Skip to content

chore(deps): Bump the all-security-updates group across 1 directory with 5 updates - #712

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/projects/ai/agents/examples/deep-search/frontend/all-security-updates-740388a607
Closed

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/projects/ai/agents/examples/deep-search/frontend/all-security-updates-740388a607

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 24, 2026 •

Copy link
Copy Markdown
Contributor

Bumps the all-security-updates group with 5 updates in the /projects/operational-ai-leap/demo_app/ui directory:

Package From To
js-yaml 4.3.1 4.3.2
@angular/common 20.3.27 20.3.28
@angular/compiler 20.3.27 20.3.28
fast-uri 3.1.5 3.1.8
hono 4.13.1 4.13.9
js-yaml 4.3.1 4.3.2

Updates js-yaml from 4.3.1 to 4.3.2

Changelog

Sourced from js-yaml's changelog.

4.3.2 - 2026-08-26

Changed

  • [backport] Hard-limit merge sequence size to 100.

Security

  • [backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.
Commits

Updates @angular/common from 20.3.27 to 20.3.28

Release notes

Sourced from @​angular/common's releases.

20.3.28

core

Commit Description
fix - 2f96c8020f sanitize host bindings on concrete hosts

http

Commit Description
fix - 969133d426 match header values exactly when deleting
fix - 29dd26bd71 preserve immutability of materialized clones
fix - e4c416c20a run root interceptors in the terminal request chain
Changelog

Sourced from @​angular/common's changelog.

20.3.28 (2026-08-13)

core

Commit Type Description
2f96c8020f fix sanitize host bindings on concrete hosts

http

Commit Type Description
969133d426 fix match header values exactly when deleting
29dd26bd71 fix preserve immutability of materialized clones
e4c416c20a fix run root interceptors in the terminal request chain

Commits
  • e4c416c fix(http): run root interceptors in the terminal request chain
  • 969133d fix(http): match header values exactly when deleting
  • 29dd26b fix(http): preserve immutability of materialized clones
  • See full diff in compare view

Updates @angular/compiler from 20.3.27 to 20.3.28

Release notes

Sourced from @​angular/compiler's releases.

20.3.28

core

Commit Description
fix - 2f96c8020f sanitize host bindings on concrete hosts

http

Commit Description
fix - 969133d426 match header values exactly when deleting
fix - 29dd26bd71 preserve immutability of materialized clones
fix - e4c416c20a run root interceptors in the terminal request chain
Changelog

Sourced from @​angular/compiler's changelog.

20.3.28 (2026-08-13)

core

Commit Type Description
2f96c8020f fix sanitize host bindings on concrete hosts

http

Commit Type Description
969133d426 fix match header values exactly when deleting
29dd26bd71 fix preserve immutability of materialized clones
e4c416c20a fix run root interceptors in the terminal request chain

Commits

Updates fast-uri from 3.1.5 to 3.1.8

Release notes

Sourced from fast-uri's releases.

v3.1.8

⚠️ Security Warning

This security release fixes the following medium-severity security advisory:

Users of the v3.x release line should upgrade to v3.1.8.

Full Changelog: fastify/fast-uri@v3.1.7...v3.1.8

v3.1.7

⚠️ Security Warning

This is a security release that fixes the following high-severity security advisories:

Users of the v3.x release line should upgrade to v3.1.7.

Full Changelog: fastify/fast-uri@v3.1.6...v3.1.7

v3.1.6

⚠️ Security Warning

This release addresses the following high-severity security advisories:

Users of the v3.x release line should upgrade to v3.1.6.

Full Changelog: fastify/fast-uri@v3.1.5...v3.1.6

Commits
  • ead3ab7 Bumped v3.1.8
  • c88b59e fix: normalize decoded reg-name case
  • 412e40a Bumped v3.1.7
  • 9f4c943 fix: backport port and IP-literal validation to v3.x (#216)
  • 1eb3ce4 fix: treat unterminated bracket hosts as reg-names again (#214)
  • 6f970b2 Bumped v3.1.6
  • d941579 fix: never run IDN canonicalization on bracketed IP literals
  • c0f0279 test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)
  • 37f3417 Merge commit from fork
  • 607bfbe Merge commit from fork
  • Additional commits viewable in compare view

Updates hono from 4.13.1 to 4.13.9

Release notes

Sourced from hono's releases.

v4.13.9

What's Changed

  • fix(jsx): replace Suspense and ErrorBoundary content across newlines in honojs/hono#5380
  • fix(accepts): match media types and language tags case-insensitively in honojs/hono#5376
  • fix(linear-router): don't match an empty path segment as a param in honojs/hono#5373
  • fix(pretty-json): don't break responses with unparseable JSON bodies in honojs/hono#5377
  • fix(jwt): throw JwtTokenInvalid when the signature is not valid base64url in honojs/hono#5379
  • fix(aws-lambda): treat binary +xml archive media types as binary in honojs/hono#5424
  • fix(aws-lambda): preserve empty query parameters in honojs/hono#5292
  • fix(lambda-edge): sync content type detection with aws-lambda in honojs/hono#5426
  • fix(lambda-edge): fail with a descriptive error on a malformed event in honojs/hono#5358

Full Changelog: honojs/hono@v4.13.8...v4.13.9

v4.13.8

What's Changed

Full Changelog: honojs/hono@v4.13.7...v4.13.8

v4.13.7

Security fixes

This release includes a fix for the following security issue:

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Affects: Suspense, ErrorBoundary, and Context.Provider in hono/jsx, and renderToString() / renderToReadableStream() in hono/jsx/dom/server. Fixes missing HTML escaping for a plain string placed directly as a child or fallback of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv


Users who render untrusted strings inside Suspense, ErrorBoundary, or Context.Provider, or pass them directly to hono/jsx/dom/server, are strongly encouraged to upgrade to this version.

v4.13.6

What's Changed

Full Changelog: honojs/hono@v4.13.5...v4.13.6

... (truncated)

Commits
  • 7c3b0df 4.13.9
  • 6cadf75 fix(lambda-edge): fail with a descriptive error on a malformed event (#5358)
  • de310ac fix(lambda-edge): sync content type detection with aws-lambda (#5426)
  • 28e8572 fix(aws-lambda): preserve empty query parameters (#5292)
  • 0d86899 fix(aws-lambda): treat binary +xml archive media types as binary (#5424)
  • 52febbc fix(jwt): throw JwtTokenInvalid when the signature is not valid base64url (#5...
  • f950277 fix(pretty-json): don't break responses with unparseable JSON bodies (#5377)
  • 00ee875 fix(linear-router): don't match an empty path segment as a param (#5373)
  • f5a5346 fix(accepts): match media types and language tags case-insensitively (#5376)
  • cb5bea3 fix(jsx): replace Suspense and ErrorBoundary content across newlines (#5380)
  • Additional commits viewable in compare view

Updates js-yaml from 4.3.1 to 4.3.2

Changelog

Sourced from js-yaml's changelog.

4.3.2 - 2026-08-26

Changed

  • [backport] Hard-limit merge sequence size to 100.

Security

  • [backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

…ith 5 updates

Bumps the all-security-updates group with 5 updates in the /projects/operational-ai-leap/demo_app/ui directory:

| Package | From | To |
| --- | --- | --- |
| [js-yaml](https://github.com/nodeca/js-yaml) | `4.3.1` | `4.3.2` |
| [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common) | `20.3.27` | `20.3.28` |
| [@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler) | `20.3.27` | `20.3.28` |
| [fast-uri](https://github.com/fastify/fast-uri) | `3.1.5` | `3.1.8` |
| [hono](https://github.com/honojs/hono) | `4.13.1` | `4.13.9` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `4.3.1` | `4.3.2` |



Updates `js-yaml` from 4.3.1 to 4.3.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.3.1...4.3.2)

Updates `@angular/common` from 20.3.27 to 20.3.28
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/v20.3.28/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v20.3.28/packages/common)

Updates `@angular/compiler` from 20.3.27 to 20.3.28
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/v20.3.28/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v20.3.28/packages/compiler)

Updates `fast-uri` from 3.1.5 to 3.1.8
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.5...v3.1.8)

Updates `hono` from 4.13.1 to 4.13.9
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.1...v4.13.9)

Updates `js-yaml` from 4.3.1 to 4.3.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.3.1...4.3.2)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.3.2
  dependency-type: indirect
  dependency-group: all-security-updates
- dependency-name: "@angular/common"
  dependency-version: 20.3.28
  dependency-type: direct:production
  dependency-group: all-security-updates
- dependency-name: "@angular/compiler"
  dependency-version: 20.3.28
  dependency-type: direct:production
  dependency-group: all-security-updates
- dependency-name: fast-uri
  dependency-version: 3.1.8
  dependency-type: indirect
  dependency-group: all-security-updates
- dependency-name: hono
  dependency-version: 4.13.9
  dependency-type: indirect
  dependency-group: all-security-updates
- dependency-name: js-yaml
  dependency-version: 4.3.2
  dependency-type: indirect
  dependency-group: all-security-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file p0 SECURITY labels Sep 24, 2026
@github-actions

Copy link
Copy Markdown

Super-linter summary

Language Validation result
EDITORCONFIG Pass ✅
GITLEAKS Pass ✅
GIT_COMMITLINT Pass ✅
GIT_MERGE_CONFLICT_MARKERS Pass ✅
JSON Pass ✅
JSON_PRETTIER Pass ✅
SPELL_CODESPELL Pass ✅

All files and directories linted successfully

For more information, see the
GitHub Actions workflow run

Powered by Super-linter

copybara-service Bot pushed a commit that referenced this pull request Sep 24, 2026
…ith 5 updates

Import of github PR #712 from dependabot[bot]
#712

Bumps the all-security-updates group with 5 updates in the /projects/operational-ai-leap/demo_app/ui directory:

[js-yaml](https://github.com/nodeca/js-yaml): `4.3.1` → `4.3.2`
[@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common): `20.3.27` → `20.3.28`
[@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler): `20.3.27` → `20.3.28`
[fast-uri](https://github.com/fastify/fast-uri): `3.1.5` → `3.1.8`
[hono](https://github.com/honojs/hono): `4.13.1` → `4.13.9`
[js-yaml](https://github.com/nodeca/js-yaml): `4.3.1` → `4.3.2`

Updates `js-yaml` from 4.3.1 to 4.3.2

Updates `@angular/common` from 20.3.27 to 20.3.28

Updates `@angular/compiler` from 20.3.27 to 20.3.28

Updates `fast-uri` from 3.1.5 to 3.1.8

Updates `hono` from 4.13.1 to 4.13.9

Updates `js-yaml` from 4.3.1 to 4.3.2

---

### Commit Message(s):

--
Change 1 of 1 by dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>:

chore(deps): Bump the all-security-updates group across 1 directory with 5 updates

Bumps the all-security-updates group with 5 updates in the /projects/operational-ai-leap/demo_app/ui directory:

[js-yaml](https://github.com/nodeca/js-yaml): `4.3.1` → `4.3.2`
[@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common): `20.3.27` → `20.3.28`
[@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler): `20.3.27` → `20.3.28`
[fast-uri](https://github.com/fastify/fast-uri): `3.1.5` → `3.1.8`
[hono](https://github.com/honojs/hono): `4.13.1` → `4.13.9`
[js-yaml](https://github.com/nodeca/js-yaml): `4.3.1` → `4.3.2`

Updates `js-yaml` from 4.3.1 to 4.3.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.3.1...4.3.2)

Updates `@angular/common` from 20.3.27 to 20.3.28
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/v20.3.28/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v20.3.28/packages/common)

Updates `@angular/compiler` from 20.3.27 to 20.3.28
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/v20.3.28/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v20.3.28/packages/compiler)

Updates `fast-uri` from 3.1.5 to 3.1.8
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.5...v3.1.8)

Updates `hono` from 4.13.1 to 4.13.9
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.1...v4.13.9)

Updates `js-yaml` from 4.3.1 to 4.3.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.3.1...4.3.2)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.3.2
  dependency-type: indirect
  dependency-group: all-security-updates
- dependency-name: "@angular/common"
  dependency-version: 20.3.28
  dependency-type: direct:production
  dependency-group: all-security-updates
- dependency-name: "@angular/compiler"
  dependency-version: 20.3.28
  dependency-type: direct:production
  dependency-group: all-security-updates
- dependency-name: fast-uri
  dependency-version: 3.1.8
  dependency-type: indirect
  dependency-group: all-security-updates
- dependency-name: hono
  dependency-version: 4.13.9
  dependency-type: indirect
  dependency-group: all-security-updates
- dependency-name: js-yaml
  dependency-version: 4.3.2
  dependency-type: indirect
  dependency-group: all-security-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
GitOrigin-RevId: d4c9cbce469a2c5dbc5e29e9875ae41e2c72bec9
@dependabot @github

dependabot Bot commented on behalf of github Sep 24, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are no longer updatable, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 24, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/projects/ai/agents/examples/deep-search/frontend/all-security-updates-740388a607 branch September 24, 2026 08:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file p0 SECURITY

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants