Bump the npm_and_yarn group across 1 directory with 10 updates #1

dependabot · 2025-07-25T10:04:35Z

Bumps the npm_and_yarn group with 10 updates in the / directory:

Package	From	To
vite	`5.4.7`	`5.4.19`
vitest	`2.1.1`	`2.1.9`
canvg	`3.0.10`	`3.0.11`
dompurify	`2.5.6`	`3.2.6`
jspdf	`2.5.1`	`3.0.1`
esbuild	`0.21.5`	`0.25.8`
@vitejs/plugin-vue	`5.1.4`	`5.2.4`
vite	`5.4.19`	`7.0.6`
vitest	`2.1.9`	`3.2.4`
form-data	`2.3.3`	`4.0.4`
@cypress/request	`3.0.1`	`3.0.9`
happy-dom	`13.3.8`	`18.0.1`

Updates vite from 5.4.7 to 5.4.19

Release notes

Sourced from vite's releases.

v5.4.19

Please refer to CHANGELOG.md for details.

v5.4.18

Please refer to CHANGELOG.md for details.

v5.4.17

Please refer to CHANGELOG.md for details.

v5.4.16

Please refer to CHANGELOG.md for details.

v5.4.15

Please refer to CHANGELOG.md for details.

v5.4.14

Please refer to CHANGELOG.md for details.

v5.4.13

Please refer to CHANGELOG.md for details.

v5.4.12

This version contains a breaking change due to security fixes. See GHSA-vg6x-rcgg-rjx6 for more details.

Please refer to CHANGELOG.md for details.

v5.4.11

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

5.4.19 (2025-04-30)

fix: backport #19965, check static serve file inside sirv (#19966) (766947e), closes #19965 #19966

5.4.18 (2025-04-10)

fix: backport #19830, reject requests with # in request-target (#19831) (823675b), closes #19830 #19831

5.4.17 (2025-04-03)

fix: backport #19782, fs check with svg and relative paths (#19784) (84b2b46), closes #19782 #19784

5.4.16 (2025-03-31)

fix: backport #19761, fs check in transform middleware (#19762) (b627c50), closes #19761 #19762

5.4.15 (2025-03-24)

fix: backport #19702, fs raw query with query separators (#19703) (807d7f0), closes #19702 #19703

5.4.14 (2025-01-21)

fix: preview.allowedHosts with specific values was not respected (#19246) (9df6e6b), closes #19246

fix: allow CORS from loopback addresses by default (#19249) (7d1699c), closes #19249

5.4.13 (2025-01-20)

fix: try parse server.origin URL (#19241) (5946215), closes #19241

5.4.12 (2025-01-20)

fix!: check host header to prevent DNS rebinding attacks and introduce server.allowedHosts (9da4abc)

fix!: default server.cors: false to disallow fetching from untrusted origins (dfea38f)

fix: verify token for HMR WebSocket connection (b71a5c8)

chore: add deps update changelog (ecd2375)

... (truncated)

Commits

80a333a release: v5.4.19
766947e fix: backport #19965, check static serve file inside sirv (#19966)
731b77d release: v5.4.18
823675b fix: backport #19830, reject requests with # in request-target (#19831)
0a2518a release: v5.4.17
84b2b46 fix: backport #19782, fs check with svg and relative paths (#19784)
712cb71 release: v5.4.16
b627c50 fix: backport #19761, fs check in transform middleware (#19762)
9b0f4c8 release: v5.4.15
807d7f0 fix: backport #19702, fs raw query with query separators (#19703)
Additional commits viewable in compare view

Updates vitest from 2.1.1 to 2.1.9

Release notes

Sourced from vitest's releases.

v2.1.9

This release includes security patches for:

Browser mode serves arbitrary files | CVE-2025-24963

Remote Code Execution when accessing a malicious website while Vitest API server is listening | CVE-2025-24964

   🐞 Bug Fixes

backport vitest-dev/vitest#7317 to v2 - by @hi-ogawa in vitest-dev/vitest#7318

(backport #7340 to v2) restrict served files from /__screenshot-error - by @hi-ogawa in vitest-dev/vitest#7343

    View changes on GitHub

v2.1.8

   🐞 Bug Fixes

Support Node 21 - by @sheremet-va (92f7a)

    View changes on GitHub

v2.1.7

   🐞 Bug Fixes

Revert support for Vite 6 - by @sheremet-va (fbe5c)

This introduced some breaking changes (vitest-dev/vitest#6992). We will enable support for it later. In the meantime, you can still use pnpm.overrides or yarn resolutions to override the vite version in the vitest package - the APIs are compatible.

    View changes on GitHub

v2.1.6

🚀 Features

Support Vite 6

    View changes on GitHub

v2.1.5

   🐞 Bug Fixes

dangerouslyIgnoreUnhandledErrors without base reporter - by @AriPerkkio in vitest-dev/vitest#6808 (0bf0a)

Capture unhandledRejection even when base reporter is not used - by @AriPerkkio in vitest-dev/vitest#6812 (8878b)

Don't change the working directory when loading workspace projects - by @sheremet-va in vitest-dev/vitest#6811 (f0aea)

Remove sequence.concurrent from the RuntimeConfig type - by @sheremet-va in vitest-dev/vitest#6880 (6af73)

Stop the runner before restarting, restart on workspace config change - by @sheremet-va in vitest-dev/vitest#6859 (b01df)

Don't rerun on Esc or Ctrl-C during watch filter - by @hi-ogawa in vitest-dev/vitest#6895 (98f76)

Print ssrTransform error - by @hi-ogawa in vitest-dev/vitest#6885 (4c96c)

Throw an error and a warning if .poll, .element, .rejects/.resolves, and locator.* weren't awaited - by @sheremet-va in vitest-dev/vitest#6877 (93b67)

browser:

Don't process the default css styles - by @sheremet-va in vitest-dev/vitest#6861 (0d67f)

Support non US key input - by @hi-ogawa in vitest-dev/vitest#6873 (5969d)

... (truncated)

Commits

c9e59a0 chore: release v2.1.9
e0fe1d8 fix: backport #7317 to v2 (#7318)
d69cc75 bump: 2.1.8
92f7a2a fix: support Node 21
81ed45b chore: release v2.1.7
fbe5c39 fix: revert support for Vite 6
b936702 bump: 2.1.6
32f23b9 chore: release v2.1.5
417bdb4 fix(browser): init browsers eagerly when tests are running (#6876)
93b67c2 fix: throw an error and a warning if .poll, .element, .rejects/`.resolv...
Additional commits viewable in compare view

Updates canvg from 3.0.10 to 3.0.11

Release notes

Sourced from canvg's releases.

v3.0.11

Bug Fixes

fix prototype pollution vulneralbility

Changelog

Sourced from canvg's changelog.

3.0.11 (2025-03-13)

Bug Fixes

fix prototype pollution vulneralbility

[3.0.9] - 2021-10-04

Fixed

#1480

#1484

[3.0.8] - 2021-07-31

Fixed

#1460

#108

#1439

#1364

[3.0.7] - 2020-10-17

Fixed

#1133

#1001

#977

#1196

#1111

#1161

[3.0.6] - 2020-03-25

Fixed

#747

#897

#908

#941

#944

#945

#946

[3.0.1] - 2019-12-03

Fixed

#816

[3.0.0] - 2019-10-23

Added

OffscreenCanvas support.

Changed

JavaScript -> TypeScript.

Fixed

#782

... (truncated)

Commits

See full diff in compare view

Updates dompurify from 2.5.6 to 3.2.6

Release notes

Sourced from dompurify's releases.

DOMPurify 3.2.6

Fixed several typos and removed clutter from our documentation, thanks @Rotzbua

Added matrix: as an allowed URI scheme, thanks @kleinesfilmroellchen

Added better config hardening against prototype pollution, thanks @EffectRenan

Added better handling of attribute removal, thanks @michalnieruchalski-tiugo

Added better configuration for aggressive mXSS scrubbing behavior, thanks @BryanValverdeU

Removed the script that caused the fake entry CVE-2025-48050

DOMPurify 3.2.5

Added a check to the mXSS detection regex to be more strict, thanks @masatokinugawa

Added ESM type imports in source, removes patch function, thanks @donmccurdy

Added script to verify various TypeScript configurations, thanks @reduckted

Added more modern browsers to the Karma launchers list

Added Node 23.x to tested runtimes, removed Node 17.x

Fixed the generation of source maps, thanks @reduckted

Fixed an unexpected behavior with ALLOWED_URI_REGEXP using the 'g' flag, thanks @hhk-png

Fixed a few typos in the README file

DOMPurify 3.2.4

Fixed a conditional and config dependent mXSS-style bypass reported by @nsysean

Added a new feature to allow specific hook removal, thanks @davecardwell

Added purify.js and purify.min.js to exports, thanks @Aetherinox

Added better logic in case no window object is president, thanks @yehuya

Updated some dependencies called out by dependabot

Updated license files etc to show the correct year

DOMPurify 3.2.3

Fixed two conditional sanitizer bypasses discovered by @parrot409 and @Slonser

Updated the attribute clobbering checks to prevent future bypasses, thanks @parrot409

DOMPurify 3.2.2

Fixed a possible bypass in case a rather specific config for custom elements is set, thanks @yaniv-git

Fixed several minor issues with the type definitions, thanks again @reduckted

Fixed a minor issue with the types reference for trusted types, thanks @reduckted

Fixed a minor problem with the template detection regex on some systems, thanks @svdb99

DOMPurify 3.2.1

Fixed several minor issues with the type definitions, thanks @reduckted @ghiscoding @asamuzaK @MiniDigger

Fixed an issue with non-minified dist files and order of imports, thanks @reduckted

DOMPurify 3.2.0

Added type declarations, thanks @reduckted , @philmayfield, @aloisklink, @ssi02014 and others

Fixed a minor issue with the handling of hooks, thanks @kevin-mizu

DOMPurify 3.1.7

Fixed an issue with comment detection and possible bypasses with specific config settings, thanks @masatokinugawa

Fixed several smaller typos in documentation and test & build files, thanks @christianhg

Added better support for Angular compiler, thanks @jeroen1602

Added several new attributes to HTML and SVG allow-list, thanks @Gigabyte5671 and @Rotzbua

... (truncated)

Commits

32f765e Merge pull request #1105 from cure53/main
6158ecb Merge pull request #1103 from cure53/main
0f7ce14 chore: Preparing 3.2.6 release
848463b chore: removed unused test server script
b0e0ebb Update README.md
f094f76 Update README.md
6bc6d60 Merge pull request #1101 from odaysec/patch-1
e9afd60 Update server.js
166151c see #1095
ac7c594 Merge pull request #1096 from Rotzbua/fix_missing
Additional commits viewable in compare view

Updates jspdf from 2.5.1 to 3.0.1

Release notes

Sourced from jspdf's releases.

v3.0.1

This release fixes two security vulnerabilities:

Upgrade optional dependency canvg to 3.0.11

Fix a ReDoS vulnerability in the addImage method and the methods html and addSvgAsImage, which depend on addImage

v3.0.0

This major release officially drops support for Internet Explorer and fixes a security vulnerability in the html function by updating the optional dependency dompurify to v3.2.4. There are no other breaking changes.

New Contributors

@nlqivision made their first contribution in parallax/jsPDF#3812

@dependabot made their first contribution in parallax/jsPDF#3826

@hainenber made their first contribution in parallax/jsPDF#3827

Full Changelog: parallax/jsPDF@v2.5.2...v3.0.0

v2.5.2

This release upgrades the Dompurify dependency to 2.5.4 with fixes a vulnerability with high severity: GHSA-mmhx-hmjr-r674.

It also upgrades fflate, core-js, and @babel/runtime to more recent versions.

What's Changed

Implement justifying for unicode fonts by @owenl131 in parallax/jsPDF#3285

chore: update dompurify version 2.5.4 by @MarcioMeier in parallax/jsPDF#3768

[Snyk] Upgrade fflate from 0.4.8 to 0.8.1 by @MrRio in parallax/jsPDF#3666

[Snyk] Upgrade core-js from 3.6.5 to 3.33.0 by @MrRio in parallax/jsPDF#3664

[Snyk] Upgrade @babel/runtime from 7.14.6 to 7.23.2 by @MrRio in parallax/jsPDF#3665

Commits

57cbe94 3.0.1
7cf6ddf fix: upgrade @babel/runtime from 7.26.0 to 7.26.7 (#3832)
b167c43 improve performance of data url parsing in addimage (#3843)
c4b7421 don't use saucelabs in CI to be able to correctly run CI for PRs
6136d4b Upgrade canvg from 3.0.6 to 3.0.11 (#3836)
d0c605f 3.0.0
7aa332e fix(sec): remove MSIE support to allow upgrading to vuln-free dompurify v3 ...
e2c1818 Bump rollup from 2.21.0 to 2.79.2 (#3826)
5aad456 fix: upgrade @babel/runtime from 7.25.6 to 7.26.0 (#3822)
637b5d3 Upgrade dompurify to 2.5.6 to 2.5.8 (#3812)
Additional commits viewable in compare view

Updates esbuild from 0.21.5 to 0.25.8

Release notes

Sourced from esbuild's releases.

v0.25.8
Fix another TypeScript parsing edge case (#4248)

This fixes a regression with a change in the previous release that tries to more accurately parse TypeScript arrow functions inside the ?: operator. The regression specifically involves parsing an arrow function containing a #private identifier inside the middle of a ?: ternary operator inside a class body. This was fixed by propagating private identifier state into the parser clone used to speculatively parse the arrow function body. Here is an example of some affected code:
class CachedDict {
  #has = (a: string) => dict.has(a);
  has = window
    ? (word: string): boolean => this.#has(word)
    : this.#has;
}
Fix a regression with the parsing of source phase imports

The change in the previous release to parse source phase imports failed to properly handle the following cases:
import source from 'bar'
import source from from 'bar'
import source type foo from 'bar'
Parsing for these cases should now be fixed. The first case was incorrectly treated as a syntax error because esbuild was expecting the second case. And the last case was previously allowed but is now forbidden. TypeScript hasn't added this feature yet so it remains to be seen whether the last case will be allowed, but it's safer to disallow it for now. At least Babel doesn't allow the last case when parsing TypeScript, and Babel was involved with the source phase import specification.
v0.25.7
Parse and print JavaScript imports with an explicit phase (#4238)

This release adds basic syntax support for the defer and source import phases in JavaScript:
defer

This is a stage 3 proposal for an upcoming JavaScript feature that will provide one way to eagerly load but lazily initialize imported modules. The imported module is automatically initialized on first use. Support for this syntax will also be part of the upcoming release of TypeScript 5.9. The syntax looks like this:
import defer * as foo from "<specifier>";
const bar = await import.defer("<specifier>");
Note that this feature deliberately cannot be used with the syntax import defer foo from "<specifier>" or import defer { foo } from "<specifier>".
source

This is a stage 3 proposal for an upcoming JavaScript feature that will provide another way to eagerly load but lazily initialize imported modules. The imported module is returned in an uninitialized state. Support for this syntax may or may not be a part of TypeScript 5.9 (see this issue for details). The syntax looks like this:
import source foo from "<specifier>";
const bar = await import.source("<specifier>");

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2024

This changelog documents all esbuild versions published in the year 2024 (versions 0.19.12 through 0.24.2).

0.24.2

Fix regression with --define and import.meta (#4010, #4012, #4013)

The previous change in version 0.24.1 to use a more expression-like parser for define values to allow quoted property names introduced a regression that removed the ability to use --define:import.meta=.... Even though import is normally a keyword that can't be used as an identifier, ES modules special-case the import.meta expression to behave like an identifier anyway. This change fixes the regression.

This fix was contributed by @sapphi-red.

0.24.1
Allow es2024 as a target in tsconfig.json (#4004)

TypeScript recently added es2024 as a compilation target, so esbuild now supports this in the target field of tsconfig.json files, such as in the following configuration file:
{
  "compilerOptions": {
    "target": "ES2024"
  }
}
As a reminder, the only thing that esbuild uses this field for is determining whether or not to use legacy TypeScript behavior for class fields. You can read more in the documentation.

This fix was contributed by @billyjanitsch.
Allow automatic semicolon insertion after get/set

This change fixes a grammar bug in the parser that incorrectly treated the following code as a syntax error:
class Foo {
  get
  *x() {}
  set
  *y() {}
}
The above code will be considered valid starting with this release. This change to esbuild follows a similar change to TypeScript which will allow this syntax starting with TypeScript 5.7.
Allow quoted property names in --define and --pure (#4008)

The define and pure API options now accept identifier expressions containing quoted property names. Previously all identifiers in the identifier expression had to be bare identifiers. This change now makes --define and --pure consistent with --global-name, which already supported quoted property names. For example, the following is now possible:

... (truncated)

Commits

8c71947 publish 0.25.8 to npm
0508f24 some parsing fixes for source phase imports
6e4be2f js parser: recover from bad #private identifiers
c9c6357 fix #4248: #private ids in arrow fn body in ?:
9b42f68 publish 0.25.7 to npm
9ba01d1 abs-paths: js api and tests
ca196c9 fix for parser backtracking crash
2979b84 fix #4241: ts arrow function type backtrack (hack)
1180410 fix an unused variable warning
fc3da57 fix #4238: add defer and source import phases
Additional commits viewable in compare view

Updates @vitejs/plugin-vue from 5.1.4 to 5.2.4

Release notes

Sourced from @vitejs/plugin-vue's releases.

plugin-vue@5.2.4

Please refer to CHANGELOG.md for details.

plugin-vue@5.2.3

Please refer to CHANGELOG.md for details.

plugin-vue@5.2.2

Please refer to CHANGELOG.md for details.

plugin-vue@5.2.1

Please refer to CHANGELOG.md for details.

plugin-vue@5.2.0

Please refer to CHANGELOG.md for details.

plugin-vue@5.1.5

Please refer to CHANGELOG.md for details.

Changelog

Sourced from @vitejs/plugin-vue's changelog.

5.2.4 (2025-05-09)

Features

plugin-vue: use transformWithOxc if rolldown-vite is detected (#584) (6ac8e3a)

Bug Fixes

plugin-vue: handle sourcemap with empty script code (#585) (7f73970)

plugin-vue: when the resource path contains chinese characters, dev/build is inconsistent (#550) (5f6affe)

Miscellaneous Chores

deps: update upstream (#542) (ef446fc)

deps: update upstream (#569) (98381b2)

fix types with Vite 6.3 (#559) (8002511)

use rollup types exposed from Vite (#583) (2e1287f)

5.2.3 (2025-03-17)

5.2.2 (2025-03-17)

Features

css: tree shake scoped styles (#533) (333094f)

pass descriptor vapor flag to compileTemplte (219e007)

Bug Fixes

deps: update all non-major dependencies (#482) (cdbae68)

deps: update all non-major dependencies (#488) (5d39582)

generate unique component id (#538) (2704e85)

index: move the if check earlier to avoid creating unnecessary ssr when entering return block (#523) (2135c84)

plugin-vue: default value for compile time flags (#495) (ae9d948)

plugin-vue: ensure HMR updates styles when SFC is treated as a type dependency (#541) (4abe3be)

plugin-vue: resolve sourcemap conflicts in build watch mode with cached modules (#505) (906cebb)

plugin-vue: support external import URLs for monorepos (#524) (cdd4922)

plugin-vue: support vapor template-only component (#529) (95be153)

plugin-vue: suppress warnings for non-recognized pseudo selectors form lightningcss (#521) (15c0eb0)

properly interpret boolean values in define (#545) (46d3d65)

Miscellaneous Chores

deps: update dependency rollup to ^4.27.4 (#479) (428320d)

deps: update dependency rollup to ^4.28.1 (#484) (388403f)

deps: update dependency rollup to ^4.29.1 (#493) (b092bc8)

deps: update upstream (#503) (8c12b9f)

deps: update upstream (#511) (d057351)

deps: update upstream (#526) (59946d3)

plugin-vue: simplify resolved declaration (7288a59)

5.2.1 (2024-11-26)

Miscellaneous Chores

... (truncated)

Commits

6027d40 release: plugin-vue@5.2.4
98381b2 chore(deps): update upstream (#569)
6ac8e3a feat(plugin-vue): use transformWithOxc if rolldown-vite is detected (#584)
7f73970 fix(plugin-vue): handle sourcemap with empty script code (#585)
2e1287f chore: use rollup types exposed from Vite (#583)
ef446fc chore(deps): update upstream (#542)
5f6affe fix(plugin-vue): when the resource path contains chinese characters, dev/buil...
8002511 chore: fix types with Vite 6.3 (#559)
b733b91 release: plugin-vue@5.2.3
4bc5517 Revert "fix: generate unique component id" (#548)
Additional commits viewable in compare view

Updates vite from 5.4.19 to 7.0.6

Release notes

Sourced from vite's releases.

v5.4.19

Please refer to CHANGELOG.md for details.

v5.4.18

Please refer to CHANGELOG.md for details.

v5.4.17

Please refer to CHANGELOG.md for details.

v5.4.16

Please refer to CHANGELOG.md for details.

v5.4.15

Please refer to CHANGELOG.md for details.

v5.4.14

Please refer to CHANGELOG.md for details.

v5.4.13

Please refer to CHANGELOG.md for details.

v5.4.12

This version contains a breaking change due to security fixes. See GHSA-vg6x-rcgg-rjx6 for more details.

Please refer to CHANGELOG.md for details.

v5.4.11

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

5.4.19 (2025-04-30)

fix: backport #19965, check static serve file inside sirv (#19966) (766947e), closes #19965 #19966

5.4.18 (2025-04-10)

fix: backport #19830, reject requests with # in request-target (#19831) (823675b), closes #19830 #19831

5.4.17 (2025-04-03)

fix: backport #19782, fs check with svg and relative paths (#19784) (84b2b46), closes #19782 #19784

5.4.16 (2025-03-31)

fix: backport #19761, fs check in transform middleware (#19762) (b627c50), closes #19761 #19762

5.4.15 (2025-03-24)

fix: backport #19702, fs raw query with query separators (#19703) (807d7f0), closes #19702 #19703

5.4.14 (2025-01-21)

fix: preview.allowedHosts with specific values was not respected (#19246) (9df6e6b), closes #19246

fix: allow CORS from loopback addresses by default (#19249) (7d1699c), closes #19249

5.4.13 (2025-01-20)

fix: try parse server.origin URL (#19241) (5946215), closes #19241

5.4.12 (2025-01-20)

fix!: check host header to prevent DNS rebinding attacks and introduce server.allowedHosts (9da4abc)

fix!: default server.cors: false to disallow fetching from untrusted origins (dfea38f)

fix: verify token for HMR WebSocket connection (b71a5c8)

chore: add deps update changelog (ecd2375)

... (truncated)

Commits

80a333a release: v5.4.19
76694... Description has been truncated

Bumps the npm_and_yarn group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `5.4.7` | `5.4.19` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `2.1.1` | `2.1.9` | | [canvg](https://github.com/canvg/canvg) | `3.0.10` | `3.0.11` | | [dompurify](https://github.com/cure53/DOMPurify) | `2.5.6` | `3.2.6` | | [jspdf](https://github.com/MrRio/jsPDF) | `2.5.1` | `3.0.1` | | [esbuild](https://github.com/evanw/esbuild) | `0.21.5` | `0.25.8` | | [@vitejs/plugin-vue](https://github.com/vitejs/vite-plugin-vue/tree/HEAD/packages/plugin-vue) | `5.1.4` | `5.2.4` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `5.4.19` | `7.0.6` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `2.1.9` | `3.2.4` | | [form-data](https://github.com/form-data/form-data) | `2.3.3` | `4.0.4` | | [@cypress/request](https://github.com/cypress-io/request) | `3.0.1` | `3.0.9` | | [happy-dom](https://github.com/capricorn86/happy-dom) | `13.3.8` | `18.0.1` | Updates `vite` from 5.4.7 to 5.4.19 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v5.4.19/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v5.4.19/packages/vite) Updates `vitest` from 2.1.1 to 2.1.9 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Commits](https://github.com/vitest-dev/vitest/commits/v2.1.9/packages/vitest) Updates `canvg` from 3.0.10 to 3.0.11 - [Release notes](https://github.com/canvg/canvg/releases) - [Changelog](https://github.com/canvg/canvg/blob/v3.0.11/CHANGELOG.md) - [Commits](https://github.com/canvg/canvg/commits/v3.0.11) Updates `dompurify` from 2.5.6 to 3.2.6 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@2.5.6...3.2.6) Updates `jspdf` from 2.5.1 to 3.0.1 - [Release notes](https://github.com/MrRio/jsPDF/releases) - [Changelog](https://github.com/parallax/jsPDF/blob/master/RELEASE.md) - [Commits](parallax/jsPDF@v2.5.1...v3.0.1) Updates `esbuild` from 0.21.5 to 0.25.8 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2024.md) - [Commits](evanw/esbuild@v0.21.5...v0.25.8) Updates `@vitejs/plugin-vue` from 5.1.4 to 5.2.4 - [Release notes](https://github.com/vitejs/vite-plugin-vue/releases) - [Changelog](https://github.com/vitejs/vite-plugin-vue/blob/main/packages/plugin-vue/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite-plugin-vue/commits/plugin-vue@5.2.4/packages/plugin-vue) Updates `vite` from 5.4.19 to 7.0.6 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v5.4.19/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v5.4.19/packages/vite) Updates `vitest` from 2.1.9 to 3.2.4 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Commits](https://github.com/vitest-dev/vitest/commits/v2.1.9/packages/vitest) Updates `form-data` from 2.3.3 to 4.0.4 - [Release notes](https://github.com/form-data/form-data/releases) - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](https://github.com/form-data/form-data/commits/v4.0.4) Updates `@cypress/request` from 3.0.1 to 3.0.9 - [Release notes](https://github.com/cypress-io/request/releases) - [Changelog](https://github.com/cypress-io/request/blob/master/CHANGELOG.md) - [Commits](cypress-io/request@v3.0.1...v3.0.9) Updates `happy-dom` from 13.3.8 to 18.0.1 - [Release notes](https://github.com/capricorn86/happy-dom/releases) - [Commits](capricorn86/happy-dom@v13.3.8...v18.0.1) --- updated-dependencies: - dependency-name: vite dependency-version: 5.4.19 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: vitest dependency-version: 2.1.9 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: canvg dependency-version: 3.0.11 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: dompurify dependency-version: 3.2.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: jspdf dependency-version: 3.0.1 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: esbuild dependency-version: 0.25.8 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@vitejs/plugin-vue" dependency-version: 5.2.4 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 7.0.6 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: vitest dependency-version: 3.2.4 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: form-data dependency-version: 4.0.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@cypress/request" dependency-version: 3.0.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: happy-dom dependency-version: 18.0.1 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 25, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump the npm_and_yarn group across 1 directory with 10 updates #1

Bump the npm_and_yarn group across 1 directory with 10 updates #1

Uh oh!

dependabot bot commented on behalf of github Jul 25, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Bump the npm_and_yarn group across 1 directory with 10 updates #1

Are you sure you want to change the base?

Bump the npm_and_yarn group across 1 directory with 10 updates #1

Uh oh!

Conversation

dependabot bot commented on behalf of github Jul 25, 2025

v5.4.19

v5.4.18

v5.4.17

v5.4.16

v5.4.15

v5.4.14

v5.4.13

v5.4.12

v5.4.11

5.4.19 (2025-04-30)

5.4.18 (2025-04-10)

5.4.17 (2025-04-03)

5.4.16 (2025-03-31)

5.4.15 (2025-03-24)

5.4.14 (2025-01-21)

5.4.13 (2025-01-20)

5.4.12 (2025-01-20)

v2.1.9

🐞 Bug Fixes

View changes on GitHub

v2.1.8

🐞 Bug Fixes

View changes on GitHub

v2.1.7

🐞 Bug Fixes

View changes on GitHub

v2.1.6

🚀 Features

View changes on GitHub

v2.1.5

🐞 Bug Fixes

v3.0.11

Bug Fixes

3.0.11 (2025-03-13)

Bug Fixes

[3.0.9] - 2021-10-04

Fixed

[3.0.8] - 2021-07-31

Fixed

[3.0.7] - 2020-10-17

Fixed

[3.0.6] - 2020-03-25

Fixed

[3.0.1] - 2019-12-03

Fixed

[3.0.0] - 2019-10-23

Added

Changed

Fixed

DOMPurify 3.2.6

DOMPurify 3.2.5

DOMPurify 3.2.4

DOMPurify 3.2.3

DOMPurify 3.2.2

DOMPurify 3.2.1

DOMPurify 3.2.0

DOMPurify 3.1.7

v3.0.1

v3.0.0

New Contributors

v2.5.2

What's Changed

v0.25.8

v0.25.7

Changelog: 2024

0.24.2

0.24.1

plugin-vue@5.2.4

plugin-vue@5.2.3

plugin-vue@5.2.2

plugin-vue@5.2.1

plugin-vue@5.2.0

plugin-vue@5.1.5

5.2.4 (2025-05-09)