Sourced from node-fetch's releases.

v2.6.7

Security patch release

Recommended to upgrade, to not leak sensitive cookie and authentication header information to 3th party host while a redirect occurred

What's Changed

• fix: don't forward secure headers to 3th party by @​jimmywarting in node-fetch/node-fetch#1453

Full Changelog: https://github.com/node-fetch/node-fetch/compare/v2.6.6...v2.6.7

• 1ef4b56 backport of #1449 (#1453)
• 8fe5c4e 2.x: Specify encoding as an optional peer dependency in package.json (#1310)
• See full diff in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

Sourced from semver-regex's releases.

v3.1.4

• Backport of ReDoS fix https://github.com/sindresorhus/semver-regex/commit/7712ba564d40da101cf2b2b33e6a910d9f2f57f4

• See full diff in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

• 7efb22a 1.2.6
• ef88b93 security notice for additional prototype pollution issue
• c2b9819 isConstructorOrProto adapted from PR
• bc8ecee test from prototype pollution PR
• See full diff in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

Sourced from prismjs's releases.

v1.27.0

Release 1.27.0

Sourced from prismjs's changelog.

1.27.0 (2022-02-17)

New components

• UO Razor Script (#3309) 3f8cc5a0

Updated components

• AutoIt
  • Allow hyphen in directive (#3308) bcb2e2c8
• EditorConfig
  • Change alias of section from keyword to selector (#3305) e46501b9
• Ini
  • Swap out header for section (#3304) deb3a97f
• MongoDB
  • Added v5 support (#3297) 8458c41f
• PureBasic
  • Added missing keyword and fixed constants ending with $ (#3320) d6c53726
• Scala
  • Added support for interpolated strings (#3293) 441a1422
• Systemd configuration file
  • Swap out operator for punctuation (#3306) 2eb89e15

Updated plugins

• Command Line
  • Escape markup in command line output (#3341) e002e78c
  • Add support for line continuation and improved colors (#3326) 1784b175
  • Added span around command and output (#3312) 82d0ca15

Other

• Core
  • Added better error message for missing grammars (#3311) 2cc4660b

• 703881e 1.27.0
• 7ac1373 Updated changelog for v1.27.0 (#3342)
• e002e78 Command Line: Escape markup in command line output (#3341)
• 13b56a9 Bump follow-redirects from 1.14.7 to 1.14.8 (#3338)
• f094c4a Bump yargs-parser from 5.0.0 to 5.0.1 (#3334)
• 9fd4c74 Bump ajv from 6.10.0 to 6.12.6 (#3333)
• 3fcca6b Bump pathval from 1.1.0 to 1.1.1 (#3331)
• 1784b17 Command Line: Add support for line continuation and improved colors (#3326)
• f545843 ESLint: Allow Map and Set in ES5 code (#3328)
• d6c5372 PureBasic: Added missing keyword and fixed constants ending with $ (#3320)
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

Sourced from next's releases.

v12.1.0

Core Changes

• Relay Support in Rust Compiler: #33702
• fix eslint link-passhref rule: #33857
• update webpack: #33831
• Flush buffered vitals metrics on page mount: #33867
• fix problem with HMR when middleware and page reference the same node_module: #33873
• Refactor page component getter in web server: #33759
• update NextResponse default redirect status to 307 to match docs: #33505
• Bug fix: dynamic page should not be interpreted as predefined page: #33808
• Group streaming experimental apis: #33878
• Encapsulate routing and initial hydration: #33875
• Optimize offline condition judgment: #33238
• Ensure external beforeFiles rewrites are handled with next/link: #33888
• Fix parsing params for i18n optional route in minimal mode: #33896
• Ensure browserslist extends works properly: #33890
• Fix image cache race condition: #33883
• Add support for Relay projects without artifactDirectory: #33918
• fix: handle jsxspreadattribute in inline-script-id eslint rule: #32421
• feat(next-swc): Update swc: #33724
• Update to latest version of amphtml-validator: #33967
• Warn in dev mode when script tags are added with next/head: #33968
• Ensure optional chaining in swc matches babel: #33995
• Use react-dom/server.browser in Node.js: #33950
• Ensure external middleware rewrite is handled correctly: #33962
• Update Terser to v5.10.0, fix minification issues: #33045
• Warn in dev mode when stylesheets are added using next/head: #34004
• Use ReadableStream in RenderResult: #34005
• Fix suffix ordering while streaming: #34011
• Don't use yarn if a package-lock.json file is found: #31926
• Do not warn when application/ld+json scripts are used with next/head: #34021
• Babel & next-swc: Fix exporting page config with AsExpression: #32702
• Detect per page runtime config for functions manifest: #33945
• Add JSDoc to config options: #32915
• Update font-stylesheet-gathering-plugin.ts: #30709
• Add decoratorMetadata flag if enabled by tsconfig: #32914
• fix: data url handling in css-loader: #34034
• Place 'charset' element at the top of : #28119
• Fix detection of anchor click events inside svg: #23272
• Allow passing nothing as custom jest config: #32328
• Fixes #31240: Adding a recursive addPackagePath function in webpack-config: #31264
• Require component rendered as child of Link to pass event to onClick handler: #27723
• Allow scroll prevention on hash change: #31921
• Add support for async fn / promise in next.config.js/.mjs: #33662
• Fix lazyRoot functionality for next/image: #33933
• Change SWC minify from beta to release candidate: #34056
• Make Router state immutable: #33925
• Stop exposing internal render and renderError methods from next/client: #34069
• Add api-utils helper for testing: #34078

... (truncated)

• 8545fd1 v12.1.0
• 1605f30 v12.0.11-canary.21
• 69aedbd Fix typo (#34480)
• f0f322c Remove deprecation for relative URL usage in middlewares (#34461)
• d4d79b2 Fix chunk buffering for server components (#34474)
• 74fa4d4 update webpack (#34477)
• b70397e Revert "Allow reading request bodies in middlewares (#34294)" (#34479)
• 4202011 Update font-optimization test snapshot (#34478)
• 1edd851 Allow reading request bodies in middlewares (#34294)
• ba78437 fix: don't wrap profile in firebase example (#34457)
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

Sourced from next's releases.

v12.1.0

Core Changes

• Relay Support in Rust Compiler: #33702
• fix eslint link-passhref rule: #33857
• update webpack: #33831
• Flush buffered vitals metrics on page mount: #33867
• fix problem with HMR when middleware and page reference the same node_module: #33873
• Refactor page component getter in web server: #33759
• update NextResponse default redirect status to 307 to match docs: #33505
• Bug fix: dynamic page should not be interpreted as predefined page: #33808
• Group streaming experimental apis: #33878
• Encapsulate routing and initial hydration: #33875
• Optimize offline condition judgment: #33238
• Ensure external beforeFiles rewrites are handled with next/link: #33888
• Fix parsing params for i18n optional route in minimal mode: #33896
• Ensure browserslist extends works properly: #33890
• Fix image cache race condition: #33883
• Add support for Relay projects without artifactDirectory: #33918
• fix: handle jsxspreadattribute in inline-script-id eslint rule: #32421
• feat(next-swc): Update swc: #33724
• Update to latest version of amphtml-validator: #33967
• Warn in dev mode when script tags are added with next/head: #33968
• Ensure optional chaining in swc matches babel: #33995
• Use react-dom/server.browser in Node.js: #33950
• Ensure external middleware rewrite is handled correctly: #33962
• Update Terser to v5.10.0, fix minification issues: #33045
• Warn in dev mode when stylesheets are added using next/head: #34004
• Use ReadableStream in RenderResult: #34005
• Fix suffix ordering while streaming: #34011
• Don't use yarn if a package-lock.json file is found: #31926
• Do not warn when application/ld+json scripts are used with next/head: #34021
• Babel & next-swc: Fix exporting page config with AsExpression: #32702
• Detect per page runtime config for functions manifest: #33945
• Add JSDoc to config options: #32915
• Update font-stylesheet-gathering-plugin.ts: #30709
• Add decoratorMetadata flag if enabled by tsconfig: #32914
• fix: data url handling in css-loader: #34034
• Place 'charset' element at the top of : #28119
• Fix detection of anchor click events inside svg: #23272
• Allow passing nothing as custom jest config: #32328
• Fixes #31240: Adding a recursive addPackagePath function in webpack-config: #31264
• Require component rendered as child of Link to pass event to onClick handler: #27723
• Allow scroll prevention on hash change: #31921
• Add support for async fn / promise in next.config.js/.mjs: #33662
• Fix lazyRoot functionality for next/image: #33933
• Change SWC minify from beta to release candidate: #34056
• Make Router state immutable: #33925
• Stop exposing internal render and renderError methods from next/client: #34069
• Add api-utils helper for testing: #34078

... (truncated)

• 8545fd1 v12.1.0
• 1605f30 v12.0.11-canary.21
• 69aedbd Fix typo (#34480)
• f0f322c Remove deprecation for relative URL usage in middlewares (#34461)
• d4d79b2 Fix chunk buffering for server components (#34474)
• 74fa4d4 update webpack (#34477)
• b70397e Revert "Allow reading request bodies in middlewares (#34294)" (#34479)
• 4202011 Update font-optimization test snapshot (#34478)
• 1edd851 Allow reading request bodies in middlewares (#34294)
• ba78437 fix: don't wrap profile in firebase example (#34457)
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

Sourced from npm's changelog.

v8.12.0 (2022-06-01)

Features

• aee6fc8 #4892 feat(init): reify on init new workspace (@​ruyadorno)
• a8ae177 #4931 feat: Add --auth-type=webauthn flag (@​jumoel)

Bug Fixes

• 646b6b5 #4963 fix(arborist): use rawSpec for bundled and shrinkwrapped deps (@​nlf)
• fcc72dd #4929 fix(libnpmexec): fix bug not install latest pkg (@​jihunleekr)

Dependencies

• a6b62b2 #4949 deps: [email protected]
• fb4cc24 #4969 deps: [email protected]
• 5b9688c #4971 deps: [email protected]
• a8bfdd8 #4972 deps: [email protected]
• 66981ec #4973 deps: [email protected]
• 180a7e4 #4975 deps: @npmcli/[email protected]
• 0886f7f #4976 deps: [email protected]

v8.11.0 (2022-05-25)

Features

• 8898710 #4879 feat: deprecated set-script, birthday, --global, and --local (@​fritzy)
• 7307c8d #4940 feat(libnpmpack): bump pacote for better workspace awareness (@​nlf)

Bug Fixes

• 400c80f #4913 fix(ci): remove node_modules post-validation (@​wraithgar)
• 124df81 #4910 fix: clean up npm cache tests (@​wraithgar)
• ee3308a fix: remove dead code from get-identity (@​wraithgar)
• 357b0af #4917 fix: pass prefix and workspaces to libnpmpack (@​nlf)
• 0f89e07 #4935 fix: add global getter to npm class (@​nlf)

Documentation

• 83ed8d0 #4922 docs: update roadmap link in readme (@​OmriBarZik)
• ed054d4 #4933 docs: fix broken link in changelog (@​yonran)

Dependencies

• 632ce87 #4915 deps: [email protected]
• 7b2b77a #4915 deps: [email protected]
• f3b0a24 #4915 deps: [email protected]
• 0df3011 #4915 deps: [email protected]
• dc38ab9 #4919 deps: [email protected]
• 353e2f9 #4940 deps: [email protected] [email protected]

... (truncated)

• 4ee12d0 8.12.0
• bad7378 chore: update AUTHORS
• 91f17a1 chore: changelog for v8.12.0
• 0886f7f deps: [email protected]
• 42e2791 chore(latest): release libnpmexec 4.0.6
• 180a7e4 deps: @​npmcli/arborist@​5.2.1
• 07b35ab chore(latest): release arborist 5.2.1
• 8bf5ac7 chore(arborist): update readme link (#4948)
• fcc72dd fix(libnpmexec): fix bug not install latest pkg (#4929)
• 646b6b5 fix(arborist): use rawSpec for bundled and shrinkwrapped deps (#4963)
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

Sourced from jose's releases.

v4.9.2

Fixes

• limit default PBES2 alg's computational expense (03d6d01)

v4.9.1

Fixes

• deno: add a Deno package entrypoint (9f3c459)

v4.9.0

Features

• add support for RFC 9278 - JWK Thumbprint URI (d06ce65)

Refactor

• consume some base64url decode errors (#436) (caaf2c3)
• unify JOSENotSupported throw on key export (fe5d093)

v4.8.3

This release contains only code refactoring and documentation updates.

v4.8.1

Fixes

• typescript: add types export for nodenext module resolution (#406) (5a6d8f0)

v4.8.0

Features

• add "worker" export in package.json (#400) (c58c80a)
• optional headers options for createRemoteJWKSet (#397) (b4612f5)

v4.7.0

Features

• add createRemoteJWKSet cacheMaxAge option (5017d95), closes #394

v4.6.2

Fixes

• dont check JWT iat is in the past unless maxTokenAge is used (96d85c7)

v4.6.1

This release contains only code refactoring and documentation updates.

v4.6.0

Features

... (truncated)

Sourced from jose's changelog.

4.9.2 (2022-09-01)

Fixes

• limit default PBES2 alg's computational expense (03d6d01)

4.9.1 (2022-08-29)

Fixes

• deno: add a Deno package entrypoint (9f3c459)

4.9.0 (2022-08-17)

Features

• add support for RFC 9278 - JWK Thumbprint URI (d06ce65)

Refactor

• consume some base64url decode errors (#436) (caaf2c3)
• unify JOSENotSupported throw on key export (fe5d093)

4.8.3 (2022-06-29)

4.8.1 (2022-05-02)

Fixes

• typescript: add types export for nodenext module resolution (#406) (5a6d8f0)

4.8.0 (2022-04-26)

Features

• add "worker" export in package.json (#400) (c58c80a)
• optional headers options for createRemoteJWKSet (#397) (b4612f5)

4.7.0 (2022-04-21)

Features

• add createRemoteJWKSet cacheMaxAge option (5017d95), closes #394

... (truncated)

• db71b3d chore(release): 4.9.2
• 03d6d01 fix: limit default PBES2 alg's computational expense
• 8c5cc34 chore: cleanup after publish
• 8ed39d6 chore(release): 4.9.1
• 9f3c459 fix(deno): add a Deno package entrypoint
• d07c6e9 test: update expectations for P-384 ECDH
• 664279d chore: cleanup after publish
• 24484d6 chore(release): 4.9.0
• ebf277b chore: add refactors to version logs
• d06ce65 feat: add support for RFC 9278 - JWK Thumbprint URI
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.