[PR #5] [MERGED] Bump the npm_and_yarn group across 1 directory with 2 updates #6

New issue

Closed

opened 2026-10-15 18:07:26 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:07:26 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/SillyTavern/SillyTavern-Office-Parser/pull/5
Author: @dependabot[bot]
Created: 11/16/2025
Status: ✅ Merged
Merged: 11/16/2025
Merged by: @Cohee1207

Base: main ← Head: dependabot/npm_and_yarn/npm_and_yarn-768f0996a5

📝 Commits (1)

cd397f4 Bump the npm_and_yarn group across 1 directory with 2 updates

📊 Changes

2 files changed (+27 additions, -56 deletions)

View changed files

📝 package-lock.json (+26 -55)
📝 package.json (+1 -1)

📄 Description

Bumps the npm_and_yarn group with 2 updates in the / directory: js-yaml and tmp.

Updates js-yaml from 4.1.0 to 4.1.1

Changelog

Sourced from js-yaml's changelog.

[4.1.1] - 2025-11-12

Security

Fix prototype pollution issue in yaml merge (<<) operator.

Commits

cc482e7 4.1.1 released
50968b8 dist rebuild
d092d86 lint fix
383665f fix prototype pollution in merge (<<)
0d3ca7a README.md: HTTP => HTTPS (#678)
49baadd doc: 'empty' style option for !!null
ba3460e Fix demo link (#618)
See full diff in compare view

Updates tmp from 0.0.33 to 0.2.5

Changelog

Sourced from tmp's changelog.

v0.2.2 (2024-02-28)

🐛 Bug Fix

#278 Closes #268: Revert "fix #246: remove any double quotes or single quotes… (@mbargiel)

📝 Documentation

#279 Closes #266: move paragraph on graceful cleanup to the head of the documentation (@silkentrance)

Committers: 5

Carsten Klein (@silkentrance)

Dave Nicolson (@dnicolson)

KARASZI István (@raszi)

Maxime Bargiel (@mbargiel)

@robertoaceves

v0.2.1 (2020-04-28)

🚀 Enhancement

#252 Closes #250: introduce tmpdir option for overriding the system tmp dir (@silkentrance)

🏠 Internal

#253 Closes #191: generate changelog from pull requests using lerna-changelog (@silkentrance)

Committers: 1

Carsten Klein (@silkentrance)

v0.2.0 (2020-04-25)

🚀 Enhancement

#234 feat: stabilize tmp for v0.2.0 release (@silkentrance)

🐛 Bug Fix

#231 Closes #230: regression after fix for #197 (@silkentrance)

#220 Closes #197: return sync callback when using the sync interface, otherwise return the async callback (@silkentrance)

#193 Closes #192: tmp must not exit the process on its own (@silkentrance)

📝 Documentation

#221 Gh 206 document name option (@silkentrance)

🏠 Internal

#226 Closes #212: enable direct name option test (@silkentrance)

#225 Closes #211: existing tests must clean up after themselves (@silkentrance)

#224 Closes #217: name tests must use tmpName (@silkentrance)

#223 Closes #214: refactor tests and lib (@silkentrance)

#198 Update dependencies to latest versions (@matsev)

... (truncated)

Commits

3d2fe38 Bump up the version
e162828 Merge pull request #309 from fflorent/fix-tmp-dir-with-dir
b847d2f Fix use of tmp.dir() with dir option
08fa3ab Update version
1cf4ec5 Merge commit from fork
188b25e Fix GHSA-52f5-9888-hmc6
73b9fe4 Add test case for GHSA-52f5-9888-hmc6
b8e2f29 Remove broken tests
2892a02 Remove outdated URL
f592318 Reformat package.json
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/SillyTavern/SillyTavern-Office-Parser/pull/5 **Author:** [@dependabot[bot]](https://github.com/apps/dependabot) **Created:** 11/16/2025 **Status:** ✅ Merged **Merged:** 11/16/2025 **Merged by:** [@Cohee1207](https://github.com/Cohee1207) **Base:** `main` ← **Head:** `dependabot/npm_and_yarn/npm_and_yarn-768f0996a5` --- ### 📝 Commits (1) - [`cd397f4`](https://github.com/SillyTavern/SillyTavern-Office-Parser/commit/cd397f4a163e01c8d9201c5c216e63e9dcdf14d9) Bump the npm_and_yarn group across 1 directory with 2 updates ### 📊 Changes **2 files changed** (+27 additions, -56 deletions) <details> <summary>View changed files</summary> 📝 `package-lock.json` (+26 -55) 📝 `package.json` (+1 -1) </details> ### 📄 Description Bumps the npm_and_yarn group with 2 updates in the / directory: [js-yaml](https://github.com/nodeca/js-yaml) and [tmp](https://github.com/raszi/node-tmp). Updates `js-yaml` from 4.1.0 to 4.1.1 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md">js-yaml's changelog</a>.</em></p> <blockquote> <h2>[4.1.1] - 2025-11-12</h2> <h3>Security</h3> <ul> <li>Fix prototype pollution issue in yaml merge (<<) operator.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/nodeca/js-yaml/commit/cc482e775913e6625137572a3712d2826170e53a"><code>cc482e7</code></a> 4.1.1 released</li> <li><a href="https://github.com/nodeca/js-yaml/commit/50968b862e75866ef90e626572fe0b2f97b55f9f"><code>50968b8</code></a> dist rebuild</li> <li><a href="https://github.com/nodeca/js-yaml/commit/d092d866031751cb27c12d93f3e2470ad74d678b"><code>d092d86</code></a> lint fix</li> <li><a href="https://github.com/nodeca/js-yaml/commit/383665ff4248ec2192d1274e934462bb30426879"><code>383665f</code></a> fix prototype pollution in merge (<<)</li> <li><a href="https://github.com/nodeca/js-yaml/commit/0d3ca7a27b03a6c974790a30a89e456007d62976"><code>0d3ca7a</code></a> README.md: HTTP => HTTPS (<a href="https://redirect.github.com/nodeca/js-yaml/issues/678">#678</a>)</li> <li><a href="https://github.com/nodeca/js-yaml/commit/49baadd52af887d2991e2c39a6639baa56d6c71b"><code>49baadd</code></a> doc: 'empty' style option for !!null</li> <li><a href="https://github.com/nodeca/js-yaml/commit/ba3460eb9d3e4478edcbc29edabe17c2157fc9ce"><code>ba3460e</code></a> Fix demo link (<a href="https://redirect.github.com/nodeca/js-yaml/issues/618">#618</a>)</li> <li>See full diff in <a href="https://github.com/nodeca/js-yaml/compare/4.1.0...4.1.1">compare view</a></li> </ul> </details> <br /> Updates `tmp` from 0.0.33 to 0.2.5 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md">tmp's changelog</a>.</em></p> <blockquote> <h2>v0.2.2 (2024-02-28)</h2> <h4>:bug: Bug Fix</h4> <ul> <li><a href="https://redirect.github.com/raszi/node-tmp/pull/278">#278</a> Closes <a href="https://redirect.github.com/raszi/node-tmp/issues/268">#268</a>: Revert "fix <a href="https://redirect.github.com/raszi/node-tmp/issues/246">#246</a>: remove any double quotes or single quotes… (<a href="https://github.com/mbargiel"><code>@mbargiel</code></a>)</li> </ul> <h4>:memo: Documentation</h4> <ul> <li><a href="https://redirect.github.com/raszi/node-tmp/pull/279">#279</a> Closes <a href="https://redirect.github.com/raszi/node-tmp/issues/266">#266</a>: move paragraph on graceful cleanup to the head of the documentation (<a href="https://github.com/silkentrance"><code>@silkentrance</code></a>)</li> </ul> <h4>Committers: 5</h4> <ul> <li>Carsten Klein (<a href="https://github.com/silkentrance"><code>@silkentrance</code></a>)</li> <li>Dave Nicolson (<a href="https://github.com/dnicolson"><code>@dnicolson</code></a>)</li> <li>KARASZI István (<a href="https://github.com/raszi"><code>@raszi</code></a>)</li> <li>Maxime Bargiel (<a href="https://github.com/mbargiel"><code>@mbargiel</code></a>)</li> <li><a href="https://github.com/robertoaceves"><code>@robertoaceves</code></a></li> </ul> <h2>v0.2.1 (2020-04-28)</h2> <h4>:rocket: Enhancement</h4> <ul> <li><a href="https://redirect.github.com/raszi/node-tmp/pull/252">#252</a> Closes <a href="https://redirect.github.com/raszi/node-tmp/issues/250">#250</a>: introduce tmpdir option for overriding the system tmp dir (<a href="https://github.com/silkentrance"><code>@silkentrance</code></a>)</li> </ul> <h4>:house: Internal</h4> <ul> <li><a href="https://redirect.github.com/raszi/node-tmp/pull/253">#253</a> Closes <a href="https://redirect.github.com/raszi/node-tmp/issues/191">#191</a>: generate changelog from pull requests using lerna-changelog (<a href="https://github.com/silkentrance"><code>@silkentrance</code></a>)</li> </ul> <h4>Committers: 1</h4> <ul> <li>Carsten Klein (<a href="https://github.com/silkentrance"><code>@silkentrance</code></a>)</li> </ul> <h2>v0.2.0 (2020-04-25)</h2> <h4>:rocket: Enhancement</h4> <ul> <li><a href="https://redirect.github.com/raszi/node-tmp/pull/234">#234</a> feat: stabilize tmp for v0.2.0 release (<a href="https://github.com/silkentrance"><code>@silkentrance</code></a>)</li> </ul> <h4>:bug: Bug Fix</h4> <ul> <li><a href="https://redirect.github.com/raszi/node-tmp/pull/231">#231</a> Closes <a href="https://redirect.github.com/raszi/node-tmp/issues/230">#230</a>: regression after fix for <a href="https://redirect.github.com/raszi/node-tmp/issues/197">#197</a> (<a href="https://github.com/silkentrance"><code>@silkentrance</code></a>)</li> <li><a href="https://redirect.github.com/raszi/node-tmp/pull/220">#220</a> Closes <a href="https://redirect.github.com/raszi/node-tmp/issues/197">#197</a>: return sync callback when using the sync interface, otherwise return the async callback (<a href="https://github.com/silkentrance"><code>@silkentrance</code></a>)</li> <li><a href="https://redirect.github.com/raszi/node-tmp/pull/193">#193</a> Closes <a href="https://redirect.github.com/raszi/node-tmp/issues/192">#192</a>: tmp must not exit the process on its own (<a href="https://github.com/silkentrance"><code>@silkentrance</code></a>)</li> </ul> <h4>:memo: Documentation</h4> <ul> <li><a href="https://redirect.github.com/raszi/node-tmp/pull/221">#221</a> Gh 206 document name option (<a href="https://github.com/silkentrance"><code>@silkentrance</code></a>)</li> </ul> <h4>:house: Internal</h4> <ul> <li><a href="https://redirect.github.com/raszi/node-tmp/pull/226">#226</a> Closes <a href="https://redirect.github.com/raszi/node-tmp/issues/212">#212</a>: enable direct name option test (<a href="https://github.com/silkentrance"><code>@silkentrance</code></a>)</li> <li><a href="https://redirect.github.com/raszi/node-tmp/pull/225">#225</a> Closes <a href="https://redirect.github.com/raszi/node-tmp/issues/211">#211</a>: existing tests must clean up after themselves (<a href="https://github.com/silkentrance"><code>@silkentrance</code></a>)</li> <li><a href="https://redirect.github.com/raszi/node-tmp/pull/224">#224</a> Closes <a href="https://redirect.github.com/raszi/node-tmp/issues/217">#217</a>: name tests must use tmpName (<a href="https://github.com/silkentrance"><code>@silkentrance</code></a>)</li> <li><a href="https://redirect.github.com/raszi/node-tmp/pull/223">#223</a> Closes <a href="https://redirect.github.com/raszi/node-tmp/issues/214">#214</a>: refactor tests and lib (<a href="https://github.com/silkentrance"><code>@silkentrance</code></a>)</li> <li><a href="https://redirect.github.com/raszi/node-tmp/pull/198">#198</a> Update dependencies to latest versions (<a href="https://github.com/matsev"><code>@matsev</code></a>)</li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/raszi/node-tmp/commit/3d2fe387f3f91b13830b9182faa02c3231ea8258"><code>3d2fe38</code></a> Bump up the version</li> <li><a href="https://github.com/raszi/node-tmp/commit/e16282879e5d0554fe824e1ab3df724847e91183"><code>e162828</code></a> Merge pull request <a href="https://redirect.github.com/raszi/node-tmp/issues/309">#309</a> from fflorent/fix-tmp-dir-with-dir</li> <li><a href="https://github.com/raszi/node-tmp/commit/b847d2f1a42b625c26149f4a2029ed00a1edf90b"><code>b847d2f</code></a> Fix use of tmp.dir() with <code>dir</code> option</li> <li><a href="https://github.com/raszi/node-tmp/commit/08fa3abac32b621506512724b28b56b9c4a95846"><code>08fa3ab</code></a> Update version</li> <li><a href="https://github.com/raszi/node-tmp/commit/1cf4ec54180a77a2a95dc1941efa1659774c8787"><code>1cf4ec5</code></a> Merge commit from fork</li> <li><a href="https://github.com/raszi/node-tmp/commit/188b25e529496e37adaf1a1d9dccb40019a08b1b"><code>188b25e</code></a> Fix GHSA-52f5-9888-hmc6</li> <li><a href="https://github.com/raszi/node-tmp/commit/73b9fe45bbb40157acdfab8126dd0911de91c8fa"><code>73b9fe4</code></a> Add test case for GHSA-52f5-9888-hmc6</li> <li><a href="https://github.com/raszi/node-tmp/commit/b8e2f29a7575352e49e4882a836aab4bd2ec927f"><code>b8e2f29</code></a> Remove broken tests</li> <li><a href="https://github.com/raszi/node-tmp/commit/2892a027b4d2d3a25d1d08a398bc108a0200857f"><code>2892a02</code></a> Remove outdated URL</li> <li><a href="https://github.com/raszi/node-tmp/commit/f5923182461a89e9de5a7a09c75f410a76979ae7"><code>f592318</code></a> Reformat package.json</li> <li>Additional commits viewable in <a href="https://github.com/raszi/node-tmp/compare/v0.0.33...v0.2.5">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/SillyTavern/SillyTavern-Office-Parser/network/alerts). </details> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-15 18:07:26 +00:00