Bump the npm_and_yarn group across 14 directories with 5 updates

[dependabot]

Bumps the npm_and_yarn group with 4 updates in the / directory: minimatch, undici, immutable and flatted.
Bumps the npm_and_yarn group with 1 update in the /compiler directory: flatted.
Bumps the npm_and_yarn group with 1 update in the /fixtures/legacy-jsx-runtimes/react-14 directory: minimatch.
Bumps the npm_and_yarn group with 1 update in the /fixtures/packaging/browserify/dev directory: minimatch.
Bumps the npm_and_yarn group with 1 update in the /fixtures/packaging/browserify/prod directory: minimatch.
Bumps the npm_and_yarn group with 2 updates in the /fixtures/packaging/brunch/dev directory: minimatch and tar.
Bumps the npm_and_yarn group with 2 updates in the /fixtures/packaging/brunch/prod directory: minimatch and tar.
Bumps the npm_and_yarn group with 1 update in the /fixtures/packaging/systemjs-builder/dev directory: minimatch.
Bumps the npm_and_yarn group with 1 update in the /fixtures/packaging/systemjs-builder/prod directory: minimatch.
Bumps the npm_and_yarn group with 2 updates in the /fixtures/packaging/webpack-alias/dev directory: minimatch and tar.
Bumps the npm_and_yarn group with 2 updates in the /fixtures/packaging/webpack-alias/prod directory: minimatch and tar.
Bumps the npm_and_yarn group with 2 updates in the /fixtures/packaging/webpack/dev directory: minimatch and tar.
Bumps the npm_and_yarn group with 2 updates in the /fixtures/packaging/webpack/prod directory: minimatch and tar.
Bumps the npm_and_yarn group with 1 update in the /scripts/bench directory: minimatch.

Updates minimatch from 3.0.4 to 3.1.4

Commits

• 1a2e084 3.1.4
• ae24656 update lockfile
• b100374 limit recursion for **, improve perf considerably
• 26ffeaa lockfile update
• 9eca892 lock node version to 14
• 00c323b 3.1.3
• 30486b2 update CI matrix and actions
• 9c31b2d update test expectations for coalesced consecutive stars
• 46fe687 coalesce consecutive non-globstar * characters
• 5a9ccbd [meta] update publishConfig.tag to legacy-v3
• Additional commits viewable in compare view

Updates undici from 5.28.4 to 6.24.0

Release notes

Sourced from undici's releases.

v6.24.0

Undici v6.24.0 Security Release Notes (LTS)

This release backports fixes for security vulnerabilities affecting the v6 line.

Upgrade guidance

All users on v6 should upgrade to v6.24.0 or later.

Fixed advisories

• GHSA-2mjp-6q6p-2qxm / CVE-2026-1525 (Medium)
  Inconsistent interpretation of HTTP requests (request/response smuggling class issue).

• GHSA-f269-vfmq-vjvj / CVE-2026-1528 (High)
  Malicious WebSocket 64-bit frame length handling could crash the client.

• GHSA-4992-7rv2-5pvq / CVE-2026-1527 (Medium)
  CRLF injection via the upgrade option.

• GHSA-v9p9-hfj2-hcw8 / CVE-2026-2229 (High)
  Unhandled exception from invalid server_max_window_bits in WebSocket permessage-deflate negotiation.

• GHSA-vrm6-8vpv-qv8q / CVE-2026-1526 (High)
  Unbounded memory consumption in WebSocket permessage-deflate decompression.

Not applicable to v6

• GHSA-phc3-fgpg-7m6h / CVE-2026-2581 affects >= 7.17.0 < 7.24.0 only.

Affected and patched ranges (v6)

• CVE-2026-1525: affected < 6.24.0, patched 6.24.0
• CVE-2026-1528: affected >= 6.0.0 < 6.24.0, patched 6.24.0
• CVE-2026-1527: affected < 6.24.0, patched 6.24.0
• CVE-2026-2229: affected < 6.24.0, patched 6.24.0
• CVE-2026-1526: affected < 6.24.0, patched 6.24.0

References

• GitHub Security Advisories: https://github.com/nodejs/undici/security/advisories
• NVD CVE-2026-1525: https://nvd.nist.gov/vuln/detail/CVE-2026-1525
• NVD CVE-2026-1528: https://nvd.nist.gov/vuln/detail/CVE-2026-1528
• NVD CVE-2026-1527: https://nvd.nist.gov/vuln/detail/CVE-2026-1527
• NVD CVE-2026-2229: https://nvd.nist.gov/vuln/detail/CVE-2026-2229
• NVD CVE-2026-1526: https://nvd.nist.gov/vuln/detail/CVE-2026-1526

v6.23.0

⚠️ Security Release

... (truncated)

Commits

• 8873c94 Bumped v6.24.0
• 411bd01 test(websocket): use node:assert for Node 18 compatibility
• 844bf59 test: fix http2 lint regressions in backport
• a444e4f test: stabilize h2 and tls-cert-leak under current test runner
• dc032a1 fix: h2 CI (#4395)
• 4cd3f4b test: increase bitness in test/fixtures/*.pem (#3659)
• 7df6442 fix: adapt websocket frame-limit handling for v6 parser
• 4e0179a fix: reject duplicate content-length and host headers
• 5a97f08 Fix websocket 64-bit length overflow
• e43e898 fix: validate upgrade header to prevent CRLF injection
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for undici since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates immutable from 4.0.0-rc.12 to 4.3.8

Release notes

Sourced from immutable's releases.

v4.3.8

Fix Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

v4.3.7

What's Changed

• Fix issue with slice negative of filtered sequence by @​jdeniau in immutable-js/immutable-js#2006

Full Changelog: immutable-js/immutable-js@v4.3.6...v4.3.7

v4.3.6

What's Changed

• Fix Repeat().equals(undefined) incorrectly returning true by @​butchler in immutable-js/immutable-js#1994

Internals

• change youtube image by @​jdeniau in immutable-js/immutable-js#1973
• Upgrade eslint and ignore no-constructor-return rule for actual constructors by @​jdeniau in immutable-js/immutable-js#1974
• upgrate documentation website to next 14 by @​jdeniau in immutable-js/immutable-js#1975
• start migrating to nextjs app router by @​jdeniau in immutable-js/immutable-js#1976
• upgrade next sitemap by @​jdeniau in immutable-js/immutable-js#1978

New Contributors

• @​butchler made their first contribution in immutable-js/immutable-js#1994

Full Changelog: immutable-js/immutable-js@v4.3.5...v4.3.6

v4.3.5

What's Changed

• Fix Set.fromKeys types with Map constructor in TS 5.0 by @​jdeniau in immutable-js/immutable-js#1971
• upgrade to TS 5.1 by @​jdeniau in immutable-js/immutable-js#1972
• fix dist-stats command by @​jdeniau in immutable-js/immutable-js#1964
• fix Read the Docs link on readme by @​joshding in immutable-js/immutable-js#1970

New Contributors

• @​joshding made their first contribution in immutable-js/immutable-js#1970

Full Changelog: immutable-js/immutable-js@v4.3.4...v4.3.5

4.3.4

What's Changed

• Rollback toJS type due to circular reference error by @​jdeniau in immutable-js/immutable-js#1958

Full Changelog: immutable-js/immutable-js@v4.3.3...v4.3.4

v4.3.3

What's Changed

• [typescript] manage to handle toJS circular reference. #1932 by @​jdeniau

... (truncated)

Changelog

Sourced from immutable's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning. Dates are formatted as YYYY-MM-DD.

Unreleased

5.1.5

• Fix Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

5.1.4

• Migrate some files to TS by @​jdeniau in immutable-js/immutable-js#2125
  • Iterator.ts
  • PairSorting.ts
  • toJS.ts
  • Math.ts
  • Hash.ts
• Extract CollectionHelperMethods and convert to TS by @​jdeniau in immutable-js/immutable-js#2131
• Use npm trusted publishing only to avoid token stealing.

Documentation

• Fix/a11y issues by @​lyannel in immutable-js/immutable-js#2136
• Doc add Map.get signature update by @​borracciaBlu in immutable-js/immutable-js#2138
• fix(doc):minor-issues#2132 by @​JayMeDotDot in immutable-js/immutable-js#2133
• Fix algolia search by @​jdeniau in immutable-js/immutable-js#2135
• Typo in OrderedMap by @​jdeniau in immutable-js/immutable-js#2144

Internal

• chore: Sort all imports and activate eslint import rule by @​jdeniau in immutable-js/immutable-js#2119

5.1.3

TypeScript

• fix: allow readonly map entry constructor by @​septs in immutable-js/immutable-js#2123

Documentation

There has been a huge amount of changes in the documentation, mainly migrate from an autogenerated documentation from .d.ts file, to a proper documentation in markdown. The playground has been included on nearly all method examples. We added a page about browser extensions too: https://immutable-js.com/browser-extension/

Internal

... (truncated)

Commits

• 485cbe0 4.3.8
• 6ed4eb6 Merge commit from fork
• 94bcd3c fix new proto key injection
• faeb58b fix Prototype Pollution in mergeDeep, toJS, etc.
• 37ca417 release 4.3.7 (#2007)
• 23daf26 Fix issue with slice negative of filtered sequence (#2006)
• 493afba release 4.3.6 (#1997)
• be3cb9a Fix Repeat(<value>).equals(undefined) incorrectly returning true (#1994)
• d7664bf generate sitemap in path that will be deployed
• f8327b1 upgrade next sitemap (#1978)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for immutable since your current version.

Updates flatted from 3.2.7 to 3.4.1

Commits

• 2a02dce 3.4.1
• fba4e8f Merge pull request #89 from WebReflection/python-fix
• 5fe8648 added "when in Rome" also a test for PHP
• 53517ad some minor improvement
• b3e2a0c Fixing recursion issue in Python too
• c4b46db Add SECURITY.md for security policy and reporting
• f86d071 Create dependabot.yml for version updates
• d3418c7 3.4.0
• 7eb65d8 Merge pull request #88 from WebReflection/avoid-recusrion
• 7774aae Avoid recursion on parse due possible shenanigans
• Additional commits viewable in compare view

Updates flatted from 3.2.7 to 3.4.1

Commits

• 2a02dce 3.4.1
• fba4e8f Merge pull request #89 from WebReflection/python-fix
• 5fe8648 added "when in Rome" also a test for PHP
• 53517ad some minor improvement
• b3e2a0c Fixing recursion issue in Python too
• c4b46db Add SECURITY.md for security policy and reporting
• f86d071 Create dependabot.yml for version updates
• d3418c7 3.4.0
• 7eb65d8 Merge pull request #88 from WebReflection/avoid-recusrion
• 7774aae Avoid recursion on parse due possible shenanigans
• Additional commits viewable in compare view

Updates minimatch from 3.0.4 to 3.1.5

Commits

• 1a2e084 3.1.4
• ae24656 update lockfile
• b100374 limit recursion for **, improve perf considerably
• 26ffeaa lockfile update
• 9eca892 lock node version to 14
• 00c323b 3.1.3
• 30486b2 update CI matrix and actions
• 9c31b2d update test expectations for coalesced consecutive stars
• 46fe687 coalesce consecutive non-globstar * characters
• 5a9ccbd [meta] update publishConfig.tag to legacy-v3
• Additional commits viewable in compare view

Updates minimatch from 3.0.4 to 3.1.5

Commits

• 1a2e084 3.1.4
• ae24656 update lockfile
• b100374 limit recursion for **, improve perf considerably
• 26ffeaa lockfile update
• 9eca892 lock node version to 14
• 00c323b 3.1.3
• 30486b2 update CI matrix and actions
• 9c31b2d update test expectations for coalesced consecutive stars
• 46fe687 coalesce consecutive non-globstar * characters
• 5a9ccbd [meta] update publishConfig.tag to legacy-v3
• Additional commits viewable in compare view

Updates minimatch from 3.0.4 to 3.1.5

Commits

• 1a2e084 3.1.4
• ae24656 update lockfile
• b100374 limit recursion for **, improve perf considerably
• 26ffeaa lockfile update
• 9eca892 lock node version to 14
• 00c323b 3.1.3
• 30486b2 update CI matrix and actions
• 9c31b2d update test expectations for coalesced consecutive stars
• 46fe687 coalesce consecutive non-globstar * characters
• 5a9ccbd [meta] update publishConfig.tag to legacy-v3
• Additional commits viewable in compare view

Updates minimatch from 3.0.4 to 3.1.5

Commits

• 1a2e084 3.1.4
• ae24656 update lockfile
• b100374 limit recursion for **, improve perf considerably
• 26ffeaa lockfile update
• 9eca892 lock node version to 14
• 00c323b 3.1.3
• 30486b2 update CI matrix and actions
• 9c31b2d update test expectations for coalesced consecutive stars
• 46fe687 coalesce consecutive non-globstar * characters
• 5a9ccbd [meta] update publishConfig.tag to legacy-v3
• Additional commits viewable in compare view

Updates tar from 2.2.1 to 2.2.2

Commits

• 523c5c7 2.2.2
• 7ecef07 Bump fstream to fix hardlink overwriting vulnerability
• 9fc84b9 Use {} for hardlink tracking instead of []
• 15e59f1 Only track previously seen hardlinks
• 4f85851 Ignore potentially unsafe files
• See full diff in compare view

Updates minimatch from 3.0.4 to 3.1.5

Commits

• 1a2e084 3.1.4
• ae24656 update lockfile
• b100374 limit recursion for **, improve perf considerably
• 26ffeaa lockfile update
• 9eca892 lock node version to 14
• 00c323b 3.1.3
• 30486b2 update CI matrix and actions
• 9c31b2d update test expectations for coalesced consecutive stars
• 46fe687 coalesce consecutive non-globstar * characters
• 5a9ccbd [meta] update publishConfig.tag to legacy-v3
• Additional commits viewable in compare view

Updates tar from 2.2.1 to 2.2.2

Commits

• 523c5c7 2.2.2
• 7ecef07 Bump fstream to fix hardlink overwriting vulnerability
• 9fc84b9 Use {} for hardlink tracking instead of []
• 15e59f1 Only track previously seen hardlinks
• 4f85851 Ignore potentially unsafe files
• See full diff in compare view

Updates minimatch from 3.0.4 to 3.1.5

Commits

• 1a2e084 3.1.4
• ae24656 update lockfile
• b100374 limit recursion for **, improve perf considerably
• 26ffeaa lockfile update
• 9eca892 lock node version to 14
• 00c323b 3.1.3
• 30486b2 update CI matrix and actions
• 9c31b2d update test expectations for coalesced consecutive stars
• 46fe687 coalesce consecutive non-globstar * characters
• 5a9ccbd [meta] update publishConfig.tag to legacy-v3
• Additional commits viewable in compare view

Updates minimatch from 3.0.4 to 3.1.5

Commits

• 1a2e084 3.1.4
• ae24656 update lockfile
• b100374 limit recursion for **, improve perf considerably
• 26ffeaa lockfile update
• 9eca892 lock node version to 14
• 00c323b 3.1.3
• 30486b2 update CI matrix and actions
• 9c31b2d update test expectations for coalesced consecutive stars
• 46fe687 coalesce consecutive non-globstar * characters
• 5a9ccbd [meta] update publishConfig.tag to legacy-v3
• Additional commits viewable in compare view

Updates minimatch from 3.0.4 to 3.1.5

Commits

• 1a2e084 3.1.4
• ae24656 update lockfile
• b100374 limit recursion for **, improve perf considerably
• 26ffeaa lockfile update
• 9eca892 lock node version to 14
• 00c323b 3.1.3
• 30486b2 update CI matrix and actions
• 9c31b2d update test expectations for coalesced consecutive stars
• 46fe687 coalesce consecutive non-globstar * characters
• 5a9ccbd [meta] update publishConfig.tag to legacy-v3
• Additional commits viewable in compare view

Updates tar from 2.2.1 to 2.2.2

Commits

• 523c5c7 2.2.2
• 7ecef07 Bump fstream to fix hardlink overwriting vulnerability
• 9fc84b9 Use {} for hardlink tracking instead of []
• 15e59f1 Only track previously seen hardlinks
• 4f85851 Ignore potentially unsafe files
• See full diff in compare view

Updates minimatch from 3.0.4 to 3.1.5

Commits

• 1a2e084 3.1.4
• ae24656 update lockfile
• b100374 limit recursion for **, improve perf considerably
• 26ffeaa lockfile update
• 9eca892 lock node version to 14
• 00c323b 3.1.3
• 30486b2 update CI matrix and actions
• 9c31b2d update test expectations for coalesced consecutive stars
• 46fe687 coalesce consecutive non-globstar * characters
• 5a9ccbd [meta] update publishConfig.tag to legacy-v3
• Additional commits viewable in compare view

Updates tar from 2.2.1 to 2.2.2

Commits

• 523c5c7 2.2.2
• 7ecef07 Bump fstream to fix hardlink overwriting vulnerability
• 9fc84b9 Use {} for hardlink tracking instead of []
• 15e59f1 Only track previously seen hardlinks
• 4f85851 Ignore potentially unsafe files
• See full diff in compare view

Updates minimatch from 3.0.4 to 3.1.5

Commits

• 1a2e084 3.1.4
• ae24656 update lockfile
• b100374 limit recursion for **, improve perf considerably
• 26ffeaa lockfile update
• 9eca892 lock node version to 14
• 00c323b 3.1.3
• 30486b2 update CI matrix and actions
• 9c31b2d update test expectations for coalesced consecutive stars
• 46fe687 coalesce consecutive non-globstar * characters
• 5a9ccbd [meta] update publishConfig.tag to legacy-v3
• Additional commits viewable in compare view

Updates tar from 2.2.1 to 2.2.2

Commits

• 523c5c7 2.2.2
• 7ecef07 Bump fstream to fix hardlink overwriting vulnerability
• 9fc84b9 Use {} for hardlink tracking instead of []
• 15e59f1 Only track previously seen hardlinks
• 4f85851 Ignore potentially unsafe files
• See full diff in compare view

Updates minimatch from 3.0.4 to 3.1.5

Commits

• 1a2e084 3.1.4
• ae24656 update lockfile
• b100374 limit recursion for **, improve perf considerably
• 26ffeaa lockfile update
• 9eca892 lock node version to 14
• 00c323b 3.1.3
• 30486b2 update CI matrix and actions
• 9c31b2d update test expectations for coalesced consecutive stars
• 46fe687 coalesce consecutive non-globstar * characters
• 5a9ccbd [meta] update publishConfig.tag to legacy-v3
• Additional commits viewable in compare view

Updates tar from 2.2.1 to 2.2.2

Commits

• 523c5c7 2.2.2
• 7ecef07 Bump fstream to fix hardlink overwriting vulnerability
• 9fc84b9 Use {} for hardlink tracking instead of []
• 15e59f1 Only track previously seen hardlinks
• 4f85851 Ignore potentially unsafe files
• See full diff in compare view

Updates minimatch from 3.0.4 to 3.1.5

Commits

• 1a2e084 3.1.4
• ae24656 update lockfile
• b100374 limit recursion for **, improve perf considerably
• 26ffeaa lockfile update
• 9eca892 lock node version to 14
• 00c323b 3.1.3
• 30486b2 update CI matrix and actions
• 9c31b2d update test expectations for coalesced consecutive stars
• 46fe687 coalesce consecutive non-globstar * characters
• 5a9ccbd [meta] update publishConfig.tag to legacy-v3
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.