Skip to content

chore(deps): bump the npm_and_yarn group across 3 directories with 9 updates - #882

Merged
karinamaulitova merged 2 commits into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-69bb93ee69
Oct 30, 2026
Merged

chore(deps): bump the npm_and_yarn group across 3 directories with 9 updates#882
karinamaulitova merged 2 commits into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-69bb93ee69

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 29, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 9 updates in the / directory:

Package From To
ua-parser-js 2.0.3 2.0.10
@vitest/mocker 3.2.7 5.0.5
baseline-browser-mapping 2.10.43 2.11.34
body-parser 1.20.6 1.20.9
brace-expansion 1.1.16 1.1.21
fast-uri 3.1.8 3.1.9
js-yaml 3.15.0 3.15.2
postcss-selector-parser 6.1.4 6.1.5
undici 6.27.0 6.29.1

Bumps the npm_and_yarn group with 1 update in the /packages/lido-landing-ui directory: ua-parser-js.
Bumps the npm_and_yarn group with 1 update in the /packages/lido-shared-ui directory: ua-parser-js.

Updates ua-parser-js from 2.0.3 to 2.0.10

Release notes

Sourced from ua-parser-js's releases.

v2.0.10

Version 2.0.10

  • Fix ReDoS vulnerability by limiting Client Hints input length (GHSA-9h5v-pfqq-x599)
  • Add new method useExtension() in UAParser to extend custom detection rules
  • Add new device vendor: Blackview, Coolpad, CUBOT, T-Mobile
  • Improve browser detection: Huawei Browser, UCBrowser
  • Improve OS detection: iOS
  • Identify WebView user-agent as inapp browser
  • extensions submodule:
    • Add new crawler: atlassian-bot, Audisto Crawler, AwarioBot, AwarioRssBot, AwarioSmartBot, BrightEdge Crawler, HubSpot Crawler, Meta-ExternalAds, Meta-WebIndexer, proximic, yacybot
    • Add new fetcher: Feedly, GoogleDocs, UptimeBot, virustotal
    • Add new library: phpcrawl
  • helpers submodule:
    • Fix isElectron() function return itself

What's Changed

New Contributors

Full Changelog: faisalman/ua-parser-js@2.0.9...2.0.10

v2.0.9

Version 2.0.9

  • Restore icons directory
  • Add new browser: Aloha Browser, Avira Secure Browser, Lighthouse, Luakit, Norton Private Browser
  • Add new OS: Vega OS
  • Improve OS detection: watchOS
  • extensions submodule:
    • Add new crawler: atlassian-bot, Cloudflare-AutoRAG, Google-NotebookLM, SemrushBot-SWA
    • Add new fetcher: FlipboardProxy

What's Changed

New Contributors

Full Changelog: faisalman/ua-parser-js@2.0.8...2.0.9

v2.0.8

Version 2.0.8

... (truncated)

Changelog

Sourced from ua-parser-js's changelog.

Version 2.0.10

  • Fix ReDoS vulnerability by limiting Client Hints input length (GHSA-9h5v-pfqq-x599)
  • Add new method useExtension() in UAParser to extend custom detection rules
  • Add new device vendor: Blackview, Coolpad, CUBOT, T-Mobile
  • Improve browser detection: Huawei Browser, UCBrowser
  • Improve OS detection: iOS
  • Identify WebView user-agent as inapp browser
  • extensions submodule:
    • Add new crawler: atlassian-bot, Audisto Crawler, AwarioBot, AwarioRssBot, AwarioSmartBot, BrightEdge Crawler, HubSpot Crawler, Meta-ExternalAds, Meta-WebIndexer, proximic, yacybot
    • Add new fetcher: Feedly, GoogleDocs, UptimeBot, virustotal
    • Add new library: phpcrawl
  • helpers submodule:
    • Fix isElectron() function return itself

Version 2.0.9

  • Restore icons directory
  • Add new browser: Aloha Browser, Avira Secure Browser, Lighthouse, Luakit, Norton Private Browser
  • Add new OS: Vega OS
  • Improve OS detection: watchOS
  • extensions submodule:
    • Add new crawler: atlassian-bot, Cloudflare-AutoRAG, Google-NotebookLM, SemrushBot-SWA
    • Add new fetcher: FlipboardProxy

Version 2.0.8

  • Resolve syntax error related to import renaming in ESM build
  • Add new browser: HiBrowser, Opera Neon
  • Add new engine: Dillo
  • Improve browser detection: Brave, TikTok
  • Improve device detection: OnePlus
  • Improve OS detection: Firefox OS
  • extensions submodule:
    • Add new CLI: PowerShell
    • Add new email: Alpine, Android, AquaMail, Balsa, Barca, Canary, Claws Mail, eM Client, Eudora, FairEmail, Geary, Gnus, Horde::IMP, Lotus-Notes, IncrediMail, K-9 Mail, Mailbird, MailMate, Mailspring, Mutt, Newton, Nine, NylasMail, Outlook-Express, Pegasus Mail, PocoMail, Postbox, ProtonMail Bridge, Quala, R2Mail2, Rainloop, Roundcube Webmail, SamsungEmail, Spicebird, SquirrelMail, Sylpheed, The Bat!, Trojita, Turnpike, tutanota-desktop, Wanderlust, Windows-Live-Mail
    • Add new library: http.rb, Jetty, ocaml-cohttp
  • helpers submodule:
    • Add new method: getOutlookEdition() to map Outlook versions to their marketing editions

Version 2.0.7

  • Add support for chaining withClientHints() & withFeatureCheck()
  • Add new browser: Atlas, Steam
  • Add new device vendor: Anbernic, Logitech, Valve
  • Improve device detection: Xiaomi
  • Improve OS detection: iOS
  • Split helpers submodule into several new submodules:
    • bot-detection:
      • isAIAssistant()

... (truncated)

Commits
  • 4121c59 Build: Bump version 2.0.10
  • 90354d3 Fix: Prevent ReDoS vulnerability by limiting Client Hints input length (GHSA-...
  • 3baa3bc Test: Increase nyc timeout to fix timeout error
  • 18d39b5 CI: Add GitHub Actions workflow to publish to Docker Hub
  • 58b5a0c Build: Add Dockerfile for container image build
  • 965c20d CI: Update fuzz test
  • ad97fea Build: Set sideEffects=false in package.json for tree shaking (#781)
  • 312598f CI: Add AI and spam detection to pull request workflow
  • 8f9e4dc Test: Fix relative path and update done() callback in CLI test spec
  • eb809ec Chore(license): Add THIRD_PARTY_NOTICES.md for third-party assets
  • Additional commits viewable in compare view

Updates @vitest/mocker from 3.2.7 to 5.0.5

Release notes

Sourced from @​vitest/mocker's releases.

v5.0.5

   🐞 Bug Fixes

    View changes on GitHub

v5.0.4

   🚀 Features

   🐞 Bug Fixes

... (truncated)

Commits

Updates baseline-browser-mapping from 2.10.43 to 2.11.34

Release notes

Sourced from baseline-browser-mapping's releases.

v2.11.0

What's Changed in 2.11.0

  • feat: Adds a new getTimeline() method for getting the series of minimum browser changes, either grouped by date or by browser.
  • refactor: Substantial refactoring of the data compression process that replaces the full list of browsers from @mdn/browser-compat-data and downstream-browsers.json and features from web-features (in their very pared down form) with a change-list timeline that reflects which versions supported Baseline (newly available) on a given date. Thanks to @​swwind for the idea!
  • refactor: Some common functions have been moved to a util.ts module for use in other scripts.
  • fix: Removes process.exit() calls when unsupported option combinations are passed to getCompatibleVersions() and getAllVersions() in favour of throwing an Error. There is a small security risk with process.exit() calls that sites accepting unsanitised inputs could be the subject of attacks. Unsupported config options now throw and Error which should allow for more graceful handling. Thanks to @​bnbdr for flagging this as vulnerability CVE-2026-45819 .

Fixes #134

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.10.44...v2.11.0

Commits
  • 4a311c7 Patch to 2.11.34 because browser or feature data changed
  • cadd64d Browser or feature data changed
  • 7439261 Updating static site
  • 47dde6e Patch to 2.11.33 because browser or feature data changed
  • 7d23626 Browser or feature data changed
  • 107852a Updating static site
  • b010b39 Patch to 2.11.32 because browser or feature data changed
  • b41f5fb Browser or feature data changed
  • b1b7b47 Updating static site
  • 22ea69a Patch to 2.11.31 because browser or feature data changed
  • Additional commits viewable in compare view

Updates body-parser from 1.20.6 to 1.20.9

Release notes

Sourced from body-parser's releases.

1.20.9

Important: Security

What's Changed

Full Changelog: expressjs/body-parser@1.20.8...1.20.9

1.20.8

Important

Same code base as 1.20.7. This was created to test the new release process.

What's Changed

Full Changelog: expressjs/body-parser@1.20.7...1.20.8

1.20.7

What's Changed

Full Changelog: expressjs/body-parser@1.20.6...1.20.7

Changelog

Sourced from body-parser's changelog.

1.20.9

1.20.8

  • Same code base as 1.20.7. This was created to test the new release process.

1.20.7

  • deps: qs@~6.16.0
Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for body-parser since your current version.


Updates brace-expansion from 1.1.16 to 1.1.21

Commits

Updates fast-uri from 3.1.8 to 3.1.9

Release notes

Sourced from fast-uri's releases.

v3.1.9

Security

This security release fixes four URI parsing and normalization vulnerabilities in fast-uri 3.x. Applications that process untrusted URI input should upgrade to v3.1.9.

  • Medium — URI scheme spoofing through percent-encoded schemes (GHSA-w74x-v6f9-j3xg, CVE-2026-110306): percent-encoded scheme input is now rejected instead of being decoded into a live scheme.
  • Medium — Host confusion during domain-host canonicalization (GHSA-wjr9-j795-jxcr, CVE-2026-110180): malformed domain hosts containing ambiguous delimiters or stripped control characters are now rejected instead of being silently rewritten.
  • Low — Incorrect relative-reference normalization (GHSA-xhq7-xmqj-769h, CVE-2026-110095): dot-segment removal now preserves the resolution semantics of relative references.
  • Low — Scheme injection in suffix references (GHSA-333x-w4r6-6crp, CVE-2026-110725): first-segment colons in path-only suffix references are now escaped so the output is not reparsed as a scheme.

Upgrade with:

npm install fast-uri@3.1.9

Thanks to @​zekth for reporting the scheme, host, and relative-reference issues, and to @​UlisesGascon for finding the suffix-reference issue and reviewing the remediations.

What's Changed

Full Changelog: fastify/fast-uri@v3.1.8...v3.1.9

Commits
  • 0def703 Bumped v3.1.9
  • a1d0da2 test: generate only relative path references
  • 9eb8759 fix: preserve relative paths in suffix and relative resolution
  • 54c30f7 docs: note suffix-reference authority ambiguity
  • 39e6493 fix: escape a first-segment colon in suffix references
  • 745183c test: cover first-segment colon in suffix references
  • ddfc6a5 fix(SEC-03): reject non reg-name characters in domain hosts
  • d86a8d2 fix: keep a colon-first segment behind "./" in relative normalization
  • eb483b5 test: cover colon-first relative references in normalization
  • b110a35 fix(SEC-02): preserve meaning of relative references during normalization
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for fast-uri since your current version.


Updates js-yaml from 3.15.0 to 3.15.2

Changelog

Sourced from js-yaml's changelog.

3.15.2 - 2026-08-26

Changed

  • [backport] Hard-limit merge sequence size to 100.

Security

  • [backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

3.15.1 - 2026-07-31

Security

  • [backport] Remove quadratic complexity from !!omap duplicate key detection.
Commits

Updates postcss-selector-parser from 6.1.4 to 6.1.5

Release notes

Sourced from postcss-selector-parser's releases.

6.1.5

The 6.x line is now in security-only maintenance

This release exists because the advisory above covers every published 6.x version, and until now the only remediation on offer was an upgrade to 7.x. 6.1.5 is the patched version for the 6.x line.

The line is kept alive for the installed base that cannot move to 7 yet, Tailwind CSS 3 in particular, which depends on ^6.1.2. From here on it receives security fixes only: no features, no other bug fixes, no type changes. Everything else goes to 7.x, where this package is actively developed. Tailwind CSS 4 no longer depends on this package at all, so this line is expected to retire on its own.

6.1.5 is published under the legacy-v6 npm dist-tag, so npm install postcss-selector-parser keeps resolving to 7.x. Existing ^6 ranges pick up 6.1.5 as usual.

Changelog

Sourced from postcss-selector-parser's changelog.

6.1.5 - 2026-10-19

The 6.x line is now in security-only maintenance

This release exists because the advisory above covers every published 6.x version, and until now the only remediation on offer was an upgrade to 7.x. 6.1.5 is the patched version for the 6.x line.

The line is kept alive for the installed base that cannot move to 7 yet, Tailwind CSS 3 in particular, which depends on ^6.1.2. From here on it receives security fixes only: no features, no other bug fixes, no type changes. Everything else goes to 7.x, where this package is actively developed. Tailwind CSS 4 no longer depends on this package at all, so this line is expected to retire on its own.

6.1.5 is published under the legacy-v6 npm dist-tag, so npm install postcss-selector-parser keeps resolving to 7.x. Existing ^6 ranges pick up 6.1.5 as usual.

Commits

Updates undici from 6.27.0 to 6.29.1

Release notes

Sourced from undici's releases.

v6.29.1

Security fixes

High severity

Denial of service via TLS 1.2 certificate-changing renegotiation

CVE-2026-87018 · GHSA-qrxm-fqhp-jwvm

A malicious or compromised HTTPS server could crash the Node.js process by initiating TLS 1.2 renegotiation and presenting a different, CA-trusted certificate whose hostname did not match the requested host. The resulting socket error reached an assertion in undici's HTTP/1.1 and HTTP/2 connection handling. This release handles post-connect certificate errors without terminating the process.

TLS certificate validation bypass through dropped Agent options

CVE-2026-109383 · GHSA-2m5v-pch6-74hx

Agent used a JSON-based clone for constructor options, which silently removed function-valued TLS options such as checkServerIdentity. Applications relying on custom certificate or public-key verification could therefore accept a certificate that the callback was intended to reject. This release preserves TLS options when creating per-origin dispatchers.

Denial of service through excessive Content-Encoding values

CVE-2026-109869 · GHSA-xjj6-f33q-929c

A malicious HTTP server could crash the Node.js process by returning more than five content codings and closing the connection before sending the body. Although fetch() rejected the response, an error from an orphaned internal stream could remain unhandled. This release validates the content-encoding chain before creating the body stream and aborts oversized chains safely.

Medium severity

Denial of service through unbounded EventSource parser state

CVE-2026-109924 · GHSA-4qv8-2p9j-2685

A malicious Server-Sent Events endpoint could exhaust process memory by sending many tiny data: fields without completing an event, or by splitting an unfinished line across many chunks. This release bounds retained EventSource parser state, including field counts, buffered chunks, unfinished-line length, and retained field data.

Denial of service through unbounded automatic WebSocket PONG buffering

CVE-2026-109932 · GHSA-9fm3-97px-rjf6

A malicious WebSocket server could exhaust process memory by flooding the client with PING frames while not reading the automatic PONG responses. undici previously ignored socket backpressure and allowed the outbound queue to grow without bound. This release pauses frame parsing when PONG writes encounter backpressure and resumes after the socket drains.

What's Changed

Full Changelog: nodejs/undici@v6.29.0...v6.29.1

v6.29.0

What's Changed

... (truncated)

Commits
  • 8c57f6c [Release] v6.29.1 (#6023)
  • 39f93e1 fix(websocket): bound automatic PONG writes under backpressure
  • c43b23f fix(eventsource): bound retained SSE parser state
  • 1325a87 fix(fetch): abort excessive content encoding responses
  • 8c59f6b fix: preserve Agent connection options
  • b40fbfc fix: handle post-connect TLS certificate errors
  • 407630a [v6.x] fix(fetch): fix aborting Streams (#3754) (#6000)
  • e1d0501 Bumped v6.29.0 (#5888)
  • 57ac4de test: synchronize the issue-3356 body timeout (#5834)
  • 6d44174 Backport upgrade diagnostics lifecycle fixes to v6.x (#5833)
  • Additional commits viewable in compare view

Updates ua-parser-js from 2.0.3 to 2.0.10

Release notes

Sourced from ua-parser-js's releases.

v2.0.10

Version 2.0.10

  • Fix ReDoS vulnerability by limiting Client Hints input length (GHSA-9h5v-pfqq-x599)
  • Add new method useExtension() in UAParser to extend custom detection rules
  • Add new device vendor: Blackview, Coolpad, CUBOT, T-Mobile
  • Improve browser detection: Huawei Browser, UCBrowser
  • Improve OS detection: iOS
  • Identify WebView user-agent as inapp browser
  • extensions submodule:
    • Add new crawler: atlassian-bot, Audisto Crawler, AwarioBot, AwarioRssBot, AwarioSmartBot, BrightEdge Crawler, HubSpot Crawler, Meta-ExternalAds, Meta-WebIndexer, proximic, yacybot
    • Add new fetcher: Feedly, GoogleDocs, UptimeBot, virustotal
    • Add new library: phpcrawl
  • helpers submodule:
    • Fix isElectron() function return itself

What's Changed

New Contributors

Full Changelog: faisalman/ua-parser-js@2.0.9...2.0.10

v2.0.9

Version 2.0.9

  • Restore icons directory
  • Add new browser: Aloha Browser, Avira Secure Browser, Lighthouse, Luakit, Norton Private Browser
  • Add new OS: Vega OS
  • Improve OS detection: watchOS
  • extensions submodule:
    • Add new crawler: atlassian-bot, Cloudflare-AutoRAG, Google-NotebookLM, SemrushBot-SWA
    • Add new fetcher: FlipboardProxy

What's Changed

New Contributors

Full Changelog: faisalman/ua-parser-js@2.0.8...2.0.9

v2.0.8

Version 2.0.8

... (truncated)

Changelog

Sourced from ua-parser-js's changelog.

Version 2.0.10

  • Fix ReDoS vulnerability by limiting Client Hints input length (GHSA-9h5v-pfqq-x599)
  • Add new method useExtension() in UAParser to extend custom detection rules
  • Add new device vendor: Blackview, Coolpad, CUBOT, T-Mobile
  • Improve browser detection: Huawei Browser, UCBrowser
  • Improve OS detection: iOS
  • Identify WebView user-agent as inapp browser
  • extensions submodule:
    • Add new crawler: atlassian-bot, Audisto Crawler, AwarioBot, AwarioRssBot, AwarioSmartBot, BrightEdge Crawler, HubSpot Crawler, Meta-ExternalAds, Meta-WebIndexer, proximic, yacybot
    • Add new fetcher: Feedly, GoogleDocs, UptimeBot, virustotal
    • Add new library: phpcrawl
  • helpers submodule:
    • Fix isElectron() function return itself

Version 2.0.9

  • Restore icons directory
  • Add new browser: Aloha Browser, Avira Secure Browser, Lighthouse, Luakit, Norton Private Browser
  • Add new OS: Vega OS
  • Improve OS detection: watchOS
  • extensions submodule:
    • Add new crawler: atlassian-bot, Cloudflare-AutoRAG, Google-NotebookLM, SemrushBot-SWA
    • Add new fetcher: FlipboardProxy

Version 2.0.8

  • Resolve syntax error related to import renaming in ESM build
  • Add new browser: HiBrowser, Opera Neon
  • Add new engine: Dillo
  • Improve browser detection: Brave, TikTok
  • Improve device detection: OnePlus
  • Improve OS detection: Firefox OS
  • extensions submodule:
    • Add new CLI: PowerShell
    • Add new email: Alpine, Android, AquaMail, Balsa, Barca, Canary, Claws Mail, eM Client, Eudora, FairEmail, Geary, Gnus, Horde::IMP, Lotus-Notes, IncrediMail, K-9 Mail, Mailbird, MailMate, Mailspring, Mutt, Newton, Nine, NylasMail, Outlook-Express, Pegasus Mail, PocoMail, Postbox, ProtonMail Bridge, Quala, R2Mail2, Rainloop, Roundcube Webmail, SamsungEmail, Spicebird, SquirrelMail, Sylpheed, The Bat!, Trojita, Turnpike, tutanota-desktop, Wanderlust, Windows-Live-Mail
    • Add new library: http.rb, Jetty, ocaml-cohttp
  • helpers submodule:
    • Add new method: getOutlookEdition() to map Outlook versions to their marketing editions

Version 2.0.7

  • Add support for chaining withClientHints() & withFeatureCheck()
  • Add new browser: Atlas, Steam
  • Add new device ve...

    Description has been truncated

@dependabot
chore(deps): bump the npm_and_yarn group across 3 directories with 9 …
70dff38 
…updates

Bumps the npm_and_yarn group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [ua-parser-js](https://github.com/faisalman/ua-parser-js) | `2.0.3` | `2.0.10` |
| [@vitest/mocker](https://github.com/vitest-dev/vitest/tree/HEAD/packages/mocker) | `3.2.7` | `5.0.5` |
| [baseline-browser-mapping](https://github.com/web-platform-dx/baseline-browser-mapping) | `2.10.43` | `2.11.34` |
| [body-parser](https://github.com/expressjs/body-parser) | `1.20.6` | `1.20.9` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.16` | `1.1.21` |
| [fast-uri](https://github.com/fastify/fast-uri) | `3.1.8` | `3.1.9` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `3.15.0` | `3.15.2` |
| [postcss-selector-parser](https://github.com/postcss/postcss-selector-parser) | `6.1.4` | `6.1.5` |
| [undici](https://github.com/nodejs/undici) | `6.27.0` | `6.29.1` |

Bumps the npm_and_yarn group with 1 update in the /packages/lido-landing-ui directory: [ua-parser-js](https://github.com/faisalman/ua-parser-js).
Bumps the npm_and_yarn group with 1 update in the /packages/lido-shared-ui directory: [ua-parser-js](https://github.com/faisalman/ua-parser-js).


Updates `ua-parser-js` from 2.0.3 to 2.0.10
- [Release notes](https://github.com/faisalman/ua-parser-js/releases)
- [Changelog](https://github.com/faisalman/ua-parser-js/blob/master/CHANGELOG.md)
- [Commits](faisalman/ua-parser-js@2.0.3...2.0.10)

Updates `@vitest/mocker` from 3.2.7 to 5.0.5
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/mocker)

Updates `baseline-browser-mapping` from 2.10.43 to 2.11.34
- [Release notes](https://github.com/web-platform-dx/baseline-browser-mapping/releases)
- [Commits](web-platform-dx/baseline-browser-mapping@v2.10.43...v2.11.34)

Updates `body-parser` from 1.20.6 to 1.20.9
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/1.20.9/HISTORY.md)
- [Commits](expressjs/body-parser@1.20.6...1.20.9)

Updates `brace-expansion` from 1.1.16 to 1.1.21
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.16...v1.1.21)

Updates `fast-uri` from 3.1.8 to 3.1.9
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.8...v3.1.9)

Updates `js-yaml` from 3.15.0 to 3.15.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/3.15.2/CHANGELOG.md)
- [Commits](nodeca/js-yaml@3.15.0...3.15.2)

Updates `postcss-selector-parser` from 6.1.4 to 6.1.5
- [Release notes](https://github.com/postcss/postcss-selector-parser/releases)
- [Changelog](https://github.com/postcss/postcss-selector-parser/blob/6.1.5/CHANGELOG.md)
- [Commits](postcss/postcss-selector-parser@6.1.4...6.1.5)

Updates `undici` from 6.27.0 to 6.29.1
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.27.0...v6.29.1)

Updates `ua-parser-js` from 2.0.3 to 2.0.10
- [Release notes](https://github.com/faisalman/ua-parser-js/releases)
- [Changelog](https://github.com/faisalman/ua-parser-js/blob/master/CHANGELOG.md)
- [Commits](faisalman/ua-parser-js@2.0.3...2.0.10)

Updates `ua-parser-js` from 2.0.3 to 2.0.10
- [Release notes](https://github.com/faisalman/ua-parser-js/releases)
- [Changelog](https://github.com/faisalman/ua-parser-js/blob/master/CHANGELOG.md)
- [Commits](faisalman/ua-parser-js@2.0.3...2.0.10)

---
updated-dependencies:
- dependency-name: ua-parser-js
  dependency-version: 2.0.10
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@vitest/mocker"
  dependency-version: 5.0.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: baseline-browser-mapping
  dependency-version: 2.11.34
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: body-parser
  dependency-version: 1.20.9
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 1.1.21
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fast-uri
  dependency-version: 3.1.9
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 3.15.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: postcss-selector-parser
  dependency-version: 6.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 6.29.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ua-parser-js
  dependency-version: 2.0.10
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: ua-parser-js
  dependency-version: 2.0.10
  dependency-type: direct:production
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from a team as a code owner October 29, 2026 10:29
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 29, 2026
@preview-stands

preview-stands Bot commented Oct 29, 2026 •
edited
Loading

Copy link
Copy Markdown

Preview stand status

Stand was demolished

@cakeinpanic
fix(deps): restore compatible Storybook and Vitest versions
48c14bd 
Co-authored-by: cakeinpanic <588916+cakeinpanic@users.noreply.github.com>
Copilot AI requested a review from cakeinpanic October 29, 2026 11:04
@karinamaulitova
karinamaulitova merged commit f12bede into main Oct 30, 2026
10 checks passed
@karinamaulitova
karinamaulitova deleted the dependabot/npm_and_yarn/npm_and_yarn-69bb93ee69 branch October 30, 2026 15:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@karinamaulitova karinamaulitova karinamaulitova approved these changes
@cakeinpanic cakeinpanic Awaiting requested review from cakeinpanic

Assignees

Copilot code review Copilot

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@karinamaulitova