[PR #410] [MERGED] chore(deps-dev): bump nitropack from 2.13.3 to 2.13.4 #396

New Issue

2026-06-05T14:22:42-04:00

yindo commented

2026-06-05 14:22:42 -04:00

📋 Pull Request Information

Original PR: https://github.com/Drop-OSS/drop/pull/410
Author: @dependabot[bot]
Created: 5/8/2026
Status: ✅ Merged
Merged: 5/8/2026
Merged by: @DecDuck

Base: develop ← Head: dependabot/npm_and_yarn/nitropack-2.13.4

📝 Commits (1)

8a9a02b chore(deps-dev): bump nitropack from 2.13.3 to 2.13.4

📊 Changes

2 files changed (+1120 additions, -685 deletions)

View changed files

📝 pnpm-lock.yaml (+1119 -684)
📝 server/package.json (+1 -1)

📄 Description

Bumps nitropack from 2.13.3 to 2.13.4.

Release notes

Sourced from nitropack's releases.

v2.13.4

compare changes

[!IMPORTANT] This release patches two medium-severity vulnerabilities in proxy and redirect route rules. Users relying on either are strongly encouraged to upgrade. See GHSA-5w89-w975-hf9q and GHSA-9phm-9p8f-hw5m for details.

🚀 Enhancements

Add version meta (#4194)

🩹 Fixes

route-rules: Reject out-of-scope requests (#4223)

route-rules: Prevent open redirect via protocol-relative url bypass (8d6bfb0b)

🏡 Chore

❤️ Contributors

Pooya Parsa (@pi0)

Rihan Arfan (@RihanArfan)

Commits

f92e684 chore: apply automated updates
112e215 chore: basic dist-diff script
932f628 chore: ignore vite7 from pnpm outdated
705069f chore: update deps
bc1dd9d fix(route-rules): prevent open redirect via protocol-relative url bypass (#4236)
6edbf84 chore(deps): update all non-major dependencies (#4227)
feebdc1 refactor: use built-in escapeRegExp util (#4109)
f8cf6cc feat(tracing): enable tracing channels for unstorage (#4226)
0bbbb79 docs: improve jsdocs (#4199)
d0d8d91 types(vite): make experimental.vite optional (#4225)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Drop-OSS/drop/pull/410 **Author:** [@dependabot[bot]](https://github.com/apps/dependabot) **Created:** 5/8/2026 **Status:** ✅ Merged **Merged:** 5/8/2026 **Merged by:** [@DecDuck](https://github.com/DecDuck) **Base:** `develop` ← **Head:** `dependabot/npm_and_yarn/nitropack-2.13.4` --- ### 📝 Commits (1) - [`8a9a02b`](https://github.com/Drop-OSS/drop/commit/8a9a02b6fc0ae138bed14d5752992fb33bcf530d) chore(deps-dev): bump nitropack from 2.13.3 to 2.13.4 ### 📊 Changes **2 files changed** (+1120 additions, -685 deletions) <details> <summary>View changed files</summary> 📝 `pnpm-lock.yaml` (+1119 -684) 📝 `server/package.json` (+1 -1) </details> ### 📄 Description Bumps [nitropack](https://github.com/nitrojs/nitro) from 2.13.3 to 2.13.4. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/nitrojs/nitro/releases">nitropack's releases</a>.</em></p> <blockquote> <h2>v2.13.4</h2> <p><a href="https://github.com/nitrojs/nitro/compare/v2.13.2...v2.13.4">compare changes</a></p> <blockquote> <p>[!IMPORTANT] This release patches two medium-severity vulnerabilities in <code>proxy</code> and <code>redirect</code> route rules. Users relying on either are strongly encouraged to upgrade. See <a href="https://github.com/nitrojs/nitro/security/advisories/GHSA-5w89-w975-hf9q">GHSA-5w89-w975-hf9q</a> and <a href="https://github.com/nitrojs/nitro/security/advisories/GHSA-9phm-9p8f-hw5m">GHSA-9phm-9p8f-hw5m</a> for details.</p> </blockquote> <h3>🚀 Enhancements</h3> <ul> <li>Add version meta (<a href="https://redirect.github.com/nitrojs/nitro/pull/4194">#4194</a>)</li> </ul> <h3>🩹 Fixes</h3> <ul> <li><strong>route-rules:</strong> Reject out-of-scope requests (<a href="https://redirect.github.com/nitrojs/nitro/pull/4223">#4223</a>)</li> <li><strong>route-rules:</strong> Prevent open redirect via protocol-relative url bypass (<a href="https://github.com/nitrojs/nitro/commit/8d6bfb0b">8d6bfb0b</a>)</li> </ul> <h3>🏡 Chore</h3> <h3>❤️ Contributors</h3> <ul> <li>Pooya Parsa (<a href="https://github.com/pi0"><code>@pi0</code></a>)</li> <li>Rihan Arfan (<a href="https://github.com/RihanArfan"><code>@RihanArfan</code></a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/nitrojs/nitro/commit/f92e684736169f8b1d563fd6154060643d05f4bb"><code>f92e684</code></a> chore: apply automated updates</li> <li><a href="https://github.com/nitrojs/nitro/commit/112e2155f903f27ca1595e5d3e9734231cd8d75e"><code>112e215</code></a> chore: basic dist-diff script</li> <li><a href="https://github.com/nitrojs/nitro/commit/932f62856c6f8a6db589473417307a1f9d7738e7"><code>932f628</code></a> chore: ignore vite7 from pnpm outdated</li> <li><a href="https://github.com/nitrojs/nitro/commit/705069fef5b632e469ad15e07663b61d21c4d036"><code>705069f</code></a> chore: update deps</li> <li><a href="https://github.com/nitrojs/nitro/commit/bc1dd9dcd76ec08cbc029024edb2622d256da1dc"><code>bc1dd9d</code></a> fix(route-rules): prevent open redirect via protocol-relative url bypass (<a href="https://redirect.github.com/nitrojs/nitro/issues/4236">#4236</a>)</li> <li><a href="https://github.com/nitrojs/nitro/commit/6edbf84906a5d57df044ebfdbf6b9628cb74bf90"><code>6edbf84</code></a> chore(deps): update all non-major dependencies (<a href="https://redirect.github.com/nitrojs/nitro/issues/4227">#4227</a>)</li> <li><a href="https://github.com/nitrojs/nitro/commit/feebdc1e4b8624ab743e6f90af9bb047eb9056ca"><code>feebdc1</code></a> refactor: use built-in escapeRegExp util (<a href="https://redirect.github.com/nitrojs/nitro/issues/4109">#4109</a>)</li> <li><a href="https://github.com/nitrojs/nitro/commit/f8cf6ccc9e18d015b6c5bf1bc59d5510189d8bd1"><code>f8cf6cc</code></a> feat(tracing): enable tracing channels for unstorage (<a href="https://redirect.github.com/nitrojs/nitro/issues/4226">#4226</a>)</li> <li><a href="https://github.com/nitrojs/nitro/commit/0bbbb798d743177dda2a2c283bab41b61181a6a1"><code>0bbbb79</code></a> docs: improve jsdocs (<a href="https://redirect.github.com/nitrojs/nitro/issues/4199">#4199</a>)</li> <li><a href="https://github.com/nitrojs/nitro/commit/d0d8d9119a5e76db6f47f99c97a6fec67e426ce8"><code>d0d8d91</code></a> types(vite): make <code>experimental.vite</code> optional (<a href="https://redirect.github.com/nitrojs/nitro/issues/4225">#4225</a>)</li> <li>Additional commits viewable in <a href="https://github.com/nitrojs/nitro/compare/v2.13.3...v2.13.4">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=nitropack&package-manager=npm_and_yarn&previous-version=2.13.3&new-version=2.13.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/Drop-OSS/drop/network/alerts). </details> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

yindo added the pull-request label 2026-06-05 14:22:42 -04:00

yindo closed this issue

2026-06-05 14:22:42 -04:00

yindo referenced this issue

2026-06-07 16:02:22 -04:00

[PR #396] [CLOSED] chore(deps): bump follow-redirects from 1.15.11 to 1.16.0 in /desktop #383

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Drop-OSS/drop#396