chore(deps)(deps): bump the frontend-minor-patch group across 1 directory with 8 updates by dependabot[bot] · Pull Request #208 · mickyarun/bodhiorchard

dependabot · 2026-06-04T04:42:13Z

Updates the requirements on axios, diff, dompurify, mermaid, playcanvas, vue, sass and vite-ssg to permit the latest version.
Updates axios from 1.16.0 to 1.17.0

Release notes

Sourced from axios's releases.

v1.17.0 — June 1, 2026

This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.

🔒 Security Fixes

Config Hardening: Guarded socketPath, params, and paramsSerializer reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (#10901, #10922)

Release Publishing: Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (#10926)

🚀 New Features

HTTP Compression: Added Node HTTP adapter support for zstd response decompression, with transitional.advertiseZstdAcceptEncoding controlling whether zstd is advertised in Accept-Encoding. (#6792, #10920)

🐛 Bug Fixes

Authentication Handling: Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (#10929, #10896)

Proxy TLS: Preserved user httpsAgent TLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (#10957)

React Native FormData: Cleared default Content-Type for React Native FormData so multipart boundaries can be generated correctly. (#10898)

Headers: Silently skipped empty or whitespace-only header names instead of throwing, matching parsed-header behavior and avoiding React Native response crashes. (#10875)

Request Data Merging: Preserved enumerable symbol keys when cloning plain request data through axios merge logic. (#10812)

Bundler Compatibility: Converted resolveConfig from an arrow default export to a named function export to avoid webpack and Babel transform interop failures. (#10891)

Types: Corrected AxiosHeaders.toJSON() return types and updated CommonJS isCancel typings to narrow to CanceledError<T>. (#10956, #10952)

Build Tooling: Avoided emitting a null Authorization header from the GitHub build helper when GITHUB_TOKEN is unset. (#10931)

🔧 Maintenance & Chores

HTTP/2 Internals: Extracted Http2Sessions into its own helper module and added direct unit coverage for session pooling, timeout, and cleanup behavior. (#10861)

Package Publishing: Reduced published package size by switching to a files allowlist and dropping unneeded unminified bundle source maps. (#10939)

CI and Release Automation: Added bundle-size reporting, moved reports to the job summary, fixed bundle-size comparison coverage, added Node 26 to the matrix, pinned npm for staged publishing, and prepared the 1.17.0 release. (#10907, #10911, #10916, #10927, #10935, #10983)

Developer Workflow: Added a dev container and iterated on OpenSpec workflow files before removing them from the release branch. (#10925, #10914, #10958)

Documentation and Policy: Updated disclosure, contributor, collaboration, threat-model, advanced docs, README badges, release notes, moderator configuration, and project metadata. (#10890, #10889, #10921, #10945, #10905, #10933, #10915, #10887, #10955)

Dependencies: Bumped Babel tooling, Commitlint, ESLint, Rollup, Globals, Vitest, Playwright, fs-extra, qs, docs dependencies, and GitHub Actions dependencies including actions/dependency-review-action and zizmorcore/zizmor-action. (#10871, #10879, #10918, #10919, #10934, #10947, #10954, #10960)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

@BasixKOR (#6792)

@carladams1299-lab (#10861)

@LaplaceYoung (#10812)

@JamieMagee (#10939)

@RonGamzu (#10905)

@sapirbaruch (#10891)

@nezukoagent (#10901)

@devareddy05 (#10929)

@Mohammad-Faiz-Cloud-Engineer (#10922)

@azandabot (#10931)

@niksy (#10896)

Full Changelog

... (truncated)

Changelog

Sourced from axios's changelog.

v1.17.0 — June 1, 2026

This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.

🔒 Security Fixes

Config Hardening: Guarded socketPath, params, and paramsSerializer reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (#10901, #10922)

Release Publishing: Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (#10926)

🚀 New Features

HTTP Compression: Added Node HTTP adapter support for zstd response decompression, with transitional.advertiseZstdAcceptEncoding controlling whether zstd is advertised in Accept-Encoding. (#6792, #10920)

🐛 Bug Fixes

Authentication Handling: Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (#10929, #10896)

Proxy TLS: Preserved user httpsAgent TLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (#10957)

React Native FormData: Cleared default Content-Type for React Native FormData so multipart boundaries can be generated correctly. (#10898)

Headers: Silently skipped empty or whitespace-only header names instead of throwing, matching parsed-header behavior and avoiding React Native response crashes. (#10875)

Request Data Merging: Preserved enumerable symbol keys when cloning plain request data through axios merge logic. (#10812)

Bundler Compatibility: Converted resolveConfig from an arrow default export to a named function export to avoid webpack and Babel transform interop failures. (#10891)

Types: Corrected AxiosHeaders.toJSON() return types and updated CommonJS isCancel typings to narrow to CanceledError<T>. (#10956, #10952)

Build Tooling: Avoided emitting a null Authorization header from the GitHub build helper when GITHUB_TOKEN is unset. (#10931)

🔧 Maintenance & Chores

HTTP/2 Internals: Extracted Http2Sessions into its own helper module and added direct unit coverage for session pooling, timeout, and cleanup behavior. (#10861)

Package Publishing: Reduced published package size by switching to a files allowlist and dropping unneeded unminified bundle source maps. (#10939)

CI and Release Automation: Added bundle-size reporting, moved reports to the job summary, fixed bundle-size comparison coverage, added Node 26 to the matrix, pinned npm for staged publishing, and prepared the 1.17.0 release. (#10907, #10911, #10916, #10927, #10935, #10983)

Developer Workflow: Added a dev container and iterated on OpenSpec workflow files before removing them from the release branch. (#10925, #10914, #10958)

Documentation and Policy: Updated disclosure, contributor, collaboration, threat-model, advanced docs, README badges, release notes, moderator configuration, and project metadata. (#10890, #10889, #10921, #10945, #10905, #10933, #10915, #10887, #10955)

Dependencies: Bumped Babel tooling, Commitlint, ESLint, Rollup, Globals, Vitest, Playwright, fs-extra, qs, docs dependencies, and GitHub Actions dependencies including actions/dependency-review-action and zizmorcore/zizmor-action. (#10871, #10879, #10918, #10919, #10934, #10947, #10954, #10960)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

@BasixKOR (#6792)

@carladams1299-lab (#10861)

@LaplaceYoung (#10812)

@JamieMagee (#10939)

@RonGamzu (#10905)

@sapirbaruch (#10891)

@nezukoagent (#10901)

@devareddy05 (#10929)

@Mohammad-Faiz-Cloud-Engineer (#10922)

@azandabot (#10931)

@niksy (#10896)

Full Changelog

... (truncated)

Commits

4306df2 chore: add fun 88 sponsorship
931cc8f chore(release): prepare release 1.17.0 (#10983)
38ba1b3 fix(fetch): support basic auth from URL (#10896)
32e2515 fix: replace ternary side effect in script (#10931)
030e722 chore(deps): bump axios from 1.15.2 to 1.16.1 in /docs (#10960)
ec63164 chore: remove openspec (#10958)
3dec28f fix(http): preserve TLS options for proxy tunnels (#10957)
a2390a5 fix: correct isCancel type to narrow to CanceledError<T> (#10952)
fa01b92 chore(deps-dev): bump tmp from 0.2.5 to 0.2.7 in /docs (#10954)
2d2314a fix: AxiosHeaders toJSON() return types (#10956)
Additional commits viewable in compare view

Updates diff to 7.0.0

Changelog

Sourced from diff's changelog.

7.0.0

Just a single (breaking) bugfix, undoing a behaviour change introduced accidentally in 6.0.0:

#554 diffWords treats numbers and underscores as word characters again. This behaviour was broken in v6.0.0.

6.0.0

This is a release containing many, many breaking changes. The objective of this release was to carry out a mass fix, in one go, of all the open bugs and design problems that required breaking changes to fix. A substantial, but exhaustive, changelog is below.

Commits

#497 diffWords behavior has been radically changed. Previously, even with ignoreWhitespace: true, runs of whitespace were tokens, which led to unhelpful and unintuitive diffing behavior in typical texts. Specifically, even when two texts contained overlapping passages, diffWords would sometimes choose to delete all the words from the old text and insert them anew in their new positions in order to avoid having to delete or insert whitespace tokens. Whitespace sequences are no longer tokens as of this release, which affects both the generated diffs and the counts.

Runs of whitespace are still tokens in diffWordsWithSpace.

As part of the changes to diffWords, a new .postProcess method has been added on the base Diff type, which can be overridden in custom Diff implementations.

diffLines with ignoreWhitespace: true will no longer ignore the insertion or deletion of entire extra lines of whitespace at the end of the text. Previously, these would not show up as insertions or deletions, as a side effect of a hack in the base diffing algorithm meant to help ignore whitespace in diffWords. More generally, the undocumented special handling in the core algorithm for ignored terminals has been removed entirely. (This special case behavior used to rewrite the final two change objects in a scenario where the final change object was an addition or deletion and its value was treated as equal to the empty string when compared using the diff object's .equals method.)

#500 diffChars now diffs Unicode code points instead of UTF-16 code units.

#508 parsePatch now always runs in what was previously "strict" mode; the undocumented strict option has been removed. Previously, by default, parsePatch (and other patch functions that use it under the hood to parse patches) would accept a patch where the line counts in the headers were inconsistent with the actual patch content - e.g. where a hunk started with the header @@ -1,3 +1,6 @@, indicating that the content below spanned 3 lines in the old file and 6 lines in the new file, but then the actual content below the header consisted of some different number of lines, say 10 lines of context, 5 deletions, and 1 insertion. Actually trying to work with these patches using applyPatch or merge, however, would produce incorrect results instead of just ignoring the incorrect headers, making this "feature" more of a trap than something actually useful. It's been ripped out, and now we are always "strict" and will reject patches where the line counts in the headers aren't consistent with the actual patch content.

#435 Fix parsePatch handling of control characters. parsePatch used to interpret various unusual control characters - namely vertical tabs, form feeds, lone carriage returns without a line feed, and EBCDIC NELs - as line breaks when parsing a patch file. This was inconsistent with the behavior of both JsDiff's own diffLines method and also the Unix diff and patch utils, which all simply treat those control characters as ordinary characters. The result of this discrepancy was that some well-formed patches - produced either by diff or by JsDiff itself and handled properly by the patch util - would be wrongly parsed by parsePatch, with the effect that it would disregard the remainder of a hunk after encountering one of these control characters.

#439 Prefer diffs that order deletions before insertions. When faced with a choice between two diffs with an equal total edit distance, the Myers diff algorithm generally prefers one that does deletions before insertions rather than insertions before deletions. For instance, when diffing abcd against acbd, it will prefer a diff that says to delete the b and then insert a new b after the c, over a diff that says to insert a c before the b and then delete the existing c. JsDiff deviated from the published Myers algorithm in a way that led to it having the opposite preference in many cases, including that example. This is now fixed, meaning diffs output by JsDiff will more accurately reflect what the published Myers diff algorithm would output.

#455 The added and removed properties of change objects are now guaranteed to be set to a boolean value. (Previously, they would be set to undefined or omitted entirely instead of setting them to false.)

#464 Specifying {maxEditLength: 0} now sets a max edit length of 0 instead of no maximum.

#460 Added oneChangePerToken option.

#467 Consistent ordering of arguments to comparator(left, right). Values from the old array will now consistently be passed as the first argument (left) and values from the new array as the second argument (right). Previously this was almost (but not quite) always the other way round.

#480 Passing maxEditLength to createPatch & createTwoFilesPatch now works properly (i.e. returns undefined if the max edit distance is exceeded; previous behavior was to crash with a TypeError if the edit distance was exceeded).

#486 The ignoreWhitespace option of diffLines behaves more sensibly now. values in returned change objects now include leading/trailing whitespace even when ignoreWhitespace is used, just like how with ignoreCase the values still reflect the case of one of the original texts instead of being all-lowercase. ignoreWhitespace is also now compatible with newlineIsToken. Finally, diffTrimmedLines is deprecated (and removed from the docs) in favour of using diffLines with ignoreWhitespace: true; the two are, and always have been, equivalent.

#490 When calling diffing functions in async mode by passing a callback option, the diff result will now be passed as the first argument to the callback instead of the second. (Previously, the first argument was never used at all and would always have value undefined.)

#489 this.options no longer exists on Diff objects. Instead, options is now passed as an argument to methods that rely on options, like equals(left, right, options). This fixes a race condition in async mode, where diffing behaviour could be changed mid-execution if a concurrent usage of the same Diff instances overwrote its options.

#518 linedelimiters no longer exists on patch objects; instead, when a patch with Windows-style CRLF line endings is parsed, the lines in lines will end with \r. There is now a new autoConvertLineEndings option, on by default, which makes it so that when a patch with Windows-style line endings is applied to a source file with Unix style line endings, the patch gets autoconverted to use Unix-style line endings, and when a patch with Unix-style line endings is applied to a source file with Windows-style line endings, it gets autoconverted to use Windows-style line endings.

#521 the callback option is now supported by structuredPatch, createPatch, and createTwoFilesPatch

#529 parsePatch can now parse patches where lines starting with -- or ++ are deleted/inserted; previously, there were edge cases where the parser would choke on valid patches or give wrong results.

#530 Added ignoreNewlineAtEof option to diffLines

#533 applyPatch uses an entirely new algorithm for fuzzy matching. Differences between the old and new algorithm are as follows:

The fuzzFactor now indicates the maximum Levenshtein distance that there can be between the context shown in a hunk and the actual file content at a location where we try to apply the hunk. (Previously, it represented a maximum Hamming distance, meaning that a single insertion or deletion in the source file could stop a hunk from applying even with a high fuzzFactor.)

A hunk containing a deletion can now only be applied in a context where the line to be deleted actually appears verbatim. (Previously, as long as enough context lines in the hunk matched, applyPatch would apply the hunk anyway and delete a completely different line.)

The context line immediately before and immediately after an insertion must match exactly between the hunk and the file for a hunk to apply. (Previously this was not required.)

#535 A bug in patch generation functions is now fixed that would sometimes previously cause \ No newline at end of file to appear in the wrong place in the generated patch, resulting in the patch being invalid. These invalid patches can also no longer be applied successfully with applyPatch. (It was already the case that tools other than jsdiff, like GNU patch, would consider them malformed and refuse to apply them; versions of jsdiff with this fix now do the same thing if you ask them to apply a malformed patch emitted by jsdiff v5.)

#535 Passing newlineIsToken: true to patch-generation functions is no longer allowed. (Passing it to diffLines is still supported - it's only functions like createPatch where passing newlineIsToken is now an error.) Allowing it to be passed never really made sense, since in cases where the option had any effect on the output at all, the effect tended to be causing a garbled patch to be created that couldn't actually be applied to the source file.

#539 diffWords now takes an optional intlSegmenter option which should be an Intl.Segmenter with word-level granularity. This provides better tokenization of text into words than the default behaviour, even for English but especially for some other languages for which the default behaviour is poor.

v5.2.2 - January 2026

Only change from 5.2.0 is a backport of the fix to GHSA-73rr-hh4g-fpgx.

v5.2.1 (deprecated)

... (truncated)

Commits

See full diff in compare view

Updates dompurify from 3.4.2 to 3.4.8

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.8

Cleaned up the repository root, renamed some and removed unneeded files

Fixed an issue with handling of Trusted Types policies, thanks @fulstadev

Fixed the node iterator for better template scrubbing, thanks @IamLeandrooooo

Included formerly missing LICENSE-MPL in published npm package, thanks @asamuzaK

Bumped several dependencies where possible

DOMPurify 3.4.7

Hardened the handling of Shadow Roots when using IN_PLACE, thanks @GameZoneHacker

Removed a problem leading to permanent hook pollution, thanks @offset

Refactored the test suite and expanded test coverage significantly

DOMPurify 3.4.6

Fixed several issues with DOM Clobbering in IN_PLACE mode, thanks @offset & @Bankde

Hardened the checks for cross-realm IN_PLACE and Shadow DOM sanitization, thanks @offset & @Bankde

Added more test coverage for IN_PLACE and general DOM Clobbering attacks

Bumped several dependencies where possible

DOMPurify 3.4.5

Fixed a bypass caused by the new HTML element selectedcontent added in 3.4.4, thanks @KabirAcharya

Note that this is a security release for an issue introduced in 3.4.4 and should be upgraded to immediately.

DOMPurify 3.4.4

Added the selectedcontent element to default allow-list, thanks @lukewarlow

Added the command and commandfor attributes to default allowed-list, thanks @lukewarlow

Added better template scrubbing for IN_PLACE operations, thanks @DEMON1A

Added stronger checks for cross-realm windows, thanks @DEMON1A & @fg0x0

Updated demo website and made sure it uses the latest from main

Updated existing workflows, fuzzer, dependabot, etc., added more tests

Bumped several dependencies where possible

🚨 This release had been flagged as deprecated, please use DOMPurify 3.4.5 instead 🚨

DOMPurify 3.4.3

Fixed an issue with handling of nested Shadow DOM trees, thanks @fishjojo1

Fixed the template regexes to be more robust against ReDoS attacks, thanks @aleung27

Updated the node iteration code to catch more Shadow DOM related issues

Updated Playwright and added Node 26 to test matrix

Updated existing workflows, fuzzer, release signing, etc., added more tests

Bumped several dependencies where possible

Commits

bcdd828 release: 3.4.8 (#1439)
ca30f07 release: 3.4.7 (#1414)
bb7739e release: 3.4.6 (#1394)
011b0c7 release: 3.4.5 (#1382)
5817ad9 release: 3.4.4 (#1374)
520edb0 release: 3.4.3 (#1352)
See full diff in compare view

Updates mermaid to 11.15.0

Release notes

Sourced from mermaid's releases.

mermaid@11.15.0

Minor Changes
#7174 0aca217 Thanks @milesspencer35! - feat(sequence): Add support for decimal start and increment values in the autonumber directive

#7512 8e17492 Thanks @aruncveli! - feat(flowchart): add datastore shape

In Data flow diagrams, a datastore/warehouse/file/database is used to represent data persistence. It is denoted by a rectangle with only top and bottom borders, and can be used in flowcharts with A@{ shape: datastore, label: "Datastore" }.

#6440 9ad8dde Thanks @yordis, @lgazo! - feat: add Event Modeling diagram

#7707 27db774 Thanks @txmxthy! - feat(architecture): expose four fcose layout knobs for architecture-beta diagrams (nodeSeparation, idealEdgeLengthMultiplier, edgeElasticity, numIter) so authors can tune layout density and spread overlapping siblings without changing diagram source
#7604 bf9502f Thanks @M-a-c! - feat(class): add nested namespace support for class diagrams via dot notation and syntactic nesting

If you have namespaces in class diagrams that use .s already and want to render them without nesting (≤v11.14.0 behaviour), you can use set class.hierarchicalNamespaces=false in your mermaid config:
config:
  class:
    hierarchicalNamespaces: false
#7272 88cdd3d Thanks @xinbenlv! - feat(sankey): add outlined label style, configurable nodeWidth/nodePadding, and custom node colors
Patch Changes

#7737 e9b0f34 Thanks @ashishjain0512! - fix: prevent unbalanced CSS styles in classDefs

#7737 37ff937 Thanks @ashishjain0512! - fix: create CSS styles using the CSSOM

This removes some invalid CSS and normalizes some CSS formatting.

#7508 bfe60cc Thanks @biiab! - fix(stateDiagram): end note now only closes a note when used on a new line

#7737 faafb5d Thanks @ashishjain0512! - fix(gantt): add iteration limit for excludes field

#7737 65f8be2 Thanks @ashishjain0512! - fix: disallow some CSS at-rules in custom CSS

#7726 1502f32 Thanks @aloisklink! - fix(wardley): fix unnecessary sanitization of text

#7578 1f98db8 Thanks @Gaston202! - fix(class): self-referential class multiplicity labels no longer rendered multiple times

Fixes #7560. Resolves an issue where cardinality labels on self-referential class relationships were rendered three times due to edge splitting in the dagre layout. The fix ensures that each sub-edge only carries its relevant label positions.

#7592 2343e38 Thanks @knsv-bot! - fix(sequence): add background box behind alt/else section title labels in sequence diagrams

#7589 7fb9509 Thanks @NYCU-Chung! - fix(block): prevent column widths from shrinking when mixing different column spans

#7632 3f9e0f1 Thanks @ekiauhce! - fix(sequence): correct messageAlign label position for right-to-left arrows in sequence diagrams

... (truncated)

Commits

See full diff in compare view

Updates playcanvas from 2.18.1 to 2.19.2

Release notes

Sourced from playcanvas's releases.

v2.19.2

Fixes

Support HTML-in-Canvas textures via copyElementImageToTexture (WebGPU) by @mvaligursky in #8810

Replace opaque any/* types with real types in public API reference by @willeastcott in #8811

Elevate the Entity class reference to peak quality by @willeastcott in #8814

Null particle module-scope vars after construction to prevent memory leak by @Skullheadx in #8809

Update HTML-in-Canvas texture upload to new API by @mvaligursky in #8828

Fix @param names/types that contradict the function signatures by @willeastcott in #8813

Apply gsplat material changes made in frame:ready the same frame by @mvaligursky in #8830

Examples

Share dialog with state-encoded URLs by @kpal81xd in #8796

Contributors

@kpal81xd

@mvaligursky

@Skullheadx

@willeastcott

New Contributors

@Skullheadx made their first contribution in #8809

Full Changelog: playcanvas/engine@v2.19.1...v2.19.2

v2.19.1

Fixes

Sort worker ReferenceError after esbuild migration by @mvaligursky in #8808

Support GSPLAT_AA in the hybrid renderer by @mvaligursky in #8807

Drop "unified" framing now that it's the default by @mvaligursky in #8805

Contributors

@mvaligursky

Full Changelog: playcanvas/engine@v2.19.0...v2.19.1

v2.19.0

Breaking changes

[BREAKING] Remove HTMLAudioElement fallback from sound system by @willeastcott in #8636

[BREAKING] Deprecate GSplatComponent#unified and default it to true by @mvaligursky in #8802

Changes

JSDoc whitespace cleanup by @willeastcott in #8616

Standardize JSDoc class overviews across components by @willeastcott in #8617

Unlink SHADER_ constants in Material.update by @willeastcott in #8621

... (truncated)

Commits

3f52bb8 2.19.2
9cc0291 fix(gsplat): apply material changes made in frame:ready the same frame (#8830)
c90406c docs: elevate the Entity class reference to peak quality (#8814)
537521a docs: fix @param names/types that contradict the function signatures (#8813)
2e4455a docs: replace opaque any/* types with real types in public API reference (#8811)
90802d4 fix: update HTML-in-Canvas texture upload to new API (#8828)
ef37e84 feat(webgpu): support HTML-in-Canvas textures via copyElementImageToTexture (...
0282eba feat(examples): share dialog with state-encoded URLs (#8796)
62c484d fix(particle): null module-scope vars after construction to prevent memory le...
9069deb 2.19.1
Additional commits viewable in compare view

Updates vue from 3.5.34 to 3.5.35

Release notes

Sourced from vue's releases.

v3.5.35

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

Changelog

Sourced from vue's changelog.

3.5.35 (2026-05-27)

Bug Fixes

compiler-core: avoid double processing v-for keys with v-memo (#14861) (34a0ded), closes #14859

compiler-sfc: resolve top-level exports from files registered as global types (#14805) (3d077f2), closes nuxt/nuxt#33694

runtime-core: avoid repeated hydration mismatch checks (#14857) (170fc95), closes #14855

runtime-core: skip idle persisted transition hooks in keep-alive moves (#14865) (80fc139), closes #14031

server-renderer: propagate sync errors from ssrRenderSuspense (#14804) (4760997), closes nuxt/nuxt#28162

teleport: skip child unmount when pending mount discarded (#14876) (#14877) (584beb1)

Performance Improvements

reactivity: skip type checks for cached proxies (#14860) (5734fe9)

runtime-dom: optimize array event handler dispatch (#14828) (bb18dc8)

server-renderer: avoid materializing iterables in ssrRenderList (#14821) (1b7a2cc)

Commits

8be32d6 release: v3.5.35
80fc139 fix(runtime-core): skip idle persisted transition hooks in keep-alive moves (...
d6c7371 ci: use backup action for size report comments
bb18dc8 perf(runtime-dom): optimize array event handler dispatch (#14828)
5734fe9 perf(reactivity): skip type checks for cached proxies (#14860)
584beb1 fix(teleport): skip child unmount when pending mount discarded (#14876) (#14877)
34a0ded fix(compiler-core): avoid double processing v-for keys with v-memo (#14861)
170fc95 fix(runtime-core): avoid repeated hydration mismatch checks (#14857)
1b7a2cc perf(server-renderer): avoid materializing iterables in ssrRenderList (#14821)
3d077f2 fix(compiler-sfc): resolve top-level exports from files registered as global ...
Additional commits viewable in compare view

Updates sass from 1.99.0 to 1.100.0

Release notes

Sourced from sass's releases.

Dart Sass 1.100.0

To install Sass 1.100.0, download one of the packages below and

…tory with 8 updates Updates the requirements on [axios](https://github.com/axios/axios), [diff](https://github.com/kpdecker/jsdiff), [dompurify](https://github.com/cure53/DOMPurify), [mermaid](https://github.com/mermaid-js/mermaid), [playcanvas](https://github.com/playcanvas/engine), [vue](https://github.com/vuejs/core), [sass](https://github.com/sass/dart-sass) and [vite-ssg](https://github.com/antfu-collective/vite-ssg) to permit the latest version. Updates `axios` from 1.16.0 to 1.17.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.16.0...v1.17.0) Updates `diff` to 7.0.0 - [Changelog](https://github.com/kpdecker/jsdiff/blob/master/release-notes.md) - [Commits](kpdecker/jsdiff@7.0.0...7.0.0) Updates `dompurify` from 3.4.2 to 3.4.8 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.4.2...3.4.8) Updates `mermaid` to 11.15.0 - [Release notes](https://github.com/mermaid-js/mermaid/releases) - [Commits](https://github.com/mermaid-js/mermaid/compare/mermaid@11.15.0...mermaid@11.15.0) Updates `playcanvas` from 2.18.1 to 2.19.2 - [Release notes](https://github.com/playcanvas/engine/releases) - [Commits](playcanvas/engine@v2.18.1...v2.19.2) Updates `vue` from 3.5.34 to 3.5.35 - [Release notes](https://github.com/vuejs/core/releases) - [Changelog](https://github.com/vuejs/core/blob/main/CHANGELOG.md) - [Commits](vuejs/core@v3.5.34...v3.5.35) Updates `sass` from 1.99.0 to 1.100.0 - [Release notes](https://github.com/sass/dart-sass/releases) - [Changelog](https://github.com/sass/dart-sass/blob/main/CHANGELOG.md) - [Commits](sass/dart-sass@1.99.0...1.100.0) Updates `vite-ssg` to 0.23.8 - [Release notes](https://github.com/antfu-collective/vite-ssg/releases) - [Commits](antfu-collective/vite-ssg@v0.23.8...v0.23.8) --- updated-dependencies: - dependency-name: axios dependency-version: 1.17.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: frontend-minor-patch - dependency-name: diff dependency-version: 7.0.0 dependency-type: direct:production dependency-group: frontend-minor-patch - dependency-name: dompurify dependency-version: 3.4.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: frontend-minor-patch - dependency-name: mermaid dependency-version: 11.15.0 dependency-type: direct:production dependency-group: frontend-minor-patch - dependency-name: playcanvas dependency-version: 2.19.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: frontend-minor-patch - dependency-name: vue dependency-version: 3.5.35 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: frontend-minor-patch - dependency-name: sass dependency-version: 1.100.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: frontend-minor-patch - dependency-name: vite-ssg dependency-version: 0.23.8 dependency-type: direct:development dependency-group: frontend-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-06-04T04:42:14Z

Labels

The following labels could not be found: dependencies, frontend. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

dependabot · 2026-06-08T04:28:36Z

Looks like these dependencies are no longer updatable, so this is no longer needed.

dependabot Bot requested a review from mickyarun as a code owner June 4, 2026 04:42

dependabot Bot closed this Jun 8, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/frontend/frontend-minor-patch-a4ffd7cf8b branch June 8, 2026 04:28

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps)(deps): bump the frontend-minor-patch group across 1 directory with 8 updates - #208

chore(deps)(deps): bump the frontend-minor-patch group across 1 directory with 8 updates#208
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/frontend/frontend-minor-patch-a4ffd7cf8b

dependabot Bot commented on behalf of github Jun 4, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Jun 4, 2026

Uh oh!

dependabot Bot commented on behalf of github Jun 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Jun 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v1.17.0 — June 1, 2026

🔒 Security Fixes

🚀 New Features

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

v1.17.0 — June 1, 2026

🔒 Security Fixes

🚀 New Features

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

7.0.0

6.0.0

v5.2.2 - January 2026

v5.2.1 (deprecated)

DOMPurify 3.4.8

DOMPurify 3.4.7

DOMPurify 3.4.6

DOMPurify 3.4.5

DOMPurify 3.4.4

DOMPurify 3.4.3

mermaid@11.15.0

Minor Changes

Patch Changes

v2.19.2

Fixes

Examples

Contributors

New Contributors

v2.19.1

Fixes

Contributors

v2.19.0

Breaking changes

Changes

v3.5.35

3.5.35 (2026-05-27)

Bug Fixes

Performance Improvements

Dart Sass 1.100.0

Uh oh!

dependabot Bot commented on behalf of github Jun 4, 2026

Labels

Uh oh!

dependabot Bot commented on behalf of github Jun 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Jun 4, 2026 •

edited

Loading