chore: bump the npm-low-risk group with 8 updates by dependabot[bot] · Pull Request #5053 · dequelabs/axe-core

dependabot · 2026-04-01T15:04:45Z

Bumps the npm-low-risk group with 8 updates:

Package	From	To
@babel/preset-env	`7.29.0`	`7.29.2`
@babel/runtime-corejs3	`7.29.0`	`7.29.2`
core-js	`3.48.0`	`3.49.0`
globals	`17.3.0`	`17.4.0`
lint-staged	`16.2.7`	`16.4.0`
serve-handler	`6.1.6`	`6.1.7`
sinon	`21.0.1`	`21.0.3`
start-server-and-test	`2.1.3`	`2.1.5`

Updates @babel/preset-env from 7.29.0 to 7.29.2

Release notes

Sourced from @babel/preset-env's releases.

v7.29.2 (2026-03-16)

👓 Spec Compliance

babel-parser

#17840 [7.x backport] async x => {} must be in leading pos (@JLHwung)

🐛 Bug Fix

babel-helpers, babel-plugin-transform-async-generator-functions, babel-preset-env, babel-runtime-corejs3

#17805 [7.x backport] fix: Properly handle await in finally (@liuxingbaoyu)

babel-preset-env

#17789 [7.x backport] preset-env include/exclude should accept bugfix plugins (@JLHwung)

🏠 Internal

#17813 chore: update eslint peer deps (@JLHwung)

Committers: 2

Huáng Jùnliàng (@JLHwung)

@liuxingbaoyu

v7.29.1 (2026-02-04)

🐛 Bug Fix

babel-standalone

#17771 [7.x backport] fix: ensure targets.esmodules is validated (@JLHwung)

babel-generator

#17776 [7.x backport] Fix undefined when 64 indents (@liuxingbaoyu)

Committers: 2

Huáng Jùnliàng (@JLHwung)

@liuxingbaoyu

Commits

37d5595 v7.29.2
1c0a08d [7.x backport] fix: Properly handle await in finally (#17805)
061bf95 [7.x backport] preset-env include/exclude should accept bugfix plugins (#17789)
See full diff in compare view

Updates @babel/runtime-corejs3 from 7.29.0 to 7.29.2

Release notes

Sourced from @babel/runtime-corejs3's releases.

v7.29.2 (2026-03-16)

👓 Spec Compliance

babel-parser

#17840 [7.x backport] async x => {} must be in leading pos (@JLHwung)

🐛 Bug Fix

babel-helpers, babel-plugin-transform-async-generator-functions, babel-preset-env, babel-runtime-corejs3

#17805 [7.x backport] fix: Properly handle await in finally (@liuxingbaoyu)

babel-preset-env

#17789 [7.x backport] preset-env include/exclude should accept bugfix plugins (@JLHwung)

🏠 Internal

#17813 chore: update eslint peer deps (@JLHwung)

Committers: 2

Huáng Jùnliàng (@JLHwung)

@liuxingbaoyu

v7.29.1 (2026-02-04)

🐛 Bug Fix

babel-standalone

#17771 [7.x backport] fix: ensure targets.esmodules is validated (@JLHwung)

babel-generator

#17776 [7.x backport] Fix undefined when 64 indents (@liuxingbaoyu)

Committers: 2

Huáng Jùnliàng (@JLHwung)

@liuxingbaoyu

Commits

37d5595 v7.29.2
1c0a08d [7.x backport] fix: Properly handle await in finally (#17805)
See full diff in compare view

Updates core-js from 3.48.0 to 3.49.0

Changelog

Sourced from core-js's changelog.

3.49.0 - 2026.03.16

Changes v3.48.0...v3.49.0 (373 commits)

Iterator.range updated following the actual spec version

Throw a RangeError on NaN start / end / step

Allow null as optionOrStep

Improved accuracy of Math.{ asinh, atanh } polyfills with big and small values

Improved accuracy of Number.prototype.toExponential polyfills with big and small values

Improved performance of atob, btoa, Uint8Array.fromHex, Uint8Array.prototype.setFromHex, and Uint8Array.prototype.toHex, #1503, #1464, #1510, thanks @johnzhou721

Minor performance optimization polyfills of methods from Map upsert proposal

Polyfills of methods from Map upsert proposal from the pure version made generic to make it work with polyfilled and native collections

Wrap Symbol.for in Symbol.prototype.description polyfill for correct handling of empty string descriptions

Fixed a modern Safari bug in Array.prototype.includes with sparse arrays and fromIndex

Fixed one more case (Iterator.prototype.take) of a V8 ~ Chromium < 126 bug

Forced replacement of Iterator.{ concat, zip, zipKeyed } in the pure version for ensuring proper wrapped Iterator instances as the result

Fixed proxying .return() on exhausted iterator from some methods of iterator helpers polyfill to the underlying iterator

Fixed double .return() calling in case of throwing error in this method in the internal iterate helper that affected some polyfills

Fixed closing iterator on IteratorValue errors in the internal iterate helper that affected some polyfills

Fixed iterator closing in Array.from polyfill on failure to create array property

Fixed order of arguments validation in Array.fromAsync polyfill

Fixed a lack of counter validation on MAX_SAFE_INTEGER in Array.fromAsync polyfill

Fixed order of arguments validation in Array.prototype.flat polyfill

Fixed handling strings as iterables in Iterator.{ zip, zipKeyed } polyfills

Fixed some cases of iterators closing in Iterator.{ zip, zipKeyed } polyfills

Fixed validation of iterators .next() results an objects in Iterator.{ zip, zipKeyed } polyfills

Fixed a lack of early error in Iterator.concat polyfill on primitive as an iterator

Fixed buffer mutation exposure in Iterator.prototype.windows polyfill

Fixed iterator closing in Set.prototype.{ isDisjointFrom, isSupersetOf } polyfill

Fixed (updated following the final spec) one more case Set.prototype.difference polyfill with updating this

Fixed DataView.prototype.setFloat16 polyfill in (0, 1) range

Fixed order of arguments validation in String.prototype.{ padStart, padEnd } polyfills

Fixed order of arguments validation in String.prototype.{ startsWith, endsWith } polyfills

Fixed some cases of Infinity handling in String.prototype.substr polyfill

Fixed String.prototype.repeat polyfill with a counter exceeding 2 ** 32

Fixed some cases of chars case in escape polyfill

Fixed named backreferences in RegExp NCG polyfill

Fixed some cases of RegExp NCG polyfill in combination with other types of groups

Fixed some cases of RegExp NCG polyfill in combination with dotAll

Fixed String.prototype.replace with sticky polyfill, #810, #1514

Fixed RegExp sticky polyfill with alternation

Fixed handling of some line terminators in case of multiline + sticky mode in RegExp polyfill

Fixed .input slicing on result object with RegExp sticky mode polyfill

Fixed handling of empty groups with global and unicode modes in polyfills

Fixed URLSearchParam.prototype.delete polyfill with duplicate key-value pairs

Fixed possible removal of unnecessary entries in URLSearchParam.prototype.delete polyfill with second argument

Fixed an error in some cases of non-special URLs without a path in the URL polyfill

Fixed some percent encode cases / character sets in the URL polyfill

Fixed parsing of non-IPv4 hosts ends in a number in the URL polyfill

Fixed some cases of '' and null host handling in the URL polyfill

Fixed host parsing with hostname = host:port in the URL polyfill

Fixed host inheritance in some cases of file scheme in the URL polyfill

... (truncated)

Commits

80adfc4 v3.49.0
0ad3e00 fix a modern Safari bug in Array.prototype.includes with sparse arrays and ...
853bfa4 update some links
b4d723f fix a lack of counter validation on MAX_SAFE_INTEGER in Array.fromAsync p...
e276676 fix parsing of non-IPv4 hosts ends in a number in the URL polyfill
dd1cfba fix order of arguments validation in String.prototype.{ padStart, padEnd } ...
b952c5f add an extra protection to configurator
e490caf Fix for #810 (#1514)
10b4e86 drop an unneeded comment
28cf2e9 feat: Improve performance of Uint8Array Hex functions (#1510)
Additional commits viewable in compare view

Updates globals from 17.3.0 to 17.4.0

Release notes

Sourced from globals's releases.

v17.4.0

Update globals (2026-03-01) (#338) d43a051

sindresorhus/globals@v17.3.0...v17.4.0

Commits

a9cfd74 17.4.0
d43a051 Update globals (2026-03-01) (#338)
See full diff in compare view

Updates lint-staged from 16.2.7 to 16.4.0

Release notes

Sourced from lint-staged's releases.

v16.4.0

Minor Changes

#1739 687fc90 Thanks @hyperz111! - Replace micromatch with picomatch to reduce dependencies.

v16.3.4

Patch Changes

#1742 9d6e827 Thanks @iiroj! - Update dependencies, including [email protected] to make sure local node_modules/.bin are preferred to global locations (released in [email protected]).

v16.3.3

Patch Changes

#1740 0109e8d Thanks @iiroj! - Make sure Git's warning about CRLF line-endings doesn't interfere with creating initial backup stash.

v16.3.2

Patch Changes

#1735 2adaf6c Thanks @iiroj! - Hide the extra cmd window on Windows by spawning tasks without the detached option.

v16.3.1

Patch Changes

#1729 cd5d762 Thanks @iiroj! - Remove nano-spawn as a dependency from package.json as it was replaced with tinyexec and is no longer used.

v16.3.0

Minor Changes

#1698 feda37a Thanks @iiroj! - Run external processes with tinyexec instead of nano-spawn. nano-spawn replaced execa in lint-staged version 16 to limit the amount of npm dependencies required, but caused some unknown issues related to spawning tasks. Let's hope tinyexec improves the situation.

#1699 1346d16 Thanks @iiroj! - Remove pidtree as a dependency. When a task fails, its sub-processes are killed more efficiently via the process group on Unix systems, and the taskkill command on Windows.

Patch Changes

#1726 87467aa Thanks @iiroj! - Incorrect brace expansions like *.{js} (nothing to expand) are detected exhaustively, instead of just a single pass.

Changelog

Sourced from lint-staged's changelog.

16.4.0

Minor Changes

#1739 687fc90 Thanks @hyperz111! - Replace micromatch with picomatch to reduce dependencies.

16.3.4

Patch Changes

#1742 9d6e827 Thanks @iiroj! - Update dependencies, including [email protected] to make sure local node_modules/.bin are preferred to global locations (released in [email protected]).

16.3.3

Patch Changes

#1740 0109e8d Thanks @iiroj! - Make sure Git's warning about CRLF line-endings doesn't interfere with creating initial backup stash.

16.3.2

Patch Changes

#1735 2adaf6c Thanks @iiroj! - Hide the extra cmd window on Windows by spawning tasks without the detached option.

16.3.1

Patch Changes

#1729 cd5d762 Thanks @iiroj! - Remove nano-spawn as a dependency from package.json as it was replaced with tinyexec and is no longer used.

16.3.0

Minor Changes

#1698 feda37a Thanks @iiroj! - Run external processes with tinyexec instead of nano-spawn. nano-spawn replaced execa in lint-staged version 16 to limit the amount of npm dependencies required, but caused some unknown issues related to spawning tasks. Let's hope tinyexec improves the situation.

#1699 1346d16 Thanks @iiroj! - Remove pidtree as a dependency. When a task fails, its sub-processes are killed more efficiently via the process group on Unix systems, and the taskkill command on Windows.

Patch Changes

#1726 87467aa Thanks @iiroj! - Incorrect brace expansions like *.{js} (nothing to expand) are detected exhaustively, instead of just a single pass.

Commits

445f9dd chore(changeset): release
d91be60 docs: update readme to use picomatch
b392a9f refactor: extract matchFiles and add unit tests
687fc90 refactor: replace micromatch with picomatch
26dadf9 chore(changeset): release
9d6e827 build(deps): update dependencies
8aea986 chore(changeset): release
0109e8d fix: strip Git CRLF warning from output
dfd6a7a chore(changeset): release
2adaf6c fix(Windows): do not spawn tasks as detached since it opens a cmd window on ...
Additional commits viewable in compare view

Updates serve-handler from 6.1.6 to 6.1.7

Release notes

Sourced from serve-handler's releases.

6.1.7

Patches

Fix: update minimatch to 3.1.5 to resolve security vulnerabilities: #228

Credits

Huge thanks to @ParakhJaggi for helping!

Commits

5158ae7 6.1.7
754d1dc fix: update minimatch to 3.1.5 to resolve security vulnerabilities (#228)
8b357fa Revert "chore(deps): upgrade minimatch to v10.2.4 (#226)"
8df54ef chore(deps): upgrade minimatch to v10.2.4 (#226)
See full diff in compare view

Updates sinon from 21.0.1 to 21.0.3

Changelog

Sourced from sinon's changelog.

21.0.3

0494251b fix(#2678): upgrade samsam to fix buffer comparisons (Carl-Erik Kopseng)

Released by Carl-Erik Kopseng on 2026-03-16.

21.0.2

024321c4 fix: skip Node specific tests in browser env (Carl-Erik Kopseng)

b836fccb fix: js-yaml breaking change from v3 to v4 (Carl-Erik Kopseng)

ebf0c431 docs: add how-to article for stubbing ES module imports (#1832) (#2676) (Eduard Barrera)

docs: add how-to article for stubbing ES module imports with esm package

Adds a comprehensive How-To guide that addresses issue #1832, documenting how to configure Node.js to allow Sinon stubs to work with ES modules.

Explains why ES module namespace bindings are immutable by spec

Shows how to use the 'esm' npm package with mutableNamespace: true

Provides a complete working example with project layout, package.json, loader file, source modules, and a full test suite

Documents limitations (destructured imports, non-standard behavior)

Replaces the TODO comment in link-seams-commonjs.md with a cross-reference

Closes #1832 Co-authored-by: Eduard Barrera [email protected] Co-authored-by: Carl-Erik Kopseng [email protected]

ebcd506c Fix spies not being reset properly (#2673) (simon-id)

3beab2ba Make doc tests pass with new jQuery (Carl-Erik Kopseng)

766715c6 build: reduce transitive audit findings (Carl-Erik Kopseng)

92aaf5c9 build: upgrade eslint config and replace dependency-check (Carl-Erik Kopseng)

c6aaa871 chore: ignore project worktrees (Carl-Erik Kopseng)

ef387e8e Upgrade most deps (Carl-Erik Kopseng)

3cf4e77d docs: improve writing of documentation (#2675) (Eduardo de la Cruz Palacios)

6349032f Check login status before publishing steps are performed (Carl-Erik Kopseng)

Released by Carl-Erik Kopseng on 2026-03-04.

Commits

1381482 21.0.3
0494251 fix(#2678): upgrade samsam to fix buffer comparisons
2d93d68 21.0.2
3af394e lint-staged -> 16.3.2
2948314 prettier
024321c fix: skip Node specific tests in browser env
b836fcc fix: js-yaml breaking change from v3 to v4
ebf0c43 docs: add how-to article for stubbing ES module imports (#1832) (#2676)
ebcd506 Fix spies not being reset properly (#2673)
3beab2b Make doc tests pass with new jQuery
Additional commits viewable in compare view

Updates start-server-and-test from 2.1.3 to 2.1.5

Release notes

Sourced from start-server-and-test's releases.

v2.1.5

2.1.5 (2026-02-24)

Bug Fixes

formatting the message in the constructor of Error object (#395) (9d135de)

v2.1.4

2.1.4 (2026-02-24)

Bug Fixes

deps: update dependency wait-on to v9.0.4 (#413) (f06f2a2)

the release process (#415) (59b3256)

Commits

9d135de fix: formatting the message in the constructor of Error object (#395)
59b3256 fix: the release process (#415)
f06f2a2 fix(deps): update dependency wait-on to v9.0.4 (#413)
See full diff in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for start-server-and-test since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Apr 1, 2026

dependabot Bot requested a review from a team as a code owner April 1, 2026 15:04

stephenmathieson approved these changes Apr 1, 2026

View reviewed changes

stephenmathieson merged commit f2b8935 into develop Apr 1, 2026
22 checks passed

stephenmathieson deleted the dependabot/npm_and_yarn/npm-low-risk-3d377224c9 branch April 1, 2026 17:49

pwsmaster approved these changes May 21, 2026

View reviewed changes

Navigation Menu

Uh oh!

chore: bump the npm-low-risk group with 8 updates - #5053

chore: bump the npm-low-risk group with 8 updates#5053
stephenmathieson merged 1 commit into
developfrom
dependabot/npm_and_yarn/npm-low-risk-3d377224c9

dependabot Bot commented on behalf of github Apr 1, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Apr 1, 2026

v7.29.2 (2026-03-16)

👓 Spec Compliance

🐛 Bug Fix

🏠 Internal

Committers: 2

v7.29.1 (2026-02-04)

🐛 Bug Fix

Committers: 2

v7.29.2 (2026-03-16)

👓 Spec Compliance

🐛 Bug Fix

🏠 Internal

Committers: 2

v7.29.1 (2026-02-04)

🐛 Bug Fix

Committers: 2

3.49.0 - 2026.03.16

v17.4.0

v16.4.0

Minor Changes

v16.3.4

Patch Changes

v16.3.3

Patch Changes

v16.3.2

Patch Changes

v16.3.1

Patch Changes

v16.3.0

Minor Changes

Patch Changes

16.4.0

Minor Changes

16.3.4

Patch Changes

16.3.3

Patch Changes

16.3.2

Patch Changes

16.3.1

Patch Changes

16.3.0

Minor Changes

Patch Changes

6.1.7

Patches

Credits

21.0.3

21.0.2

v2.1.5

2.1.5 (2026-02-24)

Bug Fixes

v2.1.4

2.1.4 (2026-02-24)

Bug Fixes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants