Skip to content

Bump the npm_and_yarn group across 1 directory with 13 updates - #623

Merged
brian-montgomery merged 2 commits into
mainfrom
dependabot/npm_and_yarn/astro/npm_and_yarn-7696ca985a
Sep 14, 2026
Merged

Bump the npm_and_yarn group across 1 directory with 13 updates#623
brian-montgomery merged 2 commits into
mainfrom
dependabot/npm_and_yarn/astro/npm_and_yarn-7696ca985a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 10, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 10 updates in the /astro directory:

Package From To
astro 7.1.3 7.3.2
sanitize-html 2.13.0 2.17.7
svgo 4.0.2 4.1.0
svgo 3.3.4 3.3.5
esbuild 0.28.0 0.28.1
fast-uri 3.1.4 3.1.7
js-yaml 4.3.0 4.3.2
nanoid 3.3.16 3.3.19
postcss 8.5.22 8.5.28
smol-toml 1.6.1 1.8.0
undici 7.28.0 7.29.1

Updates astro from 7.1.3 to 7.3.2

Release notes

Sourced from astro's releases.

astro@7.3.2

Patch Changes

  • #17896 a548223 Thanks @​matthewp! - Fixes <script>/<style> rendering in MDX so that only literal content (including content injected by remark/rehype plugins) is treated as trusted markup. A dynamic value passed as a <script>/<style> child (e.g. <script>{value}</script>) is now escaped like any other element's content instead of being rendered raw. Use set:html to explicitly opt a dynamic value back into raw rendering.

  • #17931 c1a6a89 Thanks @​astro-factory! - Fixes the dev toolbar returning a 504 "Outdated Optimize Dep" error when a workspace-linked package imports a dependency that Vite's initial scan did not discover

  • #17908 42e9188 Thanks @​astro-factory! - Fixes i18n fallback routing replacing the first substring match instead of the actual locale segment, which mangled paths like /energy/en/about into /esergy/en/about

  • #17936 4b92ddc Thanks @​astro-factory! - Fixes sessions breaking in dev mode with the Cloudflare adapter when middleware is present

  • Updated dependencies [a548223]:

    • @​astrojs/markdown-satteri@​0.4.1

astro@7.3.1

Patch Changes

astro@7.3.0

Minor Changes

  • #17767 ce7c91f Thanks @​astro-factory! - Adds --ignore-lock flag to astro preview, allowing multiple preview servers to run simultaneously on different ports. This is useful for E2E testing workflows (e.g., Playwright) that need to run several preview servers at once.

  • #17818 c0b6581 Thanks @​florian-lefebvre! - Adds a logger parameter to image services hooks

    Custom image services now receive Astro's runtime logger as an extra argument. Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

    import type { LocalImageService } from 'astro';
const service: LocalImageService = {
// ...
async transform(inputBuffer, transform, imageConfig, logger) {
logger.warn(Could not optimize &quot;${transform.src}&quot;. Passing it through unchanged.);
return { data: inputBuffer, format: 'png' };
},
};

    Astro's built-in Sharp service now uses this logger for the warnings it emits when it encounters an unexpected or unsupported source format.

  • #17818 c0b6581 Thanks @​florian-lefebvre! - Adds logger to the context object passed to cache providers

    Custom cache providers now receive Astro's runtime logger on the context passed to onRequest(). Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

    import type { CacheProvider } from 'astro';
const provider: CacheProvider = {

... (truncated)

Changelog

Sourced from astro's changelog.

7.3.2

Patch Changes

  • #17896 a548223 Thanks @​matthewp! - Fixes <script>/<style> rendering in MDX so that only literal content (including content injected by remark/rehype plugins) is treated as trusted markup. A dynamic value passed as a <script>/<style> child (e.g. <script>{value}</script>) is now escaped like any other element's content instead of being rendered raw. Use set:html to explicitly opt a dynamic value back into raw rendering.

  • #17931 c1a6a89 Thanks @​astro-factory! - Fixes the dev toolbar returning a 504 "Outdated Optimize Dep" error when a workspace-linked package imports a dependency that Vite's initial scan did not discover

  • #17908 42e9188 Thanks @​astro-factory! - Fixes i18n fallback routing replacing the first substring match instead of the actual locale segment, which mangled paths like /energy/en/about into /esergy/en/about

  • #17936 4b92ddc Thanks @​astro-factory! - Fixes sessions breaking in dev mode with the Cloudflare adapter when middleware is present

  • Updated dependencies [a548223]:

    • @​astrojs/markdown-satteri@​0.4.1

7.3.1

Patch Changes

7.3.0

Minor Changes

  • #17767 ce7c91f Thanks @​astro-factory! - Adds --ignore-lock flag to astro preview, allowing multiple preview servers to run simultaneously on different ports. This is useful for E2E testing workflows (e.g., Playwright) that need to run several preview servers at once.

  • #17818 c0b6581 Thanks @​florian-lefebvre! - Adds a logger parameter to image services hooks

    Custom image services now receive Astro's runtime logger as an extra argument. Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

    import type { LocalImageService } from 'astro';
const service: LocalImageService = {
// ...
async transform(inputBuffer, transform, imageConfig, logger) {
logger.warn(Could not optimize &quot;${transform.src}&quot;. Passing it through unchanged.);
return { data: inputBuffer, format: 'png' };
},
};

    Astro's built-in Sharp service now uses this logger for the warnings it emits when it encounters an unexpected or unsupported source format.

  • #17818 c0b6581 Thanks @​florian-lefebvre! - Adds logger to the context object passed to cache providers

    Custom cache providers now receive Astro's runtime logger on the context passed to onRequest(). Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

    

    • 






... (truncated)





Commits






Updates sanitize-html from 2.13.0 to 2.17.7



Changelog

Sourced from sanitize-html's changelog.




2.17.7 (2026-08-13)


Security


    

  • Fixed an XSS / URL scheme policy bypass affecting configurations that allow the SVG animation elements (animate, animateColor, animateMotion, animateTransform or set) together with attributeName and one of the animation value attributes. The default configuration was not affected, as these elements are not in the default allowedTags. apostrophecms was not affected. Thanks to koyokr for responsibly disclosing the vulnerability (GHSA-g8qq-57p8-ggw5).
    • 



2.17.6 (2026-07-10)


Fixes


    

  • Allow transformTags to emit text when textFilter is set, even if the tag is initially empty. This is consistent with the documentation. Thanks to spokodev for the fix.
    • 



Security


    

  • Fixed an XSS/allowlist bypass in which the contents of a raw-text element (textarea or xmp) nested inside an svg or math root were re-emitted without HTML-escaping. sanitize-html treated that content as inert raw text because htmlparser2 10.x classified raw-text elements by tag name and ignored the namespace, but a real HTML5 parser treats textarea/xmp as ordinary foreign elements inside SVG/MathML and re-parses their contents as live markup. As a result, markup and event-handler attributes that the allowlist never permitted (for example <svg><textarea><img src=x onerror=alert(1)>) could survive sanitization and execute in the browser. This is now fixed on two fronts: htmlparser2 was upgraded to 12.x, which is namespace-aware and parses textarea/xmp inside SVG/MathML as ordinary elements, so their non-allowlisted children (such as the injected img) are dropped by the allowlist instead of being preserved as raw text; and any raw-text content sanitize-html still emits for these tags (at HTML integration points such as foreignObject/mtext, or outside foreign content) is always HTML-escaped. The default configuration is not affected; the precondition is an allowedTags that includes svg or math together with textarea or xmp. Thanks to khoadb175 for responsibly disclosing the vulnerability.
    • 

  • Fixed a mutation-XSS / allowedTags bypass affecting configurations that allow the textarea or xmp raw-text tags. htmlparser2 10.x did not recognize an end tag with a trailing solidus (e.g. </textarea/>) as closing the element, so it kept the following markup as raw text, but a spec-compliant browser treats </textarea/> as a valid close and parses that markup as a live element. Because raw-text content was re-emitted without escaping, a payload such as <textarea></textarea/><img src=x onerror=...> could smuggle non-allowlisted, executable markup through the sanitizer. The default configuration was not affected. This is now defended at two layers: htmlparser2 was upgraded to 12.x, whose tokenizer closes these end tags correctly, and the raw text sanitize-html emits for these tags is always escaped so no < can reopen a tag when the output is re-parsed (textarea, an RCDATA element whose entities htmlparser2 decodes, is escaped like normal text, while xmp, a raw-text element, has only its angle brackets escaped to avoid double-encoding already-encoded entities). Because htmlparser2 is ESM-only from version 11 onward, sanitize-html now requires Node.js >=22.12.0 (the first 22.x release in which require() of an ES module is available unflagged). Thanks to bibu123456 for reporting the vulnerability and Kayiz-PT for coordinating the disclosure (GHSA-jxwj-j7wr-gfrw).
    • 



2.17.5 (2026-06-10)


Security


    

  • Added a number of new attributes to be protected against unsafe URLs, e.g. javascript: and similar. None of these are used in the default configuration of sanitize-html or apostrophe or likely to be used there, and some attributes, like an action for a form, are inherently unsafe to allow if XSS protection is your goal. Nevertheless it makes sense to block certain URL types where they are not appropriate. Some attributes are not supported at all by modern browsers but are included for completeness. Thanks to crattack for reporting the vulnerability.
    • 

  • Address a potential vulnerability when nonTextTags is configured in a nonstandard way. While it is never a good idea to remove known non-text tags from the standard list e.g. script, styles, etc., this change ensures that doing so does not result in nested tags being passed through without sanitization when they are not expressly allowed. (ApostropheCMS would never trigger this situation.) Thanks to Dipanshu singh for pointing out the issue and contributing the fix.
    • 



2.17.4


Changes


    

  • sanitize-html and launder now share a single implementation of naughtyHref, based on that which previously existed in sanitize-html.
    • 



Security


    

  • Security vulnerability: the xmp tag could be used to pass forbidden markup through sanitize-html, even when xmp itself is not explicitly allowed All users of sanitize-html should update immediately. Thanks to Vincenzo Turturro for reporting the vulnerability.
    • 



2.17.3 (2026-04-15)


Security


    

  • Fix vulnerability introduced in version 2.17.2 that allowed XSS attacks if the developer chose to permit option tags. There was no vulnerability when not explicitly allowing option tags.
    • 



2.17.2 (2026-03-19)


Changes


    

  • Upgrade htmlparser2 from 8.x to 10.1.0. This improves security by correctly decoding zero-padded numeric character references (e.g., &[#0000001](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html/issues/0000001)) that previously bypassed javascript: URL detection. Also fixes double-encoding of entities inside raw text elements like textarea and option.
    • 



2.17.1 (2026-02-18)


Fixes





... (truncated)





Commits






Updates svgo from 4.0.2 to 4.1.0



Release notes

Sourced from svgo's releases.




v4.1.0


This minor release upgrades the SAX parser and introduces stricter XML validation. It also includes important security hardening for removeScripts, dependency updates, and improvements to the test and regression infrastructure.


Support SVGO


If SVGO is valuable to you or your organization, please consider supporting the project on OpenCollective. Your sponsorship helps fund ongoing maintenance and security work.


Stricter XML validation


SVGO now uses sax 1.6.1, upgraded from 1.5.0 (#2257).


The new parser version validates numeric character references against the ranges permitted by XML. Invalid references are now rejected in both text and attributes, including:


    

  • disallowed control characters such as &[#1](https://github.com/svg/svgo/issues/1);, &#xB;, and &#x1F;;
    • 

  • UTF-16 surrogate code points such as &#xD800;;
    • 

  • invalid XML code points such as &#xFFFF;.
    • 



Valid boundary values—including U+0020, U+D7FF, U+E000, U+FFFD, and characters through U+10FFFF—remain supported.


Parser failures are consistently exposed as SvgoParserError errors with an Invalid character entity reason.


This is an intentional behavior change: malformed SVGs that were previously accepted may now produce a parser error, while valid XML documents are unaffected.


Security


The removeScripts plugin has been hardened against several script-execution bypasses:


    

  • Filters executable data: URLs containing HTML, XHTML, or SVG documents while preserving inert data such as PNG images, and filters legacy vbscript: URLs (#2263).
    • 

  • Sanitizes content inside SVG <foreignObject> elements by removing HTML event-handler attributes, srcdoc, and executable URLs from action, data, formaction, href, and src, while preserving non-executable HTML and visual content (#2264).
    • 

  • Recognizes namespace-prefixed SVG <a> elements and removes ASCII tabs and newlines before checking URL schemes, preventing values such as java&[#9](https://github.com/svg/svgo/issues/9);script: from bypassing detection while preserving elements in unrelated custom namespaces (#2268).
    • 



These changes address:



Dependencies


    

  • Upgraded css-select to v6 and css-what to v7, and updated SVGO's custom selector adapter for css-select v6 (#2244).
    • 



Project maintenance


@​TrySound is back as an active SVGO maintainer.


Many thanks to @​KTibow, @​SethFalco, and @​XhmikosR for maintaining and improving SVGO over the past several years.


Full Changelog: svg/svgo@v4.0.2...v4.1.0







Commits

    

  • 5765cbe chore: prepare v4.1.0 release (#2275)
    • 

  • 3db3ef3 fix(removeScripts): handle anchor URL bypasses (#2268)
    • 

  • 4e9b9ae chore: cache regression screenshots (#2267)
    • 

  • d55270c chore(regression): migrate comparison workers to Tinypool (#2266)
    • 

  • fd51e47 fix(removeScripts): sanitize foreignObject content (#2264)
    • 

  • dcaf957 chore: optimize fixtures in a bounded worker pool (#2265)
    • 

  • a354293 fix(removeScripts): filter executable data URLs (#2263)
    • 

  • 4e0d2ac ci(typecheck): return typechecking on CI
    • 

  • 0b97fed test(typescript): drop tsd for vitest type testing API
    • 

  • f6e8ae1 chore(pnpm): drop package.json#pnpm.onlyBuiltDependencies
    • 

  • Additional commits viewable in compare view
    • 






Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for svgo since your current version.






Updates svgo from 3.3.4 to 3.3.5



Release notes

Sourced from svgo's releases.




v4.1.0


This minor release upgrades the SAX parser and introduces stricter XML validation. It also includes important security hardening for removeScripts, dependency updates, and improvements to the test and regression infrastructure.


Support SVGO


If SVGO is valuable to you or your organization, please consider supporting the project on OpenCollective. Your sponsorship helps fund ongoing maintenance and security work.


Stricter XML validation


SVGO now uses sax 1.6.1, upgraded from 1.5.0 (#2257).


The new parser version validates numeric character references against the ranges permitted by XML. Invalid references are now rejected in both text and attributes, including:


    

  • disallowed control characters such as &[#1](https://github.com/svg/svgo/issues/1);, &#xB;, and &#x1F;;
    • 

  • UTF-16 surrogate code points such as &#xD800;;
    • 

  • invalid XML code points such as &#xFFFF;.
    • 



Valid boundary values—including U+0020, U+D7FF, U+E000, U+FFFD, and characters through U+10FFFF—remain supported.


Parser failures are consistently exposed as SvgoParserError errors with an Invalid character entity reason.


This is an intentional behavior change: malformed SVGs that were previously accepted may now produce a parser error, while valid XML documents are unaffected.


Security


The removeScripts plugin has been hardened against several script-execution bypasses:


    

  • Filters executable data: URLs containing HTML, XHTML, or SVG documents while preserving inert data such as PNG images, and filters legacy vbscript: URLs (#2263).
    • 

  • Sanitizes content inside SVG <foreignObject> elements by removing HTML event-handler attributes, srcdoc, and executable URLs from action, data, formaction, href, and src, while preserving non-executable HTML and visual content (#2264).
    • 

  • Recognizes namespace-prefixed SVG <a> elements and removes ASCII tabs and newlines before checking URL schemes, preventing values such as java&[#9](https://github.com/svg/svgo/issues/9);script: from bypassing detection while preserving elements in unrelated custom namespaces (#2268).
    • 



These changes address:



Dependencies


    

  • Upgraded css-select to v6 and css-what to v7, and updated SVGO's custom selector adapter for css-select v6 (#2244).
    • 



Project maintenance


@​TrySound is back as an active SVGO maintainer.


Many thanks to @​KTibow, @​SethFalco, and @​XhmikosR for maintaining and improving SVGO over the past several years.


Full Changelog: svg/svgo@v4.0.2...v4.1.0







Commits

    

  • 5765cbe chore: prepare v4.1.0 release (#2275)
    • 

  • 3db3ef3 fix(removeScripts): handle anchor URL bypasses (#2268)
    • 

  • 4e9b9ae chore: cache regression screenshots (#2267)
    • 

  • d55270c chore(regression): migrate comparison workers to Tinypool (#2266)
    • 

  • fd51e47 fix(removeScripts): sanitize foreignObject content (#2264)
    • 

  • dcaf957 chore: optimize fixtures in a bounded worker pool (#2265)
    • 

  • a354293 fix(removeScripts): filter executable data URLs (#2263)
    • 

  • 4e0d2ac ci(typecheck): return typechecking on CI
    • 

  • 0b97fed test(typescript): drop tsd for vitest type testing API
    • 

  • f6e8ae1 chore(pnpm): drop package.json#pnpm.onlyBuiltDependencies
    • 

  • Additional commits viewable in compare view
    • 






Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for svgo since your current version.






Updates esbuild from 0.28.0 to 0.28.1



Release notes

Sourced from esbuild's releases.




v0.28.1


    

  • 

    Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)
    

    This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.
    

    Thanks to @​dellalibera for reporting this issue.
    

    • 

  • 

    Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)
    

    The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.
    

    Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.
    

    Thanks to @​sondt99 for reporting this issue.
    

    • 

  • 

    Avoid inlining using and await using declarations (#4482)
    

    Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:
    

    // Original code
{
  using x = new Resource()
  x.activate()
}
// Old output (with --minify)
new Resource().activate();
// New output (with --minify)
{using e=new Resource;e.activate()}
    

    • 

  • 

    Fix module evaluation when an error is thrown (#4461, #4467)
    

    If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.
    

    • 

  • 

    Fix some edge cases around the new operator (#4477)
    

    Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:
    

    // Original code
new (foo()`bar`)()
new (foo()?.bar)()
// Old output
new foo()bar();
new (foo())?.bar();
    

    • 






... (truncated)





Changelog

Sourced from esbuild's changelog.




0.28.1


    

  • 

    Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)
    

    This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.
    

    Thanks to @​dellalibera for reporting this issue.
    

    • 

  • 

    Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)
    

    The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.
    

    Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.
    

    Thanks to @​sondt99 for reporting this issue.
    

    • 

  • 

    Avoid inlining using and await using declarations (#4482)
    

    Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:
    

    // Original code
{
  using x = new Resource()
  x.activate()
}
// Old output (with --minify)
new Resource().activate();
// New output (with --minify)
{using e=new Resource;e.activate()}
    

    • 

  • 

    Fix module evaluation when an error is thrown (#4461, #4467)
    

    If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.
    

    • 

  • 

    Fix some edge cases around the new operator (#4477)
    

    Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:
    

    // Original code
new (foo()`bar`)()
new (foo()?.bar)()
// Old output
new foo()bar();
new (foo())?.bar();
    

    • 






... (truncated)





Commits






Updates brace-expansion from 2.1.2 to 5.0.7



Release notes

Sourced from brace-expansion's releases.




v4.0.1


    

  • fmt  5a5cc17
    • 

  • Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65)  0b6a978
    • 





juliangruber/brace-expansion@v4.0.0...v4.0.1


v4.0.0


    

  • feat: use string replaces instead of splits (#64)  278132b
    • 

  • fmt  dd72a59
    • 

  • add tea.yaml  70e4c1b
    • 



juliangruber/brace-expansion@v3.0.0...v4.0.0


As a precaution to not risk breaking anything with 278132b, this is a new semver major release


v3.0.1


    

  • pkg: publish on tag 3.x  3059c07
    • 

  • fmt  8229e6f
    • 

  • Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65)  15f9b3c
    • 





juliangruber/brace-expansion@v3.0.0...v3.0.1


v3.0.0


    

  • Switch to ES Modules and balanced-match 3.0.0 (#62)  c0360e8
    • 

  • added jsdoc (#55)  68c0e37
    • 

  • node 16 is EOL  9e781e9
    • 

  • add standard  3494c4d
    • 

  • use const and let (#57)  dd5a4cb
    • 

  • docs  6dad209
    • 

  • remove test  e3dd8ae
    • 

  • ci: update node versions  d23ede9
    • 

  • docs: add @​lanodan to contributors  1eb3fa4
    • 

  • docs  1e7c9cd
    • 

  • switch from tape to test module (#60)  2520537
    • 

  • Bump minimist from 1.2.5 to 1.2.6 (#59)  61a94f1
    • 

  • Bump path-parse from 1.0.6 to 1.0.7 (#51)  dc741cf
    • 

  • docs: add back ci badge  8ee5626
    • 

  • Add github actions, remove travis. Closes #52 (#53)  5c8756a
    • 

  • CI: Drop unused sudo: false Travis directive (#50)  05978a7
    • 



juliangruber/brace-expansion@v2.0.1...v3.0.0







Commits





Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.






Updates @opentelemetry/core from 2.7.1 to 2.8.0



Release notes

Sourced from @​opentelemetry/core's releases.




v2.8.0


2.8.0


🚀 Features


    

  • feat(sdk-trace-base): pretty-print SpanImpl, Tracer, and BasicTracerProvider via util.inspect so they render through diag and console.log #6690 @​mcollina
    • 

  • feat(sdk-metrics): implement metric reader self-observability metrics #6449 @​anuraaga
    • 

  • feat(core): add hrTimeToSeconds #6449 @​anuraaga
    • 



🐛 Bug Fixes


    

  • fix(core): limit processing of incoming "baggage" header to 8192 bytes @​pichlermarc
    • 








Changelog

Sourced from @​opentelemetry/core's changelog.




2.8.0


🚀 Features


    

  • feat(sdk-trace-base): pretty-print SpanImpl, Tracer, and BasicTracerProvider via util.inspect so they render through diag and console.log #6690 @​mcollina
    • 

  • feat(sdk-metrics): implement metric reader self-observability metrics #6449 @​anuraaga
    • 

  • feat(core): add hrTimeToSeconds #6449 @​anuraaga
    • 



🐛 Bug Fixes


    

  • fix(core): limit processing of incoming "baggage" header to 8192 bytes @​pichlermarc
    • 








Commits

    

  • 13a035b chore: prepare next release (#6756)
    • 

  • 4b13587 Merge commit from fork
    • 

  • 71d195c chore(renovate): set minimumReleaseAge to 3 days (#6792)
    • 

  • 555fca6 Update renovate.json to use matchManagers (#6141)
    • 

  • b711a81 docs(otlp-exporter-base): add typedoc entry points so public API is indexed a...
    • 

  • da70402 fix(ci): supply-chain sec: disable caching in release-related workflow (#6790)
    • 

  • 002267b chore: complete the move to the smaller SPDX license header (#6791)
    • 

  • 056ef9c feat(sdk-metrics): implement metric reader metrics (#6449)
    • 

  • 3bd69ce fix(configuration): improve environment variable substitution to handle all t...
    • 

  • bfbda7c docs(exporter-trace-otlp-grpc): import CompressionAlgorithm from otlp-exporte...
    • 

  • Additional commits viewable in compare view
    • 







Updates fast-uri from 3.1.4 to 3.1.7



Release notes

Sourced from fast-uri's releases.




v3.1.7


⚠️ Security Warning


This is a security release that fixes the following high-severity security advisories:



Users of the v3.x release line should upgrade to v3.1.7.


Full Changelog: fastify/fast-uri@v3.1.6...v3.1.7


v3.1.6


⚠️ Security Warning


This release addresses the following high-severity security advisories:



Users of the v3.x release line should upgrade to v3.1.6.


Full Changelog: fastify/fast-uri@v3.1.5...v3.1.6


v3.1.5


⚠️ Security Warning


Fix for GHSA-7p8r-x3mc-p8w7


Full Changelog: fastify/fast-uri@v3.1.4...v3.1.5







Commits

    

  • 412e40a Bumped v3.1.7
    • 

  • 9f4c943 fix: backport port and IP-literal validation to v3.x (#216)
    • 

  • 1eb3ce4 fix: treat unterminated bracket hosts as reg-names again (#214)
    • 

  • 6f970b2 Bumped v3.1.6
    • 

  • d941579 fix: never run IDN canonicalization on bracketed IP literals
    • 

  • c0f0279 test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)
    • 

  • 37f3417 Merge commit from fork
    • 

  • 607bfbe Merge commit from fork
    • 

  • ae92a4c Merge commit from fork
    • 


    

  
  



      


          

          
  
  

    
  
    
    

  

  

  



                    

          
        





  





    



      

  
        

  

      

  
  

  
          

  

    

      


  

        
          @dependabot
  




      

        
          Bump the npm_and_yarn group across 1 directory with 13 updates
        

          
                        
      


      

        

    
    
    

  

    


      


      

        

          

    
    
    

  

  

    
  



        

      


      

        
          50a256c
        
      

    

  

    

      
Bumps the npm_and_yarn group with 10 updates in the /astro directory:

| Package | From | To |
| --- | --- | --- |
| [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `7.1.3` | `7.3.2` |
| [sanitize-html](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html) | `2.13.0` | `2.17.7` |
| [svgo](https://github.com/svg/svgo) | `4.0.2` | `4.1.0` |
| [svgo](https://github.com/svg/svgo) | `3.3.4` | `3.3.5` |
| [esbuild](https://github.com/evanw/esbuild) | `0.28.0` | `0.28.1` |
| [fast-uri](https://github.com/fastify/fast-uri) | `3.1.4` | `3.1.7` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `4.3.0` | `4.3.2` |
| [nanoid](https://github.com/ai/nanoid) | `3.3.16` | `3.3.19` |
| [postcss](https://github.com/postcss/postcss) | `8.5.22` | `8.5.28` |
| [smol-toml](https://github.com/squirrelchat/smol-toml) | `1.6.1` | `1.8.0` |
| [undici](https://github.com/nodejs/undici) | `7.28.0` | `7.29.1` |



Updates `astro` from 7.1.3 to 7.3.2
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.3.2/packages/astro)

Updates `sanitize-html` from 2.13.0 to 2.17.7
- [Changelog](https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md)
- [Commits](https://github.com/apostrophecms/apostrophe/commits/sanitize-html@2.17.7/packages/sanitize-html)

Updates `svgo` from 4.0.2 to 4.1.0
- [Release notes](https://github.com/svg/svgo/releases)
- [Commits](svg/svgo@v4.0.2...v4.1.0)

Updates `svgo` from 3.3.4 to 3.3.5
- [Release notes](https://github.com/svg/svgo/releases)
- [Commits](svg/svgo@v4.0.2...v4.1.0)

Updates `esbuild` from 0.28.0 to 0.28.1
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md)
- [Commits](evanw/esbuild@v0.28.0...v0.28.1)

Updates `brace-expansion` from 2.1.2 to 5.0.7
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v2.1.2...v5.0.7)

Updates `@opentelemetry/core` from 2.7.1 to 2.8.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@v2.7.1...v2.8.0)

Updates `fast-uri` from 3.1.4 to 3.1.7
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.4...v3.1.7)

Updates `js-yaml` from 4.3.0 to 4.3.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.3.0...4.3.2)

Updates `nanoid` from 3.3.16 to 3.3.19
- [Release notes](https://github.com/ai/nanoid/releases)
- [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md)
- [Commits](ai/nanoid@3.3.16...3.3.19)

Updates `postcss` from 8.5.22 to 8.5.28
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.22...8.5.28)

Updates `smol-toml` from 1.6.1 to 1.8.0
- [Release notes](https://github.com/squirrelchat/smol-toml/releases)
- [Commits](squirrelchat/smol-toml@v1.6.1...v1.8.0)

Updates `toml` from 3.0.0 to 4.3.0
- [Changelog](https://github.com/BinaryMuse/toml-node/blob/master/CHANGELOG.md)
- [Commits](BinaryMuse/toml-node@v3.0.0...v4.3.0)

Updates `undici` from 7.28.0 to 7.29.1
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.28.0...v7.29.1)

---
updated-dependencies:
- dependency-name: astro
  dependency-version: 7.3.2
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: sanitize-html
  dependency-version: 2.17.7
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: svgo
  dependency-version: 4.1.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: svgo
  dependency-version: 3.3.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: esbuild
  dependency-version: 0.28.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 5.0.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@opentelemetry/core"
  dependency-version: 2.8.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fast-uri
  dependency-version: 3.1.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 4.3.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: nanoid
  dependency-version: 3.3.19
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: postcss
  dependency-version: 8.5.28
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: smol-toml
  dependency-version: 1.8.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: toml
  dependency-version: 4.3.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 7.29.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>

    







  








      

  
            

    

      
    

    


      


          @dependabot
dependabot
Bot



            added
      
  dependencies

  Pull requests that update a dependency file

      
  javascript

  Pull requests that update javascript code

  labels


      Sep 10, 2026

    

  








      

  
      



  

  @netlify






  



    

      

  

    

      
          
      

      
            netlify
    Bot

      

      

      commented


        Sep 10, 2026



      
  •

  

    
      

        
          edited
          
        
        
      

    
    
      
  
        
      Loading


  
    
  



    


  


  

    

      

          
    
    

  


        
            
  
      
              Copy link

  

            
  
      
              Copy Markdown

  

        
      

    


    

        



        

    

  





      


        



  
    

      
          
✅ Deploy Preview for accessiblecommunity ready!






Name
Link






🔨 Latest commit
ba80318




🔍 Latest deploy log
https://app.netlify.com/projects/accessiblecommunity/deploys/6aa2fa598ba69c000794b026




😎 Deploy Preview
https://deploy-preview-623--accessiblecommunity.netlify.app




📱 Preview on mobile

 Toggle QR Code... 

QR Code

Use your smartphone camera to open QR code link.










To edit notification comments on pull requests, go to your Netlify project configuration.


      		
    

  





        

            

            

              
            

        

      


      

            
  
  

    
  
    
    

  

  

  


    












      

  
        





      

  
          





      

  
        





      

  
      



  

  @brian-montgomery






  



    

      

  

    

      
          
      

      
            brian-montgomery
    

      

      

      commented


        Sep 10, 2026



      
    


  


  

    

      

          
    
    

  


        
            
  
      
              Copy link

  

            
  
      
              Copy Markdown

  

        
      

    


    

        

  
    Contributor


        

    

  





      


        



  
    

      
          
More security updates. Looks good to me, if anyone else can give a check, I'd appreciate it.


      		
    

  





        

            

            

              
            

        

      


      

            
  
  

    
  
    
    

  

  

  


    












      

  
          
 
  

    
  

  


        
    

        

              @brian-montgomery


        

      

              brian-montgomery



            merged commit 3b12c12
          into

          
  
    main
  


        Sep 14, 2026

          

            10 checks passed
          

      

    


      

        
  
          
  
    
    


  
      

  







  

  
  

  
    

        

              @dependabot


        

      

            dependabot
Bot

        
    deleted the
    
      
        dependabot/npm_and_yarn/astro/npm_and_yarn-7696ca985a
    
    branch

        September 14, 2026 11:44        
        
      

    














  
  

    

      

  










  








  
      

  
    Sign up for free
    to join this conversation on GitHub.
    Already have an account?
    Sign in to comment


  










    
        

  

    
    

    

  

    Reviewers
  


    


      

  

    


  
      @brian-montgomery
  
    brian-montgomery



    
      
        
      
    
    brian-montgomery approved these changes



      

          


  
      @lsr-explore
  
    lsr-explore


          Awaiting requested review from lsr-explore


      

      

          


  
      @alexisreytech
  
    alexisreytech


          Awaiting requested review from alexisreytech


      



      







  
      

  


      
  

    Assignees
  



        


    No one assigned







  
        


  


  

    Labels
  



    

      
    dependencies

  Pull requests that update a dependency file
  
    javascript

  Pull requests that update javascript code








  
        

  

    

        

    Projects
  


        




    None yet




  



  
        


  

    
  

    Milestone
  


      No milestone





    
      
          


  

    

      
        

          
  

    Development
  



            


Successfully merging this pull request may close these issues.





  
  



      
    

  




      

  
  
        

  

    

      1 participant
    

    

        
          @brian-montgomery