build(deps): bump the npm_and_yarn group across 1 directory with 10 updates by dependabot[bot] · Pull Request #474 · cnumr/EcoIndex

dependabot · 2026-07-20T21:17:34Z

Bumps the npm_and_yarn group with 5 updates in the / directory:

Package	From	To
@babel/core	`7.23.5`	`8.0.1`
postcss	`8.4.31`	`8.5.25`
braces	`3.0.2`	`3.0.3`
micromatch	`4.0.5`	`4.0.8`
yaml	`2.3.4`	`2.9.0`

Updates @babel/core from 7.23.5 to 8.0.1

Release notes

Sourced from @babel/core's releases.

v8.0.1 (2026-06-17)

This release includes a breaking change that was in the Babel 8 migration guide's Getting ready section and in the release post, but the actual removal of the feature from the codebase was accidentally not complete.

💥 Breaking Change

babel-core, babel-plugin-transform-object-rest-spread, babel-plugin-transform-runtime, babel-preset-env, babel-standalone

#18079 Actually remove preset-env's useBuiltIns (@nicolo-ribaudo)

Committers: 2

Huáng Jùnliàng (@JLHwung)

Nicolò Ribaudo (@nicolo-ribaudo)

v8.0.0 (2026-06-16)

NOTE: The changelog below is relative to v8.0.0-rc.6. You can find a summary of all the breaking changes shipped in the Babel 8 release line in the migration guide for users and migration guide for plugin developers.

Read the release blog post at http://babeljs.io/blog/2026/06/16/8.0.0!

👓 Spec Compliance

babel-core

#18039 perf: Only extract source map comments at the end of the file (@liuxingbaoyu)

💥 Breaking Change

babel-cli, babel-node, babel-plugin-proposal-decorators, babel-plugin-transform-classes, babel-plugin-transform-function-name, babel-plugin-transform-modules-commonjs, babel-plugin-transform-object-rest-spread, babel-plugin-transform-parameters, babel-plugin-transform-react-constant-elements, babel-plugin-transform-regenerator, babel-preset-env, babel-register

#18069 Fallback to assuming ESM support with modules: auto (@nicolo-ribaudo)

babel-plugin-transform-runtime, babel-runtime-corejs3, babel-runtime

#18036 Remove corejs exports for @babe/runtime-corejs3 (@liuxingbaoyu)

babel-parser

#18034 Remove locations: "packed" (@liuxingbaoyu)

🐛 Bug Fix

babel-generator

#18046 fix(generator): improve new callee parens check (@JLHwung)

babel-plugin-transform-modules-systemjs

#18032 fix(systemjs): support proto as an export name (@JLHwung)

📝 Documentation

#18070 Add EOL date for Babel 7 (end of June 2027) to SECURITY.md (@nicolo-ribaudo)

🏠 Internal

#18018 ci: enforce yarn integrity (@JLHwung)

🏃‍♀️ Performance

babel-core

#18039 perf: Only extract source map comments at the end of the file (@liuxingbaoyu)

Committers: 6

Babel Bot (@babel-bot)

Huáng Jùnliàng (@JLHwung)

James Garbutt (@43081j)

... (truncated)

Changelog

Sourced from @babel/core's changelog.

v8.0.1 (2026-06-17)

💥 Breaking Change

babel-core, babel-plugin-transform-object-rest-spread, babel-plugin-transform-runtime, babel-preset-env, babel-standalone

#18079 Actually remove preset-env's useBuiltIns (@nicolo-ribaudo)

v8.0.0 (2026-06-16)

👓 Spec Compliance

babel-core

#18039 perf: Only extract source map comments at the end of the file (@liuxingbaoyu)

💥 Breaking Change

babel-cli, babel-node, babel-plugin-proposal-decorators, babel-plugin-transform-classes, babel-plugin-transform-function-name, babel-plugin-transform-modules-commonjs, babel-plugin-transform-object-rest-spread, babel-plugin-transform-parameters, babel-plugin-transform-react-constant-elements, babel-plugin-transform-regenerator, babel-preset-env, babel-register

#18069 Fallback to assuming ESM support with modules: auto (@nicolo-ribaudo)

babel-plugin-transform-runtime, babel-runtime-corejs3, babel-runtime

#18036 Remove corejs exports for @babe/runtime-corejs3 (@liuxingbaoyu)

babel-parser

#18034 Remove locations: "packed" (@liuxingbaoyu)

🐛 Bug Fix

babel-generator

#18046 fix(generator): improve new callee parens check (@JLHwung)

babel-plugin-transform-modules-systemjs

#18032 fix(systemjs): support proto as an export name (@JLHwung)

📝 Documentation

#18070 Add EOL date for Babel 7 (end of June 2027) to SECURITY.md (@nicolo-ribaudo)

🏠 Internal

#18018 ci: enforce yarn integrity (@JLHwung)

🏃‍♀️ Performance

babel-core

#18039 perf: Only extract source map comments at the end of the file (@liuxingbaoyu)

v8.0.0-rc.6 (2026-05-25)

🐛 Bug Fix

babel-generator

#18011 Catchup source map position in preserveFormat (@nicolo-ribaudo)

babel-core

#17999 fix: improve inputSourceMap URL handling (@JLHwung)

babel-core, babel-generator

#17992 Preserve original identifier names from input sourcemaps (@Andarist)

🏠 Internal

babel-core

#17970 Always use native Node.js TS support for config files (@nicolo-ribaudo)

babel-compat-data, babel-register

#17993 chore: use bundled dts for register and eslint-* (@JLHwung)

babel-helper-transform-fixture-test-runner, babel-node

... (truncated)

Commits

b4be199 v8.0.1
b68b1cb Actually remove preset-env's useBuiltIns (#18079)
de007ea Avoid trailing zeroes in Babel 9 generated version (#18078)
7dc825a v8.0.0
b71c35a perf: Only extract source map comments at the end of the file (#18039)
e74b70d chore: Remove unused file (#18033)
ae57969 chore: consolidate upwards traversal to empathic (#18030)
827d003 Change jest snapshotFormat (#18029)
34cf24e Update deps (#18023)
73bceef v8.0.0-rc.6
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @babel/core since your current version.

Updates postcss from 8.4.31 to 8.5.25

Release notes

Sourced from postcss's releases.

8.5.25

Fixed 8.5.17 visitor regression.

Fixed list.split() for non-string values (by @amir-rezaei).

8.5.24

Preserve the BOM after the processing (by @hdimer).

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

Fixed declaration parsing performance (by @homanp).

8.5.14

Fixed custom syntax regression (by @43081j).

8.5.13

Fixed postcss-scss commend regression.

8.5.12

Fixed reading any file via user-generated CSS.

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.25

Fixed 8.5.17 visitor regression.

Fixed list.split() for non-string values (by @amir-rezaei).

8.5.24

Preserve the BOM after the processing (by @hdimer).

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

... (truncated)

Commits

08c989c Release 8.5.25 version
24f6814 Fix 8.5.17 visitor regression
f2fa53f Add supply chain security requirement to PostCSS plugin guide
10edf0b fix: return empty array for empty string in list.split (#2121)
0ebe8ad Release 8.5.24 version
73218c6 Update dependencies
9a114f6 Preserve the BOM when stringifying (#2119)
9069261 Fix types check
eb9e1fe Release 8.5.23 version
9d19c78 Update dependencies
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates @babel/helpers from 7.23.5 to 8.0.0

Release notes

Sourced from @babel/helpers's releases.

v8.0.0 (2026-06-16)

NOTE: The changelog below is relative to v8.0.0-rc.6. You can find a summary of all the breaking changes shipped in the Babel 8 release line in the migration guide for users and migration guide for plugin developers.

Read the release blog post at http://babeljs.io/blog/2026/06/16/8.0.0!

👓 Spec Compliance

babel-core

#18039 perf: Only extract source map comments at the end of the file (@liuxingbaoyu)

💥 Breaking Change

babel-cli, babel-node, babel-plugin-proposal-decorators, babel-plugin-transform-classes, babel-plugin-transform-function-name, babel-plugin-transform-modules-commonjs, babel-plugin-transform-object-rest-spread, babel-plugin-transform-parameters, babel-plugin-transform-react-constant-elements, babel-plugin-transform-regenerator, babel-preset-env, babel-register

#18069 Fallback to assuming ESM support with modules: auto (@nicolo-ribaudo)

babel-plugin-transform-runtime, babel-runtime-corejs3, babel-runtime

#18036 Remove corejs exports for @babe/runtime-corejs3 (@liuxingbaoyu)

babel-parser

#18034 Remove locations: "packed" (@liuxingbaoyu)

🐛 Bug Fix

babel-generator

#18046 fix(generator): improve new callee parens check (@JLHwung)

babel-plugin-transform-modules-systemjs

#18032 fix(systemjs): support proto as an export name (@JLHwung)

📝 Documentation

#18070 Add EOL date for Babel 7 (end of June 2027) to SECURITY.md (@nicolo-ribaudo)

🏠 Internal

#18018 ci: enforce yarn integrity (@JLHwung)

🏃‍♀️ Performance

babel-core

#18039 perf: Only extract source map comments at the end of the file (@liuxingbaoyu)

Committers: 6

Babel Bot (@babel-bot)

Huáng Jùnliàng (@JLHwung)

James Garbutt (@43081j)

Nicolò Ribaudo (@nicolo-ribaudo)

Sandy Chen (@sandy2008)

@liuxingbaoyu

v8.0.0-rc.6 (2026-05-25)

Re-release all packages with npm provenance attestations

🐛 Bug Fix

babel-generator

#18011 Catchup source map position in preserveFormat (@nicolo-ribaudo)

babel-core

... (truncated)

Changelog

Sourced from @babel/helpers's changelog.

v8.0.0 (2026-06-16)

👓 Spec Compliance

babel-core

#18039 perf: Only extract source map comments at the end of the file (@liuxingbaoyu)

💥 Breaking Change

babel-cli, babel-node, babel-plugin-proposal-decorators, babel-plugin-transform-classes, babel-plugin-transform-function-name, babel-plugin-transform-modules-commonjs, babel-plugin-transform-object-rest-spread, babel-plugin-transform-parameters, babel-plugin-transform-react-constant-elements, babel-plugin-transform-regenerator, babel-preset-env, babel-register

#18069 Fallback to assuming ESM support with modules: auto (@nicolo-ribaudo)

babel-plugin-transform-runtime, babel-runtime-corejs3, babel-runtime

#18036 Remove corejs exports for @babe/runtime-corejs3 (@liuxingbaoyu)

babel-parser

#18034 Remove locations: "packed" (@liuxingbaoyu)

🐛 Bug Fix

babel-generator

#18046 fix(generator): improve new callee parens check (@JLHwung)

babel-plugin-transform-modules-systemjs

#18032 fix(systemjs): support proto as an export name (@JLHwung)

📝 Documentation

#18070 Add EOL date for Babel 7 (end of June 2027) to SECURITY.md (@nicolo-ribaudo)

🏠 Internal

#18018 ci: enforce yarn integrity (@JLHwung)

🏃‍♀️ Performance

babel-core

#18039 perf: Only extract source map comments at the end of the file (@liuxingbaoyu)

v8.0.0-rc.6 (2026-05-25)

🐛 Bug Fix

babel-generator

#18011 Catchup source map position in preserveFormat (@nicolo-ribaudo)

babel-core

#17999 fix: improve inputSourceMap URL handling (@JLHwung)

babel-core, babel-generator

#17992 Preserve original identifier names from input sourcemaps (@Andarist)

🏠 Internal

babel-core

#17970 Always use native Node.js TS support for config files (@nicolo-ribaudo)

babel-compat-data, babel-register

#17993 chore: use bundled dts for register and eslint-* (@JLHwung)

babel-helper-transform-fixture-test-runner, babel-node

#17989 Test Node.js 26 on CI (@nicolo-ribaudo)

babel-build-external-helpers, babel-cli, babel-generator, babel-helper-fixtures, babel-helper-plugin-test-runner, babel-helper-transform-fixture-test-runner, babel-node, babel-parser, babel-plugin-transform-modules-systemjs, babel-types

#18002 Add file URL support for test runners (@JLHwung)

🔬 Output optimization

... (truncated)

Commits

7dc825a v8.0.0
a5adbae Convert babel helpers scripts to TS (#18053)
73bceef v8.0.0-rc.6
dc91f90 v8.0.0-rc.5
7f2dda1 chore: add custom no-extraneous-dependencies rule (#17971)
0e5a59d Require Node.js ^22.18.0 || >=24.11.0 (#17969)
7300a66 v8.0.0-rc.4
5a30c33 Bundle more packages (#17938)
faef21b chore: Update TS 6.0 (#17894)
b9d7b7b chore: Remove default fallback (#17881)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @babel/helpers since your current version.

Updates @babel/plugin-transform-modules-systemjs from 7.23.3 to 8.0.1

Release notes

Sourced from @babel/plugin-transform-modules-systemjs's releases.

v8.0.1 (2026-06-17)

This release includes a breaking change that was in the Babel 8 migration guide's Getting ready section and in the release post, but the actual removal of the feature from the codebase was accidentally not complete.

💥 Breaking Change

babel-core, babel-plugin-transform-object-rest-spread, babel-plugin-transform-runtime, babel-preset-env, babel-standalone

#18079 Actually remove preset-env's useBuiltIns (@nicolo-ribaudo)

Committers: 2

Huáng Jùnliàng (@JLHwung)

Nicolò Ribaudo (@nicolo-ribaudo)

v8.0.0 (2026-06-16)

NOTE: The changelog below is relative to v8.0.0-rc.6. You can find a summary of all the breaking changes shipped in the Babel 8 release line in the migration guide for users and migration guide for plugin developers.

Read the release blog post at http://babeljs.io/blog/2026/06/16/8.0.0!

👓 Spec Compliance

babel-core

#18039 perf: Only extract source map comments at the end of the file (@liuxingbaoyu)

💥 Breaking Change

babel-cli, babel-node, babel-plugin-proposal-decorators, babel-plugin-transform-classes, babel-plugin-transform-function-name, babel-plugin-transform-modules-commonjs, babel-plugin-transform-object-rest-spread, babel-plugin-transform-parameters, babel-plugin-transform-react-constant-elements, babel-plugin-transform-regenerator, babel-preset-env, babel-register

#18069 Fallback to assuming ESM support with modules: auto (@nicolo-ribaudo)

babel-plugin-transform-runtime, babel-runtime-corejs3, babel-runtime

#18036 Remove corejs exports for @babe/runtime-corejs3 (@liuxingbaoyu)

babel-parser

#18034 Remove locations: "packed" (@liuxingbaoyu)

🐛 Bug Fix

babel-generator

#18046 fix(generator): improve new callee parens check (@JLHwung)

babel-plugin-transform-modules-systemjs

#18032 fix(systemjs): support proto as an export name (@JLHwung)

📝 Documentation

#18070 Add EOL date for Babel 7 (end of June 2027) to SECURITY.md (@nicolo-ribaudo)

🏠 Internal

#18018 ci: enforce yarn integrity (@JLHwung)

🏃‍♀️ Performance

babel-core

#18039 perf: Only extract source map comments at the end of the file (@liuxingbaoyu)

Committers: 6

Babel Bot (@babel-bot)

Huáng Jùnliàng (@JLHwung)

James Garbutt (@43081j)

... (truncated)

Changelog

Sourced from @babel/plugin-transform-modules-systemjs's changelog.

v8.0.1 (2026-06-17)

💥 Breaking Change

babel-core, babel-plugin-transform-object-rest-spread, babel-plugin-transform-runtime, babel-preset-env, babel-standalone

#18079 Actually remove preset-env's useBuiltIns (@nicolo-ribaudo)

v8.0.0 (2026-06-16)

👓 Spec Compliance

babel-core

#18039 perf: Only extract source map comments at the end of the file (@liuxingbaoyu)

💥 Breaking Change

babel-cli, babel-node, babel-plugin-proposal-decorators, babel-plugin-transform-classes, babel-plugin-transform-function-name, babel-plugin-transform-modules-commonjs, babel-plugin-transform-object-rest-spread, babel-plugin-transform-parameters, babel-plugin-transform-react-constant-elements, babel-plugin-transform-regenerator, babel-preset-env, babel-register

#18069 Fallback to assuming ESM support with modules: auto (@nicolo-ribaudo)

babel-plugin-transform-runtime, babel-runtime-corejs3, babel-runtime

#18036 Remove corejs exports for @babe/runtime-corejs3 (@liuxingbaoyu)

babel-parser

#18034 Remove locations: "packed" (@liuxingbaoyu)

🐛 Bug Fix

babel-generator

#18046 fix(generator): improve new callee parens check (@JLHwung)

babel-plugin-transform-modules-systemjs

#18032 fix(systemjs): support proto as an export name (@JLHwung)

📝 Documentation

#18070 Add EOL date for Babel 7 (end of June 2027) to SECURITY.md (@nicolo-ribaudo)

🏠 Internal

#18018 ci: enforce yarn integrity (@JLHwung)

🏃‍♀️ Performance

babel-core

#18039 perf: Only extract source map comments at the end of the file (@liuxingbaoyu)

v8.0.0-rc.6 (2026-05-25)

🐛 Bug Fix

babel-generator

#18011 Catchup source map position in preserveFormat (@nicolo-ribaudo)

babel-core

#17999 fix: improve inputSourceMap URL handling (@JLHwung)

babel-core, babel-generator

#17992 Preserve original identifier names from input sourcemaps (@Andarist)

🏠 Internal

babel-core

#17970 Always use native Node.js TS support for config files (@nicolo-ribaudo)

babel-compat-data, babel-register

#17993 chore: use bundled dts for register and eslint-* (@JLHwung)

babel-helper-transform-fixture-test-runner, babel-node

... (truncated)

Commits

b4be199 v8.0.1
cd96c47 chore(pkg): set @babel/core peer deps to ^8.0.0 (#18076)
7dc825a v8.0.0
7af23ad fix(systemjs): support proto as an export name (#18032)
73bceef v8.0.0-rc.6
c6d71f3 Enable strictFunctionTypes (#17946)
0b91d35 Add file URL support for test runners (#18002)
dc91f90 v8.0.0-rc.5
f297c42 Add testing for plugin options (#17957)
5abf7bb fix(systemjs): improve module string name support (#17973)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @babel/plugin-transform-modules-systemjs since your current version.

Updates brace-expansion from 1.1.11 to 2.0.1

Release notes

Sourced from brace-expansion's releases.

v1.1.15

Backport v5.0.6 change to v1 (#111) 0b09384

juliangruber/brace-expansion@v1.1.14...v1.1.15

v1.1.12

pkg: publish on tag 1.x c460dbd

fmt ccb8ac6

Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) c3c73c8

juliangruber/brace-expansion@v1.1.11...v1.1.12

Commits

b9c0e57 2.0.1
4d96d7d switch to fork of matcha that works on node>12
bc482fb Ignore only blocks that begins with $ (#49)
7b31e5c Adds travis jobs on ppc64le (#48)
0b6a022 2.0.0
63c58b8 Remove concat-map dependency (#47)
25e9042 Update travis to supported node.js versions (#46)
da3fa44 Remove useless identity function (#44)
ffa773c add patreon to FUNDING.yml
4ed5a8d docs: add SECURITY
Additional commits viewable in compare view

Updates braces from 3.0.2 to 3.0.3

Commits

74b2db2 3.0.3
88f1429 update eslint. lint, fix unit tests.
415d660 Snyk js braces 6838727 (#40)
190510f fix tests, skip 1 test in test/braces.expand
716eb9f readme bump
a5851e5 Merge pull request #37 from coderaiser/fix/vulnerability
2092bd1 feature: braces: add maxSymbols (https://github.com/micromatch/braces/issues/...
9f5b4cf fix: vulnerability (https://security.snyk.io/vuln/SNYK-JS-BRACES-6838727)
98414f9 remove funding file
665ab5d update keepEscaping doc (#27)
Additional commits viewable in compare view

Updates micromatch from 4.0.5 to 4.0.8

Release notes

Sourced from micromatch's releases.

4.0.8

Ultimate release that fixes both CVE-2024-4067 and CVE-2024-4068. We consider the issues low-priority, so even if you see automated scanners saying otherwise, don't be scared.

Changelog

Sourced from micromatch's changelog.

[4.0.8] - 2024-08-22

backported CVE-2024-4067 fix (from v4.0.6) over to 4.x branch

[4.0.7] - 2024-05-22

this is basically v4.0.5, with some README updates

it is vulnerable to CVE-2024-4067

Updated braces to v3.0.3 to avoid CVE-2024-4068

does NOT break API compatibility

[4.0.6] - 2024-05-21

Added hasBraces to check if a pattern contains braces.

Fixes CVE-2024-4067

BREAKS API COMPATIBILITY

Should be labeled as a major release, but it's not.

Commits

8bd704e 4.0.8
a0e6841 run verb to generate README documentation
4ec2884 Merge branch 'v4' into hauserkristof-feature/v4.0.8
03aa805 Merge pull request #266 from hauserkristof/feature/v4.0.8
814f5f7 lint
67fcce6 fix: CHANGELOG about braces & CVE-2024-4068, v4.0.5
113f2e3 fix: CVE numbers in CHANGELOG
d9dbd9a feat: updated CHANGELOG
2ab1315 fix: use actions/setup-node@v4
1406ea3 feat: rework test to work on macos with node 10,12 and 14
Additional commits viewable in compare view

Updates minimatch from 3.1.2 to 5.1.6

Changelog

Sourced from minimatch's changelog.

change log

10.2

Add braceExpandMax option

10.1

Add magicalBraces option for escape

Fix makeRe when partial: true is set.

Fix makeRe when pattern ends in a final ** path part.

10.0

Require node 20 or 22 and higher

9.0

No default export, only named exports.

8.0

Recursive descent parser for extglob, allowing correct support for arbitrarily nested extglob expressions

Bump required Node.js version

7.4

Add escape() method

Add unescape() method

Add Minimatch.hasMagic() method

7.3

Add support for posix character classes in a unicode-aware way.

7.2

Add windowsNoMagicRoot option

7.1

Add optimizationLevel configuration option, and revert the default back to the 6.2 style minimal optimizations, making the advanced transforms introduced in 7.0 opt-in. Also, process provided file paths in the same way in optimizationLevel:2 mode, so most things that matched with optimizationLevel 1 or 0 should match with level 2 as well. However, level 1 is the default, out of an abundance of caution.

... (truncated)

Commits

3e216b9 5.1.6
4d0b7f5 Detect leading dots in extglob subpatterns
9556826 5.1.5
919c856 Count closing parens when closing excess open parens
8d5cd74 publish legacy v5 version
857a631 5.1.4
d2c654d Do not apply magic unnecessarily for nocase
5878cf2 chore: add copyright year to license
9b42a9c 5.1.3
49ae7a2 Fix end-anchoring of negative extglobs
Additional commits viewable in compare view

Updates nanoid from 3.3.7 to 3.3.16

Release notes

Sourced from nanoid's releases.

3.3.16

Fixed infinite loop on negative size (by @greymoth-jp).

3.3.15

Fixed npm provenance error.

3.3.14

Fixed random pool corruption on big ID sizes.

3.3.13

Reduced npm package size.

3.3.12

Fixed breaking Nano ID by requesting big ID.

3.3.11

Fixed React Native support.

3.3.10

Fixed React Native support (by @steida).

3.3.9

Reduced npm package size.

Changelog

Sourced from nanoid's changelog.

3.3.16

Fixed infinite loop on negative size (by @greymoth-jp).

3.3.15

Fixed npm provenance error.

3.3.14

Fixed random pool corruption on big ID sizes.

3.3.13

Reduced npm package size.

3.3.12

Fixed breaking Nano ID by requesting big ID.

3.3.11

Fixed React Native support.

3.3.10

Fixed React Native support (by @steida).

3.3.9

Reduced npm package size.

3.3.8

Fixed a way to break Nano ID by passing non-integer size (by @myndzi).

Commits

9760e11 Release 3.3.16 version
e835c9b fix(non-secure): clamp negative size to prevent infinite loop (#601)
96dd086 Update CI action
ba0bc3b Do not create latest release for v3
6819724 Release 3.3.15 version
fb0b137 Fix tag for v3
e084bc9 Back-port new release system and fix pre-commit hook
7e32945 Release 3.3.14 version
6bd27b8 Another way to deal with pool damage
41ad2ac Reduce ID size
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nanoid since your current version.

Updates yaml from 2.3.4 to 2.9.0

Release notes

Sourced from yaml's releases.

v2.9.0

The changes here are really only pa...
Description has been truncated

…pdates Bumps the npm_and_yarn group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) | `7.23.5` | `8.0.1` | | [postcss](https://github.com/postcss/postcss) | `8.4.31` | `8.5.25` | | [braces](https://github.com/micromatch/braces) | `3.0.2` | `3.0.3` | | [micromatch](https://github.com/micromatch/micromatch) | `4.0.5` | `4.0.8` | | [yaml](https://github.com/eemeli/yaml) | `2.3.4` | `2.9.0` | Updates `@babel/core` from 7.23.5 to 8.0.1 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v8.0.1/packages/babel-core) Updates `postcss` from 8.4.31 to 8.5.25 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.4.31...8.5.25) Updates `@babel/helpers` from 7.23.5 to 8.0.0 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v8.0.0/packages/babel-helpers) Updates `@babel/plugin-transform-modules-systemjs` from 7.23.3 to 8.0.1 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v8.0.1/packages/babel-plugin-transform-modules-systemjs) Updates `brace-expansion` from 1.1.11 to 2.0.1 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@1.1.11...v2.0.1) Updates `braces` from 3.0.2 to 3.0.3 - [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md) - [Commits](micromatch/braces@3.0.2...3.0.3) Updates `micromatch` from 4.0.5 to 4.0.8 - [Release notes](https://github.com/micromatch/micromatch/releases) - [Changelog](https://github.com/micromatch/micromatch/blob/master/CHANGELOG.md) - [Commits](micromatch/micromatch@4.0.5...4.0.8) Updates `minimatch` from 3.1.2 to 5.1.6 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v3.1.2...v5.1.6) Updates `nanoid` from 3.3.7 to 3.3.16 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](ai/nanoid@3.3.7...3.3.16) Updates `yaml` from 2.3.4 to 2.9.0 - [Release notes](https://github.com/eemeli/yaml/releases) - [Commits](eemeli/yaml@v2.3.4...v2.9.0) --- updated-dependencies: - dependency-name: "@babel/core" dependency-version: 8.0.1 dependency-type: direct:production - dependency-name: "@babel/helpers" dependency-version: 8.0.0 dependency-type: indirect - dependency-name: "@babel/plugin-transform-modules-systemjs" dependency-version: 8.0.1 dependency-type: indirect - dependency-name: brace-expansion dependency-version: 2.0.1 dependency-type: indirect - dependency-name: braces dependency-version: 3.0.3 dependency-type: indirect - dependency-name: micromatch dependency-version: 4.0.8 dependency-type: indirect - dependency-name: minimatch dependency-version: 5.1.6 dependency-type: indirect - dependency-name: nanoid dependency-version: 3.3.16 dependency-type: indirect - dependency-name: postcss dependency-version: 8.5.20 dependency-type: direct:production - dependency-name: yaml dependency-version: 2.9.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jul 20, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/npm_and_yarn-73b27d00b8 branch from 87261ef to b4c4120 Compare July 31, 2026 09:08

Navigation Menu

Uh oh!

build(deps): bump the npm_and_yarn group across 1 directory with 10 updates - #474

build(deps): bump the npm_and_yarn group across 1 directory with 10 updates#474
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/npm_and_yarn-73b27d00b8

dependabot Bot commented on behalf of github Jul 20, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v8.0.1 (2026-06-17)

💥 Breaking Change

Committers: 2

v8.0.0 (2026-06-16)

👓 Spec Compliance

💥 Breaking Change

🐛 Bug Fix

📝 Documentation

🏠 Internal

🏃‍♀️ Performance

Committers: 6

v8.0.1 (2026-06-17)

💥 Breaking Change

v8.0.0 (2026-06-16)

👓 Spec Compliance

💥 Breaking Change

🐛 Bug Fix

📝 Documentation

🏠 Internal

🏃‍♀️ Performance

v8.0.0-rc.6 (2026-05-25)

🐛 Bug Fix

🏠 Internal

8.5.25

8.5.24

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.17

8.5.16

8.5.15

8.5.14

8.5.13

8.5.12

8.5.25

8.5.24

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.17

8.5.16

8.5.15

v8.0.0 (2026-06-16)

👓 Spec Compliance

💥 Breaking Change

🐛 Bug Fix

📝 Documentation

🏠 Internal

🏃‍♀️ Performance

Committers: 6

v8.0.0-rc.6 (2026-05-25)

🐛 Bug Fix

v8.0.0 (2026-06-16)

👓 Spec Compliance

💥 Breaking Change

🐛 Bug Fix

📝 Documentation

🏠 Internal

🏃‍♀️ Performance

v8.0.0-rc.6 (2026-05-25)

🐛 Bug Fix

🏠 Internal

🔬 Output optimization

v8.0.1 (2026-06-17)

💥 Breaking Change

Committers: 2

v8.0.0 (2026-06-16)

👓 Spec Compliance

💥 Breaking Change

🐛 Bug Fix

dependabot Bot commented on behalf of github Jul 20, 2026 •

edited

Loading