chore(deps): bump the patch-updates group with 4 updates by dependabot[bot] · Pull Request #13336 · serverless/serverless

dependabot · 2026-02-11T14:57:18Z

Bumps the patch-updates group with 4 updates: esbuild, semver, dotenv and axios.

Updates esbuild from 0.27.2 to 0.27.3

Release notes

v0.27.3
Preserve URL fragments in data URLs (#4370)

Consider the following HTML, CSS, and SVG:
index.html:
<!DOCTYPE html>
<html>
  <head><link rel="stylesheet" href="icons.css"></head>
  <body><div class="triangle"></div></body>
</html>
icons.css:
.triangle {
  width: 10px;
  height: 10px;
  background: currentColor;
  clip-path: url(./triangle.svg#x);
}
triangle.svg:
<svg xmlns="http://www.w3.org/2000/svg">
  <defs>
    <clipPath id="x">
      <path d="M0 0H10V10Z"/>
    </clipPath>
  </defs>
</svg>
The CSS uses a URL fragment (the #x) to reference the clipPath element in the SVG file. Previously esbuild's CSS bundler didn't preserve the URL fragment when bundling the SVG using the dataurl loader, which broke the bundled CSS. With this release, esbuild will now preserve the URL fragment in the bundled CSS:
/* icons.css */
.triangle {
  width: 10px;
  height: 10px;
  background: currentColor;
  clip-path: url('data:image/svg+xml,<svg xmlns="http://www.w3.org/2000/svg"><defs><clipPath id="x"><path d="M0 0H10V10Z"/></clipPath></defs></svg>#x');
}

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.27.3
Preserve URL fragments in data URLs (#4370)

Consider the following HTML, CSS, and SVG:
index.html:
<!DOCTYPE html>
<html>
  <head><link rel="stylesheet" href="icons.css"></head>
  <body><div class="triangle"></div></body>
</html>
icons.css:
.triangle {
  width: 10px;
  height: 10px;
  background: currentColor;
  clip-path: url(./triangle.svg#x);
}
triangle.svg:
<svg xmlns="http://www.w3.org/2000/svg">
  <defs>
    <clipPath id="x">
      <path d="M0 0H10V10Z"/>
    </clipPath>
  </defs>
</svg>
The CSS uses a URL fragment (the #x) to reference the clipPath element in the SVG file. Previously esbuild's CSS bundler didn't preserve the URL fragment when bundling the SVG using the dataurl loader, which broke the bundled CSS. With this release, esbuild will now preserve the URL fragment in the bundled CSS:
/* icons.css */
.triangle {
  width: 10px;
  height: 10px;
  background: currentColor;
  clip-path: url('data:image/svg+xml,<svg xmlns="http://www.w3.org/2000/svg"><defs><clipPath id="x"><path d="M0 0H10V10Z"/></clipPath></defs></svg>#x');
}

... (truncated)

Commits

9129e00 publish 0.27.3 to npm
e20e411 small fix to release notes
0dc0f2d fix #4322: parse and print CSS @scope rules
55fe391 update firefox css gradient support
2c35297 update gradient lowering transform
9209e44 Update Go to 1.25.7 (#4388)
e8d861b close #4374: compat table for the using feature
19b8887 no longer need williamkapke/node-compat-table
7e44218 the kangax/compat-table repo moved to a new url
23b9338 run make update-compat-table
Additional commits viewable in compare view

Updates semver from 7.7.3 to 7.7.4

Release notes

Sourced from semver's releases.

v7.7.4

7.7.4 (2026-01-16)

Bug Fixes

a29faa5 #835 cli: pass options to semver.valid() for loose version validation (#835) (@mldangelo)

Documentation

1d28d5e #836 fix typos and update -n CLI option documentation (#836) (@mldangelo)

Dependencies

120968b #840 @npmcli/[email protected] (#840)

Chores

44d7130 #824 bump @npmcli/eslint-config from 5.1.0 to 6.0.0 (#824) (@dependabot[bot])

7073576 #820 reorder parameters in invalid-versions.js test (#820) (@reggi)

5816d4c #829 bump @npmcli/template-oss from 4.28.0 to 4.28.1 (#829) (@dependabot[bot], @npm-cli-bot)

Changelog

Sourced from semver's changelog.

7.7.4 (2026-01-16)

Bug Fixes

a29faa5 #835 cli: pass options to semver.valid() for loose version validation (#835) (@mldangelo)

Documentation

1d28d5e #836 fix typos and update -n CLI option documentation (#836) (@mldangelo)

Dependencies

120968b #840 @npmcli/[email protected] (#840)

Chores

44d7130 #824 bump @npmcli/eslint-config from 5.1.0 to 6.0.0 (#824) (@dependabot[bot])

7073576 #820 reorder parameters in invalid-versions.js test (#820) (@reggi)

5816d4c #829 bump @npmcli/template-oss from 4.28.0 to 4.28.1 (#829) (@dependabot[bot], @npm-cli-bot)

Commits

5993c2e chore: release 7.7.4 (#839)
120968b deps: @npmcli/template-oss@4.29.0 (#840)
a29faa5 fix(cli): pass options to semver.valid() for loose version validation (#835)
1d28d5e docs: fix typos and update -n CLI option documentation (#836)
5816d4c chore: bump @npmcli/template-oss from 4.28.0 to 4.28.1 (#829)
ab9e28a chore: bump @npmcli/template-oss from 4.27.1 to 4.28.0 (#827)
44d7130 chore: bump @npmcli/eslint-config from 5.1.0 to 6.0.0 (#824)
7073576 chore: reorder parameters in invalid-versions.js test (#820)
16a35f5 chore: bump @npmcli/template-oss from 4.26.0 to 4.27.1 (#823)
3a3459d chore: bump @npmcli/template-oss from 4.25.1 to 4.26.0 (#818)
See full diff in compare view

Updates dotenv from 17.2.3 to 17.2.4

Changelog

Sourced from dotenv's changelog.

17.2.4 (2026-02-05)

Changed

Make DotenvPopulateInput accept NodeJS.ProcessEnv type (#915)

Give back to dotenv by checking out my newest project vestauth. It is auth for agents. Thank you for using my software.

Commits

See full diff in compare view

Updates axios from 1.13.4 to 1.13.5

Release notes

Sourced from axios's releases.

v1.13.5

Release 1.13.5

Highlights

Security: Fixed a potential Denial of Service issue involving the __proto__ key in mergeConfig. (PR #7369)

Bug fix: Resolved an issue where AxiosError could be missing the status field on and after v1.13.3. (PR #7368)

Changes

Security

Fix Denial of Service via __proto__ key in mergeConfig. (PR #7369)

Fixes

Fix/5657. (PR #7313)

Ensure status is present in AxiosError on and after v1.13.3. (PR #7368)

Features / Improvements

Add input validation to isAbsoluteURL. (PR #7326)

Refactor: bump minor package versions. (PR #7356)

Documentation

Clarify object-check comment. (PR #7323)

Fix deprecated Buffer constructor usage and README formatting. (PR #7371)

CI / Maintenance

Chore: fix issues with YAML. (PR #7355)

CI: update workflow YAMLs. (PR #7372)

CI: fix run condition. (PR #7373)

Dev deps: bump karma-sourcemap-loader from 0.3.8 to 0.4.0. (PR #7360)

Chore(release): prepare release 1.13.5. (PR #7379)

New Contributors

@sachin11063 (first contribution — PR #7323)

@asmitha-16 (first contribution — PR #7326)

Full Changelog: axios/axios@v1.13.4...v1.13.5

Commits

29f7542 chore(release): prepare release 1.13.5 (#7379)
431c3a3 ci: fix run condition (#7373)
9ff3a78 ci: update ymls (#7372)
265b712 docs: fix deprecated Buffer constructor and formatting issues in README (#7371)
475e75a feat: add input validation to isAbsoluteURL (#7326)
28c7215 fix: Denial of Service via proto Key in mergeConfig (#7369)
04cf019 docs: clarify object check comment (#7323)
696fa75 fix: status is missing in AxiosError on and after v1.13.3 (#7368)
569f028 fix: added a option to choose between legacy and the new request/response int...
44b7c9f chore(deps-dev): bump karma-sourcemap-loader (#7360)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Mmarzex · 2026-02-11T14:57:33Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Feb 11, 2026

czubocha approved these changes Feb 11, 2026

View reviewed changes

czubocha merged commit abee75c into main Feb 11, 2026
8 checks passed

czubocha deleted the dependabot/npm_and_yarn/patch-updates-6611b5448c branch February 11, 2026 15:14

github-actions bot locked and limited conversation to collaborators Feb 11, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Comments

chore(deps): bump the patch-updates group with 4 updates#13336

chore(deps): bump the patch-updates group with 4 updates#13336
czubocha merged 1 commit intomainfrom
dependabot/npm_and_yarn/patch-updates-6611b5448c

dependabot bot commented on behalf of github Feb 11, 2026

Uh oh!

Mmarzex commented Feb 11, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Comments

Conversation

dependabot bot commented on behalf of github Feb 11, 2026

v0.27.3

0.27.3

v7.7.4

7.7.4 (2026-01-16)

Bug Fixes

Documentation

Dependencies

Chores

7.7.4 (2026-01-16)

Bug Fixes

Documentation

Dependencies

Chores

17.2.4 (2026-02-05)

Changed

v1.13.5

Release 1.13.5

Highlights

Changes

Security

Fixes

Features / Improvements

Documentation

CI / Maintenance

New Contributors

Uh oh!

Mmarzex commented Feb 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Mmarzex commented Feb 11, 2026 •

edited

Loading