chore(deps): bump the npm_and_yarn group across 1 directory with 10 updates by dependabot[bot] · Pull Request #727 · launchdarkly/ldcli

dependabot · 2026-06-28T22:21:54Z

Bumps the npm_and_yarn group with 10 updates in the /internal/dev_server/ui directory:

Package	From	To
lodash	`4.17.23`	`4.18.1`
react-router	`7.12.0`	`7.15.1`
vite	`6.4.1`	`8.1.0`
vitest	`2.1.9`	`4.1.9`
dompurify	`3.2.4`	`3.4.11`
flatted	`3.3.1`	`3.4.2`
form-data	`4.0.4`	`4.0.6`
js-yaml	`4.1.1`	`4.3.0`
uuid	`8.3.2`	`removed`
ws	`8.18.0`	`8.21.0`

Updates lodash from 4.17.23 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

lodash: lodash/lodash@4.18.0-npm...4.18.1-npm

lodash-es: lodash/lodash@4.18.0-es...4.18.1-es

lodash-amd: lodash/lodash@4.18.0-amd...4.18.1-amd

lodash.templatelodash/lodash@4.18.0-npm-packages...4.18.1-npm-packages

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

Add security notice for _.template in threat model and API docs (#6099)

Document lower > upper behavior in _.random (#6115)

Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

lodash.orderby

lodash.tonumber

lodash.trim

lodash.trimend

lodash.sortedindexby

lodash.zipobjectdeep

lodash.unset

lodash.omit

lodash.template

Commits

cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
75535f5 chore: prune stale advisory refs (#6170)
62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
59be2de release(minor): bump to 4.18.0 (#6161)
af63457 fix: broken tests for _.template 879aaa9
1073a76 fix: linting issues
879aaa9 fix: validate imports keys in _.template
fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
b819080 ci: add dist sync validation workflow (#6137)
Additional commits viewable in compare view

Updates react-router from 7.12.0 to 7.15.1

Release notes

Sourced from react-router's releases.

v7.15.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7151

v7.15.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7150

v7.14.2

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7142

v7.14.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7141

v7.14.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7140

v7.13.2

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7132

v7.13.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7131

v7.13.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7130

Changelog

Sourced from react-router's changelog.

v7.15.1

Patch Changes

Update router to operate on fetcher Maps in an immutable manner to avoid delayed React renders from potentially reading an updated but not yet committed Map. This could result in brief flickers in some fetcher-driven optimistic UI scenarios. (#15028)

Fix serverLoader() returning stale SSR data when a client navigation aborts pending hydration before the hydration clientLoader resolves (#15022)

Fix RouterProvider onError callback not being called for synchronous initial loader errors in SPA mode (#15039) (#14942)

Memoize useFetchers to return a stable identity and only change if fetchers changed (#15028)

Internal refactor to consolidate mutation request detection through shared utility (#15033)

Unstable Changes

⚠️ Unstable features are not recommended for production use
Add a new unstable_useRouterState() hook that consolidates access to active and pending router states (RFC: #12358) (#15017)
Data/Framework/RSC only — throws when used without a data router
This should allow you to consolidate usages of the following hooks which will likely be deprecated and removed in a future major version

useLocation

useSearchParams

useParams

useMatches

useNavigationType

useNavigation
let { active, pending } = unstable_useRouterState();
// Active is always populated with the current location
active.location; // replaces useLocation()
active.searchParams; // replaces useSearchParams()[0]
active.params; // replaces useParams()
active.matches; // replaces useMatches()
active.type; // replaces useNavigationType()
// Pending is only populated during a navigation
pending.location; // replaces useNavigation().location
pending.searchParams; // equivalent to new URLSearchParams(useNavigation().search)
pending.params; // Not directly accessible today
pending.matches; // Not directly accessible today
pending.type; // Not directly accessible today
pending.state; // replaces useNavigation().state
pending.formMethod; // replaces useNavigation().formMethod
pending.formAction; // replaces useNavigation().formAction
pending.formEncType; // replaces useNavigation().formEncType
pending.formData; // replaces useNavigation().formData
pending.json; // replaces useNavigation().json
pending.text; // replaces useNavigation().text
v7.15.0

... (truncated)

Commits

587d08f Release v7.15.1 (#15038)
89996bd Fire onError for initial-load errors when RouterProvider mounts late (#15039)
4322e58 Update docs for useRouterState
fadd6c4 Merge branch 'main' into release
6bf91ce chore: format
44c3478 fix: prevent fetcher formData flicker and eliminate state.fetchers mutations ...
7e6725a Cleanup lint issues (#15030)
aabd30c Use shared isMutationMethod check (#15033)
954a4a6 Fix stale SSR data when hydration is aborted by a same-route navigation (#15022)
041cd32 fix(react-router): Internal preloads refactor to preserve types (#14860)
Additional commits viewable in compare view

Updates vite from 6.4.1 to 8.1.0

Release notes

Sourced from vite's releases.

create-vite@8.1.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.1.0

Please refer to CHANGELOG.md for details.

v8.1.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.1.0-beta.0

Please refer to CHANGELOG.md for details.

v8.1.0-beta.0

Please refer to CHANGELOG.md for details.

v8.0.16

Please refer to CHANGELOG.md for details.

v8.0.15

Please refer to CHANGELOG.md for details.

v8.0.14

Please refer to CHANGELOG.md for details.

v8.0.13

Please refer to CHANGELOG.md for details.

v8.0.12

Please refer to CHANGELOG.md for details.

v8.0.11

Please refer to CHANGELOG.md for details.

v8.0.10

Please refer to CHANGELOG.md for details.

v8.0.9

Please refer to CHANGELOG.md for details.

v8.0.8

Please refer to CHANGELOG.md for details.

v8.0.7

Please refer to CHANGELOG.md for details.

v8.0.6

Please refer to CHANGELOG.md for details.

v8.0.5

Please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from vite's changelog.

8.1.0 (2026-06-23)

Features

extend server.fs.deny list with common files (#22707) (61ba8fd)

update rolldown to 1.1.2 (#22695) (4f008a6)

use ~ for Rolldown (#22693) (9928722)

Bug Fixes

bundled-dev: errors should be kept when incremental build fails (#22617) (9a0dd48)

cache falsy values in perEnvironmentState (#22715) (0e91e79)

glob: respect caseSensitive option in hmr matcher (#22711) (65f525e)

html: omit nonce on import map when cspNonce is unset (#22713) (8340bb5)

optimizer: skip null-valued exports in expandGlobIds glob resolution (#22611) (8b9f5cd)

resolved build options should be kept as a getter (#22691) (3527191)

server: handle malformed URI in memory files middleware (#22714) (df9e0a5)

use literal envPrefix queries for Vite Task (#22706) (da72733)

warn on deprecated envFile (#22555) (ed7b283)

Code Refactoring

client: inline dev-id value in CSS selector (#22736) (57f59bc)

remove unused removeRawQuery util (#22724) (403cc60)

use rolldownOptions property for chunkImportMap (#22692) (8e8816c)

8.1.0-beta.0 (2026-06-15)

Features

import.meta.glob support caseSensitive option (#21707) (2ad6737)

add warning to discourage Vite with yarn pnp (#21906) (3fbb55a)

build: chunk importmap (#21580) (e180312)

css: support lightningcss plugin dependency (#21748) (0b7aaed)

deps: bump @vitejs/devtools peer dependency version (#22542) (d2c2bc0)

html: add html.additionalAssetSources option (#21412) (a41404b)

integrate with Vite Task for zero-config build caching (#22453) (f8d75f7)

rename server.hmr options to server.ws options (#21357) (9ce3036)

server: support multiple hosts in __VITE_ADDITIONAL_SERVER_ALLOWED_HOSTS (#21501) (735f9a1)

track dependencies when loading config with native (#22602) (a7e2da8)

types: add more precise typing for known query types to match known as types (#21863) (cc39e55)

update rolldown to 1.1.1 (#22593) (8a13d63)

wasm: direct .wasm imports (WASM ESM Integration) (#21779) (c23d85b)

Bug Fixes

apply correct fs restrictions for pnpm gvs (#22415) (092320b)

css: support external CSS with lightningcss (#18389) (d64a1a5)

deps: update all non-major dependencies (#22637) (44bb9d9)

deps: update all non-major dependencies (#22681) (f4f0633)

html: insert import map before modulepreload that is not self-close tag (#21409) (e399c89)

optimizer: preserve sourcemaps for transformed optimized deps with follow-up transforms (#22428) (1298951)

... (truncated)

Commits

5909efd fix: allow multiple bindCLIShortcuts calls with shortcut merging (#21103)
39a0a15 chore(deps): update rolldown-related dependencies (#21095)
6a34ac3 fix(deps): update all non-major dependencies (#21096)
02ceaec chore(deps): update dependency @rollup/plugin-commonjs to v29 (#21099)
572aaca release: v7.2.2
728c8ee fix: revert "refactor: use fs.cpSync (#21019)" (#21081)
a532e68 release: v7.2.1
82d2d6c fix(worker): some worker asset was missing (#21074)
f83264f refactor(build): rename indexOfMatchInSlice to findPreloadMarker (#21054)
8293de0 release: v7.2.0
Additional commits viewable in compare view

Updates vitest from 2.1.9 to 4.1.9

Release notes

Sourced from vitest's releases.

v4.1.9

🐞 Bug Fixes

Fix importOriginal with optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in vitest-dev/vitest#10546 (a5180)

browser:

Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10555 (7fb29)

Wait for iframe tester readiness before preparing [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10497 and vitest-dev/vitest#10556 (fbc62)

mocker:

Hoist vi.mock() for vite-plus/test imports [backport to v4] - by Hiroshi Ogawa, LongYinan, Claude Opus 4.8 and Vladimir in vitest-dev/vitest#10548 (2c955)

pool:

Prevent test run hang on worker crash [backport to v4] - by Ari Perkkiö and Jattioui Ismail in vitest-dev/vitest#10543 and vitest-dev/vitest#10564 (934b0)

View changes on GitHub

v4.1.8

   🐞 Bug Fixes

browser:

Disable client cdp API when allowWrite/allowExec: false [backport to v4] - by @hi-ogawa and Codex in vitest-dev/vitest#10450 (e4067)

Remove orphaned Playwright route when same module is mocked via multiple ids [backport to v4] - by @toxik and @Zelys-DFKH in vitest-dev/vitest#10474 (675b4)

    View changes on GitHub

v4.1.7

   🐞 Bug Fixes

runner: Limit concurrency per task branch in addition to per leaf callbacks (backport) - by @hi-ogawa in vitest-dev/vitest#10384 (4f0f2)

    View changes on GitHub

v4.1.6

   🐞 Bug Fixes

browser: Provide project reference in ToMatchScreenshotResolvePath - by @macarie and @sheremet-va in vitest-dev/vitest#10138 (31882)

Global sequence.concurrent: true with top-level test(..., { concurrent: false }) + depreacte sequential test API and options - by @hi-ogawa, Codex and @sheremet-va in vitest-dev/vitest#10196 (2847d)

browser: Simplify orchestrator otel carrier - by @hi-ogawa in vitest-dev/vitest#10285 (18af9)

   🏎 Performance

Stringify diff objects only once - by @sheremet-va in vitest-dev/vitest#10276 (9f7b1)

    View changes on GitHub

v4.1.5

   🚀 Experimental Features

coverage: Istanbul to support instrumenter option - by @BartWaardenburg and @AriPerkkio in vitest-dev/vitest#10119 (0e0ff)

   🐞 Bug Fixes

... (truncated)

Commits

a7a61e7 chore: release v4.1.9 (#10598)
934b0f5 fix(pool): prevent test run hang on worker crash (#10543) [backport to v4] (#...
7fb2965 fix(browser): wait for orchestrator readiness before resolving browser sessio...
a518019 fix: fix importOriginal with optimizer and query import [backport to v4] (#...
e61f2dd chore: release v4.1.8
e4067b3 fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
a09d472 chore: release v4.1.7
a8fd24c chore: release v4.1.6
18af98c fix(browser): simplify orchestrator otel carrier (#10285)
3188260 feat(browser): provide project reference in ToMatchScreenshotResolvePath (#...
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for vitest since your current version.

Updates vitest from 2.1.9 to 4.1.9

Release notes

Sourced from vitest's releases.

v4.1.9

🐞 Bug Fixes

Fix importOriginal with optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in vitest-dev/vitest#10546 (a5180)

browser:

Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10555 (7fb29)

Wait for iframe tester readiness before preparing [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10497 and vitest-dev/vitest#10556 (fbc62)

mocker:

Hoist vi.mock() for vite-plus/test imports [backport to v4] - by Hiroshi Ogawa, LongYinan, Claude Opus 4.8 and Vladimir in vitest-dev/vitest#10548 (2c955)

pool:

Prevent test run hang on worker crash [backport to v4] - by Ari Perkkiö and Jattioui Ismail in vitest-dev/vitest#10543 and vitest-dev/vitest#10564 (934b0)

View changes on GitHub

v4.1.8

   🐞 Bug Fixes

browser:

Disable client cdp API when allowWrite/allowExec: false [backport to v4] - by @hi-ogawa and Codex in vitest-dev/vitest#10450 (e4067)

Remove orphaned Playwright route when same module is mocked via multiple ids [backport to v4] - by @toxik and @Zelys-DFKH in vitest-dev/vitest#10474 (675b4)

    View changes on GitHub

v4.1.7

   🐞 Bug Fixes

runner: Limit concurrency per task branch in addition to per leaf callbacks (backport) - by @hi-ogawa in vitest-dev/vitest#10384 (4f0f2)

    View changes on GitHub

v4.1.6

   🐞 Bug Fixes

browser: Provide project reference in ToMatchScreenshotResolvePath - by @macarie and @sheremet-va in vitest-dev/vitest#10138 (31882)

Global sequence.concurrent: true with top-level test(..., { concurrent: false }) + depreacte sequential test API and options - by @hi-ogawa, Codex and @sheremet-va in vitest-dev/vitest#10196 (2847d)

browser: Simplify orchestrator otel carrier - by @hi-ogawa in vitest-dev/vitest#10285 (18af9)

   🏎 Performance

Stringify diff objects only once - by @sheremet-va in vitest-dev/vitest#10276 (9f7b1)

    View changes on GitHub

v4.1.5

   🚀 Experimental Features

coverage: Istanbul to support instrumenter option - by @BartWaardenburg and @AriPerkkio in vitest-dev/vitest#10119 (0e0ff)

   🐞 Bug Fixes

... (truncated)

Commits

a7a61e7 chore: release v4.1.9 (#10598)
934b0f5 fix(pool): prevent test run hang on worker crash (#10543) [backport to v4] (#...
7fb2965 fix(browser): wait for orchestrator readiness before resolving browser sessio...
a518019 fix: fix importOriginal with optimizer and query import [backport to v4] (#...
e61f2dd chore: release v4.1.8
e4067b3 fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
a09d472 chore: release v4.1.7
a8fd24c chore: release v4.1.6
18af98c fix(browser): simplify orchestrator otel carrier (#10285)
3188260 feat(browser): provide project reference in ToMatchScreenshotResolvePath (#...
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for vitest since your current version.

Updates dompurify from 3.2.4 to 3.4.11

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.11

Fixed an issue with a leaky config for hooks via setConfig, thanks @trace37labs

Bumped vulnerable development dependencies to arrive at plain 0 with npm audit

Updated the osv-scanner suppression list as no vulnerable dependencies are left for now

Updated up the linting tool-chain and removed now-redundant lint directives

Updated the documentation is several spots, README, wiki, etc.

Bumped several dependencies where possible

DOMPurify 3.4.10

Refactored codebase for clarity: extracted the public type declarations into types.ts

Decomposed the three largest sanitizer functions into focused helpers

Removed duplicated defaults and dead branches, consolidated SAFE_FOR_TEMPLATES scrubbing into single shared path

Improved per-node performance by hoisting the mXSS probe regexes and testing textContent before innerHTML

Added a deterministic micro-benchmark harness (npm run bench) with a --compare mode

Reduced CI cost by running the full three-engine browser suite once per PR

Refreshed the demos/ folder so every demo runs again, and added a SVG-via-<img> demo

Documented the bench and test:happydom scripts in the README

Completed the Attack Classes & Bypass History wiki page

Bumped several dependencies where possible

DOMPurify 3.4.9

Further improved the handling of Trusted Types config options, thanks @offset

Further improved the handling of IN_PLACE sanitization, thanks @mozfreddyb

Added more test coverage for IN_PLACE and Trusted Types related usage

Bumped several dependencies where possible

Updated README and wiki with more accurate documentation & attack samples

DOMPurify 3.4.8

Cleaned up the repository root, renamed some and removed unneeded files

Fixed an issue with handling of Trusted Types policies, thanks @fulstadev

Fixed the node iterator for better template scrubbing, thanks @IamLeandrooooo

Included formerly missing LICENSE-MPL in published npm package, thanks @asamuzaK

Bumped several dependencies where possible

DOMPurify 3.4.7

Hardened the handling of Shadow Roots when using IN_PLACE, thanks @GameZoneHacker

Removed a problem leading to permanent hook pollution, thanks @offset

Refactored the test suite and expanded test coverage significantly

DOMPurify 3.4.6

Fixed several issues with DOM Clobbering in IN_PLACE mode, thanks @offset & @Bankde

Hardened the checks for cross-realm IN_PLACE and Shadow DOM sanitization, thanks @offset & @Bankde

Added more test coverage for IN_PLACE and general DOM Clobbering attacks

Bumped several dependencies where possible

DOMPurify 3.4.5

Fixed a bypass caused by the new HTML element selectedcontent added in 3.4.4, thanks @KabirAcharya

Note that this is a security release for an issue introduced in 3.4.4 and should be upgraded to immediately.

... (truncated)

Commits

0cae518 release: 3.4.11 (#1494)
6ee5716 release: 3.4.10 (#1478)
5210247 release: 3.4.9 (#1459)
bcdd828 release: 3.4.8 (#1439)
ca30f07 release: 3.4.7 (#1414)
bb7739e release: 3.4.6 (#1394)
011b0c7 release: 3.4.5 (#1382)
5817ad9 release: 3.4.4 (#1374)
520edb0 release: 3.4.3 (#1352)
6f67fd3 Sync/3.4.2 (#1322)
Additional commits viewable in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates flatted from 3.3.1 to 3.4.2

Commits

3bf0909 3.4.2
885ddcc fix CWE-1321
0bdba70 added flatted-view to the benchmark
2a02dce 3.4.1
fba4e8f Merge pull request #89 from WebReflection/python-fix
5fe8648 added "when in Rome" also a test for PHP
53517ad some minor improvement
b3e2a0c Fixing recursion issue in Python too
c4b46db Add SECURITY.md for security policy and reporting
f86d071 Create dependabot.yml for version updates
Additional commits viewable in compare view

Updates form-data from 4.0.4 to 4.0.6

Changelog

Sourced from form-data's changelog.

v4.0.6 - 2026-06-12

Commits

[Fix] escape CR, LF, and " in field names and filenames 8dff42c

[Dev Deps] update @ljharb/eslint-config, auto-changelog, tape f31d21e

[Deps] update hasown, mime-types 92ae0eb

[Dev Deps] update js-randomness-predictor 67b0f65

v4.0.5 - 2025-11-17

Commits

[Tests] Switch to newer v8 prediction library; enable node 24 testing 16e0076

[Dev Deps] update @ljharb/eslint-config, eslint 5822467

[Fix] set Symbol.toStringTag in the proper place 76d0dee

Commits

64190db v4.0.6
92ae0eb [Deps] update hasown, mime-types
f31d21e [Dev Deps] update @ljharb/eslint-config, auto-changelog, tape
8dff42c [Fix] escape CR, LF, and " in field names and filenames
67b0f65 [Dev Deps] update js-randomness-predictor
68ff7dd v4.0.5
5822467 [Dev Deps] update @ljharb/eslint-config, eslint
76d0dee [Fix] set Symbol.toStringTag in the proper place
16e0076 [Tests] Switch to newer v8 prediction library; enable node 24 testing
See full diff in compare view

Updates js-yaml from 4.1.1 to 4.3.0

Changelog

Sourced from js-yaml's changelog.

4.3.0 - 2026-06-27

Added

[backport] Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.

Fixed

Restore umd builds back to es5.

Removed

[backport] maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

[4.2.0] - 2026-06-01

Added

Added docs/safety.md with notes about processing untrusted YAML.

Added maxDepth (100) loader option. Not a problem, but gives a better exception instead of RangeError on stack overflow.

Added maxMergeSeqLength (20) loader option. Not a problem after merge fix, but an additional restriction for safety.

Added sourcemaps to dist/ builds.

Changed

Stop resolving numbers with underscores as numeric scalars, #627.

Switched dev toolchains to Vite / neostandard.

Updated demo.

Reorganized tests.

dist/ files are no longer kept in the repository.

Fixed

Fix parsing of properties on the first implicit blo...
Description has been truncated

[!NOTE]
Medium Risk
Major Vite and Vitest upgrades change the build and test toolchain for the embedded dev-server UI; lodash and transitive security bumps are low risk to app logic but need CI verification.

Overview
Updates only internal/dev_server/ui/package.json and its lockfile—no application source changes.

Runtime deps: lodash 4.17.23 → 4.18.1 (prototype-pollution and _.template injection fixes), react-router 7.12.0 → 7.15.1, and launchdarkly-js-client-sdk 3.4.0 → 3.9.3 (with launchdarkly-js-sdk-common 5.3.0 → 5.8.1; uuid no longer pulled by the common package).

Tooling (major jumps): vite 6.4.1 → 8.1.0 (Rolldown-based bundler, stricter Node ^20.19.0 || ≥22.12.0), vitest 2.1.9 → 4.1.9, and @vitejs/plugin-react 4.5.0 → 6.0.3, plus vite-plugin-singlefile 2.2.0 → 2.3.3. The lockfile reflects a large transitive refresh (e.g. Rollup/esbuild trees replaced by @rolldown/*, updated chai/Vitest 4 stack, lightningcss, dompurify, ws).

Reviewers should confirm npm run build and npm run test still pass on a supported Node version for this UI package.

^{Reviewed by Cursor Bugbot for commit ee2e20e. Bugbot is set up for automated code reviews on this repo. Configure here.}

…pdates Bumps the npm_and_yarn group with 10 updates in the /internal/dev_server/ui directory: | Package | From | To | | --- | --- | --- | | [lodash](https://github.com/lodash/lodash) | `4.17.23` | `4.18.1` | | [react-router](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router) | `7.12.0` | `7.15.1` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `6.4.1` | `8.1.0` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `2.1.9` | `4.1.9` | | [dompurify](https://github.com/cure53/DOMPurify) | `3.2.4` | `3.4.11` | | [flatted](https://github.com/WebReflection/flatted) | `3.3.1` | `3.4.2` | | [form-data](https://github.com/form-data/form-data) | `4.0.4` | `4.0.6` | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.1` | `4.3.0` | | [uuid](https://github.com/uuidjs/uuid) | `8.3.2` | `removed` | | [ws](https://github.com/websockets/ws) | `8.18.0` | `8.21.0` | Updates `lodash` from 4.17.23 to 4.18.1 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.23...4.18.1) Updates `react-router` from 7.12.0 to 7.15.1 - [Release notes](https://github.com/remix-run/react-router/releases) - [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router/CHANGELOG.md) - [Commits](https://github.com/remix-run/react-router/commits/react-router@7.15.1/packages/react-router) Updates `vite` from 6.4.1 to 8.1.0 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/create-vite@8.1.0/packages/vite) Updates `vitest` from 2.1.9 to 4.1.9 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.9/packages/vitest) Updates `vitest` from 2.1.9 to 4.1.9 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.9/packages/vitest) Updates `dompurify` from 3.2.4 to 3.4.11 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.2.4...3.4.11) Updates `flatted` from 3.3.1 to 3.4.2 - [Commits](WebReflection/flatted@v3.3.1...v3.4.2) Updates `form-data` from 4.0.4 to 4.0.6 - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v4.0.4...v4.0.6) Updates `js-yaml` from 4.1.1 to 4.3.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.0/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.1...4.3.0) Removes `uuid` Updates `ws` from 8.18.0 to 8.21.0 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.18.0...8.21.0) --- updated-dependencies: - dependency-name: lodash dependency-version: 4.18.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: react-router dependency-version: 7.15.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 8.1.0 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: vitest dependency-version: 4.1.9 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: vitest dependency-version: 4.1.9 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: dompurify dependency-version: 3.4.11 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: flatted dependency-version: 3.4.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: form-data dependency-version: 4.0.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.3.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: uuid dependency-version: dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 8.21.0 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

cursor

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit ee2e20e. Configure here.}

cursor · 2026-06-28T22:23:24Z

    "react": "18.3.1",
    "react-dom": "18.3.1",
-    "react-router": "7.12.0",
+    "react-router": "7.15.1",


Embedded dist stale after bump

High Severity

This PR bumps runtime dependencies in package.json but does not rebuild or commit dist, which is what the Go dev server embeds and serves. The checked-in bundle still ships lodash 4.17.23 and react-router 7.12.0, so security and behavior fixes from the bump never reach the UI users actually run.

^{Reviewed by Cursor Bugbot for commit ee2e20e. Configure here.}

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jun 28, 2026

dependabot Bot mentioned this pull request Jun 28, 2026

chore(deps): bump the npm_and_yarn group across 1 directory with 8 updates #713

Closed

cursor Bot reviewed Jun 28, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump the npm_and_yarn group across 1 directory with 10 updates#727

chore(deps): bump the npm_and_yarn group across 1 directory with 10 updates#727
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/internal/dev_server/ui/npm_and_yarn-83b7c939c8

dependabot Bot commented on behalf of github Jun 28, 2026 •

edited by cursor Bot

Loading

Uh oh!

cursor Bot left a comment

Uh oh!

cursor Bot Jun 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jun 28, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

4.18.1

Bugs

4.18.0

v4.18.0

Security

Docs

lodash.* modular packages

v7.15.1

v7.15.0

v7.14.2

v7.14.1

v7.14.0

v7.13.2

v7.13.1

v7.13.0

v7.15.1

Patch Changes

Unstable Changes

v7.15.0

create-vite@8.1.0

plugin-legacy@8.1.0

v8.1.0

plugin-legacy@8.1.0-beta.0

v8.1.0-beta.0

v8.0.16

v8.0.15

v8.0.14

v8.0.13

v8.0.12

v8.0.11

v8.0.10

v8.0.9

v8.0.8

v8.0.7

v8.0.6

v8.0.5

8.1.0 (2026-06-23)

Features

Bug Fixes

Code Refactoring

8.1.0-beta.0 (2026-06-15)

Features

Bug Fixes

v4.1.9

🐞 Bug Fixes

v4.1.8

🐞 Bug Fixes

v4.1.7

🐞 Bug Fixes

v4.1.6

🐞 Bug Fixes

🏎 Performance

v4.1.5

🚀 Experimental Features

🐞 Bug Fixes

v4.1.9

🐞 Bug Fixes

v4.1.8

🐞 Bug Fixes

v4.1.7

🐞 Bug Fixes

v4.1.6

🐞 Bug Fixes

🏎 Performance

v4.1.5

🚀 Experimental Features

🐞 Bug Fixes

DOMPurify 3.4.11

DOMPurify 3.4.10

DOMPurify 3.4.9

DOMPurify 3.4.8

DOMPurify 3.4.7

DOMPurify 3.4.6

DOMPurify 3.4.5

v4.0.6 - 2026-06-12

Commits

dependabot Bot commented on behalf of github Jun 28, 2026 •

edited by cursor Bot

Loading

`lodash.*` modular packages