Skip to content

chore(deps): bump the npm_and_yarn group across 2 directories with 3 updates#56

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-6a58f47bd4
Open

chore(deps): bump the npm_and_yarn group across 2 directories with 3 updates#56
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-6a58f47bd4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 24, 2026

Copy link
Copy Markdown

Bumps the npm_and_yarn group with 3 updates in the / directory: postcss, nodemailer and ua-parser-js.
Bumps the npm_and_yarn group with 3 updates in the /apps/web directory: postcss, nodemailer and ua-parser-js.

Updates postcss from 8.5.6 to 8.5.12

Release notes

Sourced from postcss's releases.

8.5.12

  • Fixed reading any file via user-generated CSS.
  • Added opts.unsafeMap to disable checks.

8.5.11

  • Fixed nested brackets parsing performance (by @​offset).

8.5.10

  • Fixed XSS via unescaped </style> in non-bundler cases (by @​TharVid).

8.5.9

  • Speed up source map encoding paring in case of the error.

8.5.8

  • Fixed Processor#version.

8.5.7

  • Improved source map annotation cleaning performance (by CodeAnt AI).
Changelog

Sourced from postcss's changelog.

8.5.12

  • Fixed reading any file via user-generated CSS.
  • Added opts.unsafeMap to disable checks.

8.5.11

  • Fixed nested brackets parsing performance (by @​offset).

8.5.10

  • Fixed XSS via unescaped </style> in non-bundler cases (by @​TharVid).

8.5.9

  • Speed up source map encoding paring in case of the error.

8.5.8

  • Fixed Processor#version.

8.5.7

  • Improved source map annotation cleaning performance (by CodeAnt AI).
Commits
  • 9bc81c4 Release 8.5.12 version
  • 85c4d7d Another try to fix coverage
  • 94484ca Try to fix coverage
  • c64b748 Load only .map source maps
  • aaec7b7 Avoid throwing JSON parsing errors for non-JSON source maps
  • 233fb26 Mention original author of the solution
  • 2502f75 Release 8.5.11 version
  • 5ca1901 Speed up parsing many nested brackets
  • 42b5337 Update dependencies
  • 7e36e15 Cache node.raws locally in Stringifier hot methods
  • Additional commits viewable in compare view

Updates nodemailer from 8.0.11 to 9.0.1

Release notes

Sourced from nodemailer's releases.

v9.0.1

9.0.1 (2026-06-17)

Bug Fixes

  • enforce disableFileAccess/disableUrlAccess for raw message option (a82e060)

v9.0.0

9.0.0 (2026-06-14)

⚠ BREAKING CHANGES

  • HTTPS requests made while fetching remote content (attachment href/path URLs, OAuth2 token endpoints, HTTP/HTTPS proxy CONNECT) now validate the server's TLS certificate by default. Requests to hosts with self-signed, expired, or hostname-mismatched certificates that previously succeeded will now fail. Opt back out per request with tls.rejectUnauthorized=false (transport options, or a per-attachment tls option).

Bug Fixes

  • replace deprecated url.parse with a WHATWG URL wrapper (0c080fb)
  • validate TLS certificates by default when fetching remote content (6a947ac)
Changelog

Sourced from nodemailer's changelog.

9.0.1 (2026-06-17)

Bug Fixes

  • enforce disableFileAccess/disableUrlAccess for raw message option (a82e060)

9.0.0 (2026-06-14)

⚠ BREAKING CHANGES

  • HTTPS requests made while fetching remote content (attachment href/path URLs, OAuth2 token endpoints, HTTP/HTTPS proxy CONNECT) now validate the server's TLS certificate by default. Requests to hosts with self-signed, expired, or hostname-mismatched certificates that previously succeeded will now fail. Opt back out per request with tls.rejectUnauthorized=false (transport options, or a per-attachment tls option).

Bug Fixes

  • replace deprecated url.parse with a WHATWG URL wrapper (0c080fb)
  • validate TLS certificates by default when fetching remote content (6a947ac)
Commits
  • 69cf625 chore(master): release 9.0.1 (#1828)
  • a82e060 fix: enforce disableFileAccess/disableUrlAccess for raw message option
  • 4e58450 chore: update dev dependencies
  • 541f5fd chore(master): release 9.0.0 (#1827)
  • 0c080fb fix: replace deprecated url.parse with a WHATWG URL wrapper
  • 6a947ac fix!: validate TLS certificates by default when fetching remote content
  • See full diff in compare view

Updates ua-parser-js from 2.0.6 to 2.0.10

Release notes

Sourced from ua-parser-js's releases.

v2.0.10

Version 2.0.10

  • Fix ReDoS vulnerability by limiting Client Hints input length (GHSA-9h5v-pfqq-x599)
  • Add new method useExtension() in UAParser to extend custom detection rules
  • Add new device vendor: Blackview, Coolpad, CUBOT, T-Mobile
  • Improve browser detection: Huawei Browser, UCBrowser
  • Improve OS detection: iOS
  • Identify WebView user-agent as inapp browser
  • extensions submodule:
    • Add new crawler: atlassian-bot, Audisto Crawler, AwarioBot, AwarioRssBot, AwarioSmartBot, BrightEdge Crawler, HubSpot Crawler, Meta-ExternalAds, Meta-WebIndexer, proximic, yacybot
    • Add new fetcher: Feedly, GoogleDocs, UptimeBot, virustotal
    • Add new library: phpcrawl
  • helpers submodule:
    • Fix isElectron() function return itself

What's Changed

New Contributors

Full Changelog: faisalman/ua-parser-js@2.0.9...2.0.10

v2.0.9

Version 2.0.9

  • Restore icons directory
  • Add new browser: Aloha Browser, Avira Secure Browser, Lighthouse, Luakit, Norton Private Browser
  • Add new OS: Vega OS
  • Improve OS detection: watchOS
  • extensions submodule:
    • Add new crawler: atlassian-bot, Cloudflare-AutoRAG, Google-NotebookLM, SemrushBot-SWA
    • Add new fetcher: FlipboardProxy

What's Changed

New Contributors

Full Changelog: faisalman/ua-parser-js@2.0.8...2.0.9

v2.0.8

Version 2.0.8

... (truncated)

Changelog

Sourced from ua-parser-js's changelog.

Version 2.0.10

  • Fix ReDoS vulnerability by limiting Client Hints input length (GHSA-9h5v-pfqq-x599)
  • Add new method useExtension() in UAParser to extend custom detection rules
  • Add new device vendor: Blackview, Coolpad, CUBOT, T-Mobile
  • Improve browser detection: Huawei Browser, UCBrowser
  • Improve OS detection: iOS
  • Identify WebView user-agent as inapp browser
  • extensions submodule:
    • Add new crawler: atlassian-bot, Audisto Crawler, AwarioBot, AwarioRssBot, AwarioSmartBot, BrightEdge Crawler, HubSpot Crawler, Meta-ExternalAds, Meta-WebIndexer, proximic, yacybot
    • Add new fetcher: Feedly, GoogleDocs, UptimeBot, virustotal
    • Add new library: phpcrawl
  • helpers submodule:
    • Fix isElectron() function return itself

Version 2.0.9

  • Restore icons directory
  • Add new browser: Aloha Browser, Avira Secure Browser, Lighthouse, Luakit, Norton Private Browser
  • Add new OS: Vega OS
  • Improve OS detection: watchOS
  • extensions submodule:
    • Add new crawler: atlassian-bot, Cloudflare-AutoRAG, Google-NotebookLM, SemrushBot-SWA
    • Add new fetcher: FlipboardProxy

Version 2.0.8

  • Resolve syntax error related to import renaming in ESM build
  • Add new browser: HiBrowser, Opera Neon
  • Add new engine: Dillo
  • Improve browser detection: Brave, TikTok
  • Improve device detection: OnePlus
  • Improve OS detection: Firefox OS
  • extensions submodule:
    • Add new CLI: PowerShell
    • Add new email: Alpine, Android, AquaMail, Balsa, Barca, Canary, Claws Mail, eM Client, Eudora, FairEmail, Geary, Gnus, Horde::IMP, Lotus-Notes, IncrediMail, K-9 Mail, Mailbird, MailMate, Mailspring, Mutt, Newton, Nine, NylasMail, Outlook-Express, Pegasus Mail, PocoMail, Postbox, ProtonMail Bridge, Quala, R2Mail2, Rainloop, Roundcube Webmail, SamsungEmail, Spicebird, SquirrelMail, Sylpheed, The Bat!, Trojita, Turnpike, tutanota-desktop, Wanderlust, Windows-Live-Mail
    • Add new library: http.rb, Jetty, ocaml-cohttp
  • helpers submodule:
    • Add new method: getOutlookEdition() to map Outlook versions to their marketing editions

Version 2.0.7

  • Add support for chaining withClientHints() & withFeatureCheck()
  • Add new browser: Atlas, Steam
  • Add new device vendor: Anbernic, Logitech, Valve
  • Improve device detection: Xiaomi
  • Improve OS detection: iOS
  • Split helpers submodule into several new submodules:
    • bot-detection:
      • isAIAssistant()

... (truncated)

Commits
  • 4121c59 Build: Bump version 2.0.10
  • 90354d3 Fix: Prevent ReDoS vulnerability by limiting Client Hints input length (GHSA-...
  • 3baa3bc Test: Increase nyc timeout to fix timeout error
  • 18d39b5 CI: Add GitHub Actions workflow to publish to Docker Hub
  • 58b5a0c Build: Add Dockerfile for container image build
  • 965c20d CI: Update fuzz test
  • ad97fea Build: Set sideEffects=false in package.json for tree shaking (#781)
  • 312598f CI: Add AI and spam detection to pull request workflow
  • 8f9e4dc Test: Fix relative path and update done() callback in CLI test spec
  • eb809ec Chore(license): Add THIRD_PARTY_NOTICES.md for third-party assets
  • Additional commits viewable in compare view

Updates postcss from 8.5.6 to 8.5.12

Release notes

Sourced from postcss's releases.

8.5.12

  • Fixed reading any file via user-generated CSS.
  • Added opts.unsafeMap to disable checks.

8.5.11

  • Fixed nested brackets parsing performance (by @​offset).

8.5.10

  • Fixed XSS via unescaped </style> in non-bundler cases (by @​TharVid).

8.5.9

  • Speed up source map encoding paring in case of the error.

8.5.8

  • Fixed Processor#version.

8.5.7

  • Improved source map annotation cleaning performance (by CodeAnt AI).
Changelog

Sourced from postcss's changelog.

8.5.12

  • Fixed reading any file via user-generated CSS.
  • Added opts.unsafeMap to disable checks.

8.5.11

  • Fixed nested brackets parsing performance (by @​offset).

8.5.10

  • Fixed XSS via unescaped </style> in non-bundler cases (by @​TharVid).

8.5.9

  • Speed up source map encoding paring in case of the error.

8.5.8

  • Fixed Processor#version.

8.5.7

  • Improved source map annotation cleaning performance (by CodeAnt AI).
Commits
  • 9bc81c4 Release 8.5.12 version
  • 85c4d7d Another try to fix coverage
  • 94484ca Try to fix coverage
  • c64b748 Load only .map source maps
  • aaec7b7 Avoid throwing JSON parsing errors for non-JSON source maps
  • 233fb26 Mention original author of the solution
  • 2502f75 Release 8.5.11 version
  • 5ca1901 Speed up parsing many nested brackets
  • 42b5337 Update dependencies
  • 7e36e15 Cache node.raws locally in Stringifier hot methods
  • Additional commits viewable in compare view

Updates nodemailer from 8.0.11 to 9.0.1

Release notes

Sourced from nodemailer's releases.

v9.0.1

9.0.1 (2026-06-17)

Bug Fixes

  • enforce disableFileAccess/disableUrlAccess for raw message option (a82e060)

v9.0.0

9.0.0 (2026-06-14)

⚠ BREAKING CHANGES

  • HTTPS requests made while fetching remote content (attachment href/path URLs, OAuth2 token endpoints, HTTP/HTTPS proxy CONNECT) now validate the server's TLS certificate by default. Requests to hosts with self-signed, expired, or hostname-mismatched certificates that previously succeeded will now fail. Opt back out per request with tls.rejectUnauthorized=false (transport options, or a per-attachment tls option).

Bug Fixes

  • replace deprecated url.parse with a WHATWG URL wrapper (0c080fb)
  • validate TLS certificates by default when fetching remote content (6a947ac)
Changelog

Sourced from nodemailer's changelog.

9.0.1 (2026-06-17)

Bug Fixes

  • enforce disableFileAccess/disableUrlAccess for raw message option (a82e060)

9.0.0 (2026-06-14)

⚠ BREAKING CHANGES

  • HTTPS requests made while fetching remote content (attachment href/path URLs, OAuth2 token endpoints, HTTP/HTTPS proxy CONNECT) now validate the server's TLS certificate by default. Requests to hosts with self-signed, expired, or hostname-mismatched certificates that previously succeeded will now fail. Opt back out per request with tls.rejectUnauthorized=false (transport options, or a per-attachment tls option).

Bug Fixes

  • replace deprecated url.parse with a WHATWG URL wrapper (0c080fb)
  • validate TLS certificates by default when fetching remote content (6a947ac)
Commits
  • 69cf625 chore(master): release 9.0.1 (#1828)
  • a82e060 fix: enforce disableFileAccess/disableUrlAccess for raw message option
  • 4e58450 chore: update dev dependencies
  • 541f5fd chore(master): release 9.0.0 (#1827)
  • 0c080fb fix: replace deprecated url.parse with a WHATWG URL wrapper
  • 6a947ac fix!: validate TLS certificates by default when fetching remote content
  • See full diff in compare view

Updates ua-parser-js from 2.0.6 to 2.0.10

Release notes

Sourced from ua-parser-js's releases.

v2.0.10

Version 2.0.10

  • Fix ReDoS vulnerability by limiting Client Hints input length (GHSA-9h5v-pfqq-x599)
  • Add new method useExtension() in UAParser to extend custom detection rules
  • Add new device vendor: Blackview, Coolpad, CUBOT, T-Mobile
  • Improve browser detection: Huawei Browser, UCBrowser
  • Improve OS detection: iOS
  • Identify WebView user-agent as inapp browser
  • extensions submodule:
    • Add new crawler: atlassian-bot, Audisto Crawler, AwarioBot, AwarioRssBot, AwarioSmartBot, BrightEdge Crawler, HubSpot Crawler, Meta-ExternalAds, Meta-WebIndexer, proximic, yacybot
    • Add new fetcher: Feedly, GoogleDocs, UptimeBot, virustotal
    • Add new library: phpcrawl
  • helpers submodule:
    • Fix isElectron() function return itself

What's Changed

New Contributors

Full Changelog: faisalman/ua-parser-js@2.0.9...2.0.10

v2.0.9

Version 2.0.9

  • Restore icons directory
  • Add new browser: Aloha Browser, Avira Secure Browser, Lighthouse, Luakit, Norton Private Browser
  • Add new OS: Vega OS
  • Improve OS detection: watchOS
  • extensions submodule:
    • Add new crawler: atlassian-bot, Cloudflare-AutoRAG, Google-NotebookLM, SemrushBot-SWA
    • Add new fetcher: FlipboardProxy

What's Changed

New Contributors

Full Changelog: faisalman/ua-parser-js@2.0.8...2.0.9

v2.0.8

Version 2.0.8

... (truncated)

Changelog

Sourced from ua-parser-js's changelog.

Version 2.0.10

  • Fix ReDoS vulnerability by limiting Client Hints input length (GHSA-9h5v-pfqq-x599)
  • Add new method useExtension() in UAParser to extend custom detection rules
  • Add new device vendor: Blackview, Coolpad, CUBOT, T-Mobile
  • Improve browser detection: Huawei Browser, UCBrowser
  • Improve OS detection: iOS
  • Identify WebView user-agent as inapp browser
  • extensions submodule:
    • Add new crawler: atlassian-bot, Audisto Crawler, AwarioBot, AwarioRssBot, AwarioSmartBot, BrightEdge Crawler, HubSpot Crawler, Meta-ExternalAds, Meta-WebIndexer, proximic, yacybot
    • Add new fetcher: Feedly, GoogleDocs, UptimeBot, virustotal
    • Add new library: phpcrawl
  • helpers submodule:
    • Fix isElectron() function return itself

Version 2.0.9

  • Restore icons directory
  • Add new browser: Aloha Browser, Avira Secure Browser, Lighthouse, Luakit, Norton Private Browser
  • Add new OS: Vega OS
  • Improve OS detection: watchOS
  • extensions submodule:
    • Add new crawler: atlassian-bot, Cloudflare-AutoRAG, Google-NotebookLM, SemrushBot-SWA
    • Add new fetcher: FlipboardProxy

Version 2.0.8

  • Resolve syntax error related to import renaming in ESM build
  • Add new browser: HiBrowser, Opera Neon
  • Add new engine: Dillo
  • Improve browser detection: Brave, TikTok
  • Improve device detection: OnePlus
  • Improve OS detection: Firefox OS
  • extensions submodule:
    • Add new CLI: PowerShell
    • Add new email: Alpine, Android, AquaMail, Balsa, Barca, Canary, Claws Mail, eM Client, Eudora, FairEmail, Geary, Gnus, Horde::IMP, Lotus-Notes, IncrediMail, K-9 Mail, Mailbird, MailMate, Mailspring, Mutt, Newton, Nine, NylasMail, Outlook-Express, Pegasus Mail, PocoMail, Postbox, ProtonMail Bridge, Quala, R2Mail2, Rainloop, Roundcube Webmail, SamsungEmail, Spicebird, SquirrelMail, Sylpheed, The Bat!, Trojita, Turnpike, tutanota-desktop, Wanderlust, Windows-Live-Mail
    • Add new library: http.rb, Jetty, ocaml-cohttp
  • helpers submodule:
    • Add new method: getOutlookEdition() to map Outlook versions to their marketing editions

Version 2.0.7

  • Add support for chaining withClientHints() & withFeatureCheck()
  • Add new browser: Atlas, Steam
  • Add new device vendor: Anbernic, Logitech, Valve
  • Improve device detection: Xiaomi
  • Improve OS detection: iOS
  • Split helpers submodule into several new submodules:
    • bot-detection:
      • isAIAssistant()

... (truncated)

Commits
  • 4121c59 Build: Bump version 2.0.10
  • 90354d3 Fix: Prevent ReDoS vulnerability by limiting Client Hints input length (GHSA-...
  • 3baa3bc Test: Increase nyc timeout to fix timeout error
  • 18d39b5 CI: Add GitHub Actions workflow to publish to Docker Hub
  • 58b5a0c Build: Add Dockerfile for container image build
  • 965c20d CI: Update fuzz test
  • ad97fea Build: Set sideEffects=false in package.json for tree shaking (#781)
  • 312598f CI: Add AI and spam detection to pull request workflow
  • 8f9e4dc Test: Fix relative path and update done() callback in CLI test spec
  • eb809ec Chore(license): Add THIRD_PARTY_NOTICES.md for third-party assets
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

…updates

Bumps the npm_and_yarn group with 3 updates in the / directory: [postcss](https://github.com/postcss/postcss), [nodemailer](https://github.com/nodemailer/nodemailer) and [ua-parser-js](https://github.com/faisalman/ua-parser-js).
Bumps the npm_and_yarn group with 3 updates in the /apps/web directory: [postcss](https://github.com/postcss/postcss), [nodemailer](https://github.com/nodemailer/nodemailer) and [ua-parser-js](https://github.com/faisalman/ua-parser-js).


Updates `postcss` from 8.5.6 to 8.5.12
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.6...8.5.12)

Updates `nodemailer` from 8.0.11 to 9.0.1
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](nodemailer/nodemailer@v8.0.11...v9.0.1)

Updates `ua-parser-js` from 2.0.6 to 2.0.10
- [Release notes](https://github.com/faisalman/ua-parser-js/releases)
- [Changelog](https://github.com/faisalman/ua-parser-js/blob/master/CHANGELOG.md)
- [Commits](faisalman/ua-parser-js@2.0.6...2.0.10)

Updates `postcss` from 8.5.6 to 8.5.12
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.6...8.5.12)

Updates `nodemailer` from 8.0.11 to 9.0.1
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](nodemailer/nodemailer@v8.0.11...v9.0.1)

Updates `ua-parser-js` from 2.0.6 to 2.0.10
- [Release notes](https://github.com/faisalman/ua-parser-js/releases)
- [Changelog](https://github.com/faisalman/ua-parser-js/blob/master/CHANGELOG.md)
- [Commits](faisalman/ua-parser-js@2.0.6...2.0.10)

---
updated-dependencies:
- dependency-name: postcss
  dependency-version: 8.5.12
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: nodemailer
  dependency-version: 9.0.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: ua-parser-js
  dependency-version: 2.0.10
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: postcss
  dependency-version: 8.5.12
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: nodemailer
  dependency-version: 9.0.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: ua-parser-js
  dependency-version: 2.0.10
  dependency-type: direct:production
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants