Skip to content

chore(deps): bump the npm_and_yarn group across 7 directories with 4 updates #200

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Mar 31, 2025

Bumps the npm_and_yarn group with 2 updates in the / directory: vite and jspdf.
Bumps the npm_and_yarn group with 1 update in the /experiments/billable directory: vite.
Bumps the npm_and_yarn group with 2 updates in the /experiments/cutable directory: vite and jspdf.
Bumps the npm_and_yarn group with 2 updates in the /experiments/cutl directory: vite and jspdf.
Bumps the npm_and_yarn group with 1 update in the /experiments/griffon directory: vite.
Bumps the npm_and_yarn group with 1 update in the /experiments/rsc directory: vite.
Bumps the npm_and_yarn group with 1 update in the /experiments/textify directory: vite.

Updates vite from 6.2.0 to 6.2.3

Release notes

Sourced from vite's releases.

v6.2.3

Please refer to CHANGELOG.md for details.

v6.2.2

Please refer to CHANGELOG.md for details.

create-vite@6.2.1

Please refer to CHANGELOG.md for details.

v6.2.1

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

6.2.3 (2025-03-24)

6.2.2 (2025-03-14)

  • fix: await client buildStart on top level buildStart (#19624) (b31faab), closes #19624
  • fix(css): inline css correctly for double quote use strict (#19590) (d0aa833), closes #19590
  • fix(deps): update all non-major dependencies (#19613) (363d691), closes #19613
  • fix(indexHtml): ensure correct URL when querying module graph (#19601) (dc5395a), closes #19601
  • fix(preview): use preview https config, not server (#19633) (98b3160), closes #19633
  • fix(ssr): use optional chaining to prevent "undefined is not an object" happening in `ssrRewriteStac (4309755), closes #19612
  • feat: show friendly error for malformed base (#19616) (2476391), closes #19616
  • feat(worker): show asset filename conflict warning (#19591) (367d968), closes #19591
  • chore: extend commit hash correctly when ambigious with a non-commit object (#19600) (89a6287), closes #19600

6.2.1 (2025-03-07)

Commits
  • 16869d7 release: v6.2.3
  • f234b57 fix: fs raw query with query separators (#19702)
  • b12911e release: v6.2.2
  • 98b3160 fix(preview): use preview https config, not server (#19633)
  • b31faab fix: await client buildStart on top level buildStart (#19624)
  • dc5395a fix(indexHtml): ensure correct URL when querying module graph (#19601)
  • 2476391 feat: show friendly error for malformed base (#19616)
  • 4309755 fix(ssr): use optional chaining to prevent "undefined is not an object" happe...
  • 363d691 fix(deps): update all non-major dependencies (#19613)
  • d0aa833 fix(css): inline css correctly for double quote use strict (#19590)
  • Additional commits viewable in compare view

Updates jspdf from 2.5.2 to 3.0.1

Release notes

Sourced from jspdf's releases.

v3.0.1

This release fixes two security vulnerabilities:

  • Upgrade optional dependency canvg to 3.0.11
  • Fix a ReDoS vulnerability in the addImage method and the methods html and addSvgAsImage, which depend on addImage

v3.0.0

This major release officially drops support for Internet Explorer and fixes a security vulnerability in the html function by updating the optional dependency dompurify to v3.2.4. There are no other breaking changes.

New Contributors

Full Changelog: parallax/jsPDF@v2.5.2...v3.0.0

Commits
  • 57cbe94 3.0.1
  • 7cf6ddf fix: upgrade @​babel/runtime from 7.26.0 to 7.26.7 (#3832)
  • b167c43 improve performance of data url parsing in addimage (#3843)
  • c4b7421 don't use saucelabs in CI to be able to correctly run CI for PRs
  • 6136d4b Upgrade canvg from 3.0.6 to 3.0.11 (#3836)
  • d0c605f 3.0.0
  • 7aa332e fix(sec): remove MSIE support to allow upgrading to vuln-free dompurify v3 ...
  • e2c1818 Bump rollup from 2.21.0 to 2.79.2 (#3826)
  • 5aad456 fix: upgrade @​babel/runtime from 7.25.6 to 7.26.0 (#3822)
  • 637b5d3 Upgrade dompurify to 2.5.6 to 2.5.8 (#3812)
  • Additional commits viewable in compare view

Updates canvg from 3.0.10 to 3.0.11

Release notes

Sourced from canvg's releases.

v3.0.11

Bug Fixes

  • fix prototype pollution vulneralbility
Changelog

Sourced from canvg's changelog.

3.0.11 (2025-03-13)

Bug Fixes

  • fix prototype pollution vulneralbility

[3.0.9] - 2021-10-04

Fixed

[3.0.8] - 2021-07-31

Fixed

[3.0.7] - 2020-10-17

Fixed

[3.0.6] - 2020-03-25

Fixed

[3.0.1] - 2019-12-03

Fixed

[3.0.0] - 2019-10-23

Added

  • OffscreenCanvas support.

Changed

  • JavaScript -> TypeScript.

Fixed

... (truncated)

Commits

Updates dompurify from 2.5.8 to 3.2.4

Release notes

Sourced from dompurify's releases.

DOMPurify 3.2.4

  • Fixed a conditional and config dependent mXSS-style bypass reported by @​nsysean
  • Added a new feature to allow specific hook removal, thanks @​davecardwell
  • Added purify.js and purify.min.js to exports, thanks @​Aetherinox
  • Added better logic in case no window object is president, thanks @​yehuya
  • Updated some dependencies called out by dependabot
  • Updated license files etc to show the correct year

DOMPurify 3.2.3

DOMPurify 3.2.2

  • Fixed a possible bypass in case a rather specific config for custom elements is set, thanks @​yaniv-git
  • Fixed several minor issues with the type definitions, thanks again @​reduckted
  • Fixed a minor issue with the types reference for trusted types, thanks @​reduckted
  • Fixed a minor problem with the template detection regex on some systems, thanks @​svdb99

DOMPurify 3.2.1

DOMPurify 3.2.0

DOMPurify 3.1.7

  • Fixed an issue with comment detection and possible bypasses with specific config settings, thanks @​masatokinugawa
  • Fixed several smaller typos in documentation and test & build files, thanks @​christianhg
  • Added better support for Angular compiler, thanks @​jeroen1602
  • Added several new attributes to HTML and SVG allow-list, thanks @​Gigabyte5671 and @​Rotzbua
  • Removed the foreignObject element from the list of HTML entry-points, thanks @​masatokinugawa
  • Bumped several dependencies to be more up to date

DOMPurify 3.1.6

  • Fixed an issue with the execution logic of attribute hooks to prevent bypasses, thanks @​kevin-mizu
  • Fixed an issue with element removal leading to uncaught errors through DOM Clobbering, thanks @​realansgar
  • Fixed a minor problem with the bower file pointing to the wrong dist path
  • Fixed several minor typos in docs, comments and comment blocks, thanks @​Rotzbua
  • Updated several development dependencies

DOMPurify 3.1.5

  • Fixed a minor issue with the dist paths in bower.js, thanks @​HakumenNC
  • Fixed a minor issue with sanitizing HTML coming from copy&paste Word content, thanks @​kakao-bishop-cho

DOMPurify 3.1.4

  • Fixed an issue with the recently implemented isNaN checks, thanks @​tulach
  • Added several new popover attributes to allow-list, thanks @​Gigabyte5671
  • Fixed the tests and adjusted the test runner to cover all branches

... (truncated)

Commits
  • ec29e65 Merge pull request #1062 from cure53/main
  • 1c1b183 chore: Preparing 3.2.4 release
  • d18ffcb fix: Changed the template literal regex to avoid a config-dependent bypass
  • 0d64d2b Merge pull request #1060 from yehuya/initializeTestImprovements
  • 9ad7933 tests: DOMPurify custom window tests improvements
  • 72760ca Merge pull request #1059 from yehuya/fixMissingWindowElement
  • bc72d44 Fix tests
  • 363a89d fix: handle undefined Element in DOMPurify initialization
  • f41b45d Update LICENSE
  • b25bf26 Update README.md
  • Additional commits viewable in compare view

Updates vite from 6.0.11 to 6.0.12

Release notes

Sourced from vite's releases.

v6.2.3

Please refer to CHANGELOG.md for details.

v6.2.2

Please refer to CHANGELOG.md for details.

create-vite@6.2.1

Please refer to CHANGELOG.md for details.

v6.2.1

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

6.2.3 (2025-03-24)

6.2.2 (2025-03-14)

  • fix: await client buildStart on top level buildStart (#19624) (b31faab), closes #19624
  • fix(css): inline css correctly for double quote use strict (#19590) (d0aa833), closes #19590
  • fix(deps): update all non-major dependencies (#19613) (363d691), closes #19613
  • fix(indexHtml): ensure correct URL when querying module graph (#19601) (dc5395a), closes #19601
  • fix(preview): use preview https config, not server (#19633) (98b3160), closes #19633
  • fix(ssr): use optional chaining to prevent "undefined is not an object" happening in `ssrRewriteStac (4309755), closes #19612
  • feat: show friendly error for malformed base (#19616) (2476391), closes #19616
  • feat(worker): show asset filename conflict warning (#19591) (367d968), closes #19591
  • chore: extend commit hash correctly when ambigious with a non-commit object (#19600) (89a6287), closes #19600

6.2.1 (2025-03-07)

Commits
  • 16869d7 release: v6.2.3
  • f234b57 fix: fs raw query with query separators (#19702)
  • b12911e release: v6.2.2
  • 98b3160 fix(preview): use preview https config, not server (#19633)
  • b31faab fix: await client buildStart on top level buildStart (#19624)
  • dc5395a fix(indexHtml): ensure correct URL when querying module graph (#19601)
  • 2476391 feat: show friendly error for malformed base (#19616)
  • 4309755 fix(ssr): use optional chaining to prevent "undefined is not an object" happe...
  • 363d691 fix(deps): update all non-major dependencies (#19613)
  • d0aa833 fix(css): inline css correctly for double quote use strict (#19590)
  • Additional commits viewable in compare view

Updates vite from 6.2.0 to 6.2.3

Release notes

Sourced from vite's releases.

v6.2.3

Please refer to CHANGELOG.md for details.

v6.2.2

Please refer to CHANGELOG.md for details.

create-vite@6.2.1

Please refer to CHANGELOG.md for details.

v6.2.1

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

6.2.3 (2025-03-24)

6.2.2 (2025-03-14)

  • fix: await client buildStart on top level buildStart (#19624) (b31faab), closes #19624
  • fix(css): inline css correctly for double quote use strict (#19590) (d0aa833), closes #19590
  • fix(deps): update all non-major dependencies (#19613) (363d691), closes #19613
  • fix(indexHtml): ensure correct URL when querying module graph (#19601) (dc5395a), closes #19601
  • fix(preview): use preview https config, not server (#19633) (98b3160), closes #19633
  • fix(ssr): use optional chaining to prevent "undefined is not an object" happening in `ssrRewriteStac (4309755), closes #19612
  • feat: show friendly error for malformed base (#19616) (2476391), closes #19616
  • feat(worker): show asset filename conflict warning (#19591) (367d968), closes #19591
  • chore: extend commit hash correctly when ambigious with a non-commit object (#19600) (89a6287), closes #19600

6.2.1 (2025-03-07)

Commits
  • 16869d7 release: v6.2.3
  • f234b57 fix: fs raw query with query separators (#19702)
  • b12911e release: v6.2.2
  • 98b3160 fix(preview): use preview https config, not server (#19633)
  • b31faab fix: await client buildStart on top level buildStart (#19624)
  • dc5395a fix(indexHtml): ensure correct URL when querying module graph (#19601)
  • 2476391 feat: show friendly error for malformed base (#19616)
  • 4309755 fix(ssr): use optional chaining to prevent "undefined is not an object" happe...
  • 363d691 fix(deps): update all non-major dependencies (#19613)
  • d0aa833 fix(css): inline css correctly for double quote use strict (#19590)
  • Additional commits viewable in compare view

Updates jspdf from 2.5.2 to 3.0.1

Release notes

Sourced from jspdf's releases.

v3.0.1

This release fixes two security vulnerabilities:

  • Upgrade optional dependency canvg to 3.0.11
  • Fix a ReDoS vulnerability in the addImage method and the methods html and addSvgAsImage, which depend on addImage

v3.0.0

This major release officially drops support for Internet Explorer and fixes a security vulnerability in the html function by updating the optional dependency dompurify to v3.2.4. There are no other breaking changes.

New Contributors

Full Changelog: parallax/jsPDF@v2.5.2...v3.0.0

Commits
  • 57cbe94 3.0.1
  • 7cf6ddf fix: upgrade @​babel/runtime from 7.26.0 to 7.26.7 (#3832)
  • b167c43 improve performance of data url parsing in addimage (#3843)
  • c4b7421 don't use saucelabs in CI to be able to correctly run CI for PRs
  • 6136d4b Upgrade canvg from 3.0.6 to 3.0.11 (#3836)
  • d0c605f 3.0.0
  • 7aa332e fix(sec): remove MSIE support to allow upgrading to vuln-free dompurify v3 ...
  • e2c1818 Bump rollup from 2.21.0 to 2.79.2 (#3826)
  • 5aad456 fix: upgrade @​babel/runtime from 7.25.6 to 7.26.0 (#3822)
  • 637b5d3 Upgrade dompurify to 2.5.6 to 2.5.8 (#3812)
  • Additional commits viewable in compare view

Updates vite from 6.2.0 to 6.2.3

Release notes

Sourced from vite's releases.

v6.2.3

Please refer to CHANGELOG.md for details.

v6.2.2

Please refer to CHANGELOG.md for details.

create-vite@6.2.1

Please refer to CHANGELOG.md for details.

v6.2.1

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

6.2.3 (2025-03-24)

6.2.2 (2025-03-14)

  • fix: await client buildStart on top level buildStart (#19624) (b31faab), closes #19624
  • fix(css): inline css correctly for double quote use strict (#19590) (d0aa833), closes #19590
  • fix(deps): update all non-major dependencies (#19613) (363d691), closes #19613
  • fix(indexHtml): ensure correct URL when querying module graph (#19601) (dc5395a), closes #19601
  • fix(preview): use preview https config, not server (#19633) (98b3160), closes #19633
  • fix(ssr): use optional chaining to prevent "undefined is not an object" happening in `ssrRewriteStac (4309755), closes #19612
  • feat: show friendly error for malformed base (#19616) (2476391), closes #19616
  • feat(worker): show asset filename conflict warning (#19591) (367d968), closes #19591
  • chore: extend commit hash correctly when ambigious with a non-commit object (#19600) (89a6287), closes #19600

6.2.1 (2025-03-07)

…updates

Bumps the npm_and_yarn group with 2 updates in the / directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) and [jspdf](https://github.com/MrRio/jsPDF).
Bumps the npm_and_yarn group with 1 update in the /experiments/billable directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite).
Bumps the npm_and_yarn group with 2 updates in the /experiments/cutable directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) and [jspdf](https://github.com/MrRio/jsPDF).
Bumps the npm_and_yarn group with 2 updates in the /experiments/cutl directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) and [jspdf](https://github.com/MrRio/jsPDF).
Bumps the npm_and_yarn group with 1 update in the /experiments/griffon directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite).
Bumps the npm_and_yarn group with 1 update in the /experiments/rsc directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite).
Bumps the npm_and_yarn group with 1 update in the /experiments/textify directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite).


Updates `vite` from 6.2.0 to 6.2.3
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v6.2.3/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v6.2.3/packages/vite)

Updates `jspdf` from 2.5.2 to 3.0.1
- [Release notes](https://github.com/MrRio/jsPDF/releases)
- [Changelog](https://github.com/parallax/jsPDF/blob/master/RELEASE.md)
- [Commits](parallax/jsPDF@v2.5.2...v3.0.1)

Updates `canvg` from 3.0.10 to 3.0.11
- [Release notes](https://github.com/canvg/canvg/releases)
- [Changelog](https://github.com/canvg/canvg/blob/v3.0.11/CHANGELOG.md)
- [Commits](https://github.com/canvg/canvg/commits/v3.0.11)

Updates `dompurify` from 2.5.8 to 3.2.4
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@2.5.8...3.2.4)

Updates `vite` from 6.0.11 to 6.0.12
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v6.2.3/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v6.2.3/packages/vite)

Updates `vite` from 6.2.0 to 6.2.3
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v6.2.3/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v6.2.3/packages/vite)

Updates `jspdf` from 2.5.2 to 3.0.1
- [Release notes](https://github.com/MrRio/jsPDF/releases)
- [Changelog](https://github.com/parallax/jsPDF/blob/master/RELEASE.md)
- [Commits](parallax/jsPDF@v2.5.2...v3.0.1)

Updates `vite` from 6.2.0 to 6.2.3
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v6.2.3/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v6.2.3/packages/vite)

Updates `jspdf` from 2.5.2 to 3.0.1
- [Release notes](https://github.com/MrRio/jsPDF/releases)
- [Changelog](https://github.com/parallax/jsPDF/blob/master/RELEASE.md)
- [Commits](parallax/jsPDF@v2.5.2...v3.0.1)

Updates `vite` from 6.0.11 to 6.0.12
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v6.2.3/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v6.2.3/packages/vite)

Updates `vite` from 6.0.0 to 6.0.12
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v6.2.3/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v6.2.3/packages/vite)

Updates `vite` from 6.0.0 to 6.0.12
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v6.2.3/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v6.2.3/packages/vite)

---
updated-dependencies:
- dependency-name: vite
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: jspdf
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: canvg
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: dompurify
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: jspdf
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: jspdf
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-type: direct:development
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 31, 2025
Copy link

cloudflare-workers-and-pages bot commented Mar 31, 2025

Deploying redwood-sdk-docs with  Cloudflare Pages  Cloudflare Pages

Latest commit: 621d8b5
Status:🚫  Build failed.

View logs

@peterp peterp closed this Mar 31, 2025
Copy link
Contributor Author

dependabot bot commented on behalf of github Mar 31, 2025

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot dependabot bot deleted the dependabot/npm_and_yarn/npm_and_yarn-7002a73056 branch March 31, 2025 10:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant