Bump the npm_and_yarn group across 1 directory with 3 updates

[dependabot]

Bumps the npm_and_yarn group with 3 updates in the / directory: electron, pnpm and vite.

Updates electron from 39.8.5 to 39.8.10

Release notes

Sourced from electron's releases.

electron v39.8.10

Release Notes for v39.8.10

[!WARNING] Electron 39.x.y has reached end-of-support as per the project's support policy. Developers and applications are encouraged to upgrade to a newer version of Electron.

Fixes

• Ensured cross-origin fetch() and XHR are blocked for custom protocols registered with supportFetchAPI: true unless corsEnabled: true is also set; cross-origin mode: 'no-cors' requests now receive an opaque response. #51272 (Also in 40, 41, 42)
• Fixed an issue where the Squirrel.Mac installer could resolve the target bundle path to different locations at different stages of an install. #50766 (Also in 42)

Other Changes

• Backported a fix for route_id validation in the GPU command buffer. #51327
• Backported security fixes for 493319454, 494158331, 493234757, 492736100, 493413432, 492668885, 496281816. #51257
• Backported several fixes in Skia, ANGLE, and WebRTC from upstream. #51266

Commits

• d7c42eb chore: backport removal of private macOS APIs (#51502)
• c76d48c build: replace spec dep fork with transitive resolution (#51490)
• 3ff23c5 fix: respect iframe sandbox flags on the OpenURL navigation path (#51437)
• 01faabf fix: resolve target bundle path once at start of install (#50766)
• 8287d59 build(deps): bump dorny/paths-filter from 3.0.2 to 4.0.1 (#51409)
• a8a79ea ci: backport secondary siso patch (#51390)
• 593607e chore: cherry-pick 1 change from chromium (#51327)
• aa7791f build: restrict npm tarball contents to an explicit allowlist (#51307)
• 5392e9a fix: ensure corsEnabled: false protocol handlers do not work across protocols...
• 2c24640 fix: validate OSR frame geometry against shared-memory mapping size (39-x-y) ...
• Additional commits viewable in compare view

Updates pnpm from 9.15.9 to 10.34.4

Release notes

Sourced from pnpm's releases.

pnpm 10.34.4

Patch Changes

• 352ae48: Security: validate config dependency names and versions before using them to build filesystem paths. A pnpm-workspace.yaml with a traversal-shaped configDependencies name (such as ../../PWNED) or version (such as ../../../PWNED) could previously cause pnpm install to create symlinks or write package files outside node_modules/.pnpm-config and the store. Names must now be valid npm package names and versions must be exact semver versions. See GHSA-qrv3-253h-g69c.

• 352ae48: Reject path-traversal and reserved dependency aliases (such as ../../../escape, .bin, .pnpm, or node_modules) that come from a lockfile rather than a freshly resolved manifest. A crafted lockfile alias could otherwise be joined directly under a hoisted node_modules directory, letting package files be written outside the intended install root or overwrite pnpm-owned layout.

  The nodeLinker: hoisted graph builder now validates each alias at the directory sink (safeJoinModulesDir), matching the validation pnpm already performs when resolving aliases from manifests. See GHSA-fr4h-3cph-29xv.

• 352ae48: Prevent pnpm patch-remove from removing files outside the configured patches directory.

• 217fbe0: Hardened the warning printed when a project .npmrc uses environment variables in registry/auth settings: the suggested pnpm config set command is now only included for keys made up of shell-inert characters. Because the key comes from a repository-controlled .npmrc and a shell expands $(...), backticks, and $VAR even inside double quotes, a crafted key could otherwise have turned the suggested copy-paste command into command execution.

Platinum Sponsors

Gold Sponsors

... (truncated)

Commits

• See full diff in compare view

Updates vite from 6.4.2 to 6.4.3

Release notes

Sourced from vite's releases.

v6.4.3

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

6.4.3 (2026-06-01)

• fix: backport #22572, reject windows alternate paths (#22576) (96b0c10), closes #22572 #22576
• fix(deps): backport #22571, reject UNC paths for launch-editor-middleware (#22575) (8fed5cf), closes #22571 #22575

Commits

• 6c2c881 release: v6.4.3
• 96b0c10 fix: backport #22572, reject windows alternate paths (#22576)
• 8fed5cf fix(deps): backport #22571, reject UNC paths for launch-editor-middleware (#2...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.