Skip to content

Bump the npm_and_yarn group across 2 directories with 10 updates#601

Closed
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm_and_yarn-91fc741ad4
Closed

Bump the npm_and_yarn group across 2 directories with 10 updates#601
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm_and_yarn-91fc741ad4

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Mar 17, 2026

Bumps the npm_and_yarn group with 7 updates in the / directory:

Package From To
jspdf 4.0.0 4.2.1
@tootallnate/once 2.0.0 removed
esbuild 0.21.5 removed
immutable 5.0.3 5.1.5
lodash 4.17.21 4.17.23
qs 6.14.0 6.15.0
undici 5.29.0 6.24.1

Bumps the npm_and_yarn group with 2 updates in the /packages/core directory: vue and vuetify.

Updates jspdf from 4.0.0 to 4.2.1

Release notes

Sourced from jspdf's releases.

v4.2.1

This release fixes two security issues.

What's Changed

Full Changelog: parallax/jsPDF@v4.2.0...v4.2.1

v4.2.0

This release fixes three security issues.

What's Changed

New Contributors

Full Changelog: parallax/jsPDF@v4.1.0...v4.2.0

v4.1.0

This release fixes several security issues.

What's Changed

Full Changelog: parallax/jsPDF@v4.0.0...v4.1.0

Commits

Removes @tootallnate/once

Updates dompurify from 3.2.4 to 3.3.3

Release notes

Sourced from dompurify's releases.

DOMPurify 3.3.3

  • Fixed an engine requirement for Node 20 which caused hiccups, thanks @​Rotzbua

DOMPurify 3.3.2

  • Fixed a possible bypass caused by jsdom's faulty raw-text tag parsing, thanks multiple reporters
  • Fixed a prototype pollution issue when working with custom elements, thanks @​christos-eth
  • Fixed a lenient config parsing in _isValidAttribute, thanks @​christos-eth
  • Bumped and removed several dependencies, thanks @​Rotzbua
  • Fixed the test suite after bumping dependencies, thanks @​Rotzbua

DOMPurify 3.3.1

  • Updated ADD_FORBID_CONTENTS setting to extend default list, thanks @​MariusRumpf
  • Updated the ESM import syntax to be more correct, thanks @​binhpv

DOMPurify 3.3.0

  • Added the SVG mask-type attribute to default allow-list, thanks @​prasadrajandran
  • Added support for ADD_ATTR and ADD_TAGS to accept functions, thanks @​nelstrom
  • Fixed an issue with the slot element being in both SVG and HTML allow-list, thanks @​Wim-Valgaeren

DOMPurify 3.2.7

  • Added new attributes and elements to default allow-list, thanks @​elrion018
  • Added tagName parameter to custom element attributeNameCheck, thanks @​nelstrom
  • Added better check for animated href attributes, thanks @​llamakko
  • Updated and improved the bundled types, thanks @​ssi02014
  • Updated several tests to better align with new browser encoding behaviors
  • Improved the handling of potentially risky content inside CDATA elements, thanks @​securityMB & @​terjanq
  • Improved the regular expression for raw-text elements to cover textareas, thanks @​securityMB & @​terjanq

DOMPurify 3.2.6

DOMPurify 3.2.5

  • Added a check to the mXSS detection regex to be more strict, thanks @​masatokinugawa
  • Added ESM type imports in source, removes patch function, thanks @​donmccurdy
  • Added script to verify various TypeScript configurations, thanks @​reduckted
  • Added more modern browsers to the Karma launchers list
  • Added Node 23.x to tested runtimes, removed Node 17.x
  • Fixed the generation of source maps, thanks @​reduckted
  • Fixed an unexpected behavior with ALLOWED_URI_REGEXP using the 'g' flag, thanks @​hhk-png
  • Fixed a few typos in the README file
Commits
  • 8bcbf73 chore: Preparing 3.3.3 release
  • 5faddd6 fix: engine requirement (#1210)
  • 0f91e3a Update README.md
  • d5ff1a8 Merge branch 'main' of github.com:cure53/DOMPurify
  • c3efd48 fix: moved back from jsdom 28 to jsdom 20
  • 988b888 fix: moved back from jsdom 28 to jsdom 20
  • 2726c74 chore: Preparing 3.3.2 release
  • 6202c7e build(deps): bump @​tootallnate/once and jsdom (#1204)
  • 302b51d fix: Expanded the regex ever so slightly to also cover script
  • cd85175 Merge branch 'main' of github.com:cure53/DOMPurify
  • Additional commits viewable in compare view

Removes esbuild

Updates immutable from 5.0.3 to 5.1.5

Release notes

Sourced from immutable's releases.

v5.1.5

What's Changed

Full Changelog: immutable-js/immutable-js@v5.1.4...v5.1.5

v5.1.4

What's Changed

Documentation

Internal

New Contributors

Full Changelog: immutable-js/immutable-js@v5.1.3...v5.1.4

v5.1.3

What's Changed

TypeScript

Documentation

There has been a huge amount of changes in the documentation, mainly migrate from an autogenerated documentation from .d.ts file, to a proper documentation in markdown. The playground has been included on nearly all method examples.

... (truncated)

Changelog

Sourced from immutable's changelog.

5.1.5

  • Fix Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

5.1.4

Documentation

Internal

5.1.3

TypeScript

Documentation

There has been a huge amount of changes in the documentation, mainly migrate from an autogenerated documentation from .d.ts file, to a proper documentation in markdown. The playground has been included on nearly all method examples. We added a page about browser extensions too: https://immutable-js.com/browser-extension/

Internal

5.1.2

... (truncated)

Commits
  • b37b855 5.1.5
  • 16b3313 Merge commit from fork
  • fd2ef49 fix new proto key injection
  • 6734b7b fix Prototype Pollution in mergeDeep, toJS, etc.
  • 6f772de Merge pull request #2175 from immutable-js/dependabot/npm_and_yarn/rollup-4.59.0
  • 5f3dc61 Bump rollup from 4.34.8 to 4.59.0
  • 049a594 Merge pull request #2173 from immutable-js/dependabot/npm_and_yarn/lodash-4.1...
  • 2481a77 Merge pull request #2172 from mrazauskas/update-tstyche
  • eb04779 Bump lodash from 4.17.21 to 4.17.23
  • b973bf3 format
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for immutable since your current version.


Updates lodash from 4.17.21 to 4.17.23

Commits

Updates qs from 6.14.0 to 6.15.0

Changelog

Sourced from qs's changelog.

6.15.0

  • [New] parse: add strictMerge option to wrap object/primitive conflicts in an array (#425, #122)
  • [Fix] duplicates option should not apply to bracket notation keys (#514)

6.14.2

  • [Fix] parse: mark overflow objects for indexed notation exceeding arrayLimit (#546)
  • [Fix] arrayLimit means max count, not max index, in combine/merge/parseArrayValue
  • [Fix] parse: throw on arrayLimit exceeded with indexed notation when throwOnLimitExceeded is true (#529)
  • [Fix] parse: enforce arrayLimit on comma-parsed values
  • [Fix] parse: fix error message to reflect arrayLimit as max index; remove extraneous comments (#545)
  • [Robustness] avoid .push, use void
  • [readme] document that addQueryPrefix does not add ? to empty output (#418)
  • [readme] clarify parseArrays and arrayLimit documentation (#543)
  • [readme] replace runkit CI badge with shields.io check-runs badge
  • [meta] fix changelog typo (arrayLengtharrayLimit)
  • [actions] fix rebase workflow permissions

6.14.1

  • [Fix] ensure arrayLimit applies to [] notation as well
  • [Fix] parse: when a custom decoder returns null for a key, ignore that key
  • [Refactor] parse: extract key segment splitting helper
  • [meta] add threat model
  • [actions] add workflow permissions
  • [Tests] stringify: increase coverage
  • [Dev Deps] update eslint, @ljharb/eslint-config, npmignore, es-value-fixtures, for-each, object-inspect
Commits
  • d9b4c66 v6.15.0
  • cb41a54 [New] parse: add strictMerge option to wrap object/primitive conflicts in...
  • 88e1563 [Fix] duplicates option should not apply to bracket notation keys
  • 9d441d2 Merge backport release tags v6.0.6–v6.13.3 into main
  • 85cc8ca v6.12.5
  • ffc12aa v6.11.4
  • 0506b11 [actions] update reusable workflows
  • 6a37faf [actions] update reusable workflows
  • 8e8df5a [Fix] fix regressions from robustness refactor
  • d60bab3 v6.10.7
  • Additional commits viewable in compare view

Updates undici from 5.29.0 to 6.24.1

Release notes

Sourced from undici's releases.

v6.24.1

Full Changelog: nodejs/undici@v6.24.0...v6.24.1

v6.24.0

Undici v6.24.0 Security Release Notes (LTS)

This release backports fixes for security vulnerabilities affecting the v6 line.

Upgrade guidance

All users on v6 should upgrade to v6.24.0 or later.

Fixed advisories

Not applicable to v6

Affected and patched ranges (v6)

References

... (truncated)

Commits
  • c0cf656 Bumped v6.24.1
  • f5a9f0c Fix v6 release workflow branch targeting
  • af2cb8f wqremove maxDecompressedMessageSize (#4891)
  • 8873c94 Bumped v6.24.0
  • 411bd01 test(websocket): use node:assert for Node 18 compatibility
  • 844bf59 test: fix http2 lint regressions in backport
  • a444e4f test: stabilize h2 and tls-cert-leak under current test runner
  • dc032a1 fix: h2 CI (#4395)
  • 4cd3f4b test: increase bitness in test/fixtures/*.pem (#3659)
  • 7df6442 fix: adapt websocket frame-limit handling for v6 parser
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for undici since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates vue from 2.7.16 to 3.5.30

Release notes

Sourced from vue's releases.

v3.5.30

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.29

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.28

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.27

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.26

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.25

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.24

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.23

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.22

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.21

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.20

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.19

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.18

For stable releases, please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from vue's changelog.

3.5.30 (2026-03-09)

Bug Fixes

  • compat: add entities to @​vue/compat deps to fix CJS edge cases (#12514) (e725a67), closes #10609
  • custom-element: ensure child component styles are injected in correct order before parent styles (#13374) (1398bf8), closes #13029
  • custom-element: properly locate parent when slotted in shadow dom (#12480) (f06c81a), closes #12479
  • custom-element: should properly patch as props for vue custom elements (#12409) (740983e), closes #12408
  • reactivity: avoid duplicate raw/proxy entries in Set.add (#14545) (d943612)
  • reactivity: fix reduce on reactive arrays to preserve reactivity (#12737) (16ef165), closes #12735
  • reactivity: handle Set with initial reactive values edge case (#12393) (5dc27ca), closes #8647
  • runtime-core: warn about negative number in v-for (#12308) (9438cc5)
  • ssr: prevent watch from firing after async setup await (#14547) (6cda71d), closes #14546
  • types: make generics with runtime props in defineComponent work (fix #11374) (#13119) (cea3cf7), closes #13763
  • types: narrow useAttrs class/style typing for TSX (#14492) (bbb8977), closes #14489

3.5.29 (2026-02-24)

Bug Fixes

3.5.28 (2026-02-09)

Bug Fixes

  • transition: avoid unexpected cancelled parameter in transition done callback (#14391) (6798853)
  • compiler-sfc: add resolution trying for .mts/.cts files (#14402) (c09d41f), closes vuejs/router#2611
  • compiler-sfc: no params were generated when using withDefaults (#12823) (b0a1f05), closes #12822
  • reactivity: add __v_skip flag to EffectScope to prevent reactive conversion (#14359) (48b7552), closes #14357
  • runtime-core: avoid retaining el on cached text vnodes during static traversal (#14419) (4ace79a), closes #14134
  • runtime-core: prevent child component updates when style remains unchanged (#12825) (57866b5), closes #12826
  • runtime-core: properly handle async component update before resolve (#11619) (e71c26c), closes #11617
  • runtime-dom: handle null/undefined handler in withModifiers (#14362) (261de54), closes #14361
  • teleport: properly handling disabled teleport target anchor (#14417) (d7bcd85), closes #14412
  • transition-group: correct move translation under scale via element rect (#14360) (0243a79), closes #14356
  • useTemplateRef: don't update setup ref for useTemplateRef key (#12756) (fc40ca0), closes #12749

3.5.27 (2026-01-19)

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for vue since your current version.


Updates vuetify from 2.7.2 to 4.0.2

Release notes

Sourced from vuetify's releases.

v4.0.2

[!IMPORTANT] Vuetify Needs Your Support! The OpenCollective funds have been fully exhausted. We are currently unable to compensate our contributors for their continued work on the framework and the ecosystem tools.

If Vuetify is part of your stack, please consider sponsoring the project so we can continue delivering updates and fixes.

Sponsor via Open Collective | Sponsor via GitHub

Every contribution helps us keep Vuetify alive and ship exciting new features.

Thank you.


🚀 Features

  • icons: add Material Symbols iconset via UnoCSS (#22680) (6c463c1), closes #20053
  • VDataTable: expose prevPage, nextPage, setPage in bottom slot (#22681) (4d1aa79)

🔧 Bug Fixes

  • hotkey: add delimiter aliases without delimiter ambiguity (#22635) (a639698)
  • rounded: add missing "md" size (#22679) (47cffdd)
  • router: replace next() deprecated in Vue Router v5 (#22643) (87c4129), closes #22632
  • VDataTable: respect disableSort prop for sortable header (#22684) (767b0e8), closes #22523
  • VFileInput: correct VField ref type (41a6063), closes #22309
  • VGrid: avoid warning about no-gutters being deprecated - it is not (5d8ec63)
  • VNavigationDrawer: fully clip list item text in rail mode (6b448cd), closes #22564 #22564
  • VNumberInput: prevent input changes when readonly (#22692) (2b1ed0d), closes #22677
  • VSelect/VAutocomplete/VCombobox: let focus leave to other fields (51196cf), closes #22697
  • VTextarea: correct VField ref type (0d689aa)
  • VTimePicker: keep hour value when changing AM/PM (b030df8)

🧪 Labs

  • VAvatarGroup: ❗ change the limit behavior to cover overflow item (e580ebc), closes #22702 #22703
  • VCommandPalette: add closeOnSelect prop and before-select event (#22634) (d534f79)
  • VCommandPalette: correct name of the inner component (bfed30c)

v4.0.1

🚀 Features

🔧 Bug Fixes

... (truncated)

Commits
  • a65f1b8 chore(release): publish v4.0.2
  • 51196cf fix(VSelect/VAutocomplete/VCombobox): let focus leave to other fields
  • b030df8 fix(VTimePicker): keep hour value when changing AM/PM
  • 6b448cd fix(VNavigationDrawer): fully clip list item text in rail mode
  • e580ebc fix(VAvatarGroup): change the limit behavior to cover overflow item
  • 6c463c1 feat(icons): add Material Symbols iconset via UnoCSS (#22680)
  • 47cffdd fix(rounded): add missing "md" size (#22679)
  • 87c4129 fix(router): replace next() deprecated in Vue Router v5 (#22643)
  • a639698 fix(hotkey): add delimiter aliases without delimiter ambiguity (#22635)
  • 4d1aa79 feat(VDataTable): expose prevPage, nextPage, setPage in bottom slot (#22681)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for vuetify since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the npm_and_yarn group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [jspdf](https://github.com/parallax/jsPDF) | `4.0.0` | `4.2.1` |
| [@tootallnate/once](https://github.com/TooTallNate/once) | `2.0.0` | `removed` |
| [esbuild](https://github.com/evanw/esbuild) | `0.21.5` | `removed` |
| [immutable](https://github.com/immutable-js/immutable-js) | `5.0.3` | `5.1.5` |
| [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.17.23` |
| [qs](https://github.com/ljharb/qs) | `6.14.0` | `6.15.0` |
| [undici](https://github.com/nodejs/undici) | `5.29.0` | `6.24.1` |

Bumps the npm_and_yarn group with 2 updates in the /packages/core directory: [vue](https://github.com/vuejs/core) and [vuetify](https://github.com/vuetifyjs/vuetify/tree/HEAD/packages/vuetify).


Updates `jspdf` from 4.0.0 to 4.2.1
- [Release notes](https://github.com/parallax/jsPDF/releases)
- [Changelog](https://github.com/parallax/jsPDF/blob/master/RELEASE.md)
- [Commits](parallax/jsPDF@v4.0.0...v4.2.1)

Removes `@tootallnate/once`

Updates `dompurify` from 3.2.4 to 3.3.3
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.2.4...3.3.3)

Removes `esbuild`

Updates `immutable` from 5.0.3 to 5.1.5
- [Release notes](https://github.com/immutable-js/immutable-js/releases)
- [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md)
- [Commits](immutable-js/immutable-js@v5.0.3...v5.1.5)

Updates `lodash` from 4.17.21 to 4.17.23
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.17.23)

Updates `qs` from 6.14.0 to 6.15.0
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.14.0...v6.15.0)

Updates `undici` from 5.29.0 to 6.24.1
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v5.29.0...v6.24.1)

Updates `vue` from 2.7.16 to 3.5.30
- [Release notes](https://github.com/vuejs/core/releases)
- [Changelog](https://github.com/vuejs/core/blob/main/CHANGELOG.md)
- [Commits](https://github.com/vuejs/core/commits/v3.5.30)

Updates `vuetify` from 2.7.2 to 4.0.2
- [Release notes](https://github.com/vuetifyjs/vuetify/releases)
- [Commits](https://github.com/vuetifyjs/vuetify/commits/v4.0.2/packages/vuetify)

---
updated-dependencies:
- dependency-name: jspdf
  dependency-version: 4.2.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@tootallnate/once"
  dependency-version: 
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: dompurify
  dependency-version: 3.3.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: esbuild
  dependency-version: 
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: immutable
  dependency-version: 5.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: lodash
  dependency-version: 4.17.23
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.15.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 6.24.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vue
  dependency-version: 3.5.30
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: vuetify
  dependency-version: 4.0.2
  dependency-type: direct:production
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 17, 2026
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 17, 2026
@dopenguin dopenguin closed this Mar 17, 2026
@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Mar 17, 2026

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot dependabot bot deleted the dependabot/npm_and_yarn/npm_and_yarn-91fc741ad4 branch March 17, 2026 19:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant