Skip to content

build(deps): bump the npm-deps group with 11 updates#6235

Merged
FlowCryptRobot merged 2 commits into
masterfrom
dependabot/npm_and_yarn/npm-deps-3a6f1a250f
Jun 1, 2026
Merged

build(deps): bump the npm-deps group with 11 updates#6235
FlowCryptRobot merged 2 commits into
masterfrom
dependabot/npm_and_yarn/npm-deps-3a6f1a250f

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 31, 2026

Bumps the npm-deps group with 11 updates:

Package From To
dompurify 3.4.5 3.4.7
squire-rte 2.4.5 2.4.6
eslint 10.4.0 10.4.1
googleapis 172.0.0 173.0.0
lint-staged 17.0.5 17.0.7
mailparser 3.9.8 3.9.9
pdfjs-dist 5.7.284 6.0.227
puppeteer 25.0.4 25.1.0
typescript-eslint 8.59.4 8.60.0
web-ext 10.2.0 10.3.0
webpack-cli 7.0.2 7.0.3

Updates dompurify from 3.4.5 to 3.4.7

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.7

  • Hardened the handling of Shadow Roots when using IN_PLACE, thanks @​GameZoneHacker
  • Removed a problem leading to permanent hook pollution, thanks @​offset
  • Refactored the test suite and expanded test coverage significantly

DOMPurify 3.4.6

  • Fixed several issues with DOM Clobbering in IN_PLACE mode, thanks @​offset & @​Bankde
  • Hardened the checks for cross-realm IN_PLACE and Shadow DOM sanitization, thanks @​offset & @​Bankde
  • Added more test coverage for IN_PLACE and general DOM Clobbering attacks
  • Bumped several dependencies where possible
Commits

Updates squire-rte from 2.4.5 to 2.4.6

Changelog

Sourced from squire-rte's changelog.

[2.4.6] - 2026-05-26

Fixed

  • Fix IndexSizeError when pressing Delete after a stale squire-selection-start/squire-selection-end bookmark marker was left in the DOM (e.g. via setHTML, pasted HTML, or an unpaired save/restore cycle). Any straggler markers are now swept on each bookmark read, and the range is only reconstructed when the start marker actually precedes the end marker in document order.

Changed

  • styleToSemantic now sets font-family, font-size and color via the element style property rather than serialising them into a style attribute string, avoiding the security risks of CSS parsing.
Commits

Updates eslint from 10.4.0 to 10.4.1

Release notes

Sourced from eslint's releases.

v10.4.1

Bug Fixes

  • e557467 fix: update @eslint/plugin-kit version to 0.7.2 (#20930) (Francesco Trotta)
  • d4ce898 fix: propagate failures from delegated commands (#20917) (Minh Vu)
  • f4f3507 fix: prefer-arrow-callback invalid autofix with newline after async (#20916) (kuldeep kumar)
  • c5bc78b fix: false positive for reference in finally block (#20655) (Tanuj Kanti)
  • 27538c0 fix: add missing CodePath and CodePathSegment types (#20853) (Pixel998)

Documentation

  • 61b0add docs: remove deprecated rule from related rules of max-params (#20921) (Tanuj Kanti)
  • 305d5b9 docs: remove deprecated rules from related rules section (#20911) (Tanuj Kanti)
  • 49b0202 docs: fix display: none of ad (#20901) (Tanuj Kanti)
  • 9067f94 docs: switch build to Node.js 24 (#20893) (Milos Djermanovic)
  • c91b041 docs: Update README (GitHub Actions Bot)
  • e349265 docs: clarify semver strings in rule deprecation objects (#20885) (Milos Djermanovic)

Chores

  • b0e466b test: add data property to invalid tests cases for rules (#20924) (Tanuj Kanti)
  • f78838b test: add CodePath type coverage (#20904) (Pixel998)
  • 1daa4bd chore: update eslint-plugin-eslint-comments test data to latest commit (#20922) (Francesco Trotta)
  • 002942c ci: declare contents:read on update-readme workflow (#20919) (Arpit Jain)
  • 64bca24 chore: update ecosystem plugins (#20912) (ESLint Bot)
  • 6d7c832 chore: ignore fflate updates in renovate (#20908) (Pixel998)
  • b2c8638 ci: bump pnpm/action-setup from 6.0.7 to 6.0.8 (#20889) (dependabot[bot])
  • a9b8d7f chore: increase maxBuffer for ecosystem tests (#20881) (sethamus)
  • b702ead chore: update ecosystem update PR settings (#20884) (Pixel998)
  • 507f60e chore: update ecosystem plugins (#20882) (ESLint Bot)
  • 92f5c5b test: add unit test for message-count (#20878) (kuldeep kumar)
  • df32108 chore: add @​eslint/markdown and typescript-eslint ecosystem tests (#20837) (sethamus)
  • 327f91d chore: use includeIgnoreFile internally (#20876) (Kirk Waiblinger)
  • f0dc4bd chore: pin fflate@0.8.2 (#20877) (Milos Djermanovic)
  • 0f4bd25 ci: run Discord alert for ecosystem test failures (#20873) (Copilot)
Commits
  • 4a3d15a 10.4.1
  • 43e7e2b Build: changelog update for 10.4.1
  • e557467 fix: update @eslint/plugin-kit version to 0.7.2 (#20930)
  • b0e466b test: add data property to invalid tests cases for rules (#20924)
  • d4ce898 fix: propagate failures from delegated commands (#20917)
  • f4f3507 fix: prefer-arrow-callback invalid autofix with newline after async (#20916)
  • f78838b test: add CodePath type coverage (#20904)
  • 61b0add docs: remove deprecated rule from related rules of max-params (#20921)
  • 1daa4bd chore: update eslint-plugin-eslint-comments test data to latest commit (#20...
  • 002942c ci: declare contents:read on update-readme workflow (#20919)
  • Additional commits viewable in compare view

Updates googleapis from 172.0.0 to 173.0.0

Release notes

Sourced from googleapis's releases.

googleapis: v173.0.0

173.0.0 (2026-05-28)

⚠ BREAKING CHANGES

  • This release has breaking changes.

Features

Commits

Updates lint-staged from 17.0.5 to 17.0.7

Release notes

Sourced from lint-staged's releases.

v17.0.7

Patch Changes

v17.0.6

Patch Changes

  • #1803 bdf2770 - Run all tests with Deno, in addition to Node.js and Bun.

  • #1796 7508272 - Fix performance regression of lint-staged v17 by going back to using git add to stage task modifications. This was changed to git update-index --again in v17 for less manual work, but unfortunately the update-index command gets slower in very large Git repos.

  • #1797 7b2505a - This version of lint-staged uses the new staged publishing for npm packages feature. Releases are already published from GitHub Actions with trusted publishing, but now an additional approval with two-factor authentication is also required.

  • #1802 321b0a9 - Downgrade dependency tinyexec@1.2.2 to avoid issues in version 1.2.3.

Changelog

Sourced from lint-staged's changelog.

17.0.7

Patch Changes

17.0.6

Patch Changes

  • #1803 bdf2770 - Run all tests with Deno, in addition to Node.js and Bun.

  • #1796 7508272 - Fix performance regression of lint-staged v17 by going back to using git add to stage task modifications. This was changed to git update-index --again in v17 for less manual work, but unfortunately the update-index command gets slower in very large Git repos.

  • #1797 7b2505a - This version of lint-staged uses the new staged publishing for npm packages feature. Releases are already published from GitHub Actions with trusted publishing, but now an additional approval with two-factor authentication is also required.

  • #1802 321b0a9 - Downgrade dependency tinyexec@1.2.2 to avoid issues in version 1.2.3.

Commits
  • cd11fec Merge pull request #1807 from lint-staged/changeset-release/main
  • 15a8ee0 chore(changeset): release
  • 797bbd9 Merge pull request #1808 from lint-staged/add-stashing-faq
  • 504e307 docs: add FAQ entry on how stashing works
  • eff5cd1 Merge pull request #1806 from lint-staged/update-tinyexec
  • e692e58 build(deps): update tinyexec@^1.2.4
  • a2dd4ea Merge pull request #1805 from lint-staged/update-github-templates
  • c928519 docs: update GitHub templates
  • 094ba56 Merge pull request #1798 from lint-staged/changeset-release/main
  • 88e19fe chore(changeset): release
  • Additional commits viewable in compare view

Updates mailparser from 3.9.8 to 3.9.9

Changelog

Sourced from mailparser's changelog.

3.9.9 (2026-05-29)

Bug Fixes

Commits

Updates pdfjs-dist from 5.7.284 to 6.0.227

Release notes

Sourced from pdfjs-dist's releases.

v6.0.227

PDF.js 6.0 is a major release that contains a number of API changes, features and bugfixes.

The complete list of changes in this release is shown below. If you're upgrading to PDF.js 6.0 we recommend checking the changes prefixed with [api-minor] and [api-major] since those might require updates to your code.

Changes since v5.7.284

... (truncated)

Commits
  • 241dbab Merge pull request #21355 from Snuffleupagus/INTERNAL_EVT
  • 74db085 Re-factor how "internal" EventBus listeners are handled in the viewer
  • 19d95c8 Merge pull request #21285 from timvandermeij/puppeteer-25
  • b9b7661 Upgrade Puppeteer to version 25.1.0
  • e7f951d Merge pull request #21357 from timvandermeij/fix-browser-test-exit-code
  • 8d5fe52 Fix missing non-zero exit code for failure cases in test.mjs
  • 80c8e62 Merge pull request #21308 from calixteman/bug2036265
  • c7a32c3 Merge pull request #21343 from calixteman/issue9437
  • 3fe3321 Merge pull request #21334 from calixteman/merge_images
  • 3e76bfd Merge pull request #21354 from mozilla/update-locales
  • Additional commits viewable in compare view

Updates puppeteer from 25.0.4 to 25.1.0

Release notes

Sourced from puppeteer's releases.

puppeteer-core: v25.1.0

25.1.0 (2026-05-26)

🎉 Features

🛠️ Fixes

📄 Documentation

🏗️ Refactor

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • @​puppeteer/browsers bumped from 3.0.3 to 3.0.4

puppeteer: v25.1.0

25.1.0 (2026-05-26)

🎉 Features

  • roll to Chrome 149.0.7827.2 (af1b9be)

🛠️ Fixes

🏗️ Refactor

... (truncated)

Changelog

Sourced from puppeteer's changelog.

25.1.0 (2026-05-26)

🎉 Features

🛠️ Fixes

🏗️ Refactor

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • @​puppeteer/browsers bumped from 3.0.3 to 3.0.4

📄 Documentation

Commits

Updates typescript-eslint from 8.59.4 to 8.60.0

Release notes

Sourced from typescript-eslint's releases.

v8.60.0

8.60.0 (2026-05-25)

🚀 Features

  • rule-tester: added updates of RuleTester from upstream (#12291)

🩹 Fixes

  • playground TS version selector is not working (#12326, #12325)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from typescript-eslint's changelog.

8.60.0 (2026-05-25)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

Updates web-ext from 10.2.0 to 10.3.0

Release notes

Sourced from web-ext's releases.

10.3.0 (2026-05-28)

main changes

None

dependencies

  • Updated: dependency tmp to 0.2.6 (#3724)

others

  • chore(deps): bump addons-linter to 10.6.0 (#3725)
  • chore(ci): add cooldown setting to dependabot (#3722)
Commits

Updates webpack-cli from 7.0.2 to 7.0.3

Release notes

Sourced from webpack-cli's releases.

webpack-cli@7.0.3

Patch Changes

  • Improved CLI startup performance and reduced memory usage. (by @​alexander-akait in #4765)

  • Reduced CLI startup CPU and memory usage by caching schema-derived argument metadata, registering only the options present in the arguments, and reading config directories once during default-config discovery. (by @​alexander-akait in #4760)

  • Replace the fastest-levenshtein dependency with a small in-tree implementation used for command/option "did you mean" suggestions. (by @​alexander-akait in #4762)

Changelog

Sourced from webpack-cli's changelog.

7.0.3

Patch Changes

  • Improved CLI startup performance and reduced memory usage. (by @​alexander-akait in #4765)

  • Reduced CLI startup CPU and memory usage by caching schema-derived argument metadata, registering only the options present in the arguments, and reading config directories once during default-config discovery. (by @​alexander-akait in #4760)

  • Replace the fastest-levenshtein dependency with a small in-tree implementation used for command/option "did you mean" suggestions. (by @​alexander-akait in #4762)

Commits
  • 5fb92f3 chore(release): new release (#4711)
  • 00347ed perf(webpack-cli): allocate Levenshtein buffer lazily (#4765)
  • 1b40b72 chore: update ejs (#4764)
  • 2bbb639 refactor(webpack-cli): replace fastest-levenshtein with in-tree implementatio...
  • a467d6e chore(deps): bump the dependencies group across 1 directory with 10 updates (...
  • 183d0e6 perf(webpack-cli): cache schema arguments and use map lookups for options (#4...
  • 5b33f70 chore(deps-dev): bump sass-loader from 16.0.8 to 17.0.0 (#4756)
  • 59f362a chore(deps): bump qs and express (#4758)
  • eaffa0b chore(deps): bump codecov/codecov-action in the dependencies group (#4757)
  • b3498b6 chore(deps): bump the dependencies group with 3 updates (#4754)
  • Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request
Dependency Name Ignore Conditions
puppeteer [>= 21.7.a, < 21.8]
pdfjs-dist [>= 4.0.a, < 4.1]
puppeteer [>= 22.0.a, < 22.1]
puppeteer [>= 22.1.a, < 22.2]
puppeteer [>= 22.3.a, < 22.4]
puppeteer [>= 22.5.a, < 22.6]
puppeteer [>= 22.6.a, < 22.7]
puppeteer [>= 22.4.a, < 22.5]
puppeteer [>= 22.2.a, < 22.3]
puppeteer [>= 22.7.a, < 22.8]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the npm-deps group with 11 updates
164ea55 
Bumps the npm-deps group with 11 updates:

| Package | From | To |
| --- | --- | --- |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.4.5` | `3.4.7` |
| [squire-rte](https://github.com/neilj/Squire) | `2.4.5` | `2.4.6` |
| [eslint](https://github.com/eslint/eslint) | `10.4.0` | `10.4.1` |
| [googleapis](https://github.com/googleapis/google-api-nodejs-client) | `172.0.0` | `173.0.0` |
| [lint-staged](https://github.com/lint-staged/lint-staged) | `17.0.5` | `17.0.7` |
| [mailparser](https://github.com/nodemailer/mailparser) | `3.9.8` | `3.9.9` |
| [pdfjs-dist](https://github.com/mozilla/pdf.js) | `5.7.284` | `6.0.227` |
| [puppeteer](https://github.com/puppeteer/puppeteer) | `25.0.4` | `25.1.0` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.59.4` | `8.60.0` |
| [web-ext](https://github.com/mozilla/web-ext) | `10.2.0` | `10.3.0` |
| [webpack-cli](https://github.com/webpack/webpack-cli) | `7.0.2` | `7.0.3` |


Updates `dompurify` from 3.4.5 to 3.4.7
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.5...3.4.7)

Updates `squire-rte` from 2.4.5 to 2.4.6
- [Changelog](https://github.com/fastmail/Squire/blob/master/CHANGELOG.md)
- [Commits](https://github.com/neilj/Squire/commits)

Updates `eslint` from 10.4.0 to 10.4.1
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.4.0...v10.4.1)

Updates `googleapis` from 172.0.0 to 173.0.0
- [Release notes](https://github.com/googleapis/google-api-nodejs-client/releases)
- [Commits](googleapis/google-api-nodejs-client@googleapis-v172.0.0...googleapis-v173.0.0)

Updates `lint-staged` from 17.0.5 to 17.0.7
- [Release notes](https://github.com/lint-staged/lint-staged/releases)
- [Changelog](https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md)
- [Commits](lint-staged/lint-staged@v17.0.5...v17.0.7)

Updates `mailparser` from 3.9.8 to 3.9.9
- [Release notes](https://github.com/nodemailer/mailparser/releases)
- [Changelog](https://github.com/nodemailer/mailparser/blob/master/CHANGELOG.md)
- [Commits](nodemailer/mailparser@v3.9.8...v3.9.9)

Updates `pdfjs-dist` from 5.7.284 to 6.0.227
- [Release notes](https://github.com/mozilla/pdf.js/releases)
- [Commits](mozilla/pdf.js@v5.7.284...v6.0.227)

Updates `puppeteer` from 25.0.4 to 25.1.0
- [Release notes](https://github.com/puppeteer/puppeteer/releases)
- [Changelog](https://github.com/puppeteer/puppeteer/blob/main/CHANGELOG.md)
- [Commits](puppeteer/puppeteer@puppeteer-v25.0.4...puppeteer-v25.1.0)

Updates `typescript-eslint` from 8.59.4 to 8.60.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.60.0/packages/typescript-eslint)

Updates `web-ext` from 10.2.0 to 10.3.0
- [Release notes](https://github.com/mozilla/web-ext/releases)
- [Commits](mozilla/web-ext@10.2.0...10.3.0)

Updates `webpack-cli` from 7.0.2 to 7.0.3
- [Release notes](https://github.com/webpack/webpack-cli/releases)
- [Changelog](https://github.com/webpack/webpack-cli/blob/main/CHANGELOG.md)
- [Commits](https://github.com/webpack/webpack-cli/compare/webpack-cli@7.0.2...webpack-cli@7.0.3)

---
updated-dependencies:
- dependency-name: dompurify
  dependency-version: 3.4.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-deps
- dependency-name: squire-rte
  dependency-version: 2.4.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-deps
- dependency-name: eslint
  dependency-version: 10.4.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-deps
- dependency-name: googleapis
  dependency-version: 173.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-deps
- dependency-name: lint-staged
  dependency-version: 17.0.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-deps
- dependency-name: mailparser
  dependency-version: 3.9.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-deps
- dependency-name: pdfjs-dist
  dependency-version: 6.0.227
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-deps
- dependency-name: puppeteer
  dependency-version: 25.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-deps
- dependency-name: typescript-eslint
  dependency-version: 8.60.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-deps
- dependency-name: web-ext
  dependency-version: 10.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-deps
- dependency-name: webpack-cli
  dependency-version: 7.0.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels May 31, 2026
@dependabot dependabot Bot requested a review from sosnovsky as a code owner May 31, 2026 22:04
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels May 31, 2026
FlowCryptRobot
FlowCryptRobot previously approved these changes May 31, 2026
View reviewed changes
@FlowCryptRobot FlowCryptRobot enabled auto-merge (squash) May 31, 2026 22:04
@FlowCryptRobot FlowCryptRobot merged commit 1477e28 into master Jun 1, 2026
12 checks passed
@FlowCryptRobot FlowCryptRobot deleted the dependabot/npm_and_yarn/npm-deps-3a6f1a250f branch June 1, 2026 09:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@sosnovsky sosnovsky sosnovsky approved these changes

@FlowCryptRobot FlowCryptRobot FlowCryptRobot left review comments

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@sosnovsky @FlowCryptRobot