chore(deps): bump the npm_and_yarn group across 21 directories with 11 updates by dependabot[bot] · Pull Request #109 · mbarnes-code/modular-monolith-2

dependabot · 2026-01-21T05:49:32Z

Bumps the npm_and_yarn group with 2 updates in the /features/CyberChef directory: diff and qs.
Bumps the npm_and_yarn group with 1 update in the /features/Nemesis/projects/frontend directory: react-router.
Bumps the npm_and_yarn group with 4 updates in the /features/actual directory: diff, qs, react-router and undici.
Bumps the npm_and_yarn group with 1 update in the /features/actual/packages/desktop-client directory: react-router.
Bumps the npm_and_yarn group with 1 update in the /features/dispatch/docs directory: qs.
Bumps the npm_and_yarn group with 2 updates in the /features/firecrawl-mcp-server directory: qs and @modelcontextprotocol/sdk.
Bumps the npm_and_yarn group with 1 update in the /features/firecrawl/apps/api directory: undici.
Bumps the npm_and_yarn group with 1 update in the /features/firecrawl/apps/js-sdk directory: diff.
Bumps the npm_and_yarn group with 1 update in the /features/firecrawl/apps/playwright-service-ts directory: diff.
Bumps the npm_and_yarn group with 4 updates in the /features/firecrawl/apps/test-suite directory: diff, qs, undici and @smithy/config-resolver.
Bumps the npm_and_yarn group with 1 update in the /features/goose/documentation directory: qs.
Bumps the npm_and_yarn group with 4 updates in the /features/goose/ui/desktop directory: qs, react-router, @modelcontextprotocol/sdk and devalue.
Bumps the npm_and_yarn group with 3 updates in the /features/inspector directory: diff, qs and @modelcontextprotocol/sdk.
Bumps the npm_and_yarn group with 1 update in the /features/mcp-virustotal directory: @modelcontextprotocol/sdk.
Bumps the npm_and_yarn group with 4 updates in the /features/mealie/frontend directory: diff, tar, h3 and devalue.
Bumps the npm_and_yarn group with 5 updates in the /features/n8n directory:

Package	From	To
qs	`6.11.0`	`6.14.1`
undici	`6.21.3`	`6.23.0`
@modelcontextprotocol/sdk	`1.15.1`	`1.25.2`
nodemailer	`6.9.9`	`7.0.11`
@langchain/core	`0.3.68`	`0.3.80`

Bumps the npm_and_yarn group with 1 update in the /features/n8n-mcp-server directory: @modelcontextprotocol/sdk.
Bumps the npm_and_yarn group with 1 update in the /features/n8n/packages/@n8n/nodes-langchain directory: @modelcontextprotocol/sdk.
Bumps the npm_and_yarn group with 1 update in the /features/n8n/packages/cli directory: nodemailer.
Bumps the npm_and_yarn group with 1 update in the /features/n8n/packages/core directory: qs.
Bumps the npm_and_yarn group with 4 updates in the /tests/productivity/firecrawl/test-suite directory: diff, qs, undici and @smithy/config-resolver.

Updates diff from 5.2.0 to 5.2.2

Changelog

Sourced from diff's changelog.

Release Notes

8.0.3

#631 - fix support for using an Intl.Segmenter with diffWords. This has been almost completely broken since the feature was added in v6.0.0, since it would outright crash on any text that featured two consecutive newlines between a pair of words (a very common case).

#635 - small tweaks to tokenization behaviour of diffWords when used without an Intl.Segmenter. Specifically, the soft hyphen (U+00AD) is no longer considered to be a word break, and the multiplication and division signs (× and ÷) are now treated as punctuation instead of as letters / word characters.

#641 - the format of file headers in createPatch etc. patches can now be customised somewhat. It now takes a headerOptions option that can be used to disable the file headers entirely, or omit the Index: line and/or the underline. In particular, this was motivated by a request to make jsdiff patches compatible with react-diff-view, which they now are if produced with headerOptions: FILE_HEADERS_ONLY.

#647 and #649 - fix denial-of-service vulnerabilities in parsePatch whereby adversarial input could cause a memory-leaking infinite loop, typically crashing the calling process. Also fixed ReDOS vulnerabilities whereby adversarially-crafted patch headers could take cubic time to parse. Now, parsePatch should reliably take linear time. (Handling of headers that include the line break characters \r, \u2028, or \u2029 in non-trailing positions is also now more reasonable as side effect of the fix.)

8.0.2

#616 Restored compatibility of diffSentences with old Safari versions. This was broken in 8.0.0 by the introduction of a regex with a lookbehind assertion; these weren't supported in Safari prior to version 16.4.

#612 Improved tree shakeability by marking the built CJS and ESM packages with sideEffects: false.

8.0.1

#610 Fixes types for diffJson which were broken by 8.0.0. The new bundled types in 8.0.0 only allowed diffJson to be passed string arguments, but it should've been possible to pass either strings or objects (and now is). Thanks to Josh Kelley for the fix.

8.0.0

#580 Multiple tweaks to diffSentences:

tokenization no longer takes quadratic time on pathological inputs (reported as a ReDOS vulnerability by Snyk); is now linear instead

the final sentence in the string is now handled the same by the tokenizer regardless of whether it has a trailing punctuation mark or not. (Previously, "foo. bar." tokenized to ["foo.", " ", "bar."] but "foo. bar" tokenized to ["foo.", " bar"] - i.e. whether the space between sentences was treated as a separate token depended upon whether the final sentence had trailing punctuation or not. This was arbitrary and surprising; it is no longer the case.)

in a string that starts with a sentence end, like "! hello.", the "!" is now treated as a separate sentence

the README now correctly documents the tokenization behaviour (it was wrong before)

#581 - fixed some regex operations used for tokenization in diffWords taking O(n^2) time in pathological cases

#595 - fixed a crash in patch creation functions when handling a single hunk consisting of a very large number (e.g. >130k) of lines. (This was caused by spreading indefinitely-large arrays to .push() using .apply or the spread operator and hitting the JS-implementation-specific limit on the maximum number of arguments to a function, as shown at https://stackoverflow.com/a/56809779/1709587; thus the exact threshold to hit the error will depend on the environment in which you were running JsDiff.)

#596 - removed the merge function. Previously JsDiff included an undocumented function called merge that was meant to, in some sense, merge patches. It had at least a couple of serious bugs that could lead to it returning unambiguously wrong results, and it was difficult to simply "fix" because it was unclear precisely what it was meant to do. For now, the fix is to remove it entirely.

#591 - JsDiff's source code has been rewritten in TypeScript. This change entails the following changes for end users:

the diff package on npm now includes its own TypeScript type definitions. Users who previously used the @types/diff npm package from DefinitelyTyped should remove that dependency when upgrading JsDiff to v8.

Note that the transition from the DefinitelyTyped types to JsDiff's own type definitions includes multiple fixes and also removes many exported types previously used for options arguments to diffing and patch-generation functions. (There are now different exported options types for abortable calls - ones with a timeout or maxEditLength that may give a result of undefined - and non-abortable calls.) See the TypeScript section of the README for some usage tips.

The Diff object is now a class. Custom extensions of Diff, as described in the "Defining custom diffing behaviors" section of the README, can therefore now be done by writing a class CustomDiff extends Diff and overriding methods, instead of the old way based on prototype inheritance. (I think code that did things the old way should still work, though!)

diff/lib/index.es6.js and diff/lib/index.mjs no longer exist, and the ESM version of the library is no longer bundled into a single file.

The ignoreWhitespace option for diffWords is no longer included in the type declarations. The effect of passing ignoreWhitespace: true has always been to make diffWords just call diffWordsWithSpace instead, which was confusing, because that behaviour doesn't seem properly described as "ignoring" whitespace at all. The property remains available to non-TypeScript applications for the sake of backwards compatibility, but TypeScript applications will now see a type error if they try to pass ignoreWhitespace: true to diffWords and should change their code to call diffWordsWithSpace instead.

JsDiff no longer purports to support ES3 environments. (I'm pretty sure it never truly did, despite claiming to in its README, since even the 1.0.0 release used Array.map which was added in ES5.)

#601 - diffJson's stringifyReplacer option behaves more like JSON.stringify's replacer argument now. In particular:

Each key/value pair now gets passed through the replacer once instead of twice

The key passed to the replacer when the top-level object is passed in as value is now "" (previously, was undefined), and the key passed with an array element is the array index as a string, like "0" or "1" (previously was whatever the key for the entire array was). Both the new behaviours match that of JSON.stringify.

#602 - diffing functions now consistently return undefined when called in async mode (i.e. with a callback). Previously, there was an odd quirk where they would return true if the strings being diffed were equal and undefined otherwise.

7.0.0

Just a single (breaking) bugfix, undoing a behaviour change introduced accidentally in 6.0.0:

#554 diffWords treats numbers and underscores as word characters again. This behaviour was broken in v6.0.0.

... (truncated)

Commits

b7b6339 v5.2.2
b5377ab Update package version to 5.2.1
7801789 Backport kpdecker/jsdiff#649
042a837 Backport kpdecker/jsdiff#647
See full diff in compare view

Updates qs from 6.14.0 to 6.14.1

Changelog

Sourced from qs's changelog.

6.14.1

[Fix] ensure arrayLength applies to [] notation as well

[Fix] parse: when a custom decoder returns null for a key, ignore that key

[Refactor] parse: extract key segment splitting helper

[meta] add threat model

[actions] add workflow permissions

[Tests] stringify: increase coverage

[Dev Deps] update eslint, @ljharb/eslint-config, npmignore, es-value-fixtures, for-each, object-inspect

Commits

3fa11a5 v6.14.1
a626704 [Dev Deps] update npmignore
3086902 [Fix] ensure arrayLength applies to [] notation as well
fc7930e [Dev Deps] update eslint, @ljharb/eslint-config
0b06aac [Dev Deps] update @ljharb/eslint-config
64951f6 [Refactor] parse: extract key segment splitting helper
e1bd259 [Dev Deps] update @ljharb/eslint-config
f4b3d39 [eslint] add eslint 9 optional peer dep
6e94d95 [Dev Deps] update eslint, @ljharb/eslint-config, npmignore
973dc3c [actions] add workflow permissions
Additional commits viewable in compare view

Updates react-router from 7.6.1 to 7.12.0

Release notes

Sourced from react-router's releases.

v7.12.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7120

v7.11.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7110

v7.10.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7101

v7.10.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7100

v7.9.6

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v796

v7.9.5

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v795

v7.9.4

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v794

v7.9.3

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v793

v7.9.2

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v792

v7.9.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v791

v7.9.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v790

v7.8.2

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v782

v7.8.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v781

v7.8.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v780

v7.7.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v771

v7.7.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v770

v7.6.3

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v763

... (truncated)

Changelog

Sourced from react-router's changelog.

7.12.0

Minor Changes

Add additional layer of CSRF protection by rejecting submissions to UI routes from external origins. If you need to permit access to specific external origins, you can specify them in the react-router.config.ts config allowedActionOrigins field. (#14708)

Patch Changes

Fix generatePath when used with suffixed params (i.e., "/books/:id.json") (#14269)

Export UNSAFE_createMemoryHistory and UNSAFE_createHashHistory alongside UNSAFE_createBrowserHistory for consistency. These are not intended to be used for new apps but intended to help apps usiong unstable_HistoryRouter migrate from v6->v7 so they can adopt the newer APIs. (#14663)

Escape HTML in scroll restoration keys (#14705)

Validate redirect locations (#14706)

[UNSTABLE] Pass <Scripts nonce> value through to the underlying importmap script tag when using future.unstable_subResourceIntegrity (#14675)

[UNSTABLE] Add a new future.unstable_trailingSlashAwareDataRequests flag to provide consistent behavior of request.pathname inside middleware, loader, and action functions on document and data requests when a trailing slash is present in the browser URL. (#14644)

Currently, your HTTP and request pathnames would be as follows for /a/b/c and /a/b/c/

URL /a/b/c HTTP pathname request pathname`

Document /a/b/c /a/b/c ✅

Data /a/b/c.data /a/b/c ✅

URL /a/b/c/ HTTP pathname request pathname`

Document /a/b/c/ /a/b/c/ ✅

Data /a/b/c.data /a/b/c ⚠️

With this flag enabled, these pathnames will be made consistent though a new _.data format for client-side .data requests:

URL /a/b/c HTTP pathname request pathname`

Document /a/b/c /a/b/c ✅

Data /a/b/c.data /a/b/c ✅

URL /a/b/c/ HTTP pathname request pathname`

Document /a/b/c/ /a/b/c/ ✅

Data /a/b/c/_.data ⬅️ /a/b/c/ ✅

This a bug fix but we are putting it behind an opt-in flag because it has the potential to be a "breaking bug fix" if you are relying on the URL format for any other application or caching logic.

Enabling this flag also changes the format of client side .data requests from /_root.data to /_.data when navigating to / to align with the new format. This does not impact the request pathname which is still / in all cases.

Preserve clientLoader.hydrate=true when using <HydratedRouter unstable_instrumentations> (#14674)

... (truncated)

Commits

26653a6 chore: Update version for release (#14712)
7ac2346 chore: Update version for release (pre) (#14709)
75b1ef5 Add origin checks for UI route submissions (#14708)
c05ef93 Validate redirect locations (#14706)
c89c32c Escape HTML in scroll restoration keys (#14705)
cbcbf30 fix: pass nonce to importmap script when using subResourceIntegrity (#14675)
30f6c1d fix(react-router): handle parameters with static suffixes in generatePath (#1...
7f140e0 Handle data requests with trailing slash consistently (#14644)
1954af6 Preserve hydrate property on client loaders during instrumentation (#14674)
5ce5cd4 chore: format
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for react-router since your current version.

Updates diff from 4.0.2 to 4.0.4

Changelog

Sourced from diff's changelog.

Release Notes

8.0.3

#631 - fix support for using an Intl.Segmenter with diffWords. This has been almost completely broken since the feature was added in v6.0.0, since it would outright crash on any text that featured two consecutive newlines between a pair of words (a very common case).

#635 - small tweaks to tokenization behaviour of diffWords when used without an Intl.Segmenter. Specifically, the soft hyphen (U+00AD) is no longer considered to be a word break, and the multiplication and division signs (× and ÷) are now treated as punctuation instead of as letters / word characters.

#641 - the format of file headers in createPatch etc. patches can now be customised somewhat. It now takes a headerOptions option that can be used to disable the file headers entirely, or omit the Index: line and/or the underline. In particular, this was motivated by a request to make jsdiff patches compatible with react-diff-view, which they now are if produced with headerOptions: FILE_HEADERS_ONLY.

#647 and #649 - fix denial-of-service vulnerabilities in parsePatch whereby adversarial input could cause a memory-leaking infinite loop, typically crashing the calling process. Also fixed ReDOS vulnerabilities whereby adversarially-crafted patch headers could take cubic time to parse. Now, parsePatch should reliably take linear time. (Handling of headers that include the line break characters \r, \u2028, or \u2029 in non-trailing positions is also now more reasonable as side effect of the fix.)

8.0.2

#616 Restored compatibility of diffSentences with old Safari versions. This was broken in 8.0.0 by the introduction of a regex with a lookbehind assertion; these weren't supported in Safari prior to version 16.4.

#612 Improved tree shakeability by marking the built CJS and ESM packages with sideEffects: false.

8.0.1

#610 Fixes types for diffJson which were broken by 8.0.0. The new bundled types in 8.0.0 only allowed diffJson to be passed string arguments, but it should've been possible to pass either strings or objects (and now is). Thanks to Josh Kelley for the fix.

8.0.0

#580 Multiple tweaks to diffSentences:

tokenization no longer takes quadratic time on pathological inputs (reported as a ReDOS vulnerability by Snyk); is now linear instead

the final sentence in the string is now handled the same by the tokenizer regardless of whether it has a trailing punctuation mark or not. (Previously, "foo. bar." tokenized to ["foo.", " ", "bar."] but "foo. bar" tokenized to ["foo.", " bar"] - i.e. whether the space between sentences was treated as a separate token depended upon whether the final sentence had trailing punctuation or not. This was arbitrary and surprising; it is no longer the case.)

in a string that starts with a sentence end, like "! hello.", the "!" is now treated as a separate sentence

the README now correctly documents the tokenization behaviour (it was wrong before)

#581 - fixed some regex operations used for tokenization in diffWords taking O(n^2) time in pathological cases

#595 - fixed a crash in patch creation functions when handling a single hunk consisting of a very large number (e.g. >130k) of lines. (This was caused by spreading indefinitely-large arrays to .push() using .apply or the spread operator and hitting the JS-implementation-specific limit on the maximum number of arguments to a function, as shown at https://stackoverflow.com/a/56809779/1709587; thus the exact threshold to hit the error will depend on the environment in which you were running JsDiff.)

#596 - removed the merge function. Previously JsDiff included an undocumented function called merge that was meant to, in some sense, merge patches. It had at least a couple of serious bugs that could lead to it returning unambiguously wrong results, and it was difficult to simply "fix" because it was unclear precisely what it was meant to do. For now, the fix is to remove it entirely.

#591 - JsDiff's source code has been rewritten in TypeScript. This change entails the following changes for end users:

the diff package on npm now includes its own TypeScript type definitions. Users who previously used the @types/diff npm package from DefinitelyTyped should remove that dependency when upgrading JsDiff to v8.

Note that the transition from the DefinitelyTyped types to JsDiff's own type definitions includes multiple fixes and also removes many exported types previously used for options arguments to diffing and patch-generation functions. (There are now different exported options types for abortable calls - ones with a timeout or maxEditLength that may give a result of undefined - and non-abortable calls.) See the TypeScript section of the README for some usage tips.

The Diff object is now a class. Custom extensions of Diff, as described in the "Defining custom diffing behaviors" section of the README, can therefore now be done by writing a class CustomDiff extends Diff and overriding methods, instead of the old way based on prototype inheritance. (I think code that did things the old way should still work, though!)

diff/lib/index.es6.js and diff/lib/index.mjs no longer exist, and the ESM version of the library is no longer bundled into a single file.

The ignoreWhitespace option for diffWords is no longer included in the type declarations. The effect of passing ignoreWhitespace: true has always been to make diffWords just call diffWordsWithSpace instead, which was confusing, because that behaviour doesn't seem properly described as "ignoring" whitespace at all. The property remains available to non-TypeScript applications for the sake of backwards compatibility, but TypeScript applications will now see a type error if they try to pass ignoreWhitespace: true to diffWords and should change their code to call diffWordsWithSpace instead.

JsDiff no longer purports to support ES3 environments. (I'm pretty sure it never truly did, despite claiming to in its README, since even the 1.0.0 release used Array.map which was added in ES5.)

#601 - diffJson's stringifyReplacer option behaves more like JSON.stringify's replacer argument now. In particular:

Each key/value pair now gets passed through the replacer once instead of twice

The key passed to the replacer when the top-level object is passed in as value is now "" (previously, was undefined), and the key passed with an array element is the array index as a string, like "0" or "1" (previously was whatever the key for the entire array was). Both the new behaviours match that of JSON.stringify.

#602 - diffing functions now consistently return undefined when called in async mode (i.e. with a callback). Previously, there was an odd quirk where they would return true if the strings being diffed were equal and undefined otherwise.

7.0.0

Just a single (breaking) bugfix, undoing a behaviour change introduced accidentally in 6.0.0:

#554 diffWords treats numbers and underscores as word characters again. This behaviour was broken in v6.0.0.

... (truncated)

Commits

b7b6339 v5.2.2
b5377ab Update package version to 5.2.1
7801789 Backport kpdecker/jsdiff#649
042a837 Backport kpdecker/jsdiff#647
See full diff in compare view

Updates qs from 6.14.0 to 6.14.1

Changelog

Sourced from qs's changelog.

6.14.1

[Fix] ensure arrayLength applies to [] notation as well

[Fix] parse: when a custom decoder returns null for a key, ignore that key

[Refactor] parse: extract key segment splitting helper

[meta] add threat model

[actions] add workflow permissions

[Tests] stringify: increase coverage

[Dev Deps] update eslint, @ljharb/eslint-config, npmignore, es-value-fixtures, for-each, object-inspect

Commits

3fa11a5 v6.14.1
a626704 [Dev Deps] update npmignore
3086902 [Fix] ensure arrayLength applies to [] notation as well
fc7930e [Dev Deps] update eslint, @ljharb/eslint-config
0b06aac [Dev Deps] update @ljharb/eslint-config
64951f6 [Refactor] parse: extract key segment splitting helper
e1bd259 [Dev Deps] update @ljharb/eslint-config
f4b3d39 [eslint] add eslint 9 optional peer dep
6e94d95 [Dev Deps] update eslint, @ljharb/eslint-config, npmignore
973dc3c [actions] add workflow permissions
Additional commits viewable in compare view

Updates react-router from 7.9.4 to 7.12.0

Release notes

Sourced from react-router's releases.

v7.12.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7120

v7.11.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7110

v7.10.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7101

v7.10.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7100

v7.9.6

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v796

v7.9.5

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v795

v7.9.4

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v794

v7.9.3

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v793

v7.9.2

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v792

v7.9.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v791

v7.9.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v790

v7.8.2

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v782

v7.8.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v781

v7.8.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v780

v7.7.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v771

v7.7.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v770

v7.6.3

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v763

... (truncated)

Changelog

Sourced from react-router's changelog.

7.12.0

Minor Changes

Add additional layer of CSRF protection by rejecting submissions to UI routes from external origins. If you need to permit access to specific external origins, you can specify them in the react-router.config.ts config allowedActionOrigins field. (#14708)

Patch Changes

Fix generatePath when used with suffixed params (i.e., "/books/:id.json") (#14269)

Export UNSAFE_createMemoryHistory and UNSAFE_createHashHistory alongside UNSAFE_createBrowserHistory for consistency. These are not intended to be used for new apps but intended to help apps usiong unstable_HistoryRouter migrate from v6->v7 so they can adopt the newer APIs. (#14663)

Escape HTML in scroll restoration keys (#14705)

Validate redirect locations (#14706)

[UNSTABLE] Pass <Scripts nonce> value through to the underlying importmap script tag when using future.unstable_subResourceIntegrity (#14675)

[UNSTABLE] Add a new future.unstable_trailingSlashAwareDataRequests flag to provide consistent behavior of request.pathname inside middleware, loader, and action functions on document and data requests when a trailing slash is present in the browser URL. (#14644)

Currently, your HTTP and request pathnames would be as follows for /a/b/c and /a/b/c/

URL /a/b/c HTTP pathname request pathname`

Document /a/b/c /a/b/c ✅

Data /a/b/c.data /a/b/c ✅

URL /a/b/c/ HTTP pathname request pathname`

Document /a/b/c/ /a/b/c/ ✅

Data /a/b/c.data /a/b/c ⚠️

With this flag enabled, these pathnames will be made consistent though a new _.data format for client-side .data requests:

URL /a/b/c HTTP pathname request pathname`

Document /a/b/c /a/b/c ✅

Data /a/b/c.data /a/b/c ✅

URL /a/b/c/ HTTP pathname request pathname`

Document /a/b/c/ /a/b/c/ ✅

Data /a/b/c/_.data ⬅️ /a/b/c/ ✅

This a bug fix but we are putting it behind an opt-in flag because it has the potential to be a "breaking bug fix" if you are relying on the URL format for any other application or caching logic.

Enabling this flag also changes the format of client side .data requests from /_root.data to /_.data when navigating to / to align with the new format. This does not impact the request pathname which is still / in all cases.

Preserve clientLoader.hydrate=true when using <HydratedRouter unstable_instrumentations> (#14674)

... (truncated)

Commits

26653a6 chore: Update version for release (#14712)
7ac2346 chore: Update version for release (pre) (#14709)
75b1ef5 Add origin checks for UI route submissions (#14708)
c05ef93 Validate redirect locations (#14706)
c89c32c Escape HTML in scroll restoration keys (#14705)
cbcbf30 fix: pass nonce to importmap script when using subResourceIntegrity (#14675)
30f6c1d fix(react-router): handle parameters with static suffixes in generatePath (#1...
7f140e0 Handle data requests with trailing slash consistently (#14644)
1954af6 Preserve hydrate property on client loaders during instrumentation (#14674)
5ce5cd4 chore: format
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for react-router since your current version.

Updates undici from 7.16.0 to 7.18.2

Release notes

Sourced from undici's releases.

v7.18.2

⚠️ Security Release

This fixes GHSA-g9mf-h72j-4rw9 and CVE-2026-22036.

What's Changed

fix(decompress): limit Content-Encoding chain to 5 to prevent resourc… by @mcollina in nodejs/undici#4729

Full Changelog: nodejs/undici@v7.18.1...v7.18.2

v7.18.1

What's Changed

Test and Fix running without SSL by @mcollina in nodejs/undici#4727

docs: add security warning for strictContentLength option by @mcollina in nodejs/undici#4726

build(deps): bump step-security/harden-runner from 2.13.1 to 2.14.0 by @dependabot[bot] in nodejs/undici#4718

build(deps): bump actions/checkout from 6.0.0 to 6.0.1 by @dependabot[bot] in nodejs/undici#4719

Full Changelog: nodejs/undici@v7.18.0...v7.18.1

v7.18.0

What's Changed

Full Changelog: nodejs/undici@v7.17.0...v7.18.0

v7.17.0

What's Changed

chore: extract infra and encoding methods by @Uzlopak in nodejs/undici#4523

ci: remove h2 by @Uzlopak in nodejs/undici#4534

ci: make nodejs-shared wf reusable, install binaryen for wasm-opt, test on node-nightly by @Uzlopak in nodejs/undici#4535

ci: fix nightly shared library case by @Uzlopak in nodejs/undici#4543

test: consume bodies of fetch responses to fix failing macos 20 ci by @Uzlopak in nodejs/undici#4528

docs: add Cache Interceptor example to README by @tawseefnabi in nodejs/undici#4393

test: remove node20 version check by @Uzlopak in nodejs/undici#4544

types: use MessagePort instance type in MessageEvent by @Renegade334 in nodejs/undici#4546

ci: set write permissions on job level by @Uzlopak in nodejs/undici#4537

lint: activate n/no-process-exit by @Uzlopak in nodejs/undici#4548

ci: run benchmarks on pull_requests and by pushing on specific branches only by @Uzlopak in nodejs/undici#4536

chore: activate n/prefer-node-protocol to enforce 'node:' prefix for requiring node built-ins by @Uzlopak in nodejs/undici#4547

feat(H2): correct CONNECT behaviour by @metcoder95 in nodejs/undici#4541

test: fix plans by @Uzlopak in nodejs/undici#4550

feat: add runtime feature "detection" by @Uzlopak in nodejs/undici#4545

perf: use less promises in extractBody by @Uzlopak in nodejs/undici#4458

fix(proxy-agent): add missing return after callback-call by @Uzlopak in nodejs/undici#4553

fix: remove redundant line in retry-handler by @Uzlopak in nodejs/undici#4554

ci: add no-wasm-simd option by @Uzlopak in nodejs/undici#4533

fix: use lazyloaders for runtime feature detection by @Uzlopak in nodejs/undici#4557

fix: minor changes in dispatcher-base.js and types for Dispatcher by @Uzlopak in nodejs/undici#4556

... (truncated)

Commits

7e5cb2d Bumped v7.18.2 (#4730)
b04e3cb fix(decompress): limit Content-Encoding chain to 5 to prevent resource exhaus...
2bcb77b Bumped v7.18.1 (#4728)
58a12b7 build(deps): bump actions/checkout from 6.0.0 to 6.0.1 (#4719)
5fa2930 build(deps): bump step-security/harden-runner from 2.13.1 to 2.14.0 (#4718)
fbbe283 docs: add security warning for strictContentLength option (#4726)

…1 updates Bumps the npm_and_yarn group with 2 updates in the /features/CyberChef directory: [diff](https://github.com/kpdecker/jsdiff) and [qs](https://github.com/ljharb/qs). Bumps the npm_and_yarn group with 1 update in the /features/Nemesis/projects/frontend directory: [react-router](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router). Bumps the npm_and_yarn group with 4 updates in the /features/actual directory: [diff](https://github.com/kpdecker/jsdiff), [qs](https://github.com/ljharb/qs), [react-router](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router) and [undici](https://github.com/nodejs/undici). Bumps the npm_and_yarn group with 1 update in the /features/actual/packages/desktop-client directory: [react-router](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router). Bumps the npm_and_yarn group with 1 update in the /features/dispatch/docs directory: [qs](https://github.com/ljharb/qs). Bumps the npm_and_yarn group with 2 updates in the /features/firecrawl-mcp-server directory: [qs](https://github.com/ljharb/qs) and [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk). Bumps the npm_and_yarn group with 1 update in the /features/firecrawl/apps/api directory: [undici](https://github.com/nodejs/undici). Bumps the npm_and_yarn group with 1 update in the /features/firecrawl/apps/js-sdk directory: [diff](https://github.com/kpdecker/jsdiff). Bumps the npm_and_yarn group with 1 update in the /features/firecrawl/apps/playwright-service-ts directory: [diff](https://github.com/kpdecker/jsdiff). Bumps the npm_and_yarn group with 4 updates in the /features/firecrawl/apps/test-suite directory: [diff](https://github.com/kpdecker/jsdiff), [qs](https://github.com/ljharb/qs), [undici](https://github.com/nodejs/undici) and [@smithy/config-resolver](https://github.com/smithy-lang/smithy-typescript/tree/HEAD/packages/config-resolver). Bumps the npm_and_yarn group with 1 update in the /features/goose/documentation directory: [qs](https://github.com/ljharb/qs). Bumps the npm_and_yarn group with 4 updates in the /features/goose/ui/desktop directory: [qs](https://github.com/ljharb/qs), [react-router](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router), [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) and [devalue](https://github.com/sveltejs/devalue). Bumps the npm_and_yarn group with 3 updates in the /features/inspector directory: [diff](https://github.com/kpdecker/jsdiff), [qs](https://github.com/ljharb/qs) and [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk). Bumps the npm_and_yarn group with 1 update in the /features/mcp-virustotal directory: [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk). Bumps the npm_and_yarn group with 4 updates in the /features/mealie/frontend directory: [diff](https://github.com/kpdecker/jsdiff), [tar](https://github.com/isaacs/node-tar), [h3](https://github.com/h3js/h3) and [devalue](https://github.com/sveltejs/devalue). Bumps the npm_and_yarn group with 5 updates in the /features/n8n directory: | Package | From | To | | --- | --- | --- | | [qs](https://github.com/ljharb/qs) | `6.11.0` | `6.14.1` | | [undici](https://github.com/nodejs/undici) | `6.21.3` | `6.23.0` | | [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.15.1` | `1.25.2` | | [nodemailer](https://github.com/nodemailer/nodemailer) | `6.9.9` | `7.0.11` | | [@langchain/core](https://github.com/langchain-ai/langchainjs) | `0.3.68` | `0.3.80` | Bumps the npm_and_yarn group with 1 update in the /features/n8n-mcp-server directory: [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk). Bumps the npm_and_yarn group with 1 update in the /features/n8n/packages/@n8n/nodes-langchain directory: [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk). Bumps the npm_and_yarn group with 1 update in the /features/n8n/packages/cli directory: [nodemailer](https://github.com/nodemailer/nodemailer). Bumps the npm_and_yarn group with 1 update in the /features/n8n/packages/core directory: [qs](https://github.com/ljharb/qs). Bumps the npm_and_yarn group with 4 updates in the /tests/productivity/firecrawl/test-suite directory: [diff](https://github.com/kpdecker/jsdiff), [qs](https://github.com/ljharb/qs), [undici](https://github.com/nodejs/undici) and [@smithy/config-resolver](https://github.com/smithy-lang/smithy-typescript/tree/HEAD/packages/config-resolver). Updates `diff` from 5.2.0 to 5.2.2 - [Changelog](https://github.com/kpdecker/jsdiff/blob/master/release-notes.md) - [Commits](kpdecker/jsdiff@v5.2.0...v5.2.2) Updates `qs` from 6.14.0 to 6.14.1 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.14.0...v6.14.1) Updates `react-router` from 7.6.1 to 7.12.0 - [Release notes](https://github.com/remix-run/react-router/releases) - [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router/CHANGELOG.md) - [Commits](https://github.com/remix-run/react-router/commits/react-router@7.12.0/packages/react-router) Updates `diff` from 4.0.2 to 4.0.4 - [Changelog](https://github.com/kpdecker/jsdiff/blob/master/release-notes.md) - [Commits](kpdecker/jsdiff@v5.2.0...v5.2.2) Updates `qs` from 6.14.0 to 6.14.1 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.14.0...v6.14.1) Updates `react-router` from 7.9.4 to 7.12.0 - [Release notes](https://github.com/remix-run/react-router/releases) - [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router/CHANGELOG.md) - [Commits](https://github.com/remix-run/react-router/commits/react-router@7.12.0/packages/react-router) Updates `undici` from 7.16.0 to 7.18.2 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.16.0...v7.18.2) Updates `react-router` from 7.9.4 to 7.12.0 - [Release notes](https://github.com/remix-run/react-router/releases) - [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router/CHANGELOG.md) - [Commits](https://github.com/remix-run/react-router/commits/react-router@7.12.0/packages/react-router) Updates `qs` from 6.13.0 to 6.14.1 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.14.0...v6.14.1) Updates `qs` from 6.14.0 to 6.14.1 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.14.0...v6.14.1) Updates `@modelcontextprotocol/sdk` from 1.18.0 to 1.25.3 - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases) - [Commits](modelcontextprotocol/typescript-sdk@1.18.0...v1.25.3) Updates `undici` from 7.10.0 to 7.18.2 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.16.0...v7.18.2) Updates `diff` from 4.0.2 to 4.0.4 - [Changelog](https://github.com/kpdecker/jsdiff/blob/master/release-notes.md) - [Commits](kpdecker/jsdiff@v5.2.0...v5.2.2) Updates `diff` from 4.0.2 to 4.0.4 - [Changelog](https://github.com/kpdecker/jsdiff/blob/master/release-notes.md) - [Commits](kpdecker/jsdiff@v5.2.0...v5.2.2) Updates `diff` from 4.0.2 to 4.0.4 - [Changelog](https://github.com/kpdecker/jsdiff/blob/master/release-notes.md) - [Commits](kpdecker/jsdiff@v5.2.0...v5.2.2) Updates `qs` from 6.12.1 to 6.14.1 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.14.0...v6.14.1) Updates `undici` from 7.12.0 to 7.18.2 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.16.0...v7.18.2) Updates `@smithy/config-resolver` from 3.0.5 to 3.0.13 - [Release notes](https://github.com/smithy-lang/smithy-typescript/releases) - [Changelog](https://github.com/smithy-lang/smithy-typescript/blob/main/packages/config-resolver/CHANGELOG.md) - [Commits](https://github.com/smithy-lang/smithy-typescript/commits/@smithy/config-resolver@3.0.13/packages/config-resolver) Updates `qs` from 6.13.0 to 6.14.1 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.14.0...v6.14.1) Updates `qs` from 6.14.0 to 6.14.1 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.14.0...v6.14.1) Updates `react-router` from 7.9.3 to 7.12.0 - [Release notes](https://github.com/remix-run/react-router/releases) - [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router/CHANGELOG.md) - [Commits](https://github.com/remix-run/react-router/commits/react-router@7.12.0/packages/react-router) Updates `@modelcontextprotocol/sdk` from 1.19.1 to 1.25.3 - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases) - [Commits](modelcontextprotocol/typescript-sdk@1.18.0...v1.25.3) Updates `devalue` from 5.3.2 to 5.6.2 - [Release notes](https://github.com/sveltejs/devalue/releases) - [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md) - [Commits](sveltejs/devalue@v5.3.2...v5.6.2) Updates `diff` from 4.0.2 to 4.0.4 - [Changelog](https://github.com/kpdecker/jsdiff/blob/master/release-notes.md) - [Commits](kpdecker/jsdiff@v5.2.0...v5.2.2) Updates `qs` from 6.14.0 to 6.14.1 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.14.0...v6.14.1) Updates `@modelcontextprotocol/sdk` from 1.18.0 to 1.25.2 - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases) - [Commits](modelcontextprotocol/typescript-sdk@1.18.0...v1.25.3) Updates `@modelcontextprotocol/sdk` from 1.0.3 to 1.25.2 - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases) - [Commits](modelcontextprotocol/typescript-sdk@1.18.0...v1.25.3) Updates `diff` from 8.0.2 to 8.0.3 - [Changelog](https://github.com/kpdecker/jsdiff/blob/master/release-notes.md) - [Commits](kpdecker/jsdiff@v5.2.0...v5.2.2) Updates `tar` from 7.5.1 to 7.5.6 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v7.5.1...v7.5.6) Updates `h3` from 1.15.4 to 1.15.5 - [Release notes](https://github.com/h3js/h3/releases) - [Changelog](https://github.com/h3js/h3/blob/v1.15.5/CHANGELOG.md) - [Commits](h3js/h3@v1.15.4...v1.15.5) Updates `devalue` from 5.3.2 to 5.6.2 - [Release notes](https://github.com/sveltejs/devalue/releases) - [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md) - [Commits](sveltejs/devalue@v5.3.2...v5.6.2) Updates `qs` from 6.11.0 to 6.14.1 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.14.0...v6.14.1) Updates `undici` from 6.21.3 to 6.23.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.16.0...v7.18.2) Updates `@modelcontextprotocol/sdk` from 1.15.1 to 1.25.2 - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases) - [Commits](modelcontextprotocol/typescript-sdk@1.18.0...v1.25.3) Updates `nodemailer` from 6.9.9 to 7.0.11 - [Release notes](https://github.com/nodemailer/nodemailer/releases) - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](nodemailer/nodemailer@v6.9.9...v7.0.11) Updates `@langchain/core` from 0.3.68 to 0.3.80 - [Release notes](https://github.com/langchain-ai/langchainjs/releases) - [Commits](https://github.com/langchain-ai/langchainjs/commits) Updates `@modelcontextprotocol/sdk` from 0.7.0 to 1.25.2 - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases) - [Commits](modelcontextprotocol/typescript-sdk@1.18.0...v1.25.3) Updates `@modelcontextprotocol/sdk` from 1.15.1 to 1.25.2 - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases) - [Commits](modelcontextprotocol/typescript-sdk@1.18.0...v1.25.3) Updates `nodemailer` from 6.9.9 to 7.0.11 - [Release notes](https://github.com/nodemailer/nodemailer/releases) - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](nodemailer/nodemailer@v6.9.9...v7.0.11) Updates `qs` from 6.11.0 to 6.14.1 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.14.0...v6.14.1) Updates `diff` from 4.0.2 to 4.0.4 - [Changelog](https://github.com/kpdecker/jsdiff/blob/master/release-notes.md) - [Commits](kpdecker/jsdiff@v5.2.0...v5.2.2) Updates `qs` from 6.12.1 to 6.14.1 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.14.0...v6.14.1) Updates `undici` from 7.12.0 to 7.18.2 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.16.0...v7.18.2) Updates `@smithy/config-resolver` from 3.0.5 to 3.0.13 - [Release notes](https://github.com/smithy-lang/smithy-typescript/releases) - [Changelog](https://github.com/smithy-lang/smithy-typescript/blob/main/packages/config-resolver/CHANGELOG.md) - [Commits](https://github.com/smithy-lang/smithy-typescript/commits/@smithy/config-resolver@3.0.13/packages/config-resolver) --- updated-dependencies: - dependency-name: diff dependency-version: 5.2.2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.14.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: react-router dependency-version: 7.12.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: diff dependency-version: 4.0.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.14.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: react-router dependency-version: 7.12.0 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 7.18.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: react-router dependency-version: 7.12.0 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.14.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.14.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@modelcontextprotocol/sdk" dependency-version: 1.25.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 7.18.2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: diff dependency-version: 4.0.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: diff dependency-version: 4.0.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: diff dependency-version: 4.0.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.14.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 7.18.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@smithy/config-resolver" dependency-version: 3.0.13 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.14.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.14.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: react-router dependency-version: 7.12.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@modelcontextprotocol/sdk" dependency-version: 1.25.3 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: devalue dependency-version: 5.6.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: diff dependency-version: 4.0.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.14.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@modelcontextprotocol/sdk" dependency-version: 1.25.2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@modelcontextprotocol/sdk" dependency-version: 1.25.2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: diff dependency-version: 8.0.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tar dependency-version: 7.5.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: h3 dependency-version: 1.15.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: devalue dependency-version: 5.6.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.14.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 6.23.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@modelcontextprotocol/sdk" dependency-version: 1.25.2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: nodemailer dependency-version: 7.0.11 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@langchain/core" dependency-version: 0.3.80 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@modelcontextprotocol/sdk" dependency-version: 1.25.2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@modelcontextprotocol/sdk" dependency-version: 1.25.2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: nodemailer dependency-version: 7.0.11 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.14.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: diff dependency-version: 4.0.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.14.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 7.18.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@smithy/config-resolver" dependency-version: 3.0.13 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jan 21, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the npm_and_yarn group across 21 directories with 11 updates#109

chore(deps): bump the npm_and_yarn group across 21 directories with 11 updates#109
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/features/CyberChef/npm_and_yarn-9ec3ca9adf

dependabot Bot commented on behalf of github Jan 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

URL `/a/b/c`	HTTP pathname	`request` pathname`
Document	`/a/b/c`	`/a/b/c` ✅
Data	`/a/b/c.data`	`/a/b/c` ✅

URL `/a/b/c/`	HTTP pathname	`request` pathname`
Document	`/a/b/c/`	`/a/b/c/` ✅
Data	`/a/b/c.data`	`/a/b/c` ⚠️

Conversation

dependabot Bot commented on behalf of github Jan 21, 2026

Release Notes

8.0.3

8.0.2

8.0.1

8.0.0

7.0.0

6.14.1

v7.12.0

v7.11.0

v7.10.1

v7.10.0

v7.9.6

v7.9.5

v7.9.4

v7.9.3

v7.9.2

v7.9.1

v7.9.0

v7.8.2

v7.8.1

v7.8.0

v7.7.1

v7.7.0

v7.6.3

7.12.0

Minor Changes

Patch Changes

Release Notes

8.0.3

8.0.2

8.0.1

8.0.0

7.0.0

6.14.1

v7.12.0

v7.11.0

v7.10.1

v7.10.0

v7.9.6

v7.9.5

v7.9.4

v7.9.3

v7.9.2

v7.9.1

v7.9.0

v7.8.2

v7.8.1

v7.8.0

v7.7.1

v7.7.0

v7.6.3

7.12.0

Minor Changes

Patch Changes

v7.18.2

⚠️ Security Release

What's Changed

v7.18.1

What's Changed

v7.18.0

What's Changed

v7.17.0

What's Changed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants