Skip to content

Bump the npm-dependencies group across 1 directory with 3 updates - #2200

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-dependencies-ad85908878
Open

Bump the npm-dependencies group across 1 directory with 3 updates#2200
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-dependencies-ad85908878

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm-dependencies group with 3 updates in the / directory: puppeteer, rollup and undici.

Updates puppeteer from 25.14.0 to 25.15.0

Release notes

Sourced from puppeteer's releases.

puppeteer-core: v25.15.0

25.15.0 (2026-10-20)

🎉 Features

🛠️ Fixes

  • apply dynamic network restrictions to already-running service workers (#15602) (edb2fab)
  • core: stop in-page pollers created after WaitTask termination (#15557) (4c10b9d)
  • handle stop() rejection when page.record() fails to start (#15593) (ff3103c)
  • network: do not emit duplicate request on Fetch.requestPaused restart (#15416) (baed95c)
  • roll to Chrome 155.0.8059.84 (#15589) (2bf492b)
  • webdriver: handle continueWithAuth rejections (#15460) (10c43c1)

puppeteer: v25.15.0

25.15.0 (2026-10-20)

♻️ Chores

  • puppeteer: Synchronize puppeteer versions

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 25.14.0 to 25.15.0
Commits
  • 4a92051 chore: release main (#15588)
  • 389d74a docs: update examples and use casesRefine examples and use cases in documenta...
  • 43d7acf chore(deps-dev): bump the dev-dependencies group with 10 updates (#15597)
  • b30eb86 chore(deps): bump the all group with 5 updates (#15599)
  • 90fcc78 chore(deps): bump pixelmatch from 7.1.0 to 8.0.0 in the dependencies group (#...
  • 7ec8c99 chore(deps): bump @​docsearch/react from 5.1.1 to 5.1.2 in /website in the all...
  • edb2fab fix: apply dynamic network restrictions to already-running service workers (#...
  • 4c10b9d fix(core): stop in-page pollers created after WaitTask termination (#15557)
  • 9f15c77 feat: add page.tabInfo() (#15594)
  • baed95c fix(network): do not emit duplicate request on Fetch.requestPaused restart (#...
  • Additional commits viewable in compare view

Updates rollup from 4.64.7 to 4.64.12

Release notes

Sourced from rollup's releases.

v4.64.12

4.64.12

2026-10-20

Bug Fixes

  • Allow generating logs from transform hooks at position 0 (#6587)
  • Properly handle global or sticky regular expressions for file names (#6588)

Pull Requests

v4.64.10

4.64.10

2026-10-18

Bug Fixes

  • Avoid breaking lazy loading when a dynamic import only contains reexports from a manual chunk (#6583)
  • Ensure HTML entities in JSX are properly decoded in the output (#6584)

Pull Requests

v4.64.9

4.64.9

2026-10-17

Bug Fixes

  • Ensure export live-bindings are properly maintained for aliased exports (#6576)
  • Retain typed array constructor calls if the argument has iteration side effects (#6582)

Pull Requests

v4.64.8

4.64.8

2026-10-17

... (truncated)

Changelog

Sourced from rollup's changelog.

4.64.12

2026-10-20

Bug Fixes

  • Allow generating logs from transform hooks at position 0 (#6587)
  • Properly handle global or sticky regular expressions for file names (#6588)

Pull Requests

4.64.10

2026-10-18

Bug Fixes

  • Avoid breaking lazy loading when a dynamic import only contains reexports from a manual chunk (#6583)
  • Ensure HTML entities in JSX are properly decoded in the output (#6584)

Pull Requests

4.64.9

2026-10-17

Bug Fixes

  • Ensure export live-bindings are properly maintained for aliased exports (#6576)
  • Retain typed array constructor calls if the argument has iteration side effects (#6582)

Pull Requests

4.64.8

2026-10-17

Bug Fixes

  • Ensure chunk hashes change when sourcemap comments change (#6509)
  • Resolve some relative import resolution edge cases (#6522)

... (truncated)

Commits

Updates undici from 8.12.1 to 8.12.3

Release notes

Sourced from undici's releases.

v8.12.3

What's Changed

New Contributors

Full Changelog: nodejs/undici@v8.12.2...v8.12.3

v8.12.2

Security fixes

High severity

Denial of service via TLS 1.2 certificate-changing renegotiation

CVE-2026-87018 · GHSA-qrxm-fqhp-jwvm

A malicious or compromised HTTPS server could crash the Node.js process by initiating TLS 1.2 renegotiation and presenting a different, CA-trusted certificate whose hostname did not match the requested host. The resulting socket error reached an assertion in undici's HTTP/1.1 and HTTP/2 connection handling. This release handles post-connect certificate errors without terminating the process.

TLS certificate validation bypass through dropped Agent options

CVE-2026-109383 · GHSA-2m5v-pch6-74hx

Agent used a JSON-based clone for constructor options, which silently removed function-valued TLS options such as checkServerIdentity. Applications relying on custom certificate or public-key verification could therefore accept a certificate that the callback was intended to reject. This release preserves TLS options when creating per-origin dispatchers.

Cache poisoning and cross-user disclosure through cross-origin redirects

CVE-2026-109829 · GHSA-4w7w-5xrc-9h26

When an originless Agent combined redirect and shared-cache interceptors as compose(redirect(), cache()), a response from a cross-origin redirect could be stored under the original URL. This could allow persistent cache poisoning or disclosure of user-specific responses to later callers. This release verifies the response origin before caching and preserves redirect-hop cache-control policy.

Denial of service through excessive Content-Encoding values

CVE-2026-109869 · GHSA-xjj6-f33q-929c

A malicious HTTP server could crash the Node.js process by returning more than five content codings and closing the connection before sending the body. Although fetch() rejected the response, an error from an orphaned internal stream could remain unhandled. This release validates the content-encoding chain before creating the body stream and aborts oversized chains safely.

Medium severity

Denial of service through the decompress interceptor

CVE-2026-87029 · GHSA-55wc-3pg8-jfw6

... (truncated)

Commits
  • ff9cc5e Bumped v8.12.3 (#6053)
  • 0bbf614 fix(pool): keep caller async context for queued requests (#5982)
  • aa1eef1 fix(h2): replace a connection that stops responding after a stream timeout (#...
  • e34b872 docs: document the options of interceptors.cache() (#6050)
  • e8f3423 build(deps-dev): bump eslint from 9.39.4 to 10.12.0 (#5967)
  • b777e40 build(deps-dev): bump neostandard from 0.13.0 to 0.14.0 (#6006)
  • 43700ff ci: use Python 3.14 for the WPT server on macOS (#6029)
  • bb6cc0a Bumped v8.12.2 (#6021)
  • b217373 fix(websocket): bound automatic PONG writes under backpressure
  • 789ef26 fix(eventsource): bound retained SSE parser state
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the npm-dependencies group across 1 directory with 3 updates
e31de5d 
Bumps the npm-dependencies group with 3 updates in the / directory: [puppeteer](https://github.com/puppeteer/puppeteer), [rollup](https://github.com/rollup/rollup) and [undici](https://github.com/nodejs/undici).


Updates `puppeteer` from 25.14.0 to 25.15.0
- [Release notes](https://github.com/puppeteer/puppeteer/releases)
- [Changelog](https://github.com/puppeteer/puppeteer/blob/main/CHANGELOG.md)
- [Commits](puppeteer/puppeteer@puppeteer-v25.14.0...puppeteer-v25.15.0)

Updates `rollup` from 4.64.7 to 4.64.12
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.64.7...v4.64.12)

Updates `undici` from 8.12.1 to 8.12.3
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v8.12.1...v8.12.3)

---
updated-dependencies:
- dependency-name: puppeteer
  dependency-version: 25.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: rollup
  dependency-version: 4.64.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: undici
  dependency-version: 8.12.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 28, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants