Skip to content

chore(deps): bump the minor-and-patch group with 9 updates - #568

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-b1e04f62e2
Open

chore(deps): bump the minor-and-patch group with 9 updates#568
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-b1e04f62e2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 30, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 9 updates:

Package From To
@vue/test-utils 2.4.11 2.5.0
happy-dom 20.11.6 20.11.12
vue-tsc 3.3.10 3.3.11
sass-embedded 1.102.0 1.103.1
vue 3.5.41 3.5.42
vue-router 5.2.0 5.3.0
js-yaml 5.3.0 5.4.1
marked 18.0.10 18.0.11
@zip.js/zip.js 2.8.54 2.8.60

Updates @vue/test-utils from 2.4.11 to 2.5.0

Release notes

Sourced from @​vue/test-utils's releases.

v2.5.0

⚠️ Breaking change: Vue Test Utils no longer supports class components. See #2904.

What's Changed

New Contributors

Full Changelog: vuejs/test-utils@v2.4.11...v2.5.0

Commits

Updates happy-dom from 20.11.6 to 20.11.12

Release notes

Sourced from happy-dom's releases.

v20.11.12

👷‍♂️ Patch fixes

v20.11.11

👷‍♂️ Patch fixes

v20.11.10

👷‍♂️ Patch fixes

  • Return default validationMessage for built-in constraint violations - By @​mixelburg in task #2187

v20.11.9

👷‍♂️ Patch fixes

  • Make sure that the element has been upgraded before invoking reaction callback in custom elements - By @​capricorn86 in task #2317

v20.11.8

👷‍♂️ Patch fixes

  • Values pushed or assigned to the adoptedStyleSheet array should be validated - By @​capricorn86 in task #2315

v20.11.7

👷‍♂️ Patch fixes

  • The properties Document.adoptedStyleSheets and ShadowRoot.adoptedStyleSheets should validate it's value - By @​capricorn86 in task #2313
Commits
  • 3d282e5 fix: #2322 Add check for if the node is still a parent during disconnect (#...
  • 64e2c77 fix: #2253 Use proxy as parent node in Node.connectedToNode() (#2254)
  • a00ec69 fix: #2319 Removing a child incorrectly calls flow for connecting node (#2321)
  • 152b5d8 fix: #2319 Removing a child incorrectly calls flow for connecting node (#2320)
  • 1100b9c fix: #2187 Return default validationMessage for built-in constraint violati...
  • 1893795 fix: #2317 Make sure that the element has been upgraded before invoking rea...
  • 00fcf21 fix: #2315 Values pushed or assigned to the adoptedStyleSheet array should ...
  • 9a9e615 fix: #2313 The properties Document.adoptedStyleSheets and ShadowRoot.adopte...
  • See full diff in compare view

Updates vue-tsc from 3.3.10 to 3.3.11

Release notes

Sourced from vue-tsc's releases.

v3.3.11

language-core

  • fix: generate full fragment props for type checking (#6155) - Thanks to @​serkodev!

language-service

  • fix: invalidate tag and prop casing detection after template changes (#6172) - Thanks to @​serkodev!
  • refactor: make name casing detection reactive (#6173) - Thanks to @​KazariEX!

component-meta

  • fix: invalidate module resolution caches when deleting files (#6163) - Thanks to @​serkodev!

tsc

  • fix: make extension retry errors serializable across IPC (#6162) - Thanks to @​KazariEX!

vscode

Our Sponsors ❤️

... (truncated)

Changelog

Sourced from vue-tsc's changelog.

3.3.11 (2026-08-21)

language-core

  • fix: generate full fragment props for type checking (#6155) - Thanks to @​serkodev!

language-service

  • fix: invalidate tag and prop casing detection after template changes (#6172) - Thanks to @​serkodev!
  • refactor: make name casing detection reactive (#6173) - Thanks to @​KazariEX!

component-meta

  • fix: invalidate module resolution caches when deleting files (#6163) - Thanks to @​serkodev!

tsc

  • fix: make extension retry errors serializable across IPC (#6162) - Thanks to @​KazariEX!

vscode

Commits
  • f521b39 v3.3.11 (#6174)
  • 05ab009 fix(tsc): replace symbol retryToken with error to allow IPC serialization (...
  • fd6dada fix(language-core): generate full fragment props for typecheck (#6155)
  • See full diff in compare view

Updates sass-embedded from 1.102.0 to 1.103.1

Changelog

Sourced from sass-embedded's changelog.

1.103.1

  • No user-visible changes.

1.103.0

  • Potentially breaking compatibility fix: Colors now preserve "analogous sets" of missing channels during conversions, per the CSS spec. For example, color.to-space(lch(50% none none), lab) now returns lab(50% none none) instead of lab(50% 0 0).
Commits

Updates vue from 3.5.41 to 3.5.42

Release notes

Sourced from vue's releases.

v3.5.42

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

Changelog

Sourced from vue's changelog.

3.5.42 (2026-08-27)

Bug Fixes

  • hydration: handle async component unmount before lazy hydration (#15252) (6e1814a)
  • hydration: handle moving unresolved async fragment (#15263) (a72036f)
  • runtime-core: avoid caching unmounted suspense children (#15291) (b535917), closes #15288
  • runtime-core: keep .trim result when combined with .number v-model modifier (#15346) (f8d42e1)
  • runtime-core: resolve $el for dev root comment fragment (#15313) (8654f35), closes #12680
  • runtime-dom: support !important on CSS custom properties in style binding (#15348) (31da934)
  • server-renderer: reject CR in attribute names (#15266) (a2b40db)
  • shared: correctly compare Map and Set values (#15328) (ef82a26), closes #15320
  • suspense: don't treat the leaving branch as the fallback while its mount is pending (#15333) (cd19745), closes #15332
  • v-model: re-sync select when model is overridden in change handler (#15298) (6eaecc1), closes #10505
Commits
  • d63616c release: v3.5.42
  • b8543dc Revert "fix(compiler-core): handle invalid static arg in same-name v-bind sho...
  • 3857716 fix(compiler-core): handle invalid static arg in same-name v-bind shorthand (...
  • 31da934 fix(runtime-dom): support !important on CSS custom properties in style bindin...
  • f8d42e1 fix(runtime-core): keep .trim result when combined with .number v-model modif...
  • cd19745 fix(suspense): don't treat the leaving branch as the fallback while its mount...
  • 8654f35 fix(runtime-core): resolve $el for dev root comment fragment (#15313)
  • ef82a26 fix(shared): correctly compare Map and Set values (#15328)
  • 6eaecc1 fix(v-model): re-sync select when model is overridden in change handler (#15298)
  • b535917 fix(runtime-core): avoid caching unmounted suspense children (#15291)
  • Additional commits viewable in compare view

Updates vue-router from 5.2.0 to 5.3.0

Release notes

Sourced from vue-router's releases.

v5.3.0

   🚀 Features

   🐞 Bug Fixes

   🏎 Performance

    View changes on GitHub
Commits
  • 0e91ac8 release: vue-router@5.3.0
  • b19cce2 chore: dark mode e2e
  • 2315047 fix(router): skip scroll saving for unknown pop direction (fix #1431) (#2780)
  • d2b87d5 feat: prevent race condition dev-only error (#2789)
  • b75d5a8 docs: scroll off
  • 033f1c7 feat(scroll): skip scroll computation based on history.scrollRestoration
  • 67babd4 fix(unplugin): generate param types from override paths and stop inheritance ...
  • 48566ba refactor: isAbsolutePath
  • 084fcfc perf(experimental): avoid tracking currentRoute in absolute string locations
  • dfb373d test: load resolved location before passing it as currentLocation
  • Additional commits viewable in compare view

Updates js-yaml from 5.3.0 to 5.4.1

Changelog

Sourced from js-yaml's changelog.

[5.4.1] - 2026-08-26

Changed

  • Hard-limit merge sequence size to 100.

Security

  • Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

[5.4.0] - 2026-08-25

Added

  • Added the scalarStyleRules dumper option to customize string formatting. See Scalar styling for details.

Changed

  • [breaking] Flattened the low-level AST node style representation. Scalar and collection nodes now use SCALAR_STYLE and COLLECTION_STYLE values; explicit tags use the separate tagged property. Alias nodes now contain only kind and anchor. This only affects code that directly constructs or edits AST nodes.
  • [breaking] The sortKeys option was rewritten using AST mutation to avoid side effects.
  • Reworked scalar style selection. This can change formatting without changing loaded values; in particular, whitespace-only strings are now double-quoted.

Fixed

  • Accept a byte order mark at the start of each document in a stream, #791.
  • Produce valid flow mappings with quoteFlowKeys and flowSkipColonSpace, including alias and property-only keys, #786.
  • Preserve empty scalar items when converting block sequences to flow style.
  • Do not apply the 1024-character simple-key limit to flow mapping keys.
  • Count Unicode code points, rather than UTF-16 code units, for the 1024-character simple-key limit.
  • Add an explicit document-end marker after keep-chomped block scalars when needed to preserve trailing newlines.
Commits

Updates marked from 18.0.10 to 18.0.11

Release notes

Sourced from marked's releases.

v18.0.11

18.0.11 (2026-08-24)

Bug Fixes

  • do not nest a link inside a link (#4051) (e250e31)
  • inlineTokens rebuilds the reflink-mask preamble per call (#4040) (0653c24)
  • keep emphasis in the text of a rejected reference link (#4059) (b699db3)
Commits
  • 53cb13f chore(release): 18.0.11 [skip ci]
  • 0c6b2a6 docs: add adaptable bullet point (#4058)
  • c430a64 chore(deps-dev): bump eslint from 10.8.1 to 10.9.0 (#4069)
  • b699db3 fix: keep emphasis in the text of a rejected reference link (#4059)
  • 0653c24 fix: inlineTokens rebuilds the reflink-mask preamble per call (#4040)
  • e250e31 fix: do not nest a link inside a link (#4051)
  • See full diff in compare view

Updates @zip.js/zip.js from 2.8.54 to 2.8.60

Release notes

Sourced from @​zip.js/zip.js's releases.

v2.8.60

What's Changed in v2.8.60

New features

  • New VERSION constant exposing the version of the library at runtime (e.g. "2.8.60"). It matches the version declared in package.json; the continuous integration verifies the agreement
  • New getRegisteredCodecs() function. It returns the definitions of the codecs registered with registerCodec(), as snapshots that cannot alter the registry. The CompressionStream and DecompressionStream classes of a codec registered with codecURI appear in the result once its module has been imported
  • New getSupportedCompressionMethods() function. It returns the compression methods supported in the current environment and configuration: the built-in methods resolved against the compression streams available at the time of the call, followed by the registered codecs. Each entry reports the compression and decompression support separately, e.g. Deflate64 is read-only. The support of a codec registered with codecURI only is reported as undefined until its module is imported
  • Registered compression codecs now receive the size of the source data as CompressionStreamOptions#uncompressedSize when the reader has a known size. Codecs such as Zstandard can use it as the pledged source size and include the content size in the compressed frame (#675)

Bug fixes

  • The zip-fs-core build now exports the full core API. It previously exported only the filesystem classes, so configure(), registerCodec(), the reader and writer classes, and the constants were unreachable from this build

Documentation

  • The Reader class documents how to implement random access to files opened with the runtime APIs, with a Deno example
  • The offset and usdz options are documented as read when the ZipWriter is created and ignored when passed to ZipWriter#add, and the default value of offset read from Writer#size is documented

Tests and continuous integration

  • New tests cover the registered codec snapshots, the codec constructor options transmitted to web workers, the VERSION constant, and the supported compression methods including the deferred resolution of codecURI codecs
  • The version bump now rebuilds the bundles so the published files embed the version, and the continuous integration verifies that the version constant agrees with the declared versions

Credits

  • Thanks to @​xqdoo00o for implementing the uncompressedSize option of the compression codecs (#675)
  • Claude (Fable 5) contributed to every other change listed above

v2.8.59

What's Changed in v2.8.59

New features

  • New ZipReader#warnings property and warnings property on entries. They report non-fatal anomalies noticed while reading, as an array of { reason, filename? } objects deduplicated by reason. ZipReader#warnings is replaced on each getEntries() call and collects the archive-level observations: an unsorted central directory, an unknown "version needed to extract", the compressed patched data bit, a malformed extra field, unknown zip64 extensible data, and a wrapped 16-bit entry count. The entry-level warnings property is set by getData() and collects the local file header observations. The checks controlled by the strictness option deposit a warning with the same reason when a lower strictness tolerates what "strict" rejects: appended or prepended data, trailing central directory data, duplicate filenames, a mismatched zip64 end of central directory record, and local file header mismatches. The warnings only report bytes the parse already read, so enabling nothing costs no additional I/O. The reasons are exported as 14 WARNING_* constants
  • New isZipFile() function. It returns true if the data looks like a zip file, i.e. if ZipReader#getEntries called on the same data would locate the archive structure. It runs the same end-anchored search as ZipReader and verifies that a central directory record is stored where the end of central directory record points, without parsing the entries. The strictness and maxAppendedDataSize options control the tolerated appended data with the same semantics and defaults as ZipReader
  • New centralExtraField option of ZipWriter#add. It sets an extra field written only in the central directory record, complementing the localExtraField option which targets the local file header and the extraField option which targets both

Behavior changes

  • Leading and trailing whitespace in entry names is now preserved by ZipWriter#add instead of being silently trimmed. The zip specification does not restrict whitespace in filenames; note that Windows filesystems cannot represent a trailing space or dot in a name
  • Unclaimed bytes lying between the last central directory record and the end of central directory record are now detected, even when the declared central directory size matches the records. The "strict" strictness rejects such archives with the ERR_AMBIGUOUS_ARCHIVE error and the lower strictness levels deposit the "trailing central directory data" warning. These bytes were previously accepted silently at every strictness level, although the gap can hide records that other readers interpret, e.g. an unadvertised zip64 end of central directory record, and Info-ZIP and 7-Zip both flag such files. The check is skipped when the central directory is encrypted, because the plaintext is legitimately shorter than the stored data

Tests and continuous integration

  • A new test suite covers the warnings: each reason is triggered by byte surgery on a well-formed zip file and asserted both as a warning at the tolerant levels and as a rejection at the levels that make the corresponding check throw
  • New regression tests lock the preserved whitespace in entry names, the isZipFile() probe, the centralExtraField option, and the detection of unclaimed bytes before the end of central directory record

Credits

... (truncated)

Commits
  • de609d4 bump up version
  • f8789dd export the full core api from the zip-fs-core build
  • 8da4a60 add getSupportedCompressionMethods
  • 8d2bcad add VERSION constant and getRegisteredCodecs
  • 2bd74ba Merge pull request #675 from xqdoo00o/master
  • 06ed534 regenerate bundles and markdown doc
  • bb36cfd pass uncompressed size to registered compression codecs
  • 9d8bed8 document the constructor-only scope of offset and usdz
  • 4f741e6 document the default offset read from the writer size
  • 594ae45 add example
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the minor-and-patch group with 9 updates
9873625 
Bumps the minor-and-patch group with 9 updates:

| Package | From | To |
| --- | --- | --- |
| [@vue/test-utils](https://github.com/vuejs/test-utils) | `2.4.11` | `2.5.0` |
| [happy-dom](https://github.com/capricorn86/happy-dom) | `20.11.6` | `20.11.12` |
| [vue-tsc](https://github.com/vuejs/language-tools/tree/HEAD/packages/tsc) | `3.3.10` | `3.3.11` |
| [sass-embedded](https://github.com/sass/embedded-host-node) | `1.102.0` | `1.103.1` |
| [vue](https://github.com/vuejs/core) | `3.5.41` | `3.5.42` |
| [vue-router](https://github.com/vuejs/router) | `5.2.0` | `5.3.0` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `5.3.0` | `5.4.1` |
| [marked](https://github.com/markedjs/marked) | `18.0.10` | `18.0.11` |
| [@zip.js/zip.js](https://github.com/gildas-lormeau/zip.js) | `2.8.54` | `2.8.60` |


Updates `@vue/test-utils` from 2.4.11 to 2.5.0
- [Release notes](https://github.com/vuejs/test-utils/releases)
- [Commits](vuejs/test-utils@v2.4.11...v2.5.0)

Updates `happy-dom` from 20.11.6 to 20.11.12
- [Release notes](https://github.com/capricorn86/happy-dom/releases)
- [Commits](capricorn86/happy-dom@v20.11.6...v20.11.12)

Updates `vue-tsc` from 3.3.10 to 3.3.11
- [Release notes](https://github.com/vuejs/language-tools/releases)
- [Changelog](https://github.com/vuejs/language-tools/blob/master/CHANGELOG.md)
- [Commits](https://github.com/vuejs/language-tools/commits/v3.3.11/packages/tsc)

Updates `sass-embedded` from 1.102.0 to 1.103.1
- [Changelog](https://github.com/sass/embedded-host-node/blob/main/CHANGELOG.md)
- [Commits](sass/embedded-host-node@1.102.0...1.103.1)

Updates `vue` from 3.5.41 to 3.5.42
- [Release notes](https://github.com/vuejs/core/releases)
- [Changelog](https://github.com/vuejs/core/blob/main/CHANGELOG.md)
- [Commits](vuejs/core@v3.5.41...v3.5.42)

Updates `vue-router` from 5.2.0 to 5.3.0
- [Release notes](https://github.com/vuejs/router/releases)
- [Commits](vuejs/router@v5.2.0...v5.3.0)

Updates `js-yaml` from 5.3.0 to 5.4.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@5.3.0...5.4.1)

Updates `marked` from 18.0.10 to 18.0.11
- [Release notes](https://github.com/markedjs/marked/releases)
- [Commits](markedjs/marked@v18.0.10...v18.0.11)

Updates `@zip.js/zip.js` from 2.8.54 to 2.8.60
- [Release notes](https://github.com/gildas-lormeau/zip.js/releases)
- [Commits](gildas-lormeau/zip.js@v2.8.54...v2.8.60)

---
updated-dependencies:
- dependency-name: "@vue/test-utils"
  dependency-version: 2.5.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: happy-dom
  dependency-version: 20.11.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: vue-tsc
  dependency-version: 3.3.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: sass-embedded
  dependency-version: 1.103.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: vue
  dependency-version: 3.5.42
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: vue-router
  dependency-version: 5.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: js-yaml
  dependency-version: 5.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: marked
  dependency-version: 18.0.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@zip.js/zip.js"
  dependency-version: 2.8.60
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 30, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner August 30, 2026 22:11
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 30, 2026
@kw-security

kw-security commented Aug 30, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
✅ Open Source Security 0 0 0 0 0 issues
✅ Licenses 0 0 0 0 0 issues
✅ Code Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@kw-security