Skip to content

chore (deps): bump the patch-updates group across 1 directory with 14 updates - #53

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/patch-updates-14fca11113
Open

chore (deps): bump the patch-updates group across 1 directory with 14 updates#53
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/patch-updates-14fca11113

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 11, 2026

Copy link
Copy Markdown

Bumps the patch-updates group with 14 updates in the / directory:

Package From To
@xmldom/xmldom 0.8.14 0.8.15
dompurify 3.4.13 3.4.15
kbpgp 2.1.18 2.1.19
markdown-it 14.3.0 14.3.1
otpauth 9.5.1 9.5.2
uuid 14.0.1 14.0.2
@codemirror/search 6.7.1 6.7.2
@codemirror/state 6.7.1 6.7.4
@codemirror/view 6.43.9 6.43.11
@puppeteer/browsers 3.2.0 3.2.2
autoprefixer 10.5.4 10.5.5
css-loader 7.1.4 7.1.5
postcss 8.5.26 8.5.28
webpack-bundle-analyzer 5.3.1 5.3.2

Updates @xmldom/xmldom from 0.8.14 to 0.8.15

Release notes

Sourced from @​xmldom/xmldom's releases.

0.8.15

Commits

Fixed

  • Security: parsing a deeply or repeatedly namespaced document no longer consumes quadratic memory; the in-scope namespace map is inherited through the prototype chain instead of being copied for every prefix-declaring element (O(N) instead of O(N²)), preventing a denial-of-service reachable from DOMParser.parseFromString with default options. Serialized output is byte-identical. GHSA-965w-775f-mr7g
  • Security: attribute de-duplication during parsing is now O(M) instead of O(M²); the NamedNodeMap parse-time dedup path uses a null-prototype membership index, so a well-formed document with a hostile number of duplicate attributes can no longer wedge the parse. Attribute order and duplicate resolution (last value wins, first position kept) are byte-identical, preserving the XML no-duplicate-attributes well-formedness constraint. GHSA-8344-3jmq-59r6
  • Security: trimming trailing whitespace from an XML end tag (ETag) is now anchored so it runs in linear time instead of backtracking quadratically on a long whitespace run, preventing a ReDoS reachable from DOMParser.parseFromString. Trimmed output is byte-identical. GHSA-x4fp-j954-r2f4
  • Security: malformed-input recovery is now linear instead of quadratic — the malformed tag-name scan terminates at an embedded <, and Node.prototype.normalize() merges adjacent text nodes in O(K) instead of O(K²) (also reachable programmatically), per normalize() in the WHATWG DOM spec. DOM output is unchanged; only the reported error text differs. GHSA-93r5-fhx6-vmg9
  • Security: XMLSerializer.serializeToString() under { requireWellFormed: true } now rejects a DocType name that is not a valid XML Name, throwing InvalidStateError — matching the sibling publicId/systemId/internalSubset checks and preventing XML injection via DocumentType.name. GHSA-27p8-2357-5qqv
  • Security: XMLSerializer.serializeToString() under { requireWellFormed: true } now validates a processing-instruction target as an XML NCName and rejects a case-insensitive xml, throwing InvalidStateError — a check 0.8.x did not previously perform, preventing PI-target injection via >, ?, or whitespace. GHSA-c7q8-3ch8-vqpv
  • Security: Document.createEntityReference() now rejects an invalid XML Name at creation, and XMLSerializer.serializeToString() under { requireWellFormed: true } validates an EntityReference nodeName as an XML Name, throwing InvalidStateError — preventing XML injection via an entity-reference name. GHSA-6gmq-8vp8-gcm6
  • Security: the parser now reports a not-well-formed end tag whose valid name is followed by trailing content as a recoverable error instead of accepting it silently, per the XML ETag production; parsing recovers to the byte-identical DOM. Consumers that want strict rejection can escalate the reported error to fatal via the parser's errorHandler. GHSA-6h8r-xr42-gp59

Thank you, @​ericchiang, @​bhaswanthc, @​arpitjain099, @​Paranoidgrinch, for your contributions

Changelog

Sourced from @​xmldom/xmldom's changelog.

0.8.15

Fixed

  • Security: parsing a deeply or repeatedly namespaced document no longer consumes quadratic memory; the in-scope namespace map is inherited through the prototype chain instead of being copied for every prefix-declaring element (O(N) instead of O(N²)), preventing a denial-of-service reachable from DOMParser.parseFromString with default options. Serialized output is byte-identical. GHSA-965w-775f-mr7g
  • Security: attribute de-duplication during parsing is now O(M) instead of O(M²); the NamedNodeMap parse-time dedup path uses a null-prototype membership index, so a well-formed document with a hostile number of duplicate attributes can no longer wedge the parse. Attribute order and duplicate resolution (last value wins, first position kept) are byte-identical, preserving the XML no-duplicate-attributes well-formedness constraint. GHSA-8344-3jmq-59r6
  • Security: trimming trailing whitespace from an XML end tag (ETag) is now anchored so it runs in linear time instead of backtracking quadratically on a long whitespace run, preventing a ReDoS reachable from DOMParser.parseFromString. Trimmed output is byte-identical. GHSA-x4fp-j954-r2f4
  • Security: malformed-input recovery is now linear instead of quadratic — the malformed tag-name scan terminates at an embedded <, and Node.prototype.normalize() merges adjacent text nodes in O(K) instead of O(K²) (also reachable programmatically), per normalize() in the WHATWG DOM spec. DOM output is unchanged; only the reported error text differs. GHSA-93r5-fhx6-vmg9
  • Security: XMLSerializer.serializeToString() under { requireWellFormed: true } now rejects a DocType name that is not a valid XML Name, throwing InvalidStateError — matching the sibling publicId/systemId/internalSubset checks and preventing XML injection via DocumentType.name. GHSA-27p8-2357-5qqv
  • Security: XMLSerializer.serializeToString() under { requireWellFormed: true } now validates a processing-instruction target as an XML NCName and rejects a case-insensitive xml, throwing InvalidStateError — a check 0.8.x did not previously perform, preventing PI-target injection via >, ?, or whitespace. GHSA-c7q8-3ch8-vqpv
  • Security: Document.createEntityReference() now rejects an invalid XML Name at creation, and XMLSerializer.serializeToString() under { requireWellFormed: true } validates an EntityReference nodeName as an XML Name, throwing InvalidStateError — preventing XML injection via an entity-reference name. GHSA-6gmq-8vp8-gcm6
  • Security: the parser now reports a not-well-formed end tag whose valid name is followed by trailing content as a recoverable error instead of accepting it silently, per the XML ETag production; parsing recovers to the byte-identical DOM. Consumers that want strict rejection can escalate the reported error to fatal via the parser's errorHandler. GHSA-6h8r-xr42-gp59

Thank you, @​ericchiang, @​bhaswanthc, @​arpitjain099, @​Paranoidgrinch, for your contributions

0.9.11

Fixed

  • Security: XMLSerializer.serializeToString() now also rejects invalid element and attribute names when { requireWellFormed: true } is passed, throwing InvalidStateError for a name that is not a valid XML QName (this covers the namespace prefix, which surfaces in the element qualified name or in a synthesized xmlns: declaration). This prevents XML injection via createElement() / setAttribute(), extending the existing requireWellFormed checks to the serialized name set. GHSA-w2rr-34g9-rvrj GHSA-4w3w-2rp5-g8jm
  • Security: the processing-instruction grammar regex no longer backtracks quadratically on an unterminated processing instruction (<?… with no closing ?>), preventing a denial-of-service (ReDoS) reachable from DOMParser.parseFromString with default options. GHSA-g53g-w8rj-fmg7
  • CharacterData nodeValue and data are now kept in sync [#990](https://github.com/xmldom/xmldom/issues/990)

Chore

  • updated dependencies

Thank you, @​bhaswanthc, @​jmestwa-coder, @​stevenobiajulu, for your contributions

Commits
  • b5b8fb5 0.8.15
  • 327508e docs: add 0.8.15 CHANGELOG entry
  • f40ccb8 fix: prevent quadratic malformed-tag recovery and normalize() adjacent-text m...
  • 3abb093 fix: prevent end-tag whitespace-trim ReDoS via anchored trim (GHSA-x4fp-j954-...
  • 2c548f2 fix: prevent quadratic attribute de-duplication via null-prototype membership...
  • 08a74b4 test: characterize NamedNodeMap attribute de-duplication before the index ref...
  • 954370f fix: prevent quadratic namespace-map memory consumption via prototype-chain i...
  • 4430189 fix: report not-well-formed end-tag trailing content (GHSA-6h8r-xr42-gp59)
  • 6c3fb5f fix: prevent XML injection via unsafe EntityReference name (GHSA-6gmq-8vp8-gcm6)
  • 3b69487 fix: prevent XML injection via unsafe processing instruction target serializa...
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by karfau, a new releaser for @​xmldom/xmldom since your current version.


Updates dompurify from 3.4.13 to 3.4.15

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.15

  • Added better clobbering hardening when XML content is involved, thanks @​gnyselcuk
  • Added several smaller hardening and edge-case improvements, thanks @​leechristensen
  • Bumped several dependencies where possible

DOMPurify 3.4.14

  • Fixed an issue with possible bypasses when risky tags are allow-listed, thanks @​AlirezaRouhbakhsh
  • Fixed a couple of edge cases with mixed document contexts, thanks @​fishjojo1
  • Added the SVG pointer-events and vector-effect presentation attributes to the allow-list, thanks @​Jaybhade
  • Conducted another refactoring run, removed dead branches and duplicated logic, flattened attribute validation
  • Updated the documentation in several spots, README, wiki, etc., thanks @​Akokonunes
  • Updated several development dependencies and CI workflow actions
Commits

Updates kbpgp from 2.1.18 to 2.1.19

Changelog

Sourced from kbpgp's changelog.

2.1.19 (2026-08-27)

  • Fix processing DSA/ECDSA signatures and ElGamal ciphertext.
Commits

Updates markdown-it from 14.3.0 to 14.3.1

Changelog

Sourced from markdown-it's changelog.

[14.3.1] - 2026-08-27

Security

  • Backported 15.0.1 fixes.
Commits
  • a855f10 14.3.1 released
  • ad70f6b Backported 15.0.1 fixes
  • b407f3b Ignore generated API docs in lint
  • bf025ad Prepare package.json for v14 backports
  • 2d9bbea fix: recognize lowercase declarations as HTML blocks (CommonMark 4.6) (#1189)
  • a311cfb fix: keep literal backslash before space in link destination (CommonMark 6.3)...
  • See full diff in compare view

Updates otpauth from 9.5.1 to 9.5.2

Release notes

Sourced from otpauth's releases.

v9.5.2

What's Changed

Full Changelog: hectorm/otpauth@v9.5.1...v9.5.2

Commits
  • 5a0cb60 9.5.2
  • 94f1fcc Update QuickJS version to 2026-06-04
  • fac0c5c Update hectorm/ghaction-setup-quickjs
  • 88bdce0 Harden and align hex/base32 secret decoding
  • c431143 Bump the github-actions-all group across 1 directory with 7 updates (#711)
  • b6e3a62 Update dependencies
  • See full diff in compare view

Updates uuid from 14.0.1 to 14.0.2

Release notes

Sourced from uuid's releases.

v14.0.2

14.0.2 (2026-08-18)

Bug Fixes

  • v1: carry nsecs overflow into the timestamp's high bits (#972) (6adcc1d)
  • v1: set the multicast bit on v1Bytes's own randomly-generated node (#973) (b1da338)
  • v7: align default seq formula in v7Bytes with updateV7State (#965) (a67db57)
Changelog

Sourced from uuid's changelog.

14.0.2 (2026-08-18)

Bug Fixes

  • v1: carry nsecs overflow into the timestamp's high bits (#972) (6adcc1d)
  • v1: set the multicast bit on v1Bytes's own randomly-generated node (#973) (b1da338)
  • v7: align default seq formula in v7Bytes with updateV7State (#965) (a67db57)
Commits
  • fd59f02 chore(main): release 14.0.2 (#967)
  • f3c564e docs: point the Node support permalink at the CI version matrix (#974)
  • b1da338 fix(v1): set the multicast bit on v1Bytes's own randomly-generated node (#973)
  • 6adcc1d fix(v1): carry nsecs overflow into the timestamp's high bits (#972)
  • ea83515 docs: cleanup API summary (#968)
  • ac36860 chore: pin publint version in CI (#966)
  • a67db57 fix(v7): align default seq formula in v7Bytes with updateV7State (#965)
  • See full diff in compare view

Updates @codemirror/search from 6.7.1 to 6.7.2

Commits

Updates @codemirror/state from 6.7.1 to 6.7.4

Commits

Updates @codemirror/view from 6.43.9 to 6.43.11

Commits

Updates @puppeteer/browsers from 3.2.0 to 3.2.2

Release notes

Sourced from @​puppeteer/browsers's releases.

browsers: v3.2.2

3.2.2 (2026-09-03)

🛠️ Fixes

  • revert launch browsers in detached mode on Windows to fix flakiness (#15415) (a84b032)

browsers: v3.2.1

3.2.1 (2026-08-17)

🛠️ Fixes

  • computeSystemExecutablePath support validatePath (#15340) (73da9a4)
  • launch browsers in detached mode on Windows to fix flakiness (#15339) (8e1022b)
  • tell the user how to recover a partial browser folder (#15319) (bbc51bd)
Changelog

Sourced from @​puppeteer/browsers's changelog.

23.2.2 (2024-09-03)

Miscellaneous Chores

  • puppeteer: Synchronize puppeteer versions

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 23.2.1 to 23.2.2

Bug Fixes

23.2.1 (2024-08-29)

Miscellaneous Chores

  • puppeteer: Synchronize puppeteer versions

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 23.2.0 to 23.2.1

Bug Fixes

Commits
  • 88b517a chore: release main (#15396)
  • a84b032 fix: revert launch browsers in detached mode on Windows to fix flakiness (#15...
  • 7a17a9a chore(deps): bump the all group across 1 directory with 2 updates (#15368)
  • 4ff495d test: explain the CDP-only mouse expectations (#15380)
  • c3ca313 test: update webmcp-types dep and simplify execute handler signatures (#15414)
  • 8ca9ab4 chore(deps-dev): bump browserslist from 4.28.4 to 4.28.8 (#15413)
  • 3744bad chore(deps-dev): bump @​humanfs/node from 0.16.7 to 0.16.8 (#15412)
  • 051c195 chore(deps): bump fast-uri from 3.1.5 to 3.1.7 in /website (#15411)
  • 89f3f18 fix: roll to Chrome 152.0.7977.75 (#15409)
  • ed544f7 feat: roll to Firefox 155.0 (#15408)
  • Additional commits viewable in compare view

Updates autoprefixer from 10.5.4 to 10.5.5

Release notes

Sourced from autoprefixer's releases.

10.5.5

Changelog

Sourced from autoprefixer's changelog.

10.5.5

Commits

Updates css-loader from 7.1.4 to 7.1.5

Release notes

Sourced from css-loader's releases.

v7.1.5

7.1.5 (2026-08-28)

Bug Fixes

  • strip BOM before processing with postcss (#1684) (bd20834)
Changelog

Sourced from css-loader's changelog.

7.1.5 (2026-08-28)

Bug Fixes

  • strip BOM before processing with postcss (#1684) (bd20834)
Commits
  • be04ec2 chore(release): 7.1.5
  • 405bdde docs: deprecate css-loader in favor of webpack's built-in CSS support (#1683)
  • bd20834 fix: strip BOM before processing with postcss (#1684)
  • 488cdb1 chore(deps-dev): bump lodash from 4.17.23 to 4.18.1 (#1663)
  • fd4cb47 chore(deps-dev): bump flatted from 3.3.3 to 3.4.2 (#1659)
  • 4bf84fa docs: clarify style-loader usage in Getting Started (#1656)
  • d7441e5 chore(deps): bump immutable from 5.1.3 to 5.1.5 (#1654)
  • ca53a77 chore(deps): bump minimatch (#1653)
  • See full diff in compare view

Updates postcss from 8.5.26 to 8.5.28

Release notes

Sourced from postcss's releases.

8.5.28

  • Fixes types regression.

8.5.27

Changelog

Sourced from postcss's changelog.

8.5.28

  • Fixes types regression.

8.5.27

Commits

Updates webpack-bundle-analyzer from 5.3.1 to 5.3.2

Release notes

Sourced from webpack-bundle-analyzer's releases.

v5.3.2

Patch Changes

  • Parse Webpack 5 module maps nested in UMD wrappers, using bundle module IDs and Webpack runtime structure to choose among IIFE candidates. (by @​Menny1337 in #733)

  • Improve report generation performance for compilations with many assets. (by @​christiango in #723)

  • Resolve bundle assets and report files against the correct compiler output path when a plugin instance is shared by multiple compilers. (by @​utkarshalpha in #725)

Changelog

Sourced from webpack-bundle-analyzer's changelog.

5.3.2

Patch Changes

  • Parse Webpack 5 module maps nested in UMD wrappers, using bundle module IDs and Webpack runtime structure to choose among IIFE candidates. (by @​Menny1337 in #733)

  • Improve report generation performance for compilations with many assets. (by @​christiango in #723)

  • Resolve bundle assets and report files against the correct compiler output path when a plugin instance is shared by multiple compilers. (by @​utkarshalpha in #725)

Commits
  • a4d4123 chore(release): new release (#726)
  • a5b70c3 fix: parse Webpack 5 module maps nested in UMD wrappers (#733)
  • 24e3f77 Improve analyzer performance for bundles with many assets (#723)
  • 23adc7a docs: troubleshoot stats error-only (#730)
  • 34eec1b docs: add Jenkins CSP troubleshooting for blank static reports (#724)
  • 83a8ee5 fix: preserve compiler paths for shared plugin instances (#725)
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore (deps): bump the patch-updates group across 1 directory with 14…
23cd781 
… updates

Bumps the patch-updates group with 14 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@xmldom/xmldom](https://github.com/xmldom/xmldom) | `0.8.14` | `0.8.15` |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.4.13` | `3.4.15` |
| [kbpgp](https://github.com/keybase/kbpgp) | `2.1.18` | `2.1.19` |
| [markdown-it](https://github.com/markdown-it/markdown-it) | `14.3.0` | `14.3.1` |
| [otpauth](https://github.com/hectorm/otpauth) | `9.5.1` | `9.5.2` |
| [uuid](https://github.com/uuidjs/uuid) | `14.0.1` | `14.0.2` |
| [@codemirror/search](https://github.com/codemirror/search) | `6.7.1` | `6.7.2` |
| [@codemirror/state](https://github.com/codemirror/state) | `6.7.1` | `6.7.4` |
| [@codemirror/view](https://github.com/codemirror/view) | `6.43.9` | `6.43.11` |
| [@puppeteer/browsers](https://github.com/puppeteer/puppeteer) | `3.2.0` | `3.2.2` |
| [autoprefixer](https://github.com/postcss/autoprefixer) | `10.5.4` | `10.5.5` |
| [css-loader](https://github.com/webpack/css-loader) | `7.1.4` | `7.1.5` |
| [postcss](https://github.com/postcss/postcss) | `8.5.26` | `8.5.28` |
| [webpack-bundle-analyzer](https://github.com/webpack/webpack-bundle-analyzer) | `5.3.1` | `5.3.2` |



Updates `@xmldom/xmldom` from 0.8.14 to 0.8.15
- [Release notes](https://github.com/xmldom/xmldom/releases)
- [Changelog](https://github.com/xmldom/xmldom/blob/master/CHANGELOG.md)
- [Commits](xmldom/xmldom@0.8.14...0.8.15)

Updates `dompurify` from 3.4.13 to 3.4.15
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.13...3.4.15)

Updates `kbpgp` from 2.1.18 to 2.1.19
- [Changelog](https://github.com/keybase/kbpgp/blob/master/CHANGELOG.md)
- [Commits](keybase/kbpgp@v2.1.18...v2.1.19)

Updates `markdown-it` from 14.3.0 to 14.3.1
- [Changelog](https://github.com/markdown-it/markdown-it/blob/14.3.1/CHANGELOG.md)
- [Commits](markdown-it/markdown-it@14.3.0...14.3.1)

Updates `otpauth` from 9.5.1 to 9.5.2
- [Release notes](https://github.com/hectorm/otpauth/releases)
- [Commits](hectorm/otpauth@v9.5.1...v9.5.2)

Updates `uuid` from 14.0.1 to 14.0.2
- [Release notes](https://github.com/uuidjs/uuid/releases)
- [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md)
- [Commits](uuidjs/uuid@v14.0.1...v14.0.2)

Updates `@codemirror/search` from 6.7.1 to 6.7.2
- [Changelog](https://github.com/codemirror/search/blob/main/CHANGELOG.md)
- [Commits](https://github.com/codemirror/search/commits)

Updates `@codemirror/state` from 6.7.1 to 6.7.4
- [Changelog](https://github.com/codemirror/state/blob/main/CHANGELOG.md)
- [Commits](https://github.com/codemirror/state/commits)

Updates `@codemirror/view` from 6.43.9 to 6.43.11
- [Changelog](https://github.com/codemirror/view/blob/main/CHANGELOG.md)
- [Commits](https://github.com/codemirror/view/commits)

Updates `@puppeteer/browsers` from 3.2.0 to 3.2.2
- [Release notes](https://github.com/puppeteer/puppeteer/releases)
- [Changelog](https://github.com/puppeteer/puppeteer/blob/main/CHANGELOG.md)
- [Commits](puppeteer/puppeteer@v3.2.0...browsers-v3.2.2)

Updates `autoprefixer` from 10.5.4 to 10.5.5
- [Release notes](https://github.com/postcss/autoprefixer/releases)
- [Changelog](https://github.com/postcss/autoprefixer/blob/main/CHANGELOG.md)
- [Commits](postcss/autoprefixer@10.5.4...10.5.5)

Updates `css-loader` from 7.1.4 to 7.1.5
- [Release notes](https://github.com/webpack/css-loader/releases)
- [Changelog](https://github.com/webpack/css-loader/blob/main/CHANGELOG.md)
- [Commits](webpack/css-loader@v7.1.4...v7.1.5)

Updates `postcss` from 8.5.26 to 8.5.28
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.26...8.5.28)

Updates `webpack-bundle-analyzer` from 5.3.1 to 5.3.2
- [Release notes](https://github.com/webpack/webpack-bundle-analyzer/releases)
- [Changelog](https://github.com/webpack/webpack-bundle-analyzer/blob/main/CHANGELOG.md)
- [Commits](webpack/webpack-bundle-analyzer@v5.3.1...v5.3.2)

---
updated-dependencies:
- dependency-name: "@xmldom/xmldom"
  dependency-version: 0.8.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: dompurify
  dependency-version: 3.4.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: kbpgp
  dependency-version: 2.1.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: markdown-it
  dependency-version: 14.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: otpauth
  dependency-version: 9.5.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: uuid
  dependency-version: 14.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: "@codemirror/search"
  dependency-version: 6.7.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: "@codemirror/state"
  dependency-version: 6.7.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: "@codemirror/view"
  dependency-version: 6.43.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: "@puppeteer/browsers"
  dependency-version: 3.2.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: autoprefixer
  dependency-version: 10.5.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: css-loader
  dependency-version: 7.1.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: postcss
  dependency-version: 8.5.28
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: webpack-bundle-analyzer
  dependency-version: 5.3.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: patch-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants