chore(deps): bump the npm_and_yarn group across 1 directory with 23 updates #1

dependabot · 2026-01-22T14:03:40Z

Bumps the npm_and_yarn group with 22 updates in the / directory:

Package	From	To
zx	`7.2.3`	`8.8.5`
electron-updater	`6.1.8`	`6.3.0`
electron	`27.0.3`	`35.7.5`
ws	`8.16.0`	`8.17.1`
@babel/helpers	`7.23.8`	`7.28.6`
axios	`1.6.5`	`1.13.2`
cipher-base	`1.0.4`	`1.0.7`
diff	`4.0.2`	`4.0.4`
express	`4.18.2`	`4.22.1`
fast-loops	`1.1.3`	`1.1.4`
follow-redirects	`1.15.5`	`1.15.11`
form-data	`3.0.1`	`3.0.4`
image-size	`1.1.1`	`1.2.1`
js-yaml	`3.14.1`	`3.14.2`
lodash	`4.17.21`	`4.17.23`
min-document	`2.19.0`	`2.19.2`
nanoid	`3.3.7`	`3.3.11`
pbkdf2	`3.1.2`	`3.1.5`
serve-static	`1.15.0`	`1.16.3`
sha.js	`2.4.11`	`2.4.12`
store2	`2.14.2`	`2.14.4`
tar	`6.2.0`	`6.2.1`

Updates zx from 7.2.3 to 8.8.5

Release notes

Sourced from zx's releases.

8.8.5 — Temporary Reservoir

This release fixes the issue, when zx flushes external node_modules on linking #1348 #1349 #1355

Also globby@15.0.0 arrives here.

8.8.4 — Flange Coupling

It's time. This release updates zx internals to make the ps API and related methods ProcessPromise.kill(), kill() work on Windows systems without wmic. #1344 webpod/ps#15

WMIC will be missing in Windows 11 25H2 (kernel >= 26000)

The windows-latest label in GitHub Actions will migrate from Windows Server 2022 to Windows Server 2025 beginning September 2, 2025 and finishing by September 30, 2025.

https://github.blog/changelog/2025-07-31-github-actions-new-apis-and-windows-latest-migration-notice/#windows-latest-image-label-migration

8.8.3 — Sealing Gasket

Continues #1339 to prevent injections via Proxy input or custom toString() manipulations.

8.8.2 — Leaking Valve

Fixes potential cmd injection via kill() method for Windows platform. #1337 #1339. Affects the versions range 8.7.1...8.8.1.

8.8.1 — Turbo Flush

We keep improving the projects internal infra to bring more stability, safety and performance for artifacts.

Featfixes

Applied flags filtration for CLI-driven deps install #1308

Added kill() event logging #1312

Set SIGTERM as kill() fallback signal #1313

Allowed stdio() arg be an array #1311
const p = $({halt: true})`cmd`
p.stdio([stream, 'ignore', 'pipe'])
Enhancements

Added check for zx@lite pkg contents #1317 #1316

Simplified ProcessPromise[asyncIterator] inners #1307

Updated deps: chalk 5.6.0, fs-extra 11.3.1, yaml 2.8.1 #1309 #1323 #1326

Added TS@next to the test matrix #1310

Optimized internal shell setters #1314

Refactored build-publish pipelines and scripts #1319 #1320 #1321 #1322 #1324 #1325 #1327

8.8.0 — Pressure Tested

This release enhances the coherence between the ProcessPromise and the Streams API, eliminating the need for certain script-level workarounds.

✨ New Features

unpipe() — Selectively stop piping

You can now call .unpipe() to stop data transfer from a source to a destination without closing any of the pair. #1302
</tr></table> 

... (truncated)

Commits

1ca9270 chore: pr template formatting (#1359)
52b01a1 chore: update pr template (#1358)
70ecf23 chore: update issue templates (#1357)
8b08fc0 chore: bump version to 8.8.5 (#1356)
6045c34 chore: update globby to v15 (#1354)
a4d1bc2 fix: checks node_modules ref on linking (#1355)
9ef6d3c fix(cli): prevent external node_modules deletion with --prefer-local (#1349)
cc2a4f7 ci: update zizmor to v1.15.1 (#1353)
b47a5f0 ci: refactor smoke tests naming (#1352)
1fb8c9f ci: update gh actions (#1351)
Additional commits viewable in compare view

