Skip to content

chore(deps-dev): bump compressing from 1.10.4 to 2.1.0#724

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/compressing-2.1.0
Open

chore(deps-dev): bump compressing from 1.10.4 to 2.1.0#724
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/compressing-2.1.0

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Mar 25, 2026

Bumps compressing from 1.10.4 to 2.1.0.

Release notes

Sourced from compressing's releases.

v2.1.0

What's Changed

Full Changelog: node-modules/compressing@v2.0.1...v2.1.0

v2.0.1

2.0.1 (2026-01-28)

  • fix(security): prevent arbitrary file write via symlink extraction (ce1c013)
  • chore: Configure Renovate (#121) (fd321da), closes #121
  • chore: fix trust publish (92df8f9)
  • test: fix test cases for uncompress stream (#118) (5f281d9), closes #118

This release is also available on:

v2.0.0

2.0.0 (2025-08-09)

  • fix: impl _final method instead hack pipe event (#114) (ba52b7b), closes #114
  • feat: remove pump and raise minimum node to v18 (#113) (8ac1164), closes #113

BREAKING CHANGE

  • Drop Node.js < 18 support

Node.js 4 is long EOL, so this PR raises it to 18 as per comment. Node 10 has built-in stream.pipeline and fs.mkdir with recursive option, which can be used instead of pump (they are the same).

Summary by CodeRabbit

  • Chores
  • Replaced the external stream piping utility with the native Node.js stream API throughout the codebase and tests.
  • Updated documentation examples to reflect the new usage of the native stream API.
  • Replaced external directory creation utilities with native Node.js directory creation methods using recursive options.
  • Removed obsolete dependencies and increased the minimum required Node.js version to 18.0.0.

... (truncated)

Changelog

Sourced from compressing's changelog.

2.1.0 (2026-01-28)

2.0.1 (2026-01-28)

  • fix: prevent arbitrary file write via symlink extraction (b8dca23)
  • Merge commit from fork (ce1c013)
  • chore: Configure Renovate (#121) (fd321da), closes #121
  • chore: fix trust publish (92df8f9)
  • test: fix test cases for uncompress stream (#118) (5f281d9), closes #118

2.0.0 (2025-08-09)

  • fix: impl _final method instead hack pipe event (#114) (ba52b7b), closes #114
  • feat: remove pump and raise minimum node to v18 (#113) (8ac1164), closes #113

BREAKING CHANGE

  • Drop Node.js < 18 support

Node.js 4 is long EOL, so this PR raises it to 18 as per comment. Node 10 has built-in stream.pipeline and fs.mkdir with recursive option, which can be used instead of pump (they are the same).

Also 3 tests fail for me but they fail on main branch as well (timeout)

Summary by CodeRabbit

  • Chores
  • Replaced the external stream piping utility with the native Node.js stream API throughout the codebase and tests.
  • Updated documentation examples to reflect the new usage of the native stream API.
  • Replaced external directory creation utilities with native Node.js directory creation methods using recursive options.
  • Removed obsolete dependencies and increased the minimum required Node.js version to 18.0.0.

1.10.3 (2025-05-24)

Bug Fixes

  • link relative paths for better portability (#111) (2684ca2)

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [compressing](https://github.com/node-modules/compressing) from 1.10.4 to 2.1.0.
- [Release notes](https://github.com/node-modules/compressing/releases)
- [Changelog](https://github.com/node-modules/compressing/blob/master/CHANGELOG.md)
- [Commits](node-modules/compressing@v1.10.4...v2.1.0)

---
updated-dependencies:
- dependency-name: compressing
  dependency-version: 2.1.0
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants