrey)
  • response.buffered is more accurate.

3.8.3 (2018-04-29)

  • Add flags for 201 & 422 responses (Nikhil Fadnis)
  • Emit progress event while uploading Node Buffer via send method (Sergey Akhalkov)
  • Fixed setting correct cookies for redirects (Damien Clark)
  • Replace .catch with ['catch'] for IE9 Support (Miguel Stevens)

3.8.2 (2017-12-09)

  • Fixed handling of exceptions thrown from callbacks
  • Stricter matching of +json MIME types.

3.8.1 (2017-11-08)

  • Clear authorization header on cross-domain redirect

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by titanism, a new releaser for superagent since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates underscore from 1.5.2 to 1.13.8

Commits
  • 9374840 Merge branch 'release/1.13.8'
  • 309ad7e Re-generate annotated sources and minified codemaps
  • a1ac1d3 Add links to diff and docs in 1.13.8 change log entry
  • b579595 Mention CVE-2026-27601 in comments and documentation (#3011)
  • 45ea015 Revert obfuscations from 42823bb.
  • 4a4019e Update minified bundles
  • 1ccfdd0 Add preliminary release notes for 1.13.8
  • 42823bb Temporarily obfuscate comments
  • a6e23ae Make _.isEqual nonrecursive
  • f2b5164 Add regression test against stack overflow in _.isEqual
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by jgonggrijp, a new releaser for underscore since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump the npm_and_yarn group across 1 directory with 6 updates
5a65bf9 
Bumps the npm_and_yarn group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [express](https://github.com/expressjs/express) | `3.3.1` | `4.22.0` |
| [socket.io](https://github.com/socketio/socket.io) | `0.9.10` | `2.5.0` |
| [mongoose](https://github.com/Automattic/mongoose) | `3.0.3` | `6.13.6` |
| [ws](https://github.com/websockets/ws) | `0.4.27` | `1.1.5` |
| [superagent](https://github.com/ladjs/superagent) | `0.15.4` | `10.2.2` |
| [underscore](https://github.com/jashkenas/underscore) | `1.5.2` | `1.13.8` |



Updates `express` from 3.3.1 to 4.22.0
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/4.22.0/History.md)
- [Commits](expressjs/express@3.3.1...4.22.0)

Updates `socket.io` from 0.9.10 to 2.5.0
- [Release notes](https://github.com/socketio/socket.io/releases)
- [Changelog](https://github.com/socketio/socket.io/blob/2.5.0/CHANGELOG.md)
- [Commits](socketio/socket.io@0.9.10...2.5.0)

Updates `mongoose` from 3.0.3 to 6.13.6
- [Release notes](https://github.com/Automattic/mongoose/releases)
- [Changelog](https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md)
- [Commits](Automattic/mongoose@3.0.3...6.13.6)

Updates `ws` from 0.4.27 to 1.1.5
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@v0.4.27...1.1.5)

Updates `superagent` from 0.15.4 to 10.2.2
- [Release notes](https://github.com/ladjs/superagent/releases)
- [Changelog](https://github.com/forwardemail/superagent/blob/master/HISTORY.md)
- [Commits](forwardemail/superagent@0.15.4...v10.2.2)

Updates `underscore` from 1.5.2 to 1.13.8
- [Commits](jashkenas/underscore@1.5.2...1.13.8)

---
updated-dependencies:
- dependency-name: express
  dependency-version: 4.22.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: socket.io
  dependency-version: 2.5.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: mongoose
  dependency-version: 6.13.6
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-version: 1.1.5
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: superagent
  dependency-version: 10.2.2
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: underscore
  dependency-version: 1.13.8
  dependency-type: direct:production
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 19, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants