Skip to content

chore: bump the security group across 1 directory with 6 updates - #902

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/examples/remix/remix-app/security-e6d6e45440
Open

chore: bump the security group across 1 directory with 6 updates#902
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/examples/remix/remix-app/security-e6d6e45440

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 23, 2026

Copy link
Copy Markdown
Contributor

Bumps the security group with 6 updates in the /examples/remix/remix-app directory:

Package From To
compression 1.7.4 1.8.2
vite 5.4.8 6.4.4
brace-expansion 1.1.11 1.1.21
postcss-selector-parser 6.1.4 7.1.7
proxy-addr 2.0.7 2.0.8
source-map-js 1.2.1 1.2.2

Updates compression from 1.7.4 to 1.8.2

Release notes

Sourced from compression's releases.

v1.8.2

Important

What's Changed

New Contributors

Full Changelog: expressjs/compression@v1.8.1...v1.8.2

v1.8.1

What's Changed

... (truncated)

Changelog

Sourced from compression's changelog.

1.8.2

1.8.1

1.8.0

  • Use res.headersSent when available
  • Replace _implicitHeader with writeHead property
  • add brotli support for versions of node that support it
  • Add the enforceEncoding option for requests without Accept-Encoding header

1.7.5

  • deps: Replace accepts with negotiator@~0.6.4
    • Add preference option
  • deps: bytes@3.1.2
    • Add petabyte (pb) support
    • Fix "thousandsSeparator" incorrecting formatting fractional part
    • Fix return value for un-parsable strings
  • deps: compressible@~2.0.18
    • Mark font/ttf as compressible
    • Remove compressible from multipart/mixed
    • deps: mime-db@'>= 1.43.0 < 2'
  • deps: safe-buffer@5.2.1
Commits
  • 0f97074 1.8.2 (#287)
  • 151f63e fix: destroy compression stream on response close
  • 0a76495 fix: match Cache-Control no-transform directive case-insensitively (#286)
  • c17b6e5 docs: update outdated Brotli note and fix npm install docs URL (#276)
  • 112911a chore(ci): npm-publish via reusable workflows (#269)
  • 1bf5eb0 build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 (#267)
  • d8fe64d build(deps): bump actions/setup-node from 6.0.0 to 6.1.0 (#266)
  • b218ff5 build(deps): bump github/codeql-action from 4.31.5 to 4.31.9 (#265)
  • 8a1cf8e build(deps): bump actions/download-artifact from 6.0.0 to 7.0.0 (#268)
  • 4a19855 build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 (#257)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for compression since your current version.


Updates vite from 5.4.8 to 6.4.4

Release notes

Sourced from vite's releases.

v6.4.4

Please refer to CHANGELOG.md for details.

v6.4.3

Please refer to CHANGELOG.md for details.

v6.4.2

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

6.4.4 (2026-10-06)

6.4.3 (2026-06-01)

6.4.2 (2026-04-06)

6.4.1 (2025-10-20)

6.4.0 (2025-10-15)

  • feat: allow passing down resolved config to vite's createServer (#20932) (ca6455e), closes #20932

6.3.7 (2025-10-14)

  • fix(esbuild): inject esbuild helpers correctly for esbuild 0.25.9+ (#20940) (c59a222), closes #20940

6.3.6 (2025-09-08)

6.3.5 (2025-05-05)

... (truncated)

Commits
  • 5f0d9a4 release: v6.4.4
  • eec6464 fix(server): check resolved ids for transform access (#20410)
  • e570d8d fix(server): store ids to safeModulePaths rather than URLs (#23656)
  • 8afec69 fix(deps): update launch-editor to v2.14.2 (#23654)
  • 19902cf fix(html): filename passed to transformIndexHtml should not include queries (...
  • 6c2c881 release: v6.4.3
  • 96b0c10 fix: backport #22572, reject windows alternate paths (#22576)
  • 8fed5cf fix(deps): backport #22571, reject UNC paths for launch-editor-middleware (#2...
  • 6b3fad0 release: v6.4.2
  • ca4da5d fix: avoid path traversal with optimize deps sourcemap handler (#22161)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for vite since your current version.


Updates brace-expansion from 1.1.11 to 1.1.21

Release notes

Sourced from brace-expansion's releases.

v1.1.15

  • Backport v5.0.6 change to v1 (#111) 0b09384

juliangruber/brace-expansion@v1.1.14...v1.1.15

v1.1.12

  • pkg: publish on tag 1.x c460dbd
  • fmt ccb8ac6
  • Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) c3c73c8

juliangruber/brace-expansion@v1.1.11...v1.1.12

Commits

Updates postcss-selector-parser from 6.1.4 to 7.1.7

Release notes

Sourced from postcss-selector-parser's releases.

7.1.7

  • fix: lossless: true preserves trailing whitespace in a selector that ends empty, such as :not(a, ). Note that :not( ) now yields a selector holding one empty string node rather than an empty selector (#337 by @​theRizwan)
  • fix: consume the whitespace that terminates a hexadecimal escape, so [x="\000061 b"] unescapes to ab (#340 by @​jakezwang)
  • fix: set the parent on every node passed to insertBefore and insertAfter, not only the first (#343 by @​feritcemkahraman)
  • fix: assigning combinator.value clears the stale raw spelling instead of being ignored (#342 by @​SAY-5)
  • fix: keep whitespace around the namespace separator in attribute selectors, so [ foo | bar ] round-trips (#339 by @​dkryaklin)

7.1.6

  • fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (GHSA-rj75-hqrm-r3gf, reported by Wayde Shi)

7.1.5

  • fix: don't treat a non-prefix token before | as a namespace (#324 by @​spokodev)
  • fix: preserve whitespace before a * namespace in attribute selectors (#325 by @​spokodev)
  • fix: TypeError on unclosed [, ( and trailing | (#330 by @​theRizwan)

7.1.4

  • fix: tolerate non-node children when serializing selectors

7.1.3

  • Improve fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (clone/walk)

7.1.2

v7.1.1

7.1.1

  • perf: replace startsWith with strict equality (#308)
  • fix(types): add walkUniversal declaration (#311)

v7.1.0

7.1.0

  • feat: insert(Before|After) support multiple new node

v7.0.0

7.0.0

  • Feat: make insertions during iteration safe (major)

6.1.5

The 6.x line is now in security-only maintenance

This release exists because the advisory above covers every published 6.x version, and until now the only remediation on offer was an upgrade to 7.x. 6.1.5 is the patched version for the 6.x line.

The line is kept alive for the installed base that cannot move to 7 yet, Tailwind

... (truncated)

Changelog

Sourced from postcss-selector-parser's changelog.

7.1.7 - 2026-10-19

  • fix: lossless: true preserves trailing whitespace in a selector that ends empty, such as :not(a, ). Note that :not( ) now yields a selector holding one empty string node rather than an empty selector (#337 by @​theRizwan)
  • fix: consume the whitespace that terminates a hexadecimal escape, so [x="\000061 b"] unescapes to ab (#340 by @​jakezwang)
  • fix: set the parent on every node passed to insertBefore and insertAfter, not only the first (#343 by @​feritcemkahraman)
  • fix: assigning combinator.value clears the stale raw spelling instead of being ignored (#342 by @​SAY-5)
  • fix: keep whitespace around the namespace separator in attribute selectors, so [ foo | bar ] round-trips (#339 by @​dkryaklin)

7.1.6 - 2026-09-03

7.1.5 - 2026-08-07

  • fix: don't treat a non-prefix token before | as a namespace (#324 by @​spokodev)
  • fix: preserve whitespace before a * namespace in attribute selectors (#325 by @​spokodev)
  • fix: TypeError on unclosed [, ( and trailing | (#330 by @​theRizwan)

7.1.4 - 2026-06-11

  • fix: tolerate non-node children when serializing selectors

7.1.3 - 2026-06-11

  • Improve fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (clone/walk)

7.1.2 - 2026-06-09

7.1.1

  • perf: replace startsWith with strict equality (#308)
  • fix(types): add walkUniversal declaration (#311)

7.1.0

  • feat: insert(Before|After) support multiple new node

7.0.0

  • Feat: make insertions during iteration safe (major)

6.1.2

  • Fixed: erroneous trailing combinators in pseudos

6.1.1

... (truncated)

Commits
  • 154c2b0 7.1.7
  • e8dc65f docs: add CVE-2026-104844 to the 7.1.6 changelog entry
  • d5122b0 fix: keep whitespace around the namespace separator in attribute selectors (#...
  • 80ab254 fix: invalidate stale raw spelling on combinator value assignment (#342)
  • ba353c7 fix: set parents for all variadic inserted nodes (#343)
  • 8b2d16d Consume whitespace after hexadecimal CSS escapes (#340)
  • 8f10b8d fix: lossless mode drops whitespace when a selector ends empty (#337)
  • 15c2b45 chore(deps-dev): bump source-map-js from 1.2.1 to 1.2.2 (#347)
  • 4eb3468 7.1.6
  • 62b1917 fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability
  • Additional commits viewable in compare view
Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates proxy-addr from 2.0.7 to 2.0.8

Release notes

Sourced from proxy-addr's releases.

2.0.8

Important

What's Changed

New Contributors

Full Changelog: jshttp/proxy-addr@v2.0.7...v2.0.8

Changelog

Sourced from proxy-addr's changelog.

2.0.8

Commits
  • a11ad82 2.0.8 (#70)
  • 780911d fix: reject IPv4 trust via mapped IPv6 subnets with a short prefix
  • 92e103e fix(ci): use publised as release trigger event (#71)
  • 3e5ac75 ci: merge coverage via artifacts, disable fail-fast, add Node.js 23-26 (#69)
  • 4b9db81 chore(ci): npm-publish via workflows (#54)
  • 655e895 build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0 (#39)
  • 50ce4d0 build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 (#45)
  • 0fd347f build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#63)
  • 6a517fa build(deps): bump github/codeql-action from 4.32.4 to 4.36.0 (#64)
  • 0d45e2a Fix "arugment" typo in README (#61)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for proxy-addr since your current version.


Updates source-map-js from 1.2.1 to 1.2.2

Release notes

Sourced from source-map-js's releases.

v1.2.2

Changelog

Sourced from source-map-js's changelog.

1.2.2

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore: bump the security group across 1 directory with 6 updates
66495b5 
Bumps the security group with 6 updates in the /examples/remix/remix-app directory:

| Package | From | To |
| --- | --- | --- |
| [compression](https://github.com/expressjs/compression) | `1.7.4` | `1.8.2` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `5.4.8` | `6.4.4` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.11` | `1.1.21` |
| [postcss-selector-parser](https://github.com/postcss/postcss-selector-parser) | `6.1.4` | `7.1.7` |
| [proxy-addr](https://github.com/jshttp/proxy-addr) | `2.0.7` | `2.0.8` |
| [source-map-js](https://github.com/7rulnik/source-map-js) | `1.2.1` | `1.2.2` |



Updates `compression` from 1.7.4 to 1.8.2
- [Release notes](https://github.com/expressjs/compression/releases)
- [Changelog](https://github.com/expressjs/compression/blob/master/HISTORY.md)
- [Commits](expressjs/compression@1.7.4...v1.8.2)

Updates `vite` from 5.4.8 to 6.4.4
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v6.4.4/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v6.4.4/packages/vite)

Updates `brace-expansion` from 1.1.11 to 1.1.21
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@1.1.11...v1.1.21)

Updates `postcss-selector-parser` from 6.1.4 to 7.1.7
- [Release notes](https://github.com/postcss/postcss-selector-parser/releases)
- [Changelog](https://github.com/postcss/postcss-selector-parser/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss-selector-parser@6.1.4...7.1.7)

Updates `proxy-addr` from 2.0.7 to 2.0.8
- [Release notes](https://github.com/jshttp/proxy-addr/releases)
- [Changelog](https://github.com/jshttp/proxy-addr/blob/master/HISTORY.md)
- [Commits](jshttp/proxy-addr@v2.0.7...v2.0.8)

Updates `source-map-js` from 1.2.1 to 1.2.2
- [Release notes](https://github.com/7rulnik/source-map-js/releases)
- [Changelog](https://github.com/7rulnik/source-map-js/blob/main/CHANGELOG.md)
- [Commits](7rulnik/source-map-js@v1.2.1...v1.2.2)

---
updated-dependencies:
- dependency-name: compression
  dependency-version: 1.8.2
  dependency-type: direct:production
  dependency-group: security
- dependency-name: vite
  dependency-version: 6.4.4
  dependency-type: direct:development
  dependency-group: security
- dependency-name: brace-expansion
  dependency-version: 1.1.21
  dependency-type: indirect
  dependency-group: security
- dependency-name: postcss-selector-parser
  dependency-version: 7.1.7
  dependency-type: indirect
  dependency-group: security
- dependency-name: proxy-addr
  dependency-version: 2.0.8
  dependency-type: indirect
  dependency-group: security
- dependency-name: source-map-js
  dependency-version: 1.2.2
  dependency-type: indirect
  dependency-group: security
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Oct 23, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner October 23, 2026 21:19

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants