chore(deps): bump the npm_and_yarn group across 1 directory with 2 updates by dependabot[bot] · Pull Request #252 · DevOpsMadDog/Fixops

dependabot · 2026-02-23T11:07:09Z

Bumps the npm_and_yarn group with 2 updates in the /suite-ui/aldeci directory: axios and esbuild.

Updates axios from 1.13.4 to 1.13.5

Release notes

v1.13.5

Release 1.13.5

Highlights

Security: Fixed a potential Denial of Service issue involving the __proto__ key in mergeConfig. (PR #7369)

Bug fix: Resolved an issue where AxiosError could be missing the status field on and after v1.13.3. (PR #7368)

Changes

Security

Fix Denial of Service via __proto__ key in mergeConfig. (PR #7369)

Fixes

Fix/5657. (PR #7313)

Ensure status is present in AxiosError on and after v1.13.3. (PR #7368)

Features / Improvements

Add input validation to isAbsoluteURL. (PR #7326)

Refactor: bump minor package versions. (PR #7356)

Documentation

Clarify object-check comment. (PR #7323)

Fix deprecated Buffer constructor usage and README formatting. (PR #7371)

CI / Maintenance

Chore: fix issues with YAML. (PR #7355)

CI: update workflow YAMLs. (PR #7372)

CI: fix run condition. (PR #7373)

Dev deps: bump karma-sourcemap-loader from 0.3.8 to 0.4.0. (PR #7360)

Chore(release): prepare release 1.13.5. (PR #7379)

New Contributors

@sachin11063 (first contribution — PR #7323)

@asmitha-16 (first contribution — PR #7326)

Full Changelog: axios/axios@v1.13.4...v1.13.5

Commits

29f7542 chore(release): prepare release 1.13.5 (#7379)
431c3a3 ci: fix run condition (#7373)
9ff3a78 ci: update ymls (#7372)
265b712 docs: fix deprecated Buffer constructor and formatting issues in README (#7371)
475e75a feat: add input validation to isAbsoluteURL (#7326)
28c7215 fix: Denial of Service via proto Key in mergeConfig (#7369)
04cf019 docs: clarify object check comment (#7323)
696fa75 fix: status is missing in AxiosError on and after v1.13.3 (#7368)
569f028 fix: added a option to choose between legacy and the new request/response int...
44b7c9f chore(deps-dev): bump karma-sourcemap-loader (#7360)
Additional commits viewable in compare view

Updates esbuild from 0.21.5 to 0.27.3

Release notes

Sourced from esbuild's releases.

v0.27.3
Preserve URL fragments in data URLs (#4370)

Consider the following HTML, CSS, and SVG:
index.html:
<!DOCTYPE html>
<html>
  <head><link rel="stylesheet" href="icons.css"></head>
  <body><div class="triangle"></div></body>
</html>
icons.css:
.triangle {
  width: 10px;
  height: 10px;
  background: currentColor;
  clip-path: url(./triangle.svg#x);
}
triangle.svg:
<svg xmlns="http://www.w3.org/2000/svg">
  <defs>
    <clipPath id="x">
      <path d="M0 0H10V10Z"/>
    </clipPath>
  </defs>
</svg>
The CSS uses a URL fragment (the #x) to reference the clipPath element in the SVG file. Previously esbuild's CSS bundler didn't preserve the URL fragment when bundling the SVG using the dataurl loader, which broke the bundled CSS. With this release, esbuild will now preserve the URL fragment in the bundled CSS:
/* icons.css */
.triangle {
  width: 10px;
  height: 10px;
  background: currentColor;
  clip-path: url('data:image/svg+xml,<svg xmlns="http://www.w3.org/2000/svg"><defs><clipPath id="x"><path d="M0 0H10V10Z"/></clipPath></defs></svg>#x');
}

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2024

This changelog documents all esbuild versions published in the year 2024 (versions 0.19.12 through 0.24.2).

0.24.2

Fix regression with --define and import.meta (#4010, #4012, #4013)

The previous change in version 0.24.1 to use a more expression-like parser for define values to allow quoted property names introduced a regression that removed the ability to use --define:import.meta=.... Even though import is normally a keyword that can't be used as an identifier, ES modules special-case the import.meta expression to behave like an identifier anyway. This change fixes the regression.

This fix was contributed by @sapphi-red.

0.24.1
Allow es2024 as a target in tsconfig.json (#4004)

TypeScript recently added es2024 as a compilation target, so esbuild now supports this in the target field of tsconfig.json files, such as in the following configuration file:
{
  "compilerOptions": {
    "target": "ES2024"
  }
}
As a reminder, the only thing that esbuild uses this field for is determining whether or not to use legacy TypeScript behavior for class fields. You can read more in the documentation.

This fix was contributed by @billyjanitsch.
Allow automatic semicolon insertion after get/set

This change fixes a grammar bug in the parser that incorrectly treated the following code as a syntax error:
class Foo {
  get
  *x() {}
  set
  *y() {}
}
The above code will be considered valid starting with this release. This change to esbuild follows a similar change to TypeScript which will allow this syntax starting with TypeScript 5.7.
Allow quoted property names in --define and --pure (#4008)

The define and pure API options now accept identifier expressions containing quoted property names. Previously all identifiers in the identifier expression had to be bare identifiers. This change now makes --define and --pure consistent with --global-name, which already supported quoted property names. For example, the following is now possible:

... (truncated)

Commits

9129e00 publish 0.27.3 to npm
e20e411 small fix to release notes
0dc0f2d fix #4322: parse and print CSS @scope rules
55fe391 update firefox css gradient support
2c35297 update gradient lowering transform
9209e44 Update Go to 1.25.7 (#4388)
e8d861b close #4374: compat table for the using feature
19b8887 no longer need williamkapke/node-compat-table
7e44218 the kangax/compat-table repo moved to a new url
23b9338 run make update-compat-table
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for esbuild since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Summary by cubic

Upgrade Suite UI (aldeci) build toolchain and HTTP client. This patches an axios security issue and updates esbuild/Vite, which raises Node version requirements.

Dependencies
- axios → 1.13.5: fixes DoS via proto in mergeConfig; restores AxiosError.status.
- esbuild → 0.27.3: build fixes and improvements; requires Node ≥18.
- vite → 7.3.1 (dev): aligns with esbuild ^0.27; requires Node ≥20.19 or ≥22.12.
Migration
- Update local and CI Node to ≥20.19 to satisfy Vite 7 (and esbuild).
- Reinstall deps and run build/tests in /suite-ui/aldeci.

^{Written for commit 433e86a. Summary will update on new commits.}

…dates Bumps the npm_and_yarn group with 2 updates in the /suite-ui/aldeci directory: [axios](https://github.com/axios/axios) and [esbuild](https://github.com/evanw/esbuild). Updates `axios` from 1.13.4 to 1.13.5 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.13.4...v1.13.5) Updates `esbuild` from 0.21.5 to 0.27.3 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2024.md) - [Commits](evanw/esbuild@v0.21.5...v0.27.3) --- updated-dependencies: - dependency-name: axios dependency-version: 1.13.5 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: esbuild dependency-version: 0.27.3 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

cubic-dev-ai

No issues found across 2 files

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 433e86af9e

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-02-23T11:11:01Z

    "tailwindcss": "^3.4.1",
    "typescript": "^5.3.3",
-    "vite": "^5.0.11"
+    "vite": "^7.3.1"


Avoid upgrading Vite major without runtime migration

This change bumps vite from ^5.0.11 to ^7.3.1, which is a breaking major upgrade, and the updated lockfile now pulls Vite with a stricter engine requirement (node ^20.19.0 || >=22.12.0 instead of the previous ^18.0.0 || >=20.0.0). In environments still on Node 18 or early Node 20, npm install/npm run dev will start failing immediately after this commit, but this PR does not include any corresponding runtime-version bump or migration updates.

Useful? React with 👍 / 👎.

dependabot · 2026-03-26T10:24:06Z

Superseded by #253.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Feb 23, 2026

cubic-dev-ai Bot reviewed Feb 23, 2026

View reviewed changes

chatgpt-codex-connector Bot reviewed Feb 23, 2026

View reviewed changes

dependabot Bot closed this Mar 26, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/suite-ui/aldeci/npm_and_yarn-9f6d8753bb branch March 26, 2026 10:24

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump the npm_and_yarn group across 1 directory with 2 updates#252

chore(deps): bump the npm_and_yarn group across 1 directory with 2 updates#252
dependabot[bot] wants to merge 1 commit into
features/intermediate-stagefrom
dependabot/npm_and_yarn/suite-ui/aldeci/npm_and_yarn-9f6d8753bb

dependabot Bot commented on behalf of github Feb 23, 2026 •

edited by cubic-dev-ai Bot

Loading

Uh oh!

cubic-dev-ai Bot left a comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Feb 23, 2026

Uh oh!

dependabot Bot commented on behalf of github Mar 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Feb 23, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v1.13.5

Release 1.13.5

Highlights

Changes

Security

Fixes

Features / Improvements

Documentation

CI / Maintenance

New Contributors

v0.27.3

Changelog: 2024

0.24.2

0.24.1

Summary by cubic

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

dependabot Bot commented on behalf of github Mar 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Feb 23, 2026 •

edited by cubic-dev-ai Bot

Loading