chore(deps): bump the npm_and_yarn group across 2 directories with 4 updates by dependabot[bot] · Pull Request #47 · nexoral/BanglaCode

dependabot · 2026-03-17T21:47:48Z

Bumps the npm_and_yarn group with 2 updates in the /Documentation directory: @opennextjs/cloudflare and minimatch.
Bumps the npm_and_yarn group with 2 updates in the /Extension directory: minimatch and undici.

Updates @opennextjs/cloudflare from 1.16.3 to 1.17.1

Release notes

Sourced from @opennextjs/cloudflare's releases.

@opennextjs/cloudflare@1.17.1

Patch Changes

#1147 f5bd138 Thanks @vicb! - make dev /cdn-cgi/image behaves like prod for consistency

@opennextjs/cloudflare@1.17.0

Minor Changes

#1133 25d5835 Thanks @dario-piotrowicz! - Update the migrate command to attempt to create an R2 bucket for caching, if that is not possible an application without caching enabled will be generated instead.

@opennextjs/cloudflare@1.16.6

Patch Changes

#1138 4487f1f Thanks @james-elicx! - Fix the CLI potentially setting a future compatibility date in the wrangler config when workerd has published a version matching a future date, by capping to the current date.

@opennextjs/cloudflare@1.16.5

Patch Changes

#1127 2b437f1 Thanks @dario-piotrowicz! - In the migrate command, add an initial step to create a Next.js config file (required by open-next) if it doesn't exist

#1126 8c3a36e Thanks @alex-all3dp! - fix: prevent Worker hang on HEAD requests to static assets

@opennextjs/cloudflare@1.16.4

Patch Changes

#1122 6c94a4a Thanks @dario-piotrowicz! - In migrate command, avoid adding unnecessary newlines when creating files

#1122 6c94a4a Thanks @dario-piotrowicz! - fix migrate command incorrectly erroring if the target application doesn't have a public directory

#1122 6c94a4a Thanks @dario-piotrowicz! - Bump @opennextjs/aws to 3.9.16

Fix migrate command not updating Next.js config files

Fixes #1062, #1115

See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v3.9.16

#1097 fea645f Thanks @dario-piotrowicz! - Add --help and --version to the opennextjs-cloudflare CLI

Improve the opennextjs-cloudflare CLI by:

ensuring that unknown commands (e.g., opennextjs-cloudflare foo) display a clear and helpful error message

adding a -h|--help flag to display the CLI's help message

adding a -v|--version flag to display the package's version

Changelog

Sourced from @opennextjs/cloudflare's changelog.

1.17.1

Patch Changes

#1147 f5bd138 Thanks @vicb! - make dev /cdn-cgi/image behaves like prod for consistency

1.17.0

Minor Changes

#1133 25d5835 Thanks @dario-piotrowicz! - Update the migrate command to attempt to create an R2 bucket for caching, if that is not possible an application without caching enabled will be generated instead.

1.16.6

Patch Changes

#1138 4487f1f Thanks @james-elicx! - Fix the CLI potentially setting a future compatibility date in the wrangler config when workerd has published a version matching a future date, by capping to the current date.

1.16.5

Patch Changes

#1127 2b437f1 Thanks @dario-piotrowicz! - In the migrate command, add an initial step to create a Next.js config file (required by open-next) if it doesn't exist

#1126 8c3a36e Thanks @alex-all3dp! - fix: prevent Worker hang on HEAD requests to static assets

1.16.4

Patch Changes

#1122 6c94a4a Thanks @dario-piotrowicz! - In migrate command, avoid adding unnecessary newlines when creating files

#1122 6c94a4a Thanks @dario-piotrowicz! - fix migrate command incorrectly erroring if the target application doesn't have a public directory

#1122 6c94a4a Thanks @dario-piotrowicz! - Bump @opennextjs/aws to 3.9.16

Fix migrate command not updating Next.js config files

Fixes #1062, #1115

See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v3.9.16

#1097 fea645f Thanks @dario-piotrowicz! - Add --help and --version to the opennextjs-cloudflare CLI

Improve the opennextjs-cloudflare CLI by:

ensuring that unknown commands (e.g., opennextjs-cloudflare foo) display a clear and helpful error message

adding a -h|--help flag to display the CLI's help message

adding a -v|--version flag to display the package's version

Commits

206794f Version Packages (#1149)
f5bd138 make dev /cdn-cgi/image behaves like prod for consistency (#1147)
e965e4d refactor: creation of config files (#1146)
7d86f42 Version Packages (#1143)
25d5835 Update the migrate command to attempt to create an R2 bucket for caching as...
2e4e595 Version Packages (#1140)
4487f1f fix: future compat date set in wrangler config (#1138)
63e29f2 Version Packages (#1128)
2b437f1 In the migrate command, add an initial step to create a Next.js config file...
8c3a36e fix: prevent Worker hang on HEAD requests to static assets (#1126)
Additional commits viewable in compare view

Updates fast-xml-parser from 4.2.5 to 5.4.1

Release notes

Sourced from fast-xml-parser's releases.

Separate Builder

XML Builder was the part of fast-xml-parser for years. But considering that any bug in builder may false-alarm the users who are only using parser and vice-versa, we have decided to split it into a separate package.

Migration

To migrate to fast-xml-builder;

From
import { XMLBuilder } from "fast-xml-parser";
To
import  XMLBuilder  from "fast-xml-builder";
XMLBuilder will be removed from current package in any next major version of this library. So better to migrate.

support strictReservedNames

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.3.9...v5.3.9

handle non-array input for XML builder && support maxNestedTags

support maxNestedTags

handle non-array input for XML builder when preserveOrder is true (By Angelo Coetzee)

save use of js properies Full Changelog: NaturalIntelligence/fast-xml-parser@v5.3.7...v5.3.8

CJS typing fix

What's Changed

Unexport X2jOptions at declaration site by @Drarig29 in NaturalIntelligence/fast-xml-parser#787

New Contributors

@Drarig29 made their first contribution in NaturalIntelligence/fast-xml-parser#787

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.3.6...v5.3.7

Entity security and performance

Improve security and performance of entity processing

new options maxEntitySize, maxExpansionDepth, maxTotalExpansions, maxExpandedLength, allowedTags,tagFilter

fast return when no edtity is present

improvement replacement logic to reduce number of calls

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.3.5...v5.3.6

v5.3.5

What's Changed

Add missing exports to fxp commonjs types by @jeremymeng in NaturalIntelligence/fast-xml-parser#782

fix: Escape regex char in entity name

... (truncated)

Changelog

Sourced from fast-xml-parser's changelog.

Note: If you find missing information about particular minor version, that version must have been changed without any functional change in this library.

Note: Due to some last quick changes on v4, detail of v4.5.3 & v4.5.4 are not updated here. v4.5.4x is the last tag of v4 in github repository. I'm extremely sorry for the confusion

5.5.6 / 2026-03-16

update builder dependency

fix incorrect regex to replace . in entity name

fix check for entitiy expansion for lastEntities and html entities too

5.5.5 / 2026-03-13

sanitize dangerous tag or attribute name

error on critical property name

support onDangerousProperty option

5.5.4 / 2026-03-13

declare Matcher & Expression as unknown so user is not forced to install path-expression-matcher

5.5.3 / 2026-03-11

upgrade builder

5.5.2 / 2026-03-11

update dependency to fix typings

5.5.1 / 2026-03-10

fix dependency

5.5.0 / 2026-03-10

support path-expression-matcher

fix: stopNode should not be parsed

performance improvement for stopNode checking

5.4.2 / 2026-03-03

support maxEntityCount option

5.4.1 / 2026-02-25

fix (#785) unpairedTag node should not have tag content

5.4.0 / 2026-02-25

migrate to fast-xml-builder

5.3.9 / 2026-02-25

support strictReservedNames

5.3.8 / 2026-02-25

support maxNestedTags

handle non-array input for XML builder when preserveOrder is true (By Angelo Coetzee)

save use of js properies

5.3.7 / 2026-02-20

... (truncated)

Commits

4e7ca80 update release info
36023b4 fix (#785) unpairedTag node should not have tag content
b366026 separate builder
6f333a8 update release info
c3ffbab support strictReservedNames
c692040 update release info
107e34c avoid {} to create an empty object
60835a4 support maxNestedTags
f55657c avoid direct call to hasOwnProperty
c13a961 handle non-array input for XML builder when preserveOrder is true
Additional commits viewable in compare view

Updates minimatch from 3.1.2 to 3.1.5

Commits

7bba978 3.1.5
bd25942 docs: add warning about ReDoS
1a9c27c fix partial matching of globstar patterns
1a2e084 3.1.4
ae24656 update lockfile
b100374 limit recursion for **, improve perf considerably
26ffeaa lockfile update
9eca892 lock node version to 14
00c323b 3.1.3
30486b2 update CI matrix and actions
Additional commits viewable in compare view

Updates undici from 7.18.2 to 7.24.4

Release notes

Sourced from undici's releases.

v7.24.4

What's Changed

fix(fetch): handle URL credentials in dispatch path extraction by @mcollina in nodejs/undici#4892

Full Changelog: nodejs/undici@v7.24.3...v7.24.4

v7.24.3

What's Changed

fix(h2): TypeError: Cannot read properties of null (reading 'push') i… by @hxinhan in nodejs/undici#4881

Full Changelog: nodejs/undici@v7.24.2...v7.24.3

v7.24.2

What's Changed

fix fetch path logic by @KhafraDev in nodejs/undici#4890

remove maxDecompressedMessageSize by @KhafraDev in nodejs/undici#4891

Full Changelog: nodejs/undici@v7.24.1...v7.24.2

v7.24.1

What's Changed

fix: proto pollution by @rahulyadav5524 in nodejs/undici#4885

Full Changelog: nodejs/undici@v7.24.0...v7.24.1

v7.24.0

Undici v7.24.0 Security Release Notes

This release addresses multiple security vulnerabilities in Undici.

Upgrade guidance

All users on v7 should upgrade to v7.24.0 or later.

Fixed advisories

GHSA-2mjp-6q6p-2qxm / CVE-2026-1525 (Medium)
Inconsistent interpretation of HTTP requests (request/response smuggling class issue).

GHSA-f269-vfmq-vjvj / CVE-2026-1528 (High)
Malicious WebSocket 64-bit frame length handling could crash the client.

GHSA-phc3-fgpg-7m6h / CVE-2026-2581 (Medium)
Unbounded memory consumption in deduplication interceptor response buffering (DoS risk).

GHSA-4992-7rv2-5pvq / CVE-2026-1527 (Medium)

... (truncated)

Commits

4991f3e Bumped v7.24.4
ea3a06d fix(fetch): preserve path for credentialed URLs (#4892)
9b96516 Bumped v7.24.3
7926660 Ignore .githuman
9eaa5af fix(h2): TypeError: Cannot read properties of null (reading 'push') in Reques...
a9bfe21 ignore .pi
f2e155b Bumped v7.24.2
4d2d1af remove maxDecompressedMessageSize (#4891)
3a05a4f fix fetch path logic (#4890)
23e3cd3 Bumped v7.24.1
Additional commits viewable in compare view

Updates minimatch from 10.1.2 to 10.2.4

Commits

7bba978 3.1.5
bd25942 docs: add warning about ReDoS
1a9c27c fix partial matching of globstar patterns
1a2e084 3.1.4
ae24656 update lockfile
b100374 limit recursion for **, improve perf considerably
26ffeaa lockfile update
9eca892 lock node version to 14
00c323b 3.1.3
30486b2 update CI matrix and actions
Additional commits viewable in compare view

Updates minimatch from 3.1.2 to 3.1.5

Commits

7bba978 3.1.5
bd25942 docs: add warning about ReDoS
1a9c27c fix partial matching of globstar patterns
1a2e084 3.1.4
ae24656 update lockfile
b100374 limit recursion for **, improve perf considerably
26ffeaa lockfile update
9eca892 lock node version to 14
00c323b 3.1.3
30486b2 update CI matrix and actions
Additional commits viewable in compare view

Updates undici from 7.21.0 to 7.24.4

Release notes

Sourced from undici's releases.

v7.24.4

What's Changed

fix(fetch): handle URL credentials in dispatch path extraction by @mcollina in nodejs/undici#4892

Full Changelog: nodejs/undici@v7.24.3...v7.24.4

v7.24.3

What's Changed

fix(h2): TypeError: Cannot read properties of null (reading 'push') i… by @hxinhan in nodejs/undici#4881

Full Changelog: nodejs/undici@v7.24.2...v7.24.3

v7.24.2

What's Changed

fix fetch path logic by @KhafraDev in nodejs/undici#4890

remove maxDecompressedMessageSize by @KhafraDev in nodejs/undici#4891

Full Changelog: nodejs/undici@v7.24.1...v7.24.2

v7.24.1

What's Changed

fix: proto pollution by @rahulyadav5524 in nodejs/undici#4885

Full Changelog: nodejs/undici@v7.24.0...v7.24.1

v7.24.0

Undici v7.24.0 Security Release Notes

This release addresses multiple security vulnerabilities in Undici.

Upgrade guidance

All users on v7 should upgrade to v7.24.0 or later.

Fixed advisories

GHSA-2mjp-6q6p-2qxm / CVE-2026-1525 (Medium)
Inconsistent interpretation of HTTP requests (request/response smuggling class issue).

GHSA-f269-vfmq-vjvj / CVE-2026-1528 (High)
Malicious WebSocket 64-bit frame length handling could crash the client.

GHSA-phc3-fgpg-7m6h / CVE-2026-2581 (Medium)
Unbounded memory consumption in deduplication interceptor response buffering (DoS risk).

GHSA-4992-7rv2-5pvq / CVE-2026-1527 (Medium)

... (truncated)

Commits

4991f3e Bumped v7.24.4
ea3a06d fix(fetch): preserve path for credentialed URLs (#4892)
9b96516 Bumped v7.24.3
7926660 Ignore .githuman
9eaa5af fix(h2): TypeError: Cannot read properties of null (reading 'push') in Reques...
a9bfe21 ignore .pi
f2e155b Bumped v7.24.2
4d2d1af remove maxDecompressedMessageSize (#4891)
3a05a4f fix fetch path logic (#4890)
23e3cd3 Bumped v7.24.1
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

…updates Bumps the npm_and_yarn group with 2 updates in the /Documentation directory: [@opennextjs/cloudflare](https://github.com/opennextjs/opennextjs-cloudflare/tree/HEAD/packages/cloudflare) and [minimatch](https://github.com/isaacs/minimatch). Bumps the npm_and_yarn group with 2 updates in the /Extension directory: [minimatch](https://github.com/isaacs/minimatch) and [undici](https://github.com/nodejs/undici). Updates `@opennextjs/cloudflare` from 1.16.3 to 1.17.1 - [Release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases) - [Changelog](https://github.com/opennextjs/opennextjs-cloudflare/blob/main/packages/cloudflare/CHANGELOG.md) - [Commits](https://github.com/opennextjs/opennextjs-cloudflare/commits/@opennextjs/cloudflare@1.17.1/packages/cloudflare) Updates `fast-xml-parser` from 4.2.5 to 5.4.1 - [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases) - [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md) - [Commits](NaturalIntelligence/fast-xml-parser@v4.2.5...v5.4.1) Updates `minimatch` from 3.1.2 to 3.1.5 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v3.1.2...v3.1.5) Updates `undici` from 7.18.2 to 7.24.4 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.21.0...v7.24.4) Updates `minimatch` from 10.1.2 to 10.2.4 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v3.1.2...v3.1.5) Updates `minimatch` from 3.1.2 to 3.1.5 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v3.1.2...v3.1.5) Updates `undici` from 7.21.0 to 7.24.4 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.21.0...v7.24.4) --- updated-dependencies: - dependency-name: "@opennextjs/cloudflare" dependency-version: 1.17.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: fast-xml-parser dependency-version: 5.4.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: minimatch dependency-version: 3.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 7.24.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: minimatch dependency-version: 10.2.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: minimatch dependency-version: 3.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 7.24.4 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 17, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump the npm_and_yarn group across 2 directories with 4 updates#47

chore(deps): bump the npm_and_yarn group across 2 directories with 4 updates#47
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/Documentation/npm_and_yarn-1fa29c165d

dependabot bot commented on behalf of github Mar 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot bot commented on behalf of github Mar 17, 2026

@​opennextjs/cloudflare@​1.17.1

Patch Changes

@​opennextjs/cloudflare@​1.17.0

Minor Changes

@​opennextjs/cloudflare@​1.16.6

Patch Changes

@​opennextjs/cloudflare@​1.16.5

Patch Changes

@​opennextjs/cloudflare@​1.16.4

Patch Changes

1.17.1

Patch Changes

1.17.0

Minor Changes

1.16.6

Patch Changes

1.16.5

Patch Changes

1.16.4

Patch Changes

Separate Builder

Migration

support strictReservedNames

handle non-array input for XML builder && support maxNestedTags

CJS typing fix

What's Changed

New Contributors

Entity security and performance

v5.3.5

What's Changed

v7.24.4

What's Changed

v7.24.3

What's Changed

v7.24.2

What's Changed

v7.24.1

What's Changed

v7.24.0

Undici v7.24.0 Security Release Notes

Upgrade guidance

Fixed advisories

v7.24.4

What's Changed

v7.24.3

What's Changed

v7.24.2

What's Changed

v7.24.1

What's Changed

v7.24.0

Undici v7.24.0 Security Release Notes

Upgrade guidance

Fixed advisories

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`@opennextjs/cloudflare@1`.17.1

`@opennextjs/cloudflare@1`.17.0

`@opennextjs/cloudflare@1`.16.6

`@opennextjs/cloudflare@1`.16.5

`@opennextjs/cloudflare@1`.16.4