Bump the npm_and_yarn group across 1 directory with 5 updates by dependabot[bot] · Pull Request #137 · Renumics/lexio

dependabot · 2026-06-17T08:57:12Z

Bumps the npm_and_yarn group with 4 updates in the /lexio directory: dompurify, vite, form-data and js-yaml.

Updates dompurify from 3.4.0 to 3.4.9

Release notes

DOMPurify 3.4.9

Further improved the handling of Trusted Types config options, thanks @offset

Further improved the handling of IN_PLACE sanitization, thanks @mozfreddyb

Added more test coverage for IN_PLACE and Trusted Types related usage

Bumped several dependencies where possible

Updated README and wiki with more accurate documentation & attack samples

DOMPurify 3.4.8

Cleaned up the repository root, renamed some and removed unneeded files

Fixed an issue with handling of Trusted Types policies, thanks @fulstadev

Fixed the node iterator for better template scrubbing, thanks @IamLeandrooooo

Included formerly missing LICENSE-MPL in published npm package, thanks @asamuzaK

Bumped several dependencies where possible

DOMPurify 3.4.7

Hardened the handling of Shadow Roots when using IN_PLACE, thanks @GameZoneHacker

Removed a problem leading to permanent hook pollution, thanks @offset

Refactored the test suite and expanded test coverage significantly

DOMPurify 3.4.6

Fixed several issues with DOM Clobbering in IN_PLACE mode, thanks @offset & @Bankde

Hardened the checks for cross-realm IN_PLACE and Shadow DOM sanitization, thanks @offset & @Bankde

Added more test coverage for IN_PLACE and general DOM Clobbering attacks

Bumped several dependencies where possible

DOMPurify 3.4.5

Fixed a bypass caused by the new HTML element selectedcontent added in 3.4.4, thanks @KabirAcharya

Note that this is a security release for an issue introduced in 3.4.4 and should be upgraded to immediately.

DOMPurify 3.4.4

Added the selectedcontent element to default allow-list, thanks @lukewarlow

Added the command and commandfor attributes to default allowed-list, thanks @lukewarlow

Added better template scrubbing for IN_PLACE operations, thanks @DEMON1A

Added stronger checks for cross-realm windows, thanks @DEMON1A & @fg0x0

Updated demo website and made sure it uses the latest from main

Updated existing workflows, fuzzer, dependabot, etc., added more tests

Bumped several dependencies where possible

🚨 This release had been flagged as deprecated, please use DOMPurify 3.4.5 instead 🚨

DOMPurify 3.4.3

Fixed an issue with handling of nested Shadow DOM trees, thanks @fishjojo1

Fixed the template regexes to be more robust against ReDoS attacks, thanks @aleung27

Updated the node iteration code to catch more Shadow DOM related issues

Updated Playwright and added Node 26 to test matrix

Updated existing workflows, fuzzer, release signing, etc., added more tests

Bumped several dependencies where possible

DOMPurify 3.4.2

... (truncated)

Commits

5210247 release: 3.4.9 (#1459)
bcdd828 release: 3.4.8 (#1439)
ca30f07 release: 3.4.7 (#1414)
bb7739e release: 3.4.6 (#1394)
011b0c7 release: 3.4.5 (#1382)
5817ad9 release: 3.4.4 (#1374)
520edb0 release: 3.4.3 (#1352)
6f67fd3 Sync/3.4.2 (#1322)
5b0cdbb chore: merge main into 3.x for 3.4.1 release (#1301)
09f5911 test: added three more browsers to test setup (OSX, mobile)
See full diff in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates vite from 6.4.2 to 8.0.16

Release notes

Sourced from vite's releases.

v8.0.16

Please refer to CHANGELOG.md for details.

v8.0.15

Please refer to CHANGELOG.md for details.

v8.0.14

Please refer to CHANGELOG.md for details.

v8.0.13

Please refer to CHANGELOG.md for details.

v8.0.12

Please refer to CHANGELOG.md for details.

v8.0.11

Please refer to CHANGELOG.md for details.

v8.0.10

Please refer to CHANGELOG.md for details.

v8.0.9

Please refer to CHANGELOG.md for details.

v8.0.8

Please refer to CHANGELOG.md for details.

v8.0.7

Please refer to CHANGELOG.md for details.

v8.0.6

Please refer to CHANGELOG.md for details.

v8.0.5

Please refer to CHANGELOG.md for details.

v8.0.4

Please refer to CHANGELOG.md for details.

create-vite@8.0.3

Please refer to CHANGELOG.md for details.

v8.0.3

Please refer to CHANGELOG.md for details.

create-vite@8.0.2

Please refer to CHANGELOG.md for details.

v8.0.2

Please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from vite's changelog.

8.0.16 (2026-06-01)

Bug Fixes

deps: reject UNC paths for launch-editor-middleware (#22571) (50b9512)

reject windows alternate paths (#22572) (dc245c7)

8.0.15 (2026-06-01)

Features

send 408 on request timeout (#22476) (c85c9ee)

update rolldown to 1.0.3 (#22538) (646dbed)

Bug Fixes

capitalize error messages and remove spurious space in parse error (#22488) (85a0eff)

deps: update all non-major dependencies (#22511) (2686d7d)

dev: fix html-proxy cache key mismatch for /@fs/ HTML paths (#21762) (47c4213)

glob: error on relative glob in virtual module when no files match (#22497) (5c8e98f)

optimizer: close the rolldown bundle when write() rejects (#22528) (e3cfb9d)

resolve: provide onWarn for viteResolvePlugin in JS plugin containers (#22509) (40985f1)

Miscellaneous Chores

deps: update rolldown-related dependencies (#22566) (3052a67)

Code Refactoring

correct logic in collectAllModules function (#22562) (6978a9c)

8.0.14 (2026-05-21)

Features

update rolldown to 1.0.2 (#22484) (96efc88)

Bug Fixes

deps: update all non-major dependencies (#22471) (98b8163)

dev: handle errors when sending messages to vite server (#22450) (e8e9a34)

html: handle trailing slash paths in transformIndexHtml (#22480) (5d94d1b)

optimizer: pass oxc jsx options to transformSync in dependency scan (#22342) (b3132da)

Miscellaneous Chores

deps: update rolldown-related dependencies (#22470) (7cb728e)

remove irrelevant commits from changelog (2c69495)

Code Refactoring

glob: do not rewrite import path for absolute base (#22310) (0ae2844)

... (truncated)

Commits

f94df87 release: v8.0.16
dc245c7 fix: reject windows alternate paths (#22572)
50b9512 fix(deps): reject UNC paths for launch-editor-middleware (#22571)
8d1b019 release: v8.0.15
2686d7d fix(deps): update all non-major dependencies (#22511)
3052a67 chore(deps): update rolldown-related dependencies (#22566)
e3cfb9d fix(optimizer): close the rolldown bundle when write() rejects (#22528)
6978a9c refactor: correct logic in collectAllModules function (#22562)
646dbed feat: update rolldown to 1.0.3 (#22538)
85a0eff fix: capitalize error messages and remove spurious space in parse error (#22488)
Additional commits viewable in compare view

Updates esbuild from 0.25.10 to 0.25.12

Release notes

Sourced from esbuild's releases.

v0.25.12
Fix a minification regression with CSS media queries (#4315)

The previous release introduced support for parsing media queries which unintentionally introduced a regression with the removal of duplicate media rules during minification. Specifically the grammar for @media <media-type> and <media-condition-without-or> { ... } was missing an equality check for the <media-condition-without-or> part, so rules with different suffix clauses in this position would incorrectly compare equal and be deduplicated. This release fixes the regression.
Update the list of known JavaScript globals (#4310)

This release updates esbuild's internal list of known JavaScript globals. These are globals that are known to not have side-effects when the property is accessed. For example, accessing the global Array property is considered to be side-effect free but accessing the global scrollY property can trigger a layout, which is a side-effect. This is used by esbuild's tree-shaking to safely remove unused code that is known to be side-effect free. This update adds the following global properties:

From ES2017:

Atomics

SharedArrayBuffer

From ES2020:

BigInt64Array

BigUint64Array

From ES2021:

FinalizationRegistry

WeakRef

From ES2025:

Float16Array

Iterator

Note that this does not indicate that constructing any of these objects is side-effect free, just that accessing the identifier is side-effect free. For example, this now allows esbuild to tree-shake classes that extend from Iterator:
// This can now be tree-shaken by esbuild:
class ExampleIterator extends Iterator {}
Add support for the new @view-transition CSS rule (#4313)

With this release, esbuild now has improved support for pretty-printing and minifying the new @view-transition rule (which esbuild was previously unaware of):
/* Original code */
@view-transition {
  navigation: auto;
  types: check;
}
/* Old output */
@view-transition { navigation: auto; types: check; }
/* New output */
@view-transition {
navigation: auto;
types: check;

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.25.12
Fix a minification regression with CSS media queries (#4315)

The previous release introduced support for parsing media queries which unintentionally introduced a regression with the removal of duplicate media rules during minification. Specifically the grammar for @media <media-type> and <media-condition-without-or> { ... } was missing an equality check for the <media-condition-without-or> part, so rules with different suffix clauses in this position would incorrectly compare equal and be deduplicated. This release fixes the regression.
Update the list of known JavaScript globals (#4310)

This release updates esbuild's internal list of known JavaScript globals. These are globals that are known to not have side-effects when the property is accessed. For example, accessing the global Array property is considered to be side-effect free but accessing the global scrollY property can trigger a layout, which is a side-effect. This is used by esbuild's tree-shaking to safely remove unused code that is known to be side-effect free. This update adds the following global properties:

From ES2017:

Atomics

SharedArrayBuffer

From ES2020:

BigInt64Array

BigUint64Array

From ES2021:

FinalizationRegistry

WeakRef

From ES2025:

Float16Array

Iterator

Note that this does not indicate that constructing any of these objects is side-effect free, just that accessing the identifier is side-effect free. For example, this now allows esbuild to tree-shake classes that extend from Iterator:
// This can now be tree-shaken by esbuild:
class ExampleIterator extends Iterator {}
Add support for the new @view-transition CSS rule (#4313)

With this release, esbuild now has improved support for pretty-printing and minifying the new @view-transition rule (which esbuild was previously unaware of):
/* Original code */
@view-transition {
  navigation: auto;
  types: check;
}
/* Old output */
@view-transition { navigation: auto; types: check; }
/* New output */
@view-transition {
navigation: auto;

... (truncated)

Commits

208f539 publish 0.25.12 to npm
5f03afd update release notes
6b2ee78 minify: remove css rules containing empty :is()
f361deb add some additional known static methods
07aa646 automatically mark "RegExp.escape()" calls as pure
9039c46 simplify some call expression checks
188944d add some additional known static methods
d3c67f9 fix #4310: add Iterator and other known globals
4a51f0b fix: escape dev server breadcrumb hrefs properly (#4316)
26b29ed fix #4315: @media deduplication bug edge case
Additional commits viewable in compare view

Updates form-data from 4.0.4 to 4.0.6

Changelog

Sourced from form-data's changelog.

v4.0.6 - 2026-06-12

Commits

[Fix] escape CR, LF, and " in field names and filenames 8dff42c

[Dev Deps] update @ljharb/eslint-config, auto-changelog, tape f31d21e

[Deps] update hasown, mime-types 92ae0eb

[Dev Deps] update js-randomness-predictor 67b0f65

v4.0.5 - 2025-11-17

Commits

[Tests] Switch to newer v8 prediction library; enable node 24 testing 16e0076

[Dev Deps] update @ljharb/eslint-config, eslint 5822467

[Fix] set Symbol.toStringTag in the proper place 76d0dee

Commits

64190db v4.0.6
92ae0eb [Deps] update hasown, mime-types
f31d21e [Dev Deps] update @ljharb/eslint-config, auto-changelog, tape
8dff42c [Fix] escape CR, LF, and " in field names and filenames
67b0f65 [Dev Deps] update js-randomness-predictor
68ff7dd v4.0.5
5822467 [Dev Deps] update @ljharb/eslint-config, eslint
76d0dee [Fix] set Symbol.toStringTag in the proper place
16e0076 [Tests] Switch to newer v8 prediction library; enable node 24 testing
See full diff in compare view

Updates js-yaml from 4.1.1 to 4.2.0

Changelog

Sourced from js-yaml's changelog.

[4.2.0] - 2026-06-01

Added

Added docs/safety.md with notes about processing untrusted YAML.

Added maxDepth (100) loader option. Not a problem, but gives a better exception instead of RangeError on stack overflow.

Added maxMergeSeqLength (20) loader option. Not a problem after merge fix, but an additional restriction for safety.

Added sourcemaps to dist/ builds.

Changed

Stop resolving numbers with underscores as numeric scalars, #627.

Switched dev toolchains to Vite / neostandard.

Updated demo.

Reorganized tests.

dist/ files are no longer kept in the repository.

Fixed

Fix parsing of properties on the first implicit block mapping key, #62.

Fix trailing whitespace handling when folding flow scalar lines, #307.

Reject top-level block scalars without content indentation, #280.

Ensure numbers survive round-trip, #737.

Fix test coverage for issue #221.

Fix flow scalar trailing whitespace folding, #307.

Fix digits in YAML named tag handles.

Security

Fix potential DoS via quadratic complexity in merge - deduplicate repeated elements (makes sense for malformed files > 10K).

[3.14.2] - 2025-11-15

Security

Backported v4.1.1 fix to v3

Commits

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the npm_and_yarn group with 4 updates in the /lexio directory: [dompurify](https://github.com/cure53/DOMPurify), [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite), [form-data](https://github.com/form-data/form-data) and [js-yaml](https://github.com/nodeca/js-yaml). Updates `dompurify` from 3.4.0 to 3.4.9 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.4.0...3.4.9) Updates `vite` from 6.4.2 to 8.0.16 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.0.16/packages/vite) Updates `esbuild` from 0.25.10 to 0.25.12 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2025.md) - [Commits](evanw/esbuild@v0.25.10...v0.25.12) Updates `form-data` from 4.0.4 to 4.0.6 - [Release notes](https://github.com/form-data/form-data/releases) - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v4.0.4...v4.0.6) Updates `js-yaml` from 4.1.1 to 4.2.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/commits) --- updated-dependencies: - dependency-name: dompurify dependency-version: 3.4.9 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 8.0.16 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: esbuild dependency-version: 0.25.12 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: form-data dependency-version: 4.0.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.2.0 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 17, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the npm_and_yarn group across 1 directory with 5 updates#137

Bump the npm_and_yarn group across 1 directory with 5 updates#137
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/lexio/npm_and_yarn-22488e4518

dependabot Bot commented on behalf of github Jun 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Jun 17, 2026

DOMPurify 3.4.9

DOMPurify 3.4.8

DOMPurify 3.4.7

DOMPurify 3.4.6

DOMPurify 3.4.5

DOMPurify 3.4.4

DOMPurify 3.4.3

DOMPurify 3.4.2

v8.0.16

v8.0.15

v8.0.14

v8.0.13

v8.0.12

v8.0.11

v8.0.10

v8.0.9

v8.0.8

v8.0.7

v8.0.6

v8.0.5

v8.0.4

create-vite@8.0.3

v8.0.3

create-vite@8.0.2

v8.0.2

8.0.16 (2026-06-01)

Bug Fixes

8.0.15 (2026-06-01)

Features

Bug Fixes

Miscellaneous Chores

Code Refactoring

8.0.14 (2026-05-21)

Features

Bug Fixes

Miscellaneous Chores

Code Refactoring

v0.25.12

0.25.12

v4.0.6 - 2026-06-12

Commits

v4.0.5 - 2025-11-17

Commits

[4.2.0] - 2026-06-01

Added

Changed

Fixed

Security

[3.14.2] - 2025-11-15

Security

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants