build(deps): bump the npm_and_yarn group across 1 directory with 8 updates by dependabot[bot] · Pull Request #98 · ConductionNL/nextcloud-app-template

dependabot · 2026-07-16T19:07:07Z

Bumps the npm_and_yarn group with 7 updates in the /docs directory:

Package	From	To
dompurify	`3.4.2`	`3.4.14`
js-yaml	`3.14.2`	`3.15.2`
launch-editor	`2.13.2`	`2.14.1`
qs	`6.15.1`	`6.15.3`
webpack-dev-server	`5.2.4`	`5.2.6`
ws	`7.5.10`	`7.5.13`
websocket-driver	`0.7.4`	`0.7.5`

Updates dompurify from 3.4.2 to 3.4.14

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.14

Fixed an issue with possible bypasses when risky tags are allow-listed, thanks @AlirezaRouhbakhsh

Fixed a couple of edge cases with mixed document contexts, thanks @fishjojo1

Added the SVG pointer-events and vector-effect presentation attributes to the allow-list, thanks @Jaybhade

Conducted another refactoring run, removed dead branches and duplicated logic, flattened attribute validation

Updated the documentation in several spots, README, wiki, etc., thanks @Akokonunes

Updated several development dependencies and CI workflow actions

DOMPurify 3.4.13

Fixed an issue with hook removal during IN_PLACE sanitization, thanks @koyokr

Fixed an issue with hooks potentially bypassing the clone guard, thanks @AkshayjainG

Fixed an issue with DOM clobbering via ownerDocument during IN_PLACE, thanks @AkshayjainG

Bumped several dependencies where possible

DOMPurify 3.4.12

Fixed an issue where a hook would not get called for custom elements, thanks @Rikuxx0

Hardened the handling of hooks removing elements, @mkrause-bee360

Added support for a few new SVG attributes, thanks @cbn-falias & @Develop-KIM

Hardened the handling of declarative partial updates

Updated the documentation is several spots, README, wiki, etc.

Bumped several dependencies where possible

DOMPurify 3.4.11

Fixed an issue with a leaky config for hooks via setConfig, thanks @trace37labs

Bumped vulnerable development dependencies to arrive at plain 0 with npm audit

Updated the osv-scanner suppression list as no vulnerable dependencies are left for now

Updated up the linting tool-chain and removed now-redundant lint directives

Updated the documentation is several spots, README, wiki, etc.

Bumped several dependencies where possible

DOMPurify 3.4.10

Refactored codebase for clarity: extracted the public type declarations into types.ts

Decomposed the three largest sanitizer functions into focused helpers

Removed duplicated defaults and dead branches, consolidated SAFE_FOR_TEMPLATES scrubbing into single shared path

Improved per-node performance by hoisting the mXSS probe regexes and testing textContent before innerHTML

Added a deterministic micro-benchmark harness (npm run bench) with a --compare mode

Reduced CI cost by running the full three-engine browser suite once per PR

Refreshed the demos/ folder so every demo runs again, and added a SVG-via-<img> demo

Documented the bench and test:happydom scripts in the README

Completed the Attack Classes & Bypass History wiki page

Bumped several dependencies where possible

DOMPurify 3.4.9

Further improved the handling of Trusted Types config options, thanks @offset

Further improved the handling of IN_PLACE sanitization, thanks @mozfreddyb

Added more test coverage for IN_PLACE and Trusted Types related usage

Bumped several dependencies where possible

Updated README and wiki with more accurate documentation & attack samples

DOMPurify 3.4.8

... (truncated)

Commits

4e6fe24 release: 3.4.14 (#1587)
3067f77 release: 3.4.13 (#1562)
a9ca1e5 release: 3.4.12 (#1537)
0cae518 release: 3.4.11 (#1494)
6ee5716 release: 3.4.10 (#1478)
5210247 release: 3.4.9 (#1459)
bcdd828 release: 3.4.8 (#1439)
ca30f07 release: 3.4.7 (#1414)
bb7739e release: 3.4.6 (#1394)
011b0c7 release: 3.4.5 (#1382)
Additional commits viewable in compare view

Updates js-yaml from 3.14.2 to 3.15.2

Changelog

Sourced from js-yaml's changelog.

3.15.2 - 2026-08-26

Changed

[backport] Hard-limit merge sequence size to 100.

Security

[backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

3.15.1 - 2026-07-31

Security

[backport] Remove quadratic complexity from !!omap duplicate key detection.

3.15.0 - 2026-06-27

Added

Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one safeLoad() / safeLoadAll() call.

Commits

5c45bd6 3.15.2 released
5a708f9 dist rebuild
3485bc0 Backport merge limits from v5.4.1
f34812f Update .gitignore
ab85ae2 3.15.1 released
30a5e76 dist rebuild
22a8071 Backport quadratic complexity fix for !!omap
c34b6c4 3.15.0 released
21e13d3 dist rebuild
4165c62 Add v3-legacy tag for publish
Additional commits viewable in compare view

Updates launch-editor from 2.13.2 to 2.14.1

Commits

3f97c64 v2.14.1
0cc9550 fix: reject UNC paths (#138)
afd1ab9 ci: run tests on mac and windows (#136)
0bfa328 test: add some tests for launch-editor package (#135)
1b006ae chore: add README (#134)
383ef26 v2.14.0
6277209 ci: harden publish settings
520b2f7 fix(deps): update all non-major dependencies (#129)
475ac66 chore(deps): update dependency lint-staged to v17 (#130)
247bf1d chore(deps): update dependency yorkie to v2 (#131)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for launch-editor since your current version.

Updates qs from 6.15.1 to 6.15.3

Changelog

Sourced from qs's changelog.

6.15.3

[Fix] parse: enforce throwOnLimitExceeded for cumulative array growth via combine/merge

[Fix] utils: respect encoding of surrogate pairs across chunks (#559)

[Robustness] parse: throw the arrayLimit error before splitting oversized comma values

[Robustness] utils.merge / utils.assign: avoid invoking __proto__ setter when copying own properties

[Robustness] utils: enforce arrayLimit consistently across merge's array paths

[Perf] utils: make compact O(n) via a side-channel visited-set instead of Array.indexOf

[Deps] update side-channel

[Dev Deps] update eslint, mock-property, tape

[Tests] parse: characterize current lenient handling of unbalanced bracket keys (#558)

6.15.2

[Fix] stringify: skip null/undefined entries in arrayFormat: 'comma' + encodeValuesOnly instead of crashing in encoder

[Fix] stringify: use configured delimiter after charsetSentinel (#555)

[Fix] stringify: apply formatter to encoded key under strictNullHandling (#554)

[Fix] stringify: skip null/undefined filter-array entries instead of crashing in encoder (#551)

[Fix] parse: handle nested bracket groups and add regression tests (#530)

[readme] fix grammar (#550)

[Dev Deps] update @ljharb/eslint-config

[Tests] add regression tests for keys containing percent-encoded bracket text

Commits

18d085e v6.15.3
c38af42 [Deps] update side-channel
adce539 [Dev Deps] update eslint, mock-property, tape
74a0f6a [Robustness] utils: enforce arrayLimit consistently across merge's arra...
f4938f5 [Tests] parse: characterize current lenient handling of unbalanced bracket ...
5d5f723 [Perf] utils: make compact O(n) via a side-channel visited-set instead of...
52afe00 [Robustness] parse: throw the arrayLimit error before splitting oversized...
963e538 [Fix] parse: enforce throwOnLimitExceeded for cumulative array growth via...
59da434 [Fix] utils: respect encoding of surrogate pairs across chunks
9532969 [Robustness] utils.merge / utils.assign: avoid invoking __proto__ sette...
Additional commits viewable in compare view

Updates shell-quote from 1.8.3 to 1.10.0

Changelog

Sourced from shell-quote's changelog.

v1.10.0 - 2026-07-10

Merged

[New] parse: add opt-in splitUnquoted option for shell field-splitting of unquoted expansions [#1](https://github.com/ljharb/shell-quote/issues/1)

Commits

[Fix] parse: match nested ${...} braces so nested parameter expansion is consumed as one substitution c0842c8

[Tests] parse: pin single-quote literalness and unmatched-quote handling a0d03e3

[readme] remove the space in js code fences so evalmd evaluates them 2116fa3

[Tests] quote: pin conservative escaping of =, @, ^, ,, :, ! (#11) 1c36f3f

[readme] document that quote outputs POSIX quoting, not cmd.exe/PowerShell 100e96e

[readme] document parse's supported parameter-expansion subset e1c75cd

[Fix] parse: a backslash inside single quotes must not escape the closing quote 5d460a3

[readme] fix stale example outputs 2de86f5

[Tests] quote: pin that a backslash with whitespace is not doubled in single quotes (#14) 190e236

[readme] quote: use output verbatim; do not re-quote it (#11) 1b36468

[Refactor] parse: fix swapped SINGLE_QUOTE/DOUBLE_QUOTE variable names 801af5c

[types] fix an error TS v6 ignores but v7 fails on 59bbf8b

[Dev Deps] update @arethetypeswrong/cli, evalmd a04d475

[Dev Deps] update @arethetypeswrong/ci, eslint d390f9a

[Tests] quote: the tilde test escapes every ~, not just a leading one (#9) 617d119

v1.9.0 - 2026-06-24

Commits

[New] add types dca6e21

[Dev Deps] update eslint 9aa9e8f

[Fix] parse: finalize tokens in linear time (GHSA-395f-4hp3-45gv) 7ff5488

[actions] update workflows 75e8497

[actions] Windows + node 4/6/7: pin eslint to 9 before install, since npm 2/3 cannot stage eslint 10@types/esrecurse 3fb739d

[actions] retry npm install on Windows to survive npm 2/3 staging-rename flake abe0163

[actions] Windows + node 5/7: install deps with a modern node b4bafa2

[Fix] quote: escape leading ~ to prevent shell tilde-expansion 7a76c1a

[Dev Deps] update auto-changelog, tape 7184b44

[Dev Deps] apparently jackspeak is no longer in the graph 9ba368a

v1.8.4 - 2026-05-22

Commits

[Fix] quote: validate object-token shapes 4378a6e

[Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint, npmignore 22ebec0

[Tests] increase coverage 9f3caa3

[readme] replace runkit CI badge with shields.io check-runs badge 3344a04

[Dev Deps] update @ljharb/eslint-config 699c511

Commits

64988d9 v1.10.0
617d119 [Tests] quote: the tilde test escapes every ~, not just a leading one (#9)
59bbf8b [types] fix an error TS v6 ignores but v7 fails on
190e236 [Tests] quote: pin that a backslash with whitespace is not doubled in singl...
a04d475 [Dev Deps] update @arethetypeswrong/cli, evalmd
b9545b3 [New] parse: add opt-in splitUnquoted option for shell field-splitting of...
1b36468 [readme] quote: use output verbatim; do not re-quote it (#11)
1c36f3f [Tests] quote: pin conservative escaping of =, @, ^, ,, :, ! (#11)
e1c75cd [readme] document parse's supported parameter-expansion subset
c0842c8 [Fix] parse: match nested ${...} braces so nested parameter expansion is ...
Additional commits viewable in compare view

Updates webpack-dev-server from 5.2.4 to 5.2.6

Release notes

Sourced from webpack-dev-server's releases.

v5.2.6

Patch Changes

fix: allow undefined as the Server constructor options argument again (by @bjohansebas in #5695)

Restores accepting undefined (defaulting it to {}) for the options argument, so passing a webpack config's optional devServer field type-checks and works as before.

Protect the built-in state-changing routes (/webpack-dev-server/invalidate and /webpack-dev-server/open-editor) against cross-site request forgery. Requests are now checked with Sec-Fetch-Site (falling back to an Origin/Host comparison when it is absent), so a cross-site page can no longer trigger a rebuild or open a file in the editor. Same-origin requests, user-initiated navigations, and non-browser clients (e.g. curl) are unaffected. (by @bjohansebas in #5698)

Handle malformed Host and Origin header values gracefully when validating requests. (by @bjohansebas in #5699)

v5.2.5

Patch Changes

Skip the HMR WebSocket path when forwarding upgrade requests to user-defined proxies, so custom proxy WebSocket upgrades are no longer intercepted by the dev server. (by @bjohansebas in #5680)

Changelog

Sourced from webpack-dev-server's changelog.

5.2.6

Patch Changes

fix: allow undefined as the Server constructor options argument again (by @bjohansebas in #5695)

Restores accepting undefined (defaulting it to {}) for the options argument, so passing a webpack config's optional devServer field type-checks and works as before.

Protect the built-in state-changing routes (/webpack-dev-server/invalidate and /webpack-dev-server/open-editor) against cross-site request forgery. Requests are now checked with Sec-Fetch-Site (falling back to an Origin/Host comparison when it is absent), so a cross-site page can no longer trigger a rebuild or open a file in the editor. Same-origin requests, user-initiated navigations, and non-browser clients (e.g. curl) are unaffected. (by @bjohansebas in #5698)

Handle malformed Host and Origin header values gracefully when validating requests. (by @bjohansebas in #5699)

5.2.5

Patch Changes

Skip the HMR WebSocket path when forwarding upgrade requests to user-defined proxies, so custom proxy WebSocket upgrades are no longer intercepted by the dev server. (by @bjohansebas in #5680)

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

Commits

8a37b0e chore(release): new release (#5697)
f21ed0f fix: handle malformed Host and Origin headers (#5699)
80cd9ee fix: reject cross-site requests to open-editor and invalidate endpoints (#5698)
308e853 fix: handle undefined options in Server constructor (#5695)
8b2b915 chore: update branch references from v4 to v5 in workflow configuration
870ed22 chore: add v5 branch to release workflow triggers
c3ee325 chore(release): new release (#5682)
60173be feat: add changeset validation and release workflow (#5680)
948d5e6 fix(proxy): match the HMR upgrade path exactly like the ws server (#5678)
93e8996 fix: skip HMR websocket path when forwarding upgrades to user-defined proxies...
See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for webpack-dev-server since your current version.

Updates ws from 7.5.10 to 7.5.13

Release notes

Sourced from ws's releases.

7.5.13

Bug fixes

Fixed a bug introduced in version 7.5.12 that prevented the fragment counter from resetting (18bcb11a).

7.5.12

Bug fixes

Backported a2f4e7c0 and f197ac65 to the v7.x release line (fb8a1935, deec2114).

7.5.11

Bug fixes

Backported 2b2abd45 to the 7.x release line (e14c4586).

Commits

1680801 [dist] 7.5.13
18bcb11 [fix] Reset the fragment counter when the message is complete
98fce81 [dist] 7.5.12
deec211 [fix] Lower default values of maxBufferedChunks and maxFragments
fb8a193 [fix] Count empty fragments toward the limit (#2329)
fd36cd8 [dist] 7.5.11
e14c458 [security] Limit retained message parts
See full diff in compare view

Updates websocket-driver from 0.7.4 to 0.7.5

Changelog

Sourced from websocket-driver's changelog.

0.7.5 / 2026-06-04

Close a draft-75/76 connection if a length header grows to exceed the configured max length

Fail the connection if a message is larger than the configured max length after extension processing

Commits

5d6a9aa Bump version to 0.7.5
c55679a Fail the connection if a message is larger than the configured max length aft...
5b197ca Close a draft-75/76 connection if a length header grows to exceed the configu...
fc93a48 Test on Node v22, v24, and v26
2e82d34 Test on recent versions of Node
e4962db Switch from Travis CI to GitHub Actions
3f2f9b7 Travis update: cache npm modules, remove sudo, run on Node 15
See full diff in compare view

rubenvdlinde · 2026-08-30T16:04:10Z

@dependabot rebase

…dates Bumps the npm_and_yarn group with 7 updates in the /docs directory: | Package | From | To | | --- | --- | --- | | [dompurify](https://github.com/cure53/DOMPurify) | `3.4.2` | `3.4.14` | | [js-yaml](https://github.com/nodeca/js-yaml) | `3.14.2` | `3.15.2` | | [launch-editor](https://github.com/vitejs/launch-editor) | `2.13.2` | `2.14.1` | | [qs](https://github.com/ljharb/qs) | `6.15.1` | `6.15.3` | | [webpack-dev-server](https://github.com/webpack/webpack-dev-server) | `5.2.4` | `5.2.6` | | [ws](https://github.com/websockets/ws) | `7.5.10` | `7.5.13` | | [websocket-driver](https://github.com/faye/websocket-driver-node) | `0.7.4` | `0.7.5` | Updates `dompurify` from 3.4.2 to 3.4.14 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.4.2...3.4.14) Updates `js-yaml` from 3.14.2 to 3.15.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/3.15.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.14.2...3.15.2) Updates `launch-editor` from 2.13.2 to 2.14.1 - [Commits](vitejs/launch-editor@v2.13.2...v2.14.1) Updates `qs` from 6.15.1 to 6.15.3 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.15.1...v6.15.3) Updates `shell-quote` from 1.8.3 to 1.10.0 - [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md) - [Commits](ljharb/shell-quote@v1.8.3...v1.10.0) Updates `webpack-dev-server` from 5.2.4 to 5.2.6 - [Release notes](https://github.com/webpack/webpack-dev-server/releases) - [Changelog](https://github.com/webpack/webpack-dev-server/blob/v5.2.6/CHANGELOG.md) - [Commits](webpack/webpack-dev-server@v5.2.4...v5.2.6) Updates `ws` from 7.5.10 to 7.5.13 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@7.5.10...7.5.13) Updates `websocket-driver` from 0.7.4 to 0.7.5 - [Changelog](https://github.com/faye/websocket-driver-node/blob/main/CHANGELOG.md) - [Commits](faye/websocket-driver-node@0.7.4...0.7.5) --- updated-dependencies: - dependency-name: dompurify dependency-version: 3.4.12 dependency-type: indirect - dependency-name: js-yaml dependency-version: 3.15.0 dependency-type: indirect - dependency-name: launch-editor dependency-version: 2.14.1 dependency-type: indirect - dependency-name: qs dependency-version: 6.15.3 dependency-type: indirect - dependency-name: shell-quote dependency-version: 1.10.0 dependency-type: indirect - dependency-name: webpack-dev-server dependency-version: 5.2.6 dependency-type: indirect - dependency-name: websocket-driver dependency-version: 0.7.5 dependency-type: indirect - dependency-name: ws dependency-version: 7.5.12 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 16, 2026

dependabot Bot requested review from Rem-Dam and rubenvdlinde as code owners July 16, 2026 19:07

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 16, 2026

rubenvdlinde mentioned this pull request Jul 31, 2026

feat(vue3): migrate the app template from Vue 2 to Vue 3 #103

Merged

dependabot Bot force-pushed the dependabot/npm_and_yarn/docs/npm_and_yarn-13a0a3044d branch from 8d757ec to f1846ec Compare August 30, 2026 16:09

Navigation Menu

Uh oh!

build(deps): bump the npm_and_yarn group across 1 directory with 8 updates - #98

build(deps): bump the npm_and_yarn group across 1 directory with 8 updates#98
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/docs/npm_and_yarn-13a0a3044d

dependabot Bot commented on behalf of github Jul 16, 2026 •

edited

Loading

Uh oh!

rubenvdlinde commented Aug 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

DOMPurify 3.4.14

DOMPurify 3.4.13

DOMPurify 3.4.12

DOMPurify 3.4.11

DOMPurify 3.4.10

DOMPurify 3.4.9

DOMPurify 3.4.8

3.15.2 - 2026-08-26

Changed

Security

3.15.1 - 2026-07-31

Security

3.15.0 - 2026-06-27

Added

6.15.3

6.15.2

v1.10.0 - 2026-07-10

Merged

Commits

v1.9.0 - 2026-06-24

Commits

v1.8.4 - 2026-05-22

Commits

v5.2.6

Patch Changes

v5.2.5

Patch Changes

5.2.6

Patch Changes

5.2.5

Patch Changes

7.5.13

Bug fixes

7.5.12

Bug fixes

7.5.11

Bug fixes

0.7.5 / 2026-06-04

Uh oh!

rubenvdlinde commented Aug 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Jul 16, 2026 •

edited

Loading