Skip to content

chore(deps): bump the npm-dependencies group across 1 directory with 7 updates#84

Open
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/npm_and_yarn/npm-dependencies-44b1aada67
Open

chore(deps): bump the npm-dependencies group across 1 directory with 7 updates#84
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/npm_and_yarn/npm-dependencies-44b1aada67

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Apr 6, 2026

Bumps the npm-dependencies group with 6 updates in the / directory:

Package From To
@tailwindcss/vite 4.2.1 4.2.2
axios 1.13.6 1.14.0
lodash 4.17.23 4.18.1
moment-timezone 0.6.0 0.6.1
vue 3.5.30 3.5.32
vite 6.4.1 6.4.2

Updates @tailwindcss/vite from 4.2.1 to 4.2.2

Release notes

Sourced from @​tailwindcss/vite's releases.

v4.2.2

Added

  • Support Vite 8 in @tailwindcss/vite (#19790)

Fixed

  • Don't crash when candidates contain prototype properties like row-constructor (#19725)
  • Canonicalize calc(var(--spacing)*…) expressions into --spacing(…) (#19769)
  • Fix crash in canonicalization step when handling utilities containing @property at-rules (e.g. shadow-sm border) (#19727)
  • Skip full reload for server only modules scanned by client CSS when using @tailwindcss/vite (#19745)
  • Improve canonicalization for bare values exceeding default spacing scale suggestions (e.g. w-1234 h-1234 → size-1234) (#19809)
  • Fix canonicalization resulting in empty list (e.g. w-5 h-5 size-5 → '' instead of size-5) (#19812)
Changelog

Sourced from @​tailwindcss/vite's changelog.

[4.2.2] - 2026-03-18

Fixed

  • Don't crash when candidates contain prototype properties like row-constructor (#19725)
  • Canonicalize calc(var(--spacing)*…) expressions into --spacing(…) (#19769)
  • Fix crash in canonicalization step when handling utilities containing @property at-rules (e.g. shadow-sm border) (#19727)
  • Skip full reload for server only modules scanned by client CSS when using @tailwindcss/vite (#19745)
  • Add support for Vite 8 in @tailwindcss/vite (#19790)
  • Improve canonicalization for bare values exceeding default spacing scale suggestions (e.g. w-1234 h-1234 → size-1234) (#19809)
  • Fix canonicalization resulting in empty list (e.g. w-5 h-5 size-5 → '' instead of size-5) (#19812)
  • Resolve tsconfig paths to allow for @import '@/path/to/file'; when using @tailwindcss/vite (#19803)
Commits

Updates axios from 1.13.6 to 1.14.0

Release notes

Sourced from axios's releases.

v1.14.0

This release focuses on compatibility fixes, adapter stability improvements, and test/tooling modernisation.

⚠️ Important Changes

  • Breaking Changes: None identified in this release.
  • Action Required: If you rely on env-based proxy behaviour or CJS resolution edge-cases, validate your integration after upgrade (notably proxy-from-env v2 alignment and main entry compatibility fix).

🚀 New Features

  • Runtime Features: No new end-user features were introduced in this release.
  • Test Coverage Expansion: Added broader smoke/module test coverage for CJS and ESM package usage. (#7510)

🐛 Bug Fixes

  • Headers: Trim trailing CRLF in normalised header values. (#7456)
  • HTTP/2: Close detached HTTP/2 sessions on timeout to avoid lingering sessions. (#7457)
  • Fetch Adapter: Cancel ReadableStream created during request-stream capability probing to prevent async resource leaks. (#7515)
  • Proxy Handling: Fixed env proxy behavior with proxy-from-env v2 usage. (#7499)
  • CommonJS Compatibility: Fixed package main entry regression affecting CJS consumers. (#7532)

🔧 Maintenance & Chores

  • Security/Dependencies: Updated formidable and refreshed package set to newer versions. (#7533, #10556)
  • Tooling: Continued migration to Vitest and modernised CI/test harnesses. (#7484, #7489, #7498)
  • Build/Lint Stack: Rollup, ESLint, TypeScript, and related dev-dependency updates. (#7508, #7509, #7522)
  • Documentation: Clarified JSON parsing and adapter-related docs/comments. (#7398, #7460, #7478)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve Axios:

Full Changelog: v1.13.6...v1.14.0

Commits
Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates lodash from 4.17.23 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

  • Add security notice for _.template in threat model and API docs (#6099)
  • Document lower > upper behavior in _.random (#6115)
  • Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

Commits
  • cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
  • 75535f5 chore: prune stale advisory refs (#6170)
  • 62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
  • 59be2de release(minor): bump to 4.18.0 (#6161)
  • af63457 fix: broken tests for _.template 879aaa9
  • 1073a76 fix: linting issues
  • 879aaa9 fix: validate imports keys in _.template
  • fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
  • 18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
  • b819080 ci: add dist sync validation workflow (#6137)
  • Additional commits viewable in compare view

Updates moment-timezone from 0.6.0 to 0.6.1

Release notes

Sourced from moment-timezone's releases.

Release 0.6.1

  • Updated data to IANA TZDB 2026a. #1140

NOTE: This release does not include recently-announced DST changes for British Columbia, Canada. Those changes will likely be in 2026b.

Changelog

Sourced from moment-timezone's changelog.

0.6.1 2026-03-18

  • Updated data to IANA TZDB 2026a. #1140
Commits

Updates vue from 3.5.30 to 3.5.32

Release notes

Sourced from vue's releases.

v3.5.32

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.31

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

Changelog

Sourced from vue's changelog.

3.5.32 (2026-04-03)

Bug Fixes

Reverts

3.5.31 (2026-03-25)

Bug Fixes

  • compiler-sfc: allow Node.js subpath imports patterns in asset urls (#13045) (95c3356), closes #9919
  • compiler-sfc: support template literal as defineModel name (#14622) (bd7eef0), closes #14621
  • reactivity: normalize toRef property keys before dep lookup + improve types (#14625) (1bb28d0), closes #12427 #12431
  • runtime-core: invalidate detached v-for memo vnodes after unmount (#14624) (560def4), closes #12708 #12710
  • runtime-core: preserve nullish event handlers in mergeProps (#14550) (5725222)
  • runtime-core: prevent merging model listener when value is null or undefined (#14629) (b39e032)
  • runtime-dom: defer teleport mount/update until suspense resolves (#8619) (88ed045), closes #8603
  • runtime-dom: handle activeElement check in Shadow DOM for v-model (#14196) (959ded2)
  • server-renderer: cleanup component effect scopes after SSR render (#14548) (862f11e)
  • suspense: avoid unmount activeBranch twice if wrapped in transition (#9392) (908c6ad), closes #7966
  • suspense: update suspense vnode's el during branch self-update (#12922) (a2c1700), closes #12920
  • transition: skip enter guard while hmr updating (#14611) (be0a2f1), closes #14608
  • types: prevent shallowReactive marker from leaking into value unions (#14493) (3b561db), closes #14490
Commits
  • 9a2eb53 release: v3.5.32
  • 32b44f1 fix(teleport): handle updates before deferred mount (#14642)
  • f166353 fix(runtime-core): prevent currentInstance leak into sibling render during as...
  • 302c47a fix(types): use private branding for shallowReactive (#14641)
  • e20ddb0 fix(types): allow customRef to have different getter/setter types (#14639)
  • 219d83b Revert "fix(server-renderer): cleanup component effect scopes after SSR rende...
  • fa23116 chore: fix typos in changelogs (#14653)
  • 81615d3 release: v3.5.31
  • 3b561db fix(types): prevent shallowReactive marker from leaking into value unions (#1...
  • 1b2aca4 chore: ignore entities updates in renovate (#14630)
  • Additional commits viewable in compare view

Updates tailwindcss from 4.2.1 to 4.2.2

Release notes

Sourced from tailwindcss's releases.

v4.2.2

Added

  • Support Vite 8 in @tailwindcss/vite (#19790)

Fixed

  • Don't crash when candidates contain prototype properties like row-constructor (#19725)
  • Canonicalize calc(var(--spacing)*…) expressions into --spacing(…) (#19769)
  • Fix crash in canonicalization step when handling utilities containing @property at-rules (e.g. shadow-sm border) (#19727)
  • Skip full reload for server only modules scanned by client CSS when using @tailwindcss/vite (#19745)
  • Improve canonicalization for bare values exceeding default spacing scale suggestions (e.g. w-1234 h-1234 → size-1234) (#19809)
  • Fix canonicalization resulting in empty list (e.g. w-5 h-5 size-5 → '' instead of size-5) (#19812)
Changelog

Sourced from tailwindcss's changelog.

[4.2.2] - 2026-03-18

Fixed

  • Don't crash when candidates contain prototype properties like row-constructor (#19725)
  • Canonicalize calc(var(--spacing)*…) expressions into --spacing(…) (#19769)
  • Fix crash in canonicalization step when handling utilities containing @property at-rules (e.g. shadow-sm border) (#19727)
  • Skip full reload for server only modules scanned by client CSS when using @tailwindcss/vite (#19745)
  • Add support for Vite 8 in @tailwindcss/vite (#19790)
  • Improve canonicalization for bare values exceeding default spacing scale suggestions (e.g. w-1234 h-1234 → size-1234) (#19809)
  • Fix canonicalization resulting in empty list (e.g. w-5 h-5 size-5 → '' instead of size-5) (#19812)
  • Resolve tsconfig paths to allow for @import '@/path/to/file'; when using @tailwindcss/vite (#19803)
Commits
  • d596b0c 4.2.2 (#19821)
  • 2228a57 Bump Lightning CSS (#19771)
  • f302fce Fix canonicalization resulting in empty list (#19812)
  • bb2f170 Improve canonicalization for bare values exceeding default spacing scale sugg...
  • faa5e88 Cleanup inconsistencies related to (regex) escapes (#19804)
  • d5717f2 run prettier
  • 51aa9d7 fix(canonicalize): handle utilities with empty property maps in collapse (#19...
  • c586bd6 Canonicalize calc(var(--spacing)*…) expressions into --spacing(…) (#19769)
  • 9ded4a2 Guard object lookups against inherited prototype properties (#19725)
  • See full diff in compare view

Updates vite from 6.4.1 to 6.4.2

Release notes

Sourced from vite's releases.

v6.4.2

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

6.4.2 (2026-04-06)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the npm-dependencies group across 1 directory with …
6dfb852 
…7 updates

Bumps the npm-dependencies group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@tailwindcss/vite](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-vite) | `4.2.1` | `4.2.2` |
| [axios](https://github.com/axios/axios) | `1.13.6` | `1.14.0` |
| [lodash](https://github.com/lodash/lodash) | `4.17.23` | `4.18.1` |
| [moment-timezone](https://github.com/moment/moment-timezone) | `0.6.0` | `0.6.1` |
| [vue](https://github.com/vuejs/core) | `3.5.30` | `3.5.32` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `6.4.1` | `6.4.2` |



Updates `@tailwindcss/vite` from 4.2.1 to 4.2.2
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.2.2/packages/@tailwindcss-vite)

Updates `axios` from 1.13.6 to 1.14.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.13.6...v1.14.0)

Updates `lodash` from 4.17.23 to 4.18.1
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.23...4.18.1)

Updates `moment-timezone` from 0.6.0 to 0.6.1
- [Release notes](https://github.com/moment/moment-timezone/releases)
- [Changelog](https://github.com/moment/moment-timezone/blob/develop/changelog.md)
- [Commits](moment/moment-timezone@0.6.0...0.6.1)

Updates `vue` from 3.5.30 to 3.5.32
- [Release notes](https://github.com/vuejs/core/releases)
- [Changelog](https://github.com/vuejs/core/blob/main/CHANGELOG.md)
- [Commits](vuejs/core@v3.5.30...v3.5.32)

Updates `tailwindcss` from 4.2.1 to 4.2.2
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.2.2/packages/tailwindcss)

Updates `vite` from 6.4.1 to 6.4.2
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v6.4.2/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v6.4.2/packages/vite)

---
updated-dependencies:
- dependency-name: "@tailwindcss/vite"
  dependency-version: 4.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: axios
  dependency-version: 1.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: moment-timezone
  dependency-version: 0.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: vue
  dependency-version: 3.5.32
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: tailwindcss
  dependency-version: 4.2.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: vite
  dependency-version: 6.4.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 6, 2026
@cloudflare-workers-and-pages
Copy link
Copy Markdown

cloudflare-workers-and-pages bot commented Apr 6, 2026 •
edited
Loading

Deploying netabare with  Cloudflare Pages  Cloudflare Pages

Latest commit: 6dfb852
Status: ✅  Deploy successful!
Preview URL: https://9b6e2d7a.netabare.pages.dev
Branch Preview URL: https://dependabot-npm-and-yarn-npm-ywjz.netabare.pages.dev

View logs

@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants