build(deps): Bump the production group across 1 directory with 7 updates by dependabot[bot] · Pull Request #199 · OrgLoop/orgloop

dependabot · 2026-06-22T02:15:18Z

Bumps the production group with 7 updates in the / directory:

Package	From	To
js-yaml	`4.2.0`	`5.0.0`
uuid	`14.0.0`	`14.0.1`
undici	`8.4.1`	`8.5.0`
@opentelemetry/api-logs	`0.218.0`	`0.219.0`
@opentelemetry/sdk-logs	`0.218.0`	`0.219.0`
@opentelemetry/exporter-logs-otlp-http	`0.218.0`	`0.219.0`
@opentelemetry/resources	`2.7.1`	`2.8.0`

Updates js-yaml from 4.2.0 to 5.0.0

Changelog

Sourced from js-yaml's changelog.

[5.0.0] - 2026-06-20

Added

Added named exports for schemas, tags, parser events and AST utilities.

Reworked JSON_SCHEMA and CORE_SCHEMA with spec-compliant scalar resolution rules, and added YAML11_SCHEMA.

Added realMapTag for lossless mappings with non-string and complex keys. Object-based mappings now reject complex keys instead of stringifying them.

Added dump() transform option for changing the generated AST before rendering.

Added dump() options seqInlineFirst, flowBracketPadding, flowSkipCommaSpace, flowSkipColonSpace, quoteFlowKeys, quoteStyle and tagBeforeAnchor.

Added formal data layers (events and AST) for modular data pipelines.

Added low-level parser (to events), presenter and visitor APIs.

Added the YAML Test Suite to the test set.

Changed

See the migration guide for upgrade notes.

Rewritten in TypeScript and reorganized the public API around flat named exports.

Reduced the set of exported schemas:

YAML 1.2 schemas: CORE_SCHEMA (loader default), JSON_SCHEMA, FAILSAFE_SCHEMA.

YAML11_SCHEMA, a combination of all YAML 1.1 tags (YAML 1.1 does not specify a schema, only "types").

load/dump default behaviour is now specified exactly via schemas:

load uses CORE_SCHEMA, without !!merge by default.

dump uses YAML11_SCHEMA + CORE_SCHEMA for the quoting check, to guarantee backward compatibility by default.

!!set is now loaded as a JavaScript Set.

Replaced the Type API with a tags API. Similar, but more precise and simpler. See examples for details. Tags can be defined via defineScalarTag(), defineSequenceTag() and defineMappingTag(), or as a spread + override of an existing tag.

Renamed Schema.extend() to Schema.withTags().

Expanded YAML 1.2 conformance and improved handling of directives, document markers, block keys, multiline scalars, tag syntax and other things.

load() now throws on empty input instead of returning undefined.

Moved browser builds to the js-yaml/browser export.

Deprecated the loadAll signature with an iterator (still works, but is a candidate for removal).

Removed

Removed deprecated safeLoad(), safeLoadAll() and safeDump() exports.

Removed DEFAULT_SCHEMA and the nested types export.

Removed loader options onWarning, legacy and listener.

Removed dumper options styles, replacer, noCompatMode, condenseFlow, quotingType and forceQuotes. Renamed noArrayIndent to seqNoIndent. Formatting and representation are now configured through presenter options,

... (truncated)

Commits

75148bc 5.0.0 released
704b25d Quote document markers followed by whitespace
42dea28 Support complex !!pairs keys with realMapTag
6cf374e Fix dumping strings that collide with YAML markers
65b8d94 Clarify !!omap/!!pairs support
33e3640 Move tagname helpers to common/ and remove unused exports
4dd582b Cleanup export types
39b3792 Add types export
0cd01e9 docs: update for v5
c5a61a4 Fix presenter coverage
Additional commits viewable in compare view

Updates uuid from 14.0.0 to 14.0.1

Release notes

Sourced from uuid's releases.

v14.0.1

14.0.1 (2026-06-20)

Bug Fixes

add types condition to node export for moduleResolution bundler (#961) (27ffae5)

Changelog

Sourced from uuid's changelog.

14.0.1 (2026-06-20)

Bug Fixes

add types condition to node export for moduleResolution bundler (#961) (27ffae5)

Commits

7017780 chore(main): release 14.0.1 (#964)
f2c3e4b chore: fix release-please workflow (#963)
27ffae5 fix: add types condition to node export for moduleResolution bundler (#961)
664cb31 Remove outdated security contact information (#959)
d729016 fix(ci): checkout PR head commit in browser workflow (#957)
89a5ebc Workflows (#948)
196e208 chore: fix workflow (#947)
95af448 chore: update workflows (#946)
3b57f95 chore: add workflow_dispatch (#944)
a433096 chore: add 12.x and 13.x maintenance release branches (#941)
Additional commits viewable in compare view

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates undici from 8.4.1 to 8.5.0

Release notes

Sourced from undici's releases.

v8.5.0

⚠️ Security Release

This release line addresses 8 security advisories. Most are fixed in v8.5.0; the SOCKS5 pool-reuse issue was fixed earlier in v8.2.0.
Action required: Upgrade to undici 8.5.0 or later.
npm install undici@^8.5.0
Summary

Advisory CVE Severity (CVSS) Fixed in Fix commit

GHSA-vxpw-j846-p89q CVE-2026-12151 High (7.5) 8.5.0 32dbf0b3

GHSA-38rv-x7px-6hhq CVE-2026-9675 High (7.5) 8.5.0 b4c287b3

GHSA-vmh5-mc38-953g CVE-2026-9697 High (7.4) 8.5.0 42d49559

GHSA-hm92-r4w5-c3mj CVE-2026-6734 High (7.5) 8.2.0 a516f870

GHSA-pr7r-676h-xcf6 CVE-2026-9678 Moderate (5.9) 8.5.0 cb105d7c

GHSA-p88m-4jfj-68fv CVE-2026-9679 Moderate (5.9) 8.5.0 5655ea43

GHSA-g8m3-5g58-fq7m CVE-2026-11525 Low (3.7) 8.5.0 5655ea43

GHSA-35p6-xmwp-9g52 CVE-2026-6733 Low (3.7) 8.5.0 6ea54ef8

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

GHSA-vxpw-j846-p89q · CWE-400, CWE-770 Fix: 32dbf0b3 websocket: limit the number of fragments in a message (also c5ed7875 handle empty fragments and stream limits)

A malicious WebSocket server can stream a large number of small or empty continuation frames. Undici enforced a limit on cumulative payload size but did not limit the number of fragments per message, leading to unbounded memory growth and denial of service.

Affected: applications using new WebSocket(...) or WebSocketStream against untrusted endpoints.

Workaround: none — upgrade is required.

WebSocket DoS via cumulative fragment bypass — CVE-2026-9675

GHSA-38rv-x7px-6hhq · CWE-400, CWE-770 Fix: b4c287b3 fix(websocket): enforce max payload size across fragments

Undici validated the size of individual frames but did not track cumulative size across a fragmented message. An attacker could send many small fragments that each pass per-frame validation but collectively exceed the configured limit, causing memory exhaustion. This is a regression introduced in 8.1.0 (the

... (truncated)

Commits

a0806e1 Bumped v8.5.0 (#5429)
8a0392c test: detect available python command in wpt runner (#5427)
f4045b9 ci: increase Node.js workflow timeout (#5426)
363e44f chore: removed repro-h2-pipelining-default.mjs and lint (#5420)
c5ed787 websocket: handle empty fragments and stream limits
e114e77 align EventSource with spec (#5418)
6df53c5 fix: preserve h2 queue on out-of-order completion (#5410)
32dbf0b websocket: limit the number of fragments in a message
0d6ecc5 add bodymixin.textStream() (#5416)
42d4955 fix: honor requestTls when proxy is SOCKS5
Additional commits viewable in compare view

Updates @opentelemetry/api-logs from 0.218.0 to 0.219.0

Release notes

Sourced from @opentelemetry/api-logs's releases.

experimental/v0.219.0

0.219.0

💥 Breaking Changes

fix(configuration)!: stop removing null values from parsed config object #6679 @trentm

It is now the responsibility of the user of a parsed declarative config object, typically just the sdk-node package, to handle null values.

fix(api-logs)!: Removed NOOP_LOGGER and NoopLogger exports from @opentelemetry/api-logs. Use createNoopLogger(): Logger instead. #6713 @dyladan

feat(api-logs)!: rename scopeAttributes to attributes in LoggerOptions #6573 @pichlermarc

fix(sdk-node)!: remove buildSamplerFromConfig export #6784 @trentm

🚀 Features

feat(sdk-node): wire up metric producers from declarative config #6712 @MikeGoldsmith

feat(sdk-logs)!: add support for attributes in LoggerOptions #6573 @pichlermarc

🐛 Bug Fixes

fix(sdk-node): pass all config properties to log record exporters in declarative config #6708 @MikeGoldsmith

fix(sdk-node): warn and ignore zero exporter timeout in declarative config #6711 @MikeGoldsmith

fix(sdk-node): pass gRPC credentials and headers to span exporter in declarative config #6705 @MikeGoldsmith

fix(otlp-transformer): do not attempt to skip groups #6704 @pichlermarc

fix(otlp-grpc-exporter-base): recreate client after 5 consecutive DEADLINE_EXCEEDED to recover from connection dropped deadlock #6296 @afharo

fix(browser-detector): use the right semantic convention for user agent resource attribute #6729 @david-luna

fix(browser-detector): user agent resource attribute always #6754 @david-luna

fix(opentelemetry-exporter-prometheus): handle additional edge cases in metric name conversion #6727 @cjihrig

fix(sdk-logs): avoid null dereference in BatchLogRecordProcessor._flushAll when an in-flight export completes between awaits #6763 @Janealter

fix(configuration): improve environment variable substitution to handle all the cases shown in the spec #6757 @trentm

📚 Documentation

docs(otlp-exporter-base): index the package's public API in generated docs so types like OTLPExporterNodeConfigBase resolve and link from consumer exporter pages #6725 @devareddy05

🏠 Internal

refactor(configuration): remove redundant env var parsing in EnvironmentConfigFactory #6710 @MikeGoldsmith

Commits

13a035b chore: prepare next release (#6756)
4b13587 Merge commit from fork
71d195c chore(renovate): set minimumReleaseAge to 3 days (#6792)
555fca6 Update renovate.json to use matchManagers (#6141)
b711a81 docs(otlp-exporter-base): add typedoc entry points so public API is indexed a...
da70402 fix(ci): supply-chain sec: disable caching in release-related workflow (#6790)
002267b chore: complete the move to the smaller SPDX license header (#6791)
056ef9c feat(sdk-metrics): implement metric reader metrics (#6449)
3bd69ce fix(configuration): improve environment variable substitution to handle all t...
bfbda7c docs(exporter-trace-otlp-grpc): import CompressionAlgorithm from otlp-exporte...
Additional commits viewable in compare view

Updates @opentelemetry/sdk-logs from 0.218.0 to 0.219.0

Release notes

Sourced from @opentelemetry/sdk-logs's releases.

experimental/v0.219.0

0.219.0

💥 Breaking Changes

fix(configuration)!: stop removing null values from parsed config object #6679 @trentm

It is now the responsibility of the user of a parsed declarative config object, typically just the sdk-node package, to handle null values.

fix(api-logs)!: Removed NOOP_LOGGER and NoopLogger exports from @opentelemetry/api-logs. Use createNoopLogger(): Logger instead. #6713 @dyladan

feat(api-logs)!: rename scopeAttributes to attributes in LoggerOptions #6573 @pichlermarc

fix(sdk-node)!: remove buildSamplerFromConfig export #6784 @trentm

🚀 Features

feat(sdk-node): wire up metric producers from declarative config #6712 @MikeGoldsmith

feat(sdk-logs)!: add support for attributes in LoggerOptions #6573 @pichlermarc

🐛 Bug Fixes

fix(sdk-node): pass all config properties to log record exporters in declarative config #6708 @MikeGoldsmith

fix(sdk-node): warn and ignore zero exporter timeout in declarative config #6711 @MikeGoldsmith

fix(sdk-node): pass gRPC credentials and headers to span exporter in declarative config #6705 @MikeGoldsmith

fix(otlp-transformer): do not attempt to skip groups #6704 @pichlermarc

fix(otlp-grpc-exporter-base): recreate client after 5 consecutive DEADLINE_EXCEEDED to recover from connection dropped deadlock #6296 @afharo

fix(browser-detector): use the right semantic convention for user agent resource attribute #6729 @david-luna

fix(browser-detector): user agent resource attribute always #6754 @david-luna

fix(opentelemetry-exporter-prometheus): handle additional edge cases in metric name conversion #6727 @cjihrig

fix(sdk-logs): avoid null dereference in BatchLogRecordProcessor._flushAll when an in-flight export completes between awaits #6763 @Janealter

fix(configuration): improve environment variable substitution to handle all the cases shown in the spec #6757 @trentm

📚 Documentation

docs(otlp-exporter-base): index the package's public API in generated docs so types like OTLPExporterNodeConfigBase resolve and link from consumer exporter pages #6725 @devareddy05

🏠 Internal

refactor(configuration): remove redundant env var parsing in EnvironmentConfigFactory #6710 @MikeGoldsmith

Commits

13a035b chore: prepare next release (#6756)
4b13587 Merge commit from fork
71d195c chore(renovate): set minimumReleaseAge to 3 days (#6792)
555fca6 Update renovate.json to use matchManagers (#6141)
b711a81 docs(otlp-exporter-base): add typedoc entry points so public API is indexed a...
da70402 fix(ci): supply-chain sec: disable caching in release-related workflow (#6790)
002267b chore: complete the move to the smaller SPDX license header (#6791)
056ef9c feat(sdk-metrics): implement metric reader metrics (#6449)
3bd69ce fix(configuration): improve environment variable substitution to handle all t...
bfbda7c docs(exporter-trace-otlp-grpc): import CompressionAlgorithm from otlp-exporte...
Additional commits viewable in compare view

Updates @opentelemetry/exporter-logs-otlp-http from 0.218.0 to 0.219.0

Release notes

Sourced from @opentelemetry/exporter-logs-otlp-http's releases.

experimental/v0.219.0

0.219.0

💥 Breaking Changes

fix(configuration)!: stop removing null values from parsed config object #6679 @trentm

It is now the responsibility of the user of a parsed declarative config object, typically just the sdk-node package, to handle null values.

fix(api-logs)!: Removed NOOP_LOGGER and NoopLogger exports from @opentelemetry/api-logs. Use createNoopLogger(): Logger instead. #6713 @dyladan

feat(api-logs)!: rename scopeAttributes to attributes in LoggerOptions #6573 @pichlermarc

fix(sdk-node)!: remove buildSamplerFromConfig export #6784 @trentm

🚀 Features

feat(sdk-node): wire up metric producers from declarative config #6712 @MikeGoldsmith

feat(sdk-logs)!: add support for attributes in LoggerOptions #6573 @pichlermarc

🐛 Bug Fixes

fix(sdk-node): pass all config properties to log record exporters in declarative config #6708 @MikeGoldsmith

fix(sdk-node): warn and ignore zero exporter timeout in declarative config #6711 @MikeGoldsmith

fix(sdk-node): pass gRPC credentials and headers to span exporter in declarative config #6705 @MikeGoldsmith

fix(otlp-transformer): do not attempt to skip groups #6704 @pichlermarc

fix(otlp-grpc-exporter-base): recreate client after 5 consecutive DEADLINE_EXCEEDED to recover from connection dropped deadlock #6296 @afharo

fix(browser-detector): use the right semantic convention for user agent resource attribute #6729 @david-luna

fix(browser-detector): user agent resource attribute always #6754 @david-luna

fix(opentelemetry-exporter-prometheus): handle additional edge cases in metric name conversion #6727 @cjihrig

fix(sdk-logs): avoid null dereference in BatchLogRecordProcessor._flushAll when an in-flight export completes between awaits #6763 @Janealter

fix(configuration): improve environment variable substitution to handle all the cases shown in the spec #6757 @trentm

📚 Documentation

docs(otlp-exporter-base): index the package's public API in generated docs so types like OTLPExporterNodeConfigBase resolve and link from consumer exporter pages #6725 @devareddy05

🏠 Internal

refactor(configuration): remove redundant env var parsing in EnvironmentConfigFactory #6710 @MikeGoldsmith

Commits

13a035b chore: prepare next release (#6756)
4b13587 Merge commit from fork
71d195c chore(renovate): set minimumReleaseAge to 3 days (#6792)
555fca6 Update renovate.json to use matchManagers (#6141)
b711a81 docs(otlp-exporter-base): add typedoc entry points so public API is indexed a...
da70402 fix(ci): supply-chain sec: disable caching in release-related workflow (#6790)
002267b chore: complete the move to the smaller SPDX license header (#6791)
056ef9c feat(sdk-metrics): implement metric reader metrics (#6449)
3bd69ce fix(configuration): improve environment variable substitution to handle all t...
bfbda7c docs(exporter-trace-otlp-grpc): import CompressionAlgorithm from otlp-exporte...
Additional commits viewable in compare view

Updates @opentelemetry/resources from 2.7.1 to 2.8.0

Release notes

Sourced from @opentelemetry/resources's releases.

v2.8.0

2.8.0

🚀 Features

feat(sdk-trace-base): pretty-print SpanImpl, Tracer, and BasicTracerProvider via util.inspect so they render through diag and console.log #6690 @mcollina

feat(sdk-metrics): implement metric reader self-observability metrics #6449 @anuraaga

feat(core): add hrTimeToSeconds #6449 @anuraaga

🐛 Bug Fixes

fix(core): limit processing of incoming "baggage" header to 8192 bytes @pichlermarc

Changelog

Sourced from @opentelemetry/resources's changelog.

2.8.0

🚀 Features

feat(sdk-trace-base): pretty-print SpanImpl, Tracer, and BasicTracerProvider via util.inspect so they render through diag and console.log #6690 @mcollina

feat(sdk-metrics): implement metric reader self-observability metrics #6449 @anuraaga

feat(core): add hrTimeToSeconds #6449 @anuraaga

🐛 Bug Fixes

fix(core): limit processing of incoming "baggage" header to 8192 bytes @pichlermarc

Commits

13a035b chore: prepare next release (#6756)
4b13587 Merge commit from fork
71d195c chore(renovate): set minimumReleaseAge to 3 days (#6792)
555fca6 Update renovate.json to use matchManagers (#6141)
b711a81 docs(otlp-exporter-base): add typedoc entry points so public API is indexed a...
da70402 fix(ci): supply-chain sec: disable caching in release-related workflow (#6790)
002267b chore: complete the move to the smaller SPDX license header (#6791)
056ef9c feat(sdk-metrics): implement metric reader metrics (#6449)
3bd69ce fix(configuration): improve environment variable substitution to handle all t...
bfbda7c docs(exporter-trace-otlp-grpc): import CompressionAlgorithm from otlp-exporte...
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the production group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.2.0` | `5.0.0` | | [uuid](https://github.com/uuidjs/uuid) | `14.0.0` | `14.0.1` | | [undici](https://github.com/nodejs/undici) | `8.4.1` | `8.5.0` | | [@opentelemetry/api-logs](https://github.com/open-telemetry/opentelemetry-js) | `0.218.0` | `0.219.0` | | [@opentelemetry/sdk-logs](https://github.com/open-telemetry/opentelemetry-js) | `0.218.0` | `0.219.0` | | [@opentelemetry/exporter-logs-otlp-http](https://github.com/open-telemetry/opentelemetry-js) | `0.218.0` | `0.219.0` | | [@opentelemetry/resources](https://github.com/open-telemetry/opentelemetry-js) | `2.7.1` | `2.8.0` | Updates `js-yaml` from 4.2.0 to 5.0.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.2.0...5.0.0) Updates `uuid` from 14.0.0 to 14.0.1 - [Release notes](https://github.com/uuidjs/uuid/releases) - [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md) - [Commits](uuidjs/uuid@v14.0.0...v14.0.1) Updates `undici` from 8.4.1 to 8.5.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v8.4.1...v8.5.0) Updates `@opentelemetry/api-logs` from 0.218.0 to 0.219.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.218.0...experimental/v0.219.0) Updates `@opentelemetry/sdk-logs` from 0.218.0 to 0.219.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.218.0...experimental/v0.219.0) Updates `@opentelemetry/exporter-logs-otlp-http` from 0.218.0 to 0.219.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.218.0...experimental/v0.219.0) Updates `@opentelemetry/resources` from 2.7.1 to 2.8.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@v2.7.1...v2.8.0) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 5.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production - dependency-name: uuid dependency-version: 14.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production - dependency-name: undici dependency-version: 8.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: "@opentelemetry/api-logs" dependency-version: 0.219.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: "@opentelemetry/sdk-logs" dependency-version: 0.219.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: "@opentelemetry/exporter-logs-otlp-http" dependency-version: 0.219.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production - dependency-name: "@opentelemetry/resources" dependency-version: 2.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 22, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

build(deps): Bump the production group across 1 directory with 7 updates#199

build(deps): Bump the production group across 1 directory with 7 updates#199
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-2d50e25a57

dependabot Bot commented on behalf of github Jun 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Advisory	CVE	Severity (CVSS)	Fixed in	Fix commit
GHSA-vxpw-j846-p89q	CVE-2026-12151	High (7.5)	8.5.0	`32dbf0b3`
GHSA-38rv-x7px-6hhq	CVE-2026-9675	High (7.5)	8.5.0	`b4c287b3`
GHSA-vmh5-mc38-953g	CVE-2026-9697	High (7.4)	8.5.0	`42d49559`
GHSA-hm92-r4w5-c3mj	CVE-2026-6734	High (7.5)	8.2.0	`a516f870`
GHSA-pr7r-676h-xcf6	CVE-2026-9678	Moderate (5.9)	8.5.0	`cb105d7c`
GHSA-p88m-4jfj-68fv	CVE-2026-9679	Moderate (5.9)	8.5.0	`5655ea43`
GHSA-g8m3-5g58-fq7m	CVE-2026-11525	Low (3.7)	8.5.0	`5655ea43`
GHSA-35p6-xmwp-9g52	CVE-2026-6733	Low (3.7)	8.5.0	`6ea54ef8`

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jun 22, 2026

[5.0.0] - 2026-06-20

Added

Changed

Removed

v14.0.1

14.0.1 (2026-06-20)

Bug Fixes

14.0.1 (2026-06-20)

Bug Fixes

v8.5.0

⚠️ Security Release

Summary

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

WebSocket DoS via cumulative fragment bypass — CVE-2026-9675

experimental/v0.219.0

0.219.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

📚 Documentation

🏠 Internal

experimental/v0.219.0

0.219.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

📚 Documentation

🏠 Internal

experimental/v0.219.0

0.219.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

📚 Documentation

🏠 Internal

v2.8.0

2.8.0

🚀 Features

🐛 Bug Fixes

2.8.0

🚀 Features

🐛 Bug Fixes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants