Skip to content

build(deps): bump the npm_and_yarn group across 2 directories with 5 updates#54

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/docs/npm_and_yarn-193933165e
Open

build(deps): bump the npm_and_yarn group across 2 directories with 5 updates#54
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/docs/npm_and_yarn-193933165e

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Apr 7, 2026

Bumps the npm_and_yarn group with 5 updates in the /web directory:

Package From To
vite 5.4.21 6.4.2
dompurify 3.2.4 3.3.2
swiper 11.1.12 12.1.2
axios 1.12.0 1.13.5
qs 6.14.1 6.14.2

Bumps the npm_and_yarn group with 2 updates in the /web/packages/axios directory: axios and qs.

Updates vite from 5.4.21 to 6.4.2

Release notes

Sourced from vite's releases.

v6.4.2

Please refer to CHANGELOG.md for details.

v6.4.1

Please refer to CHANGELOG.md for details.

v6.4.0

Please refer to CHANGELOG.md for details.

v6.3.7

Please refer to CHANGELOG.md for details.

v6.3.6

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

6.4.2 (2026-04-06)

6.4.1 (2025-10-20)

6.4.0 (2025-10-15)

  • feat: allow passing down resolved config to vite's createServer (#20932) (ca6455e), closes #20932

6.3.7 (2025-10-14)

  • fix(esbuild): inject esbuild helpers correctly for esbuild 0.25.9+ (#20940) (c59a222), closes #20940

6.3.6 (2025-09-08)

6.3.5 (2025-05-05)

6.3.4 (2025-04-30)

  • fix: check static serve file inside sirv (#19965) (c22c43d), closes #19965
  • fix(optimizer): return plain object when using require to import externals in optimized dependenci (efc5eab), closes #19940
  • refactor: remove duplicate plugin context type (#19935) (d6d01c2), closes #19935

6.3.3 (2025-04-24)

... (truncated)

Commits

Updates dompurify from 3.2.4 to 3.3.2

Release notes

Sourced from dompurify's releases.

DOMPurify 3.3.2

  • Fixed a possible bypass caused by jsdom's faulty raw-text tag parsing, thanks multiple reporters
  • Fixed a prototype pollution issue when working with custom elements, thanks @​christos-eth
  • Fixed a lenient config parsing in _isValidAttribute, thanks @​christos-eth
  • Bumped and removed several dependencies, thanks @​Rotzbua
  • Fixed the test suite after bumping dependencies, thanks @​Rotzbua

DOMPurify 3.3.1

  • Updated ADD_FORBID_CONTENTS setting to extend default list, thanks @​MariusRumpf
  • Updated the ESM import syntax to be more correct, thanks @​binhpv

DOMPurify 3.3.0

  • Added the SVG mask-type attribute to default allow-list, thanks @​prasadrajandran
  • Added support for ADD_ATTR and ADD_TAGS to accept functions, thanks @​nelstrom
  • Fixed an issue with the slot element being in both SVG and HTML allow-list, thanks @​Wim-Valgaeren

DOMPurify 3.2.7

  • Added new attributes and elements to default allow-list, thanks @​elrion018
  • Added tagName parameter to custom element attributeNameCheck, thanks @​nelstrom
  • Added better check for animated href attributes, thanks @​llamakko
  • Updated and improved the bundled types, thanks @​ssi02014
  • Updated several tests to better align with new browser encoding behaviors
  • Improved the handling of potentially risky content inside CDATA elements, thanks @​securityMB & @​terjanq
  • Improved the regular expression for raw-text elements to cover textareas, thanks @​securityMB & @​terjanq

DOMPurify 3.2.6

DOMPurify 3.2.5

  • Added a check to the mXSS detection regex to be more strict, thanks @​masatokinugawa
  • Added ESM type imports in source, removes patch function, thanks @​donmccurdy
  • Added script to verify various TypeScript configurations, thanks @​reduckted
  • Added more modern browsers to the Karma launchers list
  • Added Node 23.x to tested runtimes, removed Node 17.x
  • Fixed the generation of source maps, thanks @​reduckted
  • Fixed an unexpected behavior with ALLOWED_URI_REGEXP using the 'g' flag, thanks @​hhk-png
  • Fixed a few typos in the README file
Commits
  • 5e56114 Getting 3.x branch ready for 3.3.2 release (#1208)
  • e8c95f4 fix: Fixed the broken package-lock.json
  • 9636037 Update package-lock.json
  • 5cad4ce Getting 3.x branch ready for 3.3.2 releas (#1205)
  • 6fc446a Merge pull request #1175 from cure53/main
  • 3b3bf91 Merge branch 'main' of github.com:cure53/DOMPurify
  • 9863f41 chore: Preparing 3.3.1 release
  • b4e0295 chore: Preparing 3.3.0 release
  • 077746b build(deps-dev): bump js-yaml from 4.1.0 to 4.1.1 (#1170)
  • 4de68bb build(deps): bump actions/checkout from 5 to 6 (#1171)
  • Additional commits viewable in compare view

Updates swiper from 11.1.12 to 12.1.2

Release notes

Sourced from swiper's releases.

v12.1.2

No release notes provided.

v12.1.1

Bug Fixes

  • a11y: fix focus in virtual mode enabled (3055008), closes #8147
  • core: avoid double-subtracting offsets in centerInsufficientSlides (#8158) (60b0052)
  • core: prevent duplicate module initialization in constructor (#8155) (#8156) (07738a2)
  • types: support boolean as a11y value (#8157) (6bf76d5)

v12.1.0

Bug Fixes

  • autoplay: broken custom delay percentages with pause/resume (#8133) (0afecde)
  • core: Don't use data-swiper-slide-index for realIndex when virtual module is enabled (#8142) (bd957f8)
  • core: Escape all CSS selector special characters (d35f41a), closes #8135
  • core: support slidesOffsetBefore and slidesOffsetAfert in cssMode (45b98d0), closes #7926
  • fix lazy preloader removal error in react in vue (332f5c7), closes #8149
  • thumbs: update slide classes on virtual swiper update (#8141) (9752771)
  • types: Add autoScroll to thumbs.update type signature (#8146) (5d91e6e)
  • zoom: initialize gesture state after programmatic zoom (#8112) (71e9511)

Features

  • keyboard: add support for custom speed parameter in keyboard navigation (#8148) (7a4a0e5)
  • new snapToSlideEdge parameter (de3131f), closes #8021 #4780

v12.0.3

Bug Fixes

  • element: fixed reference to nav arrows SVG (0b17ecf), closes #8115

Features

  • core: add 'getRotateFix' export to effect utils (c97ae5d), closes #8114

v12.0.2

Features

  • navigation: add styles for when buttons set before slider (4588c57), closes #8085
  • navigation: new addIcons parameter to add SVG icons to nav buttons (b955b0c), closes #8088 #8087

v12.0.1

Bug Fixes

  • navigation: tweak nav styles when adjacent (98440d9)

v12.0.0

Bug Fixes

... (truncated)

Changelog

Sourced from swiper's changelog.

Changelog

12.1.3 (2026-03-24)

Bug Fixes

  • core: use virtual slides count in onResize when virtual mode is enabled (#8163) (4400083)
  • grid: round down slidesPerView before calculating number of slides (#8172) (49a55ab)

Features

  • element: add navigation button slots (cc82241)

12.1.1 (2026-02-13)

Bug Fixes

  • a11y: fix focus in virtual mode enabled (3055008), closes #8147
  • core: avoid double-subtracting offsets in centerInsufficientSlides (#8158) (60b0052)
  • core: prevent duplicate module initialization in constructor (#8155) (#8156) (07738a2)
  • types: support boolean as a11y value (#8157) (6bf76d5)

12.1.0 (2026-01-28)

Bug Fixes

  • autoplay: broken custom delay percentages with pause/resume (#8133) (0afecde)
  • core: Don't use data-swiper-slide-index for realIndex when virtual module is enabled (#8142) (bd957f8)
  • core: Escape all CSS selector special characters (d35f41a), closes #8135
  • core: support slidesOffsetBefore and slidesOffsetAfert in cssMode (45b98d0), closes #7926
  • fix lazy preloader removal error in react in vue (332f5c7), closes #8149
  • thumbs: update slide classes on virtual swiper update (#8141) (9752771)
  • types: Add autoScroll to thumbs.update type signature (#8146) (5d91e6e)
  • zoom: initialize gesture state after programmatic zoom (#8112) (71e9511)

Features

  • keyboard: add support for custom speed parameter in keyboard navigation (#8148) (7a4a0e5)
  • new snapToSlideEdge parameter (de3131f), closes #8021 #4780

12.0.3 (2025-10-21)

Bug Fixes

  • element: fixed reference to nav arrows SVG (0b17ecf), closes #8115

Features

  • core: add 'getRotateFix' export to effect utils (c97ae5d), closes #8114

... (truncated)

Commits
  • 2fd88b7 12.1.2
  • d3e6633 fix prototype pollution bypass in extend() util
  • 70c48c1 12.1.1
  • 3055008 fix(a11y): fix focus in virtual mode enabled
  • 60b0052 fix(core): avoid double-subtracting offsets in centerInsufficientSlides (#8158)
  • 6bf76d5 fix(types): support boolean as a11y value (#8157)
  • 07738a2 fix(core): prevent duplicate module initialization in constructor (#8155) (#8...
  • 3a1777a 12.1.0
  • 3bc6cfe 12.1.0
  • 45b98d0 fix(core): support slidesOffsetBefore and slidesOffsetAfert in cssMode
  • Additional commits viewable in compare view

Updates axios from 1.12.0 to 1.13.5

Release notes

Sourced from axios's releases.

v1.13.5

Release 1.13.5

Highlights

  • Security: Fixed a potential Denial of Service issue involving the __proto__ key in mergeConfig. (PR #7369)
  • Bug fix: Resolved an issue where AxiosError could be missing the status field on and after v1.13.3. (PR #7368)

Changes

Security

  • Fix Denial of Service via __proto__ key in mergeConfig. (PR #7369)

Fixes

  • Fix/5657. (PR #7313)
  • Ensure status is present in AxiosError on and after v1.13.3. (PR #7368)

Features / Improvements

  • Add input validation to isAbsoluteURL. (PR #7326)
  • Refactor: bump minor package versions. (PR #7356)

Documentation

  • Clarify object-check comment. (PR #7323)
  • Fix deprecated Buffer constructor usage and README formatting. (PR #7371)

CI / Maintenance

  • Chore: fix issues with YAML. (PR #7355)
  • CI: update workflow YAMLs. (PR #7372)
  • CI: fix run condition. (PR #7373)
  • Dev deps: bump karma-sourcemap-loader from 0.3.8 to 0.4.0. (PR #7360)
  • Chore(release): prepare release 1.13.5. (PR #7379)

New Contributors

Full Changelog: axios/axios@v1.13.4...v1.13.5

v1.13.4

Overview

The release addresses issues discovered in v1.13.3 and includes significant CI/CD improvements.

Full Changelog: v1.13.3...v1.13.4

What's New in v1.13.4

Bug Fixes

  • fix: issues with version 1.13.3 (#7352) (ee90dfc)
    • Fixed issues discovered in v1.13.3 release

... (truncated)

Changelog

Sourced from axios's changelog.

Changelog

1.13.3 (2026-01-20)

Bug Fixes

  • http2: Use port 443 for HTTPS connections by default. (#7256) (d7e6065)
  • interceptor: handle the error in the same interceptor (#6269) (5945e40)
  • main field in package.json should correspond to cjs artifacts (#5756) (7373fbf)
  • package.json: add 'bun' package.json 'exports' condition. Load the Node.js build in Bun instead of the browser build (#5754) (b89217e)
  • silentJSONParsing=false should throw on invalid JSON (#7253) (#7257) (7d19335)
  • turn AxiosError into a native error (#5394) (#5558) (1c6a86d)
  • types: add handlers to AxiosInterceptorManager interface (#5551) (8d1271b)
  • types: restore AxiosError.cause type from unknown to Error (#7327) (d8233d9)
  • unclear error message is thrown when specifying an empty proxy authorization (#6314) (6ef867e)

Features

Reverts

  • Revert "fix: silentJSONParsing=false should throw on invalid JSON (#7253) (#7…" (#7298) (a4230f5), closes #7253 #7 #7298
  • deps: bump peter-evans/create-pull-request from 7 to 8 in the github-actions group (#7334) (2d6ad5e)

Contributors to this release

... (truncated)

Commits
  • 29f7542 chore(release): prepare release 1.13.5 (#7379)
  • 431c3a3 ci: fix run condition (#7373)
  • 9ff3a78 ci: update ymls (#7372)
  • 265b712 docs: fix deprecated Buffer constructor and formatting issues in README (#7371)
  • 475e75a feat: add input validation to isAbsoluteURL (#7326)
  • 28c7215 fix: Denial of Service via proto Key in mergeConfig (#7369)
  • 04cf019 docs: clarify object check comment (#7323)
  • 696fa75 fix: status is missing in AxiosError on and after v1.13.3 (#7368)
  • 569f028 fix: added a option to choose between legacy and the new request/response int...
  • 44b7c9f chore(deps-dev): bump karma-sourcemap-loader (#7360)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for axios since your current version.


Updates qs from 6.14.1 to 6.14.2

Changelog

Sourced from qs's changelog.

6.14.2

  • [Fix] parse: mark overflow objects for indexed notation exceeding arrayLimit (#546)
  • [Fix] arrayLimit means max count, not max index, in combine/merge/parseArrayValue
  • [Fix] parse: throw on arrayLimit exceeded with indexed notation when throwOnLimitExceeded is true (#529)
  • [Fix] parse: enforce arrayLimit on comma-parsed values
  • [Fix] parse: fix error message to reflect arrayLimit as max index; remove extraneous comments (#545)
  • [Robustness] avoid .push, use void
  • [readme] document that addQueryPrefix does not add ? to empty output (#418)
  • [readme] clarify parseArrays and arrayLimit documentation (#543)
  • [readme] replace runkit CI badge with shields.io check-runs badge
  • [meta] fix changelog typo (arrayLength → arrayLimit)
  • [actions] fix rebase workflow permissions
Commits
  • bdcf0c7 v6.14.2
  • 294db90 [readme] document that addQueryPrefix does not add ? to empty output
  • 5c308e5 [readme] clarify parseArrays and arrayLimit documentation
  • 6addf8c [Fix] parse: mark overflow objects for indexed notation exceeding arrayLimit
  • cfc108f [Fix] arrayLimit means max count, not max index, in combine/merge/`pars...
  • febb644 [Fix] parse: throw on arrayLimit exceeded with indexed notation when `thr...
  • f6a7abf [Fix] parse: enforce arrayLimit on comma-parsed values
  • fbc5206 [Fix] parse: fix error message to reflect arrayLimit as max index; remove e...
  • 1b9a8b4 [actions] fix rebase workflow permissions
  • 2a35775 [meta] fix changelog typo (arrayLength → arrayLimit)
  • Additional commits viewable in compare view

Updates axios from 1.12.0 to 1.13.5

Release notes

Sourced from axios's releases.

v1.13.5

Release 1.13.5

Highlights

  • Security: Fixed a potential Denial of Service issue involving the __proto__ key in mergeConfig. (PR #7369)
  • Bug fix: Resolved an issue where AxiosError could be missing the status field on and after v1.13.3. (PR #7368)

Changes

Security

  • Fix Denial of Service via __proto__ key in mergeConfig. (PR #7369)

Fixes

  • Fix/5657. (PR #7313)
  • Ensure status is present in AxiosError on and after v1.13.3. (PR #7368)

Features / Improvements

  • Add input validation to isAbsoluteURL. (PR #7326)
  • Refactor: bump minor package versions. (PR #7356)

Documentation

  • Clarify object-check comment. (PR #7323)
  • Fix deprecated Buffer constructor usage and README formatting. (PR #7371)

CI / Maintenance

  • Chore: fix issues with YAML. (PR #7355)
  • CI: update workflow YAMLs. (PR #7372)
  • CI: fix run condition. (PR #7373)
  • Dev deps: bump karma-sourcemap-loader from 0.3.8 to 0.4.0. (PR #7360)
  • Chore(release): prepare release 1.13.5. (PR #7379)

New Contributors

Full Changelog: axios/axios@v1.13.4...v1.13.5

v1.13.4

Overview

The release addresses issues discovered in v1.13.3 and includes significant CI/CD improvements.

Full Changelog: v1.13.3...v1.13.4

What's New in v1.13.4

Bug Fixes

  • fix: issues with version 1.13.3 (#7352) (ee90dfc)
    • Fixed issues discovered in v1.13.3 release

... (truncated)

Changelog

Sourced from axios's changelog.

Changelog

1.13.3 (2026-01-20)

Bug Fixes

  • http2: Use port 443 for HTTPS connections by default. (#7256) (d7e6065)
  • interceptor: handle the error in the same interceptor (#6269) (5945e40)
  • main field in package.json should correspond to cjs artifacts (#5756) (7373fbf)
  • package.json: add 'bun' package.json 'exports' condition. Load the Node.js build in Bun instead of the browser build (#5754) (b89217e)
  • silentJSONParsing=false should throw on invalid JSON (#7253) (#7257) (7d19335)
  • turn AxiosError into a native error (#5394) (#5558) (1c6a86d)
  • types: add handlers to AxiosInterceptorManager interface (#5551) (8d1271b)
  • types: restore AxiosError.cause type from unknown to Error (#7327) (d8233d9)
  • unclear error message is thrown when specifying an empty proxy authorization (#6314) (6ef867e)

Features

Reverts

  • Revert "fix: silentJSONParsing=false should throw on invalid JSON (#7253) (#7…" (#7298) (a4230f5), closes #7253 #7 #7298
  • deps: bump peter-evans/create-pull-request from 7 to 8 in the github-actions group (#7334) (2d6ad5e)

Contributors to this release

... (truncated)

Commits
  • 29f7542 chore(release): prepare release 1.13.5 (#7379)
  • 431c3a3 ci: fix run condition (#7373)
  • 9ff3a78 ci: update ymls (#7372)
  • 265b712 docs: fix deprecated Buffer constructor and formatting issues in README (#7371)
  • 475e75a feat: add input validation to isAbsoluteURL (#7326)
  • 28c7215 fix: Denial of Service via proto Key in mergeConfig (#7369)
  • 04cf019 docs: clarify object check comment (#7323)
  • 696fa75 fix: status is missing in AxiosError on and after v1.13.3 (#7368)
  • 569f028 fix: added a option to choose between legacy and the new request/response int...

@dependabot
build(deps): bump the npm_and_yarn group across 2 directories with 5 …
eeaa1d5 
…updates

Bumps the npm_and_yarn group with 5 updates in the /web directory:

| Package | From | To |
| --- | --- | --- |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `5.4.21` | `6.4.2` |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.2.4` | `3.3.2` |
| [swiper](https://github.com/nolimits4web/Swiper) | `11.1.12` | `12.1.2` |
| [axios](https://github.com/axios/axios) | `1.12.0` | `1.13.5` |
| [qs](https://github.com/ljharb/qs) | `6.14.1` | `6.14.2` |

Bumps the npm_and_yarn group with 2 updates in the /web/packages/axios directory: [axios](https://github.com/axios/axios) and [qs](https://github.com/ljharb/qs).


Updates `vite` from 5.4.21 to 6.4.2
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v6.4.2/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v6.4.2/packages/vite)

Updates `dompurify` from 3.2.4 to 3.3.2
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.2.4...3.3.2)

Updates `swiper` from 11.1.12 to 12.1.2
- [Release notes](https://github.com/nolimits4web/Swiper/releases)
- [Changelog](https://github.com/nolimits4web/swiper/blob/master/CHANGELOG.md)
- [Commits](nolimits4web/swiper@v11.1.12...v12.1.2)

Updates `axios` from 1.12.0 to 1.13.5
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.12.0...v1.13.5)

Updates `qs` from 6.14.1 to 6.14.2
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.14.1...v6.14.2)

Updates `axios` from 1.12.0 to 1.13.5
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.12.0...v1.13.5)

Updates `qs` from 6.14.1 to 6.14.2
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.14.1...v6.14.2)

---
updated-dependencies:
- dependency-name: vite
  dependency-version: 6.4.2
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: dompurify
  dependency-version: 3.3.2
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: swiper
  dependency-version: 12.1.2
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: axios
  dependency-version: 1.13.5
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.14.2
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: axios
  dependency-version: 1.13.5
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.14.2
  dependency-type: direct:production
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Apr 7, 2026
@vercel
Copy link
Copy Markdown

vercel bot commented Apr 7, 2026 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
jzero-admin Ready Ready Preview, Comment Apr 7, 2026 3:13am

This was referenced Apr 7, 2026
Closed
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants