Bump the security-updates group across 1 directory with 5 updates by dependabot[bot] · Pull Request #179 · qdrant/qdrant-js

dependabot · 2026-10-21T07:31:45Z

Bumps the security-updates group with 5 updates in the / directory:

Package	From	To
undici	`7.29.0`	`7.29.1`
@vitest/mocker	`4.1.9`	`5.0.5`
nanoid	`3.3.15`	`3.3.20`
postcss	`8.5.16`	`8.5.31`
source-map-js	`1.2.1`	`1.2.2`

Updates undici from 7.29.0 to 7.29.1

Release notes

Sourced from undici's releases.

v7.29.1

⚠️ Security fixes

High severity

GHSA-w293-vg96-wgc3: BalancedPool could drop function-valued connection options while cloning its configuration, including custom TLS certificate validation callbacks. Undici now preserves connect and legacy tls options when creating upstreams. Fixed by f690157d.

GHSA-rfgv-xxqx-mfg5: a WebSocket server could select a subprotocol when none was requested, causing an uncaught TypeError that could terminate the process. Undici now rejects the handshake with protocol error 1002. Fixed by 6615e017.

Medium severity

GHSA-3wwx-pv8p-q78v: a malformed permessage-deflate payload exceeding the configured decompression limit could emit an unhandled zlib error and terminate the process. Undici now destroys the inflater after reaching the limit. Fixed by 63cf698b.

GHSA-rx4f-c7p8-82vq: an unclean WebSocketStream close could create an unobserved rejected promise when its writable stream was locked, potentially terminating the process. Undici now propagates the failure through the retained writable stream controller. Fixed by 1858656e.

GHSA-2jfj-6hjv-fm6j: shared caches could store and replay responses containing Set-Cookie, disclosing one user's cookies to another caller. Undici now excludes these responses from shared caches, including existing entries and revalidation paths. Fixed by b6c5a002.

GHSA-3xpg-4rpp-hhhm: the decompression interceptor did not bound decoded output, allowing compressed responses to consume excessive memory. Undici now limits every decompression stage to 64 MiB by default and supports a configurable maxSize. Fixed by 2c7d7e12.

GHSA-pmjh-fq2x-6v4x: a terminal retry failure after response headers were exposed could orphan the original response body, causing consumers to hang indefinitely. Undici now propagates the terminal error to the exposed body. Fixed by 3c672659.

Low severity

GHSA-8436-99hf-9mmv: cache interceptors could store and replay responses to unsafe HTTP methods such as POST or DELETE. Undici now restricts cache reads and writes to safe methods while preserving invalidation by successful unsafe requests. Fixed by b61d9432.

GHSA-2gqq-gqf2-x968: the dump interceptor could treat an oversized chunked response as successfully truncated when no Content-Length was present. Undici now enforces maxSize against received bytes and aborts oversized responses. Fixed by 21693f40.

GHSA-r53p-7pc4-xj5r: the retry interceptor could concatenate a resumed response with inconsistent framing into downstream output, enabling response splitting or corruption. Undici now validates Content-Range against the original response framing before resuming. Fixed by cd8af90b.

What's Changed

[v7.x] drop: remove Node.js 26 from shared-builtin CI build by @mcollina in nodejs/undici#5592

fix(h2): honour headersTimeout by @mcollina in nodejs/undici#5604

fix(h2): keep the connection ref'd while requests are outstanding by @mcollina in nodejs/undici#5605

ci: increase Windows workflow timeout on v7.x by @mcollina in nodejs/undici#5621

fix(h2): retire the request that completed, not the head of the queue by @mcollina in nodejs/undici#5618

fix(h2): settle a request whose stream is cancelled by @mcollina in nodejs/undici#5607

perf: reduce EventSourceStream parser allocations (#5032) by @mcollina in nodejs/undici#5646

fix(h2): handle GOAWAY for CONNECT streams by @mcollina in nodejs/undici#5640

[v7.x] perf(h1): drop idle-socket timer floor with a ref'd setImmediate (#5707) by @mcollina in nodejs/undici#5769

Full Changelog: nodejs/undici@v7.29.0...v7.29.1

Commits

d39a83e Bumped v7.29.1 (#5772)
0d88464 fix(test): remove unused EventEmitter import
f57411b perf(h1): drop idle-socket timer floor with a ref'd setImmediate (#5707) (#5769)
3c67265 fix(retry): settle exposed body on terminal failure
cd8af90 fix(retry): validate resumed response framing
6615e01 fix(websocket): reject unrequested subprotocols
2c7d7e1 fix(decompress): limit decompressed response size
b6c5a00 fix(cache): do not cache Set-Cookie in shared caches
21693f4 fix(interceptor/dump): abort oversized chunked responses
f690157 fix: preserve BalancedPool connection options
Additional commits viewable in compare view

Updates @vitest/mocker from 4.1.9 to 5.0.5

Release notes

Sourced from @vitest/mocker's releases.

v5.0.5

   🐞 Bug Fixes

Keep vite default fs.deny with api token file - by @hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11578 (28dc1)

Handle quoted file names in --changed - by @sheremet-va in vitest-dev/vitest#11583 (14921)

Add data to the import.meta.hot stub - by @sheremet-va in vitest-dev/vitest#11590 (3a828)

Set skip in skipIf, ignore undefined options - by @sheremet-va in vitest-dev/vitest#11591 (d523a)

Skip builtin loading in async leak detector - by @sheremet-va in vitest-dev/vitest#11598 (fe86a)

Keep the import frame in native loader errors - by @sheremet-va in vitest-dev/vitest#11599 (9697b)

Run hook cleanups when a later hook fails - by @sheremet-va in vitest-dev/vitest#11605 (6c5a4)

Release mocks of finished test files - by @sheremet-va in vitest-dev/vitest#11607 (e9c3d)

Abort all running tests on cancel - by @sheremet-va in vitest-dev/vitest#11606 (6621a)

browser:

Ignore synthetic pagehide events - by @sheremet-va in vitest-dev/vitest#11582 (ca081)

Run plugin buildStart on server creation - by @sheremet-va in vitest-dev/vitest#11593 (ea611)

Drop late connections of closed sessions - by @sheremet-va in vitest-dev/vitest#11600 (f161e)

Wait 30s for the browser to close - by @sheremet-va in vitest-dev/vitest#11601 (6498b)

Run global setup once with instances - by @sheremet-va in vitest-dev/vitest#11596 (8dd67)

reporter:

End reason &[#39](https://github.com/vitest-dev/vitest/tree/HEAD/packages/mocker/issues/39);failed&[#39](https://github.com/vitest-dev/vitest/tree/HEAD/packages/mocker/issues/39); on worker crash - by @AriPerkkio in vitest-dev/vitest#11568 (6ae8e)

    View changes on GitHub

v5.0.4

   🚀 Features

experimental:

Tag cache directories with CACHEDIR.TAG - by @lifeiscontent in vitest-dev/vitest#11461 (a8ea3)

Support test.ui.theme option - by @sheremet-va in vitest-dev/vitest#11499 (1da66)

Highlight selector multiple matches in trace view - by @hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11489 (5abba)

Print how many tests were affected and a total when running --changed - by @sheremet-va in vitest-dev/vitest#11424 (a2336)

Add an option to cache dependencies instead of statically parsing them - by @sheremet-va in vitest-dev/vitest#11515 (c0601)

Add fit and zoom controls to trace viewer - by @hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11490 (f5dd9)

   🐞 Bug Fixes

Fail the run on git and location filter errors - by @sheremet-va in vitest-dev/vitest#11430 (30d03)

Enable fsModuleCache by default - by @sheremet-va in vitest-dev/vitest#11435 (ad208)

Track project files and mocks with --changed - by @sheremet-va in vitest-dev/vitest#11432 (b0f2b)

Refactor caching, fix : in project and change the shape of results cache - by @sheremet-va in vitest-dev/vitest#11453 (9673c)

Keep full $ string values when taskTitleValueFormatTruncate is 0 - by @hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11485 (4f7e1)

Resolve node builtins in client environments - by @sheremet-va in vitest-dev/vitest#11417 (56b31)

Fix module graph builtin externals after #11421 - by @hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11491 and vitest-dev/vitest#11421 (008e1)

Wrap module mocks during in-source testing - by @sheremet-va in vitest-dev/vitest#11505 (36d19)

Handle line endings in snapshot - by @sheremet-va in vitest-dev/vitest#11522 (4c468)

Respect root in projects - by @sheremet-va in vitest-dev/vitest#11521 (26642)

Resolve mocks in directories with spaces - by @sheremet-va in vitest-dev/vitest#11539 (caaef)

api:

Publish the api token atomically - by @umairnawaz333 in vitest-dev/vitest#11323 (6f990)

browser:

... (truncated)

Commits

7a825db chore: release v5.0.5 (#11609)
6a11cf6 chore: release v5.0.4 (#11554)
58c86ed chore(deps): update all non-major dependencies (#11550)
5c95521 fix(browser): clean up unmocked and pending mocks (#11537)
cd423ba fix(mocker): fix native loader mocking edge cases (#11540)
36d19cb fix: wrap module mocks during in-source testing (#11505)
fe025b2 chore(deps): update dependency msw to v3 (#11482)
b0f2b3b fix: track project files and mocks with --changed (#11432)
33cadea chore: release v5.0.3 (#11409)
15cc006 fix: don't print an interceptor warning in browser mode (#11377)
Additional commits viewable in compare view

Updates nanoid from 3.3.15 to 3.3.20

Release notes

Sourced from nanoid's releases.

3.3.20

Fixed types (by @johnemau).

3.3.19

Fixed killing the app by setting huge user ID.

3.3.18

Fixed infinite loop on async for React Native (by @OvergrowthBeards-JB).

3.3.17

Fixed infinite loop on zero size.

3.3.16

Fixed infinite loop on negative size (by @greymoth-jp).

Changelog

Sourced from nanoid's changelog.

3.3.20

Fixed types (by @johnemau).

3.3.19

Fixed killing the app by setting huge user ID (by @geoffrey-diederichs).

3.3.18

Fixed infinite loop on async for React Native (by @OvergrowthBeards-JB).

3.3.17

Fixed infinite loop on zero size.

3.3.16

Fixed infinite loop on negative size (by @greymoth-jp).

Commits

d76f633 Release 3.3.20 version
ac09ff6 Fix: async return types are synchronous in v3 (#615)
eb63bd6 Release 3.3.19 version
9067e03 Sync CJS and ESM
9ad9805 Release 3.3.18 version
55e50a0 Update CI action
e10f8d4 Update index.native.js (#606)
73d6716 Release 3.3.17 version
f9d13f1 Sync 0 size behaviour with PostCSS 5
9760e11 Release 3.3.16 version
Additional commits viewable in compare view

Updates postcss from 8.5.16 to 8.5.31

Release notes

Sourced from postcss's releases.

8.5.31

Fix better source map on </style> escaping (by @firefoxic).

8.5.30

Fix broken map on </style> escaping (by @Rufflet).

8.5.29

Improved </style> escaping (by @choudhryfrompak).

Fixed comments support in list.comma() and list.space() (by @00200200).

Fixed semicolon and custom property (by @wahidrizka).

8.5.28

Fixes types regression.

8.5.27

Fixed removing any comments starting with /*# (by @dylanpulver).

Fixed * hack before a comment in Custom Properties (by @Jaybhade).

Fixed empty values in the middle of list.comma() (by @MahinAnowar).

Fixed whitespace-only values in list.space() (by @MahinAnowar).

Fixed rule’s end position on space before semicolon (by @maximilliangrand).

Fixed types (by @romainmenke).

Fixed Chinese text in deprecation warning (by @Jesse205).

8.5.26

Fixed list.split() regression (by @lazerg).

Track symlinks in path protection in source map loading (by @drengir1).

8.5.25

Fixed 8.5.17 visitor regression.

Fixed list.split() for non-string values (by @amir-rezaei).

8.5.24

Preserve the BOM after the processing (by @hdimer).

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.31

Fix better source map on </style> escaping (by @firefoxic).

8.5.30

Fix broken map on </style> escaping (by @Rufflet).

8.5.29

Improved </style> escaping (by @choudhryfrompak).

Fixed comments support in list.comma() and list.space() (by @00200200).

Fixed semicolon and custom property (by @wahidrizka).

8.5.28

Fixes types regression.

8.5.27

Fixed removing any comments starting with /*# (by @dylanpulver).

Fixed * hack before a comment in Custom Properties (by @Jaybhade).

Fixed empty values in the middle of list.comma() (by @MahinAnowar).

Fixed whitespace-only values in list.space() (by @MahinAnowar).

Fixed rule’s end position on space before semicolon (by @maximilliangrand).

Fixed types (by @romainmenke).

Fixed Chinese text in deprecation warning (by @Jesse205).

8.5.26

Fixed list.split() regression (by @lazerg).

Track symlinks in path protection in source map loading (by @drengir1).

8.5.25

Fixed 8.5.17 visitor regression.

Fixed list.split() for non-string values (by @amir-rezaei).

8.5.24

Preserve the BOM after the processing (by @hdimer).

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

... (truncated)

Commits

d190857 Release 8.5.31 version
4ef6d8c Update dependencies
6abd674 Call the builder with every node when the output is escaped (#2175)
f1aca7e Release 8.5.30 version
9d83445 Update dependencies
6c9bc73 Fix invalid source map mapping on escaping before new line (#2169)
1fd8f88 Add missed changes in changelog
a7a1f34 Release 8.5.29 version
b55a36d Update dependencies
7647a81 Escape </style> in output of non-Root nodes (#2163)
Additional commits viewable in compare view

Updates source-map-js from 1.2.1 to 1.2.2

Release notes

Sourced from source-map-js's releases.

v1.2.2

Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval (#29) @xfournet

Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)

Reported by @waydeshi in #76. A fix was also proposed by @aniebiet in #78.

Changelog

Sourced from source-map-js's changelog.

1.2.2

Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval (#29) @xfournet

Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)

Reported by @waydeshi in #76. A fix was also proposed by @aniebiet in #78.

Commits

0a1d334 1.2.2
4c6fa26 Update changelog
cf76580 Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)
7899a86 Fix crash when executing browser with CSP script-src that don't permit unsafe...
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the security-updates group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [undici](https://github.com/nodejs/undici) | `7.29.0` | `7.29.1` | | [@vitest/mocker](https://github.com/vitest-dev/vitest/tree/HEAD/packages/mocker) | `4.1.9` | `5.0.5` | | [nanoid](https://github.com/ai/nanoid) | `3.3.15` | `3.3.20` | | [postcss](https://github.com/postcss/postcss) | `8.5.16` | `8.5.31` | | [source-map-js](https://github.com/7rulnik/source-map-js) | `1.2.1` | `1.2.2` | Updates `undici` from 7.29.0 to 7.29.1 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.29.0...v7.29.1) Updates `@vitest/mocker` from 4.1.9 to 5.0.5 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/mocker) Updates `nanoid` from 3.3.15 to 3.3.20 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](ai/nanoid@3.3.15...3.3.20) Updates `postcss` from 8.5.16 to 8.5.31 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.16...8.5.31) Updates `source-map-js` from 1.2.1 to 1.2.2 - [Release notes](https://github.com/7rulnik/source-map-js/releases) - [Changelog](https://github.com/7rulnik/source-map-js/blob/main/CHANGELOG.md) - [Commits](7rulnik/source-map-js@v1.2.1...v1.2.2) --- updated-dependencies: - dependency-name: undici dependency-version: 7.29.1 dependency-type: direct:production dependency-group: security-updates - dependency-name: "@vitest/mocker" dependency-version: 5.0.5 dependency-type: indirect dependency-group: security-updates - dependency-name: nanoid dependency-version: 3.3.20 dependency-type: indirect dependency-group: security-updates - dependency-name: postcss dependency-version: 8.5.31 dependency-type: indirect dependency-group: security-updates - dependency-name: source-map-js dependency-version: 1.2.2 dependency-type: indirect dependency-group: security-updates ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-10-22T09:00:31Z

Looks like these dependencies are no longer updatable, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 21, 2026

dependabot Bot closed this Oct 22, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/security-updates-652e47aecc branch October 22, 2026 09:00

Navigation Menu

Repository navigation

Bump the security-updates group across 1 directory with 5 updates - #179

Bump the security-updates group across 1 directory with 5 updates#179
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/security-updates-652e47aecc

dependabot Bot commented on behalf of github Oct 21, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Oct 22, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v7.29.1

⚠️ Security fixes

High severity

Medium severity

Low severity

What's Changed

v5.0.5

🐞 Bug Fixes

View changes on GitHub

v5.0.4

🚀 Features

🐞 Bug Fixes

3.3.20

3.3.19

3.3.18

3.3.17

3.3.16

3.3.20

3.3.19

3.3.18

3.3.17

3.3.16

8.5.31

8.5.30

8.5.29

8.5.28

8.5.27

8.5.26

8.5.25

8.5.24

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.31

8.5.30

8.5.29

8.5.28

8.5.27

8.5.26

8.5.25

8.5.24

8.5.23

8.5.22

v1.2.2

1.2.2

Uh oh!

dependabot Bot commented on behalf of github Oct 22, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Oct 21, 2026 •

edited

Loading