Bump the npm_and_yarn group across 1 directory with 14 updates by dependabot[bot] · Pull Request #4 · PlatziDev/markdown

dependabot · 2026-06-28T16:58:46Z

Bumps the npm_and_yarn group with 13 updates in the / directory:

Package	From	To
markdown-it	`8.3.1`	`14.2.0`
debug	`2.6.3`	`2.6.9`
diff	`3.2.0`	`3.5.1`
fsevents	`1.1.2`	`1.2.13`
handlebars	`4.0.6`	`4.7.9`
hosted-git-info	`2.4.1`	`2.8.9`
nwmatcher	`1.3.9`	`1.4.4`
path-parse	`1.0.5`	`1.0.7`
sshpk	`1.11.0`	`1.18.0`
stringstream	`0.0.5`	`0.0.6`
tmpl	`1.0.4`	`1.0.5`
y18n	`3.2.1`	`3.2.2`
yargs-parser	`5.0.0`	`5.0.1`

Updates markdown-it from 8.3.1 to 14.2.0

Changelog

Sourced from markdown-it's changelog.

[14.2.0] - 2026-05-24

Added

isPunctCharCode to utilities.

Fixed

Don't end HTML comment blocks on a blank line, #1155.

Properly recognize astral chars (surrogates) in delimiter scans for emphasis-like markers, #1072. Big thanks to @tats-u for his global efforts with improving CJK support.

Preserve unicode whitespaces when trimm headings/paragraphs, #1074.

More strict entities decode to avoid false positives ;, #1096.

Restore block parser state on fail in lheading rule, #1131.

Security

Fixed poor smartquotes perfomance on > 70k quotes in single block

Bumped linkify-it to 5.0.1 with fixed potential perfomance issues.

[14.1.1] - 2026-01-11

Security

Fixed regression from v13 in linkify inline rule. Specific patterns could cause high CPU use. Thanks to @ltduc147 for report.

[14.1.0] - 2024-03-19

Changed

Updated CM spec compatibility to 0.31.2, #1009.

Fixed

Fixed quadratic complexity when parsing references, #996.

Fixed quadratic output size with pathological user input in tables, #1000.

[14.0.0] - 2023-12-08

Changed

Drop ancient browsers support (use .fromCodePoint and other features).

Rewrite to ESM (including all plugins/deps). CJS fallback still available. No signatures changed, except markdown-it-emoji plugin.

Dropped dist/ folder from repo, build on package publish.

Set punicode.js as external dependency.

Fixed

Html tokens inside img alt are now rendered as their original text, #896.

Hardbreaks inside img alt are now rendered as newlines.

[13.0.2] - 2023-09-26

Security

Fixed crash/infinite loop caused by linkify inline rule, #957.

... (truncated)

Commits

829797a 14.2.0 released
9ce2087 Fix smartquotes perfomance
02e73b8 linkify-it bump
68cfb8c fix: don't end HTML comment blocks on a blank line (#1155)
1083137 Readme cleanup
97c7ca2 Update funding info
c471b55 Changelog update
7769621 isPunctChar => isPunctCharCode
aa2aa70 fix: always reset parentType in lheading rule (#1131)
59955f2 Polish PRs #1072, #1074
Additional commits viewable in compare view

Updates debug from 2.6.3 to 2.6.9

Release notes

Sourced from debug's releases.

2.6.9

Patches

Remove ReDoS regexp in %o formatter: #504

Credits

Huge thanks to @zhuangya for their help!

release 2.6.7

No release notes provided.

release 2.6.6

No release notes provided.

release 2.6.5

No release notes provided.

release 2.6.4

No release notes provided.

Changelog

Sourced from debug's changelog.

2.6.9 / 2017-09-22

remove ReDoS regexp in %o formatter (#504)

2.6.8 / 2017-05-18

Fix: Check for undefined on browser globals (#462, @marbemac)

2.6.7 / 2017-05-16

Fix: Update ms to 2.0.0 to fix regular expression denial of service vulnerability (#458, @hubdotcom)

Fix: Inline extend function in node implementation (#452, @dougwilson)

Docs: Fix typo (#455, @msasad)

2.6.5 / 2017-04-27

Fix: null reference check on window.documentElement.style.WebkitAppearance (#447, @thebigredgeek)

Misc: clean up browser reference checks (#447, @thebigredgeek)

Misc: add npm-debug.log to .gitignore (@thebigredgeek)

2.6.4 / 2017-04-20

Fix: bug that would occure if process.env.DEBUG is a non-string value. (#444, @LucianBuzzo)

Chore: ignore bower.json in npm installations. (#437, @joaovieira)

Misc: update "ms" to v0.7.3 (@tootallnate)

Commits

13abeae Release 2.6.9
f53962e remove ReDoS regexp in %o formatter (#504)
52e1f21 Release 2.6.8
2482e08 Check for undefined on browser globals (#462)
6bb07f7 release 2.6.7
15850cb Fix Regular Expression Denial of Service (ReDoS)
4a6c85c update "debug" to v1.0.0 (#454)
b68dbf8 Fix typo (#455)
1351d2f Inline extend function in node implementation (#452)
c211947 update version for component
Additional commits viewable in compare view

Updates diff from 3.2.0 to 3.5.1

Changelog

Sourced from diff's changelog.

v3.5.1 - January 2026

Only change from 3.5.0 is a backport of the fix to GHSA-73rr-hh4g-fpgx.

v3.5.0 - March 4th, 2018

Omit redundant slice in join method of diffArrays - 1023590

Support patches with empty lines - fb0f208

Accept a custom JSON replacer function for JSON diffing - 69c7f0a

Optimize parch header parser - 2aec429

Fix typos - e89c832

Commits

v3.4.0 - October 7th, 2017

#183 - Feature request: ability to specify a custom equality checker for diffArrays

#173 - Bug: diffArrays gives wrong result on array of booleans

#158 - diffArrays will not compare the empty string in array?

comparator for custom equality checks - 30e141e

count oldLines and newLines when there are conflicts - 53bf384

Fix: diffArrays can compare falsey items - 9e24284

Docs: Replace grunt with npm test - 00e2f94

Commits

v3.3.1 - September 3rd, 2017

#141 - Cannot apply patch because my file delimiter is "/r/n" instead of "/n"

#192 - Fix: Bad merge when adding new files (#189)

correct spelling mistake - 21fa478

Commits

v3.3.0 - July 5th, 2017

#114 - /patch/merge not exported

Gracefully accept invalid newStart in hunks, same as patch(1) does. - d8a3635

Use regex rather than starts/ends with for parsePatch - 6cab62c

Add browser flag - e64f674

refactor: simplified code a bit more - 8f8e0f2

refactor: simplified code a bit - b094a6f

fix: some corrections re ignoreCase option - 3c78fd0

ignoreCase option - 3cbfbb5

Sanitize filename while parsing patches - 2fe8129

Added better installation methods - aced50b

Simple export of functionality - 8690f31

Commits

Commits

e8bb422 v3.5.1
2f5bf5e Backport kpdecker/jsdiff#649
c9f00db Backport kpdecker/jsdiff#647
e9ab948 v3.5.0
b73884c Update release notes
8953021 Update release notes
1023590 Omit redundant slice in join method of diffArrays
c72ef4a Add missing test coverage
b9ef24f Support patches with empty lines
10aaabb Support patches with empty lines
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by explodingcabbage, a new releaser for diff since your current version.

Updates fsevents from 1.1.2 to 1.2.13

Release notes

Sourced from fsevents's releases.

Release v1.2.13

Only build on Mac-OSX

Release v1.2.11

Removing node-pre-gyp so that building fsevents becomes easier and enabled without the download of binaries.

The credentials to the AWS store have been lost. Releasing to AWS is both insecure and no longer possible due to the lost credentials.

Intermediate Release

No release notes provided.

Release v1.2.9 - Node v12 compatibility

No release notes provided.

Release Pre-NAPI v1.2.8

No release notes provided.

Version Bump (bundle node-pre-gyp)

No release notes provided.

Prebuilt v11.x

No release notes provided.

v1.2.3

Added node v10 for pre-built binaries

C++ tuning to fix potential SIGILL and cyclic dependency (#204)

v1.2.2

Fixed node-pre-gyp bundling issue

v1.2.1

[unpublished because of errors during publish process]

v1.2.0

BREAKING: End support for Node v0.12. If you are using Node v0.12 please pin your fsevents dependencies to v1.1.3. Not bumping semver major for this release was a compromise solution discussed in #199 and #201.

Node v0.10 should continue to work with local compilation for now, but hosted pre-built binaries will no longer be provided. If this is a constraint for you, please pin to an earlier version.

Fixed security vulnerability warnings by updating node-pre-gyp to ^0.9.0

Compatibility updates for nan v2.9.0

v1.1.3

Added node v9 for pre-built binaries

Fixed bug related to using --no-bin-links option on install

Updated node-pre-gyp to latest version (0.6.39)

Commits

844a05d Version Bump
f393f2a Only build fsevents on macOS (#322)
6a281a7 [publish binary]
acc2bce [publish binary]
f532b6e [publish binary]
4c6a1c0 Add node 13 to travis matrix.
92e40aa Release 1.2.12.
909af26 Release v1.2.11
7074adb Release v1.2.10
0a052f6 Node.js v12 support for v1.x (#274)
Additional commits viewable in compare view

Updates handlebars from 4.0.6 to 4.7.9

Release notes

Sourced from handlebars's releases.

v4.7.9

fix: enable shell mode for spawn to resolve Windows EINVAL issue - e0137c2

fix type "RuntimeOptions" also accepting string partials - eab1d14

feat(types): set hash to be a Record<string, any> - de4414d

fix non-contiguous program indices - 4512766

refactor: rename i to startPartIndex - e497a35

security: fix security issues - 68d8df5

GHSA-2w6w-674q-4c4q

GHSA-3mfm-83xf-c92r

GHSA-xhpv-hc6g-r9c6

GHSA-xjpj-3mr7-gcpf

GHSA-9cx6-37pm-9jff

GHSA-2qvq-rjwj-gvw9

GHSA-7rx3-28cr-v5wh

GHSA-442j-39wm-28r2

Commits

v4.7.8

Make library compatible with workers (#1894) - 3d3796c

Don't rely on Node.js global object (#1776) - 2954e7e

Fix compiling of each block params in strict mode (#1855) - 30dbf04

Fix rollup warning when importing Handlebars as ESM - 03d387b

Fix bundler issue with webpack 5 (#1862) - c6c6bbb

Use https instead of git for mustache submodule - 88ac068

Commits

Changelog

Sourced from handlebars's changelog.

v4.7.9 - March 26th, 2026

fix: enable shell mode for spawn to resolve Windows EINVAL issue - e0137c2

fix type "RuntimeOptions" also accepting string partials - eab1d14

feat(types): set hash to be a Record<string, any> - de4414d

fix non-contiguous program indices - 4512766

refactor: rename i to startPartIndex - e497a35

security: fix security issues - 68d8df5

Commits

v4.7.8 - July 27th, 2023

Make library compatible with workers (#1894) - 3d3796c

Don't rely on Node.js global object (#1776) - 2954e7e

Fix compiling of each block params in strict mode (#1855) - 30dbf04

Fix rollup warning when importing Handlebars as ESM - 03d387b

Fix bundler issue with webpack 5 (#1862) - c6c6bbb

Use https instead of git for mustache submodule - 88ac068

Commits

v4.7.7 - February 15th, 2021

fix weird error in integration tests - eb860c0

fix: check prototype property access in strict-mode (#1736) - b6d3de7

fix: escape property names in compat mode (#1736) - f058970

refactor: In spec tests, use expectTemplate over equals and shouldThrow (#1683) - 77825f8

chore: start testing on Node.js 12 and 13 - 3789a30

(POSSIBLY) BREAKING CHANGES:

the changes from version 4.6.0 now also apply in when using the compile-option "strict: true". Access to prototype properties is forbidden completely by default, specific properties or methods can be allowed via runtime-options. See #1633 for details. If you are using Handlebars as documented, you should not be accessing prototype properties from your template anyway, so the changes should not be a problem for you. Only the use of undocumented features can break your build.

That is why we only bump the patch version despite mentioning breaking changes.

Commits

v4.7.6 - April 3rd, 2020

Chore/Housekeeping:

#1672 - Switch cmd parser to latest minimist (@dougwilson

Compatibility notes:

Restored Node.js compatibility

... (truncated)

Commits

dce542c v4.7.9
8a41389 Update release notes
68d8df5 Fix security issues
b2a0831 Fix browser tests
9f98c16 Fix release script
45443b4 Revert "Improve partial indenting performance"
8841a5f Fix CI errors with linting
e0137c2 fix: enable shell mode for spawn to resolve Windows EINVAL issue
e914d60 Improve rendering performance
7de4b41 Upgrade GitHub Actions checkout and setup-node on 4.x branch
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by jaylinski, a new releaser for handlebars since your current version.

Updates hosted-git-info from 2.4.1 to 2.8.9

Changelog

Sourced from hosted-git-info's changelog.

2.8.9 (2021-04-07)

Bug Fixes

backport regex fix from #76 (29adfe5), closes #84

2.8.8 (2020-02-29)

Bug Fixes

#61 & #65 addressing issues w/ url.URL implmentation which regressed node 6 support (5038b18), closes #66

2.8.7 (2020-02-26)

Bug Fixes

Do not attempt to use url.URL when unavailable (2d0bb66), closes #61 #62

Do not pass scp-style URLs to the WhatWG url.URL (f2cdfcf), closes #60

2.8.6 (2020-02-25)

2.8.5 (2019-10-07)

Bug Fixes

updated pathmatch for gitlab (e8325b5), closes #51

updated pathmatch for gitlab (ffe056f)

2.8.4 (2019-08-12)

... (truncated)

Commits

8d4b369 chore(release): 2.8.9
29adfe5 fix: backport regex fix from #76
afeaefd chore(release): 2.8.8
5038b18 fix: #61 & #65 addressing issues w/ url.URL implmentation which regressed nod...
7440afa chore(release): 2.8.7
2d0bb66 fix: Do not attempt to use url.URL when unavailable
f2cdfcf fix: Do not pass scp-style URLs to the WhatWG url.URL
e1b83df chore(release): 2.8.6
ff259a6 Ensure passwords in hosted Git URLs are correctly escaped
624fd6f chore(release): 2.8.5
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by nlf, a new releaser for hosted-git-info since your current version.

Updates ms from 0.7.2 to 2.0.0

Release notes

Sourced from ms's releases.

2.0.0

Major Changes

Limit str to 100 to avoid ReDoS of 0.3s: #89

Patches

Ignored logs coming from npm: b1eaab752203e978492a4d540a7ae1d26e6306b1

Bumped dependencies to the latest version: bcf57157678fd5afc691383145a35e116f9704d0

Invalidated cache for slack badge: 94b995c1d6d5d13ec976a0c6849a3cca9b277e6b

Credits

Huge thanks to @karenyavine for their help!

1.0.0

Major Changes

Removed component specification: 1fbbe974cdcad96e592dcb65a7b2a8649f690420

Patches

Test on LTS version of Node: c9b1fd319f0f9198d85ecf4ba83e46cc1216be04

Removed XO: 94068ea6d518387670df277f740b1abada80ed48

Use prettier and eslint: 57b3ef8e3423cae6254f94c5564a11b4492cff43

Badge for XO removed: 389840b329436117741b2ef13a172725082695b9

Removed browser testing: e818c3581aca3119c00d81901bfe8fe653bcfda4

More suitable name for file containing tests: ee91f307a8dc3581ebdad614ec0533ddb3d8bf56

0.7.3

Patches

Mark "options" param as optional in jsdoc: #77

Lowercased text files: 5f0653ab192a30301aed8668b4588a87975b41ab

Pinned dependencies: 126d7f094a1836b991c8d0abfeb4d0ce09ac280f

Chore(package): update serve to version 5.0.1: #81

Credits

Huge thanks to @Jokero for their help!

Commits

9b88d15 2.0.0
94b995c Invalidated cache for slack badge
bcf5715 Bumped dependencies to the latest version
b1eaab7 Ignored logs coming from npm
caae298 Limit str to 100 to avoid ReDoS of 0.3s (#89)
b83b36d chore(package): update eslint to version 3.19.0 (#88)
3f2a4d7 chore(package): update husky to version 0.13.3 (#86)
7daf984 1.0.0
ee91f30 More suitable name for file containing tests
e818c35 Removed browser testing
Additional commits viewable in compare view

Updates nwmatcher from 1.3.9 to 1.4.4

Release notes

Sourced from nwmatcher's releases.

A fast CSS selector engine and matcher

This release has correction/fixes for the following behaviours:

fixed DOM walking to avoid using unsupported DOM methods on non 'Elements' nodes

improved DOM walking performances in JS only versions using the native traversal API

A fast CSS selector engine and matcher

This release has correction/fixes for the following behaviours:

always use case sensitive match for class attributes selectors to mimic browsers behaviour

removed attribute mapping (XHTML_TABLE) used for case sensitive match in XML documents

always use case sensitive match for class attributes selectors in XML documents

specifications amended due to bug submitted by @zirro whatwg/html@97ca4ed

A fast CSS selector engine and matcher

This release has correction/fixes for the following behaviours:

several performance improvements and code clean up

accepts and correctly resolves single character attribute names

allow syntax parsing of :after, :before and other pseudo-elements

added a shunt flag to also mute logging of errors/warnings to the console

added support for escaped numbers & characters in CSS identifiers (v1.3.9)

fix :not() negation pseudo-class containing nested pseudo-classes (v1.3.8)

fix long invalid selectors can cause match() to hang forever (v1.3.7)

fix incorrect regular expression pattern for combinators issue (v1.3.7)

Commits

See full diff in compare view

Updates path-parse from 1.0.5 to 1.0.7

Commits

See full diff in compare view

Updates sshpk from 1.11.0 to 1.18.0

Release notes

Sourced from sshpk's releases.

v1.18.0

What's Changed

Add support for ed25519 private keys in pkcs8 by @teutat3s in TritonDataCenter/node-sshpk#92

New Contributors

@teutat3s made their first contribution in TritonDataCenter/node-sshpk#92

Full Changelog: TritonDataCenter/node-sshpk@v1.17.0...v1.18.0

v1.17.0

What's Changed

TOOLS-2101 jsstyle submodules too old for old perls by @cburroughs in TritonDataCenter/node-sshpk#65

TRITON-1943 add Jenkinsfiles to Triton repositories by @cburroughs in TritonDataCenter/node-sshpk#64

MANTA-4808 jenkins-joylib notifications should include "mantav1" branch builds by @trentm in TritonDataCenter/node-sshpk#66

TRITON-2254 Change joyMattermostNotification to joySlackNotifications by @bahamat in TritonDataCenter/node-sshpk#77

node-sshpk#27 PuTTY private key support by @Eugeny in TritonDataCenter/node-sshpk#76

node-sshpk#27 prep for release by @bahamat in TritonDataCenter/node-sshpk#79

Full Changelog: TritonDataCenter/node-sshpk@v1.16.1...v1.17.0

v1.16.1

Fixes for #60 (correctly encoding certificates with expiry dates >=2050), #62 (accepting PKCS#8 EC private keys with missing public key parts)

v1.16.0

Add support for SPKI fingerprints, PuTTY PPK format (public-key only for now), PKCS#8 PBKDF2 encrypted private keys

Fix for #48

v1.15.2

New API for accessing x509 extensions in certificates

Fixes for #52, #50

v1.14.1

Remove all remaining usage of jodid25519 (abandoned dep)

Add support for DNSSEC key format

Add support for Ed25519 keys in PEM format (according to draft-curdle-pkix)

Fixes for X.509 encoding issues (asn.1 NULLs in RSA certs, cert string type mangling)

Performance issues parsing long SSH public keys

v1.13.0

Support SSH-format rsa-sha2-256 signatures (e.g. so the SSH agent can sign using RSA-SHA256)

v1.12.0

Support for generating ECDSA keys using generatePrivateKey()

Minimum for sshpk-agent to be able to sign new certificates using an agent key

Commits

8df0385 Add support for ed25519 private keys in pkcs8 (#92)
3e83664 node-sshpk#27 prep for release (#79)
1da5a87 node-sshpk#27 PuTTY private key support (#76)
85f3c4e TRITON-2254 Change joyMattermostNotification to joySlackNotifications (#77)
4342c21 MANTA-4808 jenkins-joylib notifications should include "mantav1" branch build...
cb8c666 TRITON-1943 add Jenkinsfiles to Triton repositories (#64)
e97ab59 TOOLS-2101 jsstyle submodules too old for old perls (#65)
1aece0d joyent/node-sshpk#60 certs should generate GeneralizedTime values for dates >...
684dbe6 joyent/node-sshpk#62 handle pkcs8 ECDSA keys with missing public parts
574ff21 joyent/node-sshpk#18 support for PKCS8 encrypted private keys
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by bahamat, a new releaser for sshpk since your current version.

Updates stringstream from 0.0.5 to 0.0.6

Commits

fee31c5 0.0.6
2f4a9d4 Merge pull request #9 from mhart/fix-buffer-constructor-vuln
afbc744 Ensure data is not a number in Buffer constructor
See full diff in compare view

Updates tmpl from 1.0.4 to 1.0.5

Commits

See full diff in compare view

Updates y18n from 3.2.1 to 3.2.2

Release notes

Sourced from y18n's releases.

y18n y18n-v4.0.3

Bug Fixes

release: 4.x.x should not enforce Node 10 (#126) (1e21a53)

y18n y18n-v4.0.2

Bug Fixes

security: ensure entry exists for backport (#120) (b22c0df)

Commits

See full diff in compare view

Maintainer changes

This version was pushed to npm by oss-bot, a new releaser for y18n since your current version.

Updates yargs-parser from 5.0.0 to 5.0.1

Changelog

Sourced from yargs-parser's changelog.

5.0.0 (2017-02-18)

Bug Fixes

environment variables should take precedence over config file (#81) (76cee1f)

BREAKING CHANGES

environment variables will now override config files (args, env, config-file, config-object)

5.0.1 (2021-03-10)

Bug Fixes

security: address GHSA-p9pc-299p-vxgp (#362) (1c417bd)

4.2.1 (2017-01-02)

Bug Fixes

flatten/duplicate regression (#75) (68d68a0)

4.2.0 (2016-12-01)

Bug Fixes

inner objects in configs had their keys appended to top-level key when dot-notation was disabled (#72) (0b1b5f9)

Features

allow multiple arrays to be provided, rather than always combining (#71) (0f0fb2d)

4.1.0 (2016-11-07)

... (truncated)

Commits

eab6c03 chore: release 5.0.1 (#363)
1c417bd fix(security): address GHSA-p9pc-299p-vxgp (#362)
e93a345 chore: mark release in commit history (#361)
ee15863 chore: push new package version
4774207 fix: back-porting prototype fixes for really old version (#271)
See full diff in compare view

Maintainer changes

This version was pushed to npm by oss-bot, a new releaser for yargs-parser since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the npm_and_yarn group with 13 updates in the / directory: | Package | From | To | | --- | --- | --- | | [markdown-it](https://github.com/markdown-it/markdown-it) | `8.3.1` | `14.2.0` | | [debug](https://github.com/debug-js/debug) | `2.6.3` | `2.6.9` | | [diff](https://github.com/kpdecker/jsdiff) | `3.2.0` | `3.5.1` | | [fsevents](https://github.com/fsevents/fsevents) | `1.1.2` | `1.2.13` | | [handlebars](https://github.com/handlebars-lang/handlebars.js) | `4.0.6` | `4.7.9` | | [hosted-git-info](https://github.com/npm/hosted-git-info) | `2.4.1` | `2.8.9` | | [nwmatcher](https://github.com/dperini/nwmatcher) | `1.3.9` | `1.4.4` | | [path-parse](https://github.com/jbgutierrez/path-parse) | `1.0.5` | `1.0.7` | | [sshpk](https://github.com/joyent/node-sshpk) | `1.11.0` | `1.18.0` | | [stringstream](https://github.com/mhart/StringStream) | `0.0.5` | `0.0.6` | | [tmpl](https://github.com/daaku/nodejs-tmpl) | `1.0.4` | `1.0.5` | | [y18n](https://github.com/yargs/y18n) | `3.2.1` | `3.2.2` | | [yargs-parser](https://github.com/yargs/yargs-parser) | `5.0.0` | `5.0.1` | Updates `markdown-it` from 8.3.1 to 14.2.0 - [Changelog](https://github.com/markdown-it/markdown-it/blob/master/CHANGELOG.md) - [Commits](markdown-it/markdown-it@8.3.1...14.2.0) Updates `debug` from 2.6.3 to 2.6.9 - [Release notes](https://github.com/debug-js/debug/releases) - [Changelog](https://github.com/debug-js/debug/blob/2.6.9/CHANGELOG.md) - [Commits](debug-js/debug@2.6.3...2.6.9) Updates `diff` from 3.2.0 to 3.5.1 - [Changelog](https://github.com/kpdecker/jsdiff/blob/master/release-notes.md) - [Commits](kpdecker/jsdiff@v3.2.0...v3.5.1) Updates `fsevents` from 1.1.2 to 1.2.13 - [Release notes](https://github.com/fsevents/fsevents/releases) - [Commits](fsevents/fsevents@v1.1.2...v1.2.13) Updates `handlebars` from 4.0.6 to 4.7.9 - [Release notes](https://github.com/handlebars-lang/handlebars.js/releases) - [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/v4.7.9/release-notes.md) - [Commits](handlebars-lang/handlebars.js@v4.0.6...v4.7.9) Updates `hosted-git-info` from 2.4.1 to 2.8.9 - [Release notes](https://github.com/npm/hosted-git-info/releases) - [Changelog](https://github.com/npm/hosted-git-info/blob/v2.8.9/CHANGELOG.md) - [Commits](npm/hosted-git-info@v2.4.1...v2.8.9) Updates `ms` from 0.7.2 to 2.0.0 - [Release notes](https://github.com/vercel/ms/releases) - [Commits](vercel/ms@0.7.2...2.0.0) Updates `nwmatcher` from 1.3.9 to 1.4.4 - [Release notes](https://github.com/dperini/nwmatcher/releases) - [Commits](https://github.com/dperini/nwmatcher/commits) Updates `path-parse` from 1.0.5 to 1.0.7 - [Commits](https://github.com/jbgutierrez/path-parse/commits/v1.0.7) Updates `sshpk` from 1.11.0 to 1.18.0 - [Release notes](https://github.com/joyent/node-sshpk/releases) - [Commits](TritonDataCenter/node-sshpk@v1.11.0...v1.18.0) Updates `stringstream` from 0.0.5 to 0.0.6 - [Commits](mhart/StringStream@v0.0.5...v0.0.6) Updates `tmpl` from 1.0.4 to 1.0.5 - [Commits](https://github.com/daaku/nodejs-tmpl/commits/v1.0.5) Updates `y18n` from 3.2.1 to 3.2.2 - [Release notes](https://github.com/yargs/y18n/releases) - [Changelog](https://github.com/yargs/y18n/blob/master/CHANGELOG.md) - [Commits](https://github.com/yargs/y18n/commits) Updates `yargs-parser` from 5.0.0 to 5.0.1 - [Release notes](https://github.com/yargs/yargs-parser/releases) - [Changelog](https://github.com/yargs/yargs-parser/blob/v5.0.1/CHANGELOG.md) - [Commits](yargs/yargs-parser@v5.0.0...v5.0.1) --- updated-dependencies: - dependency-name: markdown-it dependency-version: 14.2.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: debug dependency-version: 2.6.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: diff dependency-version: 3.5.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fsevents dependency-version: 1.2.13 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: handlebars dependency-version: 4.7.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: hosted-git-info dependency-version: 2.8.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ms dependency-version: 2.0.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: nwmatcher dependency-version: 1.4.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: path-parse dependency-version: 1.0.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: sshpk dependency-version: 1.18.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: stringstream dependency-version: 0.0.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tmpl dependency-version: 1.0.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: y18n dependency-version: 3.2.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: yargs-parser dependency-version: 5.0.1 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 28, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump the npm_and_yarn group across 1 directory with 14 updates#4

Bump the npm_and_yarn group across 1 directory with 14 updates#4
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/npm_and_yarn-c6783a7ed8

dependabot Bot commented on behalf of github Jun 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jun 28, 2026

[14.2.0] - 2026-05-24

Added

Fixed

Security

[14.1.1] - 2026-01-11

Security

[14.1.0] - 2024-03-19

Changed

Fixed

[14.0.0] - 2023-12-08

Changed

Fixed

[13.0.2] - 2023-09-26

Security

2.6.9

Patches

Credits

release 2.6.7

release 2.6.6

release 2.6.5

release 2.6.4

2.6.9 / 2017-09-22

2.6.8 / 2017-05-18

2.6.7 / 2017-05-16

2.6.5 / 2017-04-27

2.6.4 / 2017-04-20

v3.5.1 - January 2026

v3.5.0 - March 4th, 2018

v3.4.0 - October 7th, 2017

v3.3.1 - September 3rd, 2017

v3.3.0 - July 5th, 2017

Release v1.2.13

Release v1.2.11

Intermediate Release

Release v1.2.9 - Node v12 compatibility

Release Pre-NAPI v1.2.8

Version Bump (bundle node-pre-gyp)

Prebuilt v11.x

v1.2.3

v1.2.2

v1.2.1

v1.2.0

v1.1.3

v4.7.9

v4.7.8

v4.7.9 - March 26th, 2026

v4.7.8 - July 27th, 2023

v4.7.7 - February 15th, 2021

v4.7.6 - April 3rd, 2020

2.8.9 (2021-04-07)

Bug Fixes

2.8.8 (2020-02-29)

Bug Fixes

2.8.7 (2020-02-26)

Bug Fixes

2.8.6 (2020-02-25)

2.8.5 (2019-10-07)

Bug Fixes

2.8.4 (2019-08-12)

2.0.0

Major Changes

Patches

Credits

1.0.0

Major Changes

Patches

0.7.3

Patches

Credits

A fast CSS selector engine and matcher

A fast CSS selector engine and matcher

A fast CSS selector engine and matcher

v1.18.0

What's Changed

New Contributors

v1.17.0

What's Changed