Updates electron-updater from 6.1.8 to 6.3.0

Release notes

Sourced from electron-updater's releases.

electron-updater@6.3.0

Minor Changes

#8095 53cec79b Thanks @beyondkmp! - feat: adding differential downloader for updates on macOS

Patch Changes

#8108 3d4cc7ae Thanks @beyondkmp! - feat: add minimumSystemVersion in electron updater

#8304 1ac86c9e Thanks @mmaietta! - chore: update pnpm to 9.4.0

#8323 fa3275c0 Thanks @mmaietta! - chore(deps): update dependency typescript to v5.5.3

#8135 c2392de7 Thanks @mmaietta! - fix: unstable hdiutil retry mechanism

#8295 ac2e6a25 Thanks @mmaietta! - fix: verify LiteralPath of update file during windows signature verification

#8311 35a0784e Thanks @rastiqdev! - fix(rpm-updater): stop uninstalling app before update

#8227 48c59535 Thanks @rotu! - fix(docs): update autoupdate docs noting that channels work with Github

#8110 fa7982f1 Thanks @mmaietta! - chore: entering alpha release stage

Updated dependencies [3d4cc7ae, 1ac86c9e, ad668ae1, 445911a7, 140e2f0e, fa7982f1]:

builder-util-runtime@9.2.5

electron-updater@6.3.0-alpha.8

Patch Changes

#8323 fa3275c0 Thanks @mmaietta! - chore(deps): update dependency typescript to v5.5.3

#8311 35a0784e Thanks @rastiqdev! - fix(rpm-updater): stop uninstalling app before update

electron-updater@6.3.0-alpha.7

Patch Changes

#8304 1ac86c9e Thanks @mmaietta! - chore: update pnpm to 9.4.0

Updated dependencies [1ac86c9e, ad668ae1]:

builder-util-runtime@9.2.5-alpha.4

electron-updater@6.3.0-alpha.6

Patch Changes

#8295 ac2e6a25 Thanks @mmaietta! - fix: verify LiteralPath of update file during windows signature verification

electron-updater@6.3.0-alpha.5

Patch Changes

Updated dependencies [140e2f0e]:

... (truncated)

Changelog

Sourced from electron-updater's changelog.

6.3.0

Minor Changes

#8095 53cec79b Thanks @beyondkmp! - feat: adding differential downloader for updates on macOS

Patch Changes

#8108 3d4cc7ae Thanks @beyondkmp! - feat: add minimumSystemVersion in electron updater

#8304 1ac86c9e Thanks @mmaietta! - chore: update pnpm to 9.4.0

#8323 fa3275c0 Thanks @mmaietta! - chore(deps): update dependency typescript to v5.5.3

#8135 c2392de7 Thanks @mmaietta! - fix: unstable hdiutil retry mechanism

#8295 ac2e6a25 Thanks @mmaietta! - fix: verify LiteralPath of update file during windows signature verification

#8311 35a0784e Thanks @rastiqdev! - fix(rpm-updater): stop uninstalling app before update

#8227 48c59535 Thanks @rotu! - fix(docs): update autoupdate docs noting that channels work with Github

#8110 fa7982f1 Thanks @mmaietta! - chore: entering alpha release stage

Updated dependencies [3d4cc7ae, 1ac86c9e, ad668ae1, 445911a7, 140e2f0e, fa7982f1]:

builder-util-runtime@9.2.5

6.3.0-alpha.8

Patch Changes

#8323 fa3275c0 Thanks @mmaietta! - chore(deps): update dependency typescript to v5.5.3

#8311 35a0784e Thanks @rastiqdev! - fix(rpm-updater): stop uninstalling app before update

6.3.0-alpha.7

Patch Changes

#8304 1ac86c9e Thanks @mmaietta! - chore: update pnpm to 9.4.0

Updated dependencies [1ac86c9e, ad668ae1]:

builder-util-runtime@9.2.5-alpha.4

6.3.0-alpha.6

Patch Changes

#8295 ac2e6a25 Thanks @mmaietta! - fix: verify LiteralPath of update file during windows signature verification

... (truncated)

Commits

bfe4ecc chore(deploy): Release v25.0.0 (electron-updater@6.3.0) (#8337)
1320c0e chore(deploy): Release v25.0.0-alpha.13 (electron-updater@6.3.0-alpha.8) (alp...
fa3275c chore(deps): update dependency typescript to v5.5.3 (#8323)
35a0784 fix(rpm-updater): stop uninstalling app before update (#8311)
dd145d6 chore(deploy): Release v25.0.0-alpha.12 (electron-updater@6.3.0-alpha.7) (alp...
2b80b01 chore(deploy): Release v25.0.0-alpha.11 (electron-updater@6.3.0-alpha.6) (alp...
ac2e6a2 fix: verify LiteralPath of update file during windows signature verification ...
5e924c2 chore(deploy): Release v25.0.0-alpha.10 (electron-updater@6.3.0-alpha.5) (alp...
29f6504 chore(deploy): Release v25.0.0-alpha.9 (alpha) (#8241)
48c5953 fix(docs): update autoupdate docs noting that channels work with Github (#8...
Additional commits viewable in compare view

Updates electron from 27.0.3 to 35.7.5

Release notes

Sourced from electron's releases.

electron v35.7.5

Release Notes for v35.7.5

[!WARNING] Electron 35.x.y has reached end-of-support as per the project's support policy. Developers and applications are encouraged to upgrade to a newer version of Electron.

Fixes

Fixed an issue where shell.openPath was not non-blocking as expected. #48079 (Also in 36, 37, 38)

electron v35.7.4

Release Notes for v35.7.4

Fix ffmpeg generation on Windows non-x64

Commits

86d839a build: correct CHECK syntax (#48106)
5be0be7 fix: ensure snapshot is valid (#48105)
df232d1 ci: cleanup use new arc cluster (#48007)
ab51554 ci: fixup mac runner hang (#47992)
203abdd ci: use new arc cluster (#47913)
ea17e83 build: fix ffmpeg generation on Windows non-x64 (#47845)
7b5d411 build(dev-deps): drop unused @types/webpack dep (#47806)
def6203 build: deep update brace-expansion to resolve an audit alert (#47719)
28d8ed0 test: cleanup RenderFrame lifespan tests (#47795)
ee8942d build: drop eslint-plugin-unicorn (#47690)
Additional commits viewable in compare view

Updates ws from 8.16.0 to 8.17.1

Release notes

Sourced from ws's releases.

8.17.1

Bug fixes

Fixed a DoS vulnerability (#2231).

A request with a number of headers exceeding the[server.maxHeadersCount][] threshold could be used to crash a ws server.
const http = require('http');
const WebSocket = require('ws');
const wss = new WebSocket.Server({ port: 0 }, function () {
const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
const headers = {};
let count = 0;
for (let i = 0; i < chars.length; i++) {
if (count === 2000) break;
for (let j = 0; j &lt; chars.length; j++) {
  const key = chars[i] + chars[j];
  headers[key] = 'x';
if (++count === 2000) break;
}

}
headers.Connection = 'Upgrade';
headers.Upgrade = 'websocket';
headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';
headers['Sec-WebSocket-Version'] = '13';
const request = http.request({
headers: headers,
host: '127.0.0.1',
port: wss.address().port
});
request.end();
});
The vulnerability was reported by Ryan LaPointe in websockets/ws#2230.

In vulnerable versions of ws, the issue can be mitigated in the following ways:

Reduce the maximum allowed length of the request headers using the [--max-http-header-size=size][] and/or the [maxHeaderSize][] options so that no more headers than the server.maxHeadersCount limit can be sent.

... (truncated)

Commits

3c56601 [dist] 8.17.1
e55e510 [security] Fix crash when the Upgrade header cannot be read (#2231)
6a00029 [test] Increase code coverage
ddfe4a8 [perf] Reduce the amount of crypto.randomFillSync() calls
b73b118 [dist] 8.17.0
29694a5 [test] Use the highWaterMark variable
934c9d6 [ci] Test on node 22
1817bac [ci] Do not test on node 21
96c9b3d [major] Flip the default value of allowSynchronousEvents (#2221)
e5f32c7 [fix] Emit at most one event per event loop iteration (#2218)
Additional commits viewable in compare view

Updates @babel/helpers from 7.23.8 to 7.28.6

Release notes

Sourced from @babel/helpers's releases.

v7.28.6 (2026-01-12)

Thanks @kadhirash and @kolvian for your first PRs!

🐛 Bug Fix

babel-cli, babel-code-frame, babel-core, babel-helper-check-duplicate-nodes, babel-helper-fixtures, babel-helper-plugin-utils, babel-node, babel-plugin-transform-flow-comments, babel-plugin-transform-modules-commonjs, babel-plugin-transform-property-mutators, babel-preset-env, babel-traverse, babel-types

#17589 Improve Unicode handling in code-frame tokenizer (@JLHwung)

babel-plugin-transform-regenerator

#17556 fix: transform-regenerator correctly handles scope (@liuxingbaoyu)

babel-plugin-transform-react-jsx

#17538 fix: Keep jsx comments (@liuxingbaoyu)

💅 Polish

babel-core, babel-standalone

#17606 Polish(standalone): improve message on invalid preset/plugin (@JLHwung)

🏠 Internal

babel-plugin-bugfix-v8-static-class-fields-redefine-readonly, babel-plugin-proposal-decorators, babel-plugin-proposal-import-attributes-to-assertions, babel-plugin-proposal-import-wasm-source, babel-plugin-syntax-async-do-expressions, babel-plugin-syntax-decorators, babel-plugin-syntax-destructuring-private, babel-plugin-syntax-do-expressions, babel-plugin-syntax-explicit-resource-management, babel-plugin-syntax-export-default-from, babel-plugin-syntax-flow, babel-plugin-syntax-function-bind, babel-plugin-syntax-function-sent, babel-plugin-syntax-import-assertions, babel-plugin-syntax-import-attributes, babel-plugin-syntax-import-defer, babel-plugin-syntax-import-source, babel-plugin-syntax-jsx, babel-plugin-syntax-module-blocks, babel-plugin-syntax-optional-chaining-assign, babel-plugin-syntax-partial-application, babel-plugin-syntax-pipeline-operator, babel-plugin-syntax-throw-expressions, babel-plugin-syntax-typescript, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-class-properties, babel-plugin-transform-class-static-block, babel-plugin-transform-dotall-regex, babel-plugin-transform-duplicate-named-capturing-groups-regex, babel-plugin-transform-explicit-resource-management, babel-plugin-transform-exponentiation-operator, babel-plugin-transform-json-strings, babel-plugin-transform-logical-assignment-operators, babel-plugin-transform-nullish-coalescing-operator, babel-plugin-transform-numeric-separator, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-catch-binding, babel-plugin-transform-optional-chaining, babel-plugin-transform-private-methods, babel-plugin-transform-private-property-in-object, babel-plugin-transform-regexp-modifiers, babel-plugin-transform-unicode-property-regex, babel-plugin-transform-unicode-sets-regex

#17580 Allow Babel 8 in compatible Babel 7 plugins (@nicolo-ribaudo)

🏃‍♀️ Performance

babel-plugin-transform-react-jsx

#17555 perf: Use lighter traversal for jsx __source,__self (@liuxingbaoyu)

Committers: 7

Babel Bot (@babel-bot)

Eliot Pontarelli (@kolvian)

Huáng Jùnliàng (@JLHwung)

Kadhirash Sivakumar (@kadhirash)

Nicolò Ribaudo (@nicolo-ribaudo)

@liuxingbaoyu

coderaiser (@coderaiser)

v7.28.5 (2025-10-23)

Thank you @CO0Ki3, @Olexandr88, and @youthfulhps for your first PRs!

👓 Spec Compliance

babel-parser

#17446 Allow Runtime Errors for Function Call Assignment Targets (@liuxingbaoyu)

babel-helper-validator-identifier

#17501 fix: update identifier to unicode 17 (@fisker)

🐛 Bug Fix

babel-plugin-proposal-destructuring-private

#17534 Allow mixing private destructuring and rest (@CO0Ki3)

babel-parser

#17521 Improve @babel/parser error typing (@JLHwung)

#17491 fix: improve ts-only declaration parsing (@JLHwung)

babel-plugin-proposal-discard-binding, babel-plugin-transform-destructuring

... (truncated)

Changelog

Sourced from @babel/helpers's changelog.

Changelog

Tags:

💥 [Breaking Change]

👓 [Spec Compliance]

🚀 [New Feature]

🐛 [Bug Fix]

📝 [Documentation]

🏠 [Internal]

💅 [Polish]

Note: Gaps between patch versions are faulty, broken or test releases.

This file contains the changelog starting from v7.15.0.

See CHANGELOG - v7.0.0 to v7.14.9 for v7.0.0 to v7.14.9 changes.

See CHANGELOG - v7 prereleases for v7.0.0-alpha.1 to v7.0.0-rc.4 changes.

See CHANGELOG - v4, CHANGELOG - v5, and CHANGELOG - v6 for v4.x-v6.x changes.

See CHANGELOG - 6to5 for the pre-4.0.0 version changelog.

See Babylon's CHANGELOG for the Babylon pre-7.0.0-beta.29 version changelog.

See babel-eslint's releases for the changelog before @babel/eslint-parser 7.8.0.

See eslint-plugin-babel's releases for the changelog before @babel/eslint-plugin 7.8.0.

v7.28.5 (2025-10-23)

👓 Spec Compliance

babel-parser

#17446 Allow Runtime Errors for Function Call Assignment Targets (@liuxingbaoyu)

babel-helper-validator-identifier

#17501 fix: update identifier to unicode 17 (@fisker)

🐛 Bug Fix

babel-plugin-proposal-destructuring-private

#17534 Allow mixing private destructuring and rest (@CO0Ki3)

babel-parser

#17521 Improve @babel/parser error typing (@JLHwung)

#17491 fix: improve ts-only declaration parsing (@JLHwung)

babel-plugin-proposal-discard-binding, babel-plugin-transform-destructuring

#17519 fix: rest correctly returns plain array (@liuxingbaoyu)

babel-helper-create-class-features-plugin, babel-helper-member-expression-to-functions, babel-plugin-transform-block-scoping, babel-plugin-transform-optional-chaining, babel-traverse, babel-types

#17503 Fix JSXIdentifier handling in isReferencedIdentifier (@JLHwung)

babel-traverse

#17504 fix: ensure scope.push register in anonymous fn (@JLHwung)

🏠 Internal

babel-types

#17494 Type checking babel-types scripts (@JLHwung)

... (truncated)

Commits

d7f4008 v7.28.6
99dcba5 chore: enable some ts-eslint rules (#17592)
c1b55f6 Use eslint.config.mts (#17573)
35055e3 v7.28.4
18d88b8 Improve @babel/core typings (#17471)
ef155f5 v7.28.3
741cbd2 chore: fix various typos across codebase (#17476)
cac0ff4 v7.28.2
f743094 fix: regeneratorDefine compatibility with es5 strict mode (#17441)
baa4cb8 v7.27.6
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @babel/helpers since your current version.

Updates axios from 1.6.5 to 1.13.2

Release notes

Sourced from axios's releases.

Release v1.13.2

Release notes:

Bug Fixes

http: fix 'socket hang up' bug for keep-alive requests when using timeouts; (#7206) (8d37233)

http: use default export for http2 module to support stubs; (#7196) (0588880)

Performance Improvements

http: fix early loop exit; (#7202) (12c314b)

Contributors to this release

Dmitriy Mozgovoy

Kasper Isager Dalsgarð

Release v1.13.1

Release notes:

Bug Fixes

http: fixed a regression that caused the data stream to be interrupted for responses with non-OK HTTP statuses; (#7193) (bcd5581)

Contributors to this release

Anchal Singh

Dmitriy Mozgovoy

Release v1.13.0

Release notes:

Bug Fixes

fetch: prevent TypeError when config.env is undefined (#7155) (015faec)

resolve issue #7131 (added spacing in mergeConfig.js) (#7133) (9b9ec98)

Features

http: add HTTP2 support; (#7150) (d676df7)

Contributors to this release

Dmitriy Mozgovoy

Noritaka Kobayashi

Aviraj2929

prasoon patel

Samyak Dandge

Anchal Singh

Rahul Kumar

Amit Verma

... (truncated)

Changelog

Sourced from axios's changelog.

1.13.2 (2025-11-04)

Bug Fixes

http: fix 'socket hang up' bug for keep-alive requests when using timeouts; (#7206) (8d37233)

http: use default export for http2 module to support stubs; (#7196) (0588880)

Performance Improvements

http: fix early loop exit; (#7202) (12c314b)

Contributors to this release

Dmitriy Mozgovoy

Kasper Isager Dalsgarð

1.13.1 (2025-10-28)

Bug Fixes

http: fixed a regression that caused the data stream to be interrupted for responses with non-OK HTTP statuses; (#7193) (bcd5581)

Contributors to this release

Anchal Singh

Dmitriy Mozgovoy

1.13.0 (2025-10-27)

Bug Fixes

fetch: prevent TypeError when config.env is undefined (#7155) (015faec)

resolve issue #7131 (added spacing in mergeConfig.js) (#7133) (9b9ec98)

Features

http: add HTTP2 support; (#7150) (d676df7)

Contributors to this release

Dmitriy Mozgovoy

Noritaka Kobayashi

Aviraj2929

prasoon patel

Samyak Dandge

... (truncated)

Commits

08b84b5 chore(release): v1.13.2 (#7207)
8d37233 fix(http): fix 'socket hang up' bug for keep-alive requests when using timeou...
12c314b perf(http): fix early loop exit; (#7202)
f6d79e7 chore(sponsor): update sponsor block (#7203)
0588880 fix(http): use default export for http2 module to support stubs; (#7196)
1ef8e72 chore(release): v1.13.1 (#7194)
bcd5581 fix(http): fixed a regression that caused the data stream to be interrupted f...
c9b3371 chore: enhance styling and responsiveness in client.html (#7173)
9ead04d [Release] v1.13.0 (#7189)
d000fbf fix(http2): fix possible race condition when handling http2 stream on almost ...
Additional commits viewable in compare view

Updates cipher-base from 1.0.4 to 1.0.7

Changelog

Sourced from cipher-base's changelog.

v1.0.7 - 2025-09-24

Commits

[Refactor] use to-buffer fd1e5ee

[Dev Deps] update @ljharb/eslint-config 08ba803

v1.0.6 - 2024-11-26

Commits

[Fix] io.js 3.0 - Node.js 5.3 typed array support b7ddd2a

v1.0.5 - 2024-11-17

Commits

[Tests] standard -> eslint, make test dir, etc ae02fd6

[Tests] migrate from travis to GHA 66387d7

[meta] fix package.json indentation 5c02918

[Fix] return valid values on multi-byte-wide TypedArray input 8fd1364

[meta] add auto-changelog 88dc806

[meta] add npmignore and safe-publish-latest 7a137d7

Only apps should have lockfiles 42528f2

[Deps] update inherits, safe-buffer 0e7a2d9

[meta] add missing engines.node f2dc13e

Commits

0056718 v1.0.7
fd1e5ee [Refactor] use to-buffer
08ba803 [Dev Deps] update @ljharb/eslint-config
f5249f9 v1.0.6
b7ddd2a [Fix] io.js 3.0 - Node.js 5.3 typed array support
f03cebf v1.0.5
88dc806 [meta] add auto-changelog
7a137d7 [meta] add npmignore and safe-publish-latest
5c02918 [meta] fix package.json indentation
8fd1364 [Fix] return valid values on multi-byte-wide TypedArray input
Additional...
Description has been truncated

…pdates Bumps the npm_and_yarn group with 22 updates in the / directory: | Package | From | To | | --- | --- | --- | | [zx](https://github.com/google/zx) | `7.2.3` | `8.8.5` | | [electron-updater](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/electron-updater) | `6.1.8` | `6.3.0` | | [electron](https://github.com/electron/electron) | `27.0.3` | `35.7.5` | | [ws](https://github.com/websockets/ws) | `8.16.0` | `8.17.1` | | [@babel/helpers](https://github.com/babel/babel/tree/HEAD/packages/babel-helpers) | `7.23.8` | `7.28.6` | | [axios](https://github.com/axios/axios) | `1.6.5` | `1.13.2` | | [cipher-base](https://github.com/crypto-browserify/cipher-base) | `1.0.4` | `1.0.7` | | [diff](https://github.com/kpdecker/jsdiff) | `4.0.2` | `4.0.4` | | [express](https://github.com/expressjs/express) | `4.18.2` | `4.22.1` | | [fast-loops](https://github.com/robinweser/fast-loops) | `1.1.3` | `1.1.4` | | [follow-redirects](https://github.com/follow-redirects/follow-redirects) | `1.15.5` | `1.15.11` | | [form-data](https://github.com/form-data/form-data) | `3.0.1` | `3.0.4` | | [image-size](https://github.com/image-size/image-size) | `1.1.1` | `1.2.1` | | [js-yaml](https://github.com/nodeca/js-yaml) | `3.14.1` | `3.14.2` | | [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.17.23` | | [min-document](https://github.com/Raynos/min-document) | `2.19.0` | `2.19.2` | | [nanoid](https://github.com/ai/nanoid) | `3.3.7` | `3.3.11` | | [pbkdf2](https://github.com/browserify/pbkdf2) | `3.1.2` | `3.1.5` | | [serve-static](https://github.com/expressjs/serve-static) | `1.15.0` | `1.16.3` | | [sha.js](https://github.com/crypto-browserify/sha.js) | `2.4.11` | `2.4.12` | | [store2](https://github.com/nbubna/store) | `2.14.2` | `2.14.4` | | [tar](https://github.com/isaacs/node-tar) | `6.2.0` | `6.2.1` | Updates `zx` from 7.2.3 to 8.8.5 - [Release notes](https://github.com/google/zx/releases) - [Commits](google/zx@7.2.3...8.8.5) Updates `electron-updater` from 6.1.8 to 6.3.0 - [Release notes](https://github.com/electron-userland/electron-builder/releases) - [Changelog](https://github.com/electron-userland/electron-builder/blob/master/packages/electron-updater/CHANGELOG.md) - [Commits](https://github.com/electron-userland/electron-builder/commits/electron-updater@6.3.0/packages/electron-updater) Updates `electron` from 27.0.3 to 35.7.5 - [Release notes](https://github.com/electron/electron/releases) - [Commits](electron/electron@v27.0.3...v35.7.5) Updates `ws` from 8.16.0 to 8.17.1 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.16.0...8.17.1) Updates `@babel/helpers` from 7.23.8 to 7.28.6 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.28.6/packages/babel-helpers) Updates `axios` from 1.6.5 to 1.13.2 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.6.5...v1.13.2) Updates `cipher-base` from 1.0.4 to 1.0.7 - [Changelog](https://github.com/browserify/cipher-base/blob/master/CHANGELOG.md) - [Commits](browserify/cipher-base@v1.0.4...v1.0.7) Updates `diff` from 4.0.2 to 4.0.4 - [Changelog](https://github.com/kpdecker/jsdiff/blob/master/release-notes.md) - [Commits](kpdecker/jsdiff@v4.0.2...v4.0.4) Updates `express` from 4.18.2 to 4.22.1 - [Release notes](https://github.com/expressjs/express/releases) - [Changelog](https://github.com/expressjs/express/blob/v4.22.1/History.md) - [Commits](expressjs/express@4.18.2...v4.22.1) Updates `fast-loops` from 1.1.3 to 1.1.4 - [Commits](https://github.com/robinweser/fast-loops/commits) Updates `follow-redirects` from 1.15.5 to 1.15.11 - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.15.5...v1.15.11) Updates `form-data` from 3.0.1 to 3.0.4 - [Release notes](https://github.com/form-data/form-data/releases) - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v3.0.1...v3.0.4) Updates `image-size` from 1.1.1 to 1.2.1 - [Release notes](https://github.com/image-size/image-size/releases) - [Commits](image-size/image-size@v1.1.1...v1.2.1) Updates `js-yaml` from 3.14.1 to 3.14.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.14.1...3.14.2) Updates `lodash` from 4.17.21 to 4.17.23 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.17.23) Updates `min-document` from 2.19.0 to 2.19.2 - [Commits](Raynos/min-document@v2.19.0...v2.19.2) Updates `nanoid` from 3.3.7 to 3.3.11 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](ai/nanoid@3.3.7...3.3.11) Updates `path-to-regexp` from 0.1.7 to 0.1.12 - [Release notes](https://github.com/pillarjs/path-to-regexp/releases) - [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md) - [Commits](pillarjs/path-to-regexp@v0.1.7...v0.1.12) Updates `pbkdf2` from 3.1.2 to 3.1.5 - [Changelog](https://github.com/browserify/pbkdf2/blob/master/CHANGELOG.md) - [Commits](browserify/pbkdf2@v3.1.2...v3.1.5) Updates `serve-static` from 1.15.0 to 1.16.3 - [Release notes](https://github.com/expressjs/serve-static/releases) - [Changelog](https://github.com/expressjs/serve-static/blob/master/HISTORY.md) - [Commits](expressjs/serve-static@v1.15.0...v1.16.3) Updates `sha.js` from 2.4.11 to 2.4.12 - [Changelog](https://github.com/browserify/sha.js/blob/master/CHANGELOG.md) - [Commits](browserify/sha.js@v2.4.11...v2.4.12) Updates `store2` from 2.14.2 to 2.14.4 - [Commits](nbubna/store@2.14.2...2.14.4) Updates `tar` from 6.2.0 to 6.2.1 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v6.2.0...v6.2.1) --- updated-dependencies: - dependency-name: zx dependency-version: 8.8.5 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: electron-updater dependency-version: 6.3.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: electron dependency-version: 35.7.5 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 8.17.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@babel/helpers" dependency-version: 7.28.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: axios dependency-version: 1.13.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: cipher-base dependency-version: 1.0.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: diff dependency-version: 4.0.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: express dependency-version: 4.22.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-loops dependency-version: 1.1.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: follow-redirects dependency-version: 1.15.11 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: form-data dependency-version: 3.0.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: image-size dependency-version: 1.2.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 3.14.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.17.23 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: min-document dependency-version: 2.19.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: nanoid dependency-version: 3.3.11 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: path-to-regexp dependency-version: 0.1.12 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: pbkdf2 dependency-version: 3.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: serve-static dependency-version: 1.16.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: sha.js dependency-version: 2.4.12 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: store2 dependency-version: 2.14.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tar dependency-version: 6.2.1 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jan 22, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the npm_and_yarn group across 1 directory with 23 updates #1

chore(deps): bump the npm_and_yarn group across 1 directory with 23 updates #1

dependabot bot commented on behalf of github Jan 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

chore(deps): bump the npm_and_yarn group across 1 directory with 23 updates #1

Are you sure you want to change the base?

chore(deps): bump the npm_and_yarn group across 1 directory with 23 updates #1

Conversation

dependabot bot commented on behalf of github Jan 22, 2026

8.8.5 — Temporary Reservoir

8.8.4 — Flange Coupling

8.8.3 — Sealing Gasket

8.8.2 — Leaking Valve

8.8.1 — Turbo Flush

Featfixes

Enhancements

8.8.0 — Pressure Tested

✨ New Features

unpipe() — Selectively stop piping

electron-updater@6.3.0

Minor Changes

Patch Changes

electron-updater@6.3.0-alpha.8

Patch Changes

electron-updater@6.3.0-alpha.7

Patch Changes

electron-updater@6.3.0-alpha.6

Patch Changes

electron-updater@6.3.0-alpha.5

Patch Changes

6.3.0

Minor Changes

Patch Changes

6.3.0-alpha.8

Patch Changes

6.3.0-alpha.7

Patch Changes

6.3.0-alpha.6

Patch Changes

electron v35.7.5

Release Notes for v35.7.5

Fixes

electron v35.7.4

Release Notes for v35.7.4

8.17.1

Bug fixes

v7.28.6 (2026-01-12)

🐛 Bug Fix

💅 Polish

🏠 Internal

🏃‍♀️ Performance

Committers: 7

v7.28.5 (2025-10-23)

👓 Spec Compliance

🐛 Bug Fix

Changelog

v7.28.5 (2025-10-23)

👓 Spec Compliance

🐛 Bug Fix

🏠 Internal

Release v1.13.2

Release notes:

Bug Fixes

Performance Improvements

Contributors to this release

Release v1.13.1

Release notes:

Bug Fixes

Contributors to this release

Release v1.13.0

Release notes:

Bug Fixes

Features

Contributors to this release

1.13.2 (2025-11-04)

Bug Fixes

Performance Improvements

Contributors to this release

1.13.1 (2025-10-28)

Bug Fixes

Contributors to this release

1.13.0 (2025-10-27)

Bug Fixes

Features

`unpipe()` — Selectively stop piping