chore(deps): bump the npm-security group across 1 directory with 17 updates by dependabot[bot] · Pull Request #145 · brainstormforce/sureforms-public

dependabot · 2026-10-15T09:55:47Z

Bumps the npm-security group with 17 updates in the / directory:

Package	From	To
dompurify	`3.3.3`	`3.4.16`
postcss	`8.5.3`	`8.5.23`
react-router-dom	`6.30.3`	`6.30.6`
brace-expansion	`1.1.11`	`1.1.21`
js-yaml	`3.14.1`	`3.14.2`
extract-zip	`1.7.0`	`removed`
browserslist	`4.24.5`	`4.29.3`
colord	`2.9.3`	`2.10.0`
compression	`1.8.0`	`1.8.2`
fast-uri	`3.0.6`	`3.1.8`
http-cache-semantics	`4.2.0`	`4.3.0`
markdown-it	`12.3.2`	`14.3.2`
moment	`2.30.1`	`2.31.0`
nanoid	`5.1.5`	`5.1.16`
nanoid	`3.3.11`	`3.3.20`
proxy-addr	`2.0.7`	`2.0.8`
svgo	`3.3.2`	`3.3.5`
webpack-dev-middleware	`5.3.4`	`7.4.6`

Updates dompurify from 3.3.3 to 3.4.16

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.16

Fixed a problem with IN_PLACE node removal when working with hooks, thanks @manus-pi

Fixed a problem with IN_PLACE sanitization and raw-text roots, thanks @h-t-m

Fixed a problem with ESM default exports landing in CommonJS declarations, thanks @ssi02014

Migrated from rollup to rolldown because performance, thanks @ssi02014

Bumped several dependencies where possible

DOMPurify 3.4.15

Added better clobbering hardening when XML content is involved, thanks @gnyselcuk

Added several smaller hardening and edge-case improvements, thanks @leechristensen

Bumped several dependencies where possible

DOMPurify 3.4.14

Fixed an issue with possible bypasses when risky tags are allow-listed, thanks @AlirezaRouhbakhsh

Fixed a couple of edge cases with mixed document contexts, thanks @fishjojo1

Added the SVG pointer-events and vector-effect presentation attributes to the allow-list, thanks @Jaybhade

Conducted another refactoring run, removed dead branches and duplicated logic, flattened attribute validation

Updated the documentation in several spots, README, wiki, etc., thanks @Akokonunes

Updated several development dependencies and CI workflow actions

DOMPurify 3.4.13

Fixed an issue with hook removal during IN_PLACE sanitization, thanks @koyokr

Fixed an issue with hooks potentially bypassing the clone guard, thanks @AkshayjainG

Fixed an issue with DOM clobbering via ownerDocument during IN_PLACE, thanks @AkshayjainG

Bumped several dependencies where possible

DOMPurify 3.4.12

Fixed an issue where a hook would not get called for custom elements, thanks @Rikuxx0

Hardened the handling of hooks removing elements, @mkrause-bee360

Added support for a few new SVG attributes, thanks @cbn-falias & @Develop-KIM

Hardened the handling of declarative partial updates

Updated the documentation is several spots, README, wiki, etc.

Bumped several dependencies where possible

DOMPurify 3.4.11

Fixed an issue with a leaky config for hooks via setConfig, thanks @trace37labs

Bumped vulnerable development dependencies to arrive at plain 0 with npm audit

Updated the osv-scanner suppression list as no vulnerable dependencies are left for now

Updated up the linting tool-chain and removed now-redundant lint directives

Updated the documentation is several spots, README, wiki, etc.

Bumped several dependencies where possible

DOMPurify 3.4.10

Refactored codebase for clarity: extracted the public type declarations into types.ts

Decomposed the three largest sanitizer functions into focused helpers

Removed duplicated defaults and dead branches, consolidated SAFE_FOR_TEMPLATES scrubbing into single shared path

Improved per-node performance by hoisting the mXSS probe regexes and testing textContent before innerHTML

Added a deterministic micro-benchmark harness (npm run bench) with a --compare mode

Reduced CI cost by running the full three-engine browser suite once per PR

Refreshed the demos/ folder so every demo runs again, and added a SVG-via-<img> demo

... (truncated)

Commits

b9b9d80 release: 3.4.16 (#1636)
1d7460c release: 3.4.15 (#1609)
4e6fe24 release: 3.4.14 (#1587)
3067f77 release: 3.4.13 (#1562)
a9ca1e5 release: 3.4.12 (#1537)
0cae518 release: 3.4.11 (#1494)
6ee5716 release: 3.4.10 (#1478)
5210247 release: 3.4.9 (#1459)
bcdd828 release: 3.4.8 (#1439)
ca30f07 release: 3.4.7 (#1414)
Additional commits viewable in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates postcss from 8.5.3 to 8.5.23

Release notes

Sourced from postcss's releases.

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

Fixed declaration parsing performance (by @homanp).

8.5.14

Fixed custom syntax regression (by @43081j).

8.5.13

Fixed postcss-scss commend regression.

8.5.12

Fixed reading any file via user-generated CSS.

Added opts.unsafeMap to disable checks.

8.5.11

Fixed nested brackets parsing performance (by @offset).

8.5.10

Fixed XSS via unescaped </style> in non-bundler cases (by @TharVid).

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.30

Fix broken map on </style> escaping (by @Rufflet).

8.5.29

Improved </style> escaping (by @choudhryfrompak).

Fixed comments support in list.comma() and list.space() (by @00200200).

Fixed semicolon and custom property (by @wahidrizka).

8.5.28

Fixes types regression.

8.5.27

Fixed removing any comments starting with /*# (by @dylanpulver).

Fixed * hack before a comment in Custom Properties (by @Jaybhade).

Fixed empty values in the middle of list.comma() (by @MahinAnowar).

Fixed whitespace-only values in list.space() (by @MahinAnowar).

Fixed rule’s end position on space before semicolon (by @maximilliangrand).

Fixed types (by @romainmenke).

Fixed Chinese text in deprecation warning (by @Jesse205).

8.5.26

Fixed list.split() regression (by @lazerg).

Track symlinks in path protection in source map loading (by @drengir1).

8.5.25

Fixed 8.5.17 visitor regression.

Fixed list.split() for non-string values (by @amir-rezaei).

8.5.24

Preserve the BOM after the processing (by @hdimer).

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

... (truncated)

Commits

eb9e1fe Release 8.5.23 version
9d19c78 Update dependencies
7beca13 Does no load source map file without opts.from
decea51 Typo
c18e30d Update EM banner
98a39ad Update EM banner
a3e48c4 Release 8.5.22 version
f49d691 Fix custom property losing its semicolon before a comment (#2117)
28e0daf Release 8.5.21 version
3d2b4e4 Update dependencies
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates react-router-dom from 6.30.3 to 6.30.6

Changelog

Sourced from react-router-dom's changelog.

v6.30.6

Patch Changes

Updated dependencies:

react-router@6.30.6

@remix-run/router@1.23.4

v6.30.5

Patch Changes

Updated dependencies:

react-router@6.30.5

v6.30.4

Patch Changes

Updated dependencies:

react-router@6.30.4

@remix-run/router@1.23.3

Commits

dead496 Release v6.30.6 (#15412)
acf8eb5 Release v6.30.5 (#15411)
651211c Release v6.30.4 (#15120)
f82a6f9 Bring new release process into v6 branch (#15115)
See full diff in compare view

Updates brace-expansion from 1.1.11 to 1.1.21

Release notes

Sourced from brace-expansion's releases.

v1.1.15

Backport v5.0.6 change to v1 (#111) 0b09384

juliangruber/brace-expansion@v1.1.14...v1.1.15

v1.1.12

pkg: publish on tag 1.x c460dbd

fmt ccb8ac6

Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) c3c73c8

juliangruber/brace-expansion@v1.1.11...v1.1.12

Commits

8e81e18 1.1.21
ffdfa3e Merge commit from fork
c6513ad 1.1.20
1efee7c Merge commit from fork
a34340a 1.1.19
0bcbfc0 Merge commit from fork
758fcd6 1.1.18
27fbeed Merge commit from fork
5c57cc2 1.1.17
d757f1d npm ignore .claude
Additional commits viewable in compare view

Updates js-yaml from 3.14.1 to 3.14.2

Changelog

Sourced from js-yaml's changelog.

[3.14.2] - 2025-11-15

Security

Backported v4.1.1 fix to v3

[4.1.1] - 2025-11-12

Security

Fix prototype pollution issue in yaml merge (<<) operator.

[4.1.0] - 2021-04-15

Added

Types are now exported as yaml.types.XXX.

Every type now has options property with original arguments kept as they were (see yaml.types.int.options as an example).

Changed

Schema.extend() now keeps old type order in case of conflicts (e.g. Schema.extend([ a, b, c ]).extend([ b, a, d ]) is now ordered as abcd instead of cbad).

[4.0.0] - 2021-01-03

Changed

Check migration guide for details of all breaking changes.

Breaking: "unsafe" tags !!js/function, !!js/regexp, !!js/undefined are moved to js-yaml-js-types package.

Breaking: removed safe* functions. Use load, loadAll, dump instead which are all now safe by default.

yaml.DEFAULT_SAFE_SCHEMA and yaml.DEFAULT_FULL_SCHEMA are removed, use yaml.DEFAULT_SCHEMA instead.

yaml.Schema.create(schema, tags) is removed, use schema.extend(tags) instead.

!!binary now always mapped to Uint8Array on load.

Reduced nesting of /lib folder.

Parse numbers according to YAML 1.2 instead of YAML 1.1 (01234 is now decimal, 0o1234 is octal, 1:23 is parsed as string instead of base60).

dump() no longer quotes :, [, ], (, ) except when necessary, #470, #557.

Line and column in exceptions are now formatted as (X:Y) instead of at line X, column Y (also present in compact format), #332.

Code snippet created in exceptions now contains multiple lines with line numbers.

dump() now serializes undefined as null in collections and removes keys with undefined in mappings, #571.

Custom tags starting with ! are now dumped as !tag instead of !<!tag>, #576.

Custom tags starting with tag:yaml.org,2002: are now shorthanded using !!, #258.

Added

Added .mjs (es modules) support.

Added quotingType and forceQuotes options for dumper to configure string literal style, #290, #529.

Added styles: { '!!null': 'empty' } option for dumper (serializes { foo: null } as "foo: "), #570.

... (truncated)

Commits

9963d36 3.14.2 released
10d3c8e dist rebuild
5278870 fix prototype pollution in merge (<<) (#731)
See full diff in compare view

Removes extract-zip

Updates browserslist from 4.24.5 to 4.29.3

Release notes

Sourced from browserslist's releases.

4.29.3

Updated Firefox ESR.

4.29.2

Fixed ignoring null usage in cover X in Y query (by @wahidrizka).

4.29.1

Fixed config name loading protection on Windows (by @oss-security-shop).

Fixed case-insensitive negation queries (by @jakezwang).

Fixed percentage and supports queries case-insensitive (by @wahidrizka).

Fixed old Node.js tests (by @aaron-belenky).

Reduced code (by @charmander).

4.29.0

Added query continuations across lines and array entries (by @fzlzjerry).

4.28.9

Improve or parsing performance (by @NotAFlightRisk).

4.28.8

Fixed including kaios in baseline queries (by @Jaybhade).

4.28.7

Improved parsing performance.

Fixed unbounded memory growth (by @alanturing881).

Fixed prototype write issue (by @alanturing881).

4.28.6

Fixed Electron version queries (by @spokodev).

4.28.5

Fixed > and >= queries (by @spokodev).

4.28.4

Fixed SyntaxError regression of 4.28.3.

4.28.3

Fixed baseline query case-insensitivity (by @swwind).

4.28.2

Fix prototype pollution (by @chluo1997).

4.28.1

Removed Baseline warning since we have it own warning.

4.27.0

Added BROWSERSLIST_TRACE_WARNING environment variable.

4.26.3

Fixed throwOnMissing with extends query (by @alexander-akait).

... (truncated)

Changelog

Sourced from browserslist's changelog.

4.29.3

Updated Firefox ESR.

4.29.2

Fixed ignoring null usage in cover X in Y query (by @wahidrizka).

4.29.1

Fixed config name loading protection on Windows (by @oss-security-shop).

Fixed case-insensitive negation queries (by @jakezwang).

Fixed percentage and supports queries case-insensitive (by @wahidrizka).

Fixed old Node.js tests (by @aaron-belenky).

Reduced code (by @charmander).

4.29.0

Added query continuations across lines and array entries (by @fzlzjerry).

4.28.9

Improved or parsing performance (by @NotAFlightRisk).

4.28.8

Fixed including kaios in baseline queries (by @Jaybhade).

4.28.7

Improved parsing performance.

Fixed unbounded memory growth (by @alanturing881).

Fixed prototype write issue (by @alanturing881).

4.28.6

Fixed Electron version queries (by @spokodev).

4.28.5

Fixed > and >= queries (by @spokodev).

4.28.4

Fixed SyntaxError regression of 4.28.3.

4.28.3

Fixed baseline query case-insensitivity (by @swwind).

... (truncated)

Commits

b4809dd Release 4.29.3 version
9d844f8 Update Firefox ESR
0033f34 Update dependencies
906d329 Release 4.29.2 version
ff8c83f Update dependencies
067f4a1 Merge pull request #952 from wahidrizka/fix-cover-null-usage
f760921 Do not add versions without usage data to cover queries
5be63f5 Merge pull request #953 from wahidrizka/docs-android-latest-version
1e5356f Note that Android version queries return only the latest version
5b7e941 Add missed changes to ChangeLog
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for browserslist since your current version.

Updates colord from 2.9.3 to 2.10.0

Release notes

Sourced from colord's releases.

v2.10 (RGB color mixing)

mix, tints, shades and tones (mix plugin) now accept an optional interpolation color space. LAB stays the default; pass "rgb" to interpolate RGB channels instead — the way browsers and design tools (such as Figma) composite translucent layers.
import { colord, extend } from "colord";
import mixPlugin from "colord/plugins/mix";
extend([mixPlugin]);
colord("#ff0000").mix("#ffffff", 0.5, "rgb").toHex(); // "#ff8080"
colord("#f0f3f1").mix("#007d40", 0.14, "rgb").toHex(); // "#cee2d8" — same as compositing rgba(0, 125, 64, 0.14) over #f0f3f1
colord("#ff0000").tints(3, "rgb").map((c) => c.toHex()); // ["#ff0000", "#ff8080", "#ffffff"]

Changelog

Sourced from colord's changelog.

2.10.0

Improve mix plugin by adding an optional "rgb" interpolation mode to mix, tints, tones and shades

2.9.7

Make HEX parsing and serialization more than 2x faster

2.9.6

Fix: Rotate the unrounded hue so rotate and harmonies preserve the original color

Fix: Normalize HWB whiteness + blackness over 100% to gray ❤️ @spokodev

2.9.5

Fix: Use adjusted chroma for the CIEDE2000 rotation term ❤️ @maximilliangrand

Fix: Keep the hue within [0, 360) in every color model ❤️ @sarathfrancis90

Both fixes change returned numbers for a small set of colors; toHex() output is unchanged. Snapshots holding h: 360, "hsl(360, …)" or a delta() value may need updating.

2.9.4

Fix: Reject malformed color strings in linear time ❤️ @GAP-dev

Commits

See full diff in compare view

Updates compression from 1.8.0 to 1.8.2

Release notes

Sourced from compression's releases.

v1.8.2

Important

Fix CVE-2026-87776 (GHSA-vc2v-76pw-4v95)

What's Changed

chore: add funding to package.json by @bjohansebas in expressjs/compression#248

build(deps): bump github/codeql-action from 3.29.2 to 3.29.5 by @dependabot[bot] in expressjs/compression#249

build(deps): bump actions/checkout from 4.2.2 to 5.0.0 by @dependabot[bot] in expressjs/compression#253

build(deps): bump github/codeql-action from 3.29.7 to 3.29.11 by @dependabot[bot] in expressjs/compression#252

build(deps): bump actions/download-artifact from 4.3.0 to 5.0.0 by @dependabot[bot] in expressjs/compression#251

build(deps): bump actions/setup-node from 4.4.0 to 6.0.0 by @dependabot[bot] in expressjs/compression#261

build(deps): bump github/codeql-action from 3.29.11 to 4.31.2 by @dependabot[bot] in expressjs/compression#260

build(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 by @dependabot[bot] in expressjs/compression#259

build(deps): bump actions/download-artifact from 5.0.0 to 6.0.0 by @dependabot[bot] in expressjs/compression#258

build(deps): bump coverallsapp/github-action from 2.3.6 to 2.3.7 by @dependabot[bot] in expressjs/compression#264

build(deps): bump actions/checkout from 5.0.0 to 6.0.0 by @dependabot[bot] in expressjs/compression#263

build(deps): bump github/codeql-action from 4.31.2 to 4.31.5 by @dependabot[bot] in expressjs/compression#262

chore: up node version to 25.x in CI by @imangas in expressjs/compression#272

doc(package): remove history.md and add readme.md to published files by @sheplu in expressjs/compression#270

Update link to CONTRIBUTING.md by @krzysdz in expressjs/compression#281

test: run CI on Windows and macOS by @kilisamemarisaaa in expressjs/compression#283

build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 by @dependabot[bot] in expressjs/compression#257

build(deps): bump actions/download-artifact from 6.0.0 to 7.0.0 by @dependabot[bot] in expressjs/compression#268

build(deps): bump github/codeql-action from 4.31.5 to 4.31.9 by @dependabot[bot] in expressjs/compression#265

build(deps): bump actions/setup-node from 6.0.0 to 6.1.0 by @dependabot[bot] in expressjs/compression#266

build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 by @dependabot[bot] in expressjs/compression#267

chore(ci): npm-publish via reusable workflows by @sheplu in expressjs/compression#269

docs: update outdated Brotli note and fix npm install docs URL by @Vansh1811 in expressjs/compression#276

fix: match Cache-Control no-transform directive case-insensitively by @vaibhavmashal in expressjs/compression#286

1.8.2 by @UlisesGascon in expressjs/compression#287

New Contributors

@imangas made their first contribution in expressjs/compression#272

@sheplu made their first contribution in expressjs/compression#270

@krzysdz made their first contribution in expressjs/compression#281

@kilisamemarisaaa made their first contribution in expressjs/compression#283

@Vansh1811 made their first contribution in expressjs/compression#276

@vaibhavmashal made their first contribution in expressjs/compression#286

Full Changelog: expressjs/compression@v1.8.1...v1.8.2

v1.8.1

What's Changed

fix(docs): update multiple links from http to https by @Phillip9587 in expressjs/compression#222

ci: add dependabot for github actions by @bjohansebas in expressjs/compression#207

build(deps): bump github/codeql-action from 2.23.2 to 3.28.15 by @dependabot[bot] in expressjs/compression#228

build(deps): bump ossf/scorecard-action from 2.3.1 to 2.4.1 by @dependabot[bot] in expressjs/compression#229

build(deps-dev): bump eslint-plugin-import from 2.26.0 to 2.31.0 by @dependabot[bot] in expressjs/compression#230

build(deps-dev): bump supertest from 6.2.3 to 6.3.4 by @dependabot[bot] in expressjs/compression#231

... (truncated)

Changelog

Sourced from compression's changelog.

1.8.2

Fix CVE-2026-87776 (GHSA-vc2v-76pw-4v95)

deps: add destroy@1.2.0

Match Cache-Control: no-transform directive case-insensitively

1.8.1

deps: on-headers@~1.1.0

Fix CVE-2025-7339 (GHSA-76c9-3jph-rj3q)

Commits

0f97074 1.8.2 (#287)
151f63e fix: destroy compression stream on response close
0a76495 fix: match Cache-Control no-transform directive case-insensitively (#286)
c17b6e5 docs: update outdated Brotli note and fix npm install docs URL (#276)
112911a chore(ci): npm-publish via reusable workflows (#269)
1bf5eb0 build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 (#267)
d8fe64d build(deps): bump actions/setup-node from 6.0.0 to 6.1.0 (#266)
b218ff5 build(deps): bump github/codeql-action from 4.31.5 to 4.31.9 (#265)
8a1cf8e build(deps): bump actions/download-artifact from 6.0.0 to 7.0.0 (#268)
4a19855 build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 (#257)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for compression since your current version.

Updates fast-uri from 3.0.6 to 3.1.8

Release notes

Sourced from fast-uri's releases.

v3.1.8

⚠️ Security Warning

This security release fixes the following medium-severity security advisory:

GHSA-hrr3-gc8f-f4qj — inconsistent host case normalization via percent-encoded octets

Users of the v3.x release line should upgrade to v3.1.8.

Full Changelog: fastify/fast-uri@v3.1.7...v3.1.8

v3.1.7

⚠️ Security Warning

This is a security release that fixes the following high-severity security advisories:

GHSA-qw65-cvwx-89v3 — authority injection via an unvalidated port in serialize()

GHSA-58mr-gqgx-xq4g — host confusion via unbalanced or misplaced IP-literal brackets

Users of the v3.x release line should upgrade to v3.1.7.

Full Changelog: fastify/fast-uri@v3.1.6...v3.1.7

v3.1.6

⚠️ Security Warning

This release addresses the following high-severity security advisories:

GHSA-5jgf-p345-68v8 — host confusion via skipped IDN canonicalization on scheme-relative references

GHSA-fph4-wmhf-6fwf — server-side request forgery via repeated hostname percent-decoding

GHSA-f65p-4m7j-42xc — server-side request forgery via malformed IPv6 normalization

GHSA-jqff-g426-hqxp — host confusion via percent-encoded scheme normalization

Users of the v3.x release line should upgrade to v3.1.6.

Full Changelog: fastify/fast-uri@v3.1.5...v3.1.6

v3.1.5

⚠️ Security Warning

Fix for GHSA-7p8r-x3mc-p8w7

Full Changelog: fastify/fast-uri@v3.1.4...v3.1.5

v3.1.4

⚠️ Security Release

Fix for GHSA-v2hh-gcrm-f6hx

Full Changelog: fastify/fast-uri@v3.1.3...v3.1.4

... (truncated)

Commits

ead3ab7 Bumped v3.1.8
c88b59e fix: normalize decoded reg-name case
412e40a Bumped v3.1.7
9f4c943 fix: backport port and IP-literal validation to v3.x (#216)
1eb3ce4 fix: treat unterminated bracket hosts as reg-names again (#214)
6f970b2 Bumped v3.1.6
d941579 fix: never run IDN canonicalization on bracketed IP literals
c0f0279 test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)
37f3417 Merge commit from fork
607bfbe Merge commit from fork
Additional commits viewable in compare view

Updates http-cache-semantics from 4.2.0 to 4.3.0

Commits

See full diff in compare view

Updates markdown-it from 12.3.2 to 14.3.2

Changelog

Sourced from markdown-it's changelog.

[14.3.2] - 2026-09-12

Security

Backported 15.0.2 fixes.

[14.3.1] - 2026-08-27

Security

Backported 15.0.1 fixes.

[14.3.0] - 2026-07-02

Changed

Reworked build pipeline & tools.

Added source maps.

Bumped linkify-it to 5.0.2.

Fixed

Preserve backslash-space hard line breaks, matching CommonMark 6.7, #1185.

[14.2.0] - 2026-05-24

Added

isPunctCharCode to utilities.

Fixed

Don't end HTML comment blocks on a blank line, #1155.

Properly recognize astral chars (surrogates) in delimiter scans for emphasis-like markers, #1072. Big thanks to @tats-u for his global efforts with improving CJK support.

Preserve unicode whitespaces when trimm headings/paragraphs, #1074.

More strict entities decode to avoid false positives ;, #1096.

Restore block parser state on fail in lheading rule, #1131.

Security

Fixed poor smartquotes perfomance on > 70k quotes in single block

Bumped linkify-it to 5.0.1 with fixed potential perfomance issues.

[14.1.1] - 2026-01-11

Security

Fixed regression from v13 in linkify inline rule. Specific patterns could cause high CPU use. Thanks to @ltduc147 for report.

[14.1.0] - 2024-03-19

Changed

Updated CM spec compatibility to 0.31.2, #1009.

... (truncated)

Commits

efb9993 14.3.2 released
daf5a3c Backported 15.0.2 fixes
a855f10 14.3.1 released
ad70f6b Backported 15.0.1 fixes
b407f3b Ignore generated API docs in lint
bf025ad Prepare package.json for v14 backports
2d9bbea fix: recognize lowercase declarations as HTML blocks (CommonMark 4.6) (#1189)
a311cfb fix: keep literal backslash before space in link destination (CommonMark 6.3)...
ff0ee08 14.3.0 released
52e2749 Bump linkify-it / vite deps
Additional commits viewable in compare view

Updates moment from 2.30.1 to 2.31.0

Release notes

Sourced from moment's releases.

2.31.0

Released Sep 14, 2026

Security fixes

Fix CVE-2026-17495 (GHSA-4p3w-j4w9-5jqw)

Bug fixes

#6376 Prevent object prototype properties from being used as format tokens

#6386 Normalize lazy-loaded locale names

#6404 Fix parsing issue with eHHmm format

#6433 Ignore non-Moment arguments in min and max

#6434 Fix inherited lowercase long date formats

#6436 Reset locale parsing caches after updates

#6437 Fix weekday mismatch when the format only has part of a date

#6442 Fix locale('__proto__') corrupting the global locale

#6443 Avoid Object.assign in duration.humanize

#6446 Validate range when parsing a time zone offset

#6447 Include metadata in all-locales bundle

#6448 Apply postformat to locale relative time methods

#6450 Add stack traces to conditional deprecation warnings

New features

#6451 Add internal date-default hook for Moment Timezone

New locales

#6000: Pashto ('ps')

#6278, #6379: Amharic (Ethiopia) ('am-et')

Updates to existing locales

#5404 Portuguese (Brazil) ('pt-br'): Fix wrong plural usage for time

#6197 Indonesian ('id'): Correct the abbreviation for August

#6217 Georgian ('ka') and Dutch (Belgium) ('nl-be'): Correct L date format...
Description has been truncated

…pdates Bumps the npm-security group with 17 updates in the / directory: | Package | From | To | | --- | --- | --- | | [dompurify](https://github.com/cure53/DOMPurify) | `3.3.3` | `3.4.16` | | [postcss](https://github.com/postcss/postcss) | `8.5.3` | `8.5.23` | | [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom) | `6.30.3` | `6.30.6` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.11` | `1.1.21` | | [js-yaml](https://github.com/nodeca/js-yaml) | `3.14.1` | `3.14.2` | | [extract-zip](https://github.com/maxogden/extract-zip) | `1.7.0` | `removed` | | [browserslist](https://github.com/browserslist/browserslist) | `4.24.5` | `4.29.3` | | [colord](https://github.com/omgovich/colord) | `2.9.3` | `2.10.0` | | [compression](https://github.com/expressjs/compression) | `1.8.0` | `1.8.2` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.0.6` | `3.1.8` | | [http-cache-semantics](https://github.com/kornelski/http-cache-semantics) | `4.2.0` | `4.3.0` | | [markdown-it](https://github.com/markdown-it/markdown-it) | `12.3.2` | `14.3.2` | | [moment](https://github.com/moment/moment) | `2.30.1` | `2.31.0` | | [nanoid](https://github.com/ai/nanoid) | `5.1.5` | `5.1.16` | | [nanoid](https://github.com/ai/nanoid) | `3.3.11` | `3.3.20` | | [proxy-addr](https://github.com/jshttp/proxy-addr) | `2.0.7` | `2.0.8` | | [svgo](https://github.com/svg/svgo) | `3.3.2` | `3.3.5` | | [webpack-dev-middleware](https://github.com/webpack/webpack-dev-middleware) | `5.3.4` | `7.4.6` | Updates `dompurify` from 3.3.3 to 3.4.16 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.3.3...3.4.16) Updates `postcss` from 8.5.3 to 8.5.23 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.3...8.5.23) Updates `react-router-dom` from 6.30.3 to 6.30.6 - [Release notes](https://github.com/remix-run/react-router/releases) - [Changelog](https://github.com/remix-run/react-router/blob/react-router-dom@6.30.6/packages/react-router-dom/CHANGELOG.md) - [Commits](https://github.com/remix-run/react-router/commits/react-router-dom@6.30.6/packages/react-router-dom) Updates `brace-expansion` from 1.1.11 to 1.1.21 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@1.1.11...v1.1.21) Updates `js-yaml` from 3.14.1 to 3.14.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.14.1...3.14.2) Removes `extract-zip` Updates `browserslist` from 4.24.5 to 4.29.3 - [Release notes](https://github.com/browserslist/browserslist/releases) - [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md) - [Commits](browserslist/browserslist@4.24.5...4.29.3) Updates `colord` from 2.9.3 to 2.10.0 - [Release notes](https://github.com/omgovich/colord/releases) - [Changelog](https://github.com/omgovich/colord/blob/master/CHANGELOG.md) - [Commits](https://github.com/omgovich/colord/commits/v2.10) Updates `compression` from 1.8.0 to 1.8.2 - [Release notes](https://github.com/expressjs/compression/releases) - [Changelog](https://github.com/expressjs/compression/blob/master/HISTORY.md) - [Commits](expressjs/compression@1.8.0...v1.8.2) Updates `fast-uri` from 3.0.6 to 3.1.8 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.0.6...v3.1.8) Updates `http-cache-semantics` from 4.2.0 to 4.3.0 - [Commits](https://github.com/kornelski/http-cache-semantics/commits) Updates `markdown-it` from 12.3.2 to 14.3.2 - [Changelog](https://github.com/markdown-it/markdown-it/blob/14.3.2/CHANGELOG.md) - [Commits](markdown-it/markdown-it@12.3.2...14.3.2) Updates `moment` from 2.30.1 to 2.31.0 - [Release notes](https://github.com/moment/moment/releases) - [Changelog](https://github.com/moment/moment/blob/develop/CHANGELOG.md) - [Commits](moment/moment@2.30.1...2.31.0) Updates `nanoid` from 5.1.5 to 5.1.16 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](ai/nanoid@5.1.5...5.1.16) Updates `nanoid` from 3.3.11 to 3.3.20 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](ai/nanoid@5.1.5...5.1.16) Updates `proxy-addr` from 2.0.7 to 2.0.8 - [Release notes](https://github.com/jshttp/proxy-addr/releases) - [Changelog](https://github.com/jshttp/proxy-addr/blob/master/HISTORY.md) - [Commits](jshttp/proxy-addr@v2.0.7...v2.0.8) Updates `svgo` from 3.3.2 to 3.3.5 - [Release notes](https://github.com/svg/svgo/releases) - [Commits](svg/svgo@v3.3.2...v3.3.5) Updates `webpack-dev-middleware` from 5.3.4 to 7.4.6 - [Release notes](https://github.com/webpack/webpack-dev-middleware/releases) - [Changelog](https://github.com/webpack/webpack-dev-middleware/blob/v7.4.6/CHANGELOG.md) - [Commits](webpack/webpack-dev-middleware@v5.3.4...v7.4.6) --- updated-dependencies: - dependency-name: dompurify dependency-version: 3.4.16 dependency-type: direct:production dependency-group: npm-security - dependency-name: postcss dependency-version: 8.5.23 dependency-type: direct:production dependency-group: npm-security - dependency-name: react-router-dom dependency-version: 6.30.6 dependency-type: direct:production dependency-group: npm-security - dependency-name: brace-expansion dependency-version: 1.1.21 dependency-type: indirect dependency-group: npm-security - dependency-name: js-yaml dependency-version: 3.14.2 dependency-type: indirect dependency-group: npm-security - dependency-name: extract-zip dependency-version: dependency-type: indirect dependency-group: npm-security - dependency-name: browserslist dependency-version: 4.29.3 dependency-type: indirect dependency-group: npm-security - dependency-name: colord dependency-version: 2.10.0 dependency-type: indirect dependency-group: npm-security - dependency-name: compression dependency-version: 1.8.2 dependency-type: indirect dependency-group: npm-security - dependency-name: fast-uri dependency-version: 3.1.8 dependency-type: indirect dependency-group: npm-security - dependency-name: http-cache-semantics dependency-version: 4.3.0 dependency-type: indirect dependency-group: npm-security - dependency-name: markdown-it dependency-version: 14.3.2 dependency-type: indirect dependency-group: npm-security - dependency-name: moment dependency-version: 2.31.0 dependency-type: indirect dependency-group: npm-security - dependency-name: nanoid dependency-version: 5.1.16 dependency-type: indirect dependency-group: npm-security - dependency-name: nanoid dependency-version: 3.3.20 dependency-type: indirect dependency-group: npm-security - dependency-name: proxy-addr dependency-version: 2.0.8 dependency-type: indirect dependency-group: npm-security - dependency-name: svgo dependency-version: 3.3.5 dependency-type: indirect dependency-group: npm-security - dependency-name: webpack-dev-middleware dependency-version: 7.4.6 dependency-type: indirect dependency-group: npm-security ... Signed-off-by: dependabot[bot] <support@github.com>

socket-security · 2026-10-15T09:56:30Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
npm/@wordpress/scripts@36.1.0
npm/@wordpress/e2e-test-utils-playwright@1.23.0 ⏵ 3.0.0	⁺¹			⁺²
npm/@wordpress/env@10.23.0 ⏵ 11.17.0	^-2			⁺¹
npm/dompurify@3.3.3 ⏵ 3.4.16	⁺¹	⁺³⁶		⁺³	^-20
npm/react-router-dom@6.30.3 ⏵ 6.30.6		⁺²
npm/postcss@8.5.3 ⏵ 8.5.30	⁺¹	⁺²⁴
npm/webpack@5.99.8 ⏵ 5.111.1	^-2	⁺²	⁺¹

View full report

socket-security · 2026-10-15T09:56:32Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert (click "▶" to expand/collapse)	Action
	Critical CVE: simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection in npm `@simple-git/argv-parser` CVE: GHSA-v5rq-49vh-5v5c simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection (CRITICAL) Affected versions: < 2.0.1 Patched version: 2.0.1 From: package-lock.json → `npm/@wordpress/env@11.17.0` → `npm/@simple-git/argv-parser@1.1.1` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@simple-git/argv-parser@1.1.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report

dependabot · 2026-10-15T10:00:05Z

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 15, 2026

vanshk141999 closed this Oct 15, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/npm-security-f0fb6fb850 branch October 15, 2026 10:00

Navigation Menu

Repository navigation

chore(deps): bump the npm-security group across 1 directory with 17 updates - #145

chore(deps): bump the npm-security group across 1 directory with 17 updates#145
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/npm-security-f0fb6fb850

dependabot Bot commented on behalf of github Oct 15, 2026

Uh oh!

socket-security Bot commented Oct 15, 2026

Uh oh!

socket-security Bot commented Oct 15, 2026

Uh oh!

dependabot Bot commented on behalf of github Oct 15, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 15, 2026

DOMPurify 3.4.16

DOMPurify 3.4.15

DOMPurify 3.4.14

DOMPurify 3.4.13

DOMPurify 3.4.12

DOMPurify 3.4.11

DOMPurify 3.4.10

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.17

8.5.16

8.5.15

8.5.14

8.5.13

8.5.12

8.5.11

8.5.10

8.5.30

8.5.29

8.5.28

8.5.27

8.5.26

8.5.25

8.5.24

8.5.23

8.5.22

8.5.21

v6.30.6

Patch Changes

v6.30.5

Patch Changes

v6.30.4

Patch Changes

v1.1.15

v1.1.12

[3.14.2] - 2025-11-15

Security

[4.1.1] - 2025-11-12

Security

[4.1.0] - 2021-04-15

Added

Changed

[4.0.0] - 2021-01-03

Changed

Added

4.29.3

4.29.2

4.29.1

4.29.0

4.28.9

4.28.8

4.28.7

4.28.6

4.28.5

4.28.4

4.28.3

4.28.2

4.28.1

4.27.0

4.26.3

4.29.3

4.29.2

4.29.1

4.29.0

4.28.9

4.28.8

4.28.7

4.28.6

4.28.5

4.28.4

4.28.3

v2.10 (RGB color mixing)

2.10.0

2.9.7