Skip to content

chore(deps): bump the npm_and_yarn group across 1 directory with 6 updates - #421

Merged
fdelbrayelle merged 3 commits into
mainfrom
dependabot/npm_and_yarn/ui/npm_and_yarn-9f730d3c36
Oct 5, 2026
Merged

fdelbrayelle merged 3 commits into
mainfrom
dependabot/npm_and_yarn/ui/npm_and_yarn-9f730d3c36

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 10, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 6 updates in the /ui directory:

Package From To
brace-expansion 2.1.0 2.1.4
dompurify 3.4.11 3.4.15
js-yaml 4.2.0 4.3.2
mermaid 11.15.0 11.17.2
nanoid 3.3.12 3.3.18
postcss 8.5.15 8.5.28

Updates brace-expansion from 2.1.0 to 2.1.4

Release notes

Sourced from brace-expansion's releases.

v2.1.1

  • Backport v5.0.6 change to v2 (#109) c3a817c

juliangruber/brace-expansion@v2.1.0...v2.1.1

Commits

Updates dompurify from 3.4.11 to 3.4.15

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.15

  • Added better clobbering hardening when XML content is involved, thanks @​gnyselcuk
  • Added several smaller hardening and edge-case improvements, thanks @​leechristensen
  • Bumped several dependencies where possible

DOMPurify 3.4.14

  • Fixed an issue with possible bypasses when risky tags are allow-listed, thanks @​AlirezaRouhbakhsh
  • Fixed a couple of edge cases with mixed document contexts, thanks @​fishjojo1
  • Added the SVG pointer-events and vector-effect presentation attributes to the allow-list, thanks @​Jaybhade
  • Conducted another refactoring run, removed dead branches and duplicated logic, flattened attribute validation
  • Updated the documentation in several spots, README, wiki, etc., thanks @​Akokonunes
  • Updated several development dependencies and CI workflow actions

DOMPurify 3.4.13

  • Fixed an issue with hook removal during IN_PLACE sanitization, thanks @​koyokr
  • Fixed an issue with hooks potentially bypassing the clone guard, thanks @​AkshayjainG
  • Fixed an issue with DOM clobbering via ownerDocument during IN_PLACE, thanks @​AkshayjainG
  • Bumped several dependencies where possible

DOMPurify 3.4.12

  • Fixed an issue where a hook would not get called for custom elements, thanks @​Rikuxx0
  • Hardened the handling of hooks removing elements, @​mkrause-bee360
  • Added support for a few new SVG attributes, thanks @​cbn-falias & @​Develop-KIM
  • Hardened the handling of declarative partial updates
  • Updated the documentation is several spots, README, wiki, etc.
  • Bumped several dependencies where possible
Commits

Updates js-yaml from 4.2.0 to 4.3.2

Changelog

Sourced from js-yaml's changelog.

4.3.2 - 2026-08-26

Changed

  • [backport] Hard-limit merge sequence size to 100.

Security

  • [backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

4.3.1 - 2026-07-31

Security

  • [backport] Remove quadratic complexity from !!omap duplicate key detection.

4.3.0 - 2026-06-27

Added

  • [backport] Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.

Fixed

  • Restore umd builds back to es5.

Removed

  • [backport] maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.
Commits
  • 79ca68d 4.3.2 released
  • d90b661 Backport merge limits from v5.4.1
  • 86e91b8 4.3.1 released
  • c3cc4b0 Backport quadratic complexity fix for !!omap
  • 33d05b5 4.3.0 released
  • 663bfab Drop demo publish, to not override new v5 one.
  • 1cb8c7b Add v4-legacy tag for publish
  • 02f27af Restore umd builds back to es5
  • 8be84ed Fix es5 compatibility
  • 59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
  • Additional commits viewable in compare view

Updates mermaid from 11.15.0 to 11.17.2

Release notes

Sourced from mermaid's releases.

mermaid@11.17.2

Patch Changes

  • #8125 178d7c7 Thanks @​knsv-bot! - fix: restore the edgePaths class on the edge group in rendered SVG, and point the flowchart, block and user journey stylesheets at it

mermaid@11.17.1

Patch Changes

  • #8092 31ce60a Thanks @​pbrolin47! - fix(c4): wrap element labels to c4.width again

    C4 element labels (System, Container, Component, Person and their _Ext variants) stopped wrapping in 11.17.0, so long descriptions rendered on one unbroken line and the shape grew sideways well past the configured c4.width. The unified-shapes label helper gated wrapping on the root-level wrap option, which has no schema default and is therefore undefined; it now gates on c4.wrap (default true), which is what the legacy renderer used.

  • #8088 c66200b Thanks @​ashishjain0512! - fix: neo-look arrowheads and crow's-foot markers no longer fall back to default theme colours/stroke widths on the first render with layout: elk. State diagram arrowheads stayed dark on dark themes, and ER / requirement markers were drawn at the default stroke width, because markers were created from the layout package's own bundled copy of mermaid, whose config had not been initialized yet.

  • #8079 281cd7b Thanks @​ashishjain0512! - fix(class): class diagram relation markers (composition, aggregation, extension, dependency, lollipop) no longer scale with the edge stroke width, so they stay outside the class box boundary in themes that set strokeWidth: 2 (redux, redux-dark, redux-color, redux-dark-color, neo, neo-dark) with the default classic look.

mermaid@11.17.0

Minor Changes

Patch Changes

  • #7847 215fe89 Thanks @​filipsajdak! - fix(c4): named attributes such as $tags, $link and $sprite are no longer clobbered to undefined when they arrive in an earlier positional slot of Person/System/Container/Component/Boundary/Rel statements.

  • #7871 8d874c4 Thanks @​knsv-bot! - fix(flowchart): stop dagre layout from spamming warn-level logs on every node/edge/cluster

  • #8071 b3d1f63 Thanks @​pbrolin47! - fix(block): sibling blocks overlapping in block diagrams when one has a label wider than 200px

  • #7870 71b8843 Thanks @​knsv-bot! - fix: a RangeError: Invalid array length crash when rendering certain edges.

  • #7924 9cbef5d Thanks @​nightt5879! - fix(treeView): icons disappearing after strict security sanitization.

... (truncated)

Commits

Updates nanoid from 3.3.12 to 3.3.18

Release notes

Sourced from nanoid's releases.

3.3.18

3.3.17

  • Fixed infinite loop on zero size.

3.3.16

3.3.15

  • Fixed npm provenance error.

3.3.14

  • Fixed random pool corruption on big ID sizes.

3.3.13

  • Reduced npm package size.
Changelog

Sourced from nanoid's changelog.

3.3.18

3.3.17

  • Fixed infinite loop on zero size.

3.3.16

3.3.15

  • Fixed npm provenance error.

3.3.14

  • Fixed random pool corruption on big ID sizes.

3.3.13

  • Reduced npm package size.
Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nanoid since your current version.


Updates postcss from 8.5.15 to 8.5.28

Release notes

Sourced from postcss's releases.

8.5.28

  • Fixes types regression.

8.5.27

8.5.26

  • Fixed list.split() regression (by @​lazerg).
  • Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

  • Fixed 8.5.17 visitor regression.
  • Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

  • Preserve the BOM after the processing (by @​hdimer).

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

8.5.19

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

  • Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

  • Fixed Maximum call stack size exceeded error.
  • Fixed Prototype hijacking for postcss.fromJSON().
  • Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.28

  • Fixes types regression.

8.5.27

8.5.26

  • Fixed list.split() regression (by @​lazerg).
  • Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

  • Fixed 8.5.17 visitor regression.
  • Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

  • Preserve the BOM after the processing (by @​hdimer).

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

8.5.19

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

…dates

Bumps the npm_and_yarn group with 6 updates in the /ui directory:

| Package | From | To |
| --- | --- | --- |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `2.1.0` | `2.1.4` |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.4.11` | `3.4.15` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `4.2.0` | `4.3.2` |
| [mermaid](https://github.com/mermaid-js/mermaid) | `11.15.0` | `11.17.2` |
| [nanoid](https://github.com/ai/nanoid) | `3.3.12` | `3.3.18` |
| [postcss](https://github.com/postcss/postcss) | `8.5.15` | `8.5.28` |



Updates `brace-expansion` from 2.1.0 to 2.1.4
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v2.1.0...v2.1.4)

Updates `dompurify` from 3.4.11 to 3.4.15
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.11...3.4.15)

Updates `js-yaml` from 4.2.0 to 4.3.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.2.0...4.3.2)

Updates `mermaid` from 11.15.0 to 11.17.2
- [Release notes](https://github.com/mermaid-js/mermaid/releases)
- [Commits](https://github.com/mermaid-js/mermaid/compare/mermaid@11.15.0...mermaid@11.17.2)

Updates `nanoid` from 3.3.12 to 3.3.18
- [Release notes](https://github.com/ai/nanoid/releases)
- [Changelog](https://github.com/ai/nanoid/blob/3.3.18/CHANGELOG.md)
- [Commits](ai/nanoid@3.3.12...3.3.18)

Updates `postcss` from 8.5.15 to 8.5.28
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.15...8.5.28)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 2.1.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: dompurify
  dependency-version: 3.4.15
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 4.3.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: mermaid
  dependency-version: 11.17.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: nanoid
  dependency-version: 3.3.18
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: postcss
  dependency-version: 8.5.28
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@github-actions

github-actions Bot commented Sep 10, 2026 •

Copy link
Copy Markdown
Contributor
📦 Artifacts (1 jar)
Name Size Updated Expiration
jar 203.28 MB Oct 5, 26, 9:46:22 AM UTC Oct 12, 26, 9:46:15 AM UTC

🛡 Trivy

Vulnerability in: Java

Vulnerability Severity Package Installed Version Fixed Version
CVE-2026-55856 MEDIUM org.mariadb.jdbc:mariadb-java-client 3.5.8 2.7.14, 3.3.5, 3.4.3, 3.5.9
CVE-2026-55857 MEDIUM org.mariadb.jdbc:mariadb-java-client 3.5.8 2.7.14, 3.3.5, 3.4.3, 3.5.9
CVE-2026-55858 MEDIUM org.mariadb.jdbc:mariadb-java-client 3.5.8 2.7.14, 3.3.5, 3.4.3, 3.5.9
CVE-2026-61700 LOW org.mariadb.jdbc:mariadb-java-client 3.5.8 2.7.14, 3.3.5, 3.4.3, 3.5.9
CVE-2026-29062 HIGH tools.jackson.core:jackson-core 3.0.0 3.1.0
GHSA-2m67-wjpj-xhg9 HIGH tools.jackson.core:jackson-core 3.0.0 3.1.1
GHSA-r7wm-3cxj-wff9 HIGH tools.jackson.core:jackson-core 3.0.0 3.1.4
CVE-2026-18401 MEDIUM tools.jackson.core:jackson-core 3.0.0 3.1.0
CVE-2026-54512 HIGH tools.jackson.core:jackson-databind 3.0.0 3.1.4
CVE-2026-54513 HIGH tools.jackson.core:jackson-databind 3.0.0 3.1.4
CVE-2026-54514 MEDIUM tools.jackson.core:jackson-databind 3.0.0 2.21.4, 3.1.4
CVE-2026-54516 MEDIUM tools.jackson.core:jackson-databind 3.0.0 3.1.4
CVE-2026-54517 MEDIUM tools.jackson.core:jackson-databind 3.0.0 3.1.4
CVE-2026-54518 MEDIUM tools.jackson.core:jackson-databind 3.0.0 3.1.4
CVE-2026-59888 MEDIUM tools.jackson.core:jackson-databind 3.0.0 3.1.4
CVE-2026-59889 MEDIUM tools.jackson.core:jackson-databind 3.0.0 3.1.5, 3.2.1
🧪 Java Unit Tests ✅ (0 failed, 192 passed, 72 skipped)
TestsPassed ✅Skipped ⚠️FailedTime ⏱
Java Tests Report264 ran192 ✅72 ⚠️0 ❌1m 16s 326ms
🔁 Unreleased Commits ⚠️ (5 commits)

5 commits since v2.2.2

SHA Title Author Date
8622977 chore(deps): update kestra gradle & researchgate Ludovic DEHON Oct 2, 26, 9:45:42 PM UTC
4cf9e19 fix(plugin): remove trailing space from devcontainer README filename (#460) abhijit gorai Oct 5, 26, 8:55:06 AM UTC
364e33c fix(tool): guide skill activation with valid names (#458) Siddharth Reddy Oct 5, 26, 9:37:33 AM UTC
19aadf5 chore(deps): bump langchain4jVersion from 1.20.0 to 1.20.2 (#445) dependabot[bot] Oct 5, 26, 9:38:34 AM UTC
8416292 chore(deps): bump the npm_and_yarn group across 1 directory with 6 updates (#421) dependabot[bot] Oct 5, 26, 9:38:55 AM UTC
🔎 OpenGrep ✅ (0 findings)

Found 0 finding(s).

🐷 TruffleHog ✅ (0 secrets)

No secret found.

📊 Coverage — plugin ✅ (71.95%)

71.95% line coverage
2332/3241 lines covered
No develop baseline yet — this will compare against develop once it has a coverage run.

Coverage by module

Module Lines Coverage
root (new) 2332/3241 71.95%

@github-actions

github-actions Bot commented Sep 10, 2026 •

Copy link
Copy Markdown
Contributor

Tests report quick summary:

success ✅ > tests: 264, success: 192, skipped: 72, failed: 0

unfold for details
Project Status Success Skipped Failed
plugin-ai success ✅ 192 72 0

@fdelbrayelle
fdelbrayelle merged commit 8416292 into main Oct 5, 2026
1 check passed
@github-project-automation github-project-automation Bot moved this from To review to Done in Pull Requests Oct 5, 2026
@fdelbrayelle
fdelbrayelle deleted the dependabot/npm_and_yarn/ui/npm_and_yarn-9f730d3c36 branch October 5, 2026 09:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

3 participants