Bump the npm_and_yarn group across 2 directories with 6 updates by dependabot[bot] · Pull Request #1 · symbioticfi/yield-server

dependabot · 2026-08-11T09:27:05Z

Bumps the npm_and_yarn group with 5 updates in the / directory:

Package	From	To
pg-promise	`10.15.4`	`11.5.5`
electron	`31.7.7`	`39.8.10`
adm-zip	`0.5.18`	`removed`
brace-expansion	`1.1.16`	`1.1.18`
brace-expansion	`5.0.7`	`5.0.9`
fast-uri	`3.1.3`	`3.1.5`

Bumps the npm_and_yarn group with 2 updates in the /src/adaptors directory: brace-expansion and undici.

Updates pg-promise from 10.15.4 to 11.5.5

Release notes

Sourced from pg-promise's releases.

11.5.5

Addressing sql injection issue; All negative numbers are now wrapped in parentheses.

Dev dependencies updated.

Thanks to @paul-gerste-sonarsource!

11.5.4

Dependencies updated, including the driver, to v8.11.3

11.5.3

Following up on driver fix-update, see issue #888

11.5.2

This update is to clarify the full range of environments officially supported:

PostgreSql v10 - v15

NodeJS v14 - v18

It is worth noting that:

It may work with PostgreSql v9, but it is no longer officially supported.

It should work with NodeJS v20, but it is not officially supported yet (we support LTS versions of NodeJS only).

The CI has been updated accordingly. No functional changes.

11.5.1

Updated dependencies, including the driver, to v8.11.1

Fixed #884 - CI build issue in test

11.5.0

Many dependencies updated, including Postgres driver.

Minor documentation updates.

Please note that at the time of publishing this, GitHub CI started showing problems again, unrelated to the project. All tests pass locally fine, disregard Failed Build status for the time being.

11.4.3

Updated dependencies

Marked method batch as deprecated.

11.4.2

Dev dependencies updated

Semantic refactoring of the code

11.4.1

Corrected TypeScript signature for the Pool's property log.

11.4.0

Updated dependencies: "pg" -> "8.10.0" and "pg-query-stream" -> "4.4.0"

Extended IPool TypeScript declaration with properties expiredCount + log. The latter in case you want to log what the pool is doing:

... (truncated)

Commits

1a4dfe6 Fixing issue Vulnerability: SQL Injection via Line Comment Creation vitaly-t/pg-promise#911 (comment)...
79199d4 update the package
8f30428 Fix node-postgres.com/apis/... links (#912)
8343d4b update deps
00cd486 updating deps
e86ef61 update node ver
40311c3 add version check
ab150f2 add pg11 tests
b58bfcc downgrade supported pg to v10
7b71768 Update README.md
Additional commits viewable in compare view

Updates electron from 31.7.7 to 39.8.10

Release notes

Sourced from electron's releases.

electron v39.8.10

Release Notes for v39.8.10

[!WARNING] Electron 39.x.y has reached end-of-support as per the project's support policy. Developers and applications are encouraged to upgrade to a newer version of Electron.

Fixes

Ensured cross-origin fetch() and XHR are blocked for custom protocols registered with supportFetchAPI: true unless corsEnabled: true is also set; cross-origin mode: 'no-cors' requests now receive an opaque response. #51272 (Also in 40, 41, 42)

Fixed an issue where the Squirrel.Mac installer could resolve the target bundle path to different locations at different stages of an install. #50766 (Also in 42)

Other Changes

Backported a fix for route_id validation in the GPU command buffer. #51327

Backported security fixes for 493319454, 494158331, 493234757, 492736100, 493413432, 492668885, 496281816. #51257

Backported several fixes in Skia, ANGLE, and WebRTC from upstream. #51266

electron v39.8.9

Release Notes for v39.8.9

Other Changes

Fixed gn gen failing to resolve electron_version when building from a git worktree checkout. #51163 (Also in 40, 41, 42)

Security: backported fixes for CVE-2026-6296, CVE-2026-6297, CVE-2026-6298, CVE-2026-6299, CVE-2026-6300, CVE-2026-6301, CVE-2026-6302, CVE-2026-6303, CVE-2026-6304, CVE-2026-6305, CVE-2026-6306, CVE-2026-6307, CVE-2026-6308, CVE-2026-6309, CVE-2026-6311, CVE-2026-6312, CVE-2026-6313, CVE-2026-6314, CVE-2026-6316, CVE-2026-6318, CVE-2026-6358, CVE-2026-6359, CVE-2026-6360, CVE-2026-6361, CVE-2026-6362, CVE-2026-6363, CVE-2026-6364. #51141

electron v39.8.8

Release Notes for v39.8.8

Fixes

Fixed an issue where DevTools would re-attach to the window when opened after previously being detached. #50818 (Also in 40, 41, 42)

Other Changes

Backported fix for chromium:74266014. #50175

Backported upstream v8 fixes for several maglev, inspector, and arm64 code-generation edge cases. #50993

electron v39.8.7

Release Notes for v39.8.7

Other Changes

Backported fix for 489711638. #50624

Backported fix for 493952652. #50620

electron v39.8.6

Release Notes for v39.8.6

Fixes

Fixed a crash when calling contentTracing.getTraceBufferUsage() while a trace session is active. #50595 (Also in 40, 41, 42)

Commits

d7c42eb chore: backport removal of private macOS APIs (#51502)
c76d48c build: replace spec dep fork with transitive resolution (#51490)
3ff23c5 fix: respect iframe sandbox flags on the OpenURL navigation path (#51437)
01faabf fix: resolve target bundle path once at start of install (#50766)
8287d59 build(deps): bump dorny/paths-filter from 3.0.2 to 4.0.1 (#51409)
a8a79ea ci: backport secondary siso patch (#51390)
593607e chore: cherry-pick 1 change from chromium (#51327)
aa7791f build: restrict npm tarball contents to an explicit allowlist (#51307)
5392e9a fix: ensure corsEnabled: false protocol handlers do not work across protocols...
2c24640 fix: validate OSR frame geometry against shared-memory mapping size (39-x-y) ...
Additional commits viewable in compare view

Removes adm-zip

Updates brace-expansion from 1.1.16 to 1.1.18

Commits

758fcd6 1.1.18
27fbeed Merge commit from fork
5c57cc2 1.1.17
d757f1d npm ignore .claude
cb4b9e4 fix: backport GHSA-mh99-v99m-4gvg (#129)
See full diff in compare view

Updates brace-expansion from 5.0.7 to 5.0.9

Commits

758fcd6 1.1.18
27fbeed Merge commit from fork
5c57cc2 1.1.17
d757f1d npm ignore .claude
cb4b9e4 fix: backport GHSA-mh99-v99m-4gvg (#129)
See full diff in compare view

Updates fast-uri from 3.1.3 to 3.1.5

Release notes

Sourced from fast-uri's releases.

v3.1.5

⚠️ Security Warning

Fix for GHSA-7p8r-x3mc-p8w7

Full Changelog: fastify/fast-uri@v3.1.4...v3.1.5

v3.1.4

⚠️ Security Release

Fix for GHSA-v2hh-gcrm-f6hx

Full Changelog: fastify/fast-uri@v3.1.3...v3.1.4

Commits

5e179cb Bumped v3.1.5
2cad02d Merge commit from fork
6aeece6 Bumped v3.1.4
2d50fba fix: reject literal backslash in URI authority
See full diff in compare view

Updates undici from 6.27.0 to 6.28.0

Release notes

Sourced from undici's releases.

v6.28.0

⚠️ Security fixes

GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 740a0b7c.

GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by cba3a52a, with corrected fixtures in 4fd5a0c6.

GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by af748404.

GHSA-4cwx-7wf7-3272 and GHSA-jr45-8vmc-qm54 affect the cache interceptor in Undici v7 and v8; Undici v6 is not in their affected version ranges.

Full Changelog: nodejs/undici@v6.27.0...v6.28.0

Commits

01a912e Bumped v6.28.0 (#5591)
481ecfc Use Node 22 and npm 11 to release
740a0b7 fix: validate blob body content type
2698e49 fix: validate coerced header values for CRLF (#5579)
4fd5a0c test(retry): correct broken content-range fixtures in retry-handler.js
cba3a52 fix(retry): reject partial content length mismatch
af74840 fix: harden cookie domain, path, and unparsed attribute validation
See full diff in compare view

Updates brace-expansion from 1.1.15 to 1.1.18

Commits

758fcd6 1.1.18
27fbeed Merge commit from fork
5c57cc2 1.1.17
d757f1d npm ignore .claude
cb4b9e4 fix: backport GHSA-mh99-v99m-4gvg (#129)
See full diff in compare view

Updates undici from 6.27.0 to 6.28.0

Release notes

Sourced from undici's releases.

v6.28.0

⚠️ Security fixes

GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 740a0b7c.

GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by cba3a52a, with corrected fixtures in 4fd5a0c6.

GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by af748404.

GHSA-4cwx-7wf7-3272 and GHSA-jr45-8vmc-qm54 affect the cache interceptor in Undici v7 and v8; Undici v6 is not in their affected version ranges.

Full Changelog: nodejs/undici@v6.27.0...v6.28.0

Commits

01a912e Bumped v6.28.0 (#5591)
481ecfc Use Node 22 and npm 11 to release
740a0b7 fix: validate blob body content type
2698e49 fix: validate coerced header values for CRLF (#5579)
4fd5a0c test(retry): correct broken content-range fixtures in retry-handler.js
cba3a52 fix(retry): reject partial content length mismatch
af74840 fix: harden cookie domain, path, and unparsed attribute validation
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the npm_and_yarn group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [pg-promise](https://github.com/vitaly-t/pg-promise) | `10.15.4` | `11.5.5` | | [electron](https://github.com/electron/electron) | `31.7.7` | `39.8.10` | | [adm-zip](https://github.com/cthackers/adm-zip) | `0.5.18` | `removed` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.16` | `1.1.18` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `5.0.7` | `5.0.9` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.1.3` | `3.1.5` | Bumps the npm_and_yarn group with 2 updates in the /src/adaptors directory: [brace-expansion](https://github.com/juliangruber/brace-expansion) and [undici](https://github.com/nodejs/undici). Updates `pg-promise` from 10.15.4 to 11.5.5 - [Release notes](https://github.com/vitaly-t/pg-promise/releases) - [Commits](vitaly-t/pg-promise@10.15.4...11.5.5) Updates `electron` from 31.7.7 to 39.8.10 - [Release notes](https://github.com/electron/electron/releases) - [Commits](electron/electron@v31.7.7...v39.8.10) Removes `adm-zip` Updates `brace-expansion` from 1.1.16 to 1.1.18 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.16...v1.1.18) Updates `brace-expansion` from 5.0.7 to 5.0.9 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.16...v1.1.18) Updates `fast-uri` from 3.1.3 to 3.1.5 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.3...v3.1.5) Updates `undici` from 6.27.0 to 6.28.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v6.27.0...v6.28.0) Updates `brace-expansion` from 1.1.15 to 1.1.18 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.16...v1.1.18) Updates `undici` from 6.27.0 to 6.28.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v6.27.0...v6.28.0) --- updated-dependencies: - dependency-name: pg-promise dependency-version: 11.5.5 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: electron dependency-version: 39.8.10 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: adm-zip dependency-version: dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.18 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 5.0.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 6.28.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.18 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 6.28.0 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

socket-security · 2026-08-11T09:27:34Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability	Quality	Maintenance
pg-promise@10.15.4 ⏵ 11.5.5		⁺²		⁺²
serverless@3.40.0 ⏵ 4.41.0	⁺⁹
electron@31.7.7 ⏵ 39.8.10	⁺¹	⁺⁷⁰	⁺¹

View full report

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 11, 2026

Navigation Menu

Uh oh!

Bump the npm_and_yarn group across 2 directories with 6 updates - #1

Bump the npm_and_yarn group across 2 directories with 6 updates#1
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/npm_and_yarn-d15df7dc2c

dependabot Bot commented on behalf of github Aug 11, 2026

Uh oh!

socket-security Bot commented Aug 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 11, 2026

11.5.5

11.5.4

11.5.3

11.5.2

11.5.1

11.5.0

11.4.3

11.4.2

11.4.1

11.4.0

electron v39.8.10

Release Notes for v39.8.10

Fixes

Other Changes

electron v39.8.9

Release Notes for v39.8.9

Other Changes

electron v39.8.8

Release Notes for v39.8.8

Fixes

Other Changes

electron v39.8.7

Release Notes for v39.8.7

Other Changes

electron v39.8.6

Release Notes for v39.8.6

Fixes

v3.1.5

⚠️ Security Warning

v3.1.4

⚠️ Security Release

v6.28.0

⚠️ Security fixes

v6.28.0

⚠️ Security fixes

Uh oh!

socket-security Bot commented Aug 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants