Update npm dependencies #359

Closed

robbertbos wants to merge 1 commit from renovate/npm into main

pull from: renovate/npm

merge into: robbertbos:main

robbertbos:main

Conversation 1 Commits 1 Files changed 2 +85 -85

robbertbos commented 2026-09-13 02:05:41 +00:00

Owner

Copy link

This PR contains the following updates:

Package	Change	Age	Confidence
@​codemirror/state	^6.7.4 → ^6.7.5
@​codemirror/view	^6.43.11 → ^6.43.12
@tanstack/vue-query (source)	^5.102.8 → ^5.103.1
dompurify	^3.4.14 → ^3.4.15
marked (source)	^18.0.11 → ^18.0.13
vue (source)	^3.5.42 → ^3.5.43

---

Release Notes

TanStack/query (@​tanstack/vue-query)

v5.103.1

Compare Source

Patch Changes

• Updated dependencies [8330b2f, 3212966]:
  • @​tanstack/query-core@5.103.1

v5.103.0

Compare Source

Patch Changes

• #​11439 12027ef - fix(vue-query): make sure useQuery can accept queryOptions on type level

• #​11287 2bc8ecf - Re-export core query and mutation filter types without shadowing them with Vue-specific filter types.

• Updated dependencies [e57f816, fdae2ce, a1119e5, cbf77bf]:

  • @​tanstack/query-core@5.103.0

cure53/DOMPurify (dompurify)

v3.4.15: DOMPurify 3.4.15

Compare Source

• Added better clobbering hardening when XML content is involved, thanks @​gnyselcuk
• Added several smaller hardening and edge-case improvements, thanks @​leechristensen
• Bumped several dependencies where possible

markedjs/marked (marked)

v18.0.13

Compare Source

Bug Fixes

• allow tabs in the thematic break that ends a list item (#​4087) (afbb27c)
• avoid O(n^2) scanning in reflinkSearch (#​4090) (c6a25bb)
• case fold reference link labels (#​4077) (aed9336)
• drop the leading whitespace after a hard line break (#​4075) (123ce04)
• match html block start conditions when ending a list item (#​4072) (c2facac)
• respect raw tokens when closing link labels (#​4066) (ef394f7)
• strip a tab that follows spaces in an indented code block (#​4080) (dbb393d)

v18.0.12

Compare Source

Bug Fixes

• allow a tab before the closing sequence of an ATX heading (#​4084) (4417582)
• allow one more level of nested brackets in a link label (#​4064) (37b28d8)
• do not add a newline to an empty code block (#​4073) (23b1706)
• escape character references in autolink destinations (#​4053) (8f432f0)
• reject GFM email autolink when the domain ends in _ or - (#​4063) (df57534)
• reject invalid characters in HTML tag names (#​4083) (300bb1d)
• remove up to the fence indentation from each content line (#​4074) (0244f08)

vuejs/core (vue)

v3.5.43

Compare Source

Bug Fixes

• compiler-sfc: ignore comment delimiters inside strings and url() when parsing css vars (#​15548) (2fde323)
• compiler-sfc: prepend semicolon for await in switch case (#​15498) (9a1df69), closes #​15495
• compiler-sfc: restore await scope when leaving nested blocks (5409708), closes #​15465
• compiler-sfc: reuse parsed parent configs across tsconfig walks (fix #​15478) (#​15480) (d6febaa)
• hydration: run leave hooks for hydration placeholders (#​15431) (5dda192)
• reactivity: preserve readonly wrappers in array copy methods (#​15469) (599f35b)
• runtime-core: unmount v-once children after parent rerenders (#​15435) (d720338)
• shared: handle circular references in looseEqual (#​15499) (718f782), closes #​15496
• shared: preserve comment-like text in style values (#​15471) (b9456cb)
• suspense: don't drop nested suspense patches during hydration (#​15429) (76d42dc)
• suspense: keep the boundary pending while its branch is patched (#​15411) (bfcfe9e), closes #​7506
• suspense: patch a hydrating boundary's pending branch in place (#​15432) (2cde6f7)
• suspense: unmount the DOM an interrupted async component claimed (#​15430) (fb9b45c)
• types: keep optional props when a runtime prop uses a generic PropType (#​15523) (243aabc), closes #​9546

---

Configuration

📅 Schedule: (in timezone Europe/Amsterdam)

• Branch creation
  • "before 6am on sunday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | @&#8203;codemirror/state | [`^6.7.4` → `^6.7.5`](https://renovatebot.com/diffs/npm/@codemirror%2fstate/6.7.4/6.7.5) |  |  | | @&#8203;codemirror/view | [`^6.43.11` → `^6.43.12`](https://renovatebot.com/diffs/npm/@codemirror%2fview/6.43.11/6.43.12) |  |  | | [@tanstack/vue-query](https://tanstack.com/query) ([source](https://github.com/TanStack/query/tree/HEAD/packages/vue-query)) | [`^5.102.8` → `^5.103.1`](https://renovatebot.com/diffs/npm/@tanstack%2fvue-query/5.102.8/5.103.1) |  |  | | [dompurify](https://github.com/cure53/DOMPurify) | [`^3.4.14` → `^3.4.15`](https://renovatebot.com/diffs/npm/dompurify/3.4.14/3.4.15) |  |  | | [marked](https://marked.js.org) ([source](https://github.com/markedjs/marked)) | [`^18.0.11` → `^18.0.13`](https://renovatebot.com/diffs/npm/marked/18.0.11/18.0.13) |  |  | | [vue](https://vuejs.org/) ([source](https://github.com/vuejs/core)) | [`^3.5.42` → `^3.5.43`](https://renovatebot.com/diffs/npm/vue/3.5.42/3.5.43) |  |  | --- ### Release Notes <details> <summary>TanStack/query (@&#8203;tanstack/vue-query)</summary> ### [`v5.103.1`](https://github.com/TanStack/query/blob/HEAD/packages/vue-query/CHANGELOG.md#51031) [Compare Source](https://github.com/TanStack/query/compare/@tanstack/vue-query@5.103.0...@tanstack/vue-query@5.103.1) ##### Patch Changes - Updated dependencies \[[`8330b2f`](https://github.com/TanStack/query/commit/8330b2f2d431f226d7bb95eb727c637be9d4c6d8), [`3212966`](https://github.com/TanStack/query/commit/3212966a3681e02d14eb79e9cce0d3265b046877)]: - [@&#8203;tanstack/query-core](https://github.com/tanstack/query-core)@5.103.1 ### [`v5.103.0`](https://github.com/TanStack/query/blob/HEAD/packages/vue-query/CHANGELOG.md#51030) [Compare Source](https://github.com/TanStack/query/compare/@tanstack/vue-query@5.102.8...@tanstack/vue-query@5.103.0) ##### Patch Changes - [#&#8203;11439](https://github.com/TanStack/query/pull/11439) [`12027ef`](https://github.com/TanStack/query/commit/12027efd5c709b95064848239e67fa7bb0155864) - fix(vue-query): make sure useQuery can accept queryOptions on type level - [#&#8203;11287](https://github.com/TanStack/query/pull/11287) [`2bc8ecf`](https://github.com/TanStack/query/commit/2bc8ecf39bef623ed0680a11898b6e757d7de78b) - Re-export core query and mutation filter types without shadowing them with Vue-specific filter types. - Updated dependencies \[[`e57f816`](https://github.com/TanStack/query/commit/e57f8163b18ab3abfe52ad69cdbdda4d31453393), [`fdae2ce`](https://github.com/TanStack/query/commit/fdae2ce4e5382af7326c7c38ce5d5a12751ada12), [`a1119e5`](https://github.com/TanStack/query/commit/a1119e5a3ffa52534de7390f17c7183d17658051), [`cbf77bf`](https://github.com/TanStack/query/commit/cbf77bf8e1a9ce09caef0cdd9a8ed10fef57edf0)]: - [@&#8203;tanstack/query-core](https://github.com/tanstack/query-core)@5.103.0 </details> <details> <summary>cure53/DOMPurify (dompurify)</summary> ### [`v3.4.15`](https://github.com/cure53/DOMPurify/releases/tag/3.4.15): DOMPurify 3.4.15 [Compare Source](https://github.com/cure53/DOMPurify/compare/3.4.14...3.4.15) - Added better clobbering hardening when XML content is involved, thanks [@&#8203;gnyselcuk](https://github.com/gnyselcuk) - Added several smaller hardening and edge-case improvements, thanks [@&#8203;leechristensen](https://github.com/leechristensen) - Bumped several dependencies where possible </details> <details> <summary>markedjs/marked (marked)</summary> ### [`v18.0.13`](https://github.com/markedjs/marked/releases/tag/v18.0.13) [Compare Source](https://github.com/markedjs/marked/compare/v18.0.12...v18.0.13) ##### Bug Fixes - allow tabs in the thematic break that ends a list item ([#&#8203;4087](https://github.com/markedjs/marked/issues/4087)) ([afbb27c](https://github.com/markedjs/marked/commit/afbb27c7ee753af07fb1a5c18031fc3068261b31)) - avoid O(n^2) scanning in reflinkSearch ([#&#8203;4090](https://github.com/markedjs/marked/issues/4090)) ([c6a25bb](https://github.com/markedjs/marked/commit/c6a25bb2a9d14f839cf2fd9abe4e4c7c3eece25b)) - case fold reference link labels ([#&#8203;4077](https://github.com/markedjs/marked/issues/4077)) ([aed9336](https://github.com/markedjs/marked/commit/aed933680dc146d868cb4573f393367abde04aae)) - drop the leading whitespace after a hard line break ([#&#8203;4075](https://github.com/markedjs/marked/issues/4075)) ([123ce04](https://github.com/markedjs/marked/commit/123ce04b813e0cd87a6dcb2326112ffb54022069)) - match html block start conditions when ending a list item ([#&#8203;4072](https://github.com/markedjs/marked/issues/4072)) ([c2facac](https://github.com/markedjs/marked/commit/c2facac8d455c87034f82639c900242de288aca0)) - respect raw tokens when closing link labels ([#&#8203;4066](https://github.com/markedjs/marked/issues/4066)) ([ef394f7](https://github.com/markedjs/marked/commit/ef394f71df54ab9d4057821881e866366eaacf11)) - strip a tab that follows spaces in an indented code block ([#&#8203;4080](https://github.com/markedjs/marked/issues/4080)) ([dbb393d](https://github.com/markedjs/marked/commit/dbb393deebc5b6982cb29d7415e8a8ba5555b83a)) ### [`v18.0.12`](https://github.com/markedjs/marked/releases/tag/v18.0.12) [Compare Source](https://github.com/markedjs/marked/compare/v18.0.11...v18.0.12) ##### Bug Fixes - allow a tab before the closing sequence of an ATX heading ([#&#8203;4084](https://github.com/markedjs/marked/issues/4084)) ([4417582](https://github.com/markedjs/marked/commit/4417582f35d69926f0778ee133c3af75b7f3f966)) - allow one more level of nested brackets in a link label ([#&#8203;4064](https://github.com/markedjs/marked/issues/4064)) ([37b28d8](https://github.com/markedjs/marked/commit/37b28d8f640e39c9680e24b83fe7828dd111073d)) - do not add a newline to an empty code block ([#&#8203;4073](https://github.com/markedjs/marked/issues/4073)) ([23b1706](https://github.com/markedjs/marked/commit/23b1706a0e19e354d0dd0e82ba93fb73e11c6f5c)) - escape character references in autolink destinations ([#&#8203;4053](https://github.com/markedjs/marked/issues/4053)) ([8f432f0](https://github.com/markedjs/marked/commit/8f432f0ef219439cb1b5efdb86018aee0e44a141)) - reject GFM email autolink when the domain ends in \_ or - ([#&#8203;4063](https://github.com/markedjs/marked/issues/4063)) ([df57534](https://github.com/markedjs/marked/commit/df575341940389880afde6372ae5aa19bd9eb205)) - reject invalid characters in HTML tag names ([#&#8203;4083](https://github.com/markedjs/marked/issues/4083)) ([300bb1d](https://github.com/markedjs/marked/commit/300bb1dce07bc262d74778b28bd6644770269be0)) - remove up to the fence indentation from each content line ([#&#8203;4074](https://github.com/markedjs/marked/issues/4074)) ([0244f08](https://github.com/markedjs/marked/commit/0244f08d6253993fff0755c3edece62002692b31)) </details> <details> <summary>vuejs/core (vue)</summary> ### [`v3.5.43`](https://github.com/vuejs/core/blob/HEAD/CHANGELOG.md#3543-2026-09-17) [Compare Source](https://github.com/vuejs/core/compare/v3.5.42...v3.5.43) ##### Bug Fixes - **compiler-sfc:** ignore comment delimiters inside strings and url() when parsing css vars ([#&#8203;15548](https://github.com/vuejs/core/issues/15548)) ([2fde323](https://github.com/vuejs/core/commit/2fde3239ca3cdb9b152870f695cd3401fcaada94)) - **compiler-sfc:** prepend semicolon for await in switch case ([#&#8203;15498](https://github.com/vuejs/core/issues/15498)) ([9a1df69](https://github.com/vuejs/core/commit/9a1df69b63fecd743919af89a419783dd030b9f7)), closes [#&#8203;15495](https://github.com/vuejs/core/issues/15495) - **compiler-sfc:** restore await scope when leaving nested blocks ([5409708](https://github.com/vuejs/core/commit/54097087a0918b98f16c84599b1a6d654e952ca7)), closes [#&#8203;15465](https://github.com/vuejs/core/issues/15465) - **compiler-sfc:** reuse parsed parent configs across tsconfig walks (fix [#&#8203;15478](https://github.com/vuejs/core/issues/15478)) ([#&#8203;15480](https://github.com/vuejs/core/issues/15480)) ([d6febaa](https://github.com/vuejs/core/commit/d6febaab8c0d95a6320e7e37276c00e8159e9cb2)) - **hydration:** run leave hooks for hydration placeholders ([#&#8203;15431](https://github.com/vuejs/core/issues/15431)) ([5dda192](https://github.com/vuejs/core/commit/5dda192082afa4985951d90e229324d522e25c22)) - **reactivity:** preserve readonly wrappers in array copy methods ([#&#8203;15469](https://github.com/vuejs/core/issues/15469)) ([599f35b](https://github.com/vuejs/core/commit/599f35bbb21f3d78b7aa0818342ab4f27442a333)) - **runtime-core:** unmount v-once children after parent rerenders ([#&#8203;15435](https://github.com/vuejs/core/issues/15435)) ([d720338](https://github.com/vuejs/core/commit/d720338d5d29c1fac82abbe6f7066fe703ce624d)) - **shared:** handle circular references in looseEqual ([#&#8203;15499](https://github.com/vuejs/core/issues/15499)) ([718f782](https://github.com/vuejs/core/commit/718f782b14c7e0165d20b6f4dd8664f78054b62c)), closes [#&#8203;15496](https://github.com/vuejs/core/issues/15496) - **shared:** preserve comment-like text in style values ([#&#8203;15471](https://github.com/vuejs/core/issues/15471)) ([b9456cb](https://github.com/vuejs/core/commit/b9456cb40db714a6f573a1713d92e96d4c9e9533)) - **suspense:** don't drop nested suspense patches during hydration ([#&#8203;15429](https://github.com/vuejs/core/issues/15429)) ([76d42dc](https://github.com/vuejs/core/commit/76d42dc1874e82e62e9650debd68a53472d810e0)) - **suspense:** keep the boundary pending while its branch is patched ([#&#8203;15411](https://github.com/vuejs/core/issues/15411)) ([bfcfe9e](https://github.com/vuejs/core/commit/bfcfe9e4d0254f85af452544a058291ef88dce1a)), closes [#&#8203;7506](https://github.com/vuejs/core/issues/7506) - **suspense:** patch a hydrating boundary's pending branch in place ([#&#8203;15432](https://github.com/vuejs/core/issues/15432)) ([2cde6f7](https://github.com/vuejs/core/commit/2cde6f754cb3e4695a21fb5719e0c75ee2fc5c61)) - **suspense:** unmount the DOM an interrupted async component claimed ([#&#8203;15430](https://github.com/vuejs/core/issues/15430)) ([fb9b45c](https://github.com/vuejs/core/commit/fb9b45ce780f656a23fcb374eb8ea9f7abadc594)) - **types:** keep optional props when a runtime prop uses a generic PropType ([#&#8203;15523](https://github.com/vuejs/core/issues/15523)) ([243aabc](https://github.com/vuejs/core/commit/243aabccf05fefb3760f2dab1c2d75aa424baad7)), closes [#&#8203;9546](https://github.com/vuejs/core/issues/9546) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Amsterdam) - Branch creation - "before 6am on sunday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC42NS4xIiwidXBkYXRlZEluVmVyIjoiNDQuNjUuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19-->

robbertbos added 1 commit 2026-09-13 02:05:41 +00:00

Update npm dependencies 6d68176bd2

robbertbos force-pushed renovate/npm from 6d68176bd2 to 4bfa6bf99c 2026-09-16 02:07:19 +00:00 Compare

robbertbos force-pushed renovate/npm from 4bfa6bf99c to 0182ffc46c 2026-09-17 02:07:43 +00:00 Compare

robbertbos force-pushed renovate/npm from 0182ffc46c to e68e6dfc2b 2026-09-18 02:07:57 +00:00 Compare

robbertbos referenced this pull request 2026-09-19 14:56:37 +00:00

Bundle the open Renovate updates #365

robbertbos referenced this pull request from a commit 2026-09-19 14:56:39 +00:00

Bundle the open Renovate updates

robbertbos commented 2026-09-19 15:15:37 +00:00

Author

Owner

Copy link

Superseded by #365, which landed these bumps on main.

Superseded by #365, which landed these bumps on main.

robbertbos closed this pull request 2026-09-19 15:15:37 +00:00

Some checks failed

Hide all checks

CI / pre-commit (pull_request) Successful in 3m59s

Required

Details

CI / frontend-test (pull_request) Failing after 4m3s

Required

Details

CI / e2e (pull_request) Successful in 6m28s

Required

Details

CI / backend-test (pull_request) Successful in 9m32s

Required

Details

CI / release-scripts (pull_request) Successful in 6s

Required

Details

security-scan / SBOM (trivy) (pull_request) Successful in 19s

Required

Details

security-scan / Filesystem scan (trivy fs) (pull_request) Successful in 24s

Required

Details

security-scan / JS SCA (npm audit) (pull_request) Successful in 27s

Required

Details

security-scan / Python SAST (bandit) (pull_request) Successful in 33s

Required

Details

security-scan / Python SCA (pip-audit) (pull_request) Successful in 52s

Required

Details

test-build / build (frontend) (pull_request) Successful in 1m14s

Details

test-build / build (backend) (pull_request) Successful in 1m33s

Details

test-build / build (pull_request) Successful in 0s

Details

Pull request closed

This pull request cannot be reopened because the branch was deleted.

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

bug

Something is not working

  

duplicate

This issue or pull request already exists

  

enhancement

New feature

  

help wanted

Need some help

  

invalid

Something is wrong

  

nldd ds

  

question

More information is needed

  

wontfix

This won't be fixed

No labels

bug

duplicate

enhancement

help wanted

invalid

nldd ds

question

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

robbertbos/waggle!359

No description provided.