GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — Bump the npm-minor group across 1 directory with 7 updates by dependabot[bot] · Pull Request #4317 · github/codeql-action

Conversation

dependabot Bot commented on behalf of github Nov 11, 2026

Copy link

Copy Markdown

Contributor

Bumps the npm-minor group with 7 updates in the / directory:

Package	From	To
follow-redirects	`1.16.1`	`1.16.2`
node-forge	`1.4.1`	`1.4.3`
semver	`7.8.5`	`7.8.6`
@types/sinon	`22.0.1`	`22.0.2`
eslint-plugin-jsdoc	`65.4.0`	`65.4.3`
globals	`17.13.0`	`17.14.0`
typescript-eslint	`8.72.0`	`8.72.1`

Updates follow-redirects from 1.16.1 to 1.16.2

Commits

e3b45a7 Release version 1.16.2 of the npm package.
b0a7751 Use Array.isArray.
d96d1fe Add funding emergency notice.
See full diff in compare view

Updates node-forge from 1.4.1 to 1.4.3

Changelog

Sourced from node-forge's changelog.

1.4.3 - 2026-11-03

Security

HIGH: X.509 certificate chain verification ignores name constraints.

pki.verifyCertificateChain() does not check the nameConstraints extension (RFC 5280 4.2.1.10). A non-critical nameConstraints extension in a CA certificate is ignored, so a name-constrained intermediate CA can issue certificates for names outside its permitted subtrees, or inside its excluded subtrees, and the chain verifies. Exploitation requires the private key of a name-constrained CA that chains to a trusted root. A critical nameConstraints extension is rejected as an unsupported critical extension.

Reported by @bhaswanthc.

CVE ID: CVE-TBD

GHSA ID: GHSA-3cc4-3294-vgjf

MODERATE: TLS client crash on a handshake record without a session.

A TLS client throws an uncaught TypeError from process() when it receives a ServerHello while it has no session: after a close_notify alert or a call to close(), or before handshake() is called. A malicious server, or an on-path attacker, can terminate a Node.js process that passes socket data to process() without catching exceptions. Servers are not affected.

Reported by @manus-use.

CVE ID: CVE-TBD

GHSA ID: GHSA-j8rw-jp99-435v

MODERATE: ReDoS in forge.http response header parsing.

forge.http trims response header and Set-Cookie values with a regular expression that takes quadratic time on a long run of whitespace followed by another character. A server, or an on-path attacker, can block a forge.http client for minutes with one large header.

Reported by @manus-pi.

CVE ID: CVE-TBD

GHSA ID: GHSA-6cv4-p8m7-4r25

MODERATE: TLS client crash on an unsupported ServerHello compression method.

A TLS client accepts any compression method in the ServerHello, although it only offers no compression. An unknown method makes process() throw an uncaught Error at ServerHelloDone, before the server is authenticated. A malicious server, or an on-path attacker, can terminate a Node.js process that passes socket data to process() without catching exceptions, including through forge.tls.wrapSocket. Servers are not affected.

Reported by @alienkeric.

CVE ID: CVE-TBD

GHSA ID: GHSA-w4xr-hqv8-ch44

LOW: Ed25519 signature verification accepts small-order public keys.

ed25519.verify() does not reject public keys of small order, such as the identity point. Under such a key, a signature with S = 0 and a small-order R verifies for many or, with the identity key, all messages, without any private key. Applications are affected only if

... (truncated)

Commits

936b24d Release 1.4.3.
4d8f79a Update changelog.
1d9816d Check the ServerHello compression method.
326a4d0 Trim forge.http header values in linear time.
2cfaeb5 Ignore handshake messages on a TLS client without a session.
6b23eae Complete nameConstraints enforcement.
862aa5f Enforce nameConstraints in verifyCertificateChain().
956f2b5 Document ed25519.verify() small-order key behavior.
1b77e6f Reject small-order Ed25519 public keys in verify.
2bd5146 Add GitHub usernames to credits.
Additional commits viewable in compare view

Updates semver from 7.8.5 to 7.8.6

Release notes

Sourced from semver's releases.

v7.8.6

7.8.6 (2026-11-02)

Bug Fixes

69b305d #918 improve range parsing performance (#918) (@reggi, @Copilot)

Chores

7257c14 #917 cover comparator normalization (#917) (@reggi, @Copilot)

Changelog

Sourced from semver's changelog.

7.8.6 (2026-11-02)

Bug Fixes

69b305d #918 improve range parsing performance (#918) (@reggi, @Copilot)

Chores

7257c14 #917 cover comparator normalization (#917) (@reggi, @Copilot)

Commits

b37b033 chore: release 7.8.6 (#940)
69b305d fix: improve range parsing performance (#918)
7257c14 chore: cover comparator normalization (#917)
See full diff in compare view

Updates @types/sinon from 22.0.1 to 22.0.2

Commits

See full diff in compare view

Updates eslint-plugin-jsdoc from 65.4.0 to 65.4.3

Release notes

Sourced from eslint-plugin-jsdoc's releases.

v65.4.3

65.4.3 (2026-11-03)

Bug Fixes

require-param: add missing @param tags only once per fix; fixes #770 (ce20134)

v65.4.2

65.4.2 (2026-10-23)

Bug Fixes

ts-method-signature-style: do not turn optional or readonly function properties into method signatures (94952b2)

ts-method-signature-style: keep ? when converting between function properties and method signatures (a4040aa)

v65.4.1

65.4.1 (2026-10-22)

Bug Fixes

ts-prefer-function-type: do not throw on call signatures inside object fields, parameters or return types, and keep the type when fixing (8830b2e)

Commits

ce20134 fix(require-param): add missing @param tags only once per fix; fixes #770
a4040aa fix(ts-method-signature-style): keep ? when converting between function p...
94952b2 fix(ts-method-signature-style): do not turn optional or readonly function p...
e4a69dd refactor: share rule defaults between code and meta.defaultOptions
45c789c chore: lint rule files with eslint-plugin-eslint-plugin
44a3c45 chore: update jsdoccomment, devDep
8830b2e fix(ts-prefer-function-type): do not throw on call signatures inside object...
0a1b435 docs: move nojekyll file to /docs
a218be3 docs: avoid jekyll processing
1b32353 docs: fix issues with GH Pages
See full diff in compare view

Updates globals from 17.13.0 to 17.14.0

Release notes

Sourced from globals's releases.

v17.14.0

Update globals (2026-11-01) (#355) 7abfb5d

sindresorhus/globals@v17.13.0...v17.14.0

Commits

3080111 17.14.0
c61cc23 Tweaks
7abfb5d Update globals (2026-11-01) (#355)
See full diff in compare view

Updates typescript-eslint from 8.72.0 to 8.72.1

Release notes

Sourced from typescript-eslint's releases.

v8.72.1

8.72.1 (2026-10-26)

🩹 Fixes

eslint-plugin: [no-unnecessary-condition] false positives on unresolved conditional types (#13062)

eslint-plugin: [no-unnecessary-type-assertion] bound recursive type traversal instead of catching stack overflows (#13039)

typescript-estree: use one Program per tsconfig for the project service in single-run mode (#12988)

❤️ Thank You

Evyatar Daud @StyleShit

Josh Ghoulberg 👻

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from typescript-eslint's changelog.

8.72.1 (2026-10-26)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

4ad6b75 chore(release): publish 8.72.1
7757694 chore: cleanup typecheck & build and fix race condition (#13071)
See full diff in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
eslint-plugin-jsdoc	[>= 63.a, < 64]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions


          Bump the npm-minor group across 1 directory with 7 updates

d733250

Bumps the npm-minor group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [follow-redirects](https://github.com/follow-redirects/follow-redirects) | `1.16.1` | `1.16.2` |
| [node-forge](https://github.com/digitalbazaar/forge) | `1.4.1` | `1.4.3` |
| [semver](https://github.com/npm/node-semver) | `7.8.5` | `7.8.6` |
| [@types/sinon](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/sinon) | `22.0.1` | `22.0.2` |
| [eslint-plugin-jsdoc](https://github.com/gajus/eslint-plugin-jsdoc) | `65.4.0` | `65.4.3` |
| [globals](https://github.com/sindresorhus/globals) | `17.13.0` | `17.14.0` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.72.0` | `8.72.1` |



Updates `follow-redirects` from 1.16.1 to 1.16.2
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](follow-redirects/follow-redirects@v1.16.1...v1.16.2)

Updates `node-forge` from 1.4.1 to 1.4.3
- [Changelog](https://github.com/digitalbazaar/forge/blob/main/CHANGELOG.md)
- [Commits](digitalbazaar/forge@v1.4.1...v1.4.3)

Updates `semver` from 7.8.5 to 7.8.6
- [Release notes](https://github.com/npm/node-semver/releases)
- [Changelog](https://github.com/npm/node-semver/blob/main/CHANGELOG.md)
- [Commits](npm/node-semver@v7.8.5...v7.8.6)

Updates `@types/sinon` from 22.0.1 to 22.0.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/sinon)

Updates `eslint-plugin-jsdoc` from 65.4.0 to 65.4.3
- [Release notes](https://github.com/gajus/eslint-plugin-jsdoc/releases)
- [Commits](gajus/eslint-plugin-jsdoc@v65.4.0...v65.4.3)

Updates `globals` from 17.13.0 to 17.14.0
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](sindresorhus/globals@v17.13.0...v17.14.0)

Updates `typescript-eslint` from 8.72.0 to 8.72.1
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.72.1/packages/typescript-eslint)

---
updated-dependencies:
- dependency-name: follow-redirects
  dependency-version: 1.16.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor
- dependency-name: node-forge
  dependency-version: 1.4.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor
- dependency-name: semver
  dependency-version: 7.8.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor
- dependency-name: "@types/sinon"
  dependency-version: 22.0.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor
- dependency-name: eslint-plugin-jsdoc
  dependency-version: 65.4.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor
- dependency-name: globals
  dependency-version: 17.14.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor
- dependency-name: typescript-eslint
  dependency-version: 8.72.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor
...

Signed-off-by: dependabot[bot] <[email protected]>

dependabot Bot requested a review from a team as a code owner

November 11, 2026 17:54

dependabot Bot added the Rebuild Re-transpile JS & re-generate workflows label

Nov 11, 2026

Copilot AI auto review requested due to automatic review settings

November 11, 2026 17:54

github-actions Bot added the size/XS Should be very easy to review label

Nov 11, 2026

Copilot started reviewing

November 11, 2026 17:55

View session

github-actions Bot removed the Rebuild Re-transpile JS & re-generate workflows label

Nov 11, 2026


          Rebuild

a65b1af

github-actions Bot commented Nov 11, 2026

Copy link

Copy Markdown

Contributor

Pushed a commit to rebuild the Action. Please approve running the PR checks.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

Copilot AI reviewed

Nov 11, 2026

View reviewed changes

Copilot AI left a comment

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

The checked-in lib/ bundle was not rebuilt, so the Action still runs the old bundled dependencies and the runtime fixes do not reach users.

1 open issue

Rebuild checked-in bundle to include runtime dependency updates · New

What changed in this PR

Updates seven npm dependencies used by the CodeQL Action and its development tooling.

Changes:

Bumps runtime dependencies, including upstream security fixes in node-forge.
Refreshes Sinon typings and ESLint-related tooling.
Aligns the pr-checks workspace’s semver requirement and shared lockfile.

File	Description
`pr-checks/package.json`	Updates the workspace’s `semver` requirement.
`package.json`	Bumps three runtime and four development dependencies.
`package-lock.json`	Records updated versions, transitive dependencies, and dependency metadata.

_{Review effort: Max (auto)}

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Comment thread

package.json

Comment on lines +46 to +47

		"node-forge": "^1.4.3",
		"semver": "^7.8.6",

This branch has not been deployed

No deployments

Reviewers

Copilot code review Copilot

Copilot review effort

Applies to this pull request for everyone.Learn more about Copilot code review.

Copilot left review comments

At least 1 approving review is required to merge this pull request.

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

size/XS

Should be very easy to review

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

1 participant

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.