chore(deps): bump @adguard/agtree from 4.0.1 to 4.0.4 by dependabot[bot] · Pull Request #1451 · jaypatrick/adblock-compiler

dependabot · 2026-03-30T14:18:20Z

Bumps @adguard/agtree from 4.0.1 to 4.0.4.

Release notes

Sourced from @adguard/agtree's releases.

TSWebExtension v4.0.4

We are happy to announce the release of TSWebExtension v4.0.4!

Please see the CHANGELOG for more information.

TSUrlFilter v4.0.4

We are happy to announce the release of TSUrlFilter v4.0.4!

Please see the CHANGELOG for more information.

AGTree v4.0.4

We are happy to announce the release of AGTree v4.0.4!

Please see the CHANGELOG for more information.

TSWebExtension v4.0.3

We are happy to announce the release of TSWebExtension v4.0.3!

Please see the CHANGELOG for more information.

TSUrlFilter v4.0.3

We are happy to announce the release of TSUrlFilter v4.0.3!

Please see the CHANGELOG for more information.

AGTree v4.0.3

We are happy to announce the release of AGTree v4.0.3!

Please see the CHANGELOG for more information.

TSUrlFilter v4.0.2

We are happy to announce the release of TSUrlFilter v4.0.2!

Please see the CHANGELOG for more information.

TSWebExtension v4.0.2

We are happy to announce the release of TSWebExtension v4.0.2!

Please see the CHANGELOG for more information.

AGTree v4.0.2

We are happy to announce the release of AGTree v4.0.2!

Please see the CHANGELOG for more information.

Changelog

Sourced from @adguard/agtree's changelog.

4.0.4 - 2026-03-26

Fixed

Conversion of HTML filtering rule where [tag-content] value contains an escaped double quotes ".

4.0.3 - 2026-03-24

Fixed

Combine min-length and max-length into single regexp during HTML filtering rule conversion #187.

#187: AdguardTeam/tsurlfilter#187

4.0.2 - 2026-03-17

Fixed

Parsing of pseudo-class selectors containing attribute selectors, e.g., :not([class]).

Commits

c98dba5 AG-52411 fix conversion of tag-content with escaped double quotes
5018999 skipci: Automatic increment build number for AGTree
3f978ac combine min and max length attr values into single regexp. #187
17d92a1 AG-51186 Fix parsing of pseudo-class selectors with attribute selectors
1a5f0e6 AG-51979: prepare needed md documents for work with LLMs
f58f0cb AG-51914 Improve ESLint config for AGTree
8f44460 AG-51485: remove obsoleted code in tsweb and agtree after upgrade to AGTree v4
6d94efb AG-51148 update scriptlets to v2.2.16, prepare lib releases
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [@adguard/agtree](https://github.com/AdguardTeam/tsurlfilter/tree/HEAD/packages/agtree) from 4.0.1 to 4.0.4. - [Release notes](https://github.com/AdguardTeam/tsurlfilter/releases) - [Changelog](https://github.com/AdguardTeam/tsurlfilter/blob/master/packages/agtree/CHANGELOG.md) - [Commits](https://github.com/AdguardTeam/tsurlfilter/commits/agtree-v4.0.4/packages/agtree) --- updated-dependencies: - dependency-name: "@adguard/agtree" dependency-version: 4.0.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

socket-security · 2026-03-30T14:19:19Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
@sentry/cloudflare@10.43.0
angular-eslint@21.3.0
@vitest/coverage-v8@4.1.0
@adguard/agtree@4.0.1 ⏵ 4.0.4	⁺¹	⁺¹	⁺⁴
@prisma/client@7.5.0
better-auth@1.5.6
@neondatabase/serverless@0.10.4
eslint@10.0.3
cloudflare@5.2.0
@sentry/cli@3.3.3
@trpc/client@11.15.1
@sentry/angular@10.43.0
@prisma/adapter-d1@7.5.0
@trpc/server@11.15.1
@tailwindcss/postcss@4.2.1
agents@0.8.1
@playwright/test@1.58.2

View full report

socket-security · 2026-03-30T14:19:21Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `@react-native/debugger-frontend` is 96.0% likely obfuscated Confidence: 0.96 Location: Package overview From: pnpm-lock.yaml → `npm/@react-native/debugger-frontend@0.84.1` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@react-native/debugger-frontend@0.84.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `@sentry/cli` under LicenseRef-FSL-1.1-MIT License: LicenseRef-FSL-1.1-MIT - the applicable license policy does not allow this license (4) (package/LICENSE) From: frontend/package.json → `npm/@sentry/cli@3.3.3` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@sentry/cli@3.3.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `@zxcvbn-ts/language-common` is 91.0% likely obfuscated Confidence: 0.91 Location: Package overview From: pnpm-lock.yaml → `npm/@clerk/clerk-js@6.3.0` → `npm/@zxcvbn-ts/language-common@3.0.4` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@zxcvbn-ts/language-common@3.0.4`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `@zxcvbn-ts/language-common` is 95.0% likely obfuscated Confidence: 0.95 Location: Package overview From: pnpm-lock.yaml → `npm/@clerk/clerk-js@6.3.0` → `npm/@zxcvbn-ts/language-common@3.0.4` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@zxcvbn-ts/language-common@3.0.4`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Copilot

Pull request overview

Updates the project’s npm/pnpm dependency graph to use @adguard/agtree v4.0.4 (from v4.0.1), bringing in upstream fixes in HTML filtering rule conversion and selector parsing.

Changes:

Bump @adguard/agtree from ^4.0.1 → ^4.0.4 in package.json.
Regenerate pnpm-lock.yaml to reflect the new resolved version and updated transitive dependencies.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
package.json	Updates the direct dependency version for `@adguard/agtree`.
pnpm-lock.yaml	Updates lockfile entries for `@adguard/agtree@4.0.4` and related transitive dependency resolutions.

Files not reviewed (1)

pnpm-lock.yaml: Language not supported

Copilot · 2026-03-31T14:25:27Z

package.json

    "_syncNote": "Dependency versions here must match those pinned in deno.json's import map; keep them in sync (for example via the existing version:sync-style task).",
    "dependencies": {
-        "@adguard/agtree": "^4.0.1",
+        "@adguard/agtree": "^4.0.4",


The root dependency was bumped to @adguard/agtree ^4.0.4 here, but deno.json’s import map still pins "@adguard/agtree": "npm:@adguard/agtree@^4.0.1" (deno.json:100). That means Deno-based builds/tests will continue using 4.0.1, so this PR doesn’t fully apply the bump; please update the import map to ^4.0.4 (and any version-tracking docs like DEPENDENCIES.md if applicable).

Suggested change

"@adguard/agtree": "^4.0.4",

"@adguard/agtree": "^4.0.1",

dependabot bot added the dependencies External packages and dependencies label Mar 30, 2026

jaypatrick requested a review from Copilot March 31, 2026 14:22

Copilot started reviewing on behalf of jaypatrick March 31, 2026 14:23 View session

Copilot AI reviewed Mar 31, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump @adguard/agtree from 4.0.1 to 4.0.4#1451

chore(deps): bump @adguard/agtree from 4.0.1 to 4.0.4#1451
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/adguard/agtree-4.0.4

dependabot bot commented on behalf of github Mar 30, 2026

Uh oh!

socket-security bot commented Mar 30, 2026

Uh oh!

socket-security bot commented Mar 30, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot bot commented on behalf of github Mar 30, 2026

TSWebExtension v4.0.4

TSUrlFilter v4.0.4

AGTree v4.0.4

TSWebExtension v4.0.3

TSUrlFilter v4.0.3

AGTree v4.0.3

TSUrlFilter v4.0.2

TSWebExtension v4.0.2

AGTree v4.0.2

4.0.4 - 2026-03-26

Fixed

4.0.3 - 2026-03-24

Fixed

4.0.2 - 2026-03-17

Fixed

Uh oh!

socket-security bot commented Mar 30, 2026

Uh oh!

socket-security bot commented Mar 30, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant