Skip to content

build(deps): bump the npm_and_yarn group across 2 directories with 16 updates - #369

Open
dependabot[bot] wants to merge 1 commit into
developmentfrom
dependabot/npm_and_yarn/npm_and_yarn-c1512695b7
Open

build(deps): bump the npm_and_yarn group across 2 directories with 16 updates#369
dependabot[bot] wants to merge 1 commit into
developmentfrom
dependabot/npm_and_yarn/npm_and_yarn-c1512695b7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 2, 2026

Copy link
Copy Markdown

Bumps the npm_and_yarn group with 2 updates in the / directory: @cyclonedx/cyclonedx-npm and vitest.
Bumps the npm_and_yarn group with 11 updates in the /docs directory:

Package From To
dompurify 3.3.1 3.4.12
fast-uri 3.1.0 3.1.5
follow-redirects 1.15.11 1.16.0
postcss 8.5.6 8.5.25
qs 6.14.2 6.15.3
@babel/plugin-transform-modules-systemjs 7.29.0 7.29.8
mermaid 11.12.3 11.16.0
shell-quote 1.8.3 1.10.0
svgo 3.3.2 3.3.4
ws 7.5.10 7.5.13
websocket-driver 0.7.4 0.7.5

Updates @cyclonedx/cyclonedx-npm from 4.2.1 to 5.0.0

Release notes

Sourced from @​cyclonedx/cyclonedx-npm's releases.

5.0.0

[!IMPORTANT]
This release includes a fix for a known security vulnerability.

BREAKING Changes

  • Reworked npm handling – npm is now executed explicitly rather than through a subshell.
    The behavior when npm_execpath is present remains unchanged.

Fixed

  • Eliminated a potential shell‑injection vulnerability in the --workspace argument (via #1476)
    See GHSA-v75r-vx73-82pj

#1476: CycloneDX/cyclonedx-node-npm#1476

What's Changed

New Contributors

Full Changelog: CycloneDX/cyclonedx-node-npm@v4.2.1...v5.0.0

Changelog

Sourced from @​cyclonedx/cyclonedx-npm's changelog.

5.0.0 - 2026-06-16

  • BREAKING Changes
    • Reworked npm handling - npm is now executed explicitly rather than through a subshell.
      The behavior when npm_execpath is present remains unchanged.
  • Fixed
    • Eliminated a potential shell‑injection vulnerability in the --workspace argument (via #1476)
      See GHSA-v75r-vx73-82pj
  • Tests
    • Added regression test for shell injections (via #1476)

#1476: CycloneDX/cyclonedx-node-npm#1476

Commits

Updates vitest from 1.6.1 to 3.2.6

Release notes

Sourced from vitest's releases.

v3.2.6

   🐞 Bug Fixes

    View changes on GitHub

v3.2.5

   🚀 Features

   🐞 Bug Fixes

    View changes on GitHub

v3.2.4

   🐞 Bug Fixes

    View changes on GitHub

v3.2.3

   🚀 Features

... (truncated)

Commits
  • b6d56f8 chore: release v3.2.6
  • 16f120d fix: pin last supported vite-node version
  • 2cbad0a chore: release v3.2.5
  • 385a1ae fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
  • af88b1f feat(api): add allowWrite and allowExec options to api [backport to v3]...
  • c666d14 chore: release v3.2.4
  • 8a18c8e fix(cli): throw error when --shard x/\<count> exceeds count of test files (#...
  • 8abd7cc chore(deps): update tinypool (#8174)
  • 93f3200 fix(deps): update all non-major dependencies (#8123)
  • 0c3be6f fix(coverage): ignore SCSS in browser mode (#8161)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for vitest since your current version.


Updates esbuild from 0.21.5 to 0.28.1

Release notes

Sourced from esbuild's releases.

v0.28.1

  • Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

    This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

    Thanks to @​dellalibera for reporting this issue.

  • Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

    The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

    Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

    Thanks to @​sondt99 for reporting this issue.

  • Avoid inlining using and await using declarations (#4482)

    Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

    // Original code
{
  using x = new Resource()
  x.activate()
}
// Old output (with --minify)
new Resource().activate();
// New output (with --minify)
{using e=new Resource;e.activate()}

  • Fix module evaluation when an error is thrown (#4461, #4467)

    If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

  • Fix some edge cases around the new operator (#4477)

    Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

    // Original code
new (foo()`bar`)()
new (foo()?.bar)()
// Old output
new foo()bar();
new (foo())?.bar();

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2024

This changelog documents all esbuild versions published in the year 2024 (versions 0.19.12 through 0.24.2).

0.24.2

  • Fix regression with --define and import.meta (#4010, #4012, #4013)

    The previous change in version 0.24.1 to use a more expression-like parser for define values to allow quoted property names introduced a regression that removed the ability to use --define:import.meta=.... Even though import is normally a keyword that can't be used as an identifier, ES modules special-case the import.meta expression to behave like an identifier anyway. This change fixes the regression.

    This fix was contributed by @​sapphi-red.

0.24.1

  • Allow es2024 as a target in tsconfig.json (#4004)

    TypeScript recently added es2024 as a compilation target, so esbuild now supports this in the target field of tsconfig.json files, such as in the following configuration file:

    {
  "compilerOptions": {
    "target": "ES2024"
  }
}

    As a reminder, the only thing that esbuild uses this field for is determining whether or not to use legacy TypeScript behavior for class fields. You can read more in the documentation.

    This fix was contributed by @​billyjanitsch.

  • Allow automatic semicolon insertion after get/set

    This change fixes a grammar bug in the parser that incorrectly treated the following code as a syntax error:

    class Foo {
  get
  *x() {}
  set
  *y() {}
}

    The above code will be considered valid starting with this release. This change to esbuild follows a similar change to TypeScript which will allow this syntax starting with TypeScript 5.7.

  • Allow quoted property names in --define and --pure (#4008)

    The define and pure API options now accept identifier expressions containing quoted property names. Previously all identifiers in the identifier expression had to be bare identifiers. This change now makes --define and --pure consistent with --global-name, which already supported quoted property names. For example, the following is now possible:

    

    • 






... (truncated)





Commits





Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for esbuild since your current version.






Updates vite from 5.4.21 to 7.3.6



Release notes

Sourced from vite's releases.




v7.3.6


Please refer to CHANGELOG.md for details.


v7.3.5


Please refer to CHANGELOG.md for details.


v7.3.3


Please refer to CHANGELOG.md for details.


v7.3.2


Please refer to CHANGELOG.md for details.


v7.3.1


Please refer to CHANGELOG.md for details.


v7.3.0


Please refer to CHANGELOG.md for details.


v7.2.7


Please refer to CHANGELOG.md for details.


v7.2.6


Please refer to CHANGELOG.md for details.


v7.2.5


Please refer to CHANGELOG.md for details.


Note: 7.2.5 failed to publish so it is skipped on npm


v7.2.4


Please refer to CHANGELOG.md for details.


v7.2.3


Please refer to CHANGELOG.md for details.


v7.2.2


Please refer to CHANGELOG.md for details.


v7.2.1


Please refer to CHANGELOG.md for details.


v7.2.0


Please refer to CHANGELOG.md for details.


v7.2.0-beta.1


Please refer to CHANGELOG.md for details.


v7.2.0-beta.0


Please refer to CHANGELOG.md for details.





... (truncated)





Changelog

Sourced from vite's changelog.




7.3.6 (2026-06-25)


Features



7.3.5 (2026-06-01)


Bug Fixes



Miscellaneous Chores



7.3.4 (2026-06-01)


Bug Fixes



7.3.3 (2026-05-07)


Bug Fixes



7.3.2 (2026-04-06)


Bug Fixes



7.3.1 (2026-01-07)


Features


    

  • add ignoreOutdatedRequests option to optimizeDeps (#21364) (9d39d37)
    • 



7.3.0 (2025-12-15)


Features


    

  • deps: update esbuild from ^0.25.0 to ^0.27.0 (#21183) (cff26ec)
    • 



7.2.7 (2025-12-08)


Bug Fixes



7.2.6 (2025-12-01)


7.2.5 (2025-12-01)





... (truncated)





Commits






Updates dompurify from 3.3.1 to 3.4.12



Release notes

Sourced from dompurify's releases.




DOMPurify 3.4.12


    

  • Fixed an issue where a hook would not get called for custom elements, thanks @​Rikuxx0
    • 

  • Hardened the handling of hooks removing elements, @​mkrause-bee360
    • 

  • Added support for a few new SVG attributes, thanks @​cbn-falias & @​Develop-KIM
    • 

  • Hardened the handling of declarative partial updates
    • 

  • Updated the documentation is several spots, README, wiki, etc.
    • 

  • Bumped several dependencies where possible
    • 



DOMPurify 3.4.11


    

  • Fixed an issue with a leaky config for hooks via setConfig, thanks @​trace37labs
    • 

  • Bumped vulnerable development dependencies to arrive at plain 0 with npm audit
    • 

  • Updated the osv-scanner suppression list as no vulnerable dependencies are left for now
    • 

  • Updated up the linting tool-chain and removed now-redundant lint directives
    • 

  • Updated the documentation is several spots, README, wiki, etc.
    • 

  • Bumped several dependencies where possible
    • 



DOMPurify 3.4.10


    

  • Refactored codebase for clarity: extracted the public type declarations into types.ts
    • 

  • Decomposed the three largest sanitizer functions into focused helpers
    • 

  • Removed duplicated defaults and dead branches, consolidated SAFE_FOR_TEMPLATES scrubbing into single shared path
    • 

  • Improved per-node performance by hoisting the mXSS probe regexes and testing textContent before innerHTML
    • 

  • Added a deterministic micro-benchmark harness (npm run bench) with a --compare mode
    • 

  • Reduced CI cost by running the full three-engine browser suite once per PR
    • 

  • Refreshed the demos/ folder so every demo runs again, and added a SVG-via-<img> demo
    • 

  • Documented the bench and test:happydom scripts in the README
    • 

  • Completed the Attack Classes & Bypass History wiki page
    • 

  • Bumped several dependencies where possible
    • 



DOMPurify 3.4.9


    

  • Further improved the handling of Trusted Types config options, thanks @​offset
    • 

  • Further improved the handling of IN_PLACE sanitization, thanks @​mozfreddyb
    • 

  • Added more test coverage for IN_PLACE and Trusted Types related usage
    • 

  • Bumped several dependencies where possible
    • 

  • Updated README and wiki with more accurate documentation & attack samples
    • 



DOMPurify 3.4.8


    

  • Cleaned up the repository root, renamed some and removed unneeded files
    • 

  • Fixed an issue with handling of Trusted Types policies, thanks @​fulstadev
    • 

  • Fixed the node iterator for better template scrubbing, thanks @​IamLeandrooooo
    • 

  • Included formerly missing LICENSE-MPL in published npm package, thanks @​asamuzaK
    • 

  • Bumped several dependencies where possible
    • 



DOMPurify 3.4.7


    

  • Hardened the handling of Shadow Roots when using IN_PLACE, thanks @​GameZoneHacker
    • 

  • Removed a problem leading to permanent hook pollution, thanks @​offset
    • 

  • Refactored the test suite and expanded test coverage significantly
    • 



DOMPurify 3.4.6






... (truncated)





Commits





Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.






Updates fast-uri from 3.1.0 to 3.1.5



Release notes

Sourced from fast-uri's releases.




v3.1.5


⚠️ Security Warning


Fix for GHSA-7p8r-x3mc-p8w7


Full Changelog: fastify/fast-uri@v3.1.4...v3.1.5


v3.1.4


⚠️ Security Release


Fix for GHSA-v2hh-gcrm-f6hx


Full Changelog: fastify/fast-uri@v3.1.3...v3.1.4


v3.1.3


⚠️ Security Release



Full Changelog: fastify/fast-uri@v3.1.2...v3.1.3


v3.1.2


⚠️ Security Release



What's Changed



Full Changelog: fastify/fast-uri@v3.1.1...v3.1.2


v3.1.1


⚠️ Security Release



What's Changed






... (truncated)





Commits






Updates follow-redirects from 1.15.11 to 1.16.0



Commits

    

  • 0c23a22 Release version 1.16.0 of the npm package.
    • 

  • 844c4d3 Add sensitiveHeaders option.
    • 

  • 5e8b8d0 ci: add Node.js 24.x to the CI matrix
    • 

  • 7953e22 ci: upgrade GitHub Actions to use setup-node@v6 and checkout@v6
    • 

  • 86dc1f8 Sanitizing input.
    • 

  • See full diff in compare view
    • 







Updates postcss from 8.5.6 to 8.5.25



Release notes

Sourced from postcss's releases.




8.5.25


    

  • Fixed 8.5.17 visitor regression.
    • 

  • Fixed list.split() for non-string values (by @​amir-rezaei).
    • 



8.5.24


    

  • Preserve the BOM after the processing (by @​hdimer).
    • 



8.5.23


    

  • Do not load source map without opts.from for security reasons.
    • 



8.5.22



8.5.21



8.5.20



8.5.19


    

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).
    • 



8.5.18


    

  • Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).
    • 



8.5.17


    

  • Fixed Maximum call stack size exceeded error.
    • 

  • Fixed Prototype hijacking for postcss.fromJSON().
    • 

  • Fixed Input#origin() for unmapped end position (by @​chatman-media).
    • 



8.5.16



8.5.15


    

  • Fixed declaration parsing performance (by @​homanp).
    • 



8.5.14



8.5.13


    

  • Fixed postcss-scss commend regression.
    • 



8.5.12


    

  • Fixed reading any file via user-generated CSS.
    • 






... (truncated)





Changelog

Sourced from postcss's changelog.




8.5.25


    

  • Fixed 8.5.17 visitor regression.
    • 

  • Fixed list.split() for non-string values (by @​amir-rezaei).
    • 



8.5.24


    

  • Preserve the BOM after the processing (by @​hdimer).
    • 



8.5.23


    

  • Do not load source map without opts.from for security reasons.
    • 



8.5.22



8.5.21



8.5.20



8.5.19


    

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).
    • 



8.5.18


    

  • Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).
    • 



8.5.17


    

  • Fixed Maximum call stack size exceeded error.
    • 

  • Fixed Prototype hijacking for postcss.fromJSON().
    • 

  • Fixed Input#origin() for unmapped end position (by @​chatman-media).
    • 



8.5.16



8.5.15





... (truncated)





Commits





Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.






Updates qs from 6.14.2 to 6.15.3



Changelog

Sourced from qs's changelog.




6.15.3


    

  • [Fix] parse: enforce throwOnLimitExceeded for cumulative array growth via combine/merge
    • 

  • [Fix] utils: respect encoding of surrogate pairs across chunks (#559)
    • 

  • [Robustness] parse: throw the arrayLimit error before splitting oversized comma values
    • 

  • [Robustness] utils.merge / utils.assign: avoid invoking __proto__ setter when copying own properties
    • 

  • [Robustness] utils: enforce arrayLimit consistently across merge's array paths
    • 

  • [Perf] utils: make compact O(n) via a side-channel visited-set instead of Array.indexOf
    • 

  • [Deps] update side-channel
    • 

  • [Dev Deps] update eslint, mock-property, tape
    • 

  • [Tests] parse: characterize current lenient handling of unbalanced bracket keys (#558)
    • 



6.15.2


    

  • [Fix] stringify: skip null/undefined entries in arrayFormat: 'comma' + encodeValuesOnly instead of crashing in encoder
    • 

  • [Fix] stringify: use configured delimiter after charsetSentinel (#555)
    • 

  • [Fix] stringify: apply formatter to encoded key under strictNullHandling (#554)
    • 

  • [Fix] stringify: skip null/undefined filter-array entries instead of crashing in encoder (#551)
    • 

  • [Fix] parse: handle nested bracket groups and add regression tests (#530)
    • 

  • [readme] fix grammar (#550)
    • 

  • [Dev Deps] update @ljharb/eslint-config
    • 

  • [Tests] add regression tests for keys containing percent-encoded bracket text
    • 



6.15.1


    

  • [Fix] parse: parameterLimit: Infinity with throwOnLimitExceeded: true silently drops all parameters
    • 

  • [Deps] update @ljharb/eslint-config
    • 

  • [Dev Deps] update @ljharb/eslint-config, iconv-lite
    • 

  • [Tests] increase coverage
    • 



6.15.0


    

  • [New] parse: add strictMerge option to wrap object/primitive conflicts in an array (#425, #122)
    • 

  • [Fix]...

    Description has been truncated

    

  
  



      


          

          
  
  

    
  
    
    

  

  

  



                    

          
        





  





    



      

  
        

  

      

  
  

  
          

  

    

      


  

        
          @dependabot
  




      

        
          build(deps): bump the npm_and_yarn group across 2 directories with 16…
        

          
                        
      


      

        

    
    
    

  

    


      


      

        

          

    
    
    

  

  

    
  



        

      


      

        
          83fb94d
        
      

    

  

    

      
… updates

Bumps the npm_and_yarn group with 2 updates in the / directory: [@cyclonedx/cyclonedx-npm](https://github.com/CycloneDX/cyclonedx-node-npm) and [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest).
Bumps the npm_and_yarn group with 11 updates in the /docs directory:

| Package | From | To |
| --- | --- | --- |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.3.1` | `3.4.12` |
| [fast-uri](https://github.com/fastify/fast-uri) | `3.1.0` | `3.1.5` |
| [follow-redirects](https://github.com/follow-redirects/follow-redirects) | `1.15.11` | `1.16.0` |
| [postcss](https://github.com/postcss/postcss) | `8.5.6` | `8.5.25` |
| [qs](https://github.com/ljharb/qs) | `6.14.2` | `6.15.3` |
| [@babel/plugin-transform-modules-systemjs](https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-modules-systemjs) | `7.29.0` | `7.29.8` |
| [mermaid](https://github.com/mermaid-js/mermaid) | `11.12.3` | `11.16.0` |
| [shell-quote](https://github.com/ljharb/shell-quote) | `1.8.3` | `1.10.0` |
| [svgo](https://github.com/svg/svgo) | `3.3.2` | `3.3.4` |
| [ws](https://github.com/websockets/ws) | `7.5.10` | `7.5.13` |
| [websocket-driver](https://github.com/faye/websocket-driver-node) | `0.7.4` | `0.7.5` |



Updates `@cyclonedx/cyclonedx-npm` from 4.2.1 to 5.0.0
- [Release notes](https://github.com/CycloneDX/cyclonedx-node-npm/releases)
- [Changelog](https://github.com/CycloneDX/cyclonedx-node-npm/blob/main/HISTORY.md)
- [Commits](CycloneDX/cyclonedx-node-npm@v4.2.1...v5.0.0)

Updates `vitest` from 1.6.1 to 3.2.6
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v3.2.6/packages/vitest)

Updates `esbuild` from 0.21.5 to 0.28.1
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2024.md)
- [Commits](evanw/esbuild@v0.21.5...v0.28.1)

Updates `vite` from 5.4.21 to 7.3.6
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v7.3.6/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v7.3.6/packages/vite)

Updates `dompurify` from 3.3.1 to 3.4.12
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.3.1...3.4.12)

Updates `fast-uri` from 3.1.0 to 3.1.5
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.0...v3.1.5)

Updates `follow-redirects` from 1.15.11 to 1.16.0
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](follow-redirects/follow-redirects@v1.15.11...v1.16.0)

Updates `postcss` from 8.5.6 to 8.5.25
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.6...8.5.25)

Updates `qs` from 6.14.2 to 6.15.3
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.14.2...v6.15.3)

Updates `@babel/plugin-transform-modules-systemjs` from 7.29.0 to 7.29.8
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.29.8/packages/babel-plugin-transform-modules-systemjs)

Updates `body-parser` from 1.20.4 to 1.20.6
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@1.20.4...1.20.6)

Updates `dompurify` from 3.3.1 to 3.4.12
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.3.1...3.4.12)

Updates `fast-uri` from 3.1.0 to 3.1.5
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.0...v3.1.5)

Updates `follow-redirects` from 1.15.11 to 1.16.0
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](follow-redirects/follow-redirects@v1.15.11...v1.16.0)

Updates `mermaid` from 11.12.3 to 11.16.0
- [Release notes](https://github.com/mermaid-js/mermaid/releases)
- [Commits](https://github.com/mermaid-js/mermaid/compare/mermaid@11.12.3...mermaid@11.16.0)

Updates `postcss` from 8.5.6 to 8.5.25
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.6...8.5.25)

Updates `qs` from 6.14.2 to 6.15.3
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.14.2...v6.15.3)

Updates `shell-quote` from 1.8.3 to 1.10.0
- [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md)
- [Commits](ljharb/shell-quote@v1.8.3...v1.10.0)

Updates `svgo` from 3.3.2 to 3.3.4
- [Commits](https://github.com/svg/svgo/commits)

Updates `ws` from 7.5.10 to 7.5.13
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@7.5.10...7.5.13)

Updates `websocket-driver` from 0.7.4 to 0.7.5
- [Changelog](https://github.com/faye/websocket-driver-node/blob/main/CHANGELOG.md)
- [Commits](faye/websocket-driver-node@0.7.4...0.7.5)

---
updated-dependencies:
- dependency-name: "@cyclonedx/cyclonedx-npm"
  dependency-version: 5.0.0
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: vitest
  dependency-version: 3.2.6
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: esbuild
  dependency-version: 0.28.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 7.3.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: dompurify
  dependency-version: 3.4.12
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fast-uri
  dependency-version: 3.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: follow-redirects
  dependency-version: 1.16.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: postcss
  dependency-version: 8.5.25
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.15.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@babel/plugin-transform-modules-systemjs"
  dependency-version: 7.29.8
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: body-parser
  dependency-version: 1.20.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: dompurify
  dependency-version: 3.4.12
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fast-uri
  dependency-version: 3.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: follow-redirects
  dependency-version: 1.16.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: mermaid
  dependency-version: 11.16.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: postcss
  dependency-version: 8.5.25
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.15.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: shell-quote
  dependency-version: 1.10.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: svgo
  dependency-version: 3.3.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-version: 7.5.13
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: websocket-driver
  dependency-version: 0.7.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>

    







  








      

  
            

    

      
    

    


      


          @dependabot
dependabot
Bot



            added
      

  dependencies

  Pull requests that update a dependency file

      

  javascript

  Pull requests that update javascript code

  labels


      Aug 2, 2026

    

  



  
    

    

      
    

    


      


          @dependabot
dependabot
Bot



            added
      

  dependencies

  Pull requests that update a dependency file

      

  javascript

  Pull requests that update javascript code

  labels


      Aug 2, 2026

    

  












  
  

    

      

  










  








  
      

  
    Sign up for free
    to join this conversation on GitHub.
    Already have an account?
    Sign in to comment


  










      

  

    
    

    

  

    Reviewers
  


    


      

          


  
      @rubenvdlinde
  
    rubenvdlinde


          Awaiting requested review from rubenvdlinde


                    rubenvdlinde is a code owner

        
      

      

          


  
      @Rem-Dam
  
    Rem-Dam


          Awaiting requested review from Rem-Dam


                    Rem-Dam is a code owner

        
      

      

          


  
      @SudoThijn
  
    SudoThijn


          Awaiting requested review from SudoThijn


                    SudoThijn is a code owner

        
      

      

          


  
      @remko48
  
    remko48


          Awaiting requested review from remko48


                    remko48 is a code owner

        
      



        

      At least 1 approving review is required to merge this pull request.
  







  




    

  


      
  

    Assignees
  



        


    No one assigned







      


  


  

    Labels
  



    

      

    dependencies

  Pull requests that update a dependency file
  

    javascript

  Pull requests that update javascript code








      

  

    

        

    Projects
  


        




    None yet




  



      


  

    
  

    Milestone
  


      No milestone





    
      
          


  

    

      
        

          
  

    Development
  



            


Successfully merging this pull request may close these issues.





  
  



      
    

  




      

    

  
        

  

    

      0 participants