Skip to content

chore(deps): bump the npm_and_yarn group across 1 directory with 19 updates - #294

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-4bd2931160
Open

chore(deps): bump the npm_and_yarn group across 1 directory with 19 updates#294
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-4bd2931160

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 19 updates in the / directory:

Package From To
colord 2.9.3 2.9.4
dompurify 3.4.11 3.4.16
mermaid 11.15.0 11.16.1
electron 40.8.5 41.10.6
brace-expansion 1.1.12 1.1.21
@humanfs/node 0.16.7 0.16.8
@xmldom/xmldom 0.8.13 0.8.15
app-builder-lib 26.8.1 26.15.3
baseline-browser-mapping 2.10.0 2.11.27
browserslist 4.28.1 4.29.3
builder-util-runtime 9.5.1 9.7.0
fast-uri 3.1.2 3.1.8
hono 4.12.25 4.13.13
ip-address 10.2.0 10.7.3
joi 18.0.2 18.2.9
js-yaml 4.2.0 4.3.2
seroval 1.5.0 1.6.8
smol-toml 1.6.1 1.9.0
tar 7.5.16 7.5.22

Updates colord from 2.9.3 to 2.9.4

Changelog

Sourced from colord's changelog.

2.9.4

  • Fix: Reject malformed color strings in linear time ❤️ @​GAP-dev
Commits

Updates dompurify from 3.4.11 to 3.4.16

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.16

  • Fixed a problem with IN_PLACE node removal when working with hooks, thanks @​manus-pi
  • Fixed a problem with IN_PLACE sanitization and raw-text roots, thanks @​h-t-m
  • Fixed a problem with ESM default exports landing in CommonJS declarations, thanks @​ssi02014
  • Migrated from rollup to rolldown because performance, thanks @​ssi02014
  • Bumped several dependencies where possible

DOMPurify 3.4.15

  • Added better clobbering hardening when XML content is involved, thanks @​gnyselcuk
  • Added several smaller hardening and edge-case improvements, thanks @​leechristensen
  • Bumped several dependencies where possible

DOMPurify 3.4.14

  • Fixed an issue with possible bypasses when risky tags are allow-listed, thanks @​AlirezaRouhbakhsh
  • Fixed a couple of edge cases with mixed document contexts, thanks @​fishjojo1
  • Added the SVG pointer-events and vector-effect presentation attributes to the allow-list, thanks @​Jaybhade
  • Conducted another refactoring run, removed dead branches and duplicated logic, flattened attribute validation
  • Updated the documentation in several spots, README, wiki, etc., thanks @​Akokonunes
  • Updated several development dependencies and CI workflow actions

DOMPurify 3.4.13

  • Fixed an issue with hook removal during IN_PLACE sanitization, thanks @​koyokr
  • Fixed an issue with hooks potentially bypassing the clone guard, thanks @​AkshayjainG
  • Fixed an issue with DOM clobbering via ownerDocument during IN_PLACE, thanks @​AkshayjainG
  • Bumped several dependencies where possible

DOMPurify 3.4.12

  • Fixed an issue where a hook would not get called for custom elements, thanks @​Rikuxx0
  • Hardened the handling of hooks removing elements, @​mkrause-bee360
  • Added support for a few new SVG attributes, thanks @​cbn-falias & @​Develop-KIM
  • Hardened the handling of declarative partial updates
  • Updated the documentation is several spots, README, wiki, etc.
  • Bumped several dependencies where possible
Commits

Updates mermaid from 11.15.0 to 11.16.1

Release notes

Sourced from mermaid's releases.

mermaid@11.16.1

Patch Changes

  • #8022 12d472c Thanks @​aloisklink! - fix: handle CSS sibling combinators in compileCSS

  • #8022 2cd6dcf Thanks @​aloisklink! - fix: increase protections against prototype pollution

    User-controlled input already has protections against prototype pollution.

    Fixes: GHSA-c4c3-pg64-4m4v

  • #8022 99af3fc Thanks @​aloisklink! - fix(architecture): use Maps and Sets to store groups/services

    Services are now rendered in the order they are defined and more service IDs are now supported.

  • #8022 2cd6dcf Thanks @​aloisklink! - deprecate: Deprecate the mermaidAPI.setConfig() function

    Calling this function has no observable effect, as the next time a render() or parse() is called, the currentConfig is cleared.

  • #8022 630aa7e Thanks @​aloisklink! - fix(xychart): support zero-width x-axis ranges

  • #8022 59b22fa Thanks @​aloisklink! - fix(radar): limit number of ticks to 32

    Setting a ticks value higher than this would only show 32 ticks.

mermaid@11.16.0

Minor Changes

  • #7535 ea1c48f Thanks @​ragelink! - feat(cynefin): Adds the Cynefin framework as a new diagram type (beta) to Mermaid (available as cynefin-beta). The Cynefin framework, created by Dave Snowden, is a decision-making framework that categorizes problems into five complexity domains, widely used in agile, incident management, strategy, and organizational design.

  • #7721 f45cc2c Thanks @​notionparallax! - feat(treeView): add box-drawing character input support for treeView diagrams

  • #7550 f1f4d45 Thanks @​DominicBurkart! - feat(xychart): add per-point text labels for xychart line plots

  • #7527 b4d0442 Thanks @​notionparallax! - feat(treeView): Extends the existing treeView-beta diagram with features useful for representing file/directory structures.

  • #7793 a6f097d Thanks @​SSDWGG! - feat(er): support optional ER attribute types with a ? suffix

  • #7772 37f2e36 Thanks @​devareddy05! - feat(gantt): support multiple excludes / includes lines so long exclusion lists can be split into commented groups (#6270)

  • #7708 4e63e9d Thanks @​txmxthy! - feat(architecture): add align row|column {ids…} directive to architecture-beta diagrams so authors can declare horizontal or vertical alignment of services explicitly.

  • #7760 05223be Thanks @​ngdaniels! - feat(pie): Enhance Pie Chart - Enable donut chart, Set legend position, and highlight slice

  • #7251 216e4e9 Thanks @​ydah! - feat(railroad): Add support for Railroad Diagrams (Syntax Diagrams) with four input syntaxes: IR (railroad-beta), EBNF (railroad-ebnf-beta), ABNF (railroad-abnf-beta), and PEG (railroad-peg-beta).

  • #7774 e5c75e6 Thanks @​ngdaniels! - feat(xychart): enable rotate label on X-axis

... (truncated)

Commits
  • 7ecca0c Version Packages (#8023)
  • 95b1b9c docs: change mermaidAPI.setConfig() changeset (#8024)
  • acc69f1 Merge pull request #8022 from mermaid-js/release/11.16.1
  • eba7287 docs: point changesets to correct commit hashes
  • 12d472c Merge commit from fork
  • 2cd6dcf Merge commit from fork
  • 630aa7e Merge commit from fork
  • 59b22fa Merge commit from fork
  • 99af3fc Merge commit from fork
  • 2337f7e Merge branch 'test/improve-example.html' into release/11.16.1
  • Additional commits viewable in compare view

Updates electron from 40.8.5 to 41.10.6

Release notes

Sourced from electron's releases.

electron v41.10.6

Release Notes for v41.10.6

Fixes

  • Fixed registerFileProtocol and registerHttpProtocol returning readable responses to cross-origin no-cors fetches; they now return opaque responses like protocol.handle. #52854 (Also in 42, 43, 44)
  • Fixed an issue on Windows where the app process could fail to exit after app.quit() while a shell.openExternal() or shell.openPath() call was still waiting on a system "Open with" dialog. #52899 (Also in 43, 44)
  • Fixed windows opened by a sandboxed top-level frame not inheriting the opener's sandbox restrictions. #52849 (Also in 42, 43, 44)
  • <webview> and window.open now inherit nodeIntegrationInWorker from the embedder, consistent with the other Node and sandbox preferences. #52829 (Also in 42, 43, 44)

Other Changes

  • Backported fixes from upstream ANGLE, Chromium and Skia. #52707
  • Backported fixes from upstream Chromium and V8. #52775

electron v41.10.5

Release Notes for v41.10.5

Fixes

  • Fixed an issue where the Squirrel.Mac installer could resolve the target bundle path to different locations at different stages of an install. #50764 (Also in 39, 42)

Other Changes

  • Backported fixes from upstream ANGLE, Chromium, Skia and V8. #52702
  • No user-facing change; semver/none. #52734

electron v41.10.4

Release Notes for v41.10.4

Fixes

  • Fixed a UAF with protocol.registerStreamProtocol when an error is emitted during a read. #52513 (Also in 42, 43, 44)
  • Fixed a crash that could occur when closing DevTools while the host WebContents was being destroyed. #52512 (Also in 42, 43, 44)
  • Windows opened from links inside a sandboxed iframe now inherit the iframe's sandbox restrictions unless allow-popups-to-escape-sandbox is set. #52486 (Also in 42, 43)

electron v41.10.3

Release Notes for v41.10.3

Fixes

  • Fixed app.disableHardwareAcceleration() not fully disabling GPU hardware usage on Windows starting from Electron 38. #52368 (Also in 42, 43, 44)
  • Fixed unnecessary autofill popup creation for fields without datalist suggestions, which could cause input latency on macOS. #52320 (Also in 42, 43, 44)

Other Changes

  • Backported fixes from upstream Chromium and V8. #52396

electron v41.10.2

Release Notes for v41.10.2

Fixes

... (truncated)

Commits
  • 832e70a fix: don't let pending shell operations block app exit on Windows (#52899)
  • b8d49a4 chore: cherry-pick 39 changes from angle, chromium and skia (#52707)
  • 29fc130 fix: inherit sandbox flags in windows opened by a sandboxed top-level frame (...
  • c595b05 fix: return opaque responses from file and http protocol handlers for cross-o...
  • 6462a2e fix: inherit nodeIntegrationInWorker from the embedder for <webview> and wind...
  • d9c6215 chore: cherry-pick 4 changes from chromium and v8 (#52775)
  • a46a5af build: run the Windows builds on the VM runners (41-x-y) (#52770)
  • 5bff19c build: add release-assets.json expected-asset manifest (41-x-y) (#52734)
  • 15e2928 fix: resolve target bundle path once at start of install (#50764)
  • 2ba8050 chore: cherry-pick 33 changes from angle, chromium, skia and v8 (#52702)
  • Additional commits viewable in compare view

Updates brace-expansion from 1.1.12 to 1.1.21

Release notes

Sourced from brace-expansion's releases.

v1.1.15

  • Backport v5.0.6 change to v1 (#111) 0b09384

juliangruber/brace-expansion@v1.1.14...v1.1.15

Commits

Updates @humanfs/node from 0.16.7 to 0.16.8

Release notes

Sourced from @​humanfs/node's releases.

node: v0.16.8

0.16.8 (2026-04-17)

Bug Fixes

  • Include type dependencies at runtime (956ce7a), closes #145

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • @​humanfs/core bumped from ^0.19.1 to ^0.19.2
Changelog

Sourced from @​humanfs/node's changelog.

0.16.8 (2026-04-17)

Bug Fixes

  • Ensure symlinks are copied as symlinks in copy() and copyAll() (22bbaa44)
  • Include type dependencies at runtime (956ce7a), closes #145

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • @​humanfs/core bumped from ^0.19.1 to ^0.19.2
Commits

Updates @xmldom/xmldom from 0.8.13 to 0.8.15

Release notes

Sourced from @​xmldom/xmldom's releases.

0.8.15

Commits

Fixed

  • Security: parsing a deeply or repeatedly namespaced document no longer consumes quadratic memory; the in-scope namespace map is inherited through the prototype chain instead of being copied for every prefix-declaring element (O(N) instead of O(N²)), preventing a denial-of-service reachable from DOMParser.parseFromString with default options. Serialized output is byte-identical. GHSA-965w-775f-mr7g
  • Security: attribute de-duplication during parsing is now O(M) instead of O(M²); the NamedNodeMap parse-time dedup path uses a null-prototype membership index, so a well-formed document with a hostile number of duplicate attributes can no longer wedge the parse. Attribute order and duplicate resolution (last value wins, first position kept) are byte-identical, preserving the XML no-duplicate-attributes well-formedness constraint. GHSA-8344-3jmq-59r6
  • Security: trimming trailing whitespace from an XML end tag (ETag) is now anchored so it runs in linear time instead of backtracking quadratically on a long whitespace run, preventing a ReDoS reachable from DOMParser.parseFromString. Trimmed output is byte-identical. GHSA-x4fp-j954-r2f4
  • Security: malformed-input recovery is now linear instead of quadratic — the malformed tag-name scan terminates at an embedded <, and Node.prototype.normalize() merges adjacent text nodes in O(K) instead of O(K²) (also reachable programmatically), per normalize() in the WHATWG DOM spec. DOM output is unchanged; only the reported error text differs. GHSA-93r5-fhx6-vmg9
  • Security: XMLSerializer.serializeToString() under { requireWellFormed: true } now rejects a DocType name that is not a valid XML Name, throwing InvalidStateError — matching the sibling publicId/systemId/internalSubset checks and preventing XML injection via DocumentType.name. GHSA-27p8-2357-5qqv
  • Security: XMLSerializer.serializeToString() under { requireWellFormed: true } now validates a processing-instruction target as an XML NCName and rejects a case-insensitive xml, throwing InvalidStateError — a check 0.8.x did not previously perform, preventing PI-target injection via >, ?, or whitespace. GHSA-c7q8-3ch8-vqpv
  • Security: Document.createEntityReference() now rejects an invalid XML Name at creation, and XMLSerializer.serializeToString() under { requireWellFormed: true } validates an EntityReference nodeName as an XML Name, throwing InvalidStateError — preventing XML injection via an entity-reference name. GHSA-6gmq-8vp8-gcm6
  • Security: the parser now reports a not-well-formed end tag whose valid name is followed by trailing content as a recoverable error instead of accepting it silently, per the XML ETag production; parsing recovers to the byte-identical DOM. Consumers that want strict rejection can escalate the reported error to fatal via the parser's errorHandler. GHSA-6h8r-xr42-gp59

Thank you, @​ericchiang, @​bhaswanthc, @​arpitjain099, @​Paranoidgrinch, for your contributions

0.8.14

Commits

Fixed

  • Security: XMLSerializer.serializeToString() now also rejects invalid element and attribute names when { requireWellFormed: true } is passed, throwing InvalidStateError for a name that is not a valid XML QName (this covers the namespace prefix, which surfaces in the element qualified name or in a synthesized xmlns: declaration). This prevents XML injection via createElement() / setAttribute(), extending the existing requireWellFormed checks to the serialized name set. GHSA-w2rr-34g9-rvrj GHSA-4w3w-2rp5-g8jm

Thank you, @​bhaswanthc, @​jmestwa-coder, for your contributions

Changelog

Sourced from @​xmldom/xmldom's changelog.

0.8.15

Fixed

  • Security: parsing a deeply or repeatedly namespaced document no longer consumes quadratic memory; the in-scope namespace map is inherited through the prototype chain instead of being copied for every prefix-declaring element (O(N) instead of O(N²)), preventing a denial-of-service reachable from DOMParser.parseFromString with default options. Serialized output is byte-identical. GHSA-965w-775f-mr7g
  • Security: attribute de-duplication during parsing is now O(M) instead of O(M²); the NamedNodeMap parse-time dedup path uses a null-prototype membership index, so a well-formed document with a hostile number of duplicate attributes can no longer wedge the parse. Attribute order and duplicate resolution (last value wins, first position kept) are byte-identical, preserving the XML no-duplicate-attributes well-formedness constraint. GHSA-8344-3jmq-59r6
  • Security: trimming trailing whitespace from an XML end tag (ETag) is now anchored so it runs in linear time instead of backtracking quadratically on a long whitespace run, preventing a ReDoS reachable from DOMParser.parseFromString. Trimmed output is byte-identical. GHSA-x4fp-j954-r2f4
  • Security: malformed-input recovery is now linear instead of quadratic — the malformed tag-name scan terminates at an embedded <, and Node.prototype.normalize() merges adjacent text nodes in O(K) instead of O(K²) (also reachable programmatically), per normalize() in the WHATWG DOM spec. DOM output is unchanged; only the reported error text differs. GHSA-93r5-fhx6-vmg9
  • Security: XMLSerializer.serializeToString() under { requireWellFormed: true } now rejects a DocType name that is not a valid XML Name, throwing InvalidStateError — matching the sibling publicId/systemId/internalSubset checks and preventing XML injection via DocumentType.name. GHSA-27p8-2357-5qqv
  • Security: XMLSerializer.serializeToString() under { requireWellFormed: true } now validates a processing-instruction target as an XML NCName and rejects a case-insensitive xml, throwing InvalidStateError — a check 0.8.x did not previously perform, preventing PI-target injection via >, ?, or whitespace. GHSA-c7q8-3ch8-vqpv
  • Security: Document.createEntityReference() now rejects an invalid XML Name at creation, and XMLSerializer.serializeToString() under { requireWellFormed: true } validates an EntityReference nodeName as an XML Name, throwing InvalidStateError — preventing XML injection via an entity-reference name. GHSA-6gmq-8vp8-gcm6
  • Security: the parser now reports a not-well-formed end tag whose valid name is followed by trailing content as a recoverable error instead of accepting it silently, per the XML ETag production; parsing recovers to the byte-identical DOM. Consumers that want strict rejection can escalate the reported error to fatal via the parser's errorHandler. GHSA-6h8r-xr42-gp59

Thank you, @​ericchiang, @​bhaswanthc, @​arpitjain099, @​Paranoidgrinch, for your contributions

0.9.11

Fixed

  • Security: XMLSerializer.serializeToString() now also rejects invalid element and attribute names when { requireWellFormed: true } is passed, throwing InvalidStateError for a name that is not a valid XML QName (this covers the namespace prefix, which surfaces in the element qualified name or in a synthesized xmlns: declaration). This prevents XML injection via createElement() / setAttribute(), extending the existing requireWellFormed checks to the serialized name set. GHSA-w2rr-34g9-rvrj GHSA-4w3w-2rp5-g8jm
  • Security: the processing-instruction grammar regex no longer backtracks quadratically on an unterminated processing instruction (<?… with no closing ?>), preventing a denial-of-service (ReDoS) reachable from DOMParser.parseFromString with default options. GHSA-g53g-w8rj-fmg7
  • CharacterData nodeValue and data are now kept in sync [#990](https://github.com/xmldom/xmldom/issues/990)

Chore

  • updated dependencies

Thank you, @​bhaswanthc, @​jmestwa-coder, @​stevenobiajulu, for your contributions

0.8.14

Fixed

  • Security: XMLSerializer.serializeToString() now also rejects invalid element and attribute names when { requireWellFormed: true } is passed, throwing InvalidStateError for a name that is not a valid XML QName (this covers the namespace prefix, which surfaces in the element qualified name or in a synthesized xmlns: declaration). This prevents XML injection via createElement() / setAttribute(), extending the existing requireWellFormed checks to the serialized name set. GHSA-w2rr-34g9-rvrj GHSA-4w3w-2rp5-g8jm

Thank you, @​bhaswanthc, @​jmestwa-coder, for your contributions

0.9.10

... (truncated)

Commits
  • b5b8fb5 0.8.15
  • 327508e docs: add 0.8.15 CHANGELOG entry
  • f40ccb8 fix: prevent quadratic malformed-tag recovery and normalize() adjacent-text m...
  • 3abb093 fix: prevent end-tag whitespace-trim ReDoS via anchored trim (GHSA-x4fp-j954-...
  • 2c548f2 fix: prevent quadratic attribute de-duplication via null-prototype membership...
  • 08a74b4 test: characterize NamedNodeMap attribute de-duplication before the index ref...
  • 954370f fix: prevent quadratic namespace-map memory consumption via prototype-chain i...
  • 4430189 fix: report not-well-formed end-tag trailing content (GHSA-6h8r-xr42-gp59)
  • 6c3fb5f fix: prevent XML injection via unsafe EntityReference name (GHSA-6gmq-8vp8-gcm6)
  • 3b69487 fix: prevent XML injection via unsafe processing instruction target serializa...
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by karfau, a new releaser for @​xmldom/xmldom since your current version.


Updates app-builder-lib from 26.8.1 to 26.15.3

Release notes

Sourced from app-builder-lib's releases.

electron-builder@26.15.3

What's Changed

Full Changelog: https://github.com/electron-userland/electron-builder/compare/electron-builder@26.15.2...electron-builder@26.15.3

electron-builder@26.15.2

What's Changed

Full Changelog: https://github.com/electron-userland/electron-builder/compare/electron-builder@26.15.1...electron-builder@26.15.2

electron-builder@26.15.1

What's Changed

Full Changelog: https://github.com/electron-userland/electron-builder/compare/electron-builder@26.15.0...electron-builder@26.15.1

electron-builder@26.15.0

What's Changed

Full Changelog: https://github.com/electron-userland/electron-builder/compare/electron-builder@26.14.0...electron-builder@26.15.0

... (truncated)

Changelog

Sourced from app-builder-lib's changelog.

26.15.3

Patch Changes

818a89f 35bfdeb

  • electron-publish@26.15.3
  • builder-util@26.15.3
  • dmg-builder@26.15.3
  • electron-builder-squirrel-windows@26.15.3

26.15.2

Patch Changes

  • dmg-builder@26.15.2
  • electron-builder-squirrel-windows@26.15.2

26.15.1

Patch Changes

... (truncated)

Commits
  • 512a57e chore(deploy): Release v26.15.3 (#9858)
  • 9097daf fix(download): persist toolset archives in a predictable cache path (#9861)
  • 35bfdeb fix: add ELECTRON_BUILDER_BINARIES_ALLOW_HTTP opt-in for parsing env vars t...
  • a6117b3 chore(deploy): Release v26.15.2 (#9848)
  • f5ae163 fix(icons): replace png2icons with wasm-vips Lanczos3 resampling for high-qua...
  • 3951024 fix: retry package install on transient network errors (#9850)
  • e25f967 fix(mac): use native zip for macOS zip target to preserve .framework syml...
  • d57f094 chore(deploy): Release v26.15.1 (#9842)
  • db5d2f4 chore(deps): update and unpin @electron/rebuild package (#9845)
  • acd903e fix: ci:validate packages (#9838)
  • Additional commits viewable in compare view

Updates baseline-browser-mapping from 2.10.0 to 2.11.27

Release notesDescription has been truncated

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 4, 2026
@dependabot
chore(deps): bump the npm_and_yarn group across 1 directory with 19 u…
003ffa7 
…pdates

Bumps the npm_and_yarn group with 19 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [colord](https://github.com/omgovich/colord) | `2.9.3` | `2.9.4` |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.4.11` | `3.4.16` |
| [mermaid](https://github.com/mermaid-js/mermaid) | `11.15.0` | `11.16.1` |
| [electron](https://github.com/electron/electron) | `40.8.5` | `41.10.6` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.12` | `1.1.21` |
| [@humanfs/node](https://github.com/humanwhocodes/humanfs/tree/HEAD/packages/node) | `0.16.7` | `0.16.8` |
| [@xmldom/xmldom](https://github.com/xmldom/xmldom) | `0.8.13` | `0.8.15` |
| [app-builder-lib](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/app-builder-lib) | `26.8.1` | `26.15.3` |
| [baseline-browser-mapping](https://github.com/web-platform-dx/baseline-browser-mapping) | `2.10.0` | `2.11.27` |
| [browserslist](https://github.com/browserslist/browserslist) | `4.28.1` | `4.29.3` |
| [builder-util-runtime](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/builder-util-runtime) | `9.5.1` | `9.7.0` |
| [fast-uri](https://github.com/fastify/fast-uri) | `3.1.2` | `3.1.8` |
| [hono](https://github.com/honojs/hono) | `4.12.25` | `4.13.13` |
| [ip-address](https://github.com/beaugunderson/ip-address) | `10.2.0` | `10.7.3` |
| [joi](https://github.com/hapijs/joi) | `18.0.2` | `18.2.9` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `4.2.0` | `4.3.2` |
| [seroval](https://github.com/lxsmnsyc/seroval) | `1.5.0` | `1.6.8` |
| [smol-toml](https://github.com/squirrelchat/smol-toml) | `1.6.1` | `1.9.0` |
| [tar](https://github.com/isaacs/node-tar) | `7.5.16` | `7.5.22` |



Updates `colord` from 2.9.3 to 2.9.4
- [Release notes](https://github.com/omgovich/colord/releases)
- [Changelog](https://github.com/omgovich/colord/blob/master/CHANGELOG.md)
- [Commits](https://github.com/omgovich/colord/commits)

Updates `dompurify` from 3.4.11 to 3.4.16
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.11...3.4.16)

Updates `mermaid` from 11.15.0 to 11.16.1
- [Release notes](https://github.com/mermaid-js/mermaid/releases)
- [Commits](https://github.com/mermaid-js/mermaid/compare/mermaid@11.15.0...mermaid@11.16.1)

Updates `electron` from 40.8.5 to 41.10.6
- [Release notes](https://github.com/electron/electron/releases)
- [Commits](electron/electron@v40.8.5...v41.10.6)

Updates `brace-expansion` from 1.1.12 to 1.1.21
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.21)

Updates `@humanfs/node` from 0.16.7 to 0.16.8
- [Release notes](https://github.com/humanwhocodes/humanfs/releases)
- [Changelog](https://github.com/humanwhocodes/humanfs/blob/main/packages/node/CHANGELOG.md)
- [Commits](https://github.com/humanwhocodes/humanfs/commits/node-v0.16.8/packages/node)

Updates `@xmldom/xmldom` from 0.8.13 to 0.8.15
- [Release notes](https://github.com/xmldom/xmldom/releases)
- [Changelog](https://github.com/xmldom/xmldom/blob/master/CHANGELOG.md)
- [Commits](xmldom/xmldom@0.8.13...0.8.15)

Updates `app-builder-lib` from 26.8.1 to 26.15.3
- [Release notes](https://github.com/electron-userland/electron-builder/releases)
- [Changelog](https://github.com/electron-userland/electron-builder/blob/master/packages/app-builder-lib/CHANGELOG.md)
- [Commits](https://github.com/electron-userland/electron-builder/commits/electron-builder@26.15.3/packages/app-builder-lib)

Updates `baseline-browser-mapping` from 2.10.0 to 2.11.27
- [Release notes](https://github.com/web-platform-dx/baseline-browser-mapping/releases)
- [Commits](web-platform-dx/baseline-browser-mapping@v2.10.0...v2.11.27)

Updates `browserslist` from 4.28.1 to 4.29.3
- [Release notes](https://github.com/browserslist/browserslist/releases)
- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md)
- [Commits](browserslist/browserslist@4.28.1...4.29.3)

Updates `builder-util-runtime` from 9.5.1 to 9.7.0
- [Release notes](https://github.com/electron-userland/electron-builder/releases)
- [Changelog](https://github.com/electron-userland/electron-builder/blob/master/packages/builder-util-runtime/CHANGELOG.md)
- [Commits](https://github.com/electron-userland/electron-builder/commits/HEAD/packages/builder-util-runtime)

Updates `fast-uri` from 3.1.2 to 3.1.8
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.2...v3.1.8)

Updates `hono` from 4.12.25 to 4.13.13
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.25...v4.13.13)

Updates `ip-address` from 10.2.0 to 10.7.3
- [Release notes](https://github.com/beaugunderson/ip-address/releases)
- [Commits](beaugunderson/ip-address@v10.2.0...v10.7.3)

Updates `joi` from 18.0.2 to 18.2.9
- [Commits](hapijs/joi@v18.0.2...v18.2.9)

Updates `js-yaml` from 4.2.0 to 4.3.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.2.0...4.3.2)

Updates `seroval` from 1.5.0 to 1.6.8
- [Release notes](https://github.com/lxsmnsyc/seroval/releases)
- [Commits](https://github.com/lxsmnsyc/seroval/commits)

Updates `smol-toml` from 1.6.1 to 1.9.0
- [Release notes](https://github.com/squirrelchat/smol-toml/releases)
- [Commits](squirrelchat/smol-toml@v1.6.1...v1.9.0)

Updates `tar` from 7.5.16 to 7.5.22
- [Release notes](https://github.com/isaacs/node-tar/releases)
- [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md)
- [Commits](isaacs/node-tar@v7.5.16...v7.5.22)

---
updated-dependencies:
- dependency-name: "@humanfs/node"
  dependency-version: 0.16.8
  dependency-type: indirect
- dependency-name: "@xmldom/xmldom"
  dependency-version: 0.8.15
  dependency-type: indirect
- dependency-name: app-builder-lib
  dependency-version: 26.15.3
  dependency-type: indirect
- dependency-name: baseline-browser-mapping
  dependency-version: 2.11.27
  dependency-type: indirect
- dependency-name: brace-expansion
  dependency-version: 1.1.21
  dependency-type: indirect
- dependency-name: browserslist
  dependency-version: 4.29.3
  dependency-type: indirect
- dependency-name: builder-util-runtime
  dependency-version: 9.7.0
  dependency-type: indirect
- dependency-name: colord
  dependency-version: 2.9.4
  dependency-type: direct:production
- dependency-name: dompurify
  dependency-version: 3.4.16
  dependency-type: direct:production
- dependency-name: electron
  dependency-version: 41.10.6
  dependency-type: direct:development
- dependency-name: fast-uri
  dependency-version: 3.1.8
  dependency-type: indirect
- dependency-name: hono
  dependency-version: 4.13.13
  dependency-type: indirect
- dependency-name: ip-address
  dependency-version: 10.7.3
  dependency-type: indirect
- dependency-name: joi
  dependency-version: 18.2.9
  dependency-type: indirect
- dependency-name: js-yaml
  dependency-version: 4.3.2
  dependency-type: indirect
- dependency-name: mermaid
  dependency-version: 11.16.1
  dependency-type: direct:production
- dependency-name: seroval
  dependency-version: 1.5.6
  dependency-type: indirect
- dependency-name: smol-toml
  dependency-version: 1.9.0
  dependency-type: indirect
- dependency-name: tar
  dependency-version: 7.5.22
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/npm_and_yarn-4bd2931160 branch from 0d3f759 to 003ffa7 Compare October 7, 2026 11:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants