Skip to content

Bump the npm_and_yarn group across 2 directories with 10 updates#2

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-57e4d58bdc
Closed

Bump the npm_and_yarn group across 2 directories with 10 updates#2
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-57e4d58bdc

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot Bot commented on behalf of github Jan 3, 2026

Bumps the npm_and_yarn group with 7 updates in the / directory:

Package From To
vite 5.4.11 5.4.21
astro 5.4.1 5.15.9
dompurify 3.1.7 3.2.4
js-yaml 4.1.0 4.1.1
@nuxt/devtools 1.6.3 2.6.4
glob 10.4.2 10.5.0
nuxt 3.14.1592 3.19.0

Bumps the npm_and_yarn group with 5 updates in the /apps/frontend directory:

Package From To
dompurify 3.1.7 3.2.4
js-yaml 4.1.0 4.1.1
@nuxt/devtools 1.6.3 2.6.4
glob 10.4.2 10.5.0
nuxt 3.14.1592 3.19.0

Updates vite from 5.4.11 to 5.4.21

Release notes

Sourced from vite's releases.

v5.4.21

Please refer to CHANGELOG.md for details.

v5.4.20

Please refer to CHANGELOG.md for details.

v5.4.19

Please refer to CHANGELOG.md for details.

v5.4.18

Please refer to CHANGELOG.md for details.

v5.4.17

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

5.4.21 (2025-10-20)

5.4.20 (2025-09-08)

5.4.19 (2025-04-30)

5.4.18 (2025-04-10)

5.4.17 (2025-04-03)

5.4.16 (2025-03-31)

5.4.15 (2025-03-24)

5.4.14 (2025-01-21)

... (truncated)

Commits

Updates astro from 5.4.1 to 5.15.9

Release notes

Sourced from astro's releases.

astro@5.15.9

Patch Changes

  • #14786 758a891 Thanks @​mef! - Add handling of invalid encrypted props and slots in server islands.

  • #14783 504958f Thanks @​florian-lefebvre! - Improves the experimental Fonts API build log to show the number of downloaded files. This can help spotting excessive downloading because of misconfiguration

  • #14791 9e9c528 Thanks @​Princesseuh! - Changes the remote protocol checks for images to require explicit authorization in order to use data URIs.

    In order to allow data URIs for remote images, you will need to update your astro.config.mjs file to include the following configuration:

    // astro.config.mjs
import { defineConfig } from 'astro/config';
export default defineConfig({
images: {
remotePatterns: [
{
protocol: 'data',
},
],
},
});

  • #14787 0f75f6b Thanks @​matthewp! - Fixes wildcard hostname pattern matching to correctly reject hostnames without dots

    Previously, hostnames like localhost or other single-part names would incorrectly match patterns like *.example.com. The wildcard matching logic has been corrected to ensure that only valid subdomains matching the pattern are accepted.

  • #14776 3537876 Thanks @​ktym4a! - Fixes the behavior of passthroughImageService so it does not generate webp.

  • Updated dependencies [9e9c528, 0f75f6b]:

    • @​astrojs/internal-helpers@​0.7.5
    • @​astrojs/markdown-remark@​6.3.9

astro@5.15.8

Patch Changes

  • #14772 00c579a Thanks @​matthewp! - Improves the security of Server Islands slots by encrypting them before transmission to the browser, matching the security model used for props. This improves the integrity of slot content and prevents injection attacks, even when component templates don't explicitly support slots.

    Slots continue to work as expected for normal usage—this change has no breaking changes for legitimate requests.

  • #14771 6f80081 Thanks @​matthewp! - Fix middleware pathname matching by normalizing URL-encoded paths

    Middleware now receives normalized pathname values, ensuring that encoded paths like /%61dmin are properly decoded to /admin before middleware checks. This prevents potential security issues where middleware checks might be bypassed through URL encoding.

astro@5.15.7

Patch Changes

... (truncated)

Changelog

Sourced from astro's changelog.

5.15.9

Patch Changes

  • #14786 758a891 Thanks @​mef! - Add handling of invalid encrypted props and slots in server islands.

  • #14783 504958f Thanks @​florian-lefebvre! - Improves the experimental Fonts API build log to show the number of downloaded files. This can help spotting excessive downloading because of misconfiguration

  • #14791 9e9c528 Thanks @​Princesseuh! - Changes the remote protocol checks for images to require explicit authorization in order to use data URIs.

    In order to allow data URIs for remote images, you will need to update your astro.config.mjs file to include the following configuration:

    // astro.config.mjs
import { defineConfig } from 'astro/config';
export default defineConfig({
images: {
remotePatterns: [
{
protocol: 'data',
},
],
},
});

  • #14787 0f75f6b Thanks @​matthewp! - Fixes wildcard hostname pattern matching to correctly reject hostnames without dots

    Previously, hostnames like localhost or other single-part names would incorrectly match patterns like *.example.com. The wildcard matching logic has been corrected to ensure that only valid subdomains matching the pattern are accepted.

  • #14776 3537876 Thanks @​ktym4a! - Fixes the behavior of passthroughImageService so it does not generate webp.

  • Updated dependencies [9e9c528, 0f75f6b]:

    • @​astrojs/internal-helpers@​0.7.5
    • @​astrojs/markdown-remark@​6.3.9

5.15.8

Patch Changes

  • #14772 00c579a Thanks @​matthewp! - Improves the security of Server Islands slots by encrypting them before transmission to the browser, matching the security model used for props. This improves the integrity of slot content and prevents injection attacks, even when component templates don't explicitly support slots.

    Slots continue to work as expected for normal usage—this change has no breaking changes for legitimate requests.

  • #14771 6f80081 Thanks @​matthewp! - Fix middleware pathname matching by normalizing URL-encoded paths

    Middleware now receives normalized pathname values, ensuring that encoded paths like /%61dmin are properly decoded to /admin before middleware checks. This prevents potential security issues where middleware checks might be bypassed through URL encoding.

5.15.7

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for astro since your current version.


Updates dompurify from 3.1.7 to 3.2.4

Release notes

Sourced from dompurify's releases.

DOMPurify 3.2.4

  • Fixed a conditional and config dependent mXSS-style bypass reported by @​nsysean
  • Added a new feature to allow specific hook removal, thanks @​davecardwell
  • Added purify.js and purify.min.js to exports, thanks @​Aetherinox
  • Added better logic in case no window object is president, thanks @​yehuya
  • Updated some dependencies called out by dependabot
  • Updated license files etc to show the correct year

DOMPurify 3.2.3

DOMPurify 3.2.2

  • Fixed a possible bypass in case a rather specific config for custom elements is set, thanks @​yaniv-git
  • Fixed several minor issues with the type definitions, thanks again @​reduckted
  • Fixed a minor issue with the types reference for trusted types, thanks @​reduckted
  • Fixed a minor problem with the template detection regex on some systems, thanks @​svdb99

DOMPurify 3.2.1

DOMPurify 3.2.0

Commits
  • ec29e65 Merge pull request #1062 from cure53/main
  • 1c1b183 chore: Preparing 3.2.4 release
  • d18ffcb fix: Changed the template literal regex to avoid a config-dependent bypass
  • 0d64d2b Merge pull request #1060 from yehuya/initializeTestImprovements
  • 9ad7933 tests: DOMPurify custom window tests improvements
  • 72760ca Merge pull request #1059 from yehuya/fixMissingWindowElement
  • bc72d44 Fix tests
  • 363a89d fix: handle undefined Element in DOMPurify initialization
  • f41b45d Update LICENSE
  • b25bf26 Update README.md
  • Additional commits viewable in compare view

Updates js-yaml from 4.1.0 to 4.1.1

Changelog

Sourced from js-yaml's changelog.

[4.1.1] - 2025-11-12

Security

  • Fix prototype pollution issue in yaml merge (<<) operator.
Commits

Updates @nuxt/devtools from 1.6.3 to 2.6.4

Release notes

Sourced from @​nuxt/devtools's releases.

v2.6.4

   🐞 Bug Fixes

  • Using textContent instead of innerHtml for auth pagechore: update lock  -  by @​antfu (7cadb)
    View changes on GitHub

v2.6.3

No significant changes

    View changes on GitHub

v2.6.2

   🐞 Bug Fixes

    View changes on GitHub

v2.6.1

   🐞 Bug Fixes

    View changes on GitHub

v2.6.0

   🚀 Features

   🐞 Bug Fixes

    View changes on GitHub

v2.5.0

   🚀 Features

   🐞 Bug Fixes

    View changes on GitHub

v2.5.0-beta.2

   🐞 Bug Fixes

... (truncated)

Changelog

Sourced from @​nuxt/devtools's changelog.

2.6.4 (2025-09-19)

Bug Fixes

  • using textContent instead of innerHtml for auth pagechore: update lock (7cadbbe)

2.6.3 (2025-08-22)

2.6.2 (2025-07-02)

Bug Fixes

2.6.1 (2025-07-01)

Bug Fixes

2.6.0 (2025-06-29)

Bug Fixes

Features

2.5.0 (2025-06-04)

2.5.0-beta.2 (2025-06-04)

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @​nuxt/devtools since your current version.


Updates glob from 10.4.2 to 10.5.0

Commits

Updates nuxt from 3.14.1592 to 3.19.0

Release notes

Sourced from nuxt's releases.

v3.19.0

👀 Highlights

Please see the release notes for Nuxt v4.1 for full details on the features and fixes in Nuxt v3.19.

✅ Upgrading

As usual, our recommendation for upgrading is to run:

npx nuxt upgrade --dedupe

This will refresh your lockfile and pull in all the latest dependencies that Nuxt relies on, especially from the unjs ecosystem.

👉 Changelog

compare changes

🚀 Enhancements

  • kit: Add ignore option to resolveFiles (#32858)
  • kit: Add onInstall and onUpgrade module hooks (#32397)
  • nuxt,vite: Add experimental support for rolldown-vite (#31812)
  • nuxt: Extract defineRouteRules to page rules property (#32897)
  • nuxt,vite: Use importmap to increase chunk stability (#33075)
  • nuxt: Lazy hydration macros without auto-imports (#33037)
  • kit,nuxt,schema: Allow modules to specify dependencies (#33063)
  • kit,nuxt: Add getLayerDirectories util and refactor to use it (#33098)

🔥 Performance

  • nuxt: Clear inline route rules cache when pages change (#32877)
  • nuxt: Stop watching app manifest once a change has been detected (#32880)

🩹 Fixes

  • nuxt: Handle satisfies in page augmentation (#32902)
  • nuxt: Type response in useFetch hooks (#32891)
  • nuxt: Add TS parenthesis and as expression for page meta extraction (#32914)
  • nuxt: Use correct unit thresholds for relative time (#32893)
  • nuxt: Handle uncached current build manifests (#32913)
  • kit: Resolve directories in resolvePath and normalize file extensions (#32857)
  • schema,vite: Bump requestTimeout + allow configuration (#32874)
  • nuxt: Deep merge extracted route meta (#32887)
  • nuxt: Do not expose app components until fully resolved (#32993)
  • kit: Only exclude node_modules/ if no custom srcDir (#32987)
  • nuxt: Compare final matched routes when syncing route object (#32899)
  • nuxt: Make vue server warnings much less verbose in dev mode (#33018)
  • schema: Allow disabling cssnano/autoprefixer postcss plugins (#33016)
  • kit: Ensure local layers are prioritised alphabetically (#33030)
  • kit,nuxt: Expose global types to vue compiler (#33026)
  • nuxt: Support config type inference for defineNuxtModule().with() (#33081)
  • nuxt: Search for colliding names in route children (31a9282c2)
  • nuxt: Delete nuxtApp._runningTransition on resolve (#33025)
  • nuxt: Add validation for nuxt island reviver key (#33069)

... (truncated)

Commits
  • 8956505 v3.19.0
  • 9a3b445 test: update test for app creation
  • ae8b0d2 fix(kit): prioritise local layers over extended layers
  • 2fd3bc2 feat(kit,nuxt): add getLayerDirectories util and refactor to use it (#33098)
  • 6cc79dd feat(kit,nuxt,schema): allow modules to specify dependencies (#33063)
  • 78153ba fix(nuxt): add validation for nuxt island reviver key (#33069)
  • f4e38b7 fix(nuxt): delete nuxtApp._runningTransition on resolve (#33025)
  • 31a9282 fix(nuxt): search for colliding names in route children
  • 10fd012 refactor(kit,nuxt,ui-templates,vite): address deprecations + improve regexp p...
  • 04dda84 feat(nuxt): lazy hydration macros without auto-imports (#33037)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for nuxt since your current version.


Updates @nuxt/vite-builder from 3.14.1592 to 3.19.0

Release notes

Sourced from @​nuxt/vite-builder's releases.

v3.19.0

👀 Highlights

Please see the release notes for Nuxt v4.1 for full details on the features and fixes in Nuxt v3.19.

✅ Upgrading

As usual, our recommendation for upgrading is to run:

npx nuxt upgrade --dedupe

This will refresh your lockfile and pull in all the latest dependencies that Nuxt relies on, especially from the unjs ecosystem.

👉 Changelog

compare changes

🚀 Enhancements

  • kit: Add ignore option to resolveFiles (#32858)
  • kit: Add onInstall and onUpgrade module hooks (#32397)
  • nuxt,vite: Add experimental support for rolldown-vite (#31812)
  • nuxt: Extract defineRouteRules to page rules property (#32897)
  • nuxt,vite: Use importmap to increase chunk stability (#33075)
  • nuxt: Lazy hydration macros without auto-imports (#33037)
  • kit,nuxt,schema: Allow modules to specify dependencies (#33063)
  • kit,nuxt: Add getLayerDirectories util and refactor to use it (#33098)

🔥 Performance

  • nuxt: Clear inline route rules cache when pages change (#32877)
  • nuxt: Stop watching app manifest once a change has been detected (#32880)

🩹 Fixes

  • nuxt: Handle satisfies in page augmentation (#32902)
  • nuxt: Type response in useFetch hooks (#32891)
  • nuxt: Add TS parenthesis and as expression for page meta extraction (#32914)
  • nuxt: Use correct unit thresholds for relative time (#32893)
  • nuxt: Handle uncached current build manifests (#32913)
  • kit: Resolve directories in resolvePath and normalize file extensions (#32857)
  • schema,vite: Bump requestTimeout + allow configuration (#32874)
  • nuxt: Deep merge extracted route meta (#32887)
  • nuxt: Do not expose app components until fully resolved (#32993)
  • kit: Only exclude node_modules/ if no custom srcDir (#32987)
  • nuxt: Compare final matched routes when syncing route object (#32899)
  • nuxt: Make vue server warnings much less verbose in dev mode (#33018)
  • schema: Allow disabling cssnano/autoprefixer postcss plugins (#33016)
  • kit: Ensure local layers are prioritised alphabetically (#33030)
  • kit,nuxt: Expose global types to vue compiler (#33026)
  • nuxt: Support config type inference for defineNuxtModule().with() (#33081)
  • nuxt: Search for colliding names in route children (31a9282c2)
  • nuxt: Delete nuxtApp._runningTransition on resolve (#33025)
  • nuxt: Add validation for nuxt island reviver key (#33069)

... (truncated)

Commits
  • 8956505 v3.19.0
  • 2fd3bc2 feat(kit,nuxt): add getLayerDirectories util and refactor to use it (#33098)
  • 10fd012 refactor(kit,nuxt,ui-templates,vite): address deprecations + improve regexp p...
  • 9ea90fc refactor(vite): simplify inline chunk iteration
  • e6618e2 feat(nuxt,vite): use importmap to increase chunk stability (#33075)
  • 6ae620e feat(nuxt,vite): add experimental support for rolldown-vite (#31812)
  • bebdbf5 fix(schema,vite): bump requestTimeout + allow configuration (#32874)
  • cf7175d chore(deps): update all non-major dependencies (3.x) (#33095)
  • 436cf01 chore(deps): update all non-major dependencies (3.x) (#33062)
  • 4b5b219 chore(deps): update all non-major dependencies (3.x) (#33055)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @​nuxt/vite-builder since your current version.


Updates devalue from 5.1.1 to 5.6.1

Release notes

Sourced from devalue's releases.

v5.6.1

Patch Changes

  • 2161d44: fix: add hasOwn check before calling reviver

v5.6.0

Minor Changes

  • a3d09d4: feat: expose DevalueError for instanceof checks in catch clauses
  • a3d09d4: feat: add value and root properties in DevalueError instances

v5.5.0

Minor Changes

  • 828fa1c: Enable support for custom reducer/reviver for "function" values

v5.4.2

Patch Changes

  • 5c26c0d: fix: allow custom revivers to revive things serialized by builtin reducers

v5.4.1

Patch Changes

  • ca3c7b6: chore: Remove impossible void type from replacer's uneval

v5.4.0

Minor Changes

  • 9306d09: feat: pass uneval to replacer, for handling nested custom types

Patch Changes

  • b617c7c: perf: shrink uneval output with null-proto objects

v5.3.2

Patch Changes

  • 0623a47: fix: disallow array method access when parsing
  • 0623a47: fix: disallow __proto__ properties on objects

v5.3.1

Patch Changes

  • ae904c5: fix: correctly differentiate between +0 and -0

v5.3.0

Minor Changes

  • 2896e7b: feat: support Temporal

... (truncated)

Changelog

Sourced from devalue's changelog.

5.6.1

Patch Changes

  • 2161d44: fix: add hasOwn check before calling reviver

5.6.0

Minor Changes

  • a3d09d4: feat: expose DevalueError for instanceof checks in catch clauses
  • a3d09d4: feat: add value and root properties in DevalueError instances

5.5.0

Minor Changes

  • 828fa1c: Enable support for custom reducer/reviver for "function" values

5.4.2

Patch Changes

  • 5c26c0d: fix: allow custom revivers to revive things serialized by builtin reducers

5.4.1

Patch Changes

  • ca3c7b6: chore: Remove impossible void type from replacer's uneval

5.4.0

Minor Changes

  • 9306d09: feat: pass uneval to replacer, for handling nested custom types

Patch Changes

  • b617c7c: perf: shrink uneval output with null-proto objects

5.3.2

Patch Changes

  • 0623a47: fix: disallow array method access when parsing
  • 0623a47: fix: disallow __proto__ properties on objects

5.3.1

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for devalue since your current version.


Updates node-forge from 1.3.1 to 1.3.3

Changelog

Sourced from node-forge's changelog.

1.3.3 - 2025-12-02

Fixed

  • [pkcs12] Make digestAlgorithm parameters optional to fix PKCS#12/PFX issues introduced in 1.3.2.

1.3.2 - 2025-11-25

Security

  • HIGH: ASN.1 Validator Desynchronization
    • An Interpretation Conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.
    • Reported by Hunter Wodzenski.
    • CVE ID: CVE-2025-12816
    • GHSA ID: GHSA-5gfm-wpxj-wjgq
  • HIGH: ASN.1 Unbounded Recursion
    • An Uncontrolled Recursion (CWE-674) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 structures that trigger unbounded recursive parsing. This leads to a Denial-of-Service (DoS) via stack exhaustion when parsing untrusted DER inputs.
    • Reported by Hunter Wodzenski.
    • CVE ID: CVE-2025-66031
    • GHSA ID: GHSA-554w-wpv2-vw27
  • MODERATE: ASN.1 OID Integer Truncation
    • An Integer Overflow (CWE-190) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures containing OIDs with oversized arcs. These arcs may be decoded as smaller, trusted OIDs due to 32-bit bitwise truncation, enabling the bypass of downstream OID-based security decisions.
    • Reported by Hunter Wodzenski.
    • CVE ID: CVE-2025-66030
    • GHSA ID: GHSA-65ch-62r8-g69g

Fixed

  • [asn1] Fix for vulnerability identified by CVE-2025-12816 PKCS#12 MAC verification bypass due to missing macData enforcement and improper asn1.validate routine.
  • [asn1] Add fromDer() max recursion depth check.
    • Add a asn1.maxDepth global configurable maximum depth of 256.
    • Add a asn1.fromDer() per-call maxDepth option.
    • NOTE: The default maximum is assumed t...

      Description has been truncated

@dependabot
Bump the npm_and_yarn group across 2 directories with 10 updates
49fc002 
Bumps the npm_and_yarn group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `5.4.11` | `5.4.21` |
| [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `5.4.1` | `5.15.9` |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.1.7` | `3.2.4` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.0` | `4.1.1` |
| [@nuxt/devtools](https://github.com/nuxt/devtools/tree/HEAD/packages/devtools) | `1.6.3` | `2.6.4` |
| [glob](https://github.com/isaacs/node-glob) | `10.4.2` | `10.5.0` |
| [nuxt](https://github.com/nuxt/nuxt/tree/HEAD/packages/nuxt) | `3.14.1592` | `3.19.0` |

Bumps the npm_and_yarn group with 5 updates in the /apps/frontend directory:

| Package | From | To |
| --- | --- | --- |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.1.7` | `3.2.4` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.0` | `4.1.1` |
| [@nuxt/devtools](https://github.com/nuxt/devtools/tree/HEAD/packages/devtools) | `1.6.3` | `2.6.4` |
| [glob](https://github.com/isaacs/node-glob) | `10.4.2` | `10.5.0` |
| [nuxt](https://github.com/nuxt/nuxt/tree/HEAD/packages/nuxt) | `3.14.1592` | `3.19.0` |



Updates `vite` from 5.4.11 to 5.4.21
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v5.4.21/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v5.4.21/packages/vite)

Updates `astro` from 5.4.1 to 5.15.9
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@5.15.9/packages/astro)

Updates `dompurify` from 3.1.7 to 3.2.4
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.1.7...3.2.4)

Updates `js-yaml` from 4.1.0 to 4.1.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.1.1)

Updates `@nuxt/devtools` from 1.6.3 to 2.6.4
- [Release notes](https://github.com/nuxt/devtools/releases)
- [Changelog](https://github.com/nuxt/devtools/blob/main/CHANGELOG.md)
- [Commits](https://github.com/nuxt/devtools/commits/v2.6.4/packages/devtools)

Updates `glob` from 10.4.2 to 10.5.0
- [Changelog](https://github.com/isaacs/node-glob/blob/main/changelog.md)
- [Commits](isaacs/node-glob@v10.4.2...v10.5.0)

Updates `nuxt` from 3.14.1592 to 3.19.0
- [Release notes](https://github.com/nuxt/nuxt/releases)
- [Commits](https://github.com/nuxt/nuxt/commits/v3.19.0/packages/nuxt)

Updates `@nuxt/vite-builder` from 3.14.1592 to 3.19.0
- [Release notes](https://github.com/nuxt/nuxt/releases)
- [Commits](https://github.com/nuxt/nuxt/commits/v3.19.0/packages/vite)

Updates `devalue` from 5.1.1 to 5.6.1
- [Release notes](https://github.com/sveltejs/devalue/releases)
- [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md)
- [Commits](sveltejs/devalue@v5.1.1...v5.6.1)

Updates `node-forge` from 1.3.1 to 1.3.3
- [Changelog](https://github.com/digitalbazaar/forge/blob/main/CHANGELOG.md)
- [Commits](digitalbazaar/forge@v1.3.1...v1.3.3)

Updates `dompurify` from 3.1.7 to 3.2.4
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.1.7...3.2.4)

Updates `js-yaml` from 4.1.0 to 4.1.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.1.1)

Updates `@nuxt/devtools` from 1.6.3 to 2.6.4
- [Release notes](https://github.com/nuxt/devtools/releases)
- [Changelog](https://github.com/nuxt/devtools/blob/main/CHANGELOG.md)
- [Commits](https://github.com/nuxt/devtools/commits/v2.6.4/packages/devtools)

Updates `glob` from 10.4.2 to 10.5.0
- [Changelog](https://github.com/isaacs/node-glob/blob/main/changelog.md)
- [Commits](isaacs/node-glob@v10.4.2...v10.5.0)

Updates `nuxt` from 3.14.1592 to 3.19.0
- [Release notes](https://github.com/nuxt/nuxt/releases)
- [Commits](https://github.com/nuxt/nuxt/commits/v3.19.0/packages/nuxt)

---
updated-dependencies:
- dependency-name: vite
  dependency-version: 5.4.21
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: astro
  dependency-version: 5.15.9
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: dompurify
  dependency-version: 3.2.4
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 4.1.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@nuxt/devtools"
  dependency-version: 2.6.4
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: glob
  dependency-version: 10.5.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: nuxt
  dependency-version: 3.19.0
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: "@nuxt/vite-builder"
  dependency-version: 3.19.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: devalue
  dependency-version: 5.6.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: node-forge
  dependency-version: 1.3.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: dompurify
  dependency-version: 3.2.4
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 4.1.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@nuxt/devtools"
  dependency-version: 2.6.4
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: glob
  dependency-version: 10.5.0
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: nuxt
  dependency-version: 3.19.0
  dependency-type: direct:development
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jan 3, 2026
@dependabot dependabot Bot mentioned this pull request Jan 3, 2026
Closed
@coderabbitai
Copy link
Copy Markdown

coderabbitai Bot commented Jan 3, 2026

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Comment @coderabbitai help to get the list of available commands and usage tips.

@dependabot @github
Copy link
Copy Markdown
Author

dependabot Bot commented on behalf of github Feb 20, 2026

Superseded by #4.

@dependabot dependabot Bot closed this Feb 20, 2026
@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/npm_and_yarn-57e4d58bdc branch February 20, 2026 07:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants