build(deps): bump the npm_and_yarn group across 1 directory with 7 updates - #445
Open
dependabot[bot] wants to merge 3 commits into
Open
build(deps): bump the npm_and_yarn group across 1 directory with 7 updates#445dependabot[bot] wants to merge 3 commits into
dependabot[bot] wants to merge 3 commits into
Conversation
…dates Bumps the npm_and_yarn group with 7 updates in the /docs directory: | Package | From | To | | --- | --- | --- | | [dompurify](https://github.com/cure53/DOMPurify) | `3.4.12` | `3.4.13` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.12` | `1.1.18` | | [js-yaml](https://github.com/nodeca/js-yaml) | `3.14.2` | `3.15.1` | | [lodash](https://github.com/lodash/lodash) | `4.17.23` | `4.18.1` | | [launch-editor](https://github.com/vitejs/launch-editor) | `2.13.1` | `2.14.1` | | [mermaid](https://github.com/mermaid-js/mermaid) | `11.16.0` | `11.16.1` | | [webpack-dev-server](https://github.com/webpack/webpack-dev-server) | `5.2.3` | `5.2.6` | Updates `dompurify` from 3.4.12 to 3.4.13 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.4.12...3.4.13) Updates `brace-expansion` from 1.1.12 to 1.1.18 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.18) Updates `js-yaml` from 3.14.2 to 3.15.1 - [Changelog](https://github.com/nodeca/js-yaml/blob/3.15.1/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.14.2...3.15.1) Updates `lodash` from 4.17.23 to 4.18.1 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.23...4.18.1) Updates `launch-editor` from 2.13.1 to 2.14.1 - [Commits](vitejs/launch-editor@v2.13.1...v2.14.1) Updates `mermaid` from 11.16.0 to 11.16.1 - [Release notes](https://github.com/mermaid-js/mermaid/releases) - [Commits](https://github.com/mermaid-js/mermaid/compare/mermaid@11.16.0...mermaid@11.16.1) Updates `webpack-dev-server` from 5.2.3 to 5.2.6 - [Release notes](https://github.com/webpack/webpack-dev-server/releases) - [Changelog](https://github.com/webpack/webpack-dev-server/blob/v5.2.6/CHANGELOG.md) - [Commits](webpack/webpack-dev-server@v5.2.3...v5.2.6) --- updated-dependencies: - dependency-name: dompurify dependency-version: 3.4.13 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.18 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 3.15.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.18.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: launch-editor dependency-version: 2.14.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: mermaid dependency-version: 11.16.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: webpack-dev-server dependency-version: 5.2.6 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
requested review from
Rem-Dam,
SudoThijn,
remko48 and
rubenvdlinde
as code owners
August 10, 2026 06:07
dependabot
Bot
added
dependencies
…umps
@babel/core is a devDependency here solely to serve @babel/eslint-parser --
webpack.config.js contains no babel reference and @nextcloud/webpack-vue-config
pulls none. Moving core to ^8.0.1 while the parser stays at ^7.28.6 leaves an
unsatisfiable peer range: @babel/eslint-parser@7.29.7 requires
@babel/core@^7.11.0.
Measured both ways with a fresh resolve, package.json only:
core ^8.0.1 + parser ^7.28.6 -> npm ERESOLVE, 'Could not resolve dependency:
peer @babel/core@"^7.11.0" from
@babel/eslint-parser@7.29.7'
core ^7.29.0 + parser ^7.28.6 -> resolves clean
CI does not see it because 'npm ci' replays the locked tree without
re-resolving peers, so the build and eslint cells stay green while 'npm
install' breaks for every developer on the repo.
The pair cannot be realigned upward yet: @babel/eslint-parser@8 requires
eslint ^9 || ^10 and this app resolves eslint 8.57.1, so taking babel 8 here
means an ESLint 9 flat-config migration first. The bump carries no security
content -- the whole root lock delta is babel 8 and its transitives, plus
nanoid 3.3.17->3.3.18.
The docs/package-lock.json half is untouched and still lands: dompurify,
brace-expansion, js-yaml, lodash, launch-editor, mermaid and
webpack-dev-server.
Contributor
Quality Report — ConductionNL/decidesk @
|
| Check | PHP | Vue | Security | License | Tests |
|---|---|---|---|---|---|
| lint | ✅ | ||||
| phpcs | ✅ | ||||
| phpmd | ✅ | ||||
| psalm | ✅ | ||||
| phpstan | ✅ | ||||
| phpmetrics | ✅ | ||||
| eslint | ✅ | ||||
| stylelint | ✅ | ||||
| build | ✅ | ||||
| check-manifest | ✅ | ||||
| test-l10n | ✅ | ||||
| composer | ✅ | ✅ 100/100 | |||
| npm | ✅ | ✅ 548/548 | |||
| PHPUnit | ✅ | ||||
| Newman | ✅ | ||||
| Playwright | ❌ | ||||
| Hydra gates | ❌ |
Quality workflow — 2026-08-12 07:25 UTC
Download the full PDF report from the workflow artifacts.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the npm_and_yarn group with 7 updates in the /docs directory:
3.4.123.4.131.1.121.1.183.14.23.15.14.17.234.18.12.13.12.14.111.16.011.16.15.2.35.2.6Updates
dompurifyfrom 3.4.12 to 3.4.13Release notes
Sourced from dompurify's releases.
Commits
3067f77release: 3.4.13 (#1562)Updates
brace-expansionfrom 1.1.12 to 1.1.18Release notes
Sourced from brace-expansion's releases.
Commits
758fcd61.1.1827fbeedMerge commit from fork5c57cc21.1.17d757f1dnpm ignore.claudecb4b9e4fix: backport GHSA-mh99-v99m-4gvg (#129)447763a1.1.16d74e630fix: v1 backport for CVE-2026-13149 (#122)2203f4f1.1.150b09384Backport v5.0.6 change to v1 (#111)10c05fc1.1.14Updates
js-yamlfrom 3.14.2 to 3.15.1Changelog
Sourced from js-yaml's changelog.
Commits
ab85ae23.15.1 released30a5e76dist rebuild22a8071Backport quadratic complexity fix for !!omapc34b6c43.15.0 released21e13d3dist rebuild4165c62Add v3-legacy tag for publishd8ff750Add package lock24f13e7AddedmaxTotalMergeKeys(10000) loader option (v5 backport)Updates
lodashfrom 4.17.23 to 4.18.1Release notes
Sourced from lodash's releases.
Commits
cb0b9b9release(patch): bump main to 4.18.1 (#6177)75535f5chore: prune stale advisory refs (#6170)62e91bcdocs: remove n_ Node.js < 6 REPL note from README (#6165)59be2derelease(minor): bump to 4.18.0 (#6161)af63457fix: broken tests for _.template 879aaa91073a76fix: linting issues879aaa9fix: validate imports keys in _.templatefe8d32efix: block prototype pollution in baseUnset via constructor/prototype traversal18ba0a3refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)b819080ci: add dist sync validation workflow (#6137)Updates
launch-editorfrom 2.13.1 to 2.14.1Commits
3f97c64v2.14.10cc9550fix: reject UNC paths (#138)afd1ab9ci: run tests on mac and windows (#136)0bfa328test: add some tests for launch-editor package (#135)1b006aechore: add README (#134)383ef26v2.14.06277209ci: harden publish settings520b2f7fix(deps): update all non-major dependencies (#129)475ac66chore(deps): update dependency lint-staged to v17 (#130)247bf1dchore(deps): update dependency yorkie to v2 (#131)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for launch-editor since your current version.
Updates
mermaidfrom 11.16.0 to 11.16.1Release notes
Sourced from mermaid's releases.
Commits
7ecca0cVersion Packages (#8023)95b1b9cdocs: changemermaidAPI.setConfig()changeset (#8024)acc69f1Merge pull request #8022 from mermaid-js/release/11.16.1eba7287docs: point changesets to correct commit hashes12d472cMerge commit from fork2cd6dcfMerge commit from fork630aa7eMerge commit from fork59b22faMerge commit from fork99af3fcMerge commit from fork2337f7eMerge branch 'test/improve-example.html' into release/11.16.1Updates
webpack-dev-serverfrom 5.2.3 to 5.2.6Release notes
Sourced from webpack-dev-server's releases.
Changelog
Sourced from webpack-dev-server's changelog.
Commits
8a37b0echore(release): new release (#5697)f21ed0ffix: handle malformed Host and Origin headers (#5699)80cd9eefix: reject cross-site requests to open-editor and invalidate endpoints (#5698)308e853fix: handle undefined options in Server constructor (#5695)8b2b915chore: update branch references from v4 to v5 in workflow configuration870ed22chore: add v5 branch to release workflow triggersc3ee325chore(release): new release (#5682)60173befeat: add changeset validation and release workflow (#5680)948d5e6fix(proxy): match the HMR upgrade path exactly like the ws server (#5678)93e8996fix: skip HMR websocket path when forwarding upgrades to user-defined proxies...Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for webpack-dev-server since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.