Bump the npm_and_yarn group across 3 directories with 18 updates by dependabot[bot] · Pull Request #33 · utilitywarehouse/create-react-app

dependabot · 2026-05-28T01:04:30Z

Bumps the npm_and_yarn group with 1 update in the /packages/create-react-app directory: tmp.
Bumps the npm_and_yarn group with 7 updates in the /packages/react-scripts directory:

Package	From	To
semver	`5.4.1`	`5.7.2`
semver	`5.3.0`	`5.7.2`
tmp	`0.0.33`	`removed`
webpack-dev-server	`2.7.1`	`5.2.4`
bn.js	`4.11.8`	`4.12.3`
brace-expansion	`1.1.8`	`1.1.15`
brace-expansion	`1.1.7`	`1.1.15`
handlebars	`4.0.10`	`4.7.9`
pbkdf2	`3.0.14`	`3.1.6`

Bumps the npm_and_yarn group with 8 updates in the /packages/react-scripts/template directory:

Package	From	To
semver	`5.5.0`	`5.7.2`
tmp	`0.0.33`	`removed`
ajv	`6.5.2`	`6.15.0`
bn.js	`4.11.8`	`4.12.3`
brace-expansion	`1.1.11`	`1.1.15`
handlebars	`4.0.11`	`4.7.9`
pbkdf2	`3.0.16`	`3.1.6`
immutable	`3.8.2`	`3.8.3`

Updates tmp from 0.0.31 to 0.2.6

Changelog

Sourced from tmp's changelog.

v0.2.2 (2024-02-28)

🐛 Bug Fix

#278 Closes #268: Revert "fix #246: remove any double quotes or single quotes… (@mbargiel)

📝 Documentation

#279 Closes #266: move paragraph on graceful cleanup to the head of the documentation (@silkentrance)

Committers: 5

Carsten Klein (@silkentrance)

Dave Nicolson (@dnicolson)

KARASZI István (@raszi)

Maxime Bargiel (@mbargiel)

@robertoaceves

v0.2.1 (2020-04-28)

🚀 Enhancement

#252 Closes #250: introduce tmpdir option for overriding the system tmp dir (@silkentrance)

🏠 Internal

#253 Closes #191: generate changelog from pull requests using lerna-changelog (@silkentrance)

Committers: 1

Carsten Klein (@silkentrance)

v0.2.0 (2020-04-25)

🚀 Enhancement

#234 feat: stabilize tmp for v0.2.0 release (@silkentrance)

🐛 Bug Fix

#231 Closes #230: regression after fix for #197 (@silkentrance)

#220 Closes #197: return sync callback when using the sync interface, otherwise return the async callback (@silkentrance)

#193 Closes #192: tmp must not exit the process on its own (@silkentrance)

📝 Documentation

#221 Gh 206 document name option (@silkentrance)

🏠 Internal

#226 Closes #212: enable direct name option test (@silkentrance)

#225 Closes #211: existing tests must clean up after themselves (@silkentrance)

#224 Closes #217: name tests must use tmpName (@silkentrance)

#223 Closes #214: refactor tests and lib (@silkentrance)

#198 Update dependencies to latest versions (@matsev)

... (truncated)

Commits

41f7159 Bump up the version
efa4a06 Merge commit from fork
7ef2728 Check for relative values
3d2fe38 Bump up the version
e162828 Merge pull request #309 from fflorent/fix-tmp-dir-with-dir
b847d2f Fix use of tmp.dir() with dir option
08fa3ab Update version
1cf4ec5 Merge commit from fork
188b25e Fix GHSA-52f5-9888-hmc6
73b9fe4 Add test case for GHSA-52f5-9888-hmc6
Additional commits viewable in compare view

Updates semver from 5.4.1 to 5.7.2

Release notes

Sourced from semver's releases.

v5.7.2

5.7.2 (2023-07-10)

Bug Fixes

2f8fd41 #585 better handling of whitespace (#585) (@joaomoreno, @lukekarrys)

Changelog

Sourced from semver's changelog.

5.7.2 (2023-07-10)

Bug Fixes

2f8fd41 #585 better handling of whitespace (#585) (@joaomoreno, @lukekarrys)

5.7

Add minVersion method

5.6

Move boolean loose param to an options object, with backwards-compatibility protection.

Add ability to opt out of special prerelease version handling with the includePrerelease option flag.

5.5

Add version coercion capabilities

5.4

Add intersection checking

5.3

Add minSatisfying method

5.2

Add prerelease(v) that returns prerelease components

5.1

Add Backus-Naur for ranges

Remove excessively cute inspection methods

5.0

Remove AMD/Browserified build artifacts

Fix ltr and gtr when using the * range

Fix for range * with a prerelease identifier

Commits

f8cc313 chore: release 5.7.2
2f8fd41 fix: better handling of whitespace (#585)
deb5ad5 chore: @npmcli/template-oss@4.16.0
c83c18c 5.7.1
956e228 Correct typo in README
8055dda 5.7.0
604e73d auto-publishing scripts
bed01e2 remove the nomin comments, since we don't minify any more anyway
9cb68f1 document parse method
38d42ca 5.7 changelog
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by lukekarrys, a new releaser for semver since your current version.

Updates semver from 5.3.0 to 5.7.2

Release notes

Sourced from semver's releases.

v5.7.2

5.7.2 (2023-07-10)

Bug Fixes

2f8fd41 #585 better handling of whitespace (#585) (@joaomoreno, @lukekarrys)

Changelog

Sourced from semver's changelog.

5.7.2 (2023-07-10)

Bug Fixes

2f8fd41 #585 better handling of whitespace (#585) (@joaomoreno, @lukekarrys)

5.7

Add minVersion method

5.6

Move boolean loose param to an options object, with backwards-compatibility protection.

Add ability to opt out of special prerelease version handling with the includePrerelease option flag.

5.5

Add version coercion capabilities

5.4

Add intersection checking

5.3

Add minSatisfying method

5.2

Add prerelease(v) that returns prerelease components

5.1

Add Backus-Naur for ranges

Remove excessively cute inspection methods

5.0

Remove AMD/Browserified build artifacts

Fix ltr and gtr when using the * range

Fix for range * with a prerelease identifier

Commits

f8cc313 chore: release 5.7.2
2f8fd41 fix: better handling of whitespace (#585)
deb5ad5 chore: @npmcli/template-oss@4.16.0
c83c18c 5.7.1
956e228 Correct typo in README
8055dda 5.7.0
604e73d auto-publishing scripts
bed01e2 remove the nomin comments, since we don't minify any more anyway
9cb68f1 document parse method
38d42ca 5.7 changelog
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by lukekarrys, a new releaser for semver since your current version.

Removes tmp

Updates webpack-dev-server from 2.7.1 to 5.2.4

Release notes

Sourced from webpack-dev-server's releases.

v5.2.4

5.2.4 (2026-05-11)

Bug Fixes

set Cross-Origin-Resource-Policy header to prevent source code theft over HTTP

v5.2.3

5.2.3 (2026-01-12)

Bug Fixes

add cause for errorObject (#5518) (37b033d)

compatibility with event target and universal target and lazy compilation (574026c)

overlay: add ESC key to dismiss overlay (#5598) (f91baa8)

progress indicator styles (#5557) (41a53a1)

upgrade selfsigned to v5

v5.2.2

5.2.2 (2025-06-03)

Bug Fixes

"Overlay enabled" false positive (18e72ee)

do not crush when error is null for runtime errors (#5447) (309991f)

remove unnecessary header X_TEST (#5451) (64a6124)

respect the allowedHosts option for cross-origin header check (#5510) (03d1214)

v5.2.1

5.2.1 (2025-03-26)

Security

cross-origin requests are not allowed unless allowed by Access-Control-Allow-Origin header

requests with an IP addresses in the Origin header are not allowed to connect to WebSocket server unless configured by allowedHosts or it different from the Host header

The above changes may make the dev server not work if you relied on such behavior, but unfortunately they carry security risks, so they were considered as fixes.

Bug Fixes

prevent overlay for errors caught by React error boundaries (#5431) (8c1abc9)

take the first network found instead of the last one, this restores the same behavior as 5.0.4 (#5411) (ffd0b86)

v5.2.0

5.2.0 (2024-12-11)

Features

... (truncated)

Changelog

Sourced from webpack-dev-server's changelog.

5.2.4 (2026-05-11)

Bug Fixes

set Cross-Origin-Resource-Policy header to prevent source code theft over HTTP

5.2.3 (2026-01-12)

Bug Fixes

add cause for errorObject (#5518) (37b033d)

compatibility with event target and universal target and lazy compilation (574026c)

overlay: add ESC key to dismiss overlay (#5598) (f91baa8)

progress indicator styles (#5557) (41a53a1)

upgrade selfsigned to v5

5.2.2 (2025-06-03)

Bug Fixes

"Overlay enabled" false positive (18e72ee)

do not crush when error is null for runtime errors (#5447) (309991f)

remove unnecessary header X_TEST (#5451) (64a6124)

respect the allowedHosts option for cross-origin header check (#5510) (03d1214)

5.2.1 (2025-03-26)

Security

cross-origin requests are not allowed unless allowed by Access-Control-Allow-Origin header

requests with an IP addresses in the Origin header are not allowed to connect to WebSocket server unless configured by allowedHosts or it different from the Host header

The above changes may make the dev server not work if you relied on such behavior, but unfortunately they carry security risks, so they were considered as fixes.

Bug Fixes

prevent overlay for errors caught by React error boundaries (#5431) (8c1abc9)

take the first network found instead of the last one, this restores the same behavior as 5.0.4 (#5411) (ffd0b86)

5.2.0 (2024-12-11)

Features

added getClientEntry and getClientHotEntry methods to get clients entries (dc642a8)

Bug Fixes

... (truncated)

Commits

fd40130 chore(release): 5.2.4
ece4f36 chore: update deps (#5661)
a216144 ci: fix test (#5658)
df073c5 Merge commit from fork
b550a70 chore(release): 5.2.3
9704dc5 chore: upgrade selfsigned to v5 and remove node-forge dependency (#5618)
92bf644 chore: bump express to update qs (#5621)
792b2f0 chore(deps-dev): bump the dependencies group with 4 updates (#5606)
6d587ca chore(deps): bump the dependencies group across 1 directory with 27 updates (...
f91baa8 fix(overlay): add ESC key to dismiss overlay (#5598)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by evilebottnawi, a new releaser for webpack-dev-server since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates bn.js from 4.11.8 to 4.12.3

Commits

39fe438 4.12.3
67ecb35 backport(4.x): fix imaskn state (#317)
c4098ba 4.12.2
6277fd7 backport(4.x): Fix imuln/muln with zero (backport of #313) (#314)
ac0d4af 4.12.1
a5f14b4 Fix serious issue in .toString(16) (#309)
0cd2661 Remove package-lock.json added by npm
84ae313 4.12.0
967ed0a fix: Buffer not using global in browser (#260)
6196232 Fix LE constructor for HEX (#265)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by fanatid, a new releaser for bn.js since your current version.

Updates brace-expansion from 1.1.8 to 1.1.15

Release notes

Sourced from brace-expansion's releases.

v1.1.15

Backport v5.0.6 change to v1 (#111) 0b09384

juliangruber/brace-expansion@v1.1.14...v1.1.15

v1.1.12

pkg: publish on tag 1.x c460dbd

fmt ccb8ac6

Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) c3c73c8

juliangruber/brace-expansion@v1.1.11...v1.1.12

v1.1.11

brace-expansion

Brace expansion, as known from sh/bash, in JavaScript.

Example
var expand = require('brace-expansion');
expand('file-{a,b,c}.jpg')
// => ['file-a.jpg', 'file-b.jpg', 'file-c.jpg']
expand('-v{,,}')
// => ['-v', '-v', '-v']
expand('file{0..2}.jpg')
// => ['file0.jpg', 'file1.jpg', 'file2.jpg']
expand('file-{a..c}.jpg')
// => ['file-a.jpg', 'file-b.jpg', 'file-c.jpg']
expand('file{2..0}.jpg')
// => ['file2.jpg', 'file1.jpg', 'file0.jpg']
expand('file{0..4..2}.jpg')
// => ['file0.jpg', 'file2.jpg', 'file4.jpg']
</tr></table>

... (truncated)

Commits

2203f4f 1.1.15
0b09384 Backport v5.0.6 change to v1 (#111)
10c05fc 1.1.14
1afa1b2 Add opt-in { max } mitigation to v1 legacy line (#103)
2fbb6a2 Revert "Backport fix for GHSA-7h2j-956f-4vf2 to v1 (#101)" (#102)
0d7652e Backport fix for GHSA-7h2j-956f-4vf2 to v1 (#101)
6c353ca 1.1.13
7fd684f Backport fix for GHSA-f886-m6hf-6m8v (#95)
44f33b4 1.1.12
c460dbd pkg: publish on tag 1.x
Additional commits viewable in compare view

Updates brace-expansion from 1.1.7 to 1.1.15

Release notes

Sourced from brace-expansion's releases.

v1.1.15

Backport v5.0.6 change to v1 (#111) 0b09384

juliangruber/brace-expansion@v1.1.14...v1.1.15

v1.1.12

pkg: publish on tag 1.x c460dbd

fmt ccb8ac6

Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) c3c73c8

juliangruber/brace-expansion@v1.1.11...v1.1.12

v1.1.11

brace-expansion

Brace expansion, as known from sh/bash, in JavaScript.

Example
var expand = require('brace-expansion');
expand('file-{a,b,c}.jpg')
// => ['file-a.jpg', 'file-b.jpg', 'file-c.jpg']
expand('-v{,,}')
// => ['-v', '-v', '-v']
expand('file{0..2}.jpg')
// => ['file0.jpg', 'file1.jpg', 'file2.jpg']
expand('file-{a..c}.jpg')
// => ['file-a.jpg', 'file-b.jpg', 'file-c.jpg']
expand('file{2..0}.jpg')
// => ['file2.jpg', 'file1.jpg', 'file0.jpg']
expand('file{0..4..2}.jpg')
// => ['file0.jpg', 'file2.jpg', 'file4.jpg']
</tr></table>

... (truncated)

Commits

2203f4f 1.1.15
0b09384 Backport v5.0.6 change to v1 (#111)
10c05fc 1.1.14
1afa1b2 Add opt-in { max } mitigation to v1 legacy line (#103)
2fbb6a2 Revert "Backport fix for GHSA-7h2j-956f-4vf2 to v1 (#101)" (#102)
0d7652e Backport fix for GHSA-7h2j-956f-4vf2 to v1 (#101)
6c353ca 1.1.13
7fd684f Backport fix for GHSA-f886-m6hf-6m8v (#95)
44f33b4 1.1.12
c460dbd pkg: publish on tag 1.x
Additional commits viewable in compare view

Updates path-to-regexp from 0.1.7 to 0.1.13

Release notes

Sourced from path-to-regexp's releases.

0.1.13

Important

Fix CVE-2026-4867 (GHSA-37ch-88jc-xwx2)

Full Changelog: pillarjs/path-to-regexp@v0.1.12...v.0.1.13

Fix backtracking (again)

Fixed

Improved backtracking protection for 0.1.x, will break some previously valid paths (see previous advisory: GHSA-9wv6-86v2-598j)

pillarjs/path-to-regexp@v0.1.11...v0.1.12

Error on bad input

Changed

Add error on bad input values 8f09549

pillarjs/path-to-regexp@v0.1.10...v0.1.11

Backtrack protection

Fixed

Add backtrack protection to parameters 29b96b4

This will break some edge cases but should improve performance

pillarjs/path-to-regexp@v0.1.9...v0.1.10

Support non-lookahead regex output

Added

Allow a non-lookahead regex (#312) c4272e4

component/path-to-regexp@v0.1.8...v0.1.9

Support named matching groups in RegExp

Added

Add support for named matching groups (#301) 114f62d

pillarjs/path-to-regexp@v0.1.7...v0.1.8

Changelog

Sourced from path-to-regexp's changelog.

0.1.13 / 2026-03-26

Fix CVE-2026-4867 (GHSA-37ch-88jc-xwx2)

Commits

9fd0c87 0.1.13 (#425)
7ccf02c fix: CVE-2026-4867
640e694 0.1.12
f01c26a Merge commit from fork
0c71192 0.1.11
8f09549 Add error on bad input values
c827fce 0.1.10
29b96b4 Add backtrack protection to parameters
ac4c234 Update repo url (#314)
bdb6635 0.1.9
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for path-to-regexp since your current version.

Updates minimatch from 3.0.3 to 3.0.4

Commits

e46989a v3.0.4
ddfacbd update brace-expansion
55ed736 update package scripts and deps
See full diff in compare view

Updates handlebars from 4.0.10 to 4.7.9

Release notes

Sourced from handlebars's releases.

v4.7.9

fix: enable shell mode for spawn to resolve Windows EINVAL issue - e0137c2

fix type "RuntimeOptions" also accepting string partials - eab1d14

feat(types): set hash to be a Record<string, any> - de4414d

fix non-contiguous program indices - 4512766

refactor: rename i to startPartIndex - e497a35

security: fix security issues - 68d8df5

GHSA-2w6w-674q-4c4q

GHSA-3mfm-83xf-c92r

GHSA-xhpv-hc6g-r9c6

GHSA-xjpj-3mr7-gcpf

GHSA-9cx6-37pm-9jff

GHSA-2qvq-rjwj-gvw9

GHSA-7rx3-28cr-v5wh

GHSA-442j-39wm-28r2

Commits

v4.7.8

Make library compatible with workers (#1894) - 3d3796c

Don't rely on Node.js global object (#1776) - 2954e7e

Fix compiling of each block params in strict mode (#1855) - 30dbf04

Fix rollup warning when importing Handlebars as ESM - 03d387b

Fix bundler issue with webpack 5 (#1862) - c6c6bbb

Use https instead of git for mustache submodule - 88ac068

Commits

Changelog

Sourced from handlebars's changelog.

v4.7.9 - March 26th, 2026

fix: enable shell mode for spawn to resolve Windows EINVAL issue - e0137c2

fix type "RuntimeOptions" also accepting string partials - eab1d14

feat(types): set hash to be a Record<string, any> - de4414d

fix non-contiguous program indices - 4512766

refactor: rename i to startPartIndex - e497a35

security: fix security issues - 68d8df5

Commits

v4.7.8 - July 27th, 2023

Make library compatible with workers (#1894) - 3d3796c

Don't rely on Node.js global object (#1776) - 2954e7e

Fix compiling of each block params in strict mode (#1855) - 30dbf04

Fix rollup warning when importing Handlebars as ESM - 03d387b

Fix bundler issue with webpack 5 (#1862) - c6c6bbb

Use https instead of git for mustache submodule - 88ac068

Commits

v4.7.7 - February 15th, 2021

fix weird error in integration tests - eb860c0

fix: check prototype property access in strict-mode (#1736) - b6d3de7

fix: escape property names in compat mode (#1736) - f058970

refactor: In spec tests, use expectTemplate over equals and shouldThrow (#1683) - 77825f8

chore: start testing on Node.js 12 and 13 - 3789a30

(POSSIBLY) BREAKING CHANGES:

the changes from version 4.6.0 now also apply in when using the compile-option "strict: true". Access to prototype properties is forbidden completely by default, specific properties or methods can be allowed via runtime-options. See #1633 for details. If you are using Handlebars as documented, you should not be accessing prototype properties from your template anyway, so the changes should not be a problem for you. Only the use of undocumented features can break your build.

That is why we only bump the patch version despite mentioning breaking changes.

Commits

v4.7.6 - April 3rd, 2020

Chore/Housekeeping:

#1672 - Switch cmd parser to latest minimist (@dougwilson

Compatibility notes:

Restored Node.js compatibility

... (truncated)

Commits

dce542c v4.7.9
8a41389 Update release notes
68d8df5 Fix security issues
b2a0831 Fix browser tests
9f98c16 Fix release script
45443b4 Revert "Improve partial indenting performance"
8841a5f Fix CI errors with linting
e0137c2 fix: enable shell mode for spawn to resolve Windows EINVAL issue
e914d60 Improve rendering performance
7de4b41 Upgrade GitHub Actions checkout and setup-node on 4.x branch
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by jaylinski, a new releaser for handlebars since your current version.

Updates lodash from 4.17.4 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

lodash: lodash/lodash@4.18.0-npm...4.18.1-npm

lodash-es: lodash/lodash@4.18.0-es...4.18.1-es

lodash-amd: lodash/lodash@4.18.0-amd...4.18.1-amd

lodash.templatelodash/lodash@4.18.0-npm-packages...4.18.1-npm-packages

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

Add security notice for _.template in threat model and API docs (#6099)

Document lower > upper behavior in _.random (#6115)

Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

lodash.orderby

lodash.tonumber

lodash.trim

lodash.trimend

lodash.sortedindexby

lodash.zipobjectdeep

lodash.unset

lodash.omit

lodash.template

Commits

cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
75535f5 chore: prune stale advisory refs (#6170)
62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
59be2de release(minor): bump to 4.18.0 (#6161)
af63457 fix: broken tests for _.template 879aaa9
1073a76 fix: linting issues
879aaa9 fix: validate imports keys in _.template
fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
b819080 ci: add dist sync validation workflow (#6137)
Additional commits viewable in compare view

Updates pbkdf2 from 3.0.14 to 3.1.6

Changelog

Sourced from pbkdf2's changelog.

v3.1.6 - 2026-05-26

Commits

[New] add TypeScript type declarations fb1f747

[Fix] coerce -0 keylen to +0 7c4a495

[Dev Deps] update @ljharb/eslint-config, @types/node, eslint, npmignore e3cce16

[...
Description has been truncated

Bumps the npm_and_yarn group with 1 update in the /packages/create-react-app directory: [tmp](https://github.com/raszi/node-tmp). Bumps the npm_and_yarn group with 7 updates in the /packages/react-scripts directory: | Package | From | To | | --- | --- | --- | | [semver](https://github.com/npm/node-semver) | `5.4.1` | `5.7.2` | | [semver](https://github.com/npm/node-semver) | `5.3.0` | `5.7.2` | | [tmp](https://github.com/raszi/node-tmp) | `0.0.33` | `removed` | | [webpack-dev-server](https://github.com/webpack/webpack-dev-server) | `2.7.1` | `5.2.4` | | [bn.js](https://github.com/indutny/bn.js) | `4.11.8` | `4.12.3` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.8` | `1.1.15` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.7` | `1.1.15` | | [handlebars](https://github.com/handlebars-lang/handlebars.js) | `4.0.10` | `4.7.9` | | [pbkdf2](https://github.com/browserify/pbkdf2) | `3.0.14` | `3.1.6` | Bumps the npm_and_yarn group with 8 updates in the /packages/react-scripts/template directory: | Package | From | To | | --- | --- | --- | | [semver](https://github.com/npm/node-semver) | `5.5.0` | `5.7.2` | | [tmp](https://github.com/raszi/node-tmp) | `0.0.33` | `removed` | | [ajv](https://github.com/ajv-validator/ajv) | `6.5.2` | `6.15.0` | | [bn.js](https://github.com/indutny/bn.js) | `4.11.8` | `4.12.3` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.11` | `1.1.15` | | [handlebars](https://github.com/handlebars-lang/handlebars.js) | `4.0.11` | `4.7.9` | | [pbkdf2](https://github.com/browserify/pbkdf2) | `3.0.16` | `3.1.6` | | [immutable](https://github.com/immutable-js/immutable-js) | `3.8.2` | `3.8.3` | Updates `tmp` from 0.0.31 to 0.2.6 - [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md) - [Commits](raszi/node-tmp@v0.0.31...v0.2.6) Updates `semver` from 5.4.1 to 5.7.2 - [Release notes](https://github.com/npm/node-semver/releases) - [Changelog](https://github.com/npm/node-semver/blob/v5.7.2/CHANGELOG.md) - [Commits](npm/node-semver@v5.4.1...v5.7.2) Updates `semver` from 5.3.0 to 5.7.2 - [Release notes](https://github.com/npm/node-semver/releases) - [Changelog](https://github.com/npm/node-semver/blob/v5.7.2/CHANGELOG.md) - [Commits](npm/node-semver@v5.4.1...v5.7.2) Removes `tmp` Updates `webpack-dev-server` from 2.7.1 to 5.2.4 - [Release notes](https://github.com/webpack/webpack-dev-server/releases) - [Changelog](https://github.com/webpack/webpack-dev-server/blob/main/CHANGELOG.md) - [Commits](webpack/webpack-dev-server@v2.7.1...v5.2.4) Updates `bn.js` from 4.11.8 to 4.12.3 - [Release notes](https://github.com/indutny/bn.js/releases) - [Changelog](https://github.com/indutny/bn.js/blob/master/CHANGELOG.md) - [Commits](indutny/bn.js@v4.11.8...v4.12.3) Updates `brace-expansion` from 1.1.8 to 1.1.15 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.8...v1.1.15) Updates `brace-expansion` from 1.1.7 to 1.1.15 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.8...v1.1.15) Updates `path-to-regexp` from 0.1.7 to 0.1.13 - [Release notes](https://github.com/pillarjs/path-to-regexp/releases) - [Changelog](https://github.com/pillarjs/path-to-regexp/blob/v.0.1.13/History.md) - [Commits](pillarjs/path-to-regexp@v0.1.7...v.0.1.13) Updates `minimatch` from 3.0.3 to 3.0.4 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v3.0.3...v3.0.4) Updates `handlebars` from 4.0.10 to 4.7.9 - [Release notes](https://github.com/handlebars-lang/handlebars.js/releases) - [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/v4.7.9/release-notes.md) - [Commits](handlebars-lang/handlebars.js@v4.0.10...v4.7.9) Updates `lodash` from 4.17.4 to 4.18.1 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.4...4.18.1) Updates `pbkdf2` from 3.0.14 to 3.1.6 - [Changelog](https://github.com/browserify/pbkdf2/blob/master/CHANGELOG.md) - [Commits](browserify/pbkdf2@v3.0.14...v3.1.6) Updates `semver` from 5.5.0 to 5.7.2 - [Release notes](https://github.com/npm/node-semver/releases) - [Changelog](https://github.com/npm/node-semver/blob/v5.7.2/CHANGELOG.md) - [Commits](npm/node-semver@v5.4.1...v5.7.2) Removes `tmp` Updates `webpack-dev-server` from 2.9.4 to 4.15.2 - [Release notes](https://github.com/webpack/webpack-dev-server/releases) - [Changelog](https://github.com/webpack/webpack-dev-server/blob/main/CHANGELOG.md) - [Commits](webpack/webpack-dev-server@v2.7.1...v5.2.4) Updates `ajv` from 6.5.2 to 6.15.0 - [Release notes](https://github.com/ajv-validator/ajv/releases) - [Commits](ajv-validator/ajv@v6.5.2...v6.15.0) Updates `bn.js` from 4.11.8 to 4.12.3 - [Release notes](https://github.com/indutny/bn.js/releases) - [Changelog](https://github.com/indutny/bn.js/blob/master/CHANGELOG.md) - [Commits](indutny/bn.js@v4.11.8...v4.12.3) Updates `brace-expansion` from 1.1.11 to 1.1.15 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.8...v1.1.15) Updates `uuid` from 2.0.3 to 3.3.2 - [Release notes](https://github.com/uuidjs/uuid/releases) - [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md) - [Commits](https://github.com/uuidjs/uuid/commits/v3.3.2) Updates `path-to-regexp` from 0.1.7 to 0.1.13 - [Release notes](https://github.com/pillarjs/path-to-regexp/releases) - [Changelog](https://github.com/pillarjs/path-to-regexp/blob/v.0.1.13/History.md) - [Commits](pillarjs/path-to-regexp@v0.1.7...v.0.1.13) Updates `qs` from 6.5.1 to 6.5.2 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.5.1...v6.5.2) Updates `minimatch` from 3.0.3 to 3.0.4 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v3.0.3...v3.0.4) Updates `handlebars` from 4.0.11 to 4.7.9 - [Release notes](https://github.com/handlebars-lang/handlebars.js/releases) - [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/v4.7.9/release-notes.md) - [Commits](handlebars-lang/handlebars.js@v4.0.10...v4.7.9) Updates `lodash` from 4.17.10 to 4.18.1 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.4...4.18.1) Updates `node-forge` from 0.7.5 to 1.4.0 - [Changelog](https://github.com/digitalbazaar/forge/blob/main/CHANGELOG.md) - [Commits](digitalbazaar/forge@0.7.5...v1.4.0) Updates `url-parse` from 1.4.1 to 1.5.10 - [Commits](unshiftio/url-parse@1.4.1...1.5.10) Updates `pbkdf2` from 3.0.16 to 3.1.6 - [Changelog](https://github.com/browserify/pbkdf2/blob/master/CHANGELOG.md) - [Commits](browserify/pbkdf2@v3.0.14...v3.1.6) Updates `immutable` from 3.8.2 to 3.8.3 - [Release notes](https://github.com/immutable-js/immutable-js/releases) - [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md) - [Commits](immutable-js/immutable-js@v3.8.2...v3.8.3) Updates `follow-redirects` from 1.5.1 to 1.16.0 - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.5.1...v1.16.0) Updates `serialize-javascript` from 1.5.0 to 4.0.0 - [Release notes](https://github.com/yahoo/serialize-javascript/releases) - [Commits](yahoo/serialize-javascript@v1.5.0...v4.0.0) --- updated-dependencies: - dependency-name: tmp dependency-version: 0.2.6 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: semver dependency-version: 5.7.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: semver dependency-version: 5.7.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tmp dependency-version: dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: webpack-dev-server dependency-version: 5.2.4 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: bn.js dependency-version: 4.12.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.15 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.15 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: path-to-regexp dependency-version: 0.1.13 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: minimatch dependency-version: 3.0.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: handlebars dependency-version: 4.7.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.18.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: pbkdf2 dependency-version: 3.1.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: semver dependency-version: 5.7.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tmp dependency-version: dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: webpack-dev-server dependency-version: 4.15.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ajv dependency-version: 6.15.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: bn.js dependency-version: 4.12.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.15 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: uuid dependency-version: 3.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: path-to-regexp dependency-version: 0.1.13 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.5.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: minimatch dependency-version: 3.0.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: handlebars dependency-version: 4.7.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.18.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: node-forge dependency-version: 1.4.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: url-parse dependency-version: 1.5.10 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: pbkdf2 dependency-version: 3.1.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: immutable dependency-version: 3.8.3 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: follow-redirects dependency-version: 1.16.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: serialize-javascript dependency-version: 4.0.0 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 28, 2026

This was referenced May 28, 2026

Bump tmp from 0.0.31 to 0.2.4 in /packages/create-react-app #7

Closed

Bump semver in /packages/react-scripts #27

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the npm_and_yarn group across 3 directories with 18 updates#33

Bump the npm_and_yarn group across 3 directories with 18 updates#33
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/packages/create-react-app/npm_and_yarn-7ec8c43798

dependabot Bot commented on behalf of github May 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github May 28, 2026

v0.2.2 (2024-02-28)

🐛 Bug Fix

📝 Documentation

Committers: 5

v0.2.1 (2020-04-28)

🚀 Enhancement

🏠 Internal

Committers: 1

v0.2.0 (2020-04-25)

🚀 Enhancement

🐛 Bug Fix

📝 Documentation

🏠 Internal

v5.7.2

5.7.2 (2023-07-10)

Bug Fixes

5.7.2 (2023-07-10)

Bug Fixes

5.7

5.6

5.5

5.4

5.3

5.2

5.1

5.0

v5.7.2

5.7.2 (2023-07-10)

Bug Fixes

5.7.2 (2023-07-10)

Bug Fixes

5.7

5.6

5.5

5.4

5.3

5.2

5.1

5.0

v5.2.4

5.2.4 (2026-05-11)

Bug Fixes

v5.2.3

5.2.3 (2026-01-12)

Bug Fixes

v5.2.2

5.2.2 (2025-06-03)

Bug Fixes

v5.2.1

5.2.1 (2025-03-26)

Security

Bug Fixes

v5.2.0

5.2.0 (2024-12-11)

Features

5.2.4 (2026-05-11)

Bug Fixes

5.2.3 (2026-01-12)

Bug Fixes

5.2.2 (2025-06-03)

Bug Fixes

5.2.1 (2025-03-26)

Security

Bug Fixes

5.2.0 (2024-12-11)

Features

Bug Fixes

v1.1.15

v1.1.12

v1.1.11

brace-expansion

Example

v1.1.15

v1.1.12

v1.1.11

brace-expansion

Example

0.1.13

Support named matching groups in `RegExp`

`lodash.*` modular packages