chore(deps): bump the npm_and_yarn group across 2 directories with 9 updates

[dependabot]

Bumps the npm_and_yarn group with 8 updates in the / directory:

Package	From	To
ejs	3.1.9	3.1.10
express	4.18.2	4.19.2
follow-redirects	1.15.5	1.15.6
ip	2.0.0	2.0.1
tar	6.2.0	6.2.1
undici	6.2.1	6.11.1
@angular-devkit/build-angular	17.1.0	17.3.6
webpack-dev-middleware	5.3.3	5.3.4

Bumps the npm_and_yarn group with 1 update in the /docs directory: vite.

Updates ejs from 3.1.9 to 3.1.10

Release notes

Sourced from ejs's releases.

v3.1.10

Version 3.1.10

Commits

• d3f807d Version 3.1.10
• 9ee26dd Mocha TDD
• e469741 Basic pollution protection
• 715e950 Merge pull request #756 from Jeffrey-mu/main
• cabe314 Include advanced usage examples
• 29b076c Added header
• 11503c7 Merge branch 'main' of github.com:mde/ejs into main
• 7690404 Added security banner to README
• f47d7ae Update SECURITY.md
• 828cea1 Update SECURITY.md
• Additional commits viewable in compare view

Updates express from 4.18.2 to 4.19.2

Release notes

Sourced from express's releases.

4.19.2

What's Changed

• Improved fix for open redirect allow list bypass

Full Changelog: expressjs/express@4.19.1...4.19.2

4.19.1

What's Changed

• Fix ci after location patch by @​wesleytodd in expressjs/express#5552
• fixed un-edited version in history.md for 4.19.0 by @​wesleytodd in expressjs/express#5556

Full Changelog: expressjs/express@4.19.0...4.19.1

4.19.0

What's Changed

• fix typo in release date by @​UlisesGascon in expressjs/express#5527
• docs: nominating @​wesleytodd to be project captian by @​wesleytodd in expressjs/express#5511
• docs: loosen TC activity rules by @​wesleytodd in expressjs/express#5510
• Add note on how to update docs for new release by @​crandmck in expressjs/express#5541
• Prevent open redirect allow list bypass due to encodeurl
• Release 4.19.0 by @​wesleytodd in expressjs/express#5551

New Contributors

• @​crandmck made their first contribution in expressjs/express#5541

Full Changelog: expressjs/express@4.18.3...4.19.0

4.18.3

Main Changes

• Fix routing requests without method
• deps: body-parser@1.20.2
  • Fix strict json error message on Node.js 19+
  • deps: content-type@~1.0.5
  • deps: raw-body@2.5.2

Other Changes

• Use https: protocol instead of deprecated git: protocol by @​vcsjones in expressjs/express#5032
• build: Node.js@16.18 and Node.js@18.12 by @​abenhamdine in expressjs/express#5034
• ci: update actions/checkout to v3 by @​armujahid in expressjs/express#5027
• test: remove unused function arguments in params by @​raksbisht in expressjs/express#5124
• Remove unused originalIndex from acceptParams by @​raksbisht in expressjs/express#5119
• Fixed typos by @​raksbisht in expressjs/express#5117
• examples: remove unused params by @​raksbisht in expressjs/express#5113
• fix: parameter str is not described in JSDoc by @​raksbisht in expressjs/express#5130
• fix: typos in History.md by @​raksbisht in expressjs/express#5131
• build : add Node.js@19.7 by @​abenhamdine in expressjs/express#5028
• test: remove unused function arguments in params by @​raksbisht in expressjs/express#5137

... (truncated)

Changelog

Sourced from express's changelog.

4.19.2 / 2024-03-25

• Improved fix for open redirect allow list bypass

4.19.1 / 2024-03-20

• Allow passing non-strings to res.location with new encoding handling checks

4.19.0 / 2024-03-20

• Prevent open redirect allow list bypass due to encodeurl
• deps: cookie@0.6.0

4.18.3 / 2024-02-29

• Fix routing requests without method
• deps: body-parser@1.20.2
  • Fix strict json error message on Node.js 19+
  • deps: content-type@~1.0.5
  • deps: raw-body@2.5.2
• deps: cookie@0.6.0
  • Add partitioned option

Commits

• 04bc627 4.19.2
• da4d763 Improved fix for open redirect allow list bypass
• 4f0f6cc 4.19.1
• a003cfa Allow passing non-strings to res.location with new encoding handling checks f...
• a1fa90f fixed un-edited version in history.md for 4.19.0
• 11f2b1d build: fix build due to inconsistent supertest behavior in older versions
• 084e365 4.19.0
• 0867302 Prevent open redirect allow list bypass due to encodeurl
• 567c9c6 Add note on how to update docs for new release (#5541)
• 69a4cf2 deps: cookie@0.6.0
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by wesleytodd, a new releaser for express since your current version.

Updates follow-redirects from 1.15.5 to 1.15.6

Commits

• 35a517c Release version 1.15.6 of the npm package.
• c4f847f Drop Proxy-Authorization across hosts.
• 8526b4a Use GitHub for disclosure.
• See full diff in compare view

Updates ip from 2.0.0 to 2.0.1

Commits

• 3b0994a 2.0.1
• 32f468f lib: fixed CVE-2023-42282 and added unit test
• See full diff in compare view

Updates tar from 6.2.0 to 6.2.1

Commits

• bef7b1e 6.2.1
• fe8cd57 prevent extraction in excessively deep subfolders
• fe7ebfd remove security.md
• See full diff in compare view

Updates undici from 6.2.1 to 6.11.1

Release notes

Sourced from undici's releases.

v6.11.1

⚠️ Security Release ⚠️

What's Changed

• Fixes GHSA-m4v8-wqvr-p9f7 CVE-2024-30260
• Fixes GHSA-9qxr-qj54-h672 CVE-2024-30261
• Revert "fix: don't leak internal class (#3024)" by @​mcollina in nodejs/undici#3044

Full Changelog: nodejs/undici@v6.11.0...v6.11.1

v6.11.0

What's Changed

• refactor(#3023): Pass headers as array instead by @​metcoder95 in nodejs/undici#3025
• fix: don't leak internal class by @​ronag in nodejs/undici#3024
• build(deps): bump codecov/codecov-action from 4.1.0 to 4.1.1 by @​dependabot in nodejs/undici#3034
• build(deps-dev): bump tsd from 0.30.7 to 0.31.0 by @​dependabot in nodejs/undici#3038
• build(deps-dev): bump borp from 0.9.1 to 0.10.0 by @​dependabot in nodejs/undici#2947
• missing commits by @​ronag in nodejs/undici#3040
• build(deps): bump actions/checkout from 4.1.1 to 4.1.2 by @​dependabot in nodejs/undici#3036
• fix: regexp pattern by @​tsctx in nodejs/undici#3041

Full Changelog: nodejs/undici@v6.10.2...v6.11.0

v6.10.2

What's Changed

• Do not fail test if streams support typed arrays by @​mcollina in nodejs/undici#2978
• fix(fetch): properly redirect non-ascii location header url by @​Xvezda in nodejs/undici#2971
• perf: Remove double-stringify in setCookie by @​peterver in nodejs/undici#2980
• [fix #2982] use DispatcherInterceptor type for Dispatcher#Compose by @​clovis-guillemot in nodejs/undici#2983
• fix: make EventSource properties enumerable by @​MattBidewell in nodejs/undici#2987
• docs: ✏️ fixed benchmark links by @​benhalverson in nodejs/undici#2991
• fix(#2986): bad start check by @​metcoder95 in nodejs/undici#2992
• fix(H2 Client): bind stream 'data' listener only after received 'response' event by @​St3ffGv4 in nodejs/undici#2985
• feat: added search input by @​benhalverson in nodejs/undici#2993
• chore: validate responses can be consumed without a Content-Length or… by @​jacob-ebey in nodejs/undici#2995
• fix error message by @​KhafraDev in nodejs/undici#2998
• Revert "perf: reuse TextDecoder instance (#2863)" by @​panva in nodejs/undici#2999
• test: remove only by @​metcoder95 in nodejs/undici#3001

New Contributors

• @​Xvezda made their first contribution in nodejs/undici#2971
• @​peterver made their first contribution in nodejs/undici#2980
• @​clovis-guillemot made their first contribution in nodejs/undici#2983
• @​MattBidewell made their first contribution in nodejs/undici#2987
• @​benhalverson made their first contribution in nodejs/undici#2991
• @​St3ffGv4 made their first contribution in nodejs/undici#2985
• @​jacob-ebey made their first contribution in nodejs/undici#2995

... (truncated)

Commits

• 6df3c73 Bumped v6.11.1
• c346b66 Revert "fix: don't leak internal class (#3024)"
• d542b8c Merge pull request from GHSA-9qxr-qj54-h672
• 6805746 Merge pull request from GHSA-m4v8-wqvr-p9f7
• ee5f892 Bumped v6.11.0
• 71a6d74 Merge branch 'main' of github.com:nodejs/undici
• 0f0f239 fix: regexp pattern (#3041)
• 31f9e67 build(deps): bump actions/checkout from 4.1.1 to 4.1.2 (#3036)
• c8a43ae fixup
• 8b5e2c8 fixup
• Additional commits viewable in compare view

Updates @angular-devkit/build-angular from 17.1.0 to 17.3.6

Release notes

Sourced from @​angular-devkit/build-angular's releases.

v17.3.6

17.3.6 (2024-04-25)

@​angular-devkit/build-angular

Commit	Description
	properly configure headers for media resources and HTML page

v17.3.5

17.3.5 (2024-04-17)

@​angular-devkit/build-angular

Commit	Description
	address Unable to deserialize cloned data issue with Yarn PnP
	remove type="text/css" from style tag

v17.3.4

17.3.4 (2024-04-11)

@​angular-devkit/build-angular

Commit	Description
	ensure esbuild-based builders exclusively produce ESM output

v17.3.3

@​schematics/angular

Commit	Description
	Revert "fix(@​schematics/angular): rename SSR port env variable"

v17.3.2

17.3.2 (2024-03-25)

@​schematics/angular

Commit	Description
	rename SSR port env variable

@​angular-devkit/build-angular

Commit	Description
	Internal server error: Invalid URL when using a non localhost IP
	ensure proper resolution of linked SCSS files
	service-worker references non-existent named index output
	update webpack-dev-middleware to 6.1.2

v17.3.1

17.3.1 (2024-03-20)

... (truncated)

Changelog

Sourced from @​angular-devkit/build-angular's changelog.

17.3.6 (2024-04-25)

@​angular-devkit/build-angular

Commit	Type	Description
dcec59799	fix	properly configure headers for media resources and HTML page

18.0.0-next.3 (2024-04-17)

Breaking Changes

@​angular/cli

• The ng doc command has been removed without a replacement. To perform searches, please visit www.angular.dev

@​angular-devkit/build-angular

• By default, the index.html file is no longer emitted in the browser directory when using the application builder with SSR. Instead, an index.csr.html file is emitted. This change is implemented because in many cases server and cloud providers incorrectly treat the index.html file as a statically generated page. If you still require the old behavior, you can use the index option to specify the output file name.

  "architect": { "build": { "builder": "@angular-devkit/build-angular:application", "options": { "outputPath": "dist/my-app", "index": { "input": "src/index.html", "output": "index.html" } } } }

@​angular/cli

Commit	Type	Description
03eee0545	refactor	remove ng doc command

@​angular-devkit/build-angular

Commit	Type	Description
83d1d233a	feat	enhance Sass rebasing importer for resources URL defined in variables and handling of external paths

... (truncated)

Commits

• c6b82f6 release: cut the v17.3.6 release
• 6f1906f docs: add explanation of how to set up a new NPM package in Wombat
• dcec597 fix(@​angular-devkit/build-angular): properly configure headers for media reso...
• c5f20a3 release: cut the v17.3.5 release
• 6191d06 fix(@​angular-devkit/build-angular): address `Unable to deserialize cloned dat...
• 0335d6a fix(@​angular-devkit/build-angular): remove type="text/css" from style tag
• d0bff79 release: cut the v17.3.4 release
• 84ee482 docs: replace links links to aio with links to adev
• 1128bdd fix(@​angular-devkit/build-angular): ensure esbuild-based builders exclusively...
• 1f47a10 build: update vite and undici
• Additional commits viewable in compare view

Updates vite from 5.0.11 to 5.1.7

Release notes

Sourced from vite's releases.

create-vite@5.2.3

Please refer to CHANGELOG.md for details.

create-vite@5.2.2

Please refer to CHANGELOG.md for details.

create-vite@5.2.1

Please refer to CHANGELOG.md for details.

create-vite@5.2.0

Please refer to CHANGELOG.md for details.

create-vite@5.1.0

Please refer to CHANGELOG.md for details.

create-vite@5.0.0

Please refer to CHANGELOG.md for details.

create-vite@5.0.0-beta.1

Please refer to CHANGELOG.md for details.

create-vite@5.0.0-beta.0

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

5.2.11 (2024-05-02)

• feat: improve dynamic import variable failure error message (#16519) (f8feeea), closes #16519
• fix: dynamic-import-vars plugin normalize path issue (#16518) (f71ba5b), closes #16518
• fix: scripts and styles were missing from built HTML on Windows (#16421) (0e93f58), closes #16421
• fix(deps): update all non-major dependencies (#16488) (2d50be2), closes #16488
• fix(deps): update all non-major dependencies (#16549) (2d6a13b), closes #16549
• fix(dev): watch publicDir explicitly to include it outside the root (#16502) (4d83eb5), closes #16502
• fix(preload): skip preload for non-static urls (#16556) (bb79c9b), closes #16556
• fix(ssr): handle class declaration and expression name scoping (#16569) (c071eb3), closes #16569
• fix(ssr): handle function expression name scoping (#16563) (02db947), closes #16563

5.2.10 (2024-04-20)

• revert: perf: use workspace root for fs cache (#15712) (#16476) (77e7359), closes #15712 #16476
• fix: add base to virtual html (#16442) (721f94d), closes #16442
• fix: adjust esm syntax judgment logic (#16436) (af72eab), closes #16436
• fix: don't add outDirs to watch.ignored if emptyOutDir is false (#16453) (6a127d6), closes #16453
• fix(cspNonce): don't overwrite existing nonce values (#16415) (b872635), closes #16415
• feat: show warning if root is in build.outDir (#16454) (11444dc), closes #16454
• feat: write cspNonce to style tags (#16419) (8e54bbd), closes #16419
• chore(deps): update dependency eslint-plugin-n to v17 (#16381) (6cccef7), closes #16381

5.2.9 (2024-04-15)

• fix: fsp.rm removing files does not take effect (#16032) (b05c405), closes #16032
• fix: fix accumulated stacks in error overlay (#16393) (102c2fd), closes #16393
• fix(deps): update all non-major dependencies (#16376) (58a2938), closes #16376
• chore: update region comment (#16380) (77562c3), closes #16380
• perf: reduce size of injected __vite__mapDeps code (#16184) (c0ec6be), closes #16184
• perf(css): only replace empty chunk if imported (#16349) (e2658ad), closes #16349

5.2.8 (2024-04-03)

• fix: csp nonce injection when no closing tag (#16281) (#16282) (3c85c6b), closes #16281 #16282
• fix: do not access document in /@vite/client when not defined (#16318) (646319c), closes #16318
• fix: fix sourcemap when using object as define value (#15805) (445c4f2), closes #15805
• fix(css): unknown file error happened with lightningcss (#16306) (01af308), closes #16306
• fix(hmr): multiple updates happened when invalidate is called while multiple tabs open (#16307) (21cc10b), closes #16307
• fix(scanner): duplicate modules for same id if glob is used in html-like types (#16305) (eca68fa), closes #16305
• chore(deps): update all non-major dependencies (#16325) (a78e265), closes #16325
• refactor: use types from sass instead of @​types/sass (#16340) (4581e83), closes #16340

... (truncated)

Commits

• 2bc5d3d release: v5.2.11
• f8feeea feat: improve dynamic import variable failure error message (#16519)
• c071eb3 fix(ssr): handle class declaration and expression name scoping (#16569)
• 02db947 fix(ssr): handle function expression name scoping (#16563)
• 2d6a13b fix(deps): update all non-major dependencies (#16549)
• 0e93f58 fix: scripts and styles were missing from built HTML on Windows (#16421)
• bb79c9b fix(preload): skip preload for non-static urls (#16556)
• f71ba5b fix: dynamic-import-vars plugin normalize path issue (#16518)
• 2d50be2 fix(deps): update all non-major dependencies (#16488)
• 4d83eb5 fix(dev): watch publicDir explicitly to include it outside the root (#16502)
• Additional commits viewable in compare view

Updates webpack-dev-middleware from 5.3.3 to 5.3.4

Release notes

Sourced from webpack-dev-middleware's releases.

v5.3.4

5.3.4 (2024-03-20)

Bug Fixes

• security: do not allow to read files above (#1779) (189c4ac)

Changelog

Sourced from webpack-dev-middleware's changelog.

5.3.4 (2024-03-20)

Bug Fixes

• security: do not allow to read files above (#1779) (189c4ac)

Commits

• 86071ea chore(release): 5.3.4
• 189c4ac fix(security): do not allow to read files above (#1779)
• See full diff in compare view

Updates vite from 4.4.11 to 5.2.11

Release notes

Sourced from vite's releases.

create-vite@5.2.3

Please refer to CHANGELOG.md for details.

create-vite@5.2.2

Please refer to CHANGELOG.md for details.

create-vite@5.2.1

Please refer to CHANGELOG.md for details.

create-vite@5.2.0

Please refer to CHANGELOG.md for details.

create-vite@5.1.0

Please refer to CHANGELOG.md for details.

create-vite@5.0.0

Please refer to CHANGELOG.md for details.

create-vite@5.0.0-beta.1

Please refer to CHANGELOG.md for details.

create-vite@5.0.0-beta.0

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

5.2.11 (2024-05-02)

• feat: improve dynamic import variable failure error message (#16519) (f8feeea), closes #16519
• fix: dynamic-import-vars plugin normalize path issue (#16518) (f71ba5b), closes #16518
• fix: scripts and styles were missing from built HTML on Windows (#16421) (0e93f58), closes #16421
• fix(deps): update all non-major dependencies (#16488) (2d50be2), closes #16488
• fix(deps): update all non-major dependencies (#16549) (2d6a13b), closes #16549
• fix(dev): watch publicDir explicitly to include it outside the root (#16502) (4d83eb5), closes #16502
• fix(preload): skip preload for non-static urls (#16556) (bb79c9b), closes #16556
• fix(ssr): handle class declaration and expression name scoping (#16569) (c071eb3), closes #16569
• fix(ssr): handle function expression name scoping (#16563) (02db947), closes #16563

5.2.10 (2024-04-20)

• revert: perf: use workspace root for fs cache (#15712) (#16476) (77e7359), closes #15712 #16476
• fix: add base to virtual html (#16442) (721f94d), closes #16442
• fix: adjust esm syntax judgment logic (#16436) (af72eab), closes #16436
• fix: don't add outDirs to watch.ignored if emptyOutDir is false (#16453) (6a127d6), closes #16453
• fix(cspNonce): don't overwrite existing nonce values (#16415) (b872635), closes #16415
• feat: show warning if root is in build.outDir (#16454) (11444dc), closes #16454
• feat: write cspNonce to style tags (#16419) (8e54bbd), closes #16419
• chore(deps): update dependency eslint-plugin-n to v17 (#16381) (6cccef7), closes #16381

5.2.9 (2024-04-15)

• fix: fsp.rm removing files does not take effect (#16032) (b05c405), closes #16032
• fix: fix accumulated stacks in error overlay (#16393) (102c2fd), closes #16393
• fix(deps): update all non-major dependencies (#16376) (58a2938), closes #16376
• chore: update region comment (#16380) (77562c3), closes #16380
• perf: reduce size of injected __vite__mapDeps code (#16184) (c0ec6be), closes #16184
• perf(css): only replace empty chunk if imported (#16349) (e2658ad), closes #16349

5.2.8 (2024-04-03)

• fix: csp nonce injection when no closing tag (#16281) (#16282) (3c85c6b), closes #16281 #16282
• fix: do not access document in /@vite/client when not defined (#16318) (646319c), closes #16318
• fix: fix sourcemap when using object as define value (#15805) (445c4f2), closes #15805
• fix(css): unknown file error happened with lightningcss (#16306) (01af308), closes #16306
• fix(hmr): multiple updates happened when invalidate is called while multiple tabs open (#16307) (21cc10b), closes #16307
• fix(scanner): duplicate modules for same id if glob is used in html-like types (#16305) (eca68fa), closes #16305
• chore(deps): update all non-major dependencies (#16325) (a78e265), closes #16325
• refactor: use types from sass instead of @​types/sass (#16340) (4581e83), closes #16340

... (truncated)

Commits

• 2bc5d3d release: v5.2.11
• f8feeea feat: improve dynamic import variable failure error message (#16519)
• c071eb3 fix(ssr): handle class declaration and expression name scoping (#16569)
• 02db947 fix(ssr): handle function expression name scoping (#16563)
• 2d6a13b fix(deps): update all non-major dependencies (#16549)
• 0e93f58 fix: scripts and styles were missing from built HTML on Windows (#16421)
• bb79c9b fix(preload): skip preload for non-static urls (#16556)
• f71ba5b fix: dynamic-import-vars plugin normalize path issue (#16518)
• 2d50be2 fix(deps): update all non-major dependencies (#16488)
• 4d83eb5 fix(dev): watch publicDir explicitly to include it outside the root (#16502)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version wi...

Description has been truncated