Skip to content

deps(pnpm): bump the pnpm group across 1 directory with 9 updates - #326

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/frontend/pnpm-ef40aaef6b
Open

deps(pnpm): bump the pnpm group across 1 directory with 9 updates#326
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/frontend/pnpm-ef40aaef6b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the pnpm group with 9 updates in the /frontend directory:

Package From To
@zip.js/zip.js 2.8.33 2.8.34
devalue 5.8.2 5.9.0
dompurify 3.4.12 3.4.13
i18next-http-backend 4.0.0 4.0.1
vue 3.5.40 3.5.41
@types/node 26.1.1 26.1.2
i18next-fs-backend 2.6.6 2.6.7
markdown-it-attrs 5.0.0 5.0.1
vite 8.1.5 8.2.1

Updates @zip.js/zip.js from 2.8.33 to 2.8.34

Release notes

Sourced from @​zip.js/zip.js's releases.

v2.8.34

Bug fixes

  • Fixed zip global export name mangled away in minified UMD builds (e.g. dist/zip.min.js)
Commits

Updates devalue from 5.8.2 to 5.9.0

Release notes

Sourced from devalue's releases.

v5.9.0

Minor Changes

  • 07d6a38: feat: export filterArrayIndices, the array-index filtering used by the indicesOf stringify operation, so custom operations can reuse it instead of reimplementing it
  • 07d6a38: feat: add pluggable operations option to parse/unflatten, allowing customization of how values are constructed while reviving (e.g. cross-realm or foreign-runtime revival)
  • 5b53532: feat: add pluggable operations option to stringify/stringifyAsync, allowing customization of how values are introspected during serialization (e.g. side-effect-free or foreign-runtime serialization)
Changelog

Sourced from devalue's changelog.

5.9.0

Minor Changes

  • 07d6a38: feat: export filterArrayIndices, the array-index filtering used by the indicesOf stringify operation, so custom operations can reuse it instead of reimplementing it
  • 07d6a38: feat: add pluggable operations option to parse/unflatten, allowing customization of how values are constructed while reviving (e.g. cross-realm or foreign-runtime revival)
  • 5b53532: feat: add pluggable operations option to stringify/stringifyAsync, allowing customization of how values are introspected during serialization (e.g. side-effect-free or foreign-runtime serialization)
Commits

Updates dompurify from 3.4.12 to 3.4.13

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.13

  • Fixed an issue with hook removal during IN_PLACE sanitization, thanks @​koyokr
  • Fixed an issue with hooks potentially bypassing the clone guard, thanks @​AkshayjainG
  • Fixed an issue with DOM clobbering via ownerDocument during IN_PLACE, thanks @​AkshayjainG
  • Bumped several dependencies where possible
Commits

Updates i18next-http-backend from 4.0.0 to 4.0.1

Changelog

Sourced from i18next-http-backend's changelog.

4.0.1

  • fix: allow @ in ns values so scoped-package-style namespace names such as @organization/package-name fetch correctly again (#191). 3.0.6 relaxed the ns check for / but left @ in the shared denylist. In the URL path position @ is a plain RFC 3986 pchar with no structural meaning; it stays blocked for lng, where it marks the userinfo/authority boundary. Every other pattern from the 3.0.5 advisory (.., \, %, ?, #, whitespace, control chars, prototype keys, oversized inputs) remains blocked for both keys.
Commits
  • 5658217 4.0.1
  • 2b2e771 fix: allow @ in ns values for scoped-package-style namespaces
  • 64c1105 Bump next from 16.2.6 to 16.2.11 in /example/next (#190)
  • 7be00f7 Remove deprecated baseUrl from tsconfig to fix Deno CI type check
  • 8eeafa2 README: mention npx i18next-cli localize as the zero-to-localized path
  • 37df2ff Bump i18next-http-backend from 3.0.1 to 3.0.5 in /example/node (#187)
  • 175e327 Bump next from 16.2.3 to 16.2.6 in /example/next (#186)
  • b74344c Fix typo in Locize advice section ('backed' → 'backend')
  • 5521246 Modernize locize.com URLs and refresh UTM tags
  • See full diff in compare view

Updates vue from 3.5.40 to 3.5.41

Release notes

Sourced from vue's releases.

v3.5.41

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

Changelog

Sourced from vue's changelog.

3.5.41 (2026-08-05)

Bug Fixes

Commits

Updates @types/node from 26.1.1 to 26.1.2

Commits

Updates i18next-fs-backend from 2.6.6 to 2.6.7

Changelog

Sourced from i18next-fs-backend's changelog.

2.6.7

  • security (defence-in-depth): write() iterates own enumerable keys of queuedWrites instead of using for...in. for...in walks the prototype chain, so an Object.prototype polluted by any other library in the process was iterated here and turned into writeFile() calls. setPath / pushPath already refuse to create unsafe own keys and interpolatePath still validates before anything is written, so this closes an amplification path rather than a traversal.
  • docs: corrected the security section of the README, which still claimed / is rejected in both lng and ns. That has not been true since 2.6.5, which allows / in ns so nested namespace names such as a/b map to subfolder layouts. The per-key split is now described accurately.
Commits
  • 7c51fad 2.6.7
  • d3910ce security: iterate own keys in write(); fix stale README security section
  • 8e5a11e Bump i18next-fs-backend from 2.6.4 to 2.6.6 in /example/updatable-cache (#84)
  • ef0e8e5 Bump js-yaml from 4.2.0 to 4.3.0 (#83)
  • 9e252de Bump i18next-http-middleware from 3.9.3 to 3.9.7 in /example/fastify (#80)
  • 7e5e5f2 Bump @​babel/core from 7.29.0 to 7.29.6 (#81)
  • e20a304 Bump i18next-fs-backend from 2.6.4 to 2.6.6 in /example/fastify (#79)
  • 7534a5c Bump js-yaml from 4.1.1 to 4.2.0 (#78)
  • 90001df Bump esbuild from 0.28.0 to 0.28.1 (#77)
  • ae1b436 README: mention npx i18next-cli localize as the zero-to-localized path
  • Additional commits viewable in compare view

Updates markdown-it-attrs from 5.0.0 to 5.0.1

Release notes

Sourced from markdown-it-attrs's releases.

v5.0.1

What's Changed

New Contributors

Full Changelog: arve0/markdown-it-attrs@v5.0.0...v5.0.1

Commits
  • 2283317 5.0.1
  • ebbb022 Bump markdown-it from 14.1.1 to 14.3.0
  • 9016fa8 Bump @​babel/core from 7.25.2 to 7.29.6
  • 1c65f5f Bump shell-quote from 1.8.1 to 1.10.0
  • 41c0995 Bump linkify-it from 5.0.0 to 5.0.2
  • 556528a test: do not rely on end-of-block crash to trigger errorHandler
  • faf2759 feat: add errorHandler option to handle pattern transform errors
  • 6e10c1f Update end of block behavior for inline rendering
  • See full diff in compare view

Updates vite from 8.1.5 to 8.2.1

Release notes

Sourced from vite's releases.

plugin-legacy@8.2.1

Please refer to CHANGELOG.md for details.

v8.2.1

Please refer to CHANGELOG.md for details.

create-vite@8.2.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.2.0

Please refer to CHANGELOG.md for details.

v8.2.0

Please refer to CHANGELOG.md for details.

v8.2.0-beta.0

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.2.1 (2026-08-06)

Bug Fixes

  • build: make client chunkImportMap work with sharedPlugins: true (#23184) (15f0307)
  • bundled-dev: inject client script tag before chunk scripts (#23161) (eac0cc8)
  • css: don't re-run lightningcss visitor during minify (fix #23146) (#23147) (de041a7)
  • deps: update all non-major dependencies (#23136) (14454fd)
  • deps: update rolldown-related dependencies (#23070) (7ac6f7f)
  • don't mutate the user config when resolving the lib entry from the top-level input (#23135) (b4bf596)
  • handle shebang ending with uncommon line terminators (#23038) (17f7b2f)
  • server: use a random port when port is 0 (#23158) (fddf4ea)

Performance Improvements

Documentation

  • build: fix incomplete @default for build.minify (#23177) (ef02435)

Miscellaneous Chores

  • deps: update dependency rolldown-plugin-dts to ^0.28.0 (#23137) (4adc1e7)
  • deps: update dependency strip-literal to v4 (#23140) (9db65ce)

Code Refactoring

  • bundled-dev: avoid injecting server values in the bundle (#22967) (23b8a08)
  • bundled-dev: remove rolldown lazy stub module workaround (#23129) (e72036e)

Tests

8.2.0 (2026-07-30)

Features

  • add input to server.fs.allow (#23035) (95a3cda)
  • bundled-dev: reload once after rebuild instead of via the fallback page (#23106) (b24381d)
  • bundled-dev: support worker file update accepted by HMR (#23068) (0d04351)
  • config: include column in config incompatibility location (#23064) (8a24572)
  • dev: resolve interface name for explicit host in network URLs (#22965) (3ac77d9)

Bug Fixes

  • bundledDev: print build errors to the terminal when an HMR update fails (#23024) (41c4658)
  • deps: update all non-major dependencies (#23069) (4c07b74)
  • hmr: preserve environment snapshot during server restart (#22992) (b1186c3)
  • importAnalysis: interop imports injected into optimized dep files by plugins (#23029) (8c2a87d)

... (truncated)

Commits
  • 4216158 release: v8.2.1
  • fddf4ea fix(server): use a random port when port is 0 (#23158)
  • de041a7 fix(css): don't re-run lightningcss visitor during minify (fix #23146) (#23147)
  • 15f0307 fix(build): make client chunkImportMap work with sharedPlugins: true (#23184)
  • c2155fe test(bundled-dev): enable sourcemap playgrounds (#23080)
  • ef02435 docs(build): fix incomplete @default for build.minify (#23177)
  • eac0cc8 fix(bundled-dev): inject client script tag before chunk scripts (#23161)
  • 23b8a08 refactor(bundled-dev): avoid injecting server values in the bundle (#22967)
  • e72036e refactor(bundled-dev): remove rolldown lazy stub module workaround (#23129)
  • 14454fd fix(deps): update all non-major dependencies (#23136)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
deps(pnpm): bump the pnpm group across 1 directory with 9 updates
a5db5b7 
Bumps the pnpm group with 9 updates in the /frontend directory:

| Package | From | To |
| --- | --- | --- |
| [@zip.js/zip.js](https://github.com/gildas-lormeau/zip.js) | `2.8.33` | `2.8.34` |
| [devalue](https://github.com/sveltejs/devalue) | `5.8.2` | `5.9.0` |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.4.12` | `3.4.13` |
| [i18next-http-backend](https://github.com/i18next/i18next-http-backend) | `4.0.0` | `4.0.1` |
| [vue](https://github.com/vuejs/core) | `3.5.40` | `3.5.41` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.1.1` | `26.1.2` |
| [i18next-fs-backend](https://github.com/i18next/i18next-fs-backend) | `2.6.6` | `2.6.7` |
| [markdown-it-attrs](https://github.com/arve0/markdown-it-attrs) | `5.0.0` | `5.0.1` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.1.5` | `8.2.1` |



Updates `@zip.js/zip.js` from 2.8.33 to 2.8.34
- [Release notes](https://github.com/gildas-lormeau/zip.js/releases)
- [Commits](gildas-lormeau/zip.js@v2.8.33...v2.8.34)

Updates `devalue` from 5.8.2 to 5.9.0
- [Release notes](https://github.com/sveltejs/devalue/releases)
- [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md)
- [Commits](sveltejs/devalue@v5.8.2...v5.9.0)

Updates `dompurify` from 3.4.12 to 3.4.13
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.12...3.4.13)

Updates `i18next-http-backend` from 4.0.0 to 4.0.1
- [Changelog](https://github.com/i18next/i18next-http-backend/blob/master/CHANGELOG.md)
- [Commits](i18next/i18next-http-backend@v4.0.0...v4.0.1)

Updates `vue` from 3.5.40 to 3.5.41
- [Release notes](https://github.com/vuejs/core/releases)
- [Changelog](https://github.com/vuejs/core/blob/main/CHANGELOG.md)
- [Commits](vuejs/core@v3.5.40...v3.5.41)

Updates `@types/node` from 26.1.1 to 26.1.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `i18next-fs-backend` from 2.6.6 to 2.6.7
- [Changelog](https://github.com/i18next/i18next-fs-backend/blob/master/CHANGELOG.md)
- [Commits](i18next/i18next-fs-backend@v2.6.6...v2.6.7)

Updates `markdown-it-attrs` from 5.0.0 to 5.0.1
- [Release notes](https://github.com/arve0/markdown-it-attrs/releases)
- [Commits](arve0/markdown-it-attrs@v5.0.0...v5.0.1)

Updates `vite` from 8.1.5 to 8.2.1
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.2.1/packages/vite)

---
updated-dependencies:
- dependency-name: "@zip.js/zip.js"
  dependency-version: 2.8.34
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pnpm
- dependency-name: devalue
  dependency-version: 5.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pnpm
- dependency-name: dompurify
  dependency-version: 3.4.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pnpm
- dependency-name: i18next-http-backend
  dependency-version: 4.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pnpm
- dependency-name: vue
  dependency-version: 3.5.41
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pnpm
- dependency-name: "@types/node"
  dependency-version: 26.1.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: pnpm
- dependency-name: i18next-fs-backend
  dependency-version: 2.6.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: pnpm
- dependency-name: markdown-it-attrs
  dependency-version: 5.0.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: pnpm
- dependency-name: vite
  dependency-version: 8.2.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: pnpm
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 10, 2026
@github-actions

github-actions Bot commented Aug 10, 2026 •
edited
Loading

Copy link
Copy Markdown

⚠️ Deployment skipped

Reason: No permission to push to gh-pages
View logs

Local install
Run as an administrator in PowerShell to install this branch: 
irm install.raweb.app/preview/kimmknight/dependabot/npm_and_yarn/frontend/pnpm-ef40aaef6b | iex

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants