Skip to content

chore(deps): bump the npm_and_yarn group across 1 directory with 4 updates #2164

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): bump the npm_and_yarn group across 1 directory with 4 updates #2164

wants to merge 1 commit into from

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Nov 14, 2025

Bumps the npm_and_yarn group with 3 updates in the /docs directory: next, dompurify and mermaid.

Updates next from 15.3.3 to 15.5.6

Release notes

Sourced from next's releases.

v15.5.6

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • Turbopack: don't define process.cwd() in node_modules #83452

Credits

Huge thanks to @​mischnic for helping!

v15.5.5

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • Split code-frame into separate compiled package (#84238)
  • Add deprecation warning to Runtime config (#84650)
  • fix: unstable_cache should perform blocking revalidation during ISR revalidation (#84716)
  • feat: experimental.middlewareClientMaxBodySize body cloning limit (#84722)
  • fix: missing next/link types with typedRoutes (#84779)

Misc Changes

  • docs: early October improvements and fixes (#84334)

Credits

Huge thanks to @​devjiwonchoi, @​ztanner, and @​icyJoseph for helping!

v15.5.4

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • fix: ensure onRequestError is invoked when otel enabled (#83343)
  • fix: devtools initial position should be from next config (#83571)
  • [devtool] fix overlay styles are missing (#83721)
  • Turbopack: don't match dynamic pattern for node_modules packages (#83176)
  • Turbopack: don't treat metadata routes as RSC (#82911)
  • [turbopack] Improve handling of symlink resolution errors in track_glob and read_glob (#83357)
  • Turbopack: throw large static metadata error earlier (#82939)
  • fix: error overlay not closing when backdrop clicked (#83981)
  • Turbopack: flush Node.js worker IPC on error (#84077)

Misc Changes

  • [CNA] use linter preference (#83194)
  • CI: use KV for test timing data (#83745)

... (truncated)

Commits

Updates dompurify from 3.1.6 to 3.3.0

Release notes

Sourced from dompurify's releases.

DOMPurify 3.3.0

  • Added the SVG mask-type attribute to default allow-list, thanks @​prasadrajandran
  • Added support for ADD_ATTR and ADD_TAGS to accept functions, thanks @​nelstrom
  • Fixed an issue with the slot element being in both SVG and HTML allow-list, thanks @​Wim-Valgaeren

DOMPurify 3.2.7

  • Added new attributes and elements to default allow-list, thanks @​elrion018
  • Added tagName parameter to custom element attributeNameCheck, thanks @​nelstrom
  • Added better check for animated href attributes, thanks @​llamakko
  • Updated and improved the bundled types, thanks @​ssi02014
  • Updated several tests to better align with new browser encoding behaviors
  • Improved the handling of potentially risky content inside CDATA elements, thanks @​securityMB & @​terjanq
  • Improved the regular expression for raw-text elements to cover textareas, thanks @​securityMB & @​terjanq

DOMPurify 3.2.6

DOMPurify 3.2.5

  • Added a check to the mXSS detection regex to be more strict, thanks @​masatokinugawa
  • Added ESM type imports in source, removes patch function, thanks @​donmccurdy
  • Added script to verify various TypeScript configurations, thanks @​reduckted
  • Added more modern browsers to the Karma launchers list
  • Added Node 23.x to tested runtimes, removed Node 17.x
  • Fixed the generation of source maps, thanks @​reduckted
  • Fixed an unexpected behavior with ALLOWED_URI_REGEXP using the 'g' flag, thanks @​hhk-png
  • Fixed a few typos in the README file

DOMPurify 3.2.4

  • Fixed a conditional and config dependent mXSS-style bypass reported by @​nsysean
  • Added a new feature to allow specific hook removal, thanks @​davecardwell
  • Added purify.js and purify.min.js to exports, thanks @​Aetherinox
  • Added better logic in case no window object is president, thanks @​yehuya
  • Updated some dependencies called out by dependabot
  • Updated license files etc to show the correct year

DOMPurify 3.2.3

DOMPurify 3.2.2

  • Fixed a possible bypass in case a rather specific config for custom elements is set, thanks @​yaniv-git
  • Fixed several minor issues with the type definitions, thanks again @​reduckted
  • Fixed a minor issue with the types reference for trusted types, thanks @​reduckted
  • Fixed a minor problem with the template detection regex on some systems, thanks @​svdb99

... (truncated)

Commits
  • 36d1fbc Getting 3.x branch ready for 3.3.0 release (#1157)
  • eaa0bdb Merge pull request #1144 from cure53/main
  • f712593 fix: removed a possibly dossy regex
  • eb9b3b6 Merge branch 'main' of github.com:cure53/DOMPurify
  • ce006f7 chore: Preparing 3.2.7 release
  • ef0e0cb chore: Preparing 3.2.6 release
  • 2f09cd3 Update README.md
  • 6a795bc Merge pull request #1142 from cure53/dependabot/github_actions/actions/setup-...
  • 2458bbd build(deps): bump actions/setup-node from 4 to 5
  • e43d3f3 Merge pull request #1136 from cure53/dependabot/github_actions/actions/checko...
  • Additional commits viewable in compare view

Updates mermaid from 10.9.3 to 10.9.5

Commits
  • 665b3d0 chore: bump mermaid version to 10.9.5
  • 5b3912f refactor: remove unnecessary Element check
  • 01ff8c5 fix(deps): update dependency dompurify to ^3.2.4
  • d9618da chore: update dompurify to ^3.2.1
  • a65bcc5 fix: update dagre-d3-es to version 7.0.13
  • 80dcf2e chore: fixed formatting
  • cdff69f chore: updated upload artifact version
  • 2ce5801 chore: bump mermaid version to 10.9.4
  • 2efe338 fix: sanitize addHtmlLabel in createLabel
  • 7509b06 fix: Sanitize Katex
  • See full diff in compare view

Updates mermaid from 10.9.3 to 11.12.1

Commits
  • 665b3d0 chore: bump mermaid version to 10.9.5
  • 5b3912f refactor: remove unnecessary Element check
  • 01ff8c5 fix(deps): update dependency dompurify to ^3.2.4
  • d9618da chore: update dompurify to ^3.2.1
  • a65bcc5 fix: update dagre-d3-es to version 7.0.13
  • 80dcf2e chore: fixed formatting
  • cdff69f chore: updated upload artifact version
  • 2ce5801 chore: bump mermaid version to 10.9.4
  • 2efe338 fix: sanitize addHtmlLabel in createLabel
  • 7509b06 fix: Sanitize Katex
  • See full diff in compare view

Updates micromatch from 4.0.5 to 4.0.8

Release notes

Sourced from micromatch's releases.

4.0.8

Ultimate release that fixes both CVE-2024-4067 and CVE-2024-4068. We consider the issues low-priority, so even if you see automated scanners saying otherwise, don't be scared.

Changelog

Sourced from micromatch's changelog.

[4.0.8] - 2024-08-22

[4.0.7] - 2024-05-22

  • this is basically v4.0.5, with some README updates
  • it is vulnerable to CVE-2024-4067
  • Updated braces to v3.0.3 to avoid CVE-2024-4068
  • does NOT break API compatibility

[4.0.6] - 2024-05-21

  • Added hasBraces to check if a pattern contains braces.
  • Fixes CVE-2024-4067
  • BREAKS API COMPATIBILITY
  • Should be labeled as a major release, but it's not.
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump the npm_and_yarn group across 1 directory with 4 up…
f7e167d 
…dates

Bumps the npm_and_yarn group with 3 updates in the /docs directory: [next](https://github.com/vercel/next.js), [dompurify](https://github.com/cure53/DOMPurify) and [mermaid](https://github.com/mermaid-js/mermaid).


Updates `next` from 15.3.3 to 15.5.6
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v15.3.3...v15.5.6)

Updates `dompurify` from 3.1.6 to 3.3.0
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.1.6...3.3.0)

Updates `mermaid` from 10.9.3 to 10.9.5
- [Release notes](https://github.com/mermaid-js/mermaid/releases)
- [Commits](mermaid-js/mermaid@v10.9.3...v10.9.5)

Updates `mermaid` from 10.9.3 to 11.12.1
- [Release notes](https://github.com/mermaid-js/mermaid/releases)
- [Commits](mermaid-js/mermaid@v10.9.3...v10.9.5)

Updates `micromatch` from 4.0.5 to 4.0.8
- [Release notes](https://github.com/micromatch/micromatch/releases)
- [Changelog](https://github.com/micromatch/micromatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/micromatch@4.0.5...4.0.8)

---
updated-dependencies:
- dependency-name: next
  dependency-version: 15.5.6
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: dompurify
  dependency-version: 3.3.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: mermaid
  dependency-version: 10.9.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: mermaid
  dependency-version: 11.12.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: micromatch
  dependency-version: 4.0.8
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Nov 14, 2025
@vercel
Copy link

vercel bot commented Nov 14, 2025 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Preview Comments Updated (UTC)
nextra-docsgpt Building Building Preview Comment Nov 14, 2025 7:17pm
oss-docsgpt Ready Ready Preview Comment Nov 14, 2025 7:17pm

@github-actions github-actions bot added the docs label Nov 14, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file docs javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant