chore (deps): bump the patch-updates group with 6 updates by dependabot[bot] · Pull Request #14 · GCHQDeveloper581/CyberChef

dependabot · 2026-04-17T11:02:39Z

Bumps the patch-updates group with 6 updates:

Package	From	To
jimp	`1.6.0`	`1.6.1`
jsrsasign	`11.1.1`	`11.1.2`
protobufjs	`7.5.4`	`7.5.5`
grunt	`1.6.1`	`1.6.2`
postcss	`8.5.8`	`8.5.10`
webpack	`5.106.0`	`5.106.2`

Updates jimp from 1.6.0 to 1.6.1

Release notes

Sourced from jimp's releases.

v1.6.1

🎉 This release contains work from new contributors! 🎉

Thanks for all your work!

❤️ Denys Kashkovskyi (@Kashkovsky)

❤️ Viki (@vikiboss)

🐛 Bug Fix

fix docs imports (@hipstersmoothie)

@jimp/core, @jimp/plugin-quantize, @jimp/wasm-avif, @jimp/wasm-jpeg, @jimp/wasm-png, @jimp/wasm-webp

Update file-type from ^16 to ^21.3.3 in @jimp/core #1400 (@Kashkovsky @hipstersmoothie)

⚠️ Pushed to main

@jimp/core

Doc updates (closes #1342) (@hipstersmoothie)

📝 Documentation

docs: correct GitHub repo link #1340 (@vikiboss)

Authors: 3

Andrew Lisowski (@hipstersmoothie)

Denys Kashkovskyi (@Kashkovsky)

Viki (@vikiboss)

Changelog

Sourced from jimp's changelog.

v1.6.1 (Tue Apr 07 2026)

🎉 This release contains work from new contributors! 🎉

Thanks for all your work!

❤️ Denys Kashkovskyi (@Kashkovsky)

❤️ Viki (@vikiboss)

🐛 Bug Fix

fix docs imports (@hipstersmoothie)

@jimp/core, @jimp/plugin-quantize, @jimp/wasm-avif, @jimp/wasm-jpeg, @jimp/wasm-png, @jimp/wasm-webp

Update file-type from ^16 to ^21.3.3 in @jimp/core #1400 (@Kashkovsky @hipstersmoothie)

⚠️ Pushed to main

@jimp/core

Doc updates (closes #1342) (@hipstersmoothie)

📝 Documentation

docs: correct GitHub repo link #1340 (@vikiboss)

Authors: 3

Andrew Lisowski (@hipstersmoothie)

Denys Kashkovskyi (@Kashkovsky)

Viki (@vikiboss)

v1.5.0 (Mon Sep 09 2024)

Release Notes

Add support for image decoder options (#1336)

Can now have options for the underlying image codecs

🚀 Enhancement

@jimp/core, @jimp/types, @jimp/js-bmp, @jimp/js-jpeg, @jimp/js-png

Add support for image decoder options #1336 (@hipstersmoothie)

... (truncated)

Commits

7e6a956 Bump version to: v1.6.1 [skip ci]
cf9ed93 Update contributors [skip ci]
7851672 Update CHANGELOG.md [skip ci]
e1bfa93 Update file-type from ^16 to ^21.3.3 in @jimp/core (#1400)
b6b0e41 fix docs imports
c943994 docs: correct GitHub repo link (#1340)
f3e6b9e Doc updates (closes #1342)
See full diff in compare view

Updates jsrsasign from 11.1.1 to 11.1.2

Release notes

Sourced from jsrsasign's releases.

Security Fix

Changes from 11.1.1 to 11.1.2 (2026-Apr-12)

Security fixes:

HIGH: wrong random for for Node.JS >= 19 and modern browsers (ext/rng.js SecureRandom) reported by Bronson Yen of Calif.io and @Kr0emer #655.

HIGH: ASN.1 Parser Infinite Loop (asn1hex.js) getChildIdx fix to avoid infinite loop reported by Koda Reef.

HIGH: DSA Universal Signature Forgery (dsa.js) FIPS 186-4 section 4.7 wrong boundary checking in verifyWithMessageHash reported by Koda Reef, Nicholas Carlini and @Kr0emer.

ASN1HEX.getChildIdx DoS (asn1hex.js) getChildIdx may raise DoS because of lacking value length check reported by Yt(yutengsun) and Franciny S Roj.

missing JWS crit header parameter validation (jws.js) as reported by Franciny S Roj. Thank you indeed for those vulnerability reports and/or patches.

Changelog

Sourced from jsrsasign's changelog.

ChangeLog for jsrsasign

Changes from 11.1.1 to 11.1.2 (2026-Apr-12)

Security fixes:

HIGH: wrong random for for Node.JS >= 19 and modern browsers (ext/rng.js SecureRandom) reported by Bronson Yen of Calif.io and @Kr0emer #655.

HIGH: ASN.1 Parser Infinite Loop (asn1hex.js) getChildIdx fix to avoid infinite loop reported by Koda Reef.

HIGH: DSA Universal Signature Forgery (dsa.js) FIPS 186-4 section 4.7 wrong boundary checking in verifyWithMessageHash reported by Koda Reef, Nicholas Carlini and @Kr0emer.

ASN1HEX.getChildIdx DoS (asn1hex.js) getChildIdx may raise DoS because of lacking value length check reported by Yt(yutengsun) and Franciny S Roj.

missing JWS crit header parameter validation (jws.js) as reported by Franciny S Roj. Thank you indeed for those vulnerability reports and/or patches.

Changes from 11.1.0 to 11.1.1 (2026-Feb-20)

security fix for DSA and BigInteger

PR #651, #650, #649, #648, #647, #646, #645. Thank you @Kr0remer

After assigned CVE number reports will be added.

SECURITY.md added. Thank you @njg7194

restore KJUR.crypto.Cipher class without RSA/RSAOAEP support

Changes from 11.0.0 to 11.1.0 (2024-Feb-01)

src/crypto.js

restore KJUR.crypto.Cipher class without RSA and RSAOAEP encryption/decryption support

remove RSA and RSAOAEP encryption for Marvin attack

Changes from 10.9.0 to 11.0.0 (2024-Jan-16)

Major Changes:

Stop to support Internet Explorer.

Stop to support bower.

Modern ECMA functions will be introduced such as Promise, let, Array methods or class.

API document generator will be changed from Jsdoc Toolkit to JSDoc3.

Module bandler will be used such as browserify or webpack.

Not to use YUI compressor.

Unit test framework will be changed from QUnit and mocha to jest.

W3C Web Crypto API support.

split into some modules besides jsrsasign have been all in package before 11.0.0.

remove RSA PKCS#1.5 end OAEP encryption/decryption for Marvin attack (#598)

src/crypto.js

remove KJUR.crypto.Cipher class for RSA and RSAOAEP encryption/decryption

ext/{rsa,rsa2}.js remove encrypt/decrypt/encryptOAEP/decryptOAEP for RSAKey class

enhanced support for encrypted PKCS8

Changes from 10.8.6 to 10.9.0 (2023-Nov-27)

... (truncated)

Commits

d568de3 11.1.2 release
08f659d delete sponsorship
66ff9ba text update
d3370bf text update
See full diff in compare view

Updates protobufjs from 7.5.4 to 7.5.5

Changelog

Sourced from protobufjs's changelog.

Changelog

8.0.1 (2026-03-11)

Bug Fixes

bump protobufjs dependency version for cli package (#2128) (549b05e)

correct json syntax in tsconfig.json (#2120) (8065625)

descriptor: guard oneof index for non-Type parents (#2122) (1cac5cf)

do not allow setting proto in Message constructor (#2126) (f05e3c3)

filter invalid characters from the type name (#2127) (535df44)

8.0.0 (2025-12-16)

⚠ BREAKING CHANGES

add Edition 2024 Support (#2060)

Features

add Edition 2024 Support (#2060) (53e8492)

Commits

b7bdfaf chore: release 7.5.5
ff7b2af fix: filter invalid characters from the type name (#2127)
086b19d fix: do not allow setting proto in Message constructor (#2126)
See full diff in compare view

Maintainer changes

This version was pushed to npm by fenster, a new releaser for protobufjs since your current version.

Updates grunt from 1.6.1 to 1.6.2

Changelog

Sourced from grunt's changelog.

v1.6.2 date: 2026-04-14 changes: - Update minimatch to 3.1.5. (PR: gruntjs/grunt#1796) - Update nopt to 5.0.0. (PR: gruntjs/grunt#1778)

Commits

f49016e 1.6.2
662e097 Update minimatch to 3.1.5 to fix CVEs
a29fd18 CI: add Node.js 24 to version matrix
f757c4f Update links
b5aa834 Merge pull request #1792 from UlisesGascon/security-md
8d2dea2 docs: refresh security policy
aa15bdc Merge pull request #1786 from stscoundrel/ci-node-22
ee5b2a3 Merge pull request #1787 from gruntjs/add-commercial-support
c0e2b42 Readme updates re: support
c4f037d CI: update GH actions V3 -> V4
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by krinkle, a new releaser for grunt since your current version.

Updates postcss from 8.5.8 to 8.5.10

Release notes

Sourced from postcss's releases.

8.5.10

Fixed XSS via unescaped </style> in non-bundler cases (by @TharVid).

8.5.9

Speed up source map encoding paring in case of the error.

Changelog

Sourced from postcss's changelog.

8.5.10

Fixed XSS via unescaped </style> in non-bundler cases (by @TharVid).

8.5.9

Speed up source map encoding paring in case of the error.

Commits

33b9790 Release 8.5.10 version
536c79e Escape </style> in CSS output (#2074)
afa96b2 Update dependencies (#2073)
effe88b Typo (#2072)
3ee79a2 Thread model (#2071)
2e0683d Create incident response docs (#2070)
fe88ac2 Release 8.5.9 version
c551632 Avoid RegExp when we can use simple JS
89a6b74 Move SECURITY.txt for docs folder to keep GitHub page cleaner
6ceb8a4 Create SECURITY.md
Additional commits viewable in compare view

Updates webpack from 5.106.0 to 5.106.2

Release notes

Sourced from webpack's releases.

v5.106.2

Patch Changes

CSS @import now inherits the parent module's exportType, so a file configured as "text" correctly creates a style tag when @imported by a "style" parent. (by @xiaoxiaojx in #20838)

Make asset modules available in JS context when referenced from both CSS and a lazily compiled JS chunk. (by @xiaoxiaojx in #20801)

Include missing generator options in hash to ensure persistent cache invalidation when configuration changes (CssGenerator exportsOnly, JsonGenerator JSONParse, WebAssemblyGenerator mangleImports). (by @xiaoxiaojx in #20821)

Fix || default value handling in ProgressPlugin and ManifestPlugin that incorrectly overrode user-provided falsy values (e.g. modules: false, entries: false, entrypoints: false). (by @xiaoxiaojx in #20823)

Migrate from mime-types to mime-db. (by @alexander-akait in #20812)

Handle @charset at-rules in CSS modules. (by @alexander-akait in #20831)

Marked all experimental options in types. (by @alexander-akait in #20814)

v5.106.1

Patch Changes

Fix two ES5-environment regressions in the anonymous default export .name fix-up: the generated code referenced an undeclared __WEBPACK_DEFAULT_EXPORT__ binding causing ReferenceError, and used Reflect.defineProperty which is not available in pre-ES2015 runtimes. The fix-up now references the real assignment target and uses Object.defineProperty / Object.getOwnPropertyDescriptor. (by @xiaoxiaojx in #20796)

Prevent !important from being renamed as a local identifier in CSS modules. (by @xiaoxiaojx in #20798)

Use compiler context instead of module context for CSS modules local ident hashing to avoid hash collisions when files with the same name exist in different directories. (by @xiaoxiaojx in #20799)

Changelog

Sourced from webpack's changelog.

5.106.2

Patch Changes

CSS @import now inherits the parent module's exportType, so a file configured as "text" correctly creates a style tag when @imported by a "style" parent. (by @xiaoxiaojx in #20838)

Make asset modules available in JS context when referenced from both CSS and a lazily compiled JS chunk. (by @xiaoxiaojx in #20801)

Include missing generator options in hash to ensure persistent cache invalidation when configuration changes (CssGenerator exportsOnly, JsonGenerator JSONParse, WebAssemblyGenerator mangleImports). (by @xiaoxiaojx in #20821)

Fix || default value handling in ProgressPlugin and ManifestPlugin that incorrectly overrode user-provided falsy values (e.g. modules: false, entries: false, entrypoints: false). (by @xiaoxiaojx in #20823)

Migrate from mime-types to mime-db. (by @alexander-akait in #20812)

Handle @charset at-rules in CSS modules. (by @alexander-akait in #20831)

Marked all experimental options in types. (by @alexander-akait in #20814)

5.106.1

Patch Changes

Fix two ES5-environment regressions in the anonymous default export .name fix-up: the generated code referenced an undeclared __WEBPACK_DEFAULT_EXPORT__ binding causing ReferenceError, and used Reflect.defineProperty which is not available in pre-ES2015 runtimes. The fix-up now references the real assignment target and uses Object.defineProperty / Object.getOwnPropertyDescriptor. (by @xiaoxiaojx in #20796)

Prevent !important from being renamed as a local identifier in CSS modules. (by @xiaoxiaojx in #20798)

Use compiler context instead of module context for CSS modules local ident hashing to avoid hash collisions when files with the same name exist in different directories. (by @xiaoxiaojx in #20799)

Commits

0d7e3e0 chore(release): new release (#20815)
d5df118 chore(deps): bump actions/cache in the dependencies group (#20839)
5f0874b fix: make asset modules available in JS when referenced from CSS and lazy JS ...
b63ab37 chore(deps): bump test/test262-cases in the dependencies group (#20792)
313dfc5 ci: improve time for windows (#20840)
a553f61 test: update test262 (#20841)
1ef747c fix: CSS @import should inherit parent's exportType over parser config (#20838)
485d4ce chore(deps): update open-cli (#20834)
46042b9 chore(deps): no outdated strip-ansi (#20835)
8c7700b fix: handle @charset at-rules in CSS modules
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the patch-updates group with 6 updates: | Package | From | To | | --- | --- | --- | | [jimp](https://github.com/jimp-dev/jimp) | `1.6.0` | `1.6.1` | | [jsrsasign](https://github.com/kjur/jsrsasign) | `11.1.1` | `11.1.2` | | [protobufjs](https://github.com/protobufjs/protobuf.js) | `7.5.4` | `7.5.5` | | [grunt](https://github.com/gruntjs/grunt) | `1.6.1` | `1.6.2` | | [postcss](https://github.com/postcss/postcss) | `8.5.8` | `8.5.10` | | [webpack](https://github.com/webpack/webpack) | `5.106.0` | `5.106.2` | Updates `jimp` from 1.6.0 to 1.6.1 - [Release notes](https://github.com/jimp-dev/jimp/releases) - [Changelog](https://github.com/jimp-dev/jimp/blob/v1.6.1/CHANGELOG.md) - [Commits](jimp-dev/jimp@v1.6.0...v1.6.1) Updates `jsrsasign` from 11.1.1 to 11.1.2 - [Release notes](https://github.com/kjur/jsrsasign/releases) - [Changelog](https://github.com/kjur/jsrsasign/blob/master/ChangeLog.txt) - [Commits](kjur/jsrsasign@11.1.1...11.1.2) Updates `protobufjs` from 7.5.4 to 7.5.5 - [Release notes](https://github.com/protobufjs/protobuf.js/releases) - [Changelog](https://github.com/protobufjs/protobuf.js/blob/master/CHANGELOG.md) - [Commits](protobufjs/protobuf.js@protobufjs-v7.5.4...protobufjs-v7.5.5) Updates `grunt` from 1.6.1 to 1.6.2 - [Release notes](https://github.com/gruntjs/grunt/releases) - [Changelog](https://github.com/gruntjs/grunt/blob/main/CHANGELOG) - [Commits](gruntjs/grunt@v1.6.1...v1.6.2) Updates `postcss` from 8.5.8 to 8.5.10 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.8...8.5.10) Updates `webpack` from 5.106.0 to 5.106.2 - [Release notes](https://github.com/webpack/webpack/releases) - [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md) - [Commits](webpack/webpack@v5.106.0...v5.106.2) --- updated-dependencies: - dependency-name: jimp dependency-version: 1.6.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: patch-updates - dependency-name: jsrsasign dependency-version: 11.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: patch-updates - dependency-name: protobufjs dependency-version: 7.5.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: patch-updates - dependency-name: grunt dependency-version: 1.6.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: patch-updates - dependency-name: postcss dependency-version: 8.5.10 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: patch-updates - dependency-name: webpack dependency-version: 5.106.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: patch-updates ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-04-24T02:13:46Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 17, 2026

dependabot Bot closed this Apr 24, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/patch-updates-82f14583f1 branch April 24, 2026 02:13

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore (deps): bump the patch-updates group with 6 updates#14

chore (deps): bump the patch-updates group with 6 updates#14
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/npm_and_yarn/patch-updates-82f14583f1

dependabot Bot commented on behalf of github Apr 17, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Apr 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Apr 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v1.6.1

🐛 Bug Fix

⚠️ Pushed to main

📝 Documentation

Authors: 3

v1.6.1 (Tue Apr 07 2026)

🐛 Bug Fix

⚠️ Pushed to main

📝 Documentation

Authors: 3

v1.5.0 (Mon Sep 09 2024)

Release Notes

Add support for image decoder options (#1336)

🚀 Enhancement

Security Fix

Changelog

8.0.1 (2026-03-11)

Bug Fixes

8.0.0 (2025-12-16)

⚠ BREAKING CHANGES

Features

8.5.10

8.5.9

8.5.10

8.5.9

v5.106.2

Patch Changes

v5.106.1

Patch Changes

5.106.2

Patch Changes

5.106.1

Patch Changes

Uh oh!

dependabot Bot commented on behalf of github Apr 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Apr 17, 2026 •

edited

Loading

⚠️ Pushed to `main`

⚠️ Pushed to `main`