Skip to content

chore: bump @cyclonedx/cyclonedx-npm from 5.0.0 to 6.0.0 in /frontend - #346

Merged
arthuurw merged 1 commit into
homologfrom
dependabot/npm_and_yarn/frontend/homolog/cyclonedx/cyclonedx-npm-6.0.0
Aug 5, 2026
Merged

chore: bump @cyclonedx/cyclonedx-npm from 5.0.0 to 6.0.0 in /frontend#346
arthuurw merged 1 commit into
homologfrom
dependabot/npm_and_yarn/frontend/homolog/cyclonedx/cyclonedx-npm-6.0.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 17, 2026

Copy link
Copy Markdown
Contributor

Bumps @cyclonedx/cyclonedx-npm from 5.0.0 to 6.0.0.

Release notes

Sourced from @​cyclonedx/cyclonedx-npm's releases.

6.0.0

[!IMPORTANT]
This release includes a fix for a known security vulnerability.

BREAKING Changes

  • Reworked npm detection and handling.
    The behavior when npm_execpath is present remains unchanged.

Fixed

  • Eliminated a potential shell‑injection vulnerability in the --workspace argument on Windows (via #1489)
    See GHSA-q69g-4hcv-6jg4
  • Properly closing output file (via #1484)

Tests

  • Added more regression test for shell injections (via #1488)

#1484: CycloneDX/cyclonedx-node-npm#1484 #1488: CycloneDX/cyclonedx-node-npm#1488 #1489: CycloneDX/cyclonedx-node-npm#1489


What's Changed

Full Changelog: CycloneDX/cyclonedx-node-npm@v5.0.0...v6.0.0

Changelog

Sourced from @​cyclonedx/cyclonedx-npm's changelog.

6.0.0 - 2026-07-07

  • BREAKING Changes
    • Reworked npm detection and handling.
      The behavior when npm_execpath is present remains unchanged.
  • Fixed
    • Eliminated a potential shell‑injection vulnerability in the --workspace argument on Windows (via #1489)
      See GHSA-q69g-4hcv-6jg4
    • Properly closing output file (via #1484)
  • Tests
    • Added more regression test for shell injections (via #1488)

#1484: CycloneDX/cyclonedx-node-npm#1484 #1488: CycloneDX/cyclonedx-node-npm#1488 #1489: CycloneDX/cyclonedx-node-npm#1489

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [@cyclonedx/cyclonedx-npm](https://github.com/CycloneDX/cyclonedx-node-npm) from 5.0.0 to 6.0.0.
- [Release notes](https://github.com/CycloneDX/cyclonedx-node-npm/releases)
- [Changelog](https://github.com/CycloneDX/cyclonedx-node-npm/blob/main/HISTORY.md)
- [Commits](CycloneDX/cyclonedx-node-npm@v5.0.0...v6.0.0)

---
updated-dependencies:
- dependency-name: "@cyclonedx/cyclonedx-npm"
  dependency-version: 6.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 17, 2026
@dependabot
dependabot Bot requested a review from arthuurw as a code owner July 17, 2026 10:40
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 17, 2026
@github-actions

Copy link
Copy Markdown

Coverage Report for frontend

Status Category Percentage Covered / Total
🔵 Lines 88.33% (🎯 95%) 3636 / 4116
🔵 Statements 86.38% (🎯 95%) 3971 / 4597
🔵 Functions 78.71% (🎯 95%) 1039 / 1320
🔵 Branches 82.92% (🎯 90%) 2326 / 2805
File CoverageNo changed files found.
Generated in workflow #556 for commit 47ebe19 by the Vitest Coverage Report Action

@arthuurw
arthuurw merged commit 1bede0c into homolog Aug 5, 2026
19 checks passed
@arthuurw
arthuurw deleted the dependabot/npm_and_yarn/frontend/homolog/cyclonedx/cyclonedx-npm-6.0.0 branch August 5, 2026 21:21
@arthuurw arthuurw mentioned this pull request Aug 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant