Bump the npm_and_yarn group across 9 directories with 6 updates

dependabot[bot] · web-flow · commit 0844923ca225 · 2026-07-18T00:38:05.000Z
Bumps the npm_and_yarn group with 1 update in the /javascript/ql/test/library-tests/Extend directory: [merge](https://github.com/yeikos/js.merge). Bumps the npm_and_yarn group with 2 updates in the /javascript/ql/test/library-tests/HtmlSanitizers directory: [sanitize-html](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html) and [validator](https://github.com/validatorjs/validator.js). Bumps the npm_and_yarn group with 1 update in the /javascript/ql/test/library-tests/frameworks/Next directory: [next](https://github.com/vercel/next.js). Bumps the npm_and_yarn group with 1 update in the /javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss directory: [next](https://github.com/vercel/next.js). Bumps the npm_and_yarn group with 1 update in the /javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss directory: [next](https://github.com/vercel/next.js). Bumps the npm_and_yarn group with 1 update in the /javascript/ql/test/query-tests/Security/CWE-200/lib directory: [async](https://github.com/caolan/async). Bumps the npm_and_yarn group with 1 update in the /javascript/ql/test/query-tests/Security/CWE-915/PrototypePollutingMergeCall/src-non-vulnerable-lodash directory: [lodash](https://github.com/lodash/lodash). Bumps the npm_and_yarn group with 1 update in the /javascript/ql/test/query-tests/Security/CWE-915/PrototypePollutingMergeCall/src-vulnerable-lodash directory: [lodash](https://github.com/lodash/lodash). Bumps the npm_and_yarn group with 1 update in the /javascript/ql/test/query-tests/Security/CWE-918/Request directory: [next](https://github.com/vercel/next.js). Updates `merge` from 1.2.1 to 2.1.1 - [Release notes](https://github.com/yeikos/js.merge/releases) - [Changelog](https://github.com/swordev/merge/blob/main/CHANGELOG.md) - [Commits](swordev/merge@v1.2.1...v2.1.1) Updates `sanitize-html` from 1.27.5 to 2.17.6 - [Changelog](https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md) - [Commits](https://github.com/apostrophecms/apostrophe/commits/HEAD/packages/sanitize-html) Updates `validator` from 10.11.0 to 13.15.35 - [Release notes](https://github.com/validatorjs/validator.js/releases) - [Changelog](https://github.com/validatorjs/validator.js/blob/master/CHANGELOG.md) - [Commits](validatorjs/validator.js@10.11.0...13.15.35) Updates `next` from 10.2.3 to 16.2.10 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v10.2.3...v16.2.10) Updates `next` from 10.2.3 to 16.2.10 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v10.2.3...v16.2.10) Updates `next` from 10.2.3 to 16.2.10 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v10.2.3...v16.2.10) Updates `async` from 3.2.0 to 3.2.2 - [Release notes](https://github.com/caolan/async/releases) - [Changelog](https://github.com/caolan/async/blob/master/CHANGELOG.md) - [Commits](caolan/async@v3.2.0...v3.2.2) Updates `lodash` from 4.17.12 to 4.18.1 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.12...4.18.1) Updates `lodash` from 4.17.4 to 4.18.1 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.12...4.18.1) Updates `next` from 15.1.7 to 15.5.18 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v10.2.3...v16.2.10) --- updated-dependencies: - dependency-name: merge dependency-version: 2.1.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: sanitize-html dependency-version: 2.17.6 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: validator dependency-version: 13.15.35 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 16.2.10 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 16.2.10 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 16.2.10 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: async dependency-version: 3.2.2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.18.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.18.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.18 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
diff --git a/javascript/ql/test/library-tests/Extend/package.json b/javascript/ql/test/library-tests/Extend/package.json
@@ -15,7 +15,7 @@
 		"lodash": "^4.17.10",
 		"lodash.defaultsdeep": "^4.6.0",
 		"lodash.mergewith": "^4.6.1",
-		"merge": "^1.2.0",
+		"merge": "^2.1.1",
 		"merge-deep": "^3.0.2",
 		"merge-options": "^1.0.1",
 		"mixin-deep": "^2.0.0",
diff --git a/javascript/ql/test/library-tests/HtmlSanitizers/package.json b/javascript/ql/test/library-tests/HtmlSanitizers/package.json
@@ -7,10 +7,10 @@
     "he": "^1.1.1",
     "html-entities": "^1.2.1",
     "lodash": "^4.17.10",
-    "sanitize-html": "^1.18.2",
+    "sanitize-html": "^2.17.6",
     "sanitizer": "^0.1.3",
     "underscore": "^1.9.1",
-    "validator": "^10.4.0",
+    "validator": "^13.15.35",
     "xss": "^1.0.3",
     "xss-filters": "^1.2.7"
   }
diff --git a/javascript/ql/test/library-tests/frameworks/Next/package.json b/javascript/ql/test/library-tests/frameworks/Next/package.json
@@ -7,7 +7,7 @@
     "start": "next start"
   },
   "dependencies": {
-    "next": "^10.0.0",
+    "next": "^16.2.10",
     "react": "17.0.1",
     "react-dom": "17.0.1"
   }
diff --git a/javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/package.json b/javascript/ql/test/query-tests/Security/CWE-079/DomBasedXss/package.json
@@ -7,7 +7,7 @@
     "start": "next start"
   },
   "dependencies": {
-    "next": "^10.0.0",
+    "next": "^16.2.10",
     "react": "17.0.1",
     "react-dom": "17.0.1"
   }
diff --git a/javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/package.json b/javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/package.json
@@ -7,7 +7,7 @@
     "start": "next start"
   },
   "dependencies": {
-    "next": "^10.0.0",
+    "next": "^16.2.10",
     "react": "17.0.1",
     "react-dom": "17.0.1"
   }
diff --git a/javascript/ql/test/query-tests/Security/CWE-200/lib/package.json b/javascript/ql/test/query-tests/Security/CWE-200/lib/package.json
@@ -1,6 +1,6 @@
 {
     "name": "foo",
     "dependencies": {
-        "async": "3.2.0"
+        "async": "3.2.2"
     }
 }
diff --git a/javascript/ql/test/query-tests/Security/CWE-915/PrototypePollutingMergeCall/src-non-vulnerable-lodash/package.json b/javascript/ql/test/query-tests/Security/CWE-915/PrototypePollutingMergeCall/src-non-vulnerable-lodash/package.json
@@ -1,5 +1,5 @@
 {
     "dependencies": {
-        "lodash": "4.17.12"
+        "lodash": "4.18.1"
     }
 }
diff --git a/javascript/ql/test/query-tests/Security/CWE-915/PrototypePollutingMergeCall/src-vulnerable-lodash/package.json b/javascript/ql/test/query-tests/Security/CWE-915/PrototypePollutingMergeCall/src-vulnerable-lodash/package.json
@@ -1,5 +1,5 @@
 {
     "dependencies": {
-        "lodash": "4.17.4"
+        "lodash": "4.18.1"
     }
 }
diff --git a/javascript/ql/test/query-tests/Security/CWE-918/Request/package.json b/javascript/ql/test/query-tests/Security/CWE-918/Request/package.json
@@ -8,6 +8,6 @@
     "start": "next start"
   },
   "dependencies": {
-    "next": "15.1.7"
+    "next": "15.5.18"
   }
 }

Original file line number	Diff line number	Diff line change
`@@ -7,7 +7,7 @@`
`7`	`7`	`"start": "next start"`
`8`	`8`	`},`
`9`	`9`	`"dependencies": {`
`10`		`- "next": "^10.0.0",`
	`10`	`+ "next": "^16.2.10",`
`11`	`11`	`"react": "17.0.1",`
`12`	`12`	`"react-dom": "17.0.1"`
`13`	`13`	`}`
Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "foo",`
`3`	`3`	`"dependencies": {`
`4`		`- "async": "3.2.0"`
	`4`	`+ "async": "3.2.2"`
`5`	`5`	`}`
`6`	`6`	`}`
Original file line number	Diff line number	Diff line change
`@@ -1,5 +1,5 @@`
`1`	`1`	`{`
`2`	`2`	`"dependencies": {`
`3`		`- "lodash": "4.17.12"`
	`3`	`+ "lodash": "4.18.1"`
`4`	`4`	`}`
`5`	`5`	`}`
Original file line number	Diff line number	Diff line change
`@@ -1,5 +1,5 @@`
`1`	`1`	`{`
`2`	`2`	`"dependencies": {`
`3`		`- "lodash": "4.17.4"`
	`3`	`+ "lodash": "4.18.1"`
`4`	`4`	`}`
`5`	`5`	`}`
Original file line number	Diff line number	Diff line change
`@@ -8,6 +8,6 @@`
`8`	`8`	`"start": "next start"`
`9`	`9`	`},`
`10`	`10`	`"dependencies": {`
`11`		`- "next": "15.1.7"`
	`11`	`+ "next": "15.5.18"`
`12`	`12`	`}`
`13`	`13`	`}`