Skip to content

chore(deps)(deps): Bump the js-minor-patch group across 1 directory with 5 updates - #173

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/js-minor-patch-85dfbbb7e1
Closed

chore(deps)(deps): Bump the js-minor-patch group across 1 directory with 5 updates#173
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/js-minor-patch-85dfbbb7e1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github May 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the js-minor-patch group with 5 updates in the / directory:

Package From To
axios 1.16.0 1.17.0
dompurify 3.4.2 3.4.9
playcanvas 2.18.1 2.19.6
vue 3.5.34 3.5.35
sass 1.99.0 1.100.0

Updates axios from 1.16.0 to 1.17.0

Release notes

Sourced from axios's releases.

v1.17.0 — June 1, 2026

This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.

🔒 Security Fixes

  • Config Hardening: Guarded socketPath, params, and paramsSerializer reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (#10901, #10922)
  • Release Publishing: Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (#10926)

🚀 New Features

  • HTTP Compression: Added Node HTTP adapter support for zstd response decompression, with transitional.advertiseZstdAcceptEncoding controlling whether zstd is advertised in Accept-Encoding. (#6792, #10920)

🐛 Bug Fixes

  • Authentication Handling: Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (#10929, #10896)
  • Proxy TLS: Preserved user httpsAgent TLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (#10957)
  • React Native FormData: Cleared default Content-Type for React Native FormData so multipart boundaries can be generated correctly. (#10898)
  • Headers: Silently skipped empty or whitespace-only header names instead of throwing, matching parsed-header behavior and avoiding React Native response crashes. (#10875)
  • Request Data Merging: Preserved enumerable symbol keys when cloning plain request data through axios merge logic. (#10812)
  • Bundler Compatibility: Converted resolveConfig from an arrow default export to a named function export to avoid webpack and Babel transform interop failures. (#10891)
  • Types: Corrected AxiosHeaders.toJSON() return types and updated CommonJS isCancel typings to narrow to CanceledError<T>. (#10956, #10952)
  • Build Tooling: Avoided emitting a null Authorization header from the GitHub build helper when GITHUB_TOKEN is unset. (#10931)

🔧 Maintenance & Chores

  • HTTP/2 Internals: Extracted Http2Sessions into its own helper module and added direct unit coverage for session pooling, timeout, and cleanup behavior. (#10861)
  • Package Publishing: Reduced published package size by switching to a files allowlist and dropping unneeded unminified bundle source maps. (#10939)
  • CI and Release Automation: Added bundle-size reporting, moved reports to the job summary, fixed bundle-size comparison coverage, added Node 26 to the matrix, pinned npm for staged publishing, and prepared the 1.17.0 release. (#10907, #10911, #10916, #10927, #10935, #10983)
  • Developer Workflow: Added a dev container and iterated on OpenSpec workflow files before removing them from the release branch. (#10925, #10914, #10958)
  • Documentation and Policy: Updated disclosure, contributor, collaboration, threat-model, advanced docs, README badges, release notes, moderator configuration, and project metadata. (#10890, #10889, #10921, #10945, #10905, #10933, #10915, #10887, #10955)
  • Dependencies: Bumped Babel tooling, Commitlint, ESLint, Rollup, Globals, Vitest, Playwright, fs-extra, qs, docs dependencies, and GitHub Actions dependencies including actions/dependency-review-action and zizmorcore/zizmor-action. (#10871, #10879, #10918, #10919, #10934, #10947, #10954, #10960)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

Full Changelog

... (truncated)

Changelog

Sourced from axios's changelog.

v1.17.0 — June 1, 2026

This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.

🔒 Security Fixes

  • Config Hardening: Guarded socketPath, params, and paramsSerializer reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (#10901, #10922)
  • Release Publishing: Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (#10926)

🚀 New Features

  • HTTP Compression: Added Node HTTP adapter support for zstd response decompression, with transitional.advertiseZstdAcceptEncoding controlling whether zstd is advertised in Accept-Encoding. (#6792, #10920)

🐛 Bug Fixes

  • Authentication Handling: Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (#10929, #10896)
  • Proxy TLS: Preserved user httpsAgent TLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (#10957)
  • React Native FormData: Cleared default Content-Type for React Native FormData so multipart boundaries can be generated correctly. (#10898)
  • Headers: Silently skipped empty or whitespace-only header names instead of throwing, matching parsed-header behavior and avoiding React Native response crashes. (#10875)
  • Request Data Merging: Preserved enumerable symbol keys when cloning plain request data through axios merge logic. (#10812)
  • Bundler Compatibility: Converted resolveConfig from an arrow default export to a named function export to avoid webpack and Babel transform interop failures. (#10891)
  • Types: Corrected AxiosHeaders.toJSON() return types and updated CommonJS isCancel typings to narrow to CanceledError<T>. (#10956, #10952)
  • Build Tooling: Avoided emitting a null Authorization header from the GitHub build helper when GITHUB_TOKEN is unset. (#10931)

🔧 Maintenance & Chores

  • HTTP/2 Internals: Extracted Http2Sessions into its own helper module and added direct unit coverage for session pooling, timeout, and cleanup behavior. (#10861)
  • Package Publishing: Reduced published package size by switching to a files allowlist and dropping unneeded unminified bundle source maps. (#10939)
  • CI and Release Automation: Added bundle-size reporting, moved reports to the job summary, fixed bundle-size comparison coverage, added Node 26 to the matrix, pinned npm for staged publishing, and prepared the 1.17.0 release. (#10907, #10911, #10916, #10927, #10935, #10983)
  • Developer Workflow: Added a dev container and iterated on OpenSpec workflow files before removing them from the release branch. (#10925, #10914, #10958)
  • Documentation and Policy: Updated disclosure, contributor, collaboration, threat-model, advanced docs, README badges, release notes, moderator configuration, and project metadata. (#10890, #10889, #10921, #10945, #10905, #10933, #10915, #10887, #10955)
  • Dependencies: Bumped Babel tooling, Commitlint, ESLint, Rollup, Globals, Vitest, Playwright, fs-extra, qs, docs dependencies, and GitHub Actions dependencies including actions/dependency-review-action and zizmorcore/zizmor-action. (#10871, #10879, #10918, #10919, #10934, #10947, #10954, #10960)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

Full Changelog

... (truncated)

Commits

Updates dompurify from 3.4.2 to 3.4.9

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.9

  • Further improved the handling of Trusted Types config options, thanks @​offset
  • Further improved the handling of IN_PLACE sanitization, thanks @​mozfreddyb
  • Added more test coverage for IN_PLACE and Trusted Types related usage
  • Bumped several dependencies where possible
  • Updated README and wiki with more accurate documentation & attack samples

DOMPurify 3.4.8

  • Cleaned up the repository root, renamed some and removed unneeded files
  • Fixed an issue with handling of Trusted Types policies, thanks @​fulstadev
  • Fixed the node iterator for better template scrubbing, thanks @​IamLeandrooooo
  • Included formerly missing LICENSE-MPL in published npm package, thanks @​asamuzaK
  • Bumped several dependencies where possible

DOMPurify 3.4.7

  • Hardened the handling of Shadow Roots when using IN_PLACE, thanks @​GameZoneHacker
  • Removed a problem leading to permanent hook pollution, thanks @​offset
  • Refactored the test suite and expanded test coverage significantly

DOMPurify 3.4.6

  • Fixed several issues with DOM Clobbering in IN_PLACE mode, thanks @​offset & @​Bankde
  • Hardened the checks for cross-realm IN_PLACE and Shadow DOM sanitization, thanks @​offset & @​Bankde
  • Added more test coverage for IN_PLACE and general DOM Clobbering attacks
  • Bumped several dependencies where possible

DOMPurify 3.4.5

  • Fixed a bypass caused by the new HTML element selectedcontent added in 3.4.4, thanks @​KabirAcharya

Note that this is a security release for an issue introduced in 3.4.4 and should be upgraded to immediately.

DOMPurify 3.4.4

  • Added the selectedcontent element to default allow-list, thanks @​lukewarlow
  • Added the command and commandfor attributes to default allowed-list, thanks @​lukewarlow
  • Added better template scrubbing for IN_PLACE operations, thanks @​DEMON1A
  • Added stronger checks for cross-realm windows, thanks @​DEMON1A & @​fg0x0
  • Updated demo website and made sure it uses the latest from main
  • Updated existing workflows, fuzzer, dependabot, etc., added more tests
  • Bumped several dependencies where possible

🚨 This release had been flagged as deprecated, please use DOMPurify 3.4.5 instead 🚨

DOMPurify 3.4.3

  • Fixed an issue with handling of nested Shadow DOM trees, thanks @​fishjojo1
  • Fixed the template regexes to be more robust against ReDoS attacks, thanks @​aleung27
  • Updated the node iteration code to catch more Shadow DOM related issues
  • Updated Playwright and added Node 26 to test matrix
  • Updated existing workflows, fuzzer, release signing, etc., added more tests
  • Bumped several dependencies where possible
Commits

Updates playcanvas from 2.18.1 to 2.19.6

Release notes

Sourced from playcanvas's releases.

v2.19.6

Changes

  • Add a GSplat streaming test example, PREFERRED_DEVICE flag, and numSplats accessor by @​mvaligursky in #8847

Contributors

Full Changelog: playcanvas/engine@v2.19.5...v2.19.6

v2.19.5

Fixes

Contributors

Full Changelog: playcanvas/engine@v2.19.4...v2.19.5

v2.19.4

Fixes

Contributors

Full Changelog: playcanvas/engine@v2.19.3...v2.19.4

v2.19.3

Fixes

Contributors

Full Changelog: playcanvas/engine@v2.19.2...v2.19.3

v2.19.2

Fixes

... (truncated)

Commits
  • 0711d51 2.19.6
  • a0e0b61 Add a GSplat streaming test example, PREFERRED_DEVICE flag, and numSplats acc...
  • 96df0a6 2.19.5
  • 7570fb6 fix(scripts): register nameless scripts under their verbatim class name (#8844)
  • d8f1eb3 fix(gsplat): tile interval-scatter dispatch over workgroup limit (#8841)
  • d999442 2.19.4
  • 09346d8 fix(build): keep UMD exports overridable while preserving live bindings (#8839)
  • 4ca251a 2.19.3
  • 668b11a fix(build): preserve live bindings of mutable UMD exports (pc.app) (#8837)
  • 16271aa Use a Map for the script registry and guard reserved names in add() (#8835)
  • Additional commits viewable in compare view

Updates vue from 3.5.34 to 3.5.35

Release notes

Sourced from vue's releases.

v3.5.35

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

Changelog

Sourced from vue's changelog.

3.5.35 (2026-05-27)

Bug Fixes

Performance Improvements

  • reactivity: skip type checks for cached proxies (#14860) (5734fe9)
  • runtime-dom: optimize array event handler dispatch (#14828) (bb18dc8)
  • server-renderer: avoid materializing iterables in ssrRenderList (#14821) (1b7a2cc)
Commits
  • 8be32d6 release: v3.5.35
  • 80fc139 fix(runtime-core): skip idle persisted transition hooks in keep-alive moves (...
  • d6c7371 ci: use backup action for size report comments
  • bb18dc8 perf(runtime-dom): optimize array event handler dispatch (#14828)
  • 5734fe9 perf(reactivity): skip type checks for cached proxies (#14860)
  • 584beb1 fix(teleport): skip child unmount when pending mount discarded (#14876) (#14877)
  • 34a0ded fix(compiler-core): avoid double processing v-for keys with v-memo (#14861)
  • 170fc95 fix(runtime-core): avoid repeated hydration mismatch checks (#14857)
  • 1b7a2cc perf(server-renderer): avoid materializing iterables in ssrRenderList (#14821)
  • 3d077f2 fix(compiler-sfc): resolve top-level exports from files registered as global ...
  • Additional commits viewable in compare view

Updates sass from 1.99.0 to 1.100.0

Release notes

Sourced from sass's releases.

Dart Sass 1.100.0

To install Sass 1.100.0, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

  • Writing two compound selectors adjacent to one another without any whitespace between them, such as [class]a, is now deprecated. This was always an error in CSS and Sass only supported it by mistake.

    See the Sass website for details.

See the full changelog for changes in earlier releases.

Changelog

Sourced from sass's changelog.

1.100.0

  • Writing two compound selectors adjacent to one another without any whitespace between them, such as [class]a, is now deprecated. This was always an error in CSS and Sass only supported it by mistake.

    See the Sass website for details.

Commits
  • 5fd18c7 Bump node engine requirement to >=20.19.0 and chokidar requirement to ^5.0.0 ...
  • 8c1d984 Deprecate adjacent compound selectors (#2765)
  • 8e5f718 Bump postcss from 8.5.12 to 8.5.13 in /pkg/sass-parser (#2767)
  • 1447f9b Bump postcss from 8.5.8 to 8.5.12 in /pkg/sass-parser (#2766)
  • See full diff in compare view

@dependabot @github

dependabot Bot commented on behalf of github May 28, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies, javascript. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot
dependabot Bot requested a review from mickyarun as a code owner May 28, 2026 06:34
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/js-minor-patch-85dfbbb7e1 branch 5 times, most recently from acd91b7 to b6b451f Compare June 8, 2026 22:16
@dependabot
chore(deps)(deps): Bump the js-minor-patch group across 1 directory w…
63c0ea7 
…ith 5 updates

Bumps the js-minor-patch group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [axios](https://github.com/axios/axios) | `1.16.0` | `1.17.0` |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.4.2` | `3.4.9` |
| [playcanvas](https://github.com/playcanvas/engine) | `2.18.1` | `2.19.6` |
| [vue](https://github.com/vuejs/core) | `3.5.34` | `3.5.35` |
| [sass](https://github.com/sass/dart-sass) | `1.99.0` | `1.100.0` |



Updates `axios` from 1.16.0 to 1.17.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.16.0...v1.17.0)

Updates `dompurify` from 3.4.2 to 3.4.9
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.2...3.4.9)

Updates `playcanvas` from 2.18.1 to 2.19.6
- [Release notes](https://github.com/playcanvas/engine/releases)
- [Commits](playcanvas/engine@v2.18.1...v2.19.6)

Updates `vue` from 3.5.34 to 3.5.35
- [Release notes](https://github.com/vuejs/core/releases)
- [Changelog](https://github.com/vuejs/core/blob/main/CHANGELOG.md)
- [Commits](vuejs/core@v3.5.34...v3.5.35)

Updates `sass` from 1.99.0 to 1.100.0
- [Release notes](https://github.com/sass/dart-sass/releases)
- [Changelog](https://github.com/sass/dart-sass/blob/main/CHANGELOG.md)
- [Commits](sass/dart-sass@1.99.0...1.100.0)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 1.16.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: js-minor-patch
- dependency-name: dompurify
  dependency-version: 3.4.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: js-minor-patch
- dependency-name: playcanvas
  dependency-version: 2.18.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: js-minor-patch
- dependency-name: sass
  dependency-version: 1.100.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: js-minor-patch
- dependency-name: vue
  dependency-version: 3.5.35
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: js-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title chore(deps)(deps): bump the js-minor-patch group across 1 directory with 5 updates chore(deps)(deps): Bump the js-minor-patch group across 1 directory with 5 updates Jun 10, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/js-minor-patch-85dfbbb7e1 branch from b6b451f to 63c0ea7 Compare June 10, 2026 13:20
@dependabot @github

dependabot Bot commented on behalf of github Jun 11, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Jun 11, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/js-minor-patch-85dfbbb7e1 branch June 11, 2026 04:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mickyarun mickyarun Awaiting requested review from mickyarun mickyarun is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants