chore(deps): bump the npm_and_yarn group across 4 directories with 7 updates by dependabot[bot] · Pull Request #12 · hemanthreddykoduru/QuickXerox

dependabot · 2026-02-19T20:05:35Z

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

Bumps the npm_and_yarn group with 2 updates in the / directory: qs and tar.
Bumps the npm_and_yarn group with 1 update in the /_deprecated/server directory: qs.
Bumps the npm_and_yarn group with 2 updates in the /functions directory: qs and fast-xml-parser.
Bumps the npm_and_yarn group with 3 updates in the /vercel-api directory: nodemailer, esbuild and protobufjs.

Updates qs from 6.14.1 to 6.14.2

Changelog

Sourced from qs's changelog.

6.14.2

[Fix] parse: mark overflow objects for indexed notation exceeding arrayLimit (#546)

[Fix] arrayLimit means max count, not max index, in combine/merge/parseArrayValue

[Fix] parse: throw on arrayLimit exceeded with indexed notation when throwOnLimitExceeded is true (#529)

[Fix] parse: enforce arrayLimit on comma-parsed values

[Fix] parse: fix error message to reflect arrayLimit as max index; remove extraneous comments (#545)

[Robustness] avoid .push, use void

[readme] document that addQueryPrefix does not add ? to empty output (#418)

[readme] clarify parseArrays and arrayLimit documentation (#543)

[readme] replace runkit CI badge with shields.io check-runs badge

[meta] fix changelog typo (arrayLength → arrayLimit)

[actions] fix rebase workflow permissions

Commits

bdcf0c7 v6.14.2
294db90 [readme] document that addQueryPrefix does not add ? to empty output
5c308e5 [readme] clarify parseArrays and arrayLimit documentation
6addf8c [Fix] parse: mark overflow objects for indexed notation exceeding arrayLimit
cfc108f [Fix] arrayLimit means max count, not max index, in combine/merge/`pars...
febb644 [Fix] parse: throw on arrayLimit exceeded with indexed notation when `thr...
f6a7abf [Fix] parse: enforce arrayLimit on comma-parsed values
fbc5206 [Fix] parse: fix error message to reflect arrayLimit as max index; remove e...
1b9a8b4 [actions] fix rebase workflow permissions
2a35775 [meta] fix changelog typo (arrayLength → arrayLimit)
Additional commits viewable in compare view

Updates tar from 7.5.7 to 7.5.9

Commits

1f0c2c9 7.5.9
fbb0851 build minified version as default export
6b8eba0 7.5.8
2cb1120 fix(unpack): improve UnpackSync symlink error "into" path accuracy
d18e4e1 fix: do not write linkpaths through symlinks
See full diff in compare view

Maintainer changes

This version was pushed to npm by isaacs, a new releaser for tar since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates qs from 6.14.1 to 6.14.2

Changelog

Sourced from qs's changelog.

6.14.2

[Fix] parse: mark overflow objects for indexed notation exceeding arrayLimit (#546)

[Fix] arrayLimit means max count, not max index, in combine/merge/parseArrayValue

[Fix] parse: throw on arrayLimit exceeded with indexed notation when throwOnLimitExceeded is true (#529)

[Fix] parse: enforce arrayLimit on comma-parsed values

[Fix] parse: fix error message to reflect arrayLimit as max index; remove extraneous comments (#545)

[Robustness] avoid .push, use void

[readme] document that addQueryPrefix does not add ? to empty output (#418)

[readme] clarify parseArrays and arrayLimit documentation (#543)

[readme] replace runkit CI badge with shields.io check-runs badge

[meta] fix changelog typo (arrayLength → arrayLimit)

[actions] fix rebase workflow permissions

Commits

bdcf0c7 v6.14.2
294db90 [readme] document that addQueryPrefix does not add ? to empty output
5c308e5 [readme] clarify parseArrays and arrayLimit documentation
6addf8c [Fix] parse: mark overflow objects for indexed notation exceeding arrayLimit
cfc108f [Fix] arrayLimit means max count, not max index, in combine/merge/`pars...
febb644 [Fix] parse: throw on arrayLimit exceeded with indexed notation when `thr...
f6a7abf [Fix] parse: enforce arrayLimit on comma-parsed values
fbc5206 [Fix] parse: fix error message to reflect arrayLimit as max index; remove e...
1b9a8b4 [actions] fix rebase workflow permissions
2a35775 [meta] fix changelog typo (arrayLength → arrayLimit)
Additional commits viewable in compare view

Updates qs from 6.14.1 to 6.14.2

Changelog

Sourced from qs's changelog.

6.14.2

[Fix] parse: mark overflow objects for indexed notation exceeding arrayLimit (#546)

[Fix] arrayLimit means max count, not max index, in combine/merge/parseArrayValue

[Fix] parse: throw on arrayLimit exceeded with indexed notation when throwOnLimitExceeded is true (#529)

[Fix] parse: enforce arrayLimit on comma-parsed values

[Fix] parse: fix error message to reflect arrayLimit as max index; remove extraneous comments (#545)

[Robustness] avoid .push, use void

[readme] document that addQueryPrefix does not add ? to empty output (#418)

[readme] clarify parseArrays and arrayLimit documentation (#543)

[readme] replace runkit CI badge with shields.io check-runs badge

[meta] fix changelog typo (arrayLength → arrayLimit)

[actions] fix rebase workflow permissions

Commits

bdcf0c7 v6.14.2
294db90 [readme] document that addQueryPrefix does not add ? to empty output
5c308e5 [readme] clarify parseArrays and arrayLimit documentation
6addf8c [Fix] parse: mark overflow objects for indexed notation exceeding arrayLimit
cfc108f [Fix] arrayLimit means max count, not max index, in combine/merge/`pars...
febb644 [Fix] parse: throw on arrayLimit exceeded with indexed notation when `thr...
f6a7abf [Fix] parse: enforce arrayLimit on comma-parsed values
fbc5206 [Fix] parse: fix error message to reflect arrayLimit as max index; remove e...
1b9a8b4 [actions] fix rebase workflow permissions
2a35775 [meta] fix changelog typo (arrayLength → arrayLimit)
Additional commits viewable in compare view

Updates fast-xml-parser from 5.3.4 to 5.3.6

Release notes

Sourced from fast-xml-parser's releases.

Entity security and performance

Improve security and performance of entity processing

new options maxEntitySize, maxExpansionDepth, maxTotalExpansions, maxExpandedLength, allowedTags,tagFilter

fast return when no edtity is present

improvement replacement logic to reduce number of calls

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.3.5...v5.3.6

v5.3.5

What's Changed

Add missing exports to fxp commonjs types by @jeremymeng in NaturalIntelligence/fast-xml-parser#782

fix: Escape regex char in entity name

update strnum to 2.1.2

New Contributors

@jeremymeng made their first contribution in NaturalIntelligence/fast-xml-parser#782

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.3.4...v5.3.5

Changelog

Sourced from fast-xml-parser's changelog.

Note: If you find missing information about particular minor version, that version must have been changed without any functional change in this library.

5.3.6 / 2026-02-14

Improve security and performance of entity processing

new options maxEntitySize, maxExpansionDepth, maxTotalExpansions, maxExpandedLength, allowedTags,tagFilter

fast return when no edtity is present

improvement replacement logic to reduce number of calls

5.3.5 / 2026-02-08

fix: Escape regex char in entity name

update strnum to 2.1.2

add missing exports in CJS typings

5.3.4 / 2026-01-30

fix: handle HTML numeric and hex entities when out of range

5.3.3 / 2025-12-12

fix #775: transformTagName with allowBooleanAttributes adds an unnecessary attribute

5.3.2 / 2025-11-14

fix for import statement for v6

5.3.1 / 2025-11-03

Performance improvement for stopNodes (By Maciek Lamberski)

5.3.0 / 2025-10-03

Use Uint8Array in place of Buffer in Parser

5.2.5 / 2025-06-08

Inform user to use fxp-cli instead of in-built CLI feature

Export typings for direct use

5.2.4 / 2025-06-06

fix (#747): fix EMPTY and ANY with ELEMENT in DOCTYPE

5.2.3 / 2025-05-11

fix (#747): support EMPTY and ANY with ELEMENT in DOCTYPE

5.2.2 / 2025-05-05

fix (#746): update strnum to fix parsing issues related to enotations

5.2.1 / 2025-04-22

fix: read DOCTYPE entity value correctly

read DOCTYPE NOTATION, ELEMENT exp but not using read values

5.2.0 / 2025-04-03

... (truncated)

Commits

ecb2ca1 update release info
910dae5 fix entities performance & security issues
fe9a852 update strnum and release detail
943ef0e fix: Escape regex char in entity name
ddcd0ac Escape regex char in entity name
341b582 Add missing exports to fxp commonjs types (#782)
See full diff in compare view

Updates nodemailer from 6.10.1 to 7.0.11

Release notes

Sourced from nodemailer's releases.

v7.0.11

7.0.11 (2025-11-26)

Bug Fixes

prevent stack overflow DoS in addressparser with deeply nested groups (b61b9c0)

v7.0.10

7.0.10 (2025-10-23)

Bug Fixes

Increase data URI size limit from 100KB to 50MB and preserve content type (28dbf3f)

v7.0.9

7.0.9 (2025-10-07)

Bug Fixes

release: Trying to fix release proecess by upgrading Node version in runner (579fce4)

v7.0.8

7.0.8 (2025-10-07)

Bug Fixes

addressparser: flatten nested groups per RFC 5322 (8f8a77c)

v7.0.7

7.0.7 (2025-10-05)

Bug Fixes

addressparser: Fixed addressparser handling of quoted nested email addresses (1150d99)

dns: add memory leak prevention for DNS cache (0240d67)

linter: Updated eslint and created prettier formatting task (df13b74)

refresh expired DNS cache on error (#1759) (ea0fc5a)

resolve linter errors in DNS cache tests (3b8982c)

v7.0.6

7.0.6 (2025-08-27)

Bug Fixes

... (truncated)

Changelog

Sourced from nodemailer's changelog.

7.0.11 (2025-11-26)

Bug Fixes

prevent stack overflow DoS in addressparser with deeply nested groups (b61b9c0)

7.0.10 (2025-10-23)

Bug Fixes

Increase data URI size limit from 100KB to 50MB and preserve content type (28dbf3f)

7.0.9 (2025-10-07)

Bug Fixes

release: Trying to fix release proecess by upgrading Node version in runner (579fce4)

7.0.8 (2025-10-07)

Bug Fixes

addressparser: flatten nested groups per RFC 5322 (8f8a77c)

7.0.7 (2025-10-05)

Bug Fixes

addressparser: Fixed addressparser handling of quoted nested email addresses (1150d99)

dns: add memory leak prevention for DNS cache (0240d67)

linter: Updated eslint and created prettier formatting task (df13b74)

refresh expired DNS cache on error (#1759) (ea0fc5a)

resolve linter errors in DNS cache tests (3b8982c)

7.0.6 (2025-08-27)

Bug Fixes

encoder: avoid silent data loss by properly flushing trailing base64 (#1747) (01ae76f)

handle multiple XOAUTH2 token requests correctly (#1754) (dbe0028)

ReDoS vulnerability in parseDataURI and _processDataUrl (#1755) (90b3e24)

7.0.5 (2025-07-07)

Bug Fixes

... (truncated)

Commits

3d17dbe chore(master): release 7.0.11 (#1783)
15879f8 Bumped dev dependencies
b61b9c0 fix: prevent stack overflow DoS in addressparser with deeply nested groups
4175e4b chore(master): release 7.0.10 (#1776)
d882ccf Merge branch 'master' of github.com:nodemailer/nodemailer
1d7e4f7 Bumped deps
10bd871 chore: correct typo in variable name (#1773)
28dbf3f fix: Increase data URI size limit from 100KB to 50MB and preserve content type
92ae1c4 chore(master): release 7.0.9 (#1769)
c675d9e Merge branch 'master' of github.com:nodemailer/nodemailer
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for nodemailer since your current version.

Updates esbuild from 0.14.47 to 0.27.0

Release notes

Sourced from esbuild's releases.

v0.27.0

This release deliberately contains backwards-incompatible changes. To avoid automatically picking up releases like this, you should either be pinning the exact version of esbuild in your package.json file (recommended) or be using a version range syntax that only accepts patch upgrades such as ^0.26.0 or ~0.26.0. See npm's documentation about semver for more information.

Use Uint8Array.fromBase64 if available (#4286)

With this release, esbuild's binary loader will now use the new Uint8Array.fromBase64 function unless it's unavailable in the configured target environment. If it's unavailable, esbuild's previous code for this will be used as a fallback. Note that this means you may now need to specify target when using this feature with Node (for example --target=node22) unless you're using Node v25+.

Update the Go compiler from v1.23.12 to v1.25.4 (#4208, #4311)

This raises the operating system requirements for running esbuild:

Linux: now requires a kernel version of 3.2 or later

macOS: now requires macOS 12 (Monterey) or later

v0.26.0

Enable trusted publishing (#4281)

GitHub and npm are recommending that maintainers for packages such as esbuild switch to trusted publishing. With this release, a VM on GitHub will now build and publish all of esbuild's packages to npm instead of me. In theory.

Unfortunately there isn't really a way to test that this works other than to do it live. So this release is that live test. Hopefully this release is uneventful and is exactly the same as the previous one (well, except for the green provenance attestation checkmark on npm that happens with trusted publishing).

v0.25.12
Fix a minification regression with CSS media queries (#4315)

The previous release introduced support for parsing media queries which unintentionally introduced a regression with the removal of duplicate media rules during minification. Specifically the grammar for @media <media-type> and <media-condition-without-or> { ... } was missing an equality check for the <media-condition-without-or> part, so rules with different suffix clauses in this position would incorrectly compare equal and be deduplicated. This release fixes the regression.
Update the list of known JavaScript globals (#4310)

This release updates esbuild's internal list of known JavaScript globals. These are globals that are known to not have side-effects when the property is accessed. For example, accessing the global Array property is considered to be side-effect free but accessing the global scrollY property can trigger a layout, which is a side-effect. This is used by esbuild's tree-shaking to safely remove unused code that is known to be side-effect free. This update adds the following global properties:

From ES2017:

Atomics

SharedArrayBuffer

From ES2020:

BigInt64Array

BigUint64Array

From ES2021:

FinalizationRegistry

WeakRef

From ES2025:

Float16Array

Iterator

Note that this does not indicate that constructing any of these objects is side-effect free, just that accessing the identifier is side-effect free. For example, this now allows esbuild to tree-shake classes that extend from Iterator:
// This can now be tree-shaken by esbuild:

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2022

This changelog documents all esbuild versions published in the year 2022 (versions 0.14.11 through 0.16.12).

0.16.12
Loader defaults to js for extensionless files (#2776)

Certain packages contain files without an extension. For example, the yargs package contains the file yargs/yargs which has no extension. Node, Webpack, and Parcel can all understand code that imports yargs/yargs because they assume that the file is JavaScript. However, esbuild was previously unable to understand this code because it relies on the file extension to tell it how to interpret the file. With this release, esbuild will now assume files without an extension are JavaScript files. This can be customized by setting the loader for "" (the empty string, representing files without an extension) to another loader. For example, if you want files without an extension to be treated as CSS instead, you can do that like this:
CLI:
esbuild --bundle --loader:=css
JS:
esbuild.build({
  bundle: true,
  loader: { '': 'css' },
})
Go:
api.Build(api.BuildOptions{
  Bundle: true,
  Loader: map[string]api.Loader{"": api.LoaderCSS},
})
In addition, the "type" field in package.json files now only applies to files with an explicit .js, .jsx, .ts, or .tsx extension. Previously it was incorrectly applied by esbuild to all files that had an extension other than .mjs, .mts, .cjs, or .cts including extensionless files. So for example an extensionless file in a "type": "module" package is now treated as CommonJS instead of ESM.
0.16.11
Avoid a syntax error in the presence of direct eval (#2761)

The behavior of nested function declarations in JavaScript depends on whether the code is run in strict mode or not. It would be problematic if esbuild preserved nested function declarations in its output because then the behavior would depend on whether the output was run in strict mode or not instead of respecting the strict mode behavior of the original source code. To avoid this, esbuild transforms nested function declarations to preserve the intended behavior of the original source code regardless of whether the output is run in strict mode or not:
// Original code
if (true) {
  function foo() {}
  console.log(!!foo)
  foo = null
  console.log(!!foo)
}

... (truncated)

Commits

2b91699 publish 0.27.0 to npm
22b425c fix #4286: use Uint8Array.fromBase64 if present (#4295)
6d187ef update go 1.25.3 => 1.25.4
9d0d4e7 update go 1.23.12 => 1.25.3 (#4318)
b6979d8 use a patched go compiler for release builds
893d2b9 delete temporary release.yml workflow
cee3918 add a temporary release.yml workflow
f5bb1d6 fix publish.yml
17ff82b publish 0.26.0 to npm
f87181f enable trusted publishing (#4319)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for esbuild since your current version.

Updates path-to-regexp from 6.2.1 to 6.1.0

Commits

70eaaf2 Remove normalizePathname from library
fe645f9 Rename TokensToRegexpOptions
9e1215a Add test for encode in pathToRegexp
dfb620c Encode using identity function by default
e1ccbe1 4.0.5
611513c Replace whitelist with decodeURI
f9bf1e0 4.0.4
8993bb0 Remove usage of String.prototype.normalize
2ae4d25 4.0.3
08a1a3a Add normalize whitelist of characters
Additional commits viewable in compare view

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates protobufjs from 7.2.4 to 7.5.4

Release notes

Sourced from protobufjs's releases.

protobufjs: v7.5.4

7.5.4 (2025-08-15)

Bug Fixes

invalid syntax in descriptor.proto (#2092) (5a3769a)

protobufjs: v7.5.3

7.5.3 (2025-05-28)

Bug Fixes

descriptor extensions handling post-editions (#2075) (6e255d4)

protobufjs: v7.5.2

7.5.2 (2025-05-14)

Bug Fixes

ensure that types are always resolved (#2068) (4b51cb2)

protobufjs: v7.5.1

7.5.1 (2025-05-08)

Bug Fixes

optimize regressions from editions implementations (#2066) (6406d4c)

reserved field inside group blocks fail parsing (#2058) (56782bf)

protobufjs: v7.5.0

7.5.0 (2025-04-15)

Features

add Edition 2023 Support (f04ded3)

add Edition 2023 Support (ac9a3b9)

add Edition 2023 Support (e5ca5c8)

add Edition 2023 Support (a84409b)

add Edition 2023 Support (9c5a178)

add Edition 2023 Support (b2c6867)

add Edition 2023 Support (60f3e51)

add Edition 2023 Support (a656361)

add Edition 2023 Support (869a95b)

add Edition 2023 Support (b936af4)

add Edition 2023 Support (a938467)

... (truncated)

Changelog

Sourced from protobufjs's changelog.

7.5.4 (2025-08-15)

Bug Fixes

invalid syntax in descriptor.proto (#2092) (5a3769a)

7.5.3 (2025-05-28)

Bug Fixes

descriptor extensions handling post-editions (#2075) (6e255d4)

7.5.2 (2025-05-14)

Bug Fixes

ensure that types are always resolved (#2068) (4b51cb2)

7.5.1 (2025-05-08)

Bug Fixes

optimize regressions from editions implementations (#2066) (6406d4c)

reserved field inside group blocks fail parsing (#2058) (56782bf)

7.5.0 (2025-04-15)

Features

add Edition 2023 Support (f04ded3)

add Edition 2023 Support (ac9a3b9)

add Edition 2023 Support (e5ca5c8)

add Edition 2023 Support (a84409b)

add Edition 2023 Support (9c5a178)

add Edition 2023 Support (b2c6867)

add Edition 2023 Support (60f3e51)

add Edition 2023 Support (a656361)

add Edition 2023 Support (869a95b)

add Edition 2023 Support (b936af4)

add Edition 2023 Support (a938467)

add Edition 2023 Support (1af8454)

add Edition 2023 Support (785416f)

add feature resolution (a9ffc8a)

add feature resolution and tests (68b5339)

add feature resolution for protobuf editions (547afa2)

... (truncated)

Commits

827ff8e chore: release master (#2093)
5a3769a fix: invalid syntax in descriptor.proto (#2092)
f42297b chore: release master (#2076)
6e255d4 fix: descriptor extensions handling post-editions (#2075)
9467abe chore: release master (#2070)
4b51cb2 fix: ensure that types are always resolved (#2068)
69cced8 chore: release master (#2067)
6406d4c fix: optimize regressions from editions implementations (#2066)
56782bf fix: reserved field inside group blocks fail parsing (#2058)
1dbcfe3 Merge pull request #2035 from protobufjs/release-please--branches--master
Additional commits viewable in compare view

Updates tar from 6.2.1 to 7.5.9

Commits

1f0c2c9 7.5.9
fbb0851 build minified version as default export
6b8eba0 7.5.8
2cb1120 fix(unpack): improve UnpackSync symlink error "into" path accuracy
d18e4e1 fix: do not write linkpaths through symlinks
See full diff in compare view

Maintainer changes

This version was pushed to npm by isaacs, a new releaser for tar since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates fast-xml-parser from 4.5.3 to 5.3.6

Release notes

Sourced from fast-xml-parser's releases.

Entity security and performance

Improve security and performance of entity processing

new options maxEntitySize, maxExpansionDepth, maxTotalExpansions, maxExpandedLength, allowedTags,tagFilter

fast return when no edtity is present

improvement replacement logic to reduce number of calls

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.3.5...v5.3.6

v5.3.5

What's Changed

Add missing exports to fxp commonjs types by @jeremymeng in NaturalIntelligence/fast-xml-parser#782

fix: Escape regex char in entity name

update strnum to 2.1.2

New Contributors

@jeremymeng made their first contribution in NaturalIntelligence/fast-xml-parser#782

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.3.4...v5.3.5

Changelog

Sourced from fast-xml-parser's changelog.

Note: If you find missing information about particular minor version, that version must have been changed without any functional change in this library.

5.3.6 / 2026-02-14

Improve security and performance of entity processing

new options maxEntitySize, maxExpansionDepth, maxTotalExpansions, maxExpandedLength, allowedTags,tagFilter

fast return when no edtity is present

improvement replacement logic to reduce number of calls

5.3.5 / 2026-02-08

fix: Escape regex char in entity name

update strnum to 2.1.2

add missing exports in CJS typings

5.3.4 / 2026-01-30

fix: handle HTML numeric and hex entities when out of range

5.3.3 / 2025-12-12

fix #775: transformTagName with allowBooleanAttributes adds an unnecessary attribute

5.3.2 / 2025-11-14

fix for import statement for v6

5.3.1 / 2025-11-03

Performance improvement for stopNodes (By Maciek Lamberski)

5.3.0 / 2025-10-03

Use Uint8Array in place of Buffer in Parser

5.2.5 / 2025-06-08

Inform user to use fxp-cli instead of in-built CLI feature

Export typings for direct use

5.2.4 / 2025-06-06

fix (#747): fix EMPTY and ANY with ELEMENT in DOCTYPE

5.2.3 / 2025-05-11

fix (#747): support EMPTY and ANY with ELEMENT in DOCTYPE

5.2.2 / 2025-05-05

fix (#746): update strnum to fix parsing issues related to enotations

5.2.1 / 2025-04-22

fix: read DOCTYPE entity value correctly

read DOCTYPE NOTATION, ELEMENT exp but not using read values

5.2.0 / 2025-04-03

... (truncated)

Commits

ecb2ca1 update release info
910dae5 fix entities performance & security issues
fe9a852 update strnum and release detail
943ef0e fix: Escape regex char in entity name
ddcd0ac Escape regex char in entity name
341b582 Add missing exports to fxp commonjs types (#782)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

…updates Bumps the npm_and_yarn group with 2 updates in the / directory: [qs](https://github.com/ljharb/qs) and [tar](https://github.com/isaacs/node-tar). Bumps the npm_and_yarn group with 1 update in the /_deprecated/server directory: [qs](https://github.com/ljharb/qs). Bumps the npm_and_yarn group with 2 updates in the /functions directory: [qs](https://github.com/ljharb/qs) and [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser). Bumps the npm_and_yarn group with 3 updates in the /vercel-api directory: [nodemailer](https://github.com/nodemailer/nodemailer), [esbuild](https://github.com/evanw/esbuild) and [protobufjs](https://github.com/protobufjs/protobuf.js). Updates `qs` from 6.14.1 to 6.14.2 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.14.1...v6.14.2) Updates `tar` from 7.5.7 to 7.5.9 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v7.5.7...v7.5.9) Updates `qs` from 6.14.1 to 6.14.2 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.14.1...v6.14.2) Updates `qs` from 6.14.1 to 6.14.2 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.14.1...v6.14.2) Updates `fast-xml-parser` from 5.3.4 to 5.3.6 - [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases) - [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md) - [Commits](NaturalIntelligence/fast-xml-parser@v5.3.4...v5.3.6) Updates `nodemailer` from 6.10.1 to 7.0.11 - [Release notes](https://github.com/nodemailer/nodemailer/releases) - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](nodemailer/nodemailer@v6.10.1...v7.0.11) Updates `esbuild` from 0.14.47 to 0.27.0 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2022.md) - [Commits](evanw/esbuild@v0.14.47...v0.27.0) Updates `path-to-regexp` from 6.2.1 to 6.1.0 - [Release notes](https://github.com/pillarjs/path-to-regexp/releases) - [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md) - [Commits](pillarjs/path-to-regexp@v6.2.1...v6.1.0) Updates `protobufjs` from 7.2.4 to 7.5.4 - [Release notes](https://github.com/protobufjs/protobuf.js/releases) - [Changelog](https://github.com/protobufjs/protobuf.js/blob/master/CHANGELOG.md) - [Commits](protobufjs/protobuf.js@protobufjs-v7.2.4...protobufjs-v7.5.4) Updates `tar` from 6.2.1 to 7.5.9 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v7.5.7...v7.5.9) Updates `fast-xml-parser` from 4.5.3 to 5.3.6 - [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases) - [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md) - [Commits](NaturalIntelligence/fast-xml-parser@v5.3.4...v5.3.6) --- updated-dependencies: - dependency-name: qs dependency-version: 6.14.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tar dependency-version: 7.5.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.14.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.14.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-xml-parser dependency-version: 5.3.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: nodemailer dependency-version: 7.0.11 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: esbuild dependency-version: 0.27.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: path-to-regexp dependency-version: 6.1.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: protobufjs dependency-version: 7.5.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tar dependency-version: 7.5.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-xml-parser dependency-version: 5.3.6 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Feb 19, 2026

Navigation Menu

chore(deps): bump the npm_and_yarn group across 4 directories with 7 updates - #12

chore(deps): bump the npm_and_yarn group across 4 directories with 7 updates#12
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-c528a437a5

dependabot Bot commented on behalf of github Feb 19, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Feb 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

6.14.2

6.14.2

6.14.2

Entity security and performance

v5.3.5

What's Changed

New Contributors

v7.0.11

7.0.11 (2025-11-26)

Bug Fixes

v7.0.10

7.0.10 (2025-10-23)

Bug Fixes

v7.0.9

7.0.9 (2025-10-07)

Bug Fixes

v7.0.8

7.0.8 (2025-10-07)

Bug Fixes

v7.0.7

7.0.7 (2025-10-05)

Bug Fixes

v7.0.6

7.0.6 (2025-08-27)

Bug Fixes

7.0.11 (2025-11-26)

Bug Fixes

7.0.10 (2025-10-23)

Bug Fixes

7.0.9 (2025-10-07)

Bug Fixes

7.0.8 (2025-10-07)

Bug Fixes

7.0.7 (2025-10-05)

Bug Fixes

7.0.6 (2025-08-27)

Bug Fixes

7.0.5 (2025-07-07)

Bug Fixes

v0.27.0

v0.26.0

v0.25.12

Changelog: 2022

0.16.12

0.16.11

protobufjs: v7.5.4

7.5.4 (2025-08-15)

Bug Fixes

protobufjs: v7.5.3

7.5.3 (2025-05-28)

Bug Fixes

protobufjs: v7.5.2

7.5.2 (2025-05-14)

Bug Fixes

protobufjs: v7.5.1

7.5.1 (2025-05-08)

Bug Fixes

protobufjs: v7.5.0

7.5.0 (2025-04-15)

Features

7.5.4 (2025-08-15)

Bug Fixes

7.5.3 (2025-05-28)

Bug Fixes

7.5.2 (2025-05-14)

Bug Fixes

7.5.1 (2025-05-08)

Bug Fixes

7.5.0 (2025-04-15)

Features

Entity security and performance

v5.3.5

What's Changed

New Contributors

Uh oh!

Reviewers

Assignees

dependabot Bot commented on behalf of github Feb 19, 2026 •

edited

Loading