Skip to content

build(deps): Bump the zeppelin-web-security-updates group across 1 directory with 21 updates - #5220

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/zeppelin-web/zeppelin-web-security-updates-e66bd0067e
Open

build(deps): Bump the zeppelin-web-security-updates group across 1 directory with 21 updates#5220
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/zeppelin-web/zeppelin-web-security-updates-e66bd0067e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Apr 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the zeppelin-web-security-updates group with 21 updates in the /zeppelin-web directory:

Package From To
angular 1.5.7 1.8.3
angular-sanitize 1.5.7 1.8.3
bootstrap 3.4.1 5.3.8
diff 3.3.0 3.5.1
lodash 3.9.3 4.18.1
express 4.19.2 4.22.3
webpack-dev-server 4.15.2 5.2.6
body-parser 1.20.2 1.20.8
cipher-base 1.0.4 1.0.7
cookie 0.3.1 0.7.2
elliptic 6.5.6 removed
flatted 2.0.2 3.4.4
follow-redirects 1.15.6 1.16.1
handlebars 4.7.8 4.7.10
http-proxy-middleware 2.0.6 2.0.10
on-headers 1.0.2 1.1.0
picomatch 2.3.1 2.3.2
send 0.18.0 0.19.2
serialize-javascript 1.9.1 7.1.2
serve-static 1.15.0 1.16.3
tmp 0.0.33 0.2.7

Updates angular from 1.5.7 to 1.8.3

Changelog

Sourced from angular's changelog.

1.8.3 ultimate-farewell (2022-04-07)

One final release of AngularJS in order to update package README files on npm.

1.8.2 meteoric-mining (2020-10-21)

Bug Fixes

  • $sceDelegate: ensure that resourceUrlWhitelist() is identical to trustedResourceUrlList() (e41f01, #17090)

1.8.1 mutually-supporting (2020-09-30)

Bug Fixes

  • $sanitize: do not trigger CSP alert/report in Firefox and Chrome (2fab3d)

Refactorings

  • SanitizeUriProvider: remove usages of whitelist (76738102)
  • httpProvider: remove usages of whitelist and blacklist (c953af6b)
  • sceDelegateProvider: remove usages of whitelist and blacklist (a206e267)

Deprecation Notices

For the purposes of backward compatibility, the previous symbols are aliased to their new symbol.

1.8.0 nested-vaccination (2020-06-01)

_This release contains a breaking change to resolve a security issue which was discovered by Krzysztof Kotowicz(@​koto); and independently by Esben Sparre Andreasen (@​esbena) while

... (truncated)

Commits
  • cf16b24 docs(changelog): add release notes for 1.8.3
  • 757d56e docs(*): update end-of-life messages (#17177)
  • f362437 docs(eol): add EOL options text and link to template header used in every page
  • fb04e42 test(Angular): fix angularInit() tests on Safari v15+
  • 6a52c4f test(input): fix tests on Firefox v93+
  • ed30c4d docs(README.md): add wiki link to MVC
  • 4032655 chore(deps): bump js-yaml from 3.5.5 to 3.14.1
  • 47f8c65 chore(deps): bump normalize-url from 4.5.0 to 4.5.1
  • 56b0ee3 chore(e2e): run tests against Chrome 91 on macOS Catalina
  • 58cd897 chore(e2e): run tests against Firefox 85 on macOS Catalina
  • Additional commits viewable in compare view

Updates angular-sanitize from 1.5.7 to 1.8.3

Changelog

Sourced from angular-sanitize's changelog.

1.8.3 ultimate-farewell (2022-04-07)

One final release of AngularJS in order to update package README files on npm.

1.8.2 meteoric-mining (2020-10-21)

Bug Fixes

  • $sceDelegate: ensure that resourceUrlWhitelist() is identical to trustedResourceUrlList() (e41f01, #17090)

1.8.1 mutually-supporting (2020-09-30)

Bug Fixes

  • $sanitize: do not trigger CSP alert/report in Firefox and Chrome (2fab3d)

Refactorings

  • SanitizeUriProvider: remove usages of whitelist (76738102)
  • httpProvider: remove usages of whitelist and blacklist (c953af6b)
  • sceDelegateProvider: remove usages of whitelist and blacklist (a206e267)

Deprecation Notices

For the purposes of backward compatibility, the previous symbols are aliased to their new symbol.

1.8.0 nested-vaccination (2020-06-01)

_This release contains a breaking change to resolve a security issue which was discovered by Krzysztof Kotowicz(@​koto); and independently by Esben Sparre Andreasen (@​esbena) while

... (truncated)

Commits
  • cf16b24 docs(changelog): add release notes for 1.8.3
  • 757d56e docs(*): update end-of-life messages (#17177)
  • f362437 docs(eol): add EOL options text and link to template header used in every page
  • fb04e42 test(Angular): fix angularInit() tests on Safari v15+
  • 6a52c4f test(input): fix tests on Firefox v93+
  • ed30c4d docs(README.md): add wiki link to MVC
  • 4032655 chore(deps): bump js-yaml from 3.5.5 to 3.14.1
  • 47f8c65 chore(deps): bump normalize-url from 4.5.0 to 4.5.1
  • 56b0ee3 chore(e2e): run tests against Chrome 91 on macOS Catalina
  • 58cd897 chore(e2e): run tests against Firefox 85 on macOS Catalina
  • Additional commits viewable in compare view

Updates bootstrap from 3.4.1 to 5.3.8

Release notes

Sourced from bootstrap's releases.

v5.3.8

What's Changed

Dependencies

New Contributors

Full Changelog: twbs/bootstrap@v5.3.7...v5.3.8

v5.3.7

📚 Documentation

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by mdo, a new releaser for bootstrap since your current version.


Updates diff from 3.3.0 to 3.5.1

Changelog

Sourced from diff's changelog.

v3.5.1 - January 2026

Only change from 3.5.0 is a backport of the fix to GHSA-73rr-hh4g-fpgx.

v3.5.0 - March 4th, 2018

  • Omit redundant slice in join method of diffArrays - 1023590
  • Support patches with empty lines - fb0f208
  • Accept a custom JSON replacer function for JSON diffing - 69c7f0a
  • Optimize parch header parser - 2aec429
  • Fix typos - e89c832

Commits

v3.4.0 - October 7th, 2017

  • #183 - Feature request: ability to specify a custom equality checker for diffArrays
  • #173 - Bug: diffArrays gives wrong result on array of booleans
  • #158 - diffArrays will not compare the empty string in array?
  • comparator for custom equality checks - 30e141e
  • count oldLines and newLines when there are conflicts - 53bf384
  • Fix: diffArrays can compare falsey items - 9e24284
  • Docs: Replace grunt with npm test - 00e2f94

Commits

v3.3.1 - September 3rd, 2017

  • #141 - Cannot apply patch because my file delimiter is "/r/n" instead of "/n"
  • #192 - Fix: Bad merge when adding new files (#189)
  • correct spelling mistake - 21fa478

Commits

Commits
Maintainer changes

This version was pushed to npm by explodingcabbage, a new releaser for diff since your current version.


Updates lodash from 3.9.3 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

  • Add security notice for _.template in threat model and API docs (#6099)
  • Document lower > upper behavior in _.random (#6115)
  • Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

4.0.0

lodash v4.0.0

... (truncated)

Commits
  • cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
  • 75535f5 chore: prune stale advisory refs (#6170)
  • 62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
  • 59be2de release(minor): bump to 4.18.0 (#6161)
  • af63457 fix: broken tests for _.template 879aaa9
  • 1073a76 fix: linting issues
  • 879aaa9 fix: validate imports keys in _.template
  • fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
  • 18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
  • b819080 ci: add dist sync validation workflow (#6137)
  • Additional commits viewable in compare view

Updates express from 4.19.2 to 4.22.3

Release notes

Sourced from express's releases.

v4.22.2

What's Changed

  • fix: restore >20 array parsing for req.query repeated keys (8d09bfe6)
    • This also unifies array-cap behavior across notations. Indexed notation (a[0]=...) was historically capped at qs's default arrayLimit of 20 even in older qs versions; after this change it also allows up to 1000 items.
  • deps: qs@~6.15.1
  • deps: body-parser@~1.20.5

New Contributors

Full Changelog: expressjs/express@v4.22.1...v4.22.2

v4.22.1

What's Changed

[!IMPORTANT]
The prior release (4.22.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

Full Changelog: expressjs/express@4.22.0...v4.22.1

4.22.0

Important: Security

What's Changed

Full Changelog: expressjs/express@4.21.2...4.22.0

4.21.2

What's Changed

... (truncated)

Changelog

Sourced from express's changelog.

4.22.3

  • Allow conditional revalidation for QUERY requests
    • req.fresh now includes QUERY in the freshness check, so QUERY responses can return 304 when a validator matches
  • deps: qs@~6.16.0

4.22.2

  • fix: restore >20 array parsing for req.query repeated keys (8d09bfe6)
    • This also unifies array-cap behavior across notations. Indexed notation (a[0]=...) was historically capped at qs's default arrayLimit of 20 even in older qs versions; after this change it also allows up to 1000 items.
  • deps: qs@~6.15.1
  • deps: body-parser@~1.20.5

4.22.1

  • Revert security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
    • The prior release (4.22.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.

4.22.0

4.21.2

  • deps: path-to-regexp@0.1.12
    • Fix backtracking protection
  • deps: path-to-regexp@0.1.11
    • Throws an error on invalid path values

4.21.1

4.21.0

  • Deprecate res.location("back") and res.redirect("back") magic string
  • deps: serve-static@1.16.2
    • includes send@0.19.0
  • deps: finalhandler@1.3.1
  • deps: qs@6.13.0

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for express since your current version.


Updates webpack-dev-server from 4.15.2 to 5.2.6

Release notes

Sourced from webpack-dev-server's releases.

v5.2.6

Patch Changes

  • fix: allow undefined as the Server constructor options argument again (by @​bjohansebas in #5695)

    Restores accepting undefined (defaulting it to {}) for the options argument, so passing a webpack config's optional devServer field type-checks and works as before.

  • Protect the built-in state-changing routes (/webpack-dev-server/invalidate and /webpack-dev-server/open-editor) against cross-site request forgery. Requests are now checked with Sec-Fetch-Site (falling back to an Origin/Host comparison when it is absent), so a cross-site page can no longer trigger a rebuild or open a file in the editor. Same-origin requests, user-initiated navigations, and non-browser clients (e.g. curl) are unaffected. (by @​bjohansebas in #5698)

  • Handle malformed Host and Origin header values gracefully when validating requests. (by @​bjohansebas in #5699)

v5.2.5

Patch Changes

  • Skip the HMR WebSocket path when forwarding upgrade requests to user-defined proxies, so custom proxy WebSocket upgrades are no longer intercepted by the dev server. (by @​bjohansebas in #5680)

v5.2.4

5.2.4 (2026-05-11)

Bug Fixes

  • set Cross-Origin-Resource-Policy header to prevent source code theft over HTTP

v5.2.3

5.2.3 (2026-01-12)

Bug Fixes

  • add cause for errorObject (#5518) (37b033d)
  • compatibility with event target and universal target and lazy compilation (574026c)
  • overlay: add ESC key to dismiss overlay (#5598) (f91baa8)
  • progress indicator styles (#5557) (41a53a1)
  • upgrade selfsigned to v5

v5.2.2

5.2.2 (2025-06-03)

Bug Fixes

  • "Overlay enabled" false positive (18e72ee)
  • do not crush when error is null for runtime errors (#5447) (309991f)
  • remove unnecessary header X_TEST (#5451) (64a6124)
  • respect the allowedHosts option for cross-origin header check (#5510) (03d1214)

v5.2.1

5.2.1 (2025-03-26)

... (truncated)

Changelog

Sourced from webpack-dev-server's changelog.

5.2.6

Patch Changes

  • fix: allow undefined as the Server constructor options argument again (by @​bjohansebas in #5695)

    Restores accepting undefined (defaulting it to {}) for the options argument, so passing a webpack config's optional devServer field type-checks and works as before.

  • Protect the built-in state-changing routes (/webpack-dev-server/invalidate and /webpack-dev-server/open-editor) against cross-site request forgery. Requests are now checked with Sec-Fetch-Site (falling back to an Origin/Host comparison when it is absent), so a cross-site page can no longer trigger a rebuild or open a file in the editor. Same-origin requests, user-initiated navigations, and non-browser clients (e.g. curl) are unaffected. (by @​bjohansebas in #5698)

  • Handle malformed Host and Origin header values gracefully when validating requests. (by @​bjohansebas in #5699)

5.2.5

Patch Changes

  • Skip the HMR WebSocket path when forwarding upgrade requests to user-defined proxies, so custom proxy WebSocket upgrades are no longer intercepted by the dev server. (by @​bjohansebas in #5680)

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

5.2.4 (2026-05-11)

Bug Fixes

  • set Cross-Origin-Resource-Policy header to prevent source code theft over HTTP

5.2.3 (2026-01-12)

Bug Fixes

  • add cause for errorObject (#5518) (37b033d)
  • compatibility with event target and universal target and lazy compilation (574026c)
  • overlay: add ESC key to dismiss overlay (#5598) (f91baa8)
  • progress indicator styles (#5557) (41a53a1)
  • upgrade selfsigned to v5

5.2.2 (2025-06-03)

Bug Fixes

  • "Overlay enabled" false positive (18e72ee)
  • do not crush when error is null for runtime errors (#5447) (309991f)
  • remove unnecessary header X_TEST (#5451) (64a6124)
  • respect the allowedHosts option for cross-origin header check (#5510) (03d1214)

5.2.1 (2025-03-26)

Security

... (truncated)

Commits
  • 8a37b0e chore(release): new release (#5697)
  • f21ed0f fix: handle malformed Host and Origin headers (#5699)
  • 80cd9ee fix: reject cross-site requests to open-editor and invalidate endpoints (#5698)
  • 308e853 fix: handle undefined options in Server constructor (#5695)
  • 8b2b915 chore: update branch references from v4 to v5 in workflow configuration
  • 870ed22 chore: add v5 branch to release workflow triggers
  • c3ee325 chore(release): new release (#5682)
  • 60173be feat: add changeset validation and release workflow (#5680)
  • 948d5e6 fix(proxy): match the HMR upgrade path exactly like the ws server (#5678)
  • 93e8996 fix: skip HMR websocket path when forwarding upgrades to user-defined proxies...
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for webpack-dev-server since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates body-parser from 1.20.2 to 1.20.8

Release notes

Sourced from body-parser's releases.

1.20.8

Important

Same code base as 1.20.7. This was created to test the new release process.

What's Changed

Full Changelog: expressjs/body-parser@1.20.7...1.20.8

1.20.7

What's Changed

Full Changelog: expressjs/body-parser@1.20.6...1.20.7

1.20.6

Important: Security

What's Changed

Full Changelog: expressjs/body-parser@1.20.5...1.20.6

v1.20.5

What's Changed

The reason for this release is a fix to the extended urlencoded parser returning objects instead of arrays for large array inputs (> 100) on qs@6.14.2+. (expressjs/body-parser#716)

New Contributors

  • @​abhu85 made their first c...

    Description has been truncated

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Apr 23, 2026
@tbonelee

tbonelee commented May 24, 2026

Copy link
Copy Markdown
Contributor

@dependabot rebase

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/zeppelin-web/zeppelin-web-security-updates-e66bd0067e branch from cb4eebd to 8436e69 Compare May 24, 2026 18:25
@voidmatcha

voidmatcha commented Oct 7, 2026

Copy link
Copy Markdown
Member

@dependabot rebase

@dependabot
build(deps): Bump the zeppelin-web-security-updates group across 1 di…
ab9f9c5 
…rectory with 21 updates

Bumps the zeppelin-web-security-updates group with 21 updates in the /zeppelin-web directory:

| Package | From | To |
| --- | --- | --- |
| [angular](https://github.com/angular/angular.js) | `1.5.7` | `1.8.3` |
| [angular-sanitize](https://github.com/angular/angular.js) | `1.5.7` | `1.8.3` |
| [bootstrap](https://github.com/twbs/bootstrap) | `3.4.1` | `5.3.8` |
| [diff](https://github.com/kpdecker/jsdiff) | `3.3.0` | `3.5.1` |
| [lodash](https://github.com/lodash/lodash) | `3.9.3` | `4.18.1` |
| [express](https://github.com/expressjs/express) | `4.19.2` | `4.22.3` |
| [webpack-dev-server](https://github.com/webpack/webpack-dev-server) | `4.15.2` | `5.2.6` |
| [body-parser](https://github.com/expressjs/body-parser) | `1.20.2` | `1.20.8` |
| [cipher-base](https://github.com/crypto-browserify/cipher-base) | `1.0.4` | `1.0.7` |
| [cookie](https://github.com/jshttp/cookie) | `0.3.1` | `0.7.2` |
| [elliptic](https://github.com/indutny/elliptic) | `6.5.6` | `removed` |
| [flatted](https://github.com/WebReflection/flatted) | `2.0.2` | `3.4.4` |
| [follow-redirects](https://github.com/follow-redirects/follow-redirects) | `1.15.6` | `1.16.1` |
| [handlebars](https://github.com/handlebars-lang/handlebars.js) | `4.7.8` | `4.7.10` |
| [http-proxy-middleware](https://github.com/chimurai/http-proxy-middleware) | `2.0.6` | `2.0.10` |
| [on-headers](https://github.com/jshttp/on-headers) | `1.0.2` | `1.1.0` |
| [picomatch](https://github.com/micromatch/picomatch) | `2.3.1` | `2.3.2` |
| [send](https://github.com/pillarjs/send) | `0.18.0` | `0.19.2` |
| [serialize-javascript](https://github.com/yahoo/serialize-javascript) | `1.9.1` | `7.1.2` |
| [serve-static](https://github.com/expressjs/serve-static) | `1.15.0` | `1.16.3` |
| [tmp](https://github.com/raszi/node-tmp) | `0.0.33` | `0.2.7` |



Updates `angular` from 1.5.7 to 1.8.3
- [Changelog](https://github.com/angular/angular.js/blob/master/CHANGELOG.md)
- [Commits](angular/angular.js@v1.5.7...v1.8.3)

Updates `angular-sanitize` from 1.5.7 to 1.8.3
- [Changelog](https://github.com/angular/angular.js/blob/master/CHANGELOG.md)
- [Commits](angular/angular.js@v1.5.7...v1.8.3)

Updates `bootstrap` from 3.4.1 to 5.3.8
- [Release notes](https://github.com/twbs/bootstrap/releases)
- [Commits](twbs/bootstrap@v3.4.1...v5.3.8)

Updates `diff` from 3.3.0 to 3.5.1
- [Changelog](https://github.com/kpdecker/jsdiff/blob/master/release-notes.md)
- [Commits](kpdecker/jsdiff@v3.3.0...v3.5.1)

Updates `lodash` from 3.9.3 to 4.18.1
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@3.9.3...4.18.1)

Updates `express` from 4.19.2 to 4.22.3
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/v4.22.3/History.md)
- [Commits](expressjs/express@4.19.2...v4.22.3)

Updates `webpack-dev-server` from 4.15.2 to 5.2.6
- [Release notes](https://github.com/webpack/webpack-dev-server/releases)
- [Changelog](https://github.com/webpack/webpack-dev-server/blob/v5.2.6/CHANGELOG.md)
- [Commits](webpack/webpack-dev-server@v4.15.2...v5.2.6)

Updates `body-parser` from 1.20.2 to 1.20.8
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/1.20.8/HISTORY.md)
- [Commits](expressjs/body-parser@1.20.2...1.20.8)

Updates `cipher-base` from 1.0.4 to 1.0.7
- [Changelog](https://github.com/browserify/cipher-base/blob/master/CHANGELOG.md)
- [Commits](browserify/cipher-base@v1.0.4...v1.0.7)

Updates `cookie` from 0.3.1 to 0.7.2
- [Release notes](https://github.com/jshttp/cookie/releases)
- [Commits](jshttp/cookie@v0.3.1...v0.7.2)

Removes `elliptic`

Updates `flatted` from 2.0.2 to 3.4.4
- [Commits](WebReflection/flatted@v2.0.2...v3.4.4)

Updates `follow-redirects` from 1.15.6 to 1.16.1
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](follow-redirects/follow-redirects@v1.15.6...v1.16.1)

Updates `handlebars` from 4.7.8 to 4.7.10
- [Release notes](https://github.com/handlebars-lang/handlebars.js/releases)
- [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/v4.7.10/release-notes.md)
- [Commits](handlebars-lang/handlebars.js@v4.7.8...v4.7.10)

Updates `http-proxy-middleware` from 2.0.6 to 2.0.10
- [Release notes](https://github.com/chimurai/http-proxy-middleware/releases)
- [Changelog](https://github.com/chimurai/http-proxy-middleware/blob/v2.0.10/CHANGELOG.md)
- [Commits](chimurai/http-proxy-middleware@v2.0.6...v2.0.10)

Updates `on-headers` from 1.0.2 to 1.1.0
- [Release notes](https://github.com/jshttp/on-headers/releases)
- [Changelog](https://github.com/jshttp/on-headers/blob/master/HISTORY.md)
- [Commits](jshttp/on-headers@v1.0.2...v1.1.0)

Updates `picomatch` from 2.3.1 to 2.3.2
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@2.3.1...2.3.2)

Updates `send` from 0.18.0 to 0.19.2
- [Release notes](https://github.com/pillarjs/send/releases)
- [Changelog](https://github.com/pillarjs/send/blob/master/HISTORY.md)
- [Commits](pillarjs/send@0.18.0...0.19.2)

Updates `serialize-javascript` from 1.9.1 to 7.1.2
- [Release notes](https://github.com/yahoo/serialize-javascript/releases)
- [Commits](yahoo/serialize-javascript@v1.9.1...v7.1.2)

Updates `serve-static` from 1.15.0 to 1.16.3
- [Release notes](https://github.com/expressjs/serve-static/releases)
- [Changelog](https://github.com/expressjs/serve-static/blob/master/HISTORY.md)
- [Commits](expressjs/serve-static@v1.15.0...v1.16.3)

Updates `tmp` from 0.0.33 to 0.2.7
- [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md)
- [Commits](raszi/node-tmp@v0.0.33...v0.2.7)

---
updated-dependencies:
- dependency-name: angular
  dependency-version: 1.8.3
  dependency-type: direct:production
  dependency-group: zeppelin-web-security-updates
- dependency-name: angular-sanitize
  dependency-version: 1.8.3
  dependency-type: direct:production
  dependency-group: zeppelin-web-security-updates
- dependency-name: body-parser
  dependency-version: 1.20.4
  dependency-type: indirect
  dependency-group: zeppelin-web-security-updates
- dependency-name: bootstrap
  dependency-version: 5.3.8
  dependency-type: direct:production
  dependency-group: zeppelin-web-security-updates
- dependency-name: cipher-base
  dependency-version: 1.0.7
  dependency-type: indirect
  dependency-group: zeppelin-web-security-updates
- dependency-name: cookie
  dependency-version: 0.7.2
  dependency-type: indirect
  dependency-group: zeppelin-web-security-updates
- dependency-name: diff
  dependency-version: 3.5.1
  dependency-type: direct:production
  dependency-group: zeppelin-web-security-updates
- dependency-name: elliptic
  dependency-version:
  dependency-type: indirect
  dependency-group: zeppelin-web-security-updates
- dependency-name: express
  dependency-version: 4.22.1
  dependency-type: direct:development
  dependency-group: zeppelin-web-security-updates
- dependency-name: flatted
  dependency-version: 3.4.2
  dependency-type: indirect
  dependency-group: zeppelin-web-security-updates
- dependency-name: follow-redirects
  dependency-version: 1.16.0
  dependency-type: indirect
  dependency-group: zeppelin-web-security-updates
- dependency-name: handlebars
  dependency-version: 4.7.9
  dependency-type: indirect
  dependency-group: zeppelin-web-security-updates
- dependency-name: http-proxy-middleware
  dependency-version: 2.0.9
  dependency-type: indirect
  dependency-group: zeppelin-web-security-updates
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: direct:production
  dependency-group: zeppelin-web-security-updates
- dependency-name: on-headers
  dependency-version: 1.1.0
  dependency-type: indirect
  dependency-group: zeppelin-web-security-updates
- dependency-name: picomatch
  dependency-version: 2.3.2
  dependency-type: indirect
  dependency-group: zeppelin-web-security-updates
- dependency-name: send
  dependency-version: 0.19.2
  dependency-type: indirect
  dependency-group: zeppelin-web-security-updates
- dependency-name: serialize-javascript
  dependency-version: 7.0.5
  dependency-type: indirect
  dependency-group: zeppelin-web-security-updates
- dependency-name: serve-static
  dependency-version: 1.16.3
  dependency-type: indirect
  dependency-group: zeppelin-web-security-updates
- dependency-name: tmp
  dependency-version: 0.2.5
  dependency-type: indirect
  dependency-group: zeppelin-web-security-updates
- dependency-name: webpack-dev-server
  dependency-version: 5.2.1
  dependency-type: direct:development
  dependency-group: zeppelin-web-security-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title Bump the zeppelin-web-security-updates group across 1 directory with 21 updates build(deps): Bump the zeppelin-web-security-updates group across 1 directory with 21 updates Oct 7, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/zeppelin-web/zeppelin-web-security-updates-e66bd0067e branch from 8436e69 to ab9f9c5 Compare October 7, 2026 13:23

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@tbonelee @voidmatcha