Skip to content

build(deps): Bump the npm_and_yarn group across 2 directories with 18 updates - #518

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-fe4c8ffebc
Closed

build(deps): Bump the npm_and_yarn group across 2 directories with 18 updates#518
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-fe4c8ffebc

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github May 20, 2026

Copy link
Copy Markdown

Bumps the npm_and_yarn group with 14 updates in the / directory:

Package From To
vue 2.7.16 3.0.0
brace-expansion 1.1.12 2.1.0
minimatch 3.1.2 9.0.9
dompurify 2.5.8 3.4.5
picomatch 2.3.1 2.3.2
picomatch 4.0.3 4.0.4
postcss 8.5.6 8.5.15
axios 1.13.5 1.16.1
fast-uri 3.1.0 3.1.2
flatted 3.3.3 3.4.2
immutable 5.1.4 5.1.5
lodash 4.17.23 4.18.1
path-to-regexp 0.1.12 0.1.13
serialize-javascript 6.0.2 removed
webpack-dev-server 5.2.3 5.2.4

Bumps the npm_and_yarn group with 2 updates in the /docusaurus directory: brace-expansion and minimatch.

Updates vue from 2.7.16 to 3.0.0

Changelog

Sourced from vue's changelog.

3.0.0 (2020-09-18)

3.0.0-rc.13 (2020-09-18)

Bug Fixes

  • hmr: make hmr working with class components (#2144) (422f05e)
  • reactivity: avoid length mutating array methods causing infinite updates (#2138) (f316a33), closes #2137
  • suspense: should discard unmount effects of invalidated pending branch (5bfcad1)
  • types: component instance inference without props (#2145) (57bdaa2)

Code Refactoring

Features

  • runtime-core: support using inject() inside props default functions (58c31e3)
  • watch: support dot-delimited path in watch option (1c9a0b3)

BREAKING CHANGES

  • watch APIs now default to use flush: 'pre' instead of flush: 'post'. This change affects watch, watchEffect, the watch component option, and this.$watch. See (49bb447) for more details.

3.0.0-rc.12 (2020-09-16)

Bug Fixes

  • reactivity: effect should only recursively self trigger with explicit options (3810de7), closes #2125
  • runtime-core: ensure root stable fragments inherit elements for moving (bebd44f), closes #2134
  • runtime-core: should still do full traverse of stable fragment children in dev + hmr (dd40ad8)
  • runtime-core/async-component: fix error component when there are no error handlers (c7b4a37), closes #2129
  • types/tsx: optional props from Mixin/Extends are treated as required (#2048) (89e9ab8)

Features

  • compiler-sfc: additionalData support for css preprocessors (#2126) (066d514)

3.0.0-rc.11 (2020-09-15)

... (truncated)

Commits

Updates brace-expansion from 1.1.12 to 2.1.0

Release notes

Sourced from brace-expansion's releases.

v2.0.2

  • pkg: publish on tag 2.x 14f1d91
  • fmt ed7780a
  • Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) 36603d5

juliangruber/brace-expansion@v2.0.1...v2.0.2

Commits

Updates minimatch from 3.1.2 to 9.0.9

Changelog

Sourced from minimatch's changelog.

change log

10.2

  • Add braceExpandMax option

10.1

  • Add magicalBraces option for escape
  • Fix makeRe when partial: true is set.
  • Fix makeRe when pattern ends in a final ** path part.

10.0

  • Require node 20 or 22 and higher

9.0

  • No default export, only named exports.

8.0

  • Recursive descent parser for extglob, allowing correct support for arbitrarily nested extglob expressions
  • Bump required Node.js version

7.4

  • Add escape() method
  • Add unescape() method
  • Add Minimatch.hasMagic() method

7.3

  • Add support for posix character classes in a unicode-aware way.

7.2

  • Add windowsNoMagicRoot option

7.1

  • Add optimizationLevel configuration option, and revert the default back to the 6.2 style minimal optimizations, making the advanced transforms introduced in 7.0 opt-in. Also, process provided file paths in the same way in optimizationLevel:2 mode, so most things that matched with optimizationLevel 1 or 0 should match with level 2 as well. However, level 1 is the default, out of an abundance of caution.

... (truncated)

Commits
Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates dompurify from 2.5.8 to 3.4.5

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.5

  • Fixed a bypass caused by the new HTML element selectedcontent added in 3.4.4, thanks @​KabirAcharya

Note that this is a security release for an issue introduced in 3.4.4 and should be upgraded to immediately.

DOMPurify 3.4.4

  • Added the selectedcontent element to default allow-list, thanks @​lukewarlow
  • Added the command and commandfor attributes to default allowed-list, thanks @​lukewarlow
  • Added better template scrubbing for IN_PLACE operations, thanks @​DEMON1A
  • Added stronger checks for cross-realm windows, thanks @​DEMON1A & @​fg0x0
  • Updated demo website and made sure it uses the latest from main
  • Updated existing workflows, fuzzer, dependabot, etc., added more tests
  • Bumped several dependencies where possible

🚨 This release had been flagged as deprecated, please use DOMPurify 3.4.5 instead 🚨

DOMPurify 3.4.3

  • Fixed an issue with handling of nested Shadow DOM trees, thanks @​fishjojo1
  • Fixed the template regexes to be more robust against ReDoS attacks, thanks @​aleung27
  • Updated the node iteration code to catch more Shadow DOM related issues
  • Updated Playwright and added Node 26 to test matrix
  • Updated existing workflows, fuzzer, release signing, etc., added more tests
  • Bumped several dependencies where possible

DOMPurify 3.4.2

  • Fixed an issue with URI validation on attributes allowed via ADD_ATTR callback, thanks @​nelstrom
  • Fixed an issue with source maps referring to non-existing files, thanks @​cmdcolin
  • Updated existing workflows, fuzzer, release signing, etc., added more tests
  • Bumped several dependencies where possible

DOMPurify 3.4.1

  • Fixed an issue with on-handler stripping for HTML-spec-reserved custom element names (font-face, color-profile, missing-glyph, font-face-src, font-face-uri, font-face-format, font-face-name) under permissive CUSTOM_ELEMENT_HANDLING
  • Fixed a case-sensitivity gap in the annotation-xml check that allowed mixed-case variants to bypass the basic-custom-element exclusion in XHTML mode
  • Fixed SANITIZE_NAMED_PROPS repeatedly prefixing already-prefixed id and name values on subsequent sanitization
  • Fixed the IN_PLACE root-node check to explicitly guard against non-string nodeName (DOM-clobbering robustness)
  • Removed a duplicate slot entry from the default HTML attribute allow-list
  • Strengthened the fast-check fuzz harness with explicit XSS invariants, an expanded seed-payload corpus, an additional idempotence property for SANITIZE_NAMED_PROPS, and a negative-control assertion ensuring the invariants actually fire
  • Added regression and pinning tests covering the above fixes and two accepted-behavior contracts (SAFE_FOR_TEMPLATES greedy scrub, hook-added attribute handling)
  • Extended CodeQL analysis to run on 3.x and 2.x maintenance branches

DOMPurify 3.4.0

Most relevant changes:

  • Fixed a problem with FORBID_TAGS not winning over ADD_TAGS, thanks @​kodareef5
  • Fixed several minor problems and typos regarding MathML attributes, thanks @​DavidOliver
  • Fixed ADD_ATTR/ADD_TAGS function leaking into subsequent array-based calls, thanks @​1Jesper1
  • Fixed a missing SAFE_FOR_TEMPLATES scrub in RETURN_DOM path, thanks @​bencalif
  • Fixed a prototype pollution via CUSTOM_ELEMENT_HANDLING, thanks @​trace37labs
  • Fixed an issue with ADD_TAGS function form bypassing FORBID_TAGS, thanks @​eddieran
  • Fixed an issue with ADD_ATTR predicates skipping URI validation, thanks @​christos-eth

... (truncated)

Commits
Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates picomatch from 2.3.1 to 2.3.2

Release notes

Sourced from picomatch's releases.

2.3.2

This is a security release fixing several security relevant issues.

What's Changed

Full Changelog: micromatch/picomatch@2.3.1...2.3.2

Changelog

Sourced from picomatch's changelog.

Release history

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

  • Changelogs are for humans, not machines.
  • There should be an entry for every single version.
  • The same types of changes should be grouped.
  • Versions and sections should be linkable.
  • The latest version comes first.
  • The release date of each versions is displayed.
  • Mention whether you follow Semantic Versioning.

Changelog entries are classified using the following labels (from keep-a-changelog):

  • Added for new features.
  • Changed for changes in existing functionality.
  • Deprecated for soon-to-be removed features.
  • Removed for now removed features.
  • Fixed for any bug fixes.
  • Security in case of vulnerabilities.

4.0.0 (2024-02-07)

Fixes

Changed

3.0.1

Fixes

... (truncated)

Commits

Updates picomatch from 4.0.3 to 4.0.4

Release notes

Sourced from picomatch's releases.

2.3.2

This is a security release fixing several security relevant issues.

What's Changed

Full Changelog: micromatch/picomatch@2.3.1...2.3.2

Changelog

Sourced from picomatch's changelog.

Release history

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

  • Changelogs are for humans, not machines.
  • There should be an entry for every single version.
  • The same types of changes should be grouped.
  • Versions and sections should be linkable.
  • The latest version comes first.
  • The release date of each versions is displayed.
  • Mention whether you follow Semantic Versioning.

Changelog entries are classified using the following labels (from keep-a-changelog):

  • Added for new features.
  • Changed for changes in existing functionality.
  • Deprecated for soon-to-be removed features.
  • Removed for now removed features.
  • Fixed for any bug fixes.
  • Security in case of vulnerabilities.

4.0.0 (2024-02-07)

Fixes

Changed

3.0.1

Fixes

... (truncated)

Commits

Updates postcss from 8.5.6 to 8.5.15

Release notes

Sourced from postcss's releases.

8.5.15

  • Fixed declaration parsing performance (by @​homanp).

8.5.14

8.5.13

  • Fixed postcss-scss commend regression.

8.5.12

  • Fixed reading any file via user-generated CSS.
  • Added opts.unsafeMap to disable checks.

8.5.11

  • Fixed nested brackets parsing performance (by @​offset).

8.5.10

  • Fixed XSS via unescaped </style> in non-bundler cases (by @​TharVid).

8.5.9

  • Speed up source map encoding paring in case of the error.

8.5.8

  • Fixed Processor#version.

8.5.7

  • Improved source map annotation cleaning performance (by CodeAnt AI).
Changelog

Sourced from postcss's changelog.

8.5.15

  • Fixed declaration parsing performance (by @​homanp).

8.5.14

8.5.13

  • Fixed postcss-scss commend regression.

8.5.12

  • Fixed reading any file via user-generated CSS.
  • Added opts.unsafeMap to disable checks.

8.5.11

  • Fixed nested brackets parsing performance (by @​offset).

8.5.10

  • Fixed XSS via unescaped </style> in non-bundler cases (by @​TharVid).

8.5.9

  • Speed up source map encoding paring in case of the error.

8.5.8

  • Fixed Processor#version.

8.5.7

  • Improved source map annotation cleaning performance (by CodeAnt AI).
Commits
  • eae46db Release 8.5.15 version
  • 79508ff Update CI actions
  • b128e21 Speed up declaration parsing by avoiding creating new array on each token
  • 9825dca Fix code format
  • 55789c8 Update dependencies
  • 84fbbe9 Install older pnpm action for old Node.js
  • 9f860bd Revert pnpm action for old Node.js
  • 0877198 Update CI actions
  • b2d1a33 Fix linter warnings
  • 0700dac Merge pull request #2088 from rootvector2/add-oss-fuzz-harness
  • Additional commits viewable in compare view

Updates axios from 1.13.5 to 1.16.1

Release notes

Sourced from axios's releases.

v1.16.1 — May 13, 2026

This release ships a defence-in-depth fix for prototype pollution in formDataToJSON, hardens proxy and CI workflows, restores Webpack 4 compatibility for the fetch adapter, and includes several small bug fixes and maintenance improvements.

🔒 Security Fixes

  • Prototype Pollution Defence-in-Depth: Hardened formDataToJSON against already-polluted Object.prototype by walking own properties only, so attacker-controlled keys inherited from a poisoned prototype cannot propagate through deserialization. (#7413)
  • Proxy Cleartext Leak: Fixed an issue where HTTPS request data could be transmitted in cleartext to an HTTP proxy under certain configurations. (#10858)
  • CI Cache Removal: Removed all GitHub Actions caches as a defence-in-depth measure against cache poisoning vectors in the build pipeline. (#10882)

🐛 Bug Fixes

  • Data URI Parsing: Updated the fromDataURI regex to match RFC 2397 more strictly, fixing edge cases in data: URL handling. (#10829)
  • Unicode Headers: Preserved Unicode header values when running through request interceptors, so non-ASCII header content is no longer corrupted before dispatch. (#10850)
  • XHR Upload Progress: Guarded against malformed ProgressEvent payloads emitted by some environments during XHR upload, preventing crashes when loaded / total are missing or invalid. (#10868)
  • Webpack 4 Fetch Adapter: Fixed an "unexpected token" error caused by syntax in the fetch adapter that Webpack 4 could not parse, restoring compatibility for legacy bundler users. (#10864)
  • Type Definitions: Made parseReviver context.source optional in the type definitions to align with the ES2023 specification. (#10837)
  • URL Object Support Reverted: Reverted the change that allowed passing a URL object as config.url (originally #10866) due to regressions; this support will be reintroduced in a later release once the underlying issues are addressed. (#10874)

🔧 Maintenance & Chores

  • Cycle Detection Refactor: Replaced the array-based cycle tracker in toJSONObject with a WeakSet, improving performance and memory behaviour on large nested structures. (#10832)
  • composeSignals Cleanup: Refactored composeSignals to use a clearer early-return structure, simplifying the cancellation/abort composition path. (#10844)
  • AI Readiness & Repo Docs: Added AGENTS.md and related contributor-guide updates for both human and AI agents, plus post-release documentation improvements. (#10835, #10841)
  • Docs Improvements: Clarified the GET request example, fixed the interceptor eject example to reference the correct instance, and corrected the Buzzoid sponsor description in the README. (#10836, #10853, #10856)
  • Sponsorship Tooling: Fixed empty sponsor arrays in the sponsor processing script, added the ability to inject additional sponsors, updated the sponsorship link, and added a Twicsy advertisement entry. (#10843, #10859, #10869)
  • Dependencies: Bumped @commitlint/cli from 20.5.0 to 20.5.2. (#10846)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

Full Changelog

v1.16.0 — May 2, 2026

This release adds support for the QUERY HTTP method and a new ECONNREFUSED error constant, lands a substantial wave of HTTP, fetch, and XHR adapter bug fixes around redirects, aborts, headers, and timeouts, and welcomes 23 new contributors.

⚠️ Notable Changes

A handful of fixes in this release are either security-adjacent or change observable behaviour. Please review before upgrading:

... (truncated)

Changelog

Sourced from axios's changelog.

v1.16.1 — May 13, 2026

This release ships a defence-in-depth fix for prototype pollution in formDataToJSON, hardens proxy and CI workflows, restores Webpack 4 compatibility for the fetch adapter, and includes several small bug fixes and maintenance improvements.

🔒 Security Fixes

  • Prototype Pollution Defence-in-Depth: Hardened formDataToJSON against already-polluted Object.prototype by walking own properties only, so attacker-controlled keys inherited from a poisoned prototype cannot propagate through deserialization. (#7413)
  • Proxy Cleartext Leak: Fixed an issue where HTTPS request data could be transmitted in cleartext to an HTTP proxy under certain configurations. (#10858)
  • CI Cache Removal: Removed all GitHub Actions caches as a defence-in-depth measure against cache poisoning vectors in the build pipeline. (#10882)

🐛 Bug Fixes

  • Data URI Parsing: Updated the fromDataURI regex to match RFC 2397 more strictly, fixing edge cases in data: URL handling. (#10829)
  • Unicode Headers: Preserved Unicode header values when running through request interceptors, so non-ASCII header content is no longer corrupted before dispatch. (#10850)
  • XHR Upload Progress: Guarded against malformed ProgressEvent payloads emitted by some environments during XHR upload, preventing crashes when loaded / total are missing or invalid. (#10868)
  • Webpack 4 Fetch Adapter: Fixed an "unexpected token" error caused by syntax in the fetch adapter that Webpack 4 could not parse, restoring compatibility for legacy bundler users. (#10864)
  • Type Definitions: Made parseReviver context.source optional in the type definitions to align with the ES2023 specification. (#10837)
  • URL Object Support Reverted: Reverted the change that allowed passing a URL object as config.url (originally #10866) due to regressions; this support will be reintroduced in a later release once the underlying issues are addressed. (#10874)

🔧 Maintenance & Chores

  • Cycle Detection Refactor: Replaced the array-based cycle tracker in toJSONObject with a WeakSet, improving performance and memory behaviour on large nested structures. (#10832)
  • composeSignals Cleanup: Refactored composeSignals to use a clearer early-return structure, simplifying the cancellation/abort composition path. (#10844)
  • AI Readiness & Repo Docs: Added AGENTS.md and related contributor-guide updates for both human and AI agents, plus post-release documentation improvements. (#10835, #10841)
  • Docs Improvements: Clarified the GET request example, fixed the interceptor eject example to reference the correct instance, and corrected the Buzzoid sponsor description in the README. (#10836, #10853, #10856)
  • Sponsorship Tooling: Fixed empty sponsor arrays in the sponsor processing script, added the ability to inject additional sponsors, updated the sponsorship link, and added a Twicsy advertisement entry. (#10843, #10859, #10869)
  • Dependencies: Bumped @commitlint/cli from 20.5.0 to 20.5.2. (#10846)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

Full Changelog

v1.16.0 — May 2, 2026

This release adds support for the QUERY HTTP method and a new ECONNREFUSED error constant, lands a substantial wave of HTTP, fetch, and XHR adapter bug fixes around redirects, aborts, headers, and timeouts, and welcomes 23 new contributors.

⚠️ Notable Changes

A handful of fixes in this release are either security-adjacent or change observable behaviour. Please review before upgrading:

... (truncated)

Commits
  • 1337d6b chore(release): prepare release 1.16.1 (#10877)
  • 858a790 fix: remove all caches (#10882)
  • 34adfd9 revert: "fix: support URL object as config.url input (#10866)" (#10874)
  • 847d89b fix: support URL object as config.url input (#10866)
  • 4094886 fix(progress): guard malformed XHR upload events (#10868)
  • 44f0c5b chore: change sponsorship link and add Twicsy advertisement (#10869)
  • 64e1095 chore: update PR and issue template to use h2 (#10865)
  • 3e6b4e1 fix: error unexpected token in fetch JS compatibility issue with Webpack 4 (#...
  • c4453ba fix: add the ability to add additional sponsors to the process sponsors scrip...
  • caa00a9 fix: https data in cleartext to proxy (#10858)
  • Additional commits viewable in compare view
Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates fast-uri from 3.1.0 to 3.1.2

Release notes

Sourced from fast-uri's releases.

v3.1.2

⚠️ Security Release

What's Changed

Full Changelog: fastify/fast-uri@v3.1.1...v3.1.2

v3.1.1

⚠️ Security Release

What's Changed

New Contributors

Full Changelog: fastify/fast-uri@v3.1.0...v3.1.1

Commits
  • 919dd8e Bumped v3.1.2
  • c65ba57 fixup: linting
  • 6c86c17 Merge commit from fork
  • a95158a Handle malformed fragment decoding without throwing (#171)
  • cea547c Bumped v3.1.1
  • 876ce79 Merge commit from fork
  • dcdf690 ci: add lock-threads workflow (#169)
  • c860e65 build(deps-dev): bump neostandard from 0.12.2 to 0.13.0 (#167)
  • 9b4c6dc build(deps): bump fastify/workflows/.github/workflows/plugins-ci.yml (#166)
  • 85d09a9 build(deps): bump fastify/workflows/.github/workflows/plugins-ci-package-mana...
  • Additional commits viewable in compare view

Updates flatted from 3.3.3 to 3.4.2

Commits
  • 3bf0909 3.4.2
  • 885ddcc fix CWE-1321
  • 0bdba70 added flatted-view to the benchmark
  • 2a02dce 3.4.1
  • fba4e8f Merge pull request #89 from WebReflection/python-fix
  • 5fe8648 added "when in Rome" also a test for PHP
  • 53517ad some minor improvement
  • b3e2a0c Fixing recursion issue in Python too
  • c4b46db Add SECURITY.md for security policy and reporting
  • f86d071 Create dependabot.yml for version updates
  • Additional commits viewable in compare view

Updates follow-redirects from 1.15.11 to 1.16.0

Commits
  • 0c23a22 Release version 1.16.0 of the npm package.
  • 844c4d3 Add sensitiveHeaders option.
  • 5e8b8d0 ci: add Node.js 24.x to the CI matrix
  • 7953e22 ci: upgrade GitHub Actions to use setup-node@v6 and checkout@v6
  • 86dc1f8 Sanitizing input.
  • See full diff in compare view

Updates immutable from 5.1.4 to 5.1.5

Release notes

Sourced from immutable's releases.

v5.1.5

What's Changed

Full Changelog: immutable-js/immutable-js@v5.1.4...v5.1.5

Changelog

Sourced from immutable's changelog.

5.1.5

  • Fix Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable
Commits

@dependabot
build(deps): Bump the npm_and_yarn group across 2 directories with 18…
b35f41a 
… updates

Bumps the npm_and_yarn group with 14 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [vue](https://github.com/vuejs/core) | `2.7.16` | `3.0.0` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.12` | `2.1.0` |
| [minimatch](https://github.com/isaacs/minimatch) | `3.1.2` | `9.0.9` |
| [dompurify](https://github.com/cure53/DOMPurify) | `2.5.8` | `3.4.5` |
| [picomatch](https://github.com/micromatch/picomatch) | `2.3.1` | `2.3.2` |
| [picomatch](https://github.com/micromatch/picomatch) | `4.0.3` | `4.0.4` |
| [postcss](https://github.com/postcss/postcss) | `8.5.6` | `8.5.15` |
| [axios](https://github.com/axios/axios) | `1.13.5` | `1.16.1` |
| [fast-uri](https://github.com/fastify/fast-uri) | `3.1.0` | `3.1.2` |
| [flatted](https://github.com/WebReflection/flatted) | `3.3.3` | `3.4.2` |
| [immutable](https://github.com/immutable-js/immutable-js) | `5.1.4` | `5.1.5` |
| [lodash](https://github.com/lodash/lodash) | `4.17.23` | `4.18.1` |
| [path-to-regexp](https://github.com/pillarjs/path-to-regexp) | `0.1.12` | `0.1.13` |
| [serialize-javascript](https://github.com/yahoo/serialize-javascript) | `6.0.2` | `removed` |
| [webpack-dev-server](https://github.com/webpack/webpack-dev-server) | `5.2.3` | `5.2.4` |

Bumps the npm_and_yarn group with 2 updates in the /docusaurus directory: [brace-expansion](https://github.com/juliangruber/brace-expansion) and [minimatch](https://github.com/isaacs/minimatch).


Updates `vue` from 2.7.16 to 3.0.0
- [Release notes](https://github.com/vuejs/core/releases)
- [Changelog](https://github.com/vuejs/core/blob/v3.0.0/CHANGELOG.md)
- [Commits](https://github.com/vuejs/core/commits/v3.0.0)

Updates `brace-expansion` from 1.1.12 to 2.1.0
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.12...v2.1.0)

Updates `minimatch` from 3.1.2 to 9.0.9
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v3.1.2...v9.0.9)

Updates `dompurify` from 2.5.8 to 3.4.5
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@2.5.8...3.4.5)

Updates `picomatch` from 2.3.1 to 2.3.2
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@2.3.1...2.3.2)

Updates `picomatch` from 4.0.3 to 4.0.4
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@2.3.1...2.3.2)

Updates `postcss` from 8.5.6 to 8.5.15
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.6...8.5.15)

Updates `axios` from 1.13.5 to 1.16.1
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.13.5...v1.16.1)

Updates `fast-uri` from 3.1.0 to 3.1.2
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.0...v3.1.2)

Updates `flatted` from 3.3.3 to 3.4.2
- [Commits](WebReflection/flatted@v3.3.3...v3.4.2)

Updates `follow-redirects` from 1.15.11 to 1.16.0
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](follow-redirects/follow-redirects@v1.15.11...v1.16.0)

Updates `immutable` from 5.1.4 to 5.1.5
- [Release notes](https://github.com/immutable-js/immutable-js/releases)
- [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md)
- [Commits](immutable-js/immutable-js@v5.1.4...v5.1.5)

Updates `lodash` from 4.17.23 to 4.18.1
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.23...4.18.1)

Updates `path-to-regexp` from 0.1.12 to 0.1.13
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/v.0.1.13/History.md)
- [Commits](pillarjs/path-to-regexp@v0.1.12...v.0.1.13)

Removes `serialize-javascript`

Updates `webpack-dev-server` from 5.2.3 to 5.2.4
- [Release notes](https://github.com/webpack/webpack-dev-server/releases)
- [Changelog](https://github.com/webpack/webpack-dev-server/blob/main/CHANGELOG.md)
- [Commits](webpack/webpack-dev-server@v5.2.3...v5.2.4)

Updates `brace-expansion` from 1.1.12 to 1.1.14
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.12...v2.1.0)

Updates `minimatch` from 3.1.2 to 3.1.5
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v3.1.2...v9.0.9)

Updates `dompurify` from 3.3.1 to 3.4.5
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@2.5.8...3.4.5)

Updates `picomatch` from 2.3.1 to 2.3.2
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@2.3.1...2.3.2)

Updates `postcss` from 8.5.6 to 8.5.15
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.6...8.5.15)

Updates `fast-uri` from 3.1.0 to 3.1.2
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.0...v3.1.2)

Updates `follow-redirects` from 1.15.11 to 1.16.0
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](follow-redirects/follow-redirects@v1.15.11...v1.16.0)

Updates `lodash` from 4.17.23 to 4.18.1
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.23...4.18.1)

Updates `path-to-regexp` from 0.1.12 to 0.1.13
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/v.0.1.13/History.md)
- [Commits](pillarjs/path-to-regexp@v0.1.12...v.0.1.13)

Updates `webpack-dev-server` from 5.2.3 to 4.15.2
- [Release notes](https://github.com/webpack/webpack-dev-server/releases)
- [Changelog](https://github.com/webpack/webpack-dev-server/blob/main/CHANGELOG.md)
- [Commits](webpack/webpack-dev-server@v5.2.3...v5.2.4)

Updates `@babel/plugin-transform-modules-systemjs` from 7.29.0 to 7.29.4
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.29.4/packages/babel-plugin-transform-modules-systemjs)

Updates `mermaid` from 11.12.3 to 10.9.6
- [Release notes](https://github.com/mermaid-js/mermaid/releases)
- [Commits](https://github.com/mermaid-js/mermaid/compare/mermaid@11.12.3...v10.9.6)

Updates `svgo` from 3.3.2 to 3.3.3
- [Release notes](https://github.com/svg/svgo/releases)
- [Commits](svg/svgo@v3.3.2...v3.3.3)

---
updated-dependencies:
- dependency-name: vue
  dependency-version: 3.0.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 2.1.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: minimatch
  dependency-version: 9.0.9
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: dompurify
  dependency-version: 3.4.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: picomatch
  dependency-version: 2.3.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: picomatch
  dependency-version: 4.0.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: postcss
  dependency-version: 8.5.15
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: axios
  dependency-version: 1.16.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fast-uri
  dependency-version: 3.1.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: flatted
  dependency-version: 3.4.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: follow-redirects
  dependency-version: 1.16.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: immutable
  dependency-version: 5.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: path-to-regexp
  dependency-version: 0.1.13
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: serialize-javascript
  dependency-version:
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: webpack-dev-server
  dependency-version: 5.2.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 1.1.14
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: minimatch
  dependency-version: 3.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: dompurify
  dependency-version: 3.4.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: picomatch
  dependency-version: 2.3.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: postcss
  dependency-version: 8.5.15
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fast-uri
  dependency-version: 3.1.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: follow-redirects
  dependency-version: 1.16.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: path-to-regexp
  dependency-version: 0.1.13
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: webpack-dev-server
  dependency-version: 4.15.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@babel/plugin-transform-modules-systemjs"
  dependency-version: 7.29.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: mermaid
  dependency-version: 10.9.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: svgo
  dependency-version: 3.3.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 20, 2026
@rubenvdlinde

rubenvdlinde commented Aug 8, 2026

Copy link
Copy Markdown
Contributor

Closing as superseded by #672 (and by the vue-3 line already merged to development).

Two independent reasons, both from reading the diff rather than the title:

1. It proposes a wrong major as a security bump. The table's first row is vue 2.7.16 → 3.0.0 — Vue 3.0.0 is the September 2020 GA release, i.e. dependabot resolved 'lowest version without the advisory' across a major boundary. That migration was done properly on development instead, through the @conduction/nextcloud-vue vue3 line (#727, #730, #736); development is on vue 3.5.40. Landing 3.0.0 would be a large step backwards from that.

2. Everything else is already at or ahead on development. Measured against origin/development (c953aab) package-lock.json, every remaining target is met or exceeded — dompurify 3.4.13 (target 3.4.5), postcss 8.5.25 (8.5.15), axios 1.19.0 (1.16.1), fast-uri 3.1.5 (3.1.2), flatted 3.4.4 (3.4.2), immutable 5.1.9 (5.1.5), lodash 4.18.1 (4.18.1); serialize-javascript, webpack-dev-server and path-to-regexp are no longer in the tree at all.

#672 covers the same ground more recently and at higher versions. See #672 for the standing blocker on the group.

@dependabot @github

dependabot Bot commented on behalf of github Aug 8, 2026

Copy link
Copy Markdown
Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/npm_and_yarn-fe4c8ffebc branch August 8, 2026 10:33
This was referenced Aug 8, 2026
Open
Closed
Merged
@rubenvdlinde rubenvdlinde mentioned this pull request Aug 15, 2026
Merged
rubenvdlinde pushed a commit that referenced this pull request Aug 15, 2026
Conduction Release Bot
test(procest): cover the slug step's shared helper and its name
200ce73 
The coverage guard failed the stable34 cell by 0.01% — a repair step needs
a database, so most of it is unreachable from a unit suite. Same answer as
softwarecatalog #518: move what is a decision rather than DDL into the
injected collaborator.

`placeholders()` is trivial and earns its place anyway: the step builds an
IN list three times, and a mismatch between placeholder count and bound
parameters surfaces only at runtime, inside a repair step, on somebody
else's install. Tested for 0 and for a negative count too.

Also worth recording: CI reports 'Tests: 1921' in that job and I briefly
read it as my five new tests not running. It is the MERGE BASE run — the
coverage job checks out head, then the base, to compare. Head reports
1926. Colour codes hid the first line from a plain grep.
rubenvdlinde added a commit that referenced this pull request Aug 15, 2026
@rubenvdlinde Conduction Release Bot
refactor(procest): translate 8 schema slugs, and the migration that m…
c7289af 
…oves them (#849)

* refactor(procest): translate 14 schema slugs, and the migration that moves them

A schema slug is what OpenRegister's ImportHandler matches an incoming
schema against (`SchemaMapper::findBySlugInIds()`). Changing it in the
register JSON renames NOTHING: the import finds no match, creates a
second schema, and every stored object stays on the old one. Nothing
raises — it presents as an app with no records. So this adds
`RenameDutchSchemaSlugs`, registered FIRST in post-migration, ahead of
both import triggers (InitializeSettings for the procest register,
RegisterOriRegister for ORI).

The six ORI schemas move too. Open Raadsinformatie / VNG ODS-O is a
standard, and a standard's own spelling belongs in a MAPPING — which is
configuration, and out of scope for translation. A SCHEMA is English.
procest has `LoadDefaultZgwMappings` for ZGW and nothing equivalent for
ORI, so nothing consumes the standard's spelling from these schemas
today; giving ORI a real mapping is separate work and worth doing.

`bezwaar` is HELD BACK, and the reason is the interesting part.

Renaming it onto `objection` produced a DUPLICATE JSON KEY. That is legal
JSON: the file parsed, every check passed, and the consistency check I
wrote passed too — because it read the already-deduplicated structure.
Python, PHP and JS all keep the LAST key, so the `bezwaar` schema's
`x-openregister-lifecycle` and `x-openregister-calculations` simply
vanished. Nine tests caught it; no linter could have. **A file that
parses is not a file that kept your data.**

They are also not duplicates. PanelIndependenceChecker resolves
`bacAdviceRequest.bezwaar -> bezwaar (lifecycle record) -> bezwaar.case
-> objection (filed on that case)`, and SettingsService carries separate
`bezwaar_schema` and `objection_schema` keys. Naming the lifecycle record
in English is a design decision, not a translation.

`rename-slugs.js` now refuses when the target is already a schema, and
grew the schema-MAP-KEY pass it was missing: a slug lives in three places
— the `slug` value, the `/components/schemas/` key, and the register's
`configuration.schemas` key — and softwarecatalog #518 had to fix the
last two by hand.

`subsidieaanvraag` is deferred: the property should become
`grantApplication`, but a seed caseType carries `subsidieaanvraag` as its
`identifier` VALUE, which other cases reference. The applier refused it
for the wrong reason (it saw an object slug) and was right to.

Verified against a control built with `git archive origin/development`:
PHPUnit 1926 vs 1921 tests (+5 new), identical 4 errors and 2 failures,
none unique to this change. phpstan clean, psalm "No errors found",
phpmd clean, 0 phpcs errors on the new files, 386 routes resolve,
vitest 349, eslint 0 errors, l10n and manifest pass, no duplicate JSON
keys anywhere, no dangling $refs, no key/slug mismatches, stale field
references unchanged at 11. Dutch names 18 -> 7.

* refactor(procest): leave the ORI schemas alone — decidesk already owns this

Reverts six of the fourteen slug renames. procest should not have an ORI
schema register at all, so renaming its schemas cements a structure that
is going away and mints names that collide conceptually with the ones
that are already canonical elsewhere.

decidesk already implements the intended architecture, and it is not a
plan — it is on development today: Popolo-shaped schemas (Person,
Membership, Post, Meeting, Vote, VotingRound, AgendaItem, GovernanceBody,
Minutes, Transcript), extended with schema.org through `x-schema-org`,
plus OriController and OriSerializer that map them onto ORI. The canonical
structure is Popolo; ORI is the mapping over it; and a mapping is
configuration, so its vocabulary may stay in the standard's own language.

That leaves procest's `ori` register as a duplicate of decidesk's, and the
fix is to remove it and consume decidesk's instead — a design change, not
a rename. Recorded rather than attempted here.

Reverted with the same tooling in reverse, then the twelve resulting
column-map entries were removed by hand: the forward six, two of which
the second pass had turned into identity mappings (`'stemming' =>
'stemming'`), and the reverse six that pointed English at Dutch. Two
column-map invariant tests caught exactly that — `testEveryEntryIsSnakeCase`
and `testNoTargetIsAlsoASource`.

Eight slugs remain in this PR, all procest's own vocabulary:
avgClassificatie, catalogus, dwangsomBerekening, ingebrekestelling,
kanaal, termijnDefinitie, termijnInstance, voorstel.

Re-verified against the same control: PHPUnit 1926 vs 1921 (+5 new),
identical 4 errors and 2 failures, none unique. phpstan, psalm, phpmd
clean; 386 routes resolve; vitest 349; prettier clean; no duplicate JSON
keys, no dangling $refs, no key/slug mismatches.

* test(procest): cover the slug step's shared helper and its name

The coverage guard failed the stable34 cell by 0.01% — a repair step needs
a database, so most of it is unreachable from a unit suite. Same answer as
softwarecatalog #518: move what is a decision rather than DDL into the
injected collaborator.

`placeholders()` is trivial and earns its place anyway: the step builds an
IN list three times, and a mismatch between placeholder count and bound
parameters surfaces only at runtime, inside a repair step, on somebody
else's install. Tested for 0 and for a negative count too.

Also worth recording: CI reports 'Tests: 1921' in that job and I briefly
read it as my five new tests not running. It is the MERGE BASE run — the
coverage job checks out head, then the base, to compare. Head reports
1926. Colour codes hid the first line from a plain grep.

* test(procest): cover the step the slug test constructs

PHPUnit's strict coverage marks a test RISKY when it executes a class the
@Covers annotation does not name, and one risky test fails the whole cell.
testShippedStepNamesItself reflects RenameDutchSchemaSlugs into existence,
so the annotation has to name it.

Only CI sees this — there is no coverage driver in the container, so the
strict checks never fire locally. Same fix as softwarecatalog #516.

* test(procest): read the slugs where they can be tested too

Coverage guard still 0.01% under. slugsFrom() is the sibling of
schemaIdsFrom() and belongs beside it regardless: both read a database row
defensively, because a null column must yield an empty string rather than
a TypeError inside a repair step, where an exception aborts the upgrade.

60 repair tests pass; phpstan and psalm clean.

* test(procest): drive the slug step through a mocked connection

Coverage guard still 0.01% under, so the step itself needs exercising
rather than another predicate extracted.

The interesting part is what the mock throws. The step catches
OCP\DB\Exception specifically, so a RuntimeException from a mock escapes
the try/catch and the test measures the mock instead of the step — which
is exactly how it failed first time round. The mirror of that trap, a mock
throwing a type the step DOES catch, is how a broken repair step once read
as a green no-op. So this feeds an EMPTY RESULT instead and asserts the
step reports 'nothing to do' and issues no statement.

62 repair tests pass.

* docs(procest): mark the slug step's methods @SPEC exclude

gate-16 (spec-coverage) failed with six changed methods missing @SPEC —
the only gate on this PR that development does not also fail.

procest already has the right form for this: RenameDutchColumns carries
`@spec exclude` with the reason that no canonical spec covers the
Dutch-to-English vocabulary migration, and pointing it at an existing spec
would report conformance to a requirement that says nothing about it. The
same is true here, so the same tag with the same reason.

* fix(procest): the ZGW adapter keeps its Dutch resource names

Three files should never have been touched by the slug rename, and
gate-16 is what led me to them — it flagged changed methods in
ZgwService/ZgwMappingService that I had no business changing.

`catalogus` and `kanaal` are TWO different things in this app: procest's
own schema slugs, which move, and ZGW RESOURCE names, which do not.
`ZgwService::$resourceKeys`, `ZgwMappingService`'s plural map
(`'catalogussen' => 'catalogus'`) and `LoadDefaultZgwMappings`' mapping
registry are all the second kind. Those schemas ARE the mapping onto ZGW,
a mapping is configuration, and the standard's vocabulary stays in the
standard's language — the same rule that kept pipelinq's
`zgwResourceType` out of its value map.

The applier cannot tell the two apart: it matches a quoted string, and
both spellings are `'catalogus'`.

`LoadDefaultZgwMappings` had already gone half-broken from it — the key
renamed to `'catalog'` while the template beside it still read
`{{ catalogus | zgw_extract_uuid }}`. A mapping pointing at a variable
that no longer exists resolves to empty, not to an error.

All three reverted to development. PHPUnit 1931 tests, same 4 errors and
2 failures as development, none unique; 386 routes resolve; phpstan and
psalm clean.

* docs(procest): @SPEC exclude on the slug test's methods too

gate-16 still named one changed method. lib/ is clean — every changed
method there carries a @SPEC — so the remaining one is in the new test
file, which had none. Same exclude, same reason.

* docs(procest): @SPEC exclude on the slug test class as well

gate-16 still named one changed method after every method in lib/ and in
the test carried a tag. The class docblock was the one thing left without
one.

* docs(procest): @SPEC on the one method gate-16 was actually naming

Three rounds of adding @SPEC to lib/ and to the test file did not move
gate-16 off 1, because the method it meant was in src/: gate-16 covers
non-trivial FRONTEND methods too, and `BeschikkingDetailView::hasVerzending`
changed when the property it reads went from `kanaal` to
`notificationChannel`.

I found it by running the gate's own script —
`check_spec_coverage.py` with HYDRA_GATE_BASE_REF=origin/development —
which names the method and prints `# count=0` when clean. Reading its
message and guessing at the cause cost three pushes; running it took one.
Tests are NOT in scope, so the annotations I added there were unnecessary
(harmless, and left as documentation).

Gate now reports count=0 locally. vitest and prettier clean.

* fix(register): point five relation $refs at the renamed schema keys

The slug rename moved `catalogus` -> `catalog` and `voorstel` ->
`proposal`, but five relation properties refer to their target by BARE
schema key rather than by a `#/components/schemas/...` path, and the
rename tool only rewrote the path form. The refs were left pointing at
keys that no longer exist.

Nothing in PHP or JS notices: a dangling $ref is not a parse error and
not a lint finding -- the relation simply stops resolving at render time,
so the picker comes up empty. gate-54 is the only instrument that sees
it, and only when it reads its own log file: the helper writes findings
to the path it is given and discards stdout, so its exit code is 0 either
way.

gate-54 goes 6 -> 1, and the remaining one is development's own.

---------

Co-authored-by: Conduction Release Bot <release-bot@conduction.nl>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@rubenvdlinde