Skip to content

security(deps)(deps): bump the nodejs-minor-patch group across 1 directory with 8 updates - #734

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/frontend/nodejs-minor-patch-2be196bf74
Open

security(deps)(deps): bump the nodejs-minor-patch group across 1 directory with 8 updates#734
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/frontend/nodejs-minor-patch-2be196bf74

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 27, 2026

Copy link
Copy Markdown
Contributor

Bumps the nodejs-minor-patch group with 8 updates in the /frontend directory:

Package From To
dompurify 3.4.11 3.4.12
katex 0.17.0 0.18.1
react 19.2.7 19.2.8
react-dom 19.2.7 19.2.8
@eslint/js 9.39.4 9.39.5
autoprefixer 10.5.2 10.5.4
eslint 9.39.4 9.39.5
postcss 8.5.16 8.5.23

Updates dompurify from 3.4.11 to 3.4.12

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.12

  • Fixed an issue where a hook would not get called for custom elements, thanks @​Rikuxx0
  • Hardened the handling of hooks removing elements, @​mkrause-bee360
  • Added support for a few new SVG attributes, thanks @​cbn-falias & @​Develop-KIM
  • Hardened the handling of declarative partial updates
  • Updated the documentation is several spots, README, wiki, etc.
  • Bumped several dependencies where possible
Commits

Updates katex from 0.17.0 to 0.18.1

Release notes

Sourced from katex's releases.

v0.18.1

0.18.1 (2026-07-19)

Bug Fixes

v0.18.0

0.18.0 (2026-07-17)

Features

BREAKING CHANGES

  • users who apply custom styles or have allowlists targeting KaTeX's internal classes must update their selectors.
Changelog

Sourced from katex's changelog.

0.18.1 (2026-07-19)

Bug Fixes

0.18.0 (2026-07-17)

Features

BREAKING CHANGES

  • users who apply custom styles or have allowlists targeting KaTeX's internal classes must update their selectors.
Commits
  • cdf479f chore(release): 0.18.1 [ci skip]
  • 87a2b30 fix(htmlData): allow escaped commas in \htmlData (#4236)
  • 2318066 chore(deps): bump codecov/codecov-action from 6 to 7 (#4227)
  • 3b5b6a0 chore(deps): bump actions/checkout from 6 to 7 (#4232)
  • 4e9d31a chore(deps): update dependency js-yaml to v4.2.0 [security] (#4244)
  • b7ca8f0 chore(deps): update dependency webpack-dev-server to v5.2.5 [security] (#4242)
  • bf1a59f chore: use pixel diff as fallback for byte-to-byte (#4245)
  • 4d9d0ae chore(release): 0.18.0 [ci skip]
  • 6f5c44f feat: prefix css classes (#4229)
  • 2c6143a refactor: remove direct hasOwnProperty call (#4230)
  • Additional commits viewable in compare view
Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates react from 19.2.7 to 19.2.8

Release notes

Sourced from react's releases.

19.2.8 (July 21st, 2026)

React Server Components

Commits

Updates react-dom from 19.2.7 to 19.2.8

Release notes

Sourced from react-dom's releases.

19.2.8 (July 21st, 2026)

React Server Components

Commits

Updates @eslint/js from 9.39.4 to 9.39.5

Release notes

Sourced from @​eslint/js's releases.

v9.39.5

Bug Fixes

Documentation

  • 74930ed docs: switch build to Node.js 24 (#20894) (Milos Djermanovic)
  • eaec8bb docs: Add ESLint v9.x EOL notice (#20828) (Milos Djermanovic)

Chores

  • 458205f chore: update @eslint/eslintrc and @eslint/js for v9.39.5 (#21077) (Francesco Trotta)
  • 202117b chore: package.json update for @​eslint/js release (Jenkins)
  • d9eb6ed test: disable warning for vm.constants.USE_MAIN_CONTEXT_DEFAULT_LOADER (#21074) (Francesco Trotta)
  • 7b431a7 chore: override re2 dependency for @metascraper/helpers (#21068) (Milos Djermanovic)
  • daf7791 chore: pin fflate@0.8.2 (#20895) (Milos Djermanovic)
  • daee8ba ci: use pnpm in eslint-flat-config-utils type integration test (#20829) (Milos Djermanovic)
  • 116d4be ci: unpin Node.js 25.x in CI (#20619) (Copilot)
Commits

Updates autoprefixer from 10.5.2 to 10.5.4

Release notes

Sourced from autoprefixer's releases.

10.5.4

10.5.3

Changelog

Sourced from autoprefixer's changelog.

10.5.4

10.5.3

Commits

Updates eslint from 9.39.4 to 9.39.5

Release notes

Sourced from eslint's releases.

v9.39.5

Bug Fixes

Documentation

  • 74930ed docs: switch build to Node.js 24 (#20894) (Milos Djermanovic)
  • eaec8bb docs: Add ESLint v9.x EOL notice (#20828) (Milos Djermanovic)

Chores

  • 458205f chore: update @eslint/eslintrc and @eslint/js for v9.39.5 (#21077) (Francesco Trotta)
  • 202117b chore: package.json update for @​eslint/js release (Jenkins)
  • d9eb6ed test: disable warning for vm.constants.USE_MAIN_CONTEXT_DEFAULT_LOADER (#21074) (Francesco Trotta)
  • 7b431a7 chore: override re2 dependency for @metascraper/helpers (#21068) (Milos Djermanovic)
  • daf7791 chore: pin fflate@0.8.2 (#20895) (Milos Djermanovic)
  • daee8ba ci: use pnpm in eslint-flat-config-utils type integration test (#20829) (Milos Djermanovic)
  • 116d4be ci: unpin Node.js 25.x in CI (#20619) (Copilot)
Commits

Updates postcss from 8.5.16 to 8.5.23

Release notes

Sourced from postcss's releases.

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

8.5.19

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

  • Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

  • Fixed Maximum call stack size exceeded error.
  • Fixed Prototype hijacking for postcss.fromJSON().
  • Fixed Input#origin() for unmapped end position (by @​chatman-media).
Changelog

Sourced from postcss's changelog.

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

8.5.19

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

  • Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

  • Fixed Maximum call stack size exceeded error.
  • Fixed Prototype hijacking for postcss.fromJSON().
  • Fixed Input#origin() for unmapped end position (by @​chatman-media).
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
security(deps)(deps): bump the nodejs-minor-patch group across 1 dire…
3342449 
…ctory with 8 updates

Bumps the nodejs-minor-patch group with 8 updates in the /frontend directory:

| Package | From | To |
| --- | --- | --- |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.4.11` | `3.4.12` |
| [katex](https://github.com/KaTeX/KaTeX) | `0.17.0` | `0.18.1` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.7` | `19.2.8` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.7` | `19.2.8` |
| [@eslint/js](https://github.com/eslint/eslint/tree/HEAD/packages/js) | `9.39.4` | `9.39.5` |
| [autoprefixer](https://github.com/postcss/autoprefixer) | `10.5.2` | `10.5.4` |
| [eslint](https://github.com/eslint/eslint) | `9.39.4` | `9.39.5` |
| [postcss](https://github.com/postcss/postcss) | `8.5.16` | `8.5.23` |



Updates `dompurify` from 3.4.11 to 3.4.12
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.11...3.4.12)

Updates `katex` from 0.17.0 to 0.18.1
- [Release notes](https://github.com/KaTeX/KaTeX/releases)
- [Changelog](https://github.com/KaTeX/KaTeX/blob/main/CHANGELOG.md)
- [Commits](KaTeX/KaTeX@v0.17.0...v0.18.1)

Updates `react` from 19.2.7 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react)

Updates `react-dom` from 19.2.7 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom)

Updates `@eslint/js` from 9.39.4 to 9.39.5
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](https://github.com/eslint/eslint/commits/v9.39.5/packages/js)

Updates `autoprefixer` from 10.5.2 to 10.5.4
- [Release notes](https://github.com/postcss/autoprefixer/releases)
- [Changelog](https://github.com/postcss/autoprefixer/blob/main/CHANGELOG.md)
- [Commits](postcss/autoprefixer@10.5.2...10.5.4)

Updates `eslint` from 9.39.4 to 9.39.5
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v9.39.4...v9.39.5)

Updates `postcss` from 8.5.16 to 8.5.23
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.16...8.5.23)

---
updated-dependencies:
- dependency-name: dompurify
  dependency-version: 3.4.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nodejs-minor-patch
- dependency-name: katex
  dependency-version: 0.18.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nodejs-minor-patch
- dependency-name: react
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nodejs-minor-patch
- dependency-name: react-dom
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nodejs-minor-patch
- dependency-name: "@eslint/js"
  dependency-version: 9.39.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: nodejs-minor-patch
- dependency-name: autoprefixer
  dependency-version: 10.5.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: nodejs-minor-patch
- dependency-name: eslint
  dependency-version: 9.39.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: nodejs-minor-patch
- dependency-name: postcss
  dependency-version: 8.5.23
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: nodejs-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code security Security-related updates and fixes labels Jul 27, 2026
@github-actions

github-actions Bot commented Jul 27, 2026

Copy link
Copy Markdown

Security Scan Results

Security Scan Summary

Python Dependencies (Safety)

Report not available.

Node.js Dependencies (npm audit)

Report not available.

Python SAST (Bandit)

4778 issues: 0 high, 56 medium, 4722 low severity

High/Medium severity issues:

Severity Confidence File Line Issue
MEDIUM MEDIUM api_key_demo/main.py 172 Possible binding to all interfaces.
MEDIUM HIGH calculator/main.py 124 Use of possibly insecure function - consider using safer ast.literal_eval.
MEDIUM MEDIUM code-executor-v2/config.py 59 Possible binding to all interfaces.
MEDIUM HIGH code-executor-v2/main.py 277 Audit url open for permitted schemes. Allowing use of file:/ or custom schemes i
MEDIUM MEDIUM sandbox/launcher.py 195 Probable insecure usage of temp file/directory.
MEDIUM HIGH many_tools_demo/main.py 33 Use of exec detected.
MEDIUM MEDIUM pptx_generator/main.py 830 Possible binding to all interfaces.
MEDIUM MEDIUM session_state_demo/main.py 228 Possible binding to all interfaces.
MEDIUM HIGH file_storage/mock_s3_client.py 281 Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to b
MEDIUM HIGH file_storage/mock_s3_client.py 378 Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to b
MEDIUM HIGH atlas/portal_cli.py 64 Audit url open for permitted schemes. Allowing use of file:/ or custom schemes i
MEDIUM MEDIUM tests/test_adaptive_task_polling.py 14 Probable insecure usage of temp file/directory.
MEDIUM MEDIUM tests/test_agent_portal_e2e.py 358 Probable insecure usage of temp file/directory.
MEDIUM MEDIUM tests/test_agent_portal_e2e.py 372 Probable insecure usage of temp file/directory.
MEDIUM MEDIUM tests/test_agent_portal_state.py 41 Probable insecure usage of temp file/directory.
MEDIUM MEDIUM tests/test_agent_portal_state.py 44 Probable insecure usage of temp file/directory.
MEDIUM MEDIUM tests/test_agent_portal_state.py 231 Probable insecure usage of temp file/directory.
MEDIUM MEDIUM tests/test_atlas_client.py 191 Probable insecure usage of temp file/directory.
MEDIUM MEDIUM tests/test_atlas_client.py 192 Probable insecure usage of temp file/directory.
MEDIUM MEDIUM tests/test_atlas_rag_agent_tools.py 22 Probable insecure usage of temp file/directory.
MEDIUM MEDIUM tests/test_docker_env_sync.py 197 Possible binding to all interfaces.
MEDIUM MEDIUM tests/test_domain_whitelist.py 54 Probable insecure usage of temp file/directory.
MEDIUM MEDIUM tests/test_domain_whitelist.py 255 Probable insecure usage of temp file/directory.
MEDIUM MEDIUM tests/test_elicitation_routing.py 36 Probable insecure usage of temp file/directory.
MEDIUM MEDIUM tests/test_elicitation_routing.py 132 Probable insecure usage of temp file/directory.
MEDIUM MEDIUM tests/test_elicitation_routing.py 274 Probable insecure usage of temp file/directory.
MEDIUM MEDIUM tests/test_mcp_per_user_http_clients.py 16 Probable insecure usage of temp file/directory.
MEDIUM MEDIUM tests/test_mcp_per_user_http_clients.py 21 Probable insecure usage of temp file/directory.
MEDIUM MEDIUM tests/test_mcp_wormhole.py 175 Probable insecure usage of temp file/directory.
MEDIUM MEDIUM tests/test_process_manager.py 262 Probable insecure usage of temp file/directory.

Scan Status

Scan Status
Dependency Scan success
SAST Scan success
Secrets Scan success
Container Scan success

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code security Security-related updates and fixes

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants