Bump the npm_and_yarn group across 1 directory with 8 updates

[dependabot]

Bumps the npm_and_yarn group with 6 updates in the / directory:

Package	From	To
next	13.4.19	14.2.26
postcss	8.4.29	8.5.3
axios	0.26.1	1.9.0
alchemy-sdk	2.12.0	3.5.8
cross-spawn	7.0.3	7.0.6
micromatch	4.0.5	4.0.8

Updates next from 13.4.19 to 14.2.26

Release notes

Sourced from next's releases.

v14.2.26

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Match subrequest handling for edge and node (#77476)

v13.5.11

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Lock swc binaries version

v13.5.10

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Match subrequest handling for edge and node

v13.5.9

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary. This release contains a security patch for CVE-2025-29927.

Core Changes

• [backport] middleware subrequest patch (#77418)

Commits

• 10a042c v14.2.26
• 8a511d6 Match subrequest handling for edge and node (#77476)
• d36a1f3 v14.2.25
• 5fd3ae8 [backport] Update middleware request header (#77202)
• 756be15 v14.2.24
• ba6453d fix corepack keys
• c482c20 [backport v14] fix: ensure lint worker errors aren't silenced (#75766) (#75779)
• 5791cb6 [Backport v14] add additional x-middleware-set-cookie filtering (#75561) (#75...
• 8129a61 test: fix eslint plugin test (#75687)
• f27ce02 v14.2.23
• Additional commits viewable in compare view

Updates postcss from 8.4.29 to 8.5.3

Release notes

Sourced from postcss's releases.

8.5.3

• Added more details to Unknown word error (by @​hiepxanh).
• Fixed types (by @​romainmenke).
• Fixed docs (by @​catnipan).

8.5.2

• Fixed end position of rules with semicolon (by @​romainmenke).

8.5.1

• Fixed backwards compatibility for complex cases (by @​romainmenke).

8.5 “Duke Alloces”

PostCSS 8.5 brought API to work better with non-CSS sources like HTML, Vue.js/Svelte sources or CSS-in-JS.

@​romainmenke during his work on Stylelint added Input#document in additional to Input#css.

root.source.input.document //=> "<p>Hello</p>
                           //    <style>
                           //    p {
                           //      color: green;
                           //    }
                           //    </style>"
root.source.input.css      //=> "p {
                           //      color: green;
                           //    }"

Thanks to Sponsors

This release was possible thanks to our community.

If your company wants to support the sustainability of front-end infrastructure or wants to give some love to PostCSS, you can join our supporters by:

• Tidelift with a Spotify-like subscription model supporting all projects from your lock file.
• Direct donations at GitHub Sponsors or Open Collective.

8.4.49

• Fixed custom syntax without source.offset (by @​romainmenke).

8.4.48

• Fixed position calculation in error/warnings methods (by @​romainmenke).

8.4.47

• Removed debug code.

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.3

• Added more details to Unknown word error (by @​hiepxanh).
• Fixed types (by @​romainmenke).
• Fixed docs (by @​catnipan).

8.5.2

• Fixed end position of rules with semicolon (by @​romainmenke).

8.5.1

• Fixed backwards compatibility for complex cases (by @​romainmenke).

8.5 “Duke Alloces”

• Added Input#document for sources like CSS-in-JS or HTML (by @​romainmenke).

8.4.49

• Fixed custom syntax without source.offset (by @​romainmenke).

8.4.48

• Fixed position calculation in error/warnings methods (by @​romainmenke).

8.4.47

• Removed debug code.

8.4.46

• Fixed Cannot read properties of undefined (reading 'before').

8.4.45

• Removed unnecessary fix which could lead to infinite loop.

8.4.44

• Another way to fix markClean is not a function error.

8.4.43

• Fixed markClean is not a function error.

8.4.42

• Fixed CSS syntax error on long minified files (by @​varpstar).

8.4.41

• Fixed types (by @​nex3 and @​querkmachine).
• Cleaned up RegExps (by @​bluwy).

8.4.40

• Moved to getter/setter in nodes types to help Sass team (by @​nex3).

8.4.39

• Fixed CssSyntaxError types (by @​romainmenke).

8.4.38

• Fixed endIndex: 0 in errors and warnings (by @​romainmenke).

... (truncated)

Commits

• 22c309d Release 8.5.3 version
• a2b594f Update ESLint config
• 8232ba0 Fix tests
• 5082831 Fix text
• 4fdb54b update: parser.js to clarify error message
• 06006ec AtRule can be empty
• 755f08f fix typo: them -> then (#2016)
• 692fcde Release 8.5.2 version
• b70e98f Update dependencies
• ba587e3 Fix end position of rules with ownSemicon (#2012)
• Additional commits viewable in compare view

Updates axios from 0.26.1 to 1.9.0

Release notes

Sourced from axios's releases.

Release v1.9.0

Release notes:

Bug Fixes

• core: fix the Axios constructor implementation to treat the config argument as optional; (#6881) (6c5d4cd)
• fetch: fixed ERR_NETWORK mapping for Safari browsers; (#6767) (dfe8411)
• headers: allow iterable objects to be a data source for the set method; (#6873) (1b1f9cc)
• headers: fix getSetCookie by using 'get' method for caseless access; (#6874) (d4f7df4)
• headers: fixed support for setting multiple header values from an iterated source; (#6885) (f7a3b5e)
• http: send minimal end multipart boundary (#6661) (987d2e2)
• types: fix autocomplete for adapter config (#6855) (e61a893)

Features

• AxiosHeaders: add getSetCookie method to retrieve set-cookie headers values (#5707) (80ea756)

Contributors to this release

• Dmitriy Mozgovoy
• Jay
• Willian Agostini
• George Cheng
• FatahChan
• Ionuț G. Stan

Release v1.8.4

Release notes:

Bug Fixes

• buildFullPath: handle allowAbsoluteUrls: false without baseURL (#6833) (f10c2e0)

Contributors to this release

• Marc Hassan

Release v1.8.3

Release notes:

Bug Fixes

• add missing type for allowAbsoluteUrls (#6818) (10fa70e)
• xhr/fetch: pass allowAbsoluteUrls to buildFullPath in xhr and fetch adapters (#6814) (ec159e5)

Contributors to this release

• Ashcon Partovi
• StefanBRas
• Marc Hassan

Release v1.8.2

... (truncated)

Changelog

Sourced from axios's changelog.

1.9.0 (2025-04-24)

Bug Fixes

• core: fix the Axios constructor implementation to treat the config argument as optional; (#6881) (6c5d4cd)
• fetch: fixed ERR_NETWORK mapping for Safari browsers; (#6767) (dfe8411)
• headers: allow iterable objects to be a data source for the set method; (#6873) (1b1f9cc)
• headers: fix getSetCookie by using 'get' method for caseless access; (#6874) (d4f7df4)
• headers: fixed support for setting multiple header values from an iterated source; (#6885) (f7a3b5e)
• http: send minimal end multipart boundary (#6661) (987d2e2)
• types: fix autocomplete for adapter config (#6855) (e61a893)

Features

• AxiosHeaders: add getSetCookie method to retrieve set-cookie headers values (#5707) (80ea756)

Contributors to this release

• Dmitriy Mozgovoy
• Jay
• Willian Agostini
• George Cheng
• FatahChan
• Ionuț G. Stan

1.8.4 (2025-03-19)

Bug Fixes

• buildFullPath: handle allowAbsoluteUrls: false without baseURL (#6833) (f10c2e0)

Contributors to this release

• Marc Hassan

1.8.3 (2025-03-10)

Bug Fixes

• add missing type for allowAbsoluteUrls (#6818) (10fa70e)
• xhr/fetch: pass allowAbsoluteUrls to buildFullPath in xhr and fetch adapters (#6814) (ec159e5)

Contributors to this release

• Ashcon Partovi
• StefanBRas

... (truncated)

Commits

• cdcfd21 chore(release): v1.9.0 (#6891)
• 987d2e2 fix(http): send minimal end multipart boundary (#6661)
• f112edf chore(ci): add PR files guard action; (#6890)
• 61de4c0 chore(ci): update github actions; (#6889)
• c3aba3d chore(ci): add labeler github action; (#6888)
• f7a3b5e fix(headers): fixed support for setting multiple header values from an iterat...
• e61a893 fix(types): fix autocomplete for adapter config (#6855)
• 6c5d4cd fix(core): fix the Axios constructor implementation to treat the config argum...
• dfe8411 fix(fetch): fixed ERR_NETWORK mapping for Safari browsers; (#6767)
• d4f7df4 fix(headers): fix getSetCookie by using 'get' method for caseless access; (...
• Additional commits viewable in compare view

Updates alchemy-sdk from 2.12.0 to 3.5.8

Release notes

Sourced from alchemy-sdk's releases.

v3.5.8

Minor Changes

• Added Berachain Bepolia, Celo Baklava, Ethereum Hoodi, Gensyn Testnet, Lens Mainnet, Settlus Mainnet, Superseed Mainnet and Sepolia, Tea Sepolia
• Deprecated Berachain Bartio
• Replace optimism with opt-mainnet

v3.5.7

Minor Changes

• Added Solana address activity webhook
• Added animation to NFT type
• Added name to create-webhook

v3.5.6

Minor Changes

• Added MONAD testnet.
• Added SETTLUS testnet (Sepolia).

v3.5.5

Minor Changes

• Added SEI mainnet.

v3.5.4

Minor Changes

• Added RONIN mainnet, testnet (Saigon).

v3.5.3

Minor Changes

• Added ABSTRACT mainnet.
• Added UNICHAIN mainnet.
• Added SEI testnet.

v3.5.2

Minor Changes

• Added BERACHAIN mainnet.
• Updated docs

v3.5.1

Minor Changes

• Added many new networks

v3.5.0

... (truncated)

Changelog

Sourced from alchemy-sdk's changelog.

3.5.8

Minor Changes

• Added Berachain Bepolia, Celo Baklava, Ethereum Hoodi, Gensyn Testnet, Lens Mainnet, Settlus Mainnet, Superseed Mainnet and Sepolia, Tea Sepolia
• Deprecated Berachain Bartio
• Replace optimism with opt-mainnet

3.5.7

Minor Changes

• Added Solana address activity webhook
• Added animation to NFT type
• Added name to create-webhook

3.5.6

Minor Changes

• Added MONAD testnet.
• Added SETTLUS testnet (Sepolia).

3.5.5

Minor Changes

• Added SEI mainnet.

3.5.4

Major Changes

Minor Changes

• Added RONIN mainnet, testnet (Saigon).

3.5.3

Major Changes

Minor Changes

• Added ABSTRACT mainnet.
• Added UNICHAIN mainnet.
• Added SEI testnet.

3.5.2

... (truncated)

Commits

• See full diff in compare view

Updates cross-spawn from 7.0.3 to 7.0.6

Changelog

Sourced from cross-spawn's changelog.

7.0.6 (2024-11-18)

Bug Fixes

• update cross-spawn version to 7.0.5 in package-lock.json (f700743)

7.0.5 (2024-11-07)

Bug Fixes

• fix escaping bug introduced by backtracking (640d391)

7.0.4 (2024-11-07)

Bug Fixes

• disable regexp backtracking (#160) (5ff3a07)

Commits

• 77cd97f chore(release): 7.0.6
• 6717de4 chore: upgrade standard-version
• f700743 fix: update cross-spawn version to 7.0.5 in package-lock.json
• 9a7e3b2 chore: fix build status badge
• 0852683 chore(release): 7.0.5
• 640d391 fix: fix escaping bug introduced by backtracking
• bff0c87 chore: remove codecov
• a7c6abc chore: replace travis with github workflows
• 9b9246e chore(release): 7.0.4
• 5ff3a07 fix: disable regexp backtracking (#160)
• Additional commits viewable in compare view

Updates follow-redirects from 1.15.2 to 1.15.9

Commits

• e4e55c7 Release version 1.15.9 of the npm package.
• 31a1abf Attempt much more gentle detection.
• d2aaa97 Fix url field.
• 62558f0 Release version 1.15.8 of the npm package.
• a8d1cee Return subtlety.
• 458ca8e Fix native URL test for Node 20.
• ca49e44 Handle KeepAlive connections in tests.
• f3711d7 Test on Node 20 and 22.
• fda0faf Fix typo.
• 760757f Release version 1.15.7 of the npm package.
• Additional commits viewable in compare view

Updates micromatch from 4.0.5 to 4.0.8

Release notes

Sourced from micromatch's releases.

4.0.8

Ultimate release that fixes both CVE-2024-4067 and CVE-2024-4068. We consider the issues low-priority, so even if you see automated scanners saying otherwise, don't be scared.

Changelog

Sourced from micromatch's changelog.

[4.0.8] - 2024-08-22

• backported CVE-2024-4067 fix (from v4.0.6) over to 4.x branch

[4.0.7] - 2024-05-22

• this is basically v4.0.5, with some README updates
• it is vulnerable to CVE-2024-4067
• Updated braces to v3.0.3 to avoid CVE-2024-4068
• does NOT break API compatibility

[4.0.6] - 2024-05-21

• Added hasBraces to check if a pattern contains braces.
• Fixes CVE-2024-4067
• BREAKS API COMPATIBILITY
• Should be labeled as a major release, but it's not.

Commits

• 8bd704e 4.0.8
• a0e6841 run verb to generate README documentation
• 4ec2884 Merge branch 'v4' into hauserkristof-feature/v4.0.8
• 03aa805 Merge pull request #266 from hauserkristof/feature/v4.0.8
• 814f5f7 lint
• 67fcce6 fix: CHANGELOG about braces & CVE-2024-4068, v4.0.5
• 113f2e3 fix: CVE numbers in CHANGELOG
• d9dbd9a feat: updated CHANGELOG
• 2ab1315 fix: use actions/setup-node@v4
• 1406ea3 feat: rework test to work on macos with node 10,12 and 14
• Additional commits viewable in compare view

Updates nanoid from 3.3.6 to 3.3.11

Release notes

Sourced from nanoid's releases.

3.3.11

• Fixed React Native support.

3.3.10

• Fixed React Native support (by @​steida).

3.3.9

• Reduced npm package size.

Changelog

Sourced from nanoid's changelog.

3.3.11

• Fixed React Native support.

3.3.10

• Fixed React Native support (by @​steida).

3.3.9

• Reduced npm package size.

3.3.8

• Fixed a way to break Nano ID by passing non-integer size (by @​myndzi).

3.3.7

• Fixed node16 TypeScript support (by Saadi Myftija).

Commits

• 37289ce Release 3.3.11 version
• 23690b7 Fix CI
• c147962 Fix RN support
• a83734e Move to manually ESM/CJS dual package
• bb12e8a Release 3.3.10 version
• 8f44264 Fix Expo support
• adf9b0c Release 3.3.9 version
• 1c6f088 Remove dev file from npm package
• 3044cd5 Release 3.3.8 version
• 4fe3495 Update size limit
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.