build(deps): bump the npm_and_yarn group across 2 directories with 16 updates#806
Open
dependabot[bot] wants to merge 2 commits into
Open
build(deps): bump the npm_and_yarn group across 2 directories with 16 updates#806dependabot[bot] wants to merge 2 commits into
dependabot[bot] wants to merge 2 commits into
Conversation
… updates Bumps the npm_and_yarn group with 13 updates in the / directory: | Package | From | To | | --- | --- | --- | | [dompurify](https://github.com/cure53/DOMPurify) | `3.2.7` | `3.4.0` | | [axios](https://github.com/axios/axios) | `1.6.2` | `1.15.2` | | [next](https://github.com/vercel/next.js) | `15.5.15` | `15.5.18` | | [uuid](https://github.com/uuidjs/uuid) | `9.0.1` | `14.0.0` | | [postcss](https://github.com/postcss/postcss) | `8.5.6` | `8.5.10` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `5.4.6` | `6.4.2` | | [@xmldom/xmldom](https://github.com/xmldom/xmldom) | `0.9.8` | `0.9.10` | | [@babel/plugin-transform-modules-systemjs](https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-modules-systemjs) | `7.27.1` | `7.29.4` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.1.0` | `3.1.2` | | [flatted](https://github.com/WebReflection/flatted) | `3.3.3` | `3.4.2` | | [immutable](https://github.com/immutable-js/immutable-js) | `5.1.3` | `5.1.5` | | [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.18.1` | | [minimatch](https://github.com/isaacs/minimatch) | `3.1.2` | `10.2.5` | Bumps the npm_and_yarn group with 5 updates in the /apps/web directory: | Package | From | To | | --- | --- | --- | | [dompurify](https://github.com/cure53/DOMPurify) | `3.2.7` | `3.4.0` | | [axios](https://github.com/axios/axios) | `1.6.2` | `1.15.2` | | [next](https://github.com/vercel/next.js) | `15.5.15` | `15.5.18` | | [uuid](https://github.com/uuidjs/uuid) | `9.0.1` | `14.0.0` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `5.4.6` | `6.4.2` | Updates `dompurify` from 3.2.7 to 3.4.0 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.2.7...3.4.0) Updates `axios` from 1.6.2 to 1.15.2 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.6.2...v1.15.2) Updates `next` from 15.5.15 to 15.5.18 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v15.5.15...v15.5.18) Updates `uuid` from 9.0.1 to 14.0.0 - [Release notes](https://github.com/uuidjs/uuid/releases) - [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md) - [Commits](uuidjs/uuid@v9.0.1...v14.0.0) Updates `postcss` from 8.5.6 to 8.5.10 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.6...8.5.10) Updates `vite` from 5.4.6 to 6.4.2 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v6.4.2/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v6.4.2/packages/vite) Updates `@xmldom/xmldom` from 0.9.8 to 0.9.10 - [Release notes](https://github.com/xmldom/xmldom/releases) - [Changelog](https://github.com/xmldom/xmldom/blob/master/CHANGELOG.md) - [Commits](xmldom/xmldom@0.9.8...0.9.10) Updates `@babel/plugin-transform-modules-systemjs` from 7.27.1 to 7.29.4 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.4/packages/babel-plugin-transform-modules-systemjs) Updates `fast-uri` from 3.1.0 to 3.1.2 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.0...v3.1.2) Updates `flatted` from 3.3.3 to 3.4.2 - [Commits](WebReflection/flatted@v3.3.3...v3.4.2) Updates `follow-redirects` from 1.15.11 to 1.16.0 - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.15.11...v1.16.0) Updates `immutable` from 5.1.3 to 5.1.5 - [Release notes](https://github.com/immutable-js/immutable-js/releases) - [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md) - [Commits](immutable-js/immutable-js@v5.1.3...v5.1.5) Updates `lodash` from 4.17.21 to 4.18.1 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.18.1) Updates `minimatch` from 3.1.2 to 10.2.5 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v3.1.2...v10.2.5) Updates `picomatch` from 2.3.1 to 2.3.2 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@2.3.1...2.3.2) Updates `rollup` from 2.79.2 to 2.80.0 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/v2.80.0/CHANGELOG.md) - [Commits](rollup/rollup@v2.79.2...v2.80.0) Updates `dompurify` from 3.2.7 to 3.4.0 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.2.7...3.4.0) Updates `axios` from 1.6.2 to 1.15.2 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.6.2...v1.15.2) Updates `next` from 15.5.15 to 15.5.18 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v15.5.15...v15.5.18) Updates `uuid` from 9.0.1 to 14.0.0 - [Release notes](https://github.com/uuidjs/uuid/releases) - [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md) - [Commits](uuidjs/uuid@v9.0.1...v14.0.0) Updates `vite` from 5.4.6 to 6.4.2 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v6.4.2/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v6.4.2/packages/vite) --- updated-dependencies: - dependency-name: dompurify dependency-version: 3.4.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: axios dependency-version: 1.15.2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.18 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: uuid dependency-version: 14.0.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.10 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 6.4.2 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: "@xmldom/xmldom" dependency-version: 0.9.10 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@babel/plugin-transform-modules-systemjs" dependency-version: 7.29.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: flatted dependency-version: 3.4.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: follow-redirects dependency-version: 1.16.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: immutable dependency-version: 5.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.18.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: minimatch dependency-version: 10.2.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 2.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: rollup dependency-version: 2.80.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: dompurify dependency-version: 3.4.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: axios dependency-version: 1.15.2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.18 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: uuid dependency-version: 14.0.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 6.4.2 dependency-type: direct:development dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Greptile SummaryThis is a Dependabot batch upgrade across the monorepo's root and
Confidence Score: 3/5The security-only package bumps (DOMPurify, Axios, Next.js, PostCSS, @xmldom/xmldom) are straightforward and urgently needed. However, the vite v5→v6 jump in apps/web leaves vitest@2.x without a compatible vite peer, which will likely break the test pipeline, and the render-helper major version bump warrants confirmation before publishing. Upgrading vite to v6 while vitest stays at v2 in apps/web introduces a peer-dependency mismatch that can silently break the test runner — and apps/self-hosted already shows the correct pattern (vitest@^3 paired with vite 6). Additionally, publishing render-helper as a major version (3.0.0) purely from a transitive dependency update needs explicit confirmation that no downstream consumers will be unexpectedly broken. apps/web/package.json (vite v6 / vitest v2 mismatch) and packages/render-helper/package.json (major version justification) Important Files Changed
Flowchart%%{init: {'theme': 'neutral'}}%%
flowchart TD
A["Dependabot PR #806\n16 package upgrades"] --> B["apps/web/package.json"]
A --> C["apps/self-hosted/package.json"]
A --> D["packages/render-helper/package.json"]
B --> B1["dompurify 3.2.7 → 3.4.0 🔒 XSS/mXSS fixes"]
B --> B2["axios 1.6.2 → 1.15.2 🔒 Proto-pollution, SSRF, CRLF"]
B --> B3["next 15.5.15 → 15.5.18 🔒 7 High advisories"]
B --> B4["uuid 9.0.1 → 14.0.0 ⚠️ 5 major versions, CJS dropped"]
B --> B5["vite 5.4.6 → 6.4.2 ⚠️ Major bump, vitest@2 incompatible"]
B --> B6["postcss 8.5.6 → 8.5.10 🔒 XSS fix"]
C --> C1["dompurify 3.2.7 → 3.4.0 🔒"]
D --> D1["@xmldom/xmldom 0.9.8 → 0.9.10 🔒 XML injection / DoS fixes"]
D --> D2["Version 2.5.4 → 3.0.0 ⚠️ Major bump for dep-only change"]
B5 -->|"Conflict"| E["vitest@^2.1.8 expects vite@^5\nneeds upgrade to vitest@^3"]
Reviews (1): Last reviewed commit: "chore: apply changeset versioning for PR..." | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| "typescript": "^5", | ||
| "vite": "^5.4.6", | ||
| "vite": "^6.4.2", | ||
| "vitest": "^2.1.8" |
There was a problem hiding this comment.
vitest@2.x declares a peer dependency on vite@^5.0.0 — it does not support vite 6. Upgrading vite to ^6.4.2 while keeping vitest: "^2.1.8" means pnpm will install an incompatible peer, which can silently break the Vite dev-server that vitest embeds for the jsdom test environment. apps/self-hosted already correctly uses "vitest": "^3.0.0" alongside vite 6-era tooling. apps/web should be co-upgraded to vitest@^3.0.0 (and @vitejs/plugin-react may need a matching bump) to avoid test-runner failures.
| "name": "@ecency/render-helper", | ||
| "private": false, | ||
| "version": "2.5.4", | ||
| "version": "3.0.0", |
There was a problem hiding this comment.
@ecency/render-helper is a published npm package. Bumping it from 2.5.4 to 3.0.0 signals breaking API changes to downstream consumers, but the only change here is updating @xmldom/xmldom from ^0.9.6 to ^0.9.10. The @xmldom/xmldom 0.9.10 release does deprecate the splitCDATASections serializer option — if the render-helper relies on that option anywhere, that would be a genuine breaking change, but otherwise a minor or patch bump seems more appropriate. Could you confirm whether any render-helper internal logic depends on deprecated @xmldom/xmldom APIs that are being removed? Is there a specific breaking change in render-helper's public API or internal xmldom usage that warrants a major version bump, or was this triggered automatically by the dependency PR tooling?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the npm_and_yarn group with 13 updates in the / directory:
3.2.73.4.01.6.21.15.215.5.1515.5.189.0.114.0.08.5.68.5.105.4.66.4.20.9.80.9.107.27.17.29.43.1.03.1.23.3.33.4.25.1.35.1.54.17.214.18.13.1.210.2.5Bumps the npm_and_yarn group with 5 updates in the /apps/web directory:
3.2.73.4.01.6.21.15.215.5.1515.5.189.0.114.0.05.4.66.4.2Updates
dompurifyfrom 3.2.7 to 3.4.0Release notes
Sourced from dompurify's releases.
Commits
5b16e0bGetting 3.x branch ready for 3.4.0 release (#1250)8bcbf73chore: Preparing 3.3.3 release5faddd6fix: engine requirement (#1210)0f91e3aUpdate README.mdd5ff1a8Merge branch 'main' of github.com:cure53/DOMPurifyc3efd48fix: moved back from jsdom 28 to jsdom 20988b888fix: moved back from jsdom 28 to jsdom 202726c74chore: Preparing 3.3.2 release6202c7ebuild(deps): bump@tootallnate/onceand jsdom (#1204)302b51dfix: Expanded the regex ever so slightly to also cover scriptUpdates
axiosfrom 1.6.2 to 1.15.2Release notes
Sourced from axios's releases.
... (truncated)
Changelog
Sourced from axios's changelog.
... (truncated)
Commits
5829343chore(release): prepare release 1.15.2 (#10789)4709a48fix: added fix for memory leak in sockets (#10788)be33360chore: update changelog (#10781)4791514fix: more header pollutions (#10779)6feafcffix: socket issue (#10777)302e273docs: update docs, add a couple actions etc (#10776)ac42446chore(release): prepare release 1.15.1 (#10767)908f220docs: update threatmodel (#10765)f93f815docs: added docs around potential decompressions bomb (#10763)1728aa1fix: short-circuits on any truthy non-boolean in withXSRFToken (#10762)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for axios since your current version.
Install script changes
This version modifies
preparescript that runs during installation. Review the package contents before updating.Updates
nextfrom 15.5.15 to 15.5.18Release notes
Sourced from next's releases.
Commits
9ff92cev15.5.1800ebe23[backport] Disable build caches for production/staging/force-preview deploys ...62c97abv15.5.17423623aTurbopack: Match proxy matchers with webpack implementation (#93594)fa78739Turbopack: Fix middleware matcher suffix (#93590)36e62c6[backport] Turbopack: more strict vergen setup (#93588)36589b5[backport][test] Pin package manager to patch versions (#93596)ad6fd4ev15.5.1679d7dffIgnore malformed CSP nonce headers (#103)c4f6908router-server: guard upgrade proxy against absolute-url SSRF (#77) (#102)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.
Updates
uuidfrom 9.0.1 to 14.0.0Release notes
Sourced from uuid's releases.
... (truncated)
Changelog
Sourced from uuid's changelog.
... (truncated)
Commits
7c1ea08chore(main): release 14.0.0 (#926)3d2c5b0Merge commit from forkf2c235ffix!: expectcryptoto be global everywhere (requires node@20+) (#935)529ef08chore: upgrade TypeScript and fixup types (#927)086fd79chore: update dependencies (#933)dc4ddb8feat!: drop node@18 support (#934)0f1f9c9chore: switch to Biome for parsing and linting (#932)e2879e6chore: use maintained version of npm-run-all (#930)ffa3138fix: Use GITHUB_TOKEN for release-please and enable npm provenance (#925)0423d49docs: remove obsolete v1 option notes (#915)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for uuid since your current version.
Install script changes
This version adds
preparescript that runs during installation. Review the package contents before updating.Updates
postcssfrom 8.5.6 to 8.5.10Release notes
Sourced from postcss's releases.
Changelog
Sourced from postcss's changelog.
Commits
33b9790Release 8.5.10 version536c79eEscape </style> in CSS output (#2074)afa96b2Update dependencies (#2073)effe88bTypo (#2072)3ee79a2Thread model (#2071)2e0683dCreate incident response docs (#2070)fe88ac2Release 8.5.9 versionc551632Avoid RegExp when we can use simple JS89a6b74Move SECURITY.txt for docs folder to keep GitHub page cleaner6ceb8a4Create SECURITY.mdUpdates
vitefrom 5.4.6 to 6.4.2Release notes
Sourced from vite's releases.
Changelog
Sourced from vite's changelog.
... (truncated)
Commits
6b3fad0release: v6.4.2ca4da5dfix: avoid path traversal with optimize deps sourcemap handler (#22161)fe28e47fix: apply server.fs check to env transport (#22159) (#22163)5487f4frelease: v6.4.11114b5dfix(dev): trim trailing slash beforeserver.fs.denycheck (#20968) (#20969)f12697crelease: v6.4.0ca6455efeat: allow passing down resolved config to vite's createServer (#20932)0e173d8release: v6.3.7c59a222fix(esbuild): inject esbuild helpers correctly for esbuild 0.25.9+ (#20940)3f337c5release: v6.3.6Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for vite since your current version.
Updates
@xmldom/xmldomfrom 0.9.8 to 0.9.10Release notes
Sourced from @xmldom/xmldom's releases.
... (truncated)
Changelog
Sourced from @xmldom/xmldom's changelog.