Bump the npm_and_yarn group across 1 directory with 25 updates

[dependabot]

Bumps the npm_and_yarn group with 20 updates in the / directory:

Package	From	To
rollup	2.79.1	2.80.0
koa	2.13.4	3.1.2
playwright	1.28.1	1.59.1
ws	7.5.9	7.5.10
ws	8.14.2	8.20.0
@tootallnate/once	1.1.2	removed
brace-expansion	2.0.1	2.1.0
brace-expansion	1.1.11	1.1.14
braces	3.0.2	3.0.3
diff	5.1.0	5.2.2
ejs	3.1.9	3.1.10
minimatch	9.0.3	9.0.9
minimatch	5.1.6	5.1.9
minimatch	3.1.2	3.1.5
handlebars	4.7.7	4.7.9
ip	1.1.8	removed
js-yaml	3.14.1	3.14.2
liquidjs	10.7.1	10.25.7
micromatch	4.0.5	4.0.8
node-forge	1.3.1	1.4.0
picomatch	2.3.1	2.3.2
pug	3.0.2	3.0.4
qs	6.11.2	6.15.1
undici	5.21.0	6.24.1

Updates rollup from 2.79.1 to 2.80.0

Release notes

Sourced from rollup's releases.

v.2.79.2

2.79.2

2024-09-26

Bug Fixes

• Fix a vulnerability in generated code that affects IIFE, UMD and CJS bundles when run in a browser context (#5671)

Pull Requests

• #5671: Fix DOM Clobbering CVE (@​lukastaegert)

Changelog

Sourced from rollup's changelog.

2.80.0

2026-02-22

Features

• Throw when the generated bundle contains paths that would leave the output directory (#6277)

Pull Requests

• #6277: Validate bundle stays within output dir (@​lukastaegert)

2.79.2

2024-09-26

Bug Fixes

• Resolve CVE-2024-43788 (#5677)

Pull Requests

• #5677: resolve DOM Clobbering CVE-2024-43788 (backport to v2) (@​fabianszabo)

Commits

• d17ae15 2.80.0
• d6dee5e Validate bundle stays within output dir (#6277)
• c9bd03d 2.79.2
• 48aef33 fix: resolve DOM Clobbering CVE-2024-43788 (backport to v2) (#5677)
• See full diff in compare view

Updates koa from 2.13.4 to 3.1.2

Release notes

Sourced from koa's releases.

v3.1.2

What's Changed

• fix: typo in troubleshooting.md by @​WuMingDao in koajs/koa#1916
• build(deps-dev): bump qs from 6.14.0 to 6.14.1 by @​dependabot[bot] in koajs/koa#1921
• build(deps): bump http-errors from 2.0.0 to 2.0.1 by @​dependabot[bot] in koajs/koa#1919
• build(deps): bump mime-types from 3.0.1 to 3.0.2 by @​dependabot[bot] in koajs/koa#1918
• docs: use correct term "Server-Sent Events" in guide by @​jtr860830 in koajs/koa#1920
• build(deps): bump content-disposition from 0.5.4 to 1.0.1 by @​dependabot[bot] in koajs/koa#1917
• build(deps-dev): bump js-yaml from 4.1.0 to 4.1.1 by @​dependabot[bot] in koajs/koa#1922
• fix(security): Host Header Injection via ctx.hostname by @​killagu GHSA-7gcc-r8m5-44qm

New Contributors

• @​WuMingDao made their first contribution in koajs/koa#1916
• @​jtr860830 made their first contribution in koajs/koa#1920

Full Changelog: koajs/koa@v3.1.1...v3.1.2

v3.1.1

What's Changed

• fix: only original value destroy if the new value is not a stream by @​yowainwright in koajs/koa#1914

Full Changelog: koajs/koa@v3.1.0...v3.1.1

v3.1.0

What's Changed

• feat: fixes mem leak relating to issue-1834 by @​yowainwright in koajs/koa#1893
• fix: adds steam clean up by @​yowainwright in koajs/koa#1910

Full Changelog: koajs/koa@v3.0.3...v3.1.0

v3.0.3

What's Changed

• fix: normalize referer before redirect by @​fengmk2 in koajs/koa#1908

Full Changelog: koajs/koa@v3.0.2...v3.0.3

v3.0.2

What's Changed

• fix: fixes response.attachment behaviour leads to Content-Type Sniffing by @​yowainwright in koajs/koa#1904
• chore: use NPM trusted publishing with semver tag triggers by @​Copilot in koajs/koa#1907

New Contributors

• @​Copilot made their first contribution in koajs/koa#1907

Full Changelog: koajs/koa@v3.0.1...v3.0.2

v3.0.1

... (truncated)

Changelog

Sourced from koa's changelog.

[!IMPORTANT] Moving forwards we are using the GitHub releases page at https://github.com/koajs/koa/releases in combination with np for publishing releases and their changelogs.

---

3.0.0-alpha.3 / 2025-02-11

fixes

• Avoid redos on host and protocol getter

3.0.0-alpha.2 / 2024-11-04

breaking changes

• Update http-errors to v2.0.0 #1486
  • ctx.throw now requires a format of ctx.throw(status, error, properties). See: https://www.npmjs.com/package/http-errors
• Remove res.redirect('back'), add back() method to ctx #1115
• Replace node querystring with URLSearchParams #1828
• Remove obsolete createAsyncCtxStorageMiddleware #1817

features

• Add support for web WHATWG #1830

updates

• Update cookies to ~0.9.1 #1846
• Update statuses to ^2.0.1
• Update supertest to ^7.0.0 #1841

fixes

• Fix exports.defaults in package.json #1630
• Fix leaky handles in tests #1838
• Fix body null checks #1814
• Fix reformatting redirect URLs #1805 #1804
• Fix passing ctx in error handler #1758

migrations

• Migrate from jest to the native node test runner #1845

3.0.0-alpha.1 / 2023-04-12

fixes

• [e98b8d1] - fix: can not get currentContext in error handler (#1758) (Gxkl <gxkl203@gmail.com>)

3.0.0-alpha.0 / 2023-01-02

Breaking Changes

... (truncated)

Commits

• c5a52e0 3.1.2
• 55ab9ba Merge commit from fork
• fecd464 build(deps-dev): bump js-yaml from 4.1.0 to 4.1.1 (#1922)
• d2066cf build(deps): bump content-disposition from 0.5.4 to 1.0.1 (#1917)
• 8694a06 docs: use correct term "Server-Sent Events" in guide (#1920)
• 096682b build(deps): bump mime-types from 3.0.1 to 3.0.2 (#1918)
• 8215c2e build(deps): bump http-errors from 2.0.0 to 2.0.1 (#1919)
• cfe5ec6 build(deps-dev): bump qs from 6.14.0 to 6.14.1 (#1921)
• 0a6afa5 fix: typo in troubleshooting.md (#1916)
• 2e52fb5 3.1.1
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for koa since your current version.

Updates playwright from 1.28.1 to 1.59.1

Release notes

Sourced from playwright's releases.

v1.59.1

Bug Fixes

• [Windows] Reverted hiding console window when spawning browser processes, which caused regressions including broken codegen, --ui and show commands (#39990)

v1.59.0

🎬 Screencast

New page.screencast API provides a unified interface for capturing page content with:

• Screencast recordings
• Action annotations
• Visual overlays
• Real-time frame capture
• Agentic video receipts

Screencast recording — record video with precise start/stop control, as an alternative to the recordVideo option:

await page.screencast.start({ path: 'video.webm' });
// ... perform actions ...
await page.screencast.stop();

Action annotations — enable built-in visual annotations that highlight interacted elements and display action titles during recording:

await page.screencast.showActions({ position: 'top-right' });

screencast.showActions() accepts position ('top-left', 'top', 'top-right', 'bottom-left', 'bottom', 'bottom-right'), duration (ms per annotation), and fontSize (px). Returns a disposable to stop showing actions.

Action annotations can also be enabled in test fixtures via the video option:

// playwright.config.ts
export default defineConfig({
  use: {
    video: {
      mode: 'on',
      show: {
        actions: { position: 'top-left' },
        test: { position: 'top-right' },
      },
</tr></table> 

... (truncated)

Commits

• d466ac5 chore: mark v1.59.1 (#40005)
• 530e7e5 cherry-pick(#4004): fix(cli): kill-all should kill dashboard
• 9aa216c cherry-pick(#39994): Revert "fix(windows): hide console window when spawning ...
• 01b2b15 cherry-pick(#39980): chore: more release notes fixes
• a5cb6c9 cherry-pick(#39972): chore: expose browser.bind and browser.unbind APIs
• 99a17b5 cherry-pick(#39975): chore: support opening .trace files via .link indirection
• 43607c3 cherry-pick(#39974): chore(webkit): update Safari user-agent version to 26.4
• 62cabe1 cherry-pick(#39969): chore(npm): include all *.md from lib (#39970)
• 0c65a75 cherry-pick(#39968): chore: screencast.showActions api
• f04155b cherry-pick(#39958): chore: release notes for langs v1.59
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for playwright since your current version.

Updates ws from 7.5.9 to 7.5.10

Release notes

Sourced from ws's releases.

7.5.10

Bug fixes

• Backported e55e5106 to the 7.x release line (22c28763).

Commits

• d962d70 [dist] 7.5.10
• 22c2876 [security] Fix crash when the Upgrade header cannot be read (#2231)
• See full diff in compare view

Updates ws from 8.14.2 to 8.20.0

Release notes

Sourced from ws's releases.

7.5.10

Bug fixes

• Backported e55e5106 to the 7.x release line (22c28763).

Commits

• d962d70 [dist] 7.5.10
• 22c2876 [security] Fix crash when the Upgrade header cannot be read (#2231)
• See full diff in compare view

Updates @octokit/plugin-paginate-rest from 2.18.0 to 14.0.0

Release notes

Sourced from @​octokit/plugin-paginate-rest's releases.

v14.0.0

14.0.0 (2025-10-31)

Features

• add immutable releases, enterprise team membership, enterprise team organization endpoints (413e899)

BREAKING CHANGES

• Remove GET /projects/{project_id}/columns
• Remove GET /enterprises/{enterprise}/secret-scanning/alerts

v13.2.1

13.2.1 (2025-10-20)

Bug Fixes

• deps: update @octokit/types (#698) (ba56fbc)

v13.2.0

13.2.0 (2025-09-29)

Features

• new Projects v2 endpoints, new code scanning dismissal endpoints, many other endpoints (#690) (0e236cb)

v13.1.1

13.1.1 (2025-06-27)

Bug Fixes

• handle url in response when using pagination with compareCommits (#686) (8e5da25)

v13.1.0

13.1.0 (2025-06-16)

Features

• add paginatantion support for compareCommits and compareCommitsWithBasehead (#678) (6d8ea8a)

v13.0.1

13.0.1 (2025-05-25)

... (truncated)

Commits

• 413e899 feat: add immutable releases, enterprise team membership, enterprise team org...
• 3d311d6 chore(deps): update dependency @​types/node to v24 (#701)
• ba56fbc fix(deps): update @octokit/types (#698)
• 80745be ci(action): update actions/checkout action to v5 (#687)
• 0e236cb feat: new Projects v2 endpoints, new code scanning dismissal endpoints, many ...
• bf19e3e chore(deps): update dependency prettier to v3.6.2 (#685)
• 4f9fc56 ci(action): update actions/setup-node action to v5 (#688)
• 8e5da25 fix: handle url in response when using pagination with compareCommits (#686)
• 6d8ea8a feat: add paginatantion support for compareCommits and `compareCommitsWith...
• 8ec2713 fix(deps): update @octokit/types - no new paginated endpoints (#680)
• Additional commits viewable in compare view

Updates @octokit/request from 5.6.3 to 10.0.8

Release notes

Sourced from @​octokit/request's releases.

v10.0.8

10.0.8 (2026-02-20)

Bug Fixes

• use json-with-bigint instead of built-in JSON methods in order to properly support int64's (#798) (f13f5d9)

v10.0.7

10.0.7 (2025-11-13)

Bug Fixes

• readme: properly structure the options for custom agent (#786) (f17c1c1), closes #785

v10.0.6

10.0.6 (2025-10-30)

Bug Fixes

• deps: update dependency @​octokit/types to v16 (#783) (1aeac56)

v10.0.5

10.0.5 (2025-09-29)

Bug Fixes

• deps: update octokit deps (#772) (30f83b6)

v10.0.4

10.0.4 (2025-09-29)

Bug Fixes

• deps: update dependency @​octokit/types to v15 (#775) (ad78b4c)

v10.0.3

10.0.3 (2025-06-20)

Bug Fixes

• pkg: unreplaced version number in dist-bundle/ (#765) (5b181af)

v10.0.2

10.0.2 (2025-05-20)

... (truncated)

Commits

• f13f5d9 fix: use json-with-bigint instead of built-in JSON methods in order to prop...
• 9ba6ae0 Document that unsuccessful HTTP status code result in an exception (#795)
• 7160b82 chore(deps): replace glob with tinyglobby (#791)
• ab8018b ci(action): update peter-evans/create-or-update-comment action to v5 (#776)
• fb916e4 build(deps): bump vite from 6.3.4 to 6.4.1 (#780)
• e1eb769 chore(deps): update dependency esbuild to ^0.27.0 (#784)
• f17c1c1 fix(readme): properly structure the options for custom agent (#786)
• ea46fa9 ci(action): update github/codeql-action action to v4 (#778)
• 8166d28 chore(deps): update vitest monorepo to v4 (major) (#781)
• 1aeac56 fix(deps): update dependency @​octokit/types to v16 (#783)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​octokit/request since your current version.

Updates @octokit/request-error from 2.1.0 to 7.1.0

Release notes

Sourced from @​octokit/request-error's releases.

v7.1.0

7.1.0 (2025-11-13)

Features

• inherit options from base Error class to add support for the cause property (#535/#536) (2ea2780)

v7.0.2

7.0.2 (2025-10-30)

Bug Fixes

• deps: update dependency @​octokit/types to v16 (#533) (e5a75ef)

v7.0.1

7.0.1 (2025-09-29)

Bug Fixes

• deps: update dependency @​octokit/types to v15 (#522) (4a453f2)

v7.0.0

7.0.0 (2025-05-20)

Continuous Integration

• stop testing against NodeJS v18 (#512) (8eee0c1)

BREAKING CHANGES

• Drop support for NodeJS v18

• build: set minimal node version in build script to v20

• ci: stop testing against NodeJS v18

v6.1.8

6.1.8 (2025-04-10)

Bug Fixes

• deps: update dependency @​octokit/types to v14 (#505) (ab4ea7b)

v6.1.7

... (truncated)

Commits

• 2ea2780 feat: inherit options from base Error class to add support for the cause ...
• ac7b309 chore(deps): update vitest monorepo to v4 (major) (#531)
• dadc76d ci(action): update peter-evans/create-or-update-comment action to v5 (#525)
• f57f2e6 build(deps): lock file maintenance (#534)
• e5a75ef fix(deps): update dependency @​octokit/types to v16 (#533)
• e5d5de2 chore(deps): update dependency @​types/node to v24 (#532)
• 8cc127b ci(action): update actions/setup-node action to v6 (#529)
• b3a876b build(deps): lock file maintenance (#527)
• cf1817b ci(action): update github/codeql-action action to v4 (#528)
• 61f1e87 chore(deps): update dependency tinybench to v5 (#519)
• Additional commits viewable in compare view

Updates @octokit/webhooks from 9.26.0 to 14.2.0

Release notes

Sourced from @​octokit/webhooks's releases.

v14.2.0

14.2.0 (2025-12-03)

Features

• new secret_scanning_alert.assigned, secret_scanning_alert.unassigned, issue_dependencies events (#1189) (b47e4b0)

v14.1.3

14.1.3 (2025-07-31)

Bug Fixes

• avoid Object.assign to avoid hiding potential type errors (#1166) (4c36fce)

v14.1.2

14.1.2 (2025-07-30)

Bug Fixes

• normalize trailing slashes (#1167) (ea2a89d)

v14.1.1

14.1.1 (2025-07-10)

Bug Fixes

• createLogger should not recreate the logger object if it already exists (#1162) (18f0be5)

v14.1.0

14.1.0 (2025-06-29)

Features

• add validate-event-name (#1161) (6965d70)

v14.0.2

14.0.2 (2025-06-05)

Bug Fixes

• types: add missing enterprise key (#1158) (4e83370)

v14.0.1

14.0.1 (2025-06-04)

... (truncated)

Commits

• b47e4b0 feat: new secret_scanning_alert.assigned, `secret_scanning_alert.unassigned...
• 5ca3206 ci(action): update github/codeql-action action to v4 (#1178)
• 07b617c ci(action): update actions/setup-node action to v6 (#1179)
• 3e7c815 build(deps): lock file maintenance (#1177)
• be82b3d ci(action): update peter-evans/create-or-update-comment action to v5 (#1175)
• 73ec1fc chore(deps): update vitest monorepo to v4 (major) (#1181)
• 4b4ad0f build(deps): lock file maintenance (#1174)
• 2a24466 ci(action): update actions/checkout action to v5 (#1170)
• aea297e ci(action): update actions/setup-node action to v5 (#1172)
• 302105e build(deps): lock file maintenance (#1168)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​octokit/webhooks since your current version.

Removes @tootallnate/once

Updates brace-expansion from 2.0.1 to 2.1.0

Release notes

Sourced from brace-expansion's releases.

v2.0.2

• pkg: publish on tag 2.x 14f1d91
• fmt ed7780a
• Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) 36603d5

---

juliangruber/brace-expansion@v2.0.1...v2.0.2

Commits

• 1ee4a90 2.1.0
• b0302ac Add opt-in { max } mitigation to v2 legacy line (#100)
• 73b5459 2.0.3
• 311ac0d Backport fix for GHSA-f886-m6hf-6m8v to v2 (#96)
• a3efcee 2.0.2
• 14f1d91 pkg: publish on tag 2.x
• ed7780a fmt
• 36603d5 Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65)
• See full diff in compare view

Updates brace-expansion from 1.1.11 to 1.1.14

Release notes

Sourced from brace-expansion's releases.

v2.0.2

• pkg: publish on tag 2.x 14f1d91
• fmt ed7780a
• Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) 36603d5

---

juliangruber/brace-expansion@v2.0.1...v2.0.2

Commits

• 1ee4a90 2.1.0
• b0302ac Add opt-in { max } mitigation to v2 legacy line (#100)
• 73b5459 2.0.3
• 311ac0d Backport fix for GHSA-f886-m6hf-6m8v to v2 (#96)
• a3efcee 2.0.2
• 14f1d91 pkg: publish on tag 2.x
• ed7780a fmt
• 36603d5 Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65)
• See full diff in compare view

Updates braces from 3.0.2 to 3.0.3

Commits

• 74b2db2 3.0.3
• 88f1429 update eslint. lint, fix unit tests.
• 415d660 Snyk js braces 6838727 (#40)
• 190510f fix tests, skip 1 test in test/braces.expand
• 716eb9f readme bump
• a5851e5 Merge pull request #37 from coderaiser/fix/vulnerability
• 2092bd1 feature: braces: add maxSymbols (https://github.com/micromatch/braces/issues/...
• 9f5b4cf fix: vulnerability (https://security.snyk.io/vuln/SNYK-JS-BRACES-6838727)
• 98414f9 remove funding file
• 665ab5d update keepEscaping doc (#27)
• Additional commits viewable in compare view

Updates diff from 5.1.0 to 5.2.2

Changelog

Sourced from diff's changelog.

v5.2.2 - January 2026

Only change from 5.2.0 is a backport of the fix to GHSA-73rr-hh4g-fpgx.

v5.2.1 (deprecated)

Accidental release - do not use.

v5.2.0

Commits

• #411 Big performance improvement. Previously an O(n) array-copying operation inside the innermost loop of jsdiff's base diffing code increased the overall worst-case time complexity of computing a diff from O(n²) to O(n³). This is now fixed, bringing the worst-case time complexity down to what it theoretically should be for a Myers diff implementation.
• #448 Performance improvement. Diagonals whose furthest-reaching D-path would go off the edge of the edit graph are now skipped, rather than being pointlessly considered as called for by the original Myers diff algorithm. This dramatically speeds up computing diffs where the new text just appends or truncates content at the end of the old text.
• #351 Importing from the lib folder - e.g. require("diff/lib/diff/word.js") - will work again now. This had been broken for users on the latest version of Node since Node 17.5.0, which changed how Node interprets the exports property in jsdiff's package.json file.
• #344 diffLines, createTwoFilesPatch, and other patch-creation methods now take an optional stripTrailingCr: true option which causes Windows-style \r\n line endings to be replaced with Unix-style \n line endings before calculating the diff, just like GNU diff's --strip-trailing-cr flag.
• #451 Added diff.formatPatch.
• #450 Added diff.reversePatch.
• #478 Added timeout option.

Commits

• b7b6339 v5.2.2
• b5377ab Update package version to 5.2.1
• 7801789 Backport kpdecker/jsdiff#649
• 042a837 Backport kpdecker/jsdiff#647
• 370a9df 5.2.0 release (#483)
• a2f726a Add myself to the list of maintainers (#482)
• dfc6fe4 Add examples to docs of creating and applying patches (importantly including ...
• b5d1cfa Modify node_example.js to support showing added/deleted spaces (#479)
• 533893d Add timeout option (#478)
• 1f1ec96 Replace broken link to Myers's paper in the README with a working one (#476)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by explodingcabbage, a new releaser for diff since your current version.

Updates ejs from 3.1.9 to 3.1.10

Release notes

Sourced from ejs's releases.

v3.1.10

Version 3.1.10

Commits

• d3f807d Version 3.1.10
• 9ee26dd Mocha TDD
• e469741 Basic pollution protection
• 715e950 Merge pull request #756 from Jeffrey-mu/main
• cabe314 Include advanced usage examples
• 29b076c Added header
• 11503c7 Merge branch 'main' of github.com:mde/ejs into main
• 7690404 Added security banner to README
• f47d7ae Update SECURITY.md
• 828cea1 Update SECURITY.md
• Additional commits viewable in compare view

Updates minimatch from 9.0.3 to 9.0.9

Commits

• 8a10e47 9.0.9
• c6f1806 brace-expansion@2
• 446cfa3 9.0.8
• 8fa151a docs: add warning about ReDoS
• 71b78a2 fix partial matching of globstar patterns
• 2de496f 9.0.7
• 0d4616d limit nested extglob recursion, flatten extglobs
• 7117ef3 9.0.6
• 2418458 update deps, do not checkin dist
• 1d1f531 update deps
• Additional commits viewable in compare view

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates minimatch from 5.1.6 to 5.1.9

Commits

• 8a10e47 9.0.9
• c6f1806 brace-expansion@2
• 446cfa3 9.0.8
• 8fa151a docs: add warning about ReDoS
• 71b78a2 fix partial matching of globstar patterns
• 2de496f 9.0.7
• 0d4616d limit nested extglob recursion, flatten extglobs
• 7117ef3 9.0.6
• 2418458 update deps, do not checkin dist
• 1d1f531 update deps
• Additional commits viewable in compare view

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates minimatch from 3.1.2 to 3.1.5

Commits

• 8a10e47 9.0.9
• c6f1806 brace-expansion@2

[dependabot]

Superseded by #6.