Skip to content

Bump the npm_and_yarn group across 1 directory with 15 updates - #12187

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/npm_and_yarn-8b22c8fb3d
Open

Bump the npm_and_yarn group across 1 directory with 15 updates#12187
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/npm_and_yarn-8b22c8fb3d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 14 updates in the / directory:

Package From To
@angular/common 5.2.11 20.3.27
@angular/compiler 5.2.11 20.3.27
@angular/core 5.2.11 20.3.25
cordova-plugin-inappbrowser 4.1.0 6.0.1
adm-zip 0.4.13 0.6.0
electron 9.4.2 39.8.10
body-parser 1.19.0 1.20.6
brace-expansion 1.1.11 1.1.18
follow-redirects 1.13.0 1.16.0
socket.io-parser 3.2.0 4.2.7
systeminformation 4.34.23 5.33.7
webpack-dev-server 3.1.14 removed
websocket-driver 0.7.4 0.7.5
xmldom 0.1.31 removed

Updates @angular/common from 5.2.11 to 20.3.27

Release notes

Sourced from @​angular/common's releases.

20.3.27

compiler

Commit Description
fix - 5dbcd0ee16 disallow i18n event attributes
fix - db0d4a1a39 restrict possible event handler check to property names longer than 2 characters

http

Commit Description
fix - a64e2883e9 distinguish repeated transfer cache params

platform-server

Commit Description
fix - 6f80cca0b8 update domino to latest version

20.3.26

compiler-cli

Commit Description
fix - 406aaa31e6 update babel dependencies to latest v7

core

Commit Description
fix - 26831d0cbd avoid caching missing locale data
fix - 8eb7aea08b reject dynamic script host elements

http

Commit Description
fix - b963f61028 prevent caching of responses with Set-Cookie headers

service-worker

Commit Description
fix - 1fdf234168 preserve referrer in asset requests
fix - baa093ba68 preserve referrer policy in asset requests

20.3.25

common

Commit Description
fix - 9f443bc24c Limits date format string length
fix - 566ad05f20 skip transfer cache for uncacheable HTTP traffic
fix - 1a62130a6b use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Description
fix - a68ec702a0 sanitize two-way properties

core

Commit Description
fix - 768a349e6e harden TransferState restoration against DOM clobbering

... (truncated)

Changelog

Sourced from @​angular/common's changelog.

20.3.27 (2026-07-29)

compiler

Commit Type Description
5dbcd0ee16 fix disallow i18n event attributes
db0d4a1a39 fix restrict possible event handler check to property names longer than 2 characters

http

Commit Type Description
a64e2883e9 fix distinguish repeated transfer cache params

platform-server

Commit Type Description
6f80cca0b8 fix update domino to latest version

20.3.26 (2026-07-08)

compiler-cli

Commit Type Description
406aaa31e6 fix update babel dependencies to latest v7

core

Commit Type Description
26831d0cbd fix avoid caching missing locale data
8eb7aea08b fix reject dynamic script host elements

http

Commit Type Description
b963f61028 fix prevent caching of responses with Set-Cookie headers

service-worker

Commit Type Description

... (truncated)

Commits
  • a64e288 fix(http): distinguish repeated transfer cache params
  • b963f61 fix(http): prevent caching of responses with Set-Cookie headers
  • 06be298 fix(http): preserve empty referrer option in HttpRequest
  • 9f443bc fix(common): Limits date format string length
  • fa940e1 fix(http): Rejects non-HTTP(S) URLs in JSONP requests
  • 1a62130 fix(common): use cryptographically secure SHA-256 for transfer cache key gene...
  • 566ad05 fix(common): skip transfer cache for uncacheable HTTP traffic
  • e2ef1ce fix(http): skip transfer cache for fetch credentialed requests
  • 3d135ce fix(common): add upper bounds for digitsInfo
  • 39a4b4c fix(common): sanitize placeholder
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by google-wombot, a new releaser for @​angular/common since your current version.


Updates @angular/compiler from 5.2.11 to 20.3.27

Release notes

Sourced from @​angular/compiler's releases.

20.3.27

compiler

Commit Description
fix - 5dbcd0ee16 disallow i18n event attributes
fix - db0d4a1a39 restrict possible event handler check to property names longer than 2 characters

http

Commit Description
fix - a64e2883e9 distinguish repeated transfer cache params

platform-server

Commit Description
fix - 6f80cca0b8 update domino to latest version

20.3.26

compiler-cli

Commit Description
fix - 406aaa31e6 update babel dependencies to latest v7

core

Commit Description
fix - 26831d0cbd avoid caching missing locale data
fix - 8eb7aea08b reject dynamic script host elements

http

Commit Description
fix - b963f61028 prevent caching of responses with Set-Cookie headers

service-worker

Commit Description
fix - 1fdf234168 preserve referrer in asset requests
fix - baa093ba68 preserve referrer policy in asset requests

20.3.25

common

Commit Description
fix - 9f443bc24c Limits date format string length
fix - 566ad05f20 skip transfer cache for uncacheable HTTP traffic
fix - 1a62130a6b use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Description
fix - a68ec702a0 sanitize two-way properties

core

Commit Description
fix - 768a349e6e harden TransferState restoration against DOM clobbering

... (truncated)

Changelog

Sourced from @​angular/compiler's changelog.

20.3.27 (2026-07-29)

compiler

Commit Type Description
5dbcd0ee16 fix disallow i18n event attributes
db0d4a1a39 fix restrict possible event handler check to property names longer than 2 characters

http

Commit Type Description
a64e2883e9 fix distinguish repeated transfer cache params

platform-server

Commit Type Description
6f80cca0b8 fix update domino to latest version

20.3.26 (2026-07-08)

compiler-cli

Commit Type Description
406aaa31e6 fix update babel dependencies to latest v7

core

Commit Type Description
26831d0cbd fix avoid caching missing locale data
8eb7aea08b fix reject dynamic script host elements

http

Commit Type Description
b963f61028 fix prevent caching of responses with Set-Cookie headers

service-worker

Commit Type Description

... (truncated)

Commits
  • db0d4a1 fix(compiler): restrict possible event handler check to property names longer...
  • 5dbcd0e fix(compiler): disallow i18n event attributes
  • a68ec70 fix(compiler): sanitize two-way properties
  • d40acc6 fix(compiler): prevent namespaced SVG <style> elements from being stripped
  • 7ae6381 test(compiler-cli): align ngtsc sanitization expectations with modern DOM sch...
  • 36200bd test(core): update spec files to match 20.3.x limits and actual contexts (#68...
  • 823b37f test(compiler): remove obsolete schema_extractor import (#68926)
  • e345a58 fix(core): normalize tag names in runtime i18n attribute security context loo...
  • 8f35b18 fix(compiler): normalize tag names with custom namespaces in DomElementSchema...
  • 64a89e9 fix(compiler): sanitize dynamic href and xlink:href bindings on SVG a element...
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by google-wombot, a new releaser for @​angular/compiler since your current version.


Updates @angular/core from 5.2.11 to 20.3.25

Release notes

Sourced from @​angular/core's releases.

20.3.25

common

Commit Description
fix - 9f443bc24c Limits date format string length
fix - 566ad05f20 skip transfer cache for uncacheable HTTP traffic
fix - 1a62130a6b use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Description
fix - a68ec702a0 sanitize two-way properties

core

Commit Description
fix - 768a349e6e harden TransferState restoration against DOM clobbering
fix - ca48b4728d validate lowercase SVG animation attribute names (#69270)

http

Commit Description
fix - 06be298267 preserve empty referrer option in HttpRequest
fix - fa940e1f4d Rejects non-HTTP(S) URLs in JSONP requests
fix - e2ef1ce72a skip transfer cache for fetch credentialed requests

platform-server

Commit Description
fix - 49368c1859 harden platform location origin validation during SSR
refactor - d55c94ad81 deprecate ServerXhr (#69256)

service-worker

Commit Description
fix - d65a5f457b Strips sensitive headers on cross-origin redirects

Deprecations

platform-server

  • XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

20.3.24

platform-server

Commit Description
fix - 6ca433e56b throw on suspicious URLs and restrict protocol-relative URLs
fix - 8680b5152f update domino to latest version

20.3.23

compiler

Commit Description
fix - d40acc6431 prevent namespaced SVG elements from being stripped

20.3.22

common

... (truncated)

Changelog

Sourced from @​angular/core's changelog.

20.3.25 (2026-06-10)

Deprecations

platform-server

  • XHR support in @angular/platform-server is deprecated. Use standard fetch APIs instead.

common

Commit Type Description
9f443bc24c fix Limits date format string length
566ad05f20 fix skip transfer cache for uncacheable HTTP traffic
1a62130a6b fix use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit Type Description
a68ec702a0 fix sanitize two-way properties

core

Commit Type Description
768a349e6e fix harden TransferState restoration against DOM clobbering
ca48b4728d fix validate lowercase SVG animation attribute names (#69270)

http

Commit Type Description
06be298267 fix preserve empty referrer option in HttpRequest
fa940e1f4d fix Rejects non-HTTP(S) URLs in JSONP requests
e2ef1ce72a fix skip transfer cache for fetch credentialed requests

platform-server

Commit Type Description
49368c1859 fix harden platform location origin validation during SSR
d55c94ad81 refactor deprecate ServerXhr (#69256)

service-worker

Commit Type Description
d65a5f457b fix Strips sensitive headers on cross-origin redirects

... (truncated)

Commits
  • ca48b47 fix(core): validate lowercase SVG animation attribute names (#69270)
  • 1a62130 fix(common): use cryptographically secure SHA-256 for transfer cache key gene...
  • 49368c1 fix(platform-server): harden platform location origin validation during SSR
  • 566ad05 fix(common): skip transfer cache for uncacheable HTTP traffic
  • 768a349 fix(core): harden TransferState restoration against DOM clobbering
  • 7ae6381 test(compiler-cli): align ngtsc sanitization expectations with modern DOM sch...
  • 6595409 test(core): update golden symbols and host bindings sanitization spec (#68926)
  • d86e4e7 fix(core): reject script element as a dynamic component host (#68926)
  • b8f1f72 test(core): remove obsolete blockquote cite host binding tests (#68926)
  • 36200bd test(core): update spec files to match 20.3.x limits and actual contexts (#68...
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by google-wombot, a new releaser for @​angular/core since your current version.


Updates cordova-plugin-inappbrowser from 4.1.0 to 6.0.1

Release notes

Sourced from cordova-plugin-inappbrowser's releases.

6.0.1

  • GH-1152 fix(ios): check callbackId with regex
  • GH-1095 chore: gh-action workflow, license header formatting & cleanups
  • Fix npm audit issues
Changelog

Sourced from cordova-plugin-inappbrowser's changelog.

6.0.1 (June 1, 2026)

  • GH-1152 fix(ios): check callbackId with regex
  • GH-1095 chore: gh-action workflow, license header formatting & cleanups
  • Fix npm audit issues

6.0.0 (Nov 10, 2023)

  • GH-1033 chore: bump to next major release 6.0.0 & update deependencies
  • GH-1032 chore(lint): update eslint config and apply fixes
  • GH-1030 fix!: remove deprecated platforms Windows & osx
  • GH-1031 fix(ios): Remove deprecation warnings and old code
  • GH-927 fix: explicitly import dependencies, instead of relying on PCH files. This is important in Swift projects, where you cannot use prefix headers.
  • GH-968 GH-706 Android: Allow permissions requests
  • GH-1029 chore: update asf config
  • GH-1019 feat(android): Download event
  • GH-1020 ci(gh-action): Paramedic CI sync
  • GH-1015 feat(ios): Make WebView inspectable
  • GH-1016 chore: use https urls in tests and README
  • GH-1017 chore: Update SUPPORT_QUESTION.md template
  • GH-977 fix(docs): missing xml indicator in code block
  • GH-971 ci: sync workflow with paramedic
  • GH-964 dep(npm): bump package-lock v2 w/ rebuild
  • GH-957 ci(android): update java requirement for cordova-android@​11
  • GH-946 fix(android): increase toolbar to 48dp
  • GH-912 ci(ios): update workflow w/ iOS 15
  • GH-907 ci: add action-badge
  • GH-906 ci: remove travis & appveyor
  • GH-903 ci: add gh-actions workflows
  • GH-861 fix(android): add space between default useragent and custom AppendUserAgent
  • GH-881 fix(ios): make system open tel, sms, mailto and geo links

5.0.0 (Feb 10, 2021)

  • GH-828 feat(ios): add InAppBrowserStatusBarStyle 'darkcontent' configuration option
  • GH-823 chore: bump engines requirements
  • GH-824 breaking: cleanup code for old Android versions
  • GH-825 (ios): rename CDVWKProcessPoolFactory
  • GH-826 ci: add node-14.x to workflow
  • GH-821 breaking(android): replace magic numbers with Android.os.Build constants
  • GH-717 ci(ios): remove wkwebview plugin
Commits
  • 7df1c56 update ignore files
  • 4d8c187 add .asf-release
  • 6490a4e Revert changes to packge-lock.json in last commit
  • 4a1ab26 chore: update release notes
  • 1d42d84 chore: gh-action workflow, license header formatting & cleanups (#1095)
  • e83328c chore(ci): add/update release workflows
  • 9f3c4da chore: npm audit fix
  • 29c6c19 chore: update version for 6.0.1
  • 567a960 chore: release notes for 6.0.1
  • 241d55a fix(ios): check callbackId with regex
  • Additional commits viewable in compare view

Updates adm-zip from 0.4.13 to 0.6.0

Release notes

Sourced from adm-zip's releases.

v0.6.0

Full Changelog: cthackers/adm-zip@v0.5.18...v0.6.0

This release fixes a security vulnerability (CVE-2026-39244), resolves several long-standing bugs, ships built-in TypeScript types, and includes two behavior changes worth reading before you upgrade.

  • extractEntryTo(dirEntry, target, maintainEntryPath = false) now preserves subdirectories instead of flattening files into the target folder by basename (which also silently overwrote same-named files). (#306)
  • Extraction no longer fails when the modification time can't be set — utimes is now best-effort. (#379)
  • Minimum Node.js is now 14 (the code already required it; engines was incorrectly >=12).
  • CVE-2026-39244 — a crafted archive declaring a huge uncompressed size could force an unbounded Buffer.alloc and OOM the process; allocation is now bounded by the data actually present. Reported by Daniel Púa (devploit), Anh Hong, and José Antonio Zamudio Amaya. (#568)
  • Hardened entry-name lookup against object injection (proto names). Prototype-less table.
  • Data-descriptor regression rejecting valid archives (#548, #533, #554)
  • Directory permissions not restored on extract (#530)
  • Infinite recursion on symlink loops in addLocalFolder (#541)
  • Uncaught process crash in writeFileToAsync on write failure (#470, #459, #402)
  • Empty name on directory entries (#466)
  • test() always returned false for archives with files
  • ~6× faster entry sorting for large archives
  • Built-in TypeScript definitions (types.d.ts) — you can drop @​types/adm-zip

v0.5.18

What's Changed

New Contributors

Full Changelog: cthackers/adm-zip@v0.5.17...v0.5.18

v0.5.17

What's Changed

New Contributors

Full Changelog: cthackers/adm-zip@v0.5.16...v0.5.17

v0.5.16

... (truncated)

Changelog

Sourced from adm-zip's changelog.

0.6.0 / 2026-07-10

Security

  • Fixed CVE-2026-39244: a crafted archive declaring a huge uncompressed size could force an unbounded Buffer.alloc (memory exhaustion / DoS) before any validation. Allocation is now bounded by the data actually present — STORED output is sized from the real bytes, DEFLATED output is grown by the inflater and capped at the declared size (#568)
  • Hardened the internal entry-name lookup table against object injection: entry names come from untrusted archives, and a name such as __proto__ previously resolved to Object.prototype, crashing addFile and hiding the entry from getEntry/readFile. The table is now prototype-less

Bug fixes

  • Fixed a regression (0.5.15) that rejected valid archives using a data descriptor (general-purpose bit 3). The payload is now validated against the authoritative central-directory CRC instead of requiring/parsing the trailing descriptor (#548, #533, #554)
  • Fixed extractAllTo/extractAllToAsync not restoring directory permissions with keepOriginalPermission; directory modes are applied after their contents are written, deepest path first, and no longer lock the extractor out of a restrictive directory (#530)
  • Fixed infinite recursion in addLocalFolder when a folder contains a symlink pointing back to an ancestor (e.g. workspace node_modules); the walk now tracks resolved real paths and skips already-visited directories (#541)
  • Fixed an uncaught exception (ERR_INVALID_ARG_TYPE) that crashed the process when writeFileToAsync could not open the target file (bad permissions, invalid filename, exhausted file descriptors); write failures are now reported through the callback and write errors are no longer silently swallowed (#470, #459, #402)
  • Fixed directory entries reporting an empty name (e.g. a/b/c/ now returns c) (#466)
  • Fixed extractEntryTo flattening subdirectories when maintainEntryPath is false; the structure below the extracted directory is now preserved instead of collapsing (and overwriting) files by basename (#306)
  • Fixed a failed utimes aborting extraction; setting the modification time is now best-effort and never fails extraction of already-written content (#379)
  • Fixed test() always returning false for any archive containing a file (it indexed the entries array with an entry object instead of reading the entry); it now correctly verifies each entry's CRC

Performance

  • Faster entry sorting when writing archives with many entries: names are decoded once instead of on every comparison (about 6× faster sort for large archives)

Added

  • Bundled TypeScript type definitions (types.d.ts), so @types/adm-zip is no longer required

Notes

  • Behavior change: extractEntryTo(dir, target, /* maintainEntryPath */ false) now preserves subdirectories beneath the extracted directory rather than flattening them
  • Behavior change: extraction no longer fails when the modification time cannot be set

0.5.4 / 2021-03-08

  • Fixed relative paths
  • Added zipcrypto encryption
  • Lower verMade for macOS when generating zip file

0.5.3 / 2021-02-07

  • Fixed filemode when unzipping

0.5.2 / 2021-01-27

  • Fixed path traversal issue (GHSL-2020-198)

0.5.1 / 2020-11-27

  • Incremented version (cthackers)
  • Fixed outFileName (cthackers)

0.5.0 / 2020-11-19

  • Added extra parameter to extractEntryTo so target filename can be renamed (cthackers)

... (truncated)

Commits
  • 2b4d840 updated minimum node engine version to >= 14
  • dc57f0f Hardened entry-name lookup, fixed test(), and sped up entry sorting
  • f81806a Made utimes best-effort so it can't abort extraction (#379)
  • ab04324 Fixed extractEntryTo flattening subdirectories (#306)
  • 8a5d9ba Fixed empty name for directory entries (#466)
  • 3e72790 Fixed uncaught crash in writeFileToAsync on write failure (#470, #459, #402)
  • 651ae4c Added typescript types
  • e72021d Fixed infinite recursion on symlink loops in addLocalFolder (#541)
  • 8f3176b Fixed directory permissions on linux
  • 4d2c8f9 Fixed error introduced with zip descriptor checks
  • Additional commits viewable in compare view

Updates electron from 9.4.2 to 39.8.10

Release notes

Sourced from electron's releases.

electron v39.8.10

Release Notes for v39.8.10

[!WARNING] Electron 39.x.y has reached end-of-support as per the project's support policy. Developers and applications are encouraged to upgrade to a newer version of Electron.

Fixes

  • Ensured cross-origin fetch() and XHR are blocked for custom protocols registered with supportFetchAPI: true unless corsEnabled: true is also set; cross-origin mode: 'no-cors' requests now receive an opaque response. #51272 (Also in 40, 41, 42)
  • Fixed an issue where the Squirrel.Mac installer could resolve the target bundle path to different locations at different stages of an install. #50766 (Also in 42)

Other Changes

  • Backported a fix for route_id validation in the GPU command buffer. #51327
  • Backported security fixes for 493319454, 494158331, 493234757, 492736100, 493413432, 492668885, 496281816. #51257
  • Backported several fixes in Skia, ANGLE, and WebRTC from upstream. #51266
Commits
  • d7c42eb chore: backport removal of private macOS APIs (#51502)
  • c76d48c build: replace spec dep fork with transitive resolution (#51490)
  • 3ff23c5 fix: respect iframe sandbox flags on the OpenURL navigation path (#51437)
  • 01faabf fix: resolve target bundle path once at start of install (#50766)
  • 8287d59 build(deps): bump dorny/paths-filter from 3.0.2 to 4.0.1 (#51409)
  • a8a79ea ci: backport secondary siso patch (#51390)
  • 593607e chore: cherry-pick 1 change from chromium (#51327)
  • aa7791f build: restrict npm tarball contents to an explicit allowlist (#51307)
  • 5392e9a fix: ensure corsEnabled: false protocol handlers do not work across protocols...
  • 2c24640 fix: validate OSR frame geometry against shared-memory mapping size (39-x-y) ...
  • Additional commits viewable in compare view

Updates body-parser from 1.19.0 to 1.20.6

Release notes

Sourced from body-parser's releases.

1.20.6

Important: Security

What's Changed

Full Changelog: expressjs/body-parser@1.20.5...1.20.6

v1.20.5

What's Changed

The reason for this release is a fix to the extended urlencoded parser returning objects instead of arrays for large array inputs (> 100) on qs@6.14.2+. (expressjs/body-parser#716)

New Contributors

Special thanks to triager @​krzysdz for keeping this on our radar and effectively triaging the specific issue!

Full Changelog: https://github.com/...

Description has been truncated

@dependabot
Bump the npm_and_yarn group across 1 directory with 15 updates
c46df57 
Bumps the npm_and_yarn group with 14 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common) | `5.2.11` | `20.3.27` |
| [@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler) | `5.2.11` | `20.3.27` |
| [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core) | `5.2.11` | `20.3.25` |
| [cordova-plugin-inappbrowser](https://github.com/apache/cordova-plugin-inappbrowser) | `4.1.0` | `6.0.1` |
| [adm-zip](https://github.com/cthackers/adm-zip) | `0.4.13` | `0.6.0` |
| [electron](https://github.com/electron/electron) | `9.4.2` | `39.8.10` |
| [body-parser](https://github.com/expressjs/body-parser) | `1.19.0` | `1.20.6` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.11` | `1.1.18` |
| [follow-redirects](https://github.com/follow-redirects/follow-redirects) | `1.13.0` | `1.16.0` |
| [socket.io-parser](https://github.com/socketio/socket.io) | `3.2.0` | `4.2.7` |
| [systeminformation](https://github.com/sebhildebrandt/systeminformation) | `4.34.23` | `5.33.7` |
| [webpack-dev-server](https://github.com/webpack/webpack-dev-server) | `3.1.14` | `removed` |
| [websocket-driver](https://github.com/faye/websocket-driver-node) | `0.7.4` | `0.7.5` |
| [xmldom](https://github.com/xmldom/xmldom) | `0.1.31` | `removed` |



Updates `@angular/common` from 5.2.11 to 20.3.27
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/v20.3.27/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v20.3.27/packages/common)

Updates `@angular/compiler` from 5.2.11 to 20.3.27
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/v20.3.27/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v20.3.27/packages/compiler)

Updates `@angular/core` from 5.2.11 to 20.3.25
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/v20.3.25/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v20.3.25/packages/core)

Updates `cordova-plugin-inappbrowser` from 4.1.0 to 6.0.1
- [Release notes](https://github.com/apache/cordova-plugin-inappbrowser/releases)
- [Changelog](https://github.com/apache/cordova-plugin-inappbrowser/blob/master/RELEASENOTES.md)
- [Commits](apache/cordova-plugin-inappbrowser@4.1.0...rel/6.0.1)

Updates `adm-zip` from 0.4.13 to 0.6.0
- [Release notes](https://github.com/cthackers/adm-zip/releases)
- [Changelog](https://github.com/cthackers/adm-zip/blob/master/history.md)
- [Commits](cthackers/adm-zip@v0.4.13...v0.6.0)

Updates `electron` from 9.4.2 to 39.8.10
- [Release notes](https://github.com/electron/electron/releases)
- [Commits](electron/electron@v9.4.2...v39.8.10)

Updates `body-parser` from 1.19.0 to 1.20.6
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@1.19.0...1.20.6)

Updates `brace-expansion` from 1.1.11 to 1.1.18
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@1.1.11...v1.1.18)

Updates `extract-zip` from 1.7.0 to 2.0.1
- [Release notes](https://github.com/maxogden/extract-zip/releases)
- [Commits](max-mapper/extract-zip@v1.7.0...v2.0.1)

Updates `follow-redirects` from 1.13.0 to 1.16.0
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](follow-redirects/follow-redirects@v1.13.0...v1.16.0)

Updates `socket.io-parser` from 3.2.0 to 4.2.7
- [Release notes](https://github.com/socketio/socket.io/releases)
- [Changelog](https://github.com/socketio/socket.io/blob/main/CHANGELOG.md)
- [Commits](https://github.com/socketio/socket.io/commits/socket.io-parser@4.2.7)

Updates `systeminformation` from 4.34.23 to 5.33.7
- [Release notes](https://github.com/sebhildebrandt/systeminformation/releases)
- [Changelog](https://github.com/sebhildebrandt/systeminformation/blob/master/CHANGELOG.md)
- [Commits](sebhildebrandt/systeminformation@v4.34.23...v5.33.7)

Removes `webpack-dev-server`

Updates `websocket-driver` from 0.7.4 to 0.7.5
- [Changelog](https://github.com/faye/websocket-driver-node/blob/main/CHANGELOG.md)
- [Commits](faye/websocket-driver-node@0.7.4...0.7.5)

Removes `xmldom`

---
updated-dependencies:
- dependency-name: "@angular/common"
  dependency-version: 20.3.27
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@angular/compiler"
  dependency-version: 20.3.27
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@angular/core"
  dependency-version: 20.3.25
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: cordova-plugin-inappbrowser
  dependency-version: 6.0.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: adm-zip
  dependency-version: 0.6.0
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: electron
  dependency-version: 39.8.10
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: body-parser
  dependency-version: 1.20.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 1.1.18
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: extract-zip
  dependency-version: 2.0.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: follow-redirects
  dependency-version: 1.16.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: socket.io-parser
  dependency-version: 4.2.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: systeminformation
  dependency-version: 5.33.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: webpack-dev-server
  dependency-version:
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: websocket-driver
  dependency-version: 0.7.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: xmldom
  dependency-version:
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants