From b04d963c454a8302dbf297fe1f2b64a2a6a9550f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 22 Jun 2026 18:30:45 -0700 Subject: [PATCH] Bump the npm_and_yarn group across 3 directories with 6 updates (#4384) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps the npm_and_yarn group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [dompurify](https://github.com/cure53/DOMPurify) | `3.4.2` | `3.4.11` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.0.10` | `8.0.16` | | [@opentelemetry/core](https://github.com/open-telemetry/opentelemetry-js) | `2.7.1` | `2.8.0` | | [esbuild](https://github.com/evanw/esbuild) | `0.27.7` | `0.28.1` | | [shell-quote](https://github.com/ljharb/shell-quote) | `1.8.3` | `1.8.4` | | [undici](https://github.com/nodejs/undici) | `7.25.0` | `7.28.0` | Bumps the npm_and_yarn group with 1 update in the /scripts/issue-lifecycle directory: [esbuild](https://github.com/evanw/esbuild). Bumps the npm_and_yarn group with 1 update in the /scripts/pr-gate directory: [esbuild](https://github.com/evanw/esbuild). Updates `dompurify` from 3.4.2 to 3.4.11
Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.11

DOMPurify 3.4.10

DOMPurify 3.4.9

DOMPurify 3.4.8

DOMPurify 3.4.7

DOMPurify 3.4.6

DOMPurify 3.4.5

Note that this is a security release for an issue introduced in 3.4.4 and should be upgraded to immediately.

... (truncated)

Commits

Updates `vite` from 8.0.10 to 8.0.16
Release notes

Sourced from vite's releases.

v8.0.16

Please refer to CHANGELOG.md for details.

v8.0.15

Please refer to CHANGELOG.md for details.

v8.0.14

Please refer to CHANGELOG.md for details.

v8.0.13

Please refer to CHANGELOG.md for details.

v8.0.12

Please refer to CHANGELOG.md for details.

v8.0.11

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.0.16 (2026-06-01)

Bug Fixes

8.0.15 (2026-06-01)

Features

Bug Fixes

Miscellaneous Chores

Code Refactoring

8.0.14 (2026-05-21)

Features

Bug Fixes

Miscellaneous Chores

Code Refactoring

... (truncated)

Commits

Updates `@opentelemetry/core` from 2.7.1 to 2.8.0
Release notes

Sourced from @​opentelemetry/core's releases.

v2.8.0

2.8.0

:rocket: Features

:bug: Bug Fixes

Changelog

Sourced from @​opentelemetry/core's changelog.

2.8.0

:rocket: Features

:bug: Bug Fixes

Commits

Updates `esbuild` from 0.27.7 to 0.28.1
Release notes

Sourced from esbuild's releases.

v0.28.1

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.1

... (truncated)

Commits

Updates `shell-quote` from 1.8.3 to 1.8.4
Changelog

Sourced from shell-quote's changelog.

v1.8.4 - 2026-05-22

Commits

Commits

Updates `undici` from 7.25.0 to 7.28.0
Release notes

Sourced from undici's releases.

v7.28.0

⚠️ Security Release

This release line addresses 7 security advisories, all shipped in v7.28.0.

Action required: Upgrade to undici 7.28.0 or later.

npm install undici@^7.28.0

The v7 line is not affected by GHSA-38rv-x7px-6hhq (CVE-2026-9675), which is an 8.x-only regression.

Note on GHSA-hm92-r4w5-c3mj: this fix shipped in v7.28.0, not the earlier 7.2x line — the vulnerable single-pool code was still present through v7.27.2. The per-origin pool fix is 3805b8f8 (#5041).

Summary

Advisory CVE Severity (CVSS) Fixed in Fix commit
GHSA-vxpw-j846-p89q CVE-2026-12151 High (7.5) 7.28.0 8cb10f98
GHSA-vmh5-mc38-953g CVE-2026-9697 High (7.4) 7.28.0 04201f89
GHSA-hm92-r4w5-c3mj CVE-2026-6734 High (7.5) 7.28.0 3805b8f8
GHSA-pr7r-676h-xcf6 CVE-2026-9678 Moderate (5.9) 7.28.0 85a24055
GHSA-p88m-4jfj-68fv CVE-2026-9679 Moderate (5.9) 7.28.0 d0574cc4
GHSA-g8m3-5g58-fq7m CVE-2026-11525 Low (3.7) 7.28.0 d0574cc4
GHSA-35p6-xmwp-9g52 CVE-2026-6733 Low (3.7) 7.28.0 ea8930cf

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

GHSA-vxpw-j846-p89q · CWE-400, CWE-770 Fix: 8cb10f98 websocket: limit the number of fragments in a message (part of backport a027a4a0 Backport WebSocket maxPayloadSize fixes to v7.x, #5423)

A malicious WebSocket server can stream a large number of small or empty continuation frames. Undici enforced a limit on cumulative payload size but did not limit the number of fragments per message, leading to unbounded memory growth and denial of service.

TLS certificate validation bypass in SOCKS5 ProxyAgent — CVE-2026-9697

GHSA-vmh5-mc38-953g · CWE-295

... (truncated)

Commits

Updates `esbuild` from 0.28.0 to 0.28.1
Release notes

Sourced from esbuild's releases.

v0.28.1

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.1

... (truncated)

Commits

Updates `esbuild` from 0.28.0 to 0.28.1
Release notes

Sourced from esbuild's releases.

v0.28.1

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.1

... (truncated)

Commits