chore(deps): update dependency nodemon to v3 #27

However there's no function being used in semver that breaks node 8,
so it's technically still possible to run with node 8, but it will
no longer be supported (or tested in CI).

`v2.0.22`

Compare Source

Bug Fixes

remove ts mapping if loader present (f7816e4), closes #2083

`v2.0.21`

Compare Source

Bug Fixes

remove ts mapping if loader present (1468397), closes #2083

`v2.0.20`

Compare Source

Bug Fixes

remove postinstall script (e099e91)

`v2.0.19`

Compare Source

Bug Fixes

Replace update notifier with simplified deps (#2033) (176c4a6), closes #1961 #2028

`v2.0.18`

Compare Source

Bug Fixes

revert update-notifier forcing esm (1b3bc8c)

`v2.0.17`

Compare Source

Bug Fixes

bump update-notifier to v6.0.0 (#2029) (0144e4f)
update packge-lock (27e91c3)

`v2.0.16`

Compare Source

Bug Fixes

support windows by using path.delimiter (e26aaa9)

`v2.0.15`

Compare Source

Bug Fixes

bump prod dep versions (54784ab)

`v2.0.14`

Compare Source

Bug Fixes

add windows signals SIGUSR2 & SIGUSR1 to terminate the process (#1938) (61e7abd), closes #1903 #1915 #1936 #1937 #1882 #1893

`v2.0.13`

Compare Source

Bug Fixes

bump update-notifier (90e7a3e), closes #1919
release process on main (9f82a48)

`v2.0.12`

Compare Source

Bug Fixes

windows: properly handle quoted args in event (0823f18), closes #1823

`v2.0.11`

Compare Source

Bug Fixes

ensure numerical OS version check (f523d0e)

`v2.0.10`

Compare Source

Bug Fixes

windows 8 doesn't support windows-kill (6c6cb65), closes #1876

`v2.0.9`

Compare Source

Bug Fixes

allow windows users to install globally again (#1874) (3242215), closes #1872

`v2.0.8`

Compare Source

Bug Fixes

add support for SIGINT on Windows (fixes issue #1720) (#1853) (500c1b0)

`v2.0.7`

Compare Source

Bug Fixes

postinstall hide message in CI (3d2320f)
redirect help (#1825) (ac0b55e), closes #1807

`v2.0.6`

Compare Source

Bug Fixes

ignore ./ on cwd (#1787) (03c4ed3), closes #1784

`v2.0.5`

Compare Source

Bug Fixes

package.main with -- arguments (#1773) (2967726), closes #1758
respect env.OPENCOLLECTIVE_HIDE (#1765) (273d774)
runOnChangeOnly=true (7e00a30), closes #1742 #1751

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

socket-security · 2026-01-08T18:48:17Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	sinon@9.0.3
	@types/deasync@0.1.1
	json-ptr@1.3.2
	@types/json2md@1.5.0
	@types/apidoc@0.22.2
	@types/common-errors@1.0.1
	@types/ejs@3.0.4
	@types/yargs@15.0.5
	common-errors@1.2.0
	@types/sinon@9.0.5
	apidoc-markdown@5.1.6
	json2md@1.7.1
	@types/lodash@4.14.161
	apidoc@0.25.0
	deasync@0.1.20
	nodemon@3.1.11
	log-update@4.0.0

View full report

socket-security · 2026-01-08T18:48:18Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Critical CVE: npm `apidoc-core` has a prototype pollution vulnerability CVE: GHSA-6vj3-p34w-xxjp apidoc-core has a prototype pollution vulnerability (CRITICAL) Affected versions: >= 0.2.0 <= 0.15.0 Patched version: No patched versions From: `?` → `npm/apidoc@0.25.0` → `npm/apidoc-core@0.12.0` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/apidoc-core@0.12.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Critical CVE: npm `flat` vulnerable to Prototype Pollution CVE: GHSA-2j2x-2gpw-g8fm flat vulnerable to Prototype Pollution (CRITICAL) Affected versions: < 5.0.1 Patched version: 5.0.1 From: `?` → `npm/mocha@8.1.3` → `npm/flat@4.1.0` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/flat@4.1.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `registry-auth-token` is 95.0% likely obfuscated Confidence: 0.95 Location: Package overview From: `?` → `npm/@makeomatic/deploy@10.3.0` → `npm/apidoc@0.25.0` → `npm/apidoc-markdown@5.1.6` → `npm/registry-auth-token@4.2.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/registry-auth-token@4.2.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

renovate bot force-pushed the renovate/nodemon-3.x branch from a1adb7c to 815b77a Compare August 10, 2025 13:37

renovate bot force-pushed the renovate/nodemon-3.x branch from 815b77a to d3e2377 Compare September 25, 2025 20:09

renovate bot force-pushed the renovate/nodemon-3.x branch from d3e2377 to 9987dce Compare October 22, 2025 01:45

renovate bot force-pushed the renovate/nodemon-3.x branch from 9987dce to be92ea5 Compare November 11, 2025 17:44

renovate bot force-pushed the renovate/nodemon-3.x branch from be92ea5 to d2f5d3d Compare December 31, 2025 17:50

chore(deps): update dependency nodemon to v3

56f53c6

renovate bot force-pushed the renovate/nodemon-3.x branch from d2f5d3d to 56f53c6 Compare January 8, 2026 18:47

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): update dependency nodemon to v3 #27

chore(deps): update dependency nodemon to v3 #27

Uh oh!

renovate bot commented Sep 18, 2023 •

edited

Loading

Uh oh!

socket-security bot commented Jan 8, 2026

Uh oh!

socket-security bot commented Jan 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

chore(deps): update dependency nodemon to v3 #27

Are you sure you want to change the base?

chore(deps): update dependency nodemon to v3 #27

Uh oh!

Conversation

renovate bot commented Sep 18, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Features

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Features

BREAKING CHANGES

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Configuration

Uh oh!

socket-security bot commented Jan 8, 2026

Uh oh!

socket-security bot commented Jan 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate bot commented Sep 18, 2023 •

edited

Loading