Bump the npm_and_yarn group across 1 directory with 27 updates by dependabot[bot] · Pull Request #28 · mackenly/multiflux

dependabot · 2026-09-16T22:51:35Z

Bumps the npm_and_yarn group with 27 updates in the / directory:

Package	From	To
wrangler	`3.19.0`	`3.114.17`
@babel/core	`7.18.10`	`7.29.7`
@babel/plugin-transform-modules-systemjs	`7.18.9`	`7.29.8`
js-yaml	`3.14.1`	`3.15.2`
ajv	`6.12.6`	`6.15.0`
ajv	`8.11.0`	`8.20.0`
body-parser	`1.20.2`	`1.20.8`
brace-expansion	`1.1.11`	`1.1.21`
brace-expansion	`2.0.1`	`2.1.7`
browserslist	`4.23.0`	`4.29.0`
colord	`2.9.3`	`2.10.0`
minimatch	`3.1.2`	`3.1.5`
minimatch	`5.1.0`	`5.1.9`
flatted	`3.2.6`	`3.4.4`
follow-redirects	`1.15.6`	`1.16.0`
form-data	`3.0.1`	`3.0.5`
http-proxy-middleware	`2.0.6`	`2.0.10`
lodash	`4.17.21`	`4.18.1`
ws	`8.17.1`	`8.21.3`
ws	`7.5.10`	`7.5.13`
nanoid	`3.3.4`	`3.3.19`
node-forge	`1.3.1`	`1.4.0`
path-to-regexp	`0.1.7`	`0.1.13`
picomatch	`2.3.1`	`2.3.2`
qs	`6.11.0`	`6.16.0`
rollup	`2.78.0`	`2.80.0`
shell-quote	`1.7.3`	`1.10.0`
undici	`5.28.4`	`7.29.0`
webpack	`5.94.0`	`5.111.0`
websocket-driver	`0.7.4`	`0.7.5`
yaml	`1.10.2`	`1.10.3`

Updates wrangler from 3.19.0 to 3.114.17

Changelog

Sourced from wrangler's changelog.

3.114.17

Patch Changes

#11891 6d5557b Thanks @emily-shen! - Use argument array when executing git commands with wrangler pages deploy

Pass user provided values from --commit-hash safely to underlying git command.

3.114.16

Patch Changes

#11689 9bab0a0 Thanks @ascorbic! - Display a warning when authentication errors occur and the account_id in your Wrangler configuration does not match any of your authenticated accounts. This helps identify configuration issues where you may have the wrong account ID set in your wrangler.toml or wrangler.jsonc file.

#10737 c41a078 Thanks @workers-devprod! - Allow WRANGLER_SEND_ERROR_REPORTS env var to override whether to report Wrangler crashes to Sentry

#11134 bd39455 Thanks @petebacondarwin! - Reduce the amount of arguments being passed in metrics capture.

Now the argument values that are captured come from an allow list, and can be marked as ALLOW (capture the real value) or REDACT (capture as "").

#11020 9cb702e Thanks @dario-piotrowicz! - Fix observability.logs.persist being flagged as an unexpected field during the wrangler config file validation

#11147 cf4993b Thanks @FlorentCollin! - Improve the formatting of the D1 execute command to always show the duration in milliseconds with two decimal places.

#11650 cc29ead Thanks @ascorbic! - fix: respect TypeScript path aliases when resolving non-JS modules with module rules

When importing non-JavaScript files (like .graphql, .txt, etc.) using TypeScript path aliases defined in tsconfig.json, Wrangler's module-collection plugin now correctly resolves these imports. Previously, path aliases were only respected for JavaScript/TypeScript files, causing imports like import schema from '~lib/schema.graphql' to fail when using module rules.

#11179 7f779e9 Thanks @ascorbic! - Log a more helpful error when attempting to "r2 object put" a non-existent file

#11501 c78d942 Thanks @edmundhung! - fix: prevent reporting SQLite error from wrangler d1 execute to Sentry

#11262 b2683f7 Thanks @workers-devprod! - Avoid using object lookup for OAuth Error classes

#11107 d8037d3 Thanks @workers-devprod! - Fixed conflict between --env and --expires flags in wrangler r2 object put.

--e now aliases --env only, and NOT --expires.

#10961 02d2ea9 Thanks @devin-ai-integration! - Acquire Cloudflare Access tokens for additional requests made during a wrangler dev --remote session

#11108 892ec4f Thanks @emily-shen! - Fixed self-bindings (service bindings to the same worker) showing as [not connected] in wrangler dev. Self-bindings now correctly show as [connected] since a worker is always available to itself.

#11138 3db872a Thanks @devin-ai-integration! - Implement tail-based logging for wrangler dev remote mode, behind the --x-tail-tags flag. This will become the default in the future.

#10889 204616c Thanks @workers-devprod! - Clarify that wrangler check startup generates a local CPU profile

#11491 ed8aaef Thanks @edmundhung! - Explicitly close FileHandle in wrangler d1 execute to support Node 25

#10962 203e599 Thanks @devin-ai-integration! - Fixed duplicate warning messages appearing during wrangler dev when configuration changes or state transitions occur

... (truncated)

Commits

f21ee75 Version Packages (#11895)
6d5557b fix: execute git commands in pages deploy safely (#11889) (#11891)
0e19ae9 Version Packages (#10906)
3db872a [v3 backport] Backport tail-based logging from #11135 and #11346 (#11138)
02d2ea9 Fix remote dev with Access (#10961)
9bab0a0 fix(wrangler): add warning when account_id mismatch detected on auth error (v...
4b18c6f Introduce internal isWorkerNotFoundError utility and avoid worker-not-found...
ed8aaef fix(wrangler): close FileHandle in to support Node 25 (#11491)
c78d942 V3 backport of #11467: prevent SQLite users error from being reported to Sent...
cc29ead fix: respect TypeScript path aliases when resolving non-JS modules with modul...
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for wrangler since your current version.

Updates @babel/core from 7.18.10 to 7.29.7

Release notes

Sourced from @babel/core's releases.

v7.29.7 (2026-05-25)

Re-release all packages with npm provenance attestations

v7.29.6 (2026-05-25)

🐛 Bug Fix

babel-generator

#18014 Catchup source map position in preserveFormat (@nicolo-ribaudo)

babel-core

#18001 [7.x packport]Improve input source map handling (@JLHwung)

babel-core, babel-generator

#17998 Preserve original identifier names from input sourcemaps (#17992) (@Andarist)

Committers: 3

Huáng Jùnliàng (@JLHwung)

Mateusz Burzyński (@Andarist)

Nicolò Ribaudo (@nicolo-ribaudo)

v7.29.5 (2026-05-05)

🏠 Internal

babel-preset-env

Update @babel/* dependencies

v7.29.4 (2026-05-05)

🐛 Bug Fix

babel-plugin-transform-modules-systemjs

#17974 [7.x backport]fix(systemjs): improve module string name support (@JLHwung)

Committers: 1

Huáng Jùnliàng (@JLHwung)

v7.29.3 (2026-04-30)

👓 Spec Compliance

babel-parser

#17923 Support flow extends bound (@JLHwung)

🐛 Bug Fix

babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators

#17931 fix(decorators): replace super within all removed static elements (@JLHwung)

babel-register

#17915 Fix thread synchronization issues in @babel/register (@liuxingbaoyu)

babel-compat-data, babel-plugin-bugfix-safari-rest-destructuring-rhs-array, babel-preset-env

#17788 Add bugfix plugin for Safari array rest destructuring bug (@JLHwung)

💅 Polish

babel-parser

... (truncated)

Commits

4fba754 v7.29.7
04ea6b2 v7.29.6
99f498a [7.x packport]Improve input source map handling (#18001)
feba0a3 Preserve original identifier names from input sourcemaps (#17992) (#17998)
aa8394e v7.29.0
ad0d03f [7.x backport] feat: Allow specifying startLine in code frame (#17739)
d7f4008 v7.28.6
e130225 Polish(standalone): improve message on invalid preset/plugin (#17606)
99dcba5 chore: enable some ts-eslint rules (#17592)
c92c491 Improve Unicode handling in code-frame tokenizer (#17589)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @babel/core since your current version.

Updates @babel/plugin-transform-modules-systemjs from 7.18.9 to 7.29.8

Release notes

Sourced from @babel/plugin-transform-modules-systemjs's releases.

v7.29.8 (2026-07-31)

👓 Spec Compliance

babel-generator, babel-parser, babel-plugin-transform-spread, babel-traverse, babel-types

#17871 Disallow super call after new (@JLHwung)

🐛 Bug Fix

babel-generator

#18046 fix(generator): improve new callee parens check (@JLHwung)

babel-node, babel-plugin-transform-modules-systemjs

#18044 fix(systemjs): support __proto__ as an export name (@JLHwung)

Committers: 2

Huáng Jùnliàng (@JLHwung)

Nicolò Ribaudo (@nicolo-ribaudo)

v7.29.7 (2026-05-25)

Re-release all packages with npm provenance attestations

v7.29.6 (2026-05-25)

🐛 Bug Fix

babel-generator

#18014 Catchup source map position in preserveFormat (@nicolo-ribaudo)

babel-core

#18001 [7.x packport]Improve input source map handling (@JLHwung)

babel-core, babel-generator

#17998 Preserve original identifier names from input sourcemaps (#17992) (@Andarist)

Committers: 3

Huáng Jùnliàng (@JLHwung)

Mateusz Burzyński (@Andarist)

Nicolò Ribaudo (@nicolo-ribaudo)

v7.29.5 (2026-05-05)

🏠 Internal

babel-preset-env

Update @babel/* dependencies

v7.29.4 (2026-05-05)

🐛 Bug Fix

babel-plugin-transform-modules-systemjs

#17974 [7.x backport]fix(systemjs): improve module string name support (@JLHwung)

Committers: 1

Huáng Jùnliàng (@JLHwung)

... (truncated)

Commits

5de11ca v7.29.8
f08d434 fix(systemjs): support proto as an export name (#18044)
4fba754 v7.29.7
a458f66 v7.29.4
32ebd5a [7.x backport]fix(systemjs): improve module string name support (#17974)
aa8394e v7.29.0
0053db6 Update polyfill packages (#17727)
61647ae v7.28.5
a177d55 [Babel 8] Use t.traverseFast to replace some path.traverse (#17518)
eebd3a0 v7.27.1
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @babel/plugin-transform-modules-systemjs since your current version.

Updates js-yaml from 3.14.1 to 3.15.2

Changelog

Sourced from js-yaml's changelog.

3.15.2 - 2026-08-26

Changed

[backport] Hard-limit merge sequence size to 100.

Security

[backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

3.15.1 - 2026-07-31

Security

[backport] Remove quadratic complexity from !!omap duplicate key detection.

3.15.0 - 2026-06-27

Added

Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one safeLoad() / safeLoadAll() call.

[3.14.2] - 2025-11-15

Security

Fix prototype pollution in merge (<<).

Commits

5c45bd6 3.15.2 released
5a708f9 dist rebuild
3485bc0 Backport merge limits from v5.4.1
f34812f Update .gitignore
ab85ae2 3.15.1 released
30a5e76 dist rebuild
22a8071 Backport quadratic complexity fix for !!omap
c34b6c4 3.15.0 released
21e13d3 dist rebuild
4165c62 Add v3-legacy tag for publish
Additional commits viewable in compare view

Updates ajv from 6.12.6 to 6.15.0

Commits

184bc32 6.15.0
fea46af test/fix prototype pollution via $data ref with format keyword (#2606)
e3af0a7 6.14.0
b552ed6 add regExp option to address $data exploit via a regular expression (CVE-2025...
72f2286 docs: update v7 info
231e52b Merge pull request #1320 from philsturgeon/patch-1
d3475fc Add spectral, an AJV util from a sponsor
413afe0 docs: v7.0.0-beta.3
11e997b update readme for v7
See full diff in compare view

Updates ajv from 8.11.0 to 8.20.0

Commits

184bc32 6.15.0
fea46af test/fix prototype pollution via $data ref with format keyword (#2606)
e3af0a7 6.14.0
b552ed6 add regExp option to address $data exploit via a regular expression (CVE-2025...
72f2286 docs: update v7 info
231e52b Merge pull request #1320 from philsturgeon/patch-1
d3475fc Add spectral, an AJV util from a sponsor
413afe0 docs: v7.0.0-beta.3
11e997b update readme for v7
See full diff in compare view

Updates body-parser from 1.20.2 to 1.20.8

Release notes

Sourced from body-parser's releases.

1.20.8

Important

Same code base as 1.20.7. This was created to test the new release process.

What's Changed

ci: backport npm-publish workflow from master by @UlisesGascon in expressjs/body-parser#769

1.20.8 by @UlisesGascon in expressjs/body-parser#770

Full Changelog: expressjs/body-parser@1.20.7...1.20.8

1.20.7

What's Changed

docs: include security fix in 1.20.6 changes by @UlisesGascon in expressjs/body-parser#747

deps: qs@~6.16.0 by @krzysdz in expressjs/body-parser#761

1.20.7 by @UlisesGascon in expressjs/body-parser#767

Full Changelog: expressjs/body-parser@1.20.6...1.20.7

1.20.6

Important: Security

Security fix for CVE-2026-12590 (GHSA-v422-hmwv-36x6)

What's Changed

fix: improve limit option validation by @Phillip9587 in expressjs/body-parser#741

Full Changelog: expressjs/body-parser@1.20.5...1.20.6

v1.20.5

What's Changed

The reason for this release is a fix to the extended urlencoded parser returning objects instead of arrays for large array inputs (> 100) on qs@6.14.2+. (expressjs/body-parser#716)

refactor(json): simplify strict mode error string construction by @jonchurch in expressjs/body-parser#692

fix: correct off-by-one error in parameterCount by @abhu85 in expressjs/body-parser#716

deps(qs): bump qs to 6.15.1 by @jonchurch in expressjs/body-parser#722

Release: 1.20.5 by @jonchurch in expressjs/body-parser#721

New Contributors

@abhu85 made their first contribution in expressjs/body-parser#716

Special thanks to triager @krzysdz for keeping this on our radar and effectively triaging the specific issue!

Full Changelog: expressjs/body-parser@1.20.4...1.20.5

... (truncated)

Changelog

Sourced from body-parser's changelog.

1.20.8

Same code base as 1.20.7. This was created to test the new release process.

1.20.7

deps: qs@~6.16.0

1.20.6

Security fix for GHSA-v422-hmwv-36x6

fix: improve limit option validation (#698)

Invalid limit values (e.g. unparseable strings or NaN) now throw instead of being silently ignored, which previously disabled size limit enforcement

null and undefined fall back to the default 100kb limit

1.20.5

refactor(json): simplify strict mode error string construction

fix: extended urlencoded parsing of arrays with >100 elements (#716)

deps: qs@~6.15.1

1.20.4

deps: qs@~6.14.0

deps: use tilde notation for dependencies

deps: http-errors@~2.0.1

deps: raw-body@~2.5.3

1.20.3

deps: qs@6.13.0

add depth option to customize the depth level in the parser

IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)

Commits

5c08c20 1.20.8 (#770)
0cea4f4 ci: backport npm-publish workflow from master (#769)
0f0f0d7 1.20.7 (#767)
355eb04 deps: qs@~6.16.0 (#761)
8be369a docs: include security fix in 1.20.6 changes
5cc4fb8 1.20.6 (#746)
3492672 fix: improve limit option validation (#741)
0defdbe release(patch): 1.20.5
cd0e7a0 deps(qs): bump qs to 6.15.1
6f24d7e fix: correct off-by-one error in parameterCount (#716)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for body-parser since your current version.

Updates brace-expansion from 1.1.11 to 1.1.21

Release notes

Sourced from brace-expansion's releases.

v1.1.15

Backport v5.0.6 change to v1 (#111) 0b09384

juliangruber/brace-expansion@v1.1.14...v1.1.15

v1.1.12

pkg: publish on tag 1.x c460dbd

fmt ccb8ac6

Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) c3c73c8

juliangruber/brace-expansion@v1.1.11...v1.1.12

Commits

8e81e18 1.1.21
ffdfa3e Merge commit from fork
c6513ad 1.1.20
1efee7c Merge commit from fork
a34340a 1.1.19
0bcbfc0 Merge commit from fork
758fcd6 1.1.18
27fbeed Merge commit from fork
5c57cc2 1.1.17
d757f1d npm ignore .claude
Additional commits viewable in compare view

Updates brace-expansion from 2.0.1 to 2.1.7

Release notes

Sourced from brace-expansion's releases.

v1.1.15

Backport v5.0.6 change to v1 (#111) 0b09384

juliangruber/brace-expansion@v1.1.14...v1.1.15

v1.1.12

pkg: publish on tag 1.x c460dbd

fmt ccb8ac6

Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) c3c73c8

juliangruber/brace-expansion@v1.1.11...v1.1.12

Commits

8e81e18 1.1.21
ffdfa3e Merge commit from fork
c6513ad 1.1.20
1efee7c Merge commit from fork
a34340a 1.1.19
0bcbfc0 Merge commit from fork
758fcd6 1.1.18
27fbeed Merge commit from fork
5c57cc2 1.1.17
d757f1d npm ignore .claude
Additional commits viewable in compare view

Updates browserslist from 4.23.0 to 4.29.0

Release notes

Sourced from browserslist's releases.

4.29.0

Added query continuations across lines and array entries (by @fzlzjerry).

4.28.9

Improve or parsing performance (by @NotAFlightRisk).

4.28.8

Fixed including kaios in baseline queries (by @Jaybhade).

4.28.7

Improved parsing performance.

Fixed unbounded memory growth (by @alanturing881).

Fixed prototype write issue (by @alanturing881).

4.28.6

Fixed Electron version queries (by @spokodev).

4.28.5

Fixed > and >= queries (by @spokodev).

4.28.4

Fixed SyntaxError regression of 4.28.3.

4.28.3

Fixed baseline query case-insensitivity (by @swwind).

4.28.2

Fix prototype pollution (by @chluo1997).

4.28.1

Removed Baseline warning since we have it own warning.

4.27.0

Added BROWSERSLIST_TRACE_WARNING environment variable.

4.26.3

Fixed throwOnMissing with extends query (by @alexander-akait).

4.26.2

Fixed baseline-browser-mapping version requirement.

4.26.1

Updated Firefox ESR.

4.26.0

Added Baseline queries (by @tonypconway).

4.25.4

Fixed Windows support for custom stats (by @torgeilo).

... (truncated)

Changelog

Sourced from browserslist's changelog.

4.29.0

Added query continuations across lines and array entries (by @fzlzjerry).

4.28.9

Improved or parsing performance (by @NotAFlightRisk).

4.28.8

Fixed including kaios in baseline queries (by @Jaybhade).

4.28.7

Improved parsing performance.

Fixed unbounded memory growth (by @alanturing881).

Fixed prototype write issue (by @alanturing881).

4.28.6

Fixed Electron version queries (by @spokodev).

4.28.5

Fixed > and >= queries (by @spokodev).

4.28.4

Fixed SyntaxError regression of 4.28.3.

4.28.3

Fixed baseline query case-insensitivity (by @swwind).

4.28.2

Fix prototype pollution (by @chluo1997).

4.28.1

Removed Baseline warning since we have it own warning.

4.48.0

Added firefox >= esr query support (by @SethFalco).

Fixed docs (by @SethFalco).

4.27.0

Added BROWSERSLIST_TRACE_WARNING environment variable.

... (truncated)

Commits

e6dd578 Release 4.29.0 version
8987b7d Typo
47fefe6 Move from actions-up to pnpm
17b1e23 Update dependencies
df16b26 Merge pull request #944 from fzlzjerry/fix/757-query-continuations
a2673d7 Support query continuations across entries
f46a5b7 Merge pull request #942 from agilgur5/fix-docs-typo-security-table
989c8c9 docs: fix typo in table rendering for SECURITY.md
12ed525 Release 4.28.9 version
b1d8cf9 Update dependencies
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for browserslist since your current version.

Updates colord from 2.9.3 to 2.10.0

Release notes

Sourced from colord's releases.

v2.10 (RGB color mixing)

mix, tints, shades and tones (mix plugin) now accept an optional interpolation color space. LAB stays the default; pass "rgb" to interpolate RGB channels instead — the way browsers and design tools (such as Figma) composite translucent layers.
import { colord, extend } from "colord";
import mixPlugin from "colord/plugins/mix";
extend([mixPlugin]);
colord("#ff0000").mix("#ffffff", 0.5, "rgb").toHex(); // "#ff8080"
colord("#f0f3f1").mix("#007d40", 0.14, "rgb").toHex(); // "#cee2d8" — same as compositing rgba(0, 125, 64, 0.14) over #f0f3f1
colord("#ff0000").tints(3, "rgb").map((c) => c.toHex()); // ["#ff0000", "#ff8080", "#ffffff"]

Changelog

Sourced from colord's changelog.

2.10.0

Improve mix plugin by adding an optional "rgb" interpolation mode to mix, tints, tones and shades

2.9.7

Make HEX parsing and serialization more than 2x faster

2.9.6

Fix: Rotate the unrounded hue so rotate and harmonies preserve the original color

Fix: Normalize HWB whiteness + blackness over 100% to gray ❤️ @spokodev

2.9.5

Fix: Use adjusted chroma for the CIEDE2000 rotation term ❤️ @maximilliangrand

Fix: Keep the hue within [0, 360) in every color model ❤️ @sarathfrancis90

Both fixes change returned numbers for a small set of colors; toHex() output is unchanged. Snapshots holding h: 360, "hsl(360, …)" or a delta() value may need updating.

2.9.4

Fix: Reject malformed color strings in linear time ❤️ @GAP-dev

Commits

See full diff in compare view

Updates minimatch from 3.1.2 to 3.1.5

Commits

7bba978 3.1.5
bd25942 docs: add warning about ReDoS
1a9c27c fix partial matching of globstar patterns
1a2e084 3.1.4
ae24656 update lockfile
b100374 limit recursion for **, improve perf considerably
26ffeaa lockfile update
9eca892 lock node version to 14
00c323b 3.1.3
30486b2 update CI matrix and actions
Additional commits viewable in compare view

Updates minimatch from 5.1.0 to 5.1.9

Commits

7bba978 3.1.5
bd25942 docs: add warning about ReDoS
1a9c27c fix partial matching of globstar patterns
1a2e084 3.1.4
ae24656 update lockfile
b100374 limit recursion for **, improve perf considerably
26ffeaa lockfile update
9eca892 lock node version to 14
00c323b 3.1.3
30486b2 update CI matrix and actions
Additional commits viewable in compare view

Updates flatted from 3.2.6 to 3.4.4

Commits

e6f5ca7 3.4.4
47f14fa removed E_STRICT from PHP
4050568 fixced go-lang issues in CI
4303f4d Merge pull request #101 from mfinelli/gocriticfixes
106735b updated package-lock.json
670a1bd 3.4.3
50a61a9 Fix #104 - allow null as replacer value
8aa64f4 solved crytical errors over dependencies
b85577f Fix go-critic errors
bb8c63c Merge pull request #100 from WebReflection/WebReflection-patch-1
Additional commits viewable in compare view

Updates follow-redirects from 1.15.6 to 1.16.0

Commits

0c23a22 Release version 1.16.0 of the npm package.
844c4d3 Add sensitiveHeaders option.
5e8b8d0 ci: add Node.js 24.x to the CI matrix
7953e22 ci: upgrade GitHub Actions to use setup-node@v6 and checkout@v6
86dc1f8 Sanitizing input.
21ef28a Release version 1.15.11 of the npm package.
7c88135 Roll back tree shaking.
6e389ba Release version 1.15.10 of the npm package.
5bc496e Shake me up before you go-go.
694d6b4 Bump minimist from 1.2.5 to 1.2.8
Additional commits viewable in

Bumps the npm_and_yarn group with 27 updates in the / directory: | Package | From | To | | --- | --- | --- | | [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `3.19.0` | `3.114.17` | | [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) | `7.18.10` | `7.29.7` | | [@babel/plugin-transform-modules-systemjs](https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-modules-systemjs) | `7.18.9` | `7.29.8` | | [js-yaml](https://github.com/nodeca/js-yaml) | `3.14.1` | `3.15.2` | | [ajv](https://github.com/ajv-validator/ajv) | `6.12.6` | `6.15.0` | | [ajv](https://github.com/ajv-validator/ajv) | `8.11.0` | `8.20.0` | | [body-parser](https://github.com/expressjs/body-parser) | `1.20.2` | `1.20.8` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.11` | `1.1.21` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `2.0.1` | `2.1.7` | | [browserslist](https://github.com/browserslist/browserslist) | `4.23.0` | `4.29.0` | | [colord](https://github.com/omgovich/colord) | `2.9.3` | `2.10.0` | | [minimatch](https://github.com/isaacs/minimatch) | `3.1.2` | `3.1.5` | | [minimatch](https://github.com/isaacs/minimatch) | `5.1.0` | `5.1.9` | | [flatted](https://github.com/WebReflection/flatted) | `3.2.6` | `3.4.4` | | [follow-redirects](https://github.com/follow-redirects/follow-redirects) | `1.15.6` | `1.16.0` | | [form-data](https://github.com/form-data/form-data) | `3.0.1` | `3.0.5` | | [http-proxy-middleware](https://github.com/chimurai/http-proxy-middleware) | `2.0.6` | `2.0.10` | | [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.18.1` | | [ws](https://github.com/websockets/ws) | `8.17.1` | `8.21.3` | | [ws](https://github.com/websockets/ws) | `7.5.10` | `7.5.13` | | [nanoid](https://github.com/ai/nanoid) | `3.3.4` | `3.3.19` | | [node-forge](https://github.com/digitalbazaar/forge) | `1.3.1` | `1.4.0` | | [path-to-regexp](https://github.com/pillarjs/path-to-regexp) | `0.1.7` | `0.1.13` | | [picomatch](https://github.com/micromatch/picomatch) | `2.3.1` | `2.3.2` | | [qs](https://github.com/ljharb/qs) | `6.11.0` | `6.16.0` | | [rollup](https://github.com/rollup/rollup) | `2.78.0` | `2.80.0` | | [shell-quote](https://github.com/ljharb/shell-quote) | `1.7.3` | `1.10.0` | | [undici](https://github.com/nodejs/undici) | `5.28.4` | `7.29.0` | | [webpack](https://github.com/webpack/webpack) | `5.94.0` | `5.111.0` | | [websocket-driver](https://github.com/faye/websocket-driver-node) | `0.7.4` | `0.7.5` | | [yaml](https://github.com/eemeli/yaml) | `1.10.2` | `1.10.3` | Updates `wrangler` from 3.19.0 to 3.114.17 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Changelog](https://github.com/cloudflare/workers-sdk/blob/wrangler@3.114.17/packages/wrangler/CHANGELOG.md) - [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@3.114.17/packages/wrangler) Updates `@babel/core` from 7.18.10 to 7.29.7 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.7/packages/babel-core) Updates `@babel/plugin-transform-modules-systemjs` from 7.18.9 to 7.29.8 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.8/packages/babel-plugin-transform-modules-systemjs) Updates `js-yaml` from 3.14.1 to 3.15.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/3.15.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.14.1...3.15.2) Updates `ajv` from 6.12.6 to 6.15.0 - [Release notes](https://github.com/ajv-validator/ajv/releases) - [Commits](ajv-validator/ajv@v6.12.6...v6.15.0) Updates `ajv` from 8.11.0 to 8.20.0 - [Release notes](https://github.com/ajv-validator/ajv/releases) - [Commits](ajv-validator/ajv@v6.12.6...v6.15.0) Updates `body-parser` from 1.20.2 to 1.20.8 - [Release notes](https://github.com/expressjs/body-parser/releases) - [Changelog](https://github.com/expressjs/body-parser/blob/1.20.8/HISTORY.md) - [Commits](expressjs/body-parser@1.20.2...1.20.8) Updates `brace-expansion` from 1.1.11 to 1.1.21 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@1.1.11...v1.1.21) Updates `brace-expansion` from 2.0.1 to 2.1.7 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@1.1.11...v1.1.21) Updates `browserslist` from 4.23.0 to 4.29.0 - [Release notes](https://github.com/browserslist/browserslist/releases) - [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md) - [Commits](browserslist/browserslist@4.23.0...4.29.0) Updates `colord` from 2.9.3 to 2.10.0 - [Release notes](https://github.com/omgovich/colord/releases) - [Changelog](https://github.com/omgovich/colord/blob/master/CHANGELOG.md) - [Commits](https://github.com/omgovich/colord/commits/v2.10) Updates `minimatch` from 3.1.2 to 3.1.5 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v3.1.2...v3.1.5) Updates `minimatch` from 5.1.0 to 5.1.9 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v3.1.2...v3.1.5) Updates `flatted` from 3.2.6 to 3.4.4 - [Commits](WebReflection/flatted@v3.2.6...v3.4.4) Updates `follow-redirects` from 1.15.6 to 1.16.0 - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.15.6...v1.16.0) Updates `form-data` from 3.0.1 to 3.0.5 - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v3.0.1...v3.0.5) Updates `http-proxy-middleware` from 2.0.6 to 2.0.10 - [Release notes](https://github.com/chimurai/http-proxy-middleware/releases) - [Changelog](https://github.com/chimurai/http-proxy-middleware/blob/v2.0.10/CHANGELOG.md) - [Commits](chimurai/http-proxy-middleware@v2.0.6...v2.0.10) Updates `lodash` from 4.17.21 to 4.18.1 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.18.1) Updates `ws` from 8.17.1 to 8.21.3 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.17.1...8.21.3) Updates `ws` from 7.5.10 to 7.5.13 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.17.1...8.21.3) Updates `nanoid` from 3.3.4 to 3.3.19 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](ai/nanoid@3.3.4...3.3.19) Updates `node-forge` from 1.3.1 to 1.4.0 - [Changelog](https://github.com/digitalbazaar/forge/blob/main/CHANGELOG.md) - [Commits](digitalbazaar/forge@v1.3.1...v1.4.0) Updates `path-to-regexp` from 0.1.7 to 0.1.13 - [Release notes](https://github.com/pillarjs/path-to-regexp/releases) - [Changelog](https://github.com/pillarjs/path-to-regexp/blob/v.0.1.13/History.md) - [Commits](pillarjs/path-to-regexp@v0.1.7...v.0.1.13) Updates `picomatch` from 2.3.1 to 2.3.2 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@2.3.1...2.3.2) Updates `qs` from 6.11.0 to 6.16.0 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.11.0...v6.16.0) Updates `rollup` from 2.78.0 to 2.80.0 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/v2.80.0/CHANGELOG.md) - [Commits](rollup/rollup@v2.78.0...v2.80.0) Updates `shell-quote` from 1.7.3 to 1.10.0 - [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md) - [Commits](ljharb/shell-quote@v1.7.3...v1.10.0) Updates `undici` from 5.28.4 to 7.29.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v5.28.4...v7.29.0) Updates `webpack` from 5.94.0 to 5.111.0 - [Release notes](https://github.com/webpack/webpack/releases) - [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md) - [Commits](webpack/webpack@v5.94.0...v5.111.0) Updates `websocket-driver` from 0.7.4 to 0.7.5 - [Changelog](https://github.com/faye/websocket-driver-node/blob/main/CHANGELOG.md) - [Commits](faye/websocket-driver-node@0.7.4...0.7.5) Updates `yaml` from 1.10.2 to 1.10.3 - [Release notes](https://github.com/eemeli/yaml/releases) - [Commits](eemeli/yaml@v1.10.2...v1.10.3) --- updated-dependencies: - dependency-name: wrangler dependency-version: 3.114.17 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: "@babel/core" dependency-version: 7.29.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@babel/plugin-transform-modules-systemjs" dependency-version: 7.29.8 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 3.15.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ajv dependency-version: 6.15.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ajv dependency-version: 8.20.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: body-parser dependency-version: 1.20.8 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.21 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 2.1.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: browserslist dependency-version: 4.29.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: colord dependency-version: 2.10.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: minimatch dependency-version: 3.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: minimatch dependency-version: 5.1.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: flatted dependency-version: 3.4.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: follow-redirects dependency-version: 1.16.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: form-data dependency-version: 3.0.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: http-proxy-middleware dependency-version: 2.0.10 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.18.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 8.21.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 7.5.13 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: nanoid dependency-version: 3.3.19 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: node-forge dependency-version: 1.4.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: path-to-regexp dependency-version: 0.1.13 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 2.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.16.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: rollup dependency-version: 2.80.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: shell-quote dependency-version: 1.10.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 7.29.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: webpack dependency-version: 5.111.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: websocket-driver dependency-version: 0.7.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: yaml dependency-version: 1.10.3 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

socket-security · 2026-09-16T22:52:06Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	wrangler@3.19.0 ⏵ 4.133.0	⁺¹	⁺¹⁶	^-4	⁺¹

View full report

socket-security · 2026-09-16T22:52:08Z

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Block		Obfuscated code: npm `rollup` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → `npm/react-scripts@5.0.1` → `npm/rollup@2.80.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/rollup@2.80.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Dynamic code execution: npm `@emnapi/runtime` Eval Type: Function Location: Package overview From: package-lock.json → `npm/wrangler@4.133.0` → `npm/@emnapi/runtime@1.11.3` ℹ Read more on: This package \| This alert \| What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@emnapi/runtime@1.11.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Trivial package: npm `@img/sharp-darwin-arm64` has 1 lines of code Location: Package overview From: package-lock.json → `npm/wrangler@4.133.0` → `npm/@img/sharp-darwin-arm64@0.35.4` ℹ Read more on: This package \| This alert \| What are trivial packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@img/sharp-darwin-arm64@0.35.4`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Trivial package: npm `@img/sharp-darwin-x64` has 1 lines of code Location: Package overview From: package-lock.json → `npm/wrangler@4.133.0` → `npm/@img/sharp-darwin-x64@0.35.4` ℹ Read more on: This package \| This alert \| What are trivial packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@img/sharp-darwin-x64@0.35.4`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Trivial package: npm `@img/sharp-linux-arm` has 1 lines of code Location: Package overview From: package-lock.json → `npm/wrangler@4.133.0` → `npm/@img/sharp-linux-arm@0.35.4` ℹ Read more on: This package \| This alert \| What are trivial packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@img/sharp-linux-arm@0.35.4`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Trivial package: npm `@img/sharp-linux-arm64` has 1 lines of code Location: Package overview From: package-lock.json → `npm/wrangler@4.133.0` → `npm/@img/sharp-linux-arm64@0.35.4` ℹ Read more on: This package \| This alert \| What are trivial packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@img/sharp-linux-arm64@0.35.4`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Trivial package: npm `@img/sharp-linux-ppc64` has 1 lines of code Location: Package overview From: package-lock.json → `npm/wrangler@4.133.0` → `npm/@img/sharp-linux-ppc64@0.35.4` ℹ Read more on: This package \| This alert \| What are trivial packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@img/sharp-linux-ppc64@0.35.4`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Trivial package: npm `@img/sharp-linux-riscv64` has 1 lines of code Location: Package overview From: package-lock.json → `npm/wrangler@4.133.0` → `npm/@img/sharp-linux-riscv64@0.35.4` ℹ Read more on: This package \| This alert \| What are trivial packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@img/sharp-linux-riscv64@0.35.4`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Trivial package: npm `@img/sharp-linux-s390x` has 1 lines of code Location: Package overview From: package-lock.json → `npm/wrangler@4.133.0` → `npm/@img/sharp-linux-s390x@0.35.4` ℹ Read more on: This package \| This alert \| What are trivial packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@img/sharp-linux-s390x@0.35.4`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Trivial package: npm `@img/sharp-linux-x64` has 1 lines of code Location: Package overview From: package-lock.json → `npm/wrangler@4.133.0` → `npm/@img/sharp-linux-x64@0.35.4` ℹ Read more on: This package \| This alert \| What are trivial packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@img/sharp-linux-x64@0.35.4`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Trivial package: npm `@img/sharp-linuxmusl-arm64` has 1 lines of code Location: Package overview From: package-lock.json → `npm/wrangler@4.133.0` → `npm/@img/sharp-linuxmusl-arm64@0.35.4` ℹ Read more on: This package \| This alert \| What are trivial packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@img/sharp-linuxmusl-arm64@0.35.4`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Trivial package: npm `@img/sharp-linuxmusl-x64` has 1 lines of code Location: Package overview From: package-lock.json → `npm/wrangler@4.133.0` → `npm/@img/sharp-linuxmusl-x64@0.35.4` ℹ Read more on: This package \| This alert \| What are trivial packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@img/sharp-linuxmusl-x64@0.35.4`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Network access: npm `@img/sharp-wasm32` in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: package-lock.json → `npm/wrangler@4.133.0` → `npm/@img/sharp-wasm32@0.35.4` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@img/sharp-wasm32@0.35.4`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Dynamic code execution: npm `@img/sharp-wasm32` Eval Type: Function Location: Package overview From: package-lock.json → `npm/wrangler@4.133.0` → `npm/@img/sharp-wasm32@0.35.4` ℹ Read more on: This package \| This alert \| What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@img/sharp-wasm32@0.35.4`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		System shell access: npm `detect-libc` in module child_process Module: child_process Location: Package overview From: package-lock.json → `npm/wrangler@4.133.0` → `npm/detect-libc@2.1.2` ℹ Read more on: This package \| This alert \| What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/detect-libc@2.1.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Dynamic code execution: npm `minimizer-webpack-plugin` Eval Type: Function Location: Package overview From: package-lock.json → `npm/react-scripts@5.0.1` → `npm/minimizer-webpack-plugin@5.10.1` ℹ Read more on: This package \| This alert \| What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/minimizer-webpack-plugin@5.10.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Potential security risk (AI signal): npm `rollup` is 70.0% likely risky Notes: This module is a dynamic Rollup configuration/plugin loader with high-impact code execution pathways. The most significant security concern is direct runtime evaluation of attacker-influenced strings via new Function() for plugin argument parsing, combined with dynamic require/import of plugin/config modules from user-controlled specifiers and execution of transpiled/generated config via require.extensions and module._compile. While no explicit stealthy malware behavior (e.g., network exfiltration) is visible in this snippet, the overall security risk is substantial if CLI options, config paths, or plugin specifiers are not strictly controlled/trusted. Confidence: 0.70 Severity: 0.78 From: package-lock.json → `npm/react-scripts@5.0.1` → `npm/rollup@2.80.0` ℹ Read more on: This package \| This alert \| What are AI-detected potential security risks? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/rollup@2.80.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		System shell access: npm `sharp` in module node:child_process Module: node:child_process Location: Package overview From: package-lock.json → `npm/wrangler@4.133.0` → `npm/sharp@0.35.4` ℹ Read more on: This package \| This alert \| What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/sharp@0.35.4`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Potential code anomaly (AI signal): npm `@babel/core` is 68.0% likely to have a medium risk anomaly Notes: The code defines a stack-trace manipulation utility that can selectively hide or reveal frames and inject synthetic frames into error traces. While not inherently malicious, its global alteration of Error.prepareStackTrace and stackTraceLimit enables obfuscation of error reporting and can hinder debugging or auditing. Use is advised with thorough documentation and restricted scope in security-sensitive environments. Confidence: 0.68 Severity: 0.60 From: package-lock.json → `npm/react-scripts@5.0.1` → `npm/@babel/core@7.29.7` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@babel/core@7.29.7`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Potential code anomaly (AI signal): npm `@babel/core` is 75.0% likely to have a medium risk anomaly Notes: The examined code is a standard, benign helper for constructing and wrapping configuration items from descriptors within Babel’s tooling. There is no evidence of data leakage, exfiltration, backdoors, or other malicious activity in this fragment. The combination of immutability, brand-based identity, and non-enumerable descriptor storage indicates a well-scoped internal utility rather than anything suspicious. Confidence: 0.75 Severity: 0.50 From: package-lock.json → `npm/react-scripts@5.0.1` → `npm/@babel/core@7.29.7` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@babel/core@7.29.7`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Potential code anomaly (AI signal): npm `@babel/helper-module-imports` is 78.0% likely to have a medium risk anomaly Notes: The analyzed code is a Babel AST helper (ImportBuilder) used to construct import statements and interop-wrapped imports. It contains no indicators of malicious behavior, data exfiltration, backdoors, or runtime abuses. It operates within a compiler/transpiler context to produce code, not to execute arbitrary user data. Therefore, the code itself does not present security risks or malware indicators under normal usage. This is benign library behavior intended for code transformation. Confidence: 0.78 Severity: 0.55 From: package-lock.json → `npm/react-scripts@5.0.1` → `npm/@babel/helper-module-imports@7.29.7` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@babel/helper-module-imports@7.29.7`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Potential code anomaly (AI signal): npm `@babel/helper-module-transforms` is 80.0% likely to have a medium risk anomaly Notes: The code is a legitimate, static-code transformation utility used in Babel to ensure proper behavior of ES module bindings after transforms. There is no evidence of malicious behavior, data leakage, or external communications within this fragment. It operates purely on AST-level transformations consistent with module import/export handling. Confidence: 0.80 Severity: 0.50 From: package-lock.json → `npm/react-scripts@5.0.1` → `npm/@babel/helper-module-transforms@7.29.7` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@babel/helper-module-transforms@7.29.7`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Potential code anomaly (AI signal): npm `@babel/helper-string-parser` is 78.0% likely to have a medium risk anomaly Notes: The analyzed code is a standard, well-structured parsing utility for JavaScript string literals and escapes (consistent with Babel’s helper-string-parser). It includes thorough validation, proper Unicode handling, and defensive error reporting. There is no evidence of malicious behavior, data leakage, or network activity within this fragment. The security risk is low when used as part of a trusted toolchain; the code otherwise poses no evident supply-chain threat based on the provided snippet. Confidence: 0.78 Severity: 0.55 From: package-lock.json → `npm/react-scripts@5.0.1` → `npm/@babel/helper-string-parser@7.29.7` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@babel/helper-string-parser@7.29.7`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Potential code anomaly (AI signal): npm `@babel/helpers` is 75.0% likely to have a medium risk anomaly Notes: The analyzed fragment is a conventional Babel/TypeScript-style decorators runtime (applyDecs) responsible for applying decorators to class members and managing metadata and initializers. There is no evidence of malware, backdoors, or external data leakage within this module. While complex, the code behaves as a metadata-driven decorator processor and should be considered low risk when used as intended. Downstream risks depend on the decorators provided by consumers, not this utility itself. Confidence: 0.75 Severity: 0.60 From: package-lock.json → `npm/react-scripts@5.0.1` → `npm/@babel/helpers@7.29.7` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@babel/helpers@7.29.7`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Potential code anomaly (AI signal): npm `@babel/helpers` is 61.0% likely to have a medium risk anomaly Notes: The code fragment is a standard Babel decorator runtime helper (applyDecs2203). Its security posture hinges on the trustworthiness of the supplied decorators. If decorators are from untrusted sources, they can execute arbitrary code during decoration or initialization. The library itself does not exhibit malicious behavior, but this pattern introduces a high-risk surface via external inputs. Recommended mitigations include validating decorator outputs, enforcing sandboxing or runner boundaries for decorators, and auditing decorator sources in the application. Confidence: 0.61 Severity: 0.58 From: package-lock.json → `npm/react-scripts@5.0.1` → `npm/@babel/helpers@7.29.7` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@babel/helpers@7.29.7`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
See 30 more rows in the dashboard

View full report

mackenly · 2026-09-16T23:27:25Z

Leaving for human review: group update includes undici 5.28.4→7.29.0 (major; same class as seed-rest-api undici bump).

Bot

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 16, 2026

mackenly merged commit a934ec8 into main Sep 17, 2026
2 of 3 checks passed

mackenly deleted the dependabot/npm_and_yarn/npm_and_yarn-be0e22777b branch September 17, 2026 13:13

Navigation Menu

Uh oh!

Bump the npm_and_yarn group across 1 directory with 27 updates - #28

Bump the npm_and_yarn group across 1 directory with 27 updates#28
mackenly merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-be0e22777b

dependabot Bot commented on behalf of github Sep 16, 2026

Uh oh!

socket-security Bot commented Sep 16, 2026

Uh oh!

socket-security Bot commented Sep 16, 2026

Uh oh!

mackenly commented Sep 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 16, 2026

3.114.17

Patch Changes

3.114.16

Patch Changes

v7.29.7 (2026-05-25)

v7.29.6 (2026-05-25)

🐛 Bug Fix

Committers: 3

v7.29.5 (2026-05-05)

🏠 Internal

v7.29.4 (2026-05-05)

🐛 Bug Fix

Committers: 1

v7.29.3 (2026-04-30)

👓 Spec Compliance

🐛 Bug Fix

💅 Polish

v7.29.8 (2026-07-31)

👓 Spec Compliance

🐛 Bug Fix

Committers: 2

v7.29.7 (2026-05-25)

v7.29.6 (2026-05-25)

🐛 Bug Fix

Committers: 3

v7.29.5 (2026-05-05)

🏠 Internal

v7.29.4 (2026-05-05)

🐛 Bug Fix

Committers: 1

3.15.2 - 2026-08-26

Changed

Security

3.15.1 - 2026-07-31

Security

3.15.0 - 2026-06-27

Added

[3.14.2] - 2025-11-15

Security

1.20.8

Important

What's Changed

1.20.7

What's Changed

1.20.6

Important: Security

What's Changed

v1.20.5

What's Changed

New Contributors

1.20.8

1.20.7

1.20.6

1.20.5

1.20.4

1.20.3

v1.1.15

v1.1.12

v1.1.15

v1.1.12

4.29.0

4.28.9

4.28.8

4.28.7

4.28.6

4.28.5

4.28.4

4.28.3

4.28.2

4.28.1

4.27.0

4.26.3

4.26.2

4.26.1

4.26.0

4.25.4

4.29.0