public/github-stats-extended
2
0
Fork 0
forked from mirrored/github-stats-extended
Code Issues Pull Requests Actions Packages Projects Wiki Activity
2,633 Commits 2 Branches 14 Tags
v2.1
Commit Graph
2633 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martin 73189400ee set correct version for 'core' package (#219) v2.1 v2 v2.1.2 2026-05-08 12:58:37 +02:00
Martin 16ea9afebe set correct version for 'core' package (#218) 2026-05-08 12:54:54 +02:00
Martin 8a239313d3 ignore git checks when publishing (#217) v2.1.1 2026-05-08 12:20:04 +02:00
Martin c707e6b7b1 ignore git checks when publishing (#216) 2026-05-08 12:11:03 +02:00
Martin a3dbb37dd2 start publishing "core" npm package (#215) v.2 v.2.1 v.2.1.0 2026-05-08 12:00:49 +02:00
martin-mfg 9c4e631bc7 Merge remote-tracking branch 'origin/master' into release 2026-05-08 11:57:09 +02:00
Martin 9dc4910d4b finish setup for npm publishing (#212) 2026-05-08 11:51:02 +02:00
Martin 5d1978011e add npm publishing (#211) 2026-05-07 19:08:16 +02:00
Martin 6ebd9a082f release v2.0.0 (#209) v2.0 v2.0.0 2026-05-06 18:49:05 +02:00
Martin d84cc27b9c fix browser_rendering layout (#208) 2026-05-06 15:25:33 +02:00
Takuma IMAMURAandmartin-mfg e43e55c2b7 feat: replace render-time text wrapping with browser-native wrapping (#191) 
This PR uses `foreignObject` with CSS line-clamp to let the browser
handle text wrapping natively instead of manually wrapping on the
server. This provides better font-aware wrapping while keeping
server-side line estimation for SVG height calculation.

Fixes https://github.com/anuraghazra/github-readme-stats/issues/4862.

### Example card

<img width="400" height="150" alt="hyperfinitism-sample-repo"
src="https://github.com/user-attachments/assets/c3a58531-c689-4798-af02-f55ef3a90fa1"
/>

---------

Signed-off-by: Takuma IMAMURA <209989118+hyperfinitism@users.noreply.github.com>
Co-authored-by: martin-mfg <2026226+martin-mfg@users.noreply.github.com>
 2026-05-06 11:00:11 +02:00
Martin f884df6312 add top-langs customization to fork.md (#205) 2026-05-03 19:27:15 +02:00
Martin 9236acd99d release 1.2.0 (#204) v1.2 v1 v1.2.0 2026-05-03 18:28:19 +02:00
martin-mfg 12b4e979a8 Merge branch 'master' into release-1.2.0 2026-05-03 14:26:37 +02:00
github-actions[bot]andmartin-mfg f67dd0f381 Update languages JSON (#203) 
The
[update-langs](https://github.com/stats-organization/github-stats-extended/actions/workflows/update-langs.yml)
action found new/updated languages in the [upstream languages JSON
file](https://raw.githubusercontent.com/github/linguist/master/lib/linguist/languages.yml).

Co-authored-by: martin-mfg <2026226+martin-mfg@users.noreply.github.com>
 2026-05-03 14:04:12 +02:00
dependabot[bot]anddependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> 1da425c0bb build(deps-dev): Bump knip from 6.6.2 to 6.7.0 (#202) 
Bumps [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip)
from 6.6.2 to 6.7.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/webpro-nl/knip/releases">knip's
releases</a>.</em></p>
<blockquote>
<h2>Release 6.7.0</h2>
<ul>
<li>Fix markdown reporter column width (resolve <a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1700">#1700</a>)
(4713108de98bcfe76eb606036b9f968abe3e89a0)</li>
<li>Handle Vitest agent and minimal reporters (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1701">#1701</a>)
(a71ead11b99aaa67f31eed7b35628907b2dddd06) - thanks <a
href="https://github.com/dskwrite"><code>@​dskwrite</code></a>!</li>
<li>Add e2e tests w/ tsgo defs + lib consumption
(98113e61d913e47631748b58c25d1042c8dd387e)</li>
<li>Fix pkg name inconsistencies
(544c3e68d72dd754b20f8e0b0bf8ed107c05d677)</li>
<li>Add <code>export {}</code> to maintain module shape
(27d8a0230c10f2827ba1e1a8b2c65020554f61f8)</li>
<li>Strip leading UTF-8 BOM before parsing package.json
(47e4029c39ff95043cd495681e4c7558970b0ed9)</li>
<li>Skip workspace with invalid JSON manifest
(bfb48670966387a3cd26005b9fb9d8769b2a1213)</li>
<li>Preserve out-of-bound writes to stdout/err
(95faad8d6219ba456a3700df697273eb154c1dd9)</li>
<li>Consistent prefix in logError/logWarning
(2c6d8a049d1c20d9427425b4abae3b76ac7a5720)</li>
<li>Don't exit on config file load error
(0914bd3832b1851e4d34137577c0d08efaf8aef6)</li>
<li>Fix tsgo resolution in e2e tests
(a68950131e33214ef2a4f13d11fab1a78c16bad6)</li>
</ul>
<h2>Release 6.6.3</h2>
<ul>
<li>Use venz chart svg directly from CDN
(ba7e9073d1770e4a21ec18435bcb61f394db0d1c)</li>
<li>Bump that plugin counter
(abae75bbd3030e006fe67d3f63641a31a65e671c)</li>
<li>Fix plugin title (f2b8fcfc94bb78fb70dfe2be3f48ef8f254066f7)</li>
<li>Work Table util class: fix bugs, tighten API, water-fill widths
(2eb4045e0f34c2638875504b9b64e881e9a74db5)</li>
<li>Questionable.. (970a0dbdfc7b59df2fd0a3064a4bd6be4e5a59bc)</li>
<li>Fmt (14538ec1fe94cdf3c45798515160609f3ffbec9d)</li>
<li>Ensure output is flushed on exit (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1699">#1699</a>)
(9533365115d4704e9b057b7ba8d5f43fd553d1a1) - thanks <a
href="https://github.com/joshkel"><code>@​joshkel</code></a>!</li>
<li>Use currentColor to support light/dark themes
(7ea055aa68b86ccc6cb302a3092c2da9e56cdde6)</li>
<li>Tighten type-chain alignment + gate via ignoreExportsUsedInFile
(resolve <a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1698">#1698</a>)
(0910b33fc6c07867a751af2e26989a61c8a6c548)</li>
<li>Eating our own dog food ↻
(d5aa1f6b007a2dfef1a8326000dc1802510d64ab)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/webpro-nl/knip/commit/ca5545e2a3f262cbb3e9db4705abb4f4264b102f"><code>ca5545e</code></a>
Release knip@6.7.0</li>
<li><a
href="https://github.com/webpro-nl/knip/commit/a68950131e33214ef2a4f13d11fab1a78c16bad6"><code>a689501</code></a>
Fix tsgo resolution in e2e tests</li>
<li><a
href="https://github.com/webpro-nl/knip/commit/0914bd3832b1851e4d34137577c0d08efaf8aef6"><code>0914bd3</code></a>
Don't exit on config file load error</li>
<li><a
href="https://github.com/webpro-nl/knip/commit/2c6d8a049d1c20d9427425b4abae3b76ac7a5720"><code>2c6d8a0</code></a>
Consistent prefix in logError/logWarning</li>
<li><a
href="https://github.com/webpro-nl/knip/commit/95faad8d6219ba456a3700df697273eb154c1dd9"><code>95faad8</code></a>
Preserve out-of-bound writes to stdout/err</li>
<li><a
href="https://github.com/webpro-nl/knip/commit/bfb48670966387a3cd26005b9fb9d8769b2a1213"><code>bfb4867</code></a>
Skip workspace with invalid JSON manifest</li>
<li><a
href="https://github.com/webpro-nl/knip/commit/47e4029c39ff95043cd495681e4c7558970b0ed9"><code>47e4029</code></a>
Strip leading UTF-8 BOM before parsing package.json</li>
<li><a
href="https://github.com/webpro-nl/knip/commit/27d8a0230c10f2827ba1e1a8b2c65020554f61f8"><code>27d8a02</code></a>
Add <code>export {}</code> to maintain module shape</li>
<li><a
href="https://github.com/webpro-nl/knip/commit/544c3e68d72dd754b20f8e0b0bf8ed107c05d677"><code>544c3e6</code></a>
Fix pkg name inconsistencies</li>
<li><a
href="https://github.com/webpro-nl/knip/commit/98113e61d913e47631748b58c25d1042c8dd387e"><code>98113e6</code></a>
Add e2e tests w/ tsgo defs + lib consumption</li>
<li>Additional commits viewable in <a
href="https://github.com/webpro-nl/knip/commits/knip@6.7.0/packages/knip">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=knip&package-manager=npm_and_yarn&previous-version=6.6.2&new-version=6.7.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-03 13:57:31 +02:00
dependabot[bot]anddependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> 46df37adb7 build(deps): Bump axios from 1.15.1 to 1.15.2 in the axios group across 1 directory (#195) 
Bumps the axios group with 1 update in the / directory:
[axios](https://github.com/axios/axios).

Updates `axios` from 1.15.1 to 1.15.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/axios/axios/releases">axios's
releases</a>.</em></p>
<blockquote>
<h2>v1.15.2</h2>
<p>This release delivers prototype-pollution hardening for the Node HTTP
adapter, adds an opt-in <code>allowedSocketPaths</code> allowlist to
mitigate SSRF via Unix domain sockets, fixes a keep-alive socket memory
leak, and ships supply-chain hardening across CI and security docs.</p>
<h2>🔒 Security Fixes</h2>
<ul>
<li><strong>Prototype Pollution Hardening (HTTP Adapter):</strong>
Hardened the Node HTTP adapter and
<code>resolveConfig</code>/<code>mergeConfig</code>/validator paths to
read only own properties and use null-prototype config objects,
preventing polluted <code>auth</code>, <code>baseURL</code>,
<code>socketPath</code>, <code>beforeRedirect</code>, and
<code>insecureHTTPParser</code> from influencing requests. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10779">#10779</a></strong>)</li>
<li><strong>SSRF via <code>socketPath</code>:</strong> Rejects
non-string <code>socketPath</code> values and adds an opt-in
<code>allowedSocketPaths</code> config option to restrict permitted Unix
domain socket paths, returning <code>AxiosError</code>
<code>ERR_BAD_OPTION_VALUE</code> on mismatch. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10777">#10777</a></strong>)</li>
<li><strong>Supply-chain Hardening:</strong> Added <code>.npmrc</code>
with <code>ignore-scripts=true</code>, lockfile lint CI, non-blocking
reproducible build diff, scoped CODEOWNERS, expanded
<code>SECURITY.md</code>/<code>THREATMODEL.md</code> with provenance
verification (<code>npm audit signatures</code>), 60-day resolution
policy, and maintainer incident-response runbook. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10776">#10776</a></strong>)</li>
</ul>
<h2>🚀 New Features</h2>
<ul>
<li><strong><code>allowedSocketPaths</code> Config Option:</strong> New
request config option (and TypeScript types) to allowlist Unix domain
socket paths used by the Node http adapter; backwards compatible when
unset. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10777">#10777</a></strong>)</li>
</ul>
<h2>🐛 Bug Fixes</h2>
<ul>
<li><strong>Keep-alive Socket Memory Leak:</strong> Installs a single
per-socket <code>error</code> listener tracking the active request via
<code>kAxiosSocketListener</code>/<code>kAxiosCurrentReq</code>,
eliminating per-request listener accumulation,
<code>MaxListenersExceededWarning</code>, and linear heap growth under
concurrent or long-running keep-alive workloads (fixes <a
href="https://redirect.github.com/axios/axios/issues/10780">#10780</a>).
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10788">#10788</a></strong>)</li>
</ul>
<h2>🔧 Maintenance &amp; Chores</h2>
<ul>
<li><strong>Changelog:</strong> Updated <code>CHANGELOG.md</code> with
v1.15.1 release notes. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10781">#10781</a></strong>)</li>
</ul>
<p><a
href="https://github.com/axios/axios/compare/v1.15.1...v1.15.2">Full
Changelog</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/axios/axios/blob/v1.x/CHANGELOG.md">axios's
changelog</a>.</em></p>
<blockquote>
<h2>v1.15.2 - April 21, 2026</h2>
<p>This release delivers prototype-pollution hardening for the Node HTTP
adapter, adds an opt-in <code>allowedSocketPaths</code> allowlist to
mitigate SSRF via Unix domain sockets, fixes a keep-alive socket memory
leak, and ships supply-chain hardening across CI and security docs.</p>
<h2>🔒 Security Fixes</h2>
<ul>
<li><strong>Prototype Pollution Hardening (HTTP Adapter):</strong>
Hardened the Node HTTP adapter and
<code>resolveConfig</code>/<code>mergeConfig</code>/validator paths to
read only own properties and use null-prototype config objects,
preventing polluted <code>auth</code>, <code>baseURL</code>,
<code>socketPath</code>, <code>beforeRedirect</code>, and
<code>insecureHTTPParser</code> from influencing requests. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10779">#10779</a></strong>)</li>
<li><strong>SSRF via <code>socketPath</code>:</strong> Rejects
non-string <code>socketPath</code> values and adds an opt-in
<code>allowedSocketPaths</code> config option to restrict permitted Unix
domain socket paths, returning <code>AxiosError</code>
<code>ERR_BAD_OPTION_VALUE</code> on mismatch. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10777">#10777</a></strong>)</li>
<li><strong>Supply-chain Hardening:</strong> Added <code>.npmrc</code>
with <code>ignore-scripts=true</code>, lockfile lint CI, non-blocking
reproducible build diff, scoped CODEOWNERS, expanded
<code>SECURITY.md</code>/<code>THREATMODEL.md</code> with provenance
verification (<code>npm audit signatures</code>), 60-day resolution
policy, and maintainer incident-response runbook. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10776">#10776</a></strong>)</li>
</ul>
<h2>🚀 New Features</h2>
<ul>
<li><strong><code>allowedSocketPaths</code> Config Option:</strong> New
request config option (and TypeScript types) to allowlist Unix domain
socket paths used by the Node http adapter; backwards compatible when
unset. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10777">#10777</a></strong>)</li>
</ul>
<h2>🐛 Bug Fixes</h2>
<ul>
<li><strong>Keep-alive Socket Memory Leak:</strong> Installs a single
per-socket <code>error</code> listener tracking the active request via
<code>kAxiosSocketListener</code>/<code>kAxiosCurrentReq</code>,
eliminating per-request listener accumulation,
<code>MaxListenersExceededWarning</code>, and linear heap growth under
concurrent or long-running keep-alive workloads (fixes <a
href="https://redirect.github.com/axios/axios/issues/10780">#10780</a>).
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10788">#10788</a></strong>)</li>
</ul>
<h2>🔧 Maintenance &amp; Chores</h2>
<ul>
<li><strong>Changelog:</strong> Updated <code>CHANGELOG.md</code> with
v1.15.1 release notes. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10781">#10781</a></strong>)</li>
</ul>
<p><a
href="https://github.com/axios/axios/compare/v1.15.1...v1.15.2">Full
Changelog</a></p>
<hr />
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/axios/axios/commit/582934382e4e0e0bcb679c628071a4203e93cf57"><code>5829343</code></a>
chore(release): prepare release 1.15.2 (<a
href="https://redirect.github.com/axios/axios/issues/10789">#10789</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/4709a48fa2717ba97f43f5432d48ca4e26c2d326"><code>4709a48</code></a>
fix: added fix for memory leak in sockets (<a
href="https://redirect.github.com/axios/axios/issues/10788">#10788</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/be3336014e01f9a4fc1f8aef15303cf7daaf58db"><code>be33360</code></a>
chore: update changelog (<a
href="https://redirect.github.com/axios/axios/issues/10781">#10781</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/47915144662f2733e6c051bdcb895a8c8f0586aa"><code>4791514</code></a>
fix: more header pollutions (<a
href="https://redirect.github.com/axios/axios/issues/10779">#10779</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/6feafcff6c2dbafe206161c5d09e38e1d36af66f"><code>6feafcf</code></a>
fix: socket issue (<a
href="https://redirect.github.com/axios/axios/issues/10777">#10777</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/302e2739c602f00e323d4f3f5c79500647633a73"><code>302e273</code></a>
docs: update docs, add a couple actions etc (<a
href="https://redirect.github.com/axios/axios/issues/10776">#10776</a>)</li>
<li>See full diff in <a
href="https://github.com/axios/axios/compare/v1.15.1...v1.15.2">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-03 13:56:59 +02:00
Martin f766c3b789 various dependency upgrades (#201) 2026-05-03 12:06:50 +02:00
Martin 8305746754 add license info for icons (#200) 
solves https://github.com/anuraghazra/github-readme-stats/issues/4839
 2026-05-03 11:20:05 +02:00
Martin b863992994 upgrade transitive dependencies and pnpm (#190) 2026-04-27 10:43:51 +02:00
dependabot[bot]anddependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> fe5ef06049 build(deps-dev): Bump knip from 6.4.1 to 6.5.0 (#188) 
Bumps [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip)
from 6.4.1 to 6.5.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/webpro-nl/knip/releases">knip's
releases</a>.</em></p>
<blockquote>
<h2>Release 6.5.0</h2>
<ul>
<li>Drop project-extension-redundant config hint (resolve <a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1683">#1683</a>)
(f86092949d6dbd041fd621876da674fd3eac7534)</li>
<li>Add instructions to .agents/PLUGINS.md
(e2943ed8fb6d2c0ab4cf12ff04d10bd5ab9fd5f7)</li>
<li>Add a plugin for react-email (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1684">#1684</a>)
(d8ae4d3ccb810b9a9211fd43e9d1e7d7b704fcaf) - thanks <a
href="https://github.com/xaqrox"><code>@​xaqrox</code></a>!</li>
<li>Replace <code>fast-glob</code> with <code>tinyglobby</code> (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1462">#1462</a>)
(9f6b4c8aa6857fea40e66d008c905c948af10939) - thanks <a
href="https://github.com/gameroman"><code>@​gameroman</code></a>!</li>
<li>Added plugin for Serverless framework (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1478">#1478</a>)
(f885f1ded52427d984c67e7172e3141eb4e5ee29) - thanks <a
href="https://github.com/BenCrinion-IW"><code>@​BenCrinion-IW</code></a>!</li>
<li>Add args to Prettier plugin to resolve --config CLI flag (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1685">#1685</a>)
(f4658c84e714afd8a2233b72be6169da1ac3723e) - thanks <a
href="https://github.com/xaqrox"><code>@​xaqrox</code></a>!</li>
<li>fix(util): tolerate JSONC and array extends in findRootDirsBase (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1681">#1681</a>)
(f7e5464a6f70e9024a341fdb923766b5ff53a831) - thanks <a
href="https://github.com/Hoffs"><code>@​Hoffs</code></a>!</li>
<li>Format (15bd7e7a56b470096cfee1690263d5d13ddb8fb6)</li>
<li>Inherit outDir/rootDir from tsconfig project references (resolve <a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1680">#1680</a>)
(b89b4f716f4c117b0106e9a212e9e5c46aa85035)</li>
<li>tsc → tsgo (a6e09ca1b65936b3790a6c3628a4646f030d18b8)</li>
<li>Update dependencies (4cb05c96a2ae7c790d29ee76ff13288c5bbb97a2)</li>
<li>Housekeep (28c56cb8bf68031b1c8e9bee75b18ee7274ec981)</li>
<li>Test test test (7eb4ab3a8a6635dcaf756bb2b4a88e1298615994)</li>
<li>Add pino plugin with <code>transportCall</code> visitor (resolve <a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1480">#1480</a>)
(53a033e4ddc5036c6a4a0e55c0abc42c5c64e4f5)</li>
<li>Add signal to projects using knip
(dbedd665c1f8d735030600d3f68ef1825d9a2668)</li>
<li>Tune logos (3148f4d0485875370634b9b53c1b3aa7f6eafcc3)</li>
<li>Tweak <code>knip-run</code> tool response
(42940381a947c46996ae4055e8789f6ea39cfca4)</li>
<li>Add <code>workspace</code> option to <code>knip-run</code> tool
(64c4aaea89e3abb41d8695ebffc5538878520b21)</li>
<li>Remove old lingering <code>experimentalTags</code>
(e503d108e5535800ac6467f4d92c7dd6a9e90037)</li>
<li>Fix compiler type (resolve <a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1689">#1689</a>)
(e7a69adb5e584eb6e5af9b4007820afcbcf27a08)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/webpro-nl/knip/commit/5b5cda5b22e7989c9aa78746257ca8b1f4504f94"><code>5b5cda5</code></a>
Release knip@6.5.0</li>
<li><a
href="https://github.com/webpro-nl/knip/commit/e7a69adb5e584eb6e5af9b4007820afcbcf27a08"><code>e7a69ad</code></a>
Fix compiler type (resolve <a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1689">#1689</a>)</li>
<li><a
href="https://github.com/webpro-nl/knip/commit/e503d108e5535800ac6467f4d92c7dd6a9e90037"><code>e503d10</code></a>
Remove old lingering <code>experimentalTags</code></li>
<li><a
href="https://github.com/webpro-nl/knip/commit/53a033e4ddc5036c6a4a0e55c0abc42c5c64e4f5"><code>53a033e</code></a>
Add pino plugin with <code>transportCall</code> visitor (resolve <a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1480">#1480</a>)</li>
<li><a
href="https://github.com/webpro-nl/knip/commit/7eb4ab3a8a6635dcaf756bb2b4a88e1298615994"><code>7eb4ab3</code></a>
Test test test</li>
<li><a
href="https://github.com/webpro-nl/knip/commit/28c56cb8bf68031b1c8e9bee75b18ee7274ec981"><code>28c56cb</code></a>
Housekeep</li>
<li><a
href="https://github.com/webpro-nl/knip/commit/4cb05c96a2ae7c790d29ee76ff13288c5bbb97a2"><code>4cb05c9</code></a>
Update dependencies</li>
<li><a
href="https://github.com/webpro-nl/knip/commit/a6e09ca1b65936b3790a6c3628a4646f030d18b8"><code>a6e09ca</code></a>
tsc → tsgo</li>
<li><a
href="https://github.com/webpro-nl/knip/commit/b89b4f716f4c117b0106e9a212e9e5c46aa85035"><code>b89b4f7</code></a>
Inherit outDir/rootDir from tsconfig project references (resolve <a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1680">#1680</a>)</li>
<li><a
href="https://github.com/webpro-nl/knip/commit/15bd7e7a56b470096cfee1690263d5d13ddb8fb6"><code>15bd7e7</code></a>
Format</li>
<li>Additional commits viewable in <a
href="https://github.com/webpro-nl/knip/commits/knip@6.5.0/packages/knip">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-27 10:18:22 +02:00
dependabot[bot]anddependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> 134b738151 build(deps-dev): Bump the eslint group across 1 directory with 2 updates (#183) 
Bumps the eslint group with 2 updates in the / directory:
[eslint](https://github.com/eslint/eslint) and
[eslint-plugin-react-hooks](https://github.com/facebook/react/tree/HEAD/packages/eslint-plugin-react-hooks).

Updates `eslint` from 10.2.0 to 10.2.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/eslint/eslint/releases">eslint's
releases</a>.</em></p>
<blockquote>
<h2>v10.2.1</h2>
<h2>Bug Fixes</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/14be92b6d1fa0923b8923830f2208e5e2705b002"><code>14be92b</code></a>
fix: model generator yield resumption paths in code path analysis (<a
href="https://redirect.github.com/eslint/eslint/issues/20665">#20665</a>)
(sethamus)</li>
<li><a
href="https://github.com/eslint/eslint/commit/84a19d2c32255db6b9cfc08644a607aae6d5cb62"><code>84a19d2</code></a>
fix: no-async-promise-executor false positives for shadowed Promise (<a
href="https://redirect.github.com/eslint/eslint/issues/20740">#20740</a>)
(xbinaryx)</li>
<li><a
href="https://github.com/eslint/eslint/commit/af764af0ec38225755fbf8a6f207f0c77b595a8d"><code>af764af</code></a>
fix: clarify language and processor validation errors (<a
href="https://redirect.github.com/eslint/eslint/issues/20729">#20729</a>)
(Pixel998)</li>
<li><a
href="https://github.com/eslint/eslint/commit/e251b89a38280973e468a4a9386c138f4f55d10d"><code>e251b89</code></a>
fix: update eslint (<a
href="https://redirect.github.com/eslint/eslint/issues/20715">#20715</a>)
(renovate[bot])</li>
</ul>
<h2>Documentation</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/ca92ca0fb4599e8de1e2fb914e695fe7397cbe63"><code>ca92ca0</code></a>
docs: reuse markdown-it instance for markdown filter (<a
href="https://redirect.github.com/eslint/eslint/issues/20768">#20768</a>)
(Amaresh S M)</li>
<li><a
href="https://github.com/eslint/eslint/commit/57d2ee213305cee0cb55ef08e0480b57396269a9"><code>57d2ee2</code></a>
docs: Enable Eleventy incremental mode for watch (<a
href="https://redirect.github.com/eslint/eslint/issues/20767">#20767</a>)
(Amaresh S M)</li>
<li><a
href="https://github.com/eslint/eslint/commit/c1621b915742276e5f4b25efe790ca62296330dc"><code>c1621b9</code></a>
docs: fix typos in code-path-analyzer.js (<a
href="https://redirect.github.com/eslint/eslint/issues/20700">#20700</a>)
(Ayush Shukla)</li>
<li><a
href="https://github.com/eslint/eslint/commit/1418d522d10bde1960f4942afb548bc7160ec49e"><code>1418d52</code></a>
docs: Update README (GitHub Actions Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/39771e6e600f0b0617fdeafff6dd07e4211ffde6"><code>39771e6</code></a>
docs: Update README (GitHub Actions Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/71e04693def2df57268f08f3072a2749df6bf438"><code>71e0469</code></a>
docs: fix incomplete JSDoc param description in no-shadow rule (<a
href="https://redirect.github.com/eslint/eslint/issues/20728">#20728</a>)
(kuldeep kumar)</li>
<li><a
href="https://github.com/eslint/eslint/commit/22119ceb93e28f62262fc1d98ff1b1442d6e2dbf"><code>22119ce</code></a>
docs: clarify scope of for-direction rule with dead code examples (<a
href="https://redirect.github.com/eslint/eslint/issues/20723">#20723</a>)
(Amaresh S M)</li>
<li><a
href="https://github.com/eslint/eslint/commit/8f3fb77f122a5641d1833cad5d93f3f54fa3be0b"><code>8f3fb77</code></a>
docs: document <code>meta.docs.dialects</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/20718">#20718</a>)
(Pixel998)</li>
</ul>
<h2>Chores</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/7ddfea9c4f62add1588c5c0b0da568c299246383"><code>7ddfea9</code></a>
chore: update dependency prettier to v3.8.2 (<a
href="https://redirect.github.com/eslint/eslint/issues/20770">#20770</a>)
(renovate[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/fac40e1de2ba7646cc7cd2d3f93fbdd1f8819001"><code>fac40e1</code></a>
ci: bump pnpm/action-setup from 5.0.0 to 6.0.0 (<a
href="https://redirect.github.com/eslint/eslint/issues/20763">#20763</a>)
(dependabot[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/7246f923332522d8b3d46b6ee646fce88535f3fb"><code>7246f92</code></a>
test: add tests for SuppressionsService.load() error handling (<a
href="https://redirect.github.com/eslint/eslint/issues/20734">#20734</a>)
(kuldeep kumar)</li>
<li><a
href="https://github.com/eslint/eslint/commit/4f34b1e592b0f63d766d9903998e8e36eb49d3aa"><code>4f34b1e</code></a>
chore: update pnpm/action-setup action to v5 (<a
href="https://redirect.github.com/eslint/eslint/issues/20762">#20762</a>)
(renovate[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/51080eb5c98d619434e4835dbe9f1c6654aca3b8"><code>51080eb</code></a>
test: processor service (<a
href="https://redirect.github.com/eslint/eslint/issues/20731">#20731</a>)
(kuldeep kumar)</li>
<li><a
href="https://github.com/eslint/eslint/commit/e7e1889fca9b6044e08f41b38df20a1ce45808c8"><code>e7e1889</code></a>
chore: remove stale babel-eslint10 fixture and test (<a
href="https://redirect.github.com/eslint/eslint/issues/20727">#20727</a>)
(kuldeep kumar)</li>
<li><a
href="https://github.com/eslint/eslint/commit/4e1a87cb8fb90e309524bc36bc5f31b9f9cfaa76"><code>4e1a87c</code></a>
test: remove redundant async/await in flat config array tests (<a
href="https://redirect.github.com/eslint/eslint/issues/20722">#20722</a>)
(Pixel998)</li>
<li><a
href="https://github.com/eslint/eslint/commit/066eabb3643b12931f991594969bcc0028f71a5f"><code>066eabb</code></a>
test: add rule metadata coverage for <code>languages</code> and
<code>docs.dialects</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/20717">#20717</a>)
(Pixel998)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/4d1d8f9737236603f64bbe83d5bb8001627b5611"><code>4d1d8f9</code></a>
10.2.1</li>
<li><a
href="https://github.com/eslint/eslint/commit/3e33105b05d09b5a4eb894ed75a9811fb40d65e6"><code>3e33105</code></a>
Build: changelog update for 10.2.1</li>
<li><a
href="https://github.com/eslint/eslint/commit/ca92ca0fb4599e8de1e2fb914e695fe7397cbe63"><code>ca92ca0</code></a>
docs: reuse markdown-it instance for markdown filter (<a
href="https://redirect.github.com/eslint/eslint/issues/20768">#20768</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/7ddfea9c4f62add1588c5c0b0da568c299246383"><code>7ddfea9</code></a>
chore: update dependency prettier to v3.8.2 (<a
href="https://redirect.github.com/eslint/eslint/issues/20770">#20770</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/57d2ee213305cee0cb55ef08e0480b57396269a9"><code>57d2ee2</code></a>
docs: Enable Eleventy incremental mode for watch (<a
href="https://redirect.github.com/eslint/eslint/issues/20767">#20767</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/c1621b915742276e5f4b25efe790ca62296330dc"><code>c1621b9</code></a>
docs: fix typos in code-path-analyzer.js (<a
href="https://redirect.github.com/eslint/eslint/issues/20700">#20700</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/fac40e1de2ba7646cc7cd2d3f93fbdd1f8819001"><code>fac40e1</code></a>
ci: bump pnpm/action-setup from 5.0.0 to 6.0.0 (<a
href="https://redirect.github.com/eslint/eslint/issues/20763">#20763</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/7246f923332522d8b3d46b6ee646fce88535f3fb"><code>7246f92</code></a>
test: add tests for SuppressionsService.load() error handling (<a
href="https://redirect.github.com/eslint/eslint/issues/20734">#20734</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/4f34b1e592b0f63d766d9903998e8e36eb49d3aa"><code>4f34b1e</code></a>
chore: update pnpm/action-setup action to v5 (<a
href="https://redirect.github.com/eslint/eslint/issues/20762">#20762</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/1418d522d10bde1960f4942afb548bc7160ec49e"><code>1418d52</code></a>
docs: Update README</li>
<li>Additional commits viewable in <a
href="https://github.com/eslint/eslint/compare/v10.2.0...v10.2.1">compare
view</a></li>
</ul>
</details>
<br />

Updates `eslint-plugin-react-hooks` from 7.1.0 to 7.1.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/facebook/react/releases">eslint-plugin-react-hooks's
releases</a>.</em></p>
<blockquote>
<h2>eslint-plugin-react-hooks@7.1.1 (April 17, 2026)</h2>
<p><strong>Note:</strong> 7.1.0 accidentally removed the
<code>component-hook-factories</code> rule, causing errors for users who
referenced it in their ESLint config. This is now fixed.</p>
<ul>
<li>Add deprecated no-op <code>component-hook-factories</code> rule for
backwards compatibility. (<a
href="https://github.com/mofeiZ"><code>@​mofeiZ</code></a> in <a
href="https://redirect.github.com/facebook/react/pull/36307">#36307</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/facebook/react/blob/main/packages/eslint-plugin-react-hooks/CHANGELOG.md">eslint-plugin-react-hooks's
changelog</a>.</em></p>
<blockquote>
<h2>7.1.1</h2>
<p><strong>Note:</strong> 7.1.0 accidentally removed the
<code>component-hook-factories</code> rule, causing errors for users who
referenced it in their ESLint config. This is now fixed.</p>
<ul>
<li>Add deprecated no-op <code>component-hook-factories</code> rule for
backwards compatibility. (<a
href="https://github.com/mofeiZ"><code>@​mofeiZ</code></a> in <a
href="https://redirect.github.com/facebook/react/pull/36307">#36307</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/facebook/react/commit/d1727fbf987392749b374f3afe62227d2c70fc41"><code>d1727fb</code></a>
[eprh] Update changelog for 7.1.1 (<a
href="https://github.com/facebook/react/tree/HEAD/packages/eslint-plugin-react-hooks/issues/36308">#36308</a>)</li>
<li><a
href="https://github.com/facebook/react/commit/bc249804d3c2ea6ee95bc5543c3735a65d1239b5"><code>bc24980</code></a>
[eprh] Add back a no-op for removed component-hook-factories rule (<a
href="https://github.com/facebook/react/tree/HEAD/packages/eslint-plugin-react-hooks/issues/36307">#36307</a>)</li>
<li>See full diff in <a
href="https://github.com/facebook/react/commits/eslint-plugin-react-hooks@7.1.1/packages/eslint-plugin-react-hooks">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-27 10:15:11 +02:00
dependabot[bot]anddependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> 3263dd9c78 build(deps): Bump react-toastify from 11.0.5 to 11.1.0 in the react group across 1 directory (#182) 
Bumps the react group with 1 update in the / directory:
[react-toastify](https://github.com/fkhadra/react-toastify).

Updates `react-toastify` from 11.0.5 to 11.1.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/fkhadra/react-toastify/releases">react-toastify's
releases</a>.</em></p>
<blockquote>
<h2>v11.1.0</h2>
<h1>Release Notes</h1>
<h2>Features</h2>
<ul>
<li><strong>CSP nonce support.</strong> <code>&lt;ToastContainer
nonce={...}&gt;</code> applies the nonce to the
injected <code>&lt;style&gt;</code> tag. Closes <a
href="https://redirect.github.com/fkhadra/react-toastify/issues/1209">#1209</a>.</li>
</ul>
<h2>Fixes</h2>
<ul>
<li><code>onChange</code> fires <code>status: 'removed'</code>
synchronously on <code>toast.dismiss()</code> instead
of after the exit animation — observers (incl.
<code>useNotificationCenter</code>) now
see correctly ordered events. Also guards against
double-<code>onClose</code>. Closes <a
href="https://redirect.github.com/fkhadra/react-toastify/issues/1275">#1275</a>.</li>
<li>Touch drag no longer re-pauses the toast on release — the old check
compared a
PointerEvent against <code>'touchend'</code>, which never matched.
Closes <a
href="https://redirect.github.com/fkhadra/react-toastify/issues/1217">#1217</a>.</li>
<li>Vertical drag now visually moves the toast (<code>--y</code> gets a
unit). Thanks
<a href="https://github.com/janpaepke"><code>@​janpaepke</code></a>, <a
href="https://redirect.github.com/fkhadra/react-toastify/issues/1277">#1277</a>.</li>
<li>Stacked scale is clamped at 0.5, preventing zero/negative scale in
deep
stacks. Closes <a
href="https://redirect.github.com/fkhadra/react-toastify/issues/1171">#1171</a>,
<a
href="https://redirect.github.com/fkhadra/react-toastify/issues/1174">#1174</a>.</li>
<li>Stacked container respects mobile <code>100vw</code> again. Closes
<a
href="https://redirect.github.com/fkhadra/react-toastify/issues/1234">#1234</a>.</li>
</ul>
<h2>Accessibility</h2>
<ul>
<li><code>role=&quot;progressbar&quot;</code> now includes
<code>aria-valuenow</code>, <code>aria-valuemin</code>,
<code>aria-valuemax</code>.
Thanks <a
href="https://github.com/singhankit001"><code>@​singhankit001</code></a>,
<a
href="https://redirect.github.com/fkhadra/react-toastify/issues/1283">#1283</a>.
Closes <a
href="https://redirect.github.com/fkhadra/react-toastify/issues/1259">#1259</a>.</li>
</ul>
<h2>Internal</h2>
<ul>
<li>Migrated to a pnpm workspace (<code>pnpm link .</code> no longer
required for contributors).
Publish layout unchanged — addon still ships inside the main
package.</li>
<li>CSS now injected at mount via <code>useStyleSheet</code>
(prerequisite for <code>nonce</code>).</li>
<li>Dep bumps: TypeScript 6, Vite 8, Cypress 15, React 19.2, plus the
rest.</li>
<li>CI: <code>upload-artifact</code> v3 → v4.</li>
</ul>
<p>Thanks to <a
href="https://github.com/janpaepke"><code>@​janpaepke</code></a>, <a
href="https://github.com/singhankit001"><code>@​singhankit001</code></a>,
and reporters of the fixed issues.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/fkhadra/react-toastify/commit/769ce82f1c72cde5ee681068194adfa88a0c81c9"><code>769ce82</code></a>
11.1.0</li>
<li><a
href="https://github.com/fkhadra/react-toastify/commit/de219584ade15c4973c4eedf6ef68af88f64952f"><code>de21958</code></a>
remove year from license</li>
<li><a
href="https://github.com/fkhadra/react-toastify/commit/c800992ed72a47351f4d3d54a5be7fbca68765d2"><code>c800992</code></a>
fix: add unit to --y CSS variable to fix vertical drag</li>
<li><a
href="https://github.com/fkhadra/react-toastify/commit/e4ab71249e1afa5f975f9be12f8542c88f02efe9"><code>e4ab712</code></a>
fix chicken and egg issue</li>
<li><a
href="https://github.com/fkhadra/react-toastify/commit/b3bbab5468777ea945d70a82b068cb6d105d4fe7"><code>b3bbab5</code></a>
bump artifact action</li>
<li><a
href="https://github.com/fkhadra/react-toastify/commit/6d58ce465e9083a7f695a4df669d5cbc548a97af"><code>6d58ce4</code></a>
fix: stacked toast invert size, when used as stacked</li>
<li><a
href="https://github.com/fkhadra/react-toastify/commit/50e8e420e1e87fd75cfb7058728bccde46cfa790"><code>50e8e42</code></a>
fix: stacked container on mobile not 100vw</li>
<li><a
href="https://github.com/fkhadra/react-toastify/commit/1b2ee1762524893a5f3d66f5a0ed3c75d013a731"><code>1b2ee17</code></a>
fix: dispatch 'removed' onChange event synchronously on dismiss</li>
<li><a
href="https://github.com/fkhadra/react-toastify/commit/a2d376b408c23c42ead74460ecd941a2ca0c9e9f"><code>a2d376b</code></a>
feat: add ARIA accessibility attributes to ProgressBar</li>
<li><a
href="https://github.com/fkhadra/react-toastify/commit/8375aced2da12884f1c9b01bd79e20906ea5bd08"><code>8375ace</code></a>
fix: touch bug in onDragTransitionEnd, closes <a
href="https://redirect.github.com/fkhadra/react-toastify/issues/1217">#1217</a></li>
<li>Additional commits viewable in <a
href="https://github.com/fkhadra/react-toastify/compare/v11.0.5...v11.1.0">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-27 10:14:20 +02:00
dependabot[bot]anddependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> b4ae648153 build(deps): Bump axios from 1.15.0 to 1.15.1 in the axios group across 1 directory (#184) 
Bumps the axios group with 1 update in the / directory:
[axios](https://github.com/axios/axios).

Updates `axios` from 1.15.0 to 1.15.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/axios/axios/releases">axios's
releases</a>.</em></p>
<blockquote>
<h2>v1.15.1</h2>
<p>This release ships a coordinated set of security hardening fixes
across headers, body/redirect limits, multipart handling, and
XSRF/prototype-pollution vectors, alongside a broad sweep of bug fixes,
test migrations, and threat-model documentation updates.</p>
<h2>🔒 Security Fixes</h2>
<ul>
<li><strong>Header Injection Hardening:</strong> Tightened validation
and sanitisation across request header construction to close the
header-injection attack surface. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10749">#10749</a></strong>)</li>
<li><strong>CRLF Stripping in Multipart Headers:</strong> Correctly
strips CR/LF from multipart header values to prevent injection via field
names and filenames. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10758">#10758</a></strong>)</li>
<li><strong>Prototype Pollution / Auth Bypass:</strong> Replaced unsafe
<code>in</code> checks with <code>hasOwnProperty</code> to prevent
authentication bypass via prototype pollution on config objects, with
additional regression tests. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10761">#10761</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10760">#10760</a></strong>)</li>
<li><strong><code>withXSRFToken</code> Truthy Bypass:</strong>
Short-circuits on any truthy non-boolean value, so an ambiguous config
no longer silently leaks the XSRF token cross-origin. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10762">#10762</a></strong>)</li>
<li><strong><code>maxBodyLength</code> With Zero Redirects:</strong>
Enforces <code>maxBodyLength</code> even when <code>maxRedirects</code>
is set to <code>0</code>, closing a bypass path for oversized request
bodies. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10753">#10753</a></strong>)</li>
<li><strong>Streamed Response <code>maxContentLength</code>
Bypass:</strong> Applies <code>maxContentLength</code> to streamed
responses that previously bypassed the cap. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10754">#10754</a></strong>)</li>
<li><strong>Follow-up CVE Completion:</strong> Completes an earlier
incomplete CVE fix to fully close the regression window. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10755">#10755</a></strong>)</li>
</ul>
<h2>🚀 New Features</h2>
<ul>
<li><strong>AI-Based Docs Translations:</strong> Initial scaffold for
AI-assisted translations of the documentation site. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10705">#10705</a></strong>)</li>
<li><strong><code>Location</code> Request Header Type:</strong> Adds
<code>Location</code> to <code>CommonRequestHeadersList</code> for
accurate typing of redirect-aware requests. (<strong><a
href="https://redirect.github.com/axios/axios/issues/7528">#7528</a></strong>)</li>
</ul>
<h2>🐛 Bug Fixes</h2>
<ul>
<li><strong>FormData Handling:</strong> Removes
<code>Content-Type</code> when no boundary is present on
<code>FormData</code> fetch requests, supports multi-select fields,
cancels <code>request.body</code> instead of the source stream on fetch
abort, and fixes a recursion bug in form-data serialisation. (<strong><a
href="https://redirect.github.com/axios/axios/issues/7314">#7314</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10676">#10676</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10702">#10702</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10726">#10726</a></strong>)</li>
<li><strong>HTTP Adapter:</strong> Handles socket-only request errors
without leaking keep-alive listeners. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10576">#10576</a></strong>)</li>
<li><strong>Progress Events:</strong> Clamps <code>loaded</code> to
<code>total</code> for computable upload/download progress events.
(<strong><a
href="https://redirect.github.com/axios/axios/issues/7458">#7458</a></strong>)</li>
<li><strong>Types:</strong> Aligns <code>runWhen</code> type with the
runtime behaviour in <code>InterceptorManager</code> and makes response
header keys case-insensitive. (<strong><a
href="https://redirect.github.com/axios/axios/issues/7529">#7529</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10677">#10677</a></strong>)</li>
<li><strong><code>buildFullPath</code>:</strong> Uses strict equality in
the base/relative URL check. (<strong><a
href="https://redirect.github.com/axios/axios/issues/7252">#7252</a></strong>)</li>
<li><strong><code>AxiosURLSearchParams</code> Regex:</strong> Improves
the regex used for param serialisation to avoid edge-case mismatches.
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10736">#10736</a></strong>)</li>
<li><strong>Resilient Value Parsing:</strong> Parses out header/config
values instead of throwing on malformed input. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10687">#10687</a></strong>)</li>
<li><strong>Docs Artefact Cleanup:</strong> Removes the docs content
that was incorrectly committed. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10727">#10727</a></strong>)</li>
</ul>
<h2>🔧 Maintenance &amp; Chores</h2>
<ul>
<li><strong>Threat Model &amp; Security Docs:</strong> Ongoing
refinement of <code>THREATMODEL.md</code>, including Hopper security
update, TLS and tag-replay wording, mitigation descriptions,
decompression-bomb guidance, and further cleanup. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10672">#10672</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10715">#10715</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10718">#10718</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10722">#10722</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10763">#10763</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10765">#10765</a></strong>)</li>
<li><strong>Test Coverage &amp; Migration:</strong> Expanded
<code>shouldBypassProxy</code> coverage for wildcard/IPv6/edge cases,
documented and tested <code>AxiosError.status</code>, and migrated
<code>progressEventReducer</code> tests to Vitest. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10723">#10723</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10725">#10725</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10741">#10741</a></strong>)</li>
<li><strong>Type Refactor:</strong> Uses TypeScript utility types to
deduplicate literal unions. (<strong><a
href="https://redirect.github.com/axios/axios/issues/7520">#7520</a></strong>)</li>
<li><strong>Repo &amp; CI:</strong> Adds <code>CODEOWNERS</code>,
switches v1.x releases to an ephemeral release branch, and removes
orphaned Bower support. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10739">#10739</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10738">#10738</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10746">#10746</a></strong>)</li>
<li><strong>Changelog Backfill:</strong> Added missing version entries
to the changelog. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10704">#10704</a></strong>)</li>
<li><strong>Dependencies:</strong> Bumped <code>follow-redirects</code>
(<code>1.15.11</code> → <code>1.16.0</code>) in root and docs,
<code>axios</code> (<code>1.14.0</code> → <code>1.15.0</code>) in docs,
and a group of 5 development dependencies. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10717">#10717</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10716">#10716</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10684">#10684</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10709">#10709</a></strong>)</li>
</ul>
<h2>🌟 New Contributors</h2>
<p>We are thrilled to welcome our new contributors. Thank you for
helping improve axios:</p>
<ul>
<li><strong><a
href="https://github.com/curiouscoder-cmd"><code>@​curiouscoder-cmd</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/7252">#7252</a></strong>)</li>
<li><strong><a
href="https://github.com/tryonelove"><code>@​tryonelove</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/7520">#7520</a></strong>)</li>
<li><strong><a
href="https://github.com/darwin808"><code>@​darwin808</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/7314">#7314</a></strong>)</li>
<li><strong><a
href="https://github.com/zoontek"><code>@​zoontek</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10702">#10702</a></strong>)</li>
<li><strong><a
href="https://github.com/AKIB473"><code>@​AKIB473</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10725">#10725</a></strong>)</li>
</ul>
<p><a
href="https://github.com/axios/axios/compare/v1.15.0...v1.15.1">Full
Changelog</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/axios/axios/blob/v1.x/CHANGELOG.md">axios's
changelog</a>.</em></p>
<blockquote>
<h2>v1.15.1 - April 19, 2026</h2>
<p>This release ships a coordinated set of security hardening fixes
across headers, body/redirect limits, multipart handling, and
XSRF/prototype-pollution vectors, alongside a broad sweep of bug fixes,
test migrations, and threat-model documentation updates.</p>
<h2>🔒 Security Fixes</h2>
<ul>
<li>
<p><strong>Header Injection Hardening:</strong> Tightened validation and
sanitisation across request header construction to close the
header-injection attack surface. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10749">#10749</a></strong>)</p>
</li>
<li>
<p><strong>CRLF Stripping in Multipart Headers:</strong> Correctly
strips CR/LF from multipart header values to prevent injection via field
names and filenames. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10758">#10758</a></strong>)</p>
</li>
<li>
<p><strong>Prototype Pollution / Auth Bypass:</strong> Replaced unsafe
<code>in</code> checks with <code>hasOwnProperty</code> to prevent
authentication bypass via prototype pollution on config objects, with
additional regression tests. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10761">#10761</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10760">#10760</a></strong>)</p>
</li>
<li>
<p><strong><code>withXSRFToken</code> Truthy Bypass:</strong>
Short-circuits on any truthy non-boolean value, so an ambiguous config
no longer silently leaks the XSRF token cross-origin. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10762">#10762</a></strong>)</p>
</li>
<li>
<p><strong><code>maxBodyLength</code> With Zero Redirects:</strong>
Enforces <code>maxBodyLength</code> even when <code>maxRedirects</code>
is set to <code>0</code>, closing a bypass path for oversized request
bodies. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10753">#10753</a></strong>)</p>
</li>
<li>
<p><strong>Streamed Response <code>maxContentLength</code>
Bypass:</strong> Applies <code>maxContentLength</code> to streamed
responses that previously bypassed the cap. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10754">#10754</a></strong>)</p>
</li>
<li>
<p><strong>Follow-up CVE Completion:</strong> Completes an earlier
incomplete CVE fix to fully close the regression window. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10755">#10755</a></strong>)</p>
</li>
</ul>
<h2>🚀 New Features</h2>
<ul>
<li>
<p><strong>AI-Based Docs Translations:</strong> Initial scaffold for
AI-assisted translations of the documentation site. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10705">#10705</a></strong>)</p>
</li>
<li>
<p><strong><code>Location</code> Request Header Type:</strong> Adds
<code>Location</code> to <code>CommonRequestHeadersList</code> for
accurate typing of redirect-aware requests. (<strong><a
href="https://redirect.github.com/axios/axios/issues/7528">#7528</a></strong>)</p>
</li>
</ul>
<h2>🐛 Bug Fixes</h2>
<ul>
<li>
<p><strong>FormData Handling:</strong> Removes <code>Content-Type</code>
when no boundary is present on <code>FormData</code> fetch requests,
supports multi-select fields, cancels <code>request.body</code> instead
of the source stream on fetch abort, and fixes a recursion bug in
form-data serialisation. (<strong><a
href="https://redirect.github.com/axios/axios/issues/7314">#7314</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10676">#10676</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10702">#10702</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10726">#10726</a></strong>)</p>
</li>
<li>
<p><strong>HTTP Adapter:</strong> Handles socket-only request errors
without leaking keep-alive listeners. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10576">#10576</a></strong>)</p>
</li>
<li>
<p><strong>Progress Events:</strong> Clamps <code>loaded</code> to
<code>total</code> for computable upload/download progress events.
(<strong><a
href="https://redirect.github.com/axios/axios/issues/7458">#7458</a></strong>)</p>
</li>
<li>
<p><strong>Types:</strong> Aligns <code>runWhen</code> type with the
runtime behaviour in <code>InterceptorManager</code> and makes response
header keys case-insensitive. (<strong><a
href="https://redirect.github.com/axios/axios/issues/7529">#7529</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10677">#10677</a></strong>)</p>
</li>
<li>
<p><strong><code>buildFullPath</code>:</strong> Uses strict equality in
the base/relative URL check. (<strong><a
href="https://redirect.github.com/axios/axios/issues/7252">#7252</a></strong>)</p>
</li>
<li>
<p><strong><code>AxiosURLSearchParams</code> Regex:</strong> Improves
the regex used for param serialisation to avoid edge-case mismatches.
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10736">#10736</a></strong>)</p>
</li>
<li>
<p><strong>Resilient Value Parsing:</strong> Parses out header/config
values instead of throwing on malformed input. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10687">#10687</a></strong>)</p>
</li>
<li>
<p><strong>Docs Artefact Cleanup:</strong> Removes the docs content that
was incorrectly committed. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10727">#10727</a></strong>)</p>
</li>
</ul>
<h2>🔧 Maintenance &amp; Chores</h2>
<ul>
<li>
<p><strong>Threat Model &amp; Security Docs:</strong> Ongoing refinement
of <code>THREATMODEL.md</code>, including Hopper security update, TLS
and tag-replay wording, mitigation descriptions, decompression-bomb
guidance, and further cleanup. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10672">#10672</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10715">#10715</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10718">#10718</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10722">#10722</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10763">#10763</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10765">#10765</a></strong>)</p>
</li>
<li>
<p><strong>Test Coverage &amp; Migration:</strong> Expanded
<code>shouldBypassProxy</code> coverage for wildcard/IPv6/edge cases,
documented and tested <code>AxiosError.status</code>, and migrated
<code>progressEventReducer</code> tests to Vitest. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10723">#10723</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10725">#10725</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10741">#10741</a></strong>)</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/axios/axios/commit/ac42446be51300fe214ba3c6e40cc95f34fd6871"><code>ac42446</code></a>
chore(release): prepare release 1.15.1 (<a
href="https://redirect.github.com/axios/axios/issues/10767">#10767</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/908f2206b6bfeff67236784abce85935698ac1d9"><code>908f220</code></a>
docs: update threatmodel (<a
href="https://redirect.github.com/axios/axios/issues/10765">#10765</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/f93f8155250c2e066205521eda05ae22983a1f6d"><code>f93f815</code></a>
docs: added docs around potential decompressions bomb (<a
href="https://redirect.github.com/axios/axios/issues/10763">#10763</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/1728aa1b15b8857f970611fd8983c06b423fc486"><code>1728aa1</code></a>
fix: short-circuits on any truthy non-boolean in withXSRFToken (<a
href="https://redirect.github.com/axios/axios/issues/10762">#10762</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/42eb721eebc95cfded8d6c70cf62f3fbe83f3246"><code>42eb721</code></a>
fix: replace in with has own prop util (<a
href="https://redirect.github.com/axios/axios/issues/10761">#10761</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/75873270a59bd5d895322eee145738e95fb89258"><code>7587327</code></a>
fix: strip crlf correctly (<a
href="https://redirect.github.com/axios/axios/issues/10758">#10758</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/f0b98673b32677643a3b608431270d36e997473c"><code>f0b9867</code></a>
chore: added additional testing for this issue (<a
href="https://redirect.github.com/axios/axios/issues/10760">#10760</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/e033f243a08e3514c03e510f76658da1e0fac3bd"><code>e033f24</code></a>
fix: incomplete fix for cve (<a
href="https://redirect.github.com/axios/axios/issues/10755">#10755</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/e8904af03385b040e53f1263a444e825db4335d9"><code>e8904af</code></a>
fix: stream response bypassed max content length (<a
href="https://redirect.github.com/axios/axios/issues/10754">#10754</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/1c7f6d76e58359daddf38a6e636dd801ffd9c61b"><code>1c7f6d7</code></a>
fix: enforce max body length when max redirects is 0 (<a
href="https://redirect.github.com/axios/axios/issues/10753">#10753</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/axios/axios/compare/v1.15.0...v1.15.1">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-27 10:13:33 +02:00
dependabot[bot]anddependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> c401be4d6c build(deps): Bump vite from 8.0.8 to 8.0.9 in the vite group (#187) 
Bumps the vite group with 1 update:
[vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite).

Updates `vite` from 8.0.8 to 8.0.9
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite/releases">vite's
releases</a>.</em></p>
<blockquote>
<h2>v8.0.9</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.9/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md">vite's
changelog</a>.</em></p>
<blockquote>
<h2><!-- raw HTML omitted --><a
href="https://github.com/vitejs/vite/compare/v8.0.8...v8.0.9">8.0.9</a>
(2026-04-20)<!-- raw HTML omitted --></h2>
<h3>Features</h3>
<ul>
<li>update rolldown to 1.0.0-rc.16 (<a
href="https://redirect.github.com/vitejs/vite/issues/22248">#22248</a>)
(<a
href="https://github.com/vitejs/vite/commit/2947edd57ceb64a0b4dc43269743e8e44e68c09b">2947edd</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>allow binding when strictPort is set but wildcard port is in use (<a
href="https://redirect.github.com/vitejs/vite/issues/22150">#22150</a>)
(<a
href="https://github.com/vitejs/vite/commit/dfc8aa5057dd8ec2b1223980d1e2eeb946ac3384">dfc8aa5</a>)</li>
<li><strong>build:</strong> emptyOutDir should happen for watch rebuilds
(<a
href="https://redirect.github.com/vitejs/vite/issues/22207">#22207</a>)
(<a
href="https://github.com/vitejs/vite/commit/ee522672bb374c7ff95a347f14732491121b1cd6">ee52267</a>)</li>
<li><strong>bundled-dev:</strong> reject requests to HMR patch files in
non potentially trustworthy origins (<a
href="https://redirect.github.com/vitejs/vite/issues/22269">#22269</a>)
(<a
href="https://github.com/vitejs/vite/commit/868f1411a6f474baa4417f2d6524692dd452f760">868f141</a>)</li>
<li><strong>css:</strong> use unique key for cssEntriesMap to prevent
same-basename collision (<a
href="https://redirect.github.com/vitejs/vite/issues/22039">#22039</a>)
(<a
href="https://github.com/vitejs/vite/commit/374bb5d597fcd0485e929565c698d8ed219136f8">374bb5d</a>)</li>
<li><strong>deps:</strong> update all non-major dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/22219">#22219</a>)
(<a
href="https://github.com/vitejs/vite/commit/4cd0d6760edd5fb0841abe86538de3c225e880a1">4cd0d67</a>)</li>
<li><strong>deps:</strong> update all non-major dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/22268">#22268</a>)
(<a
href="https://github.com/vitejs/vite/commit/c28e9c12a849f80e6fdc93f42283ad2863ab9dbc">c28e9c1</a>)</li>
<li>detect Deno workspace root (fix <a
href="https://redirect.github.com/vitejs/vite/issues/22237">#22237</a>)
(<a
href="https://redirect.github.com/vitejs/vite/issues/22238">#22238</a>)
(<a
href="https://github.com/vitejs/vite/commit/1b793c0e1726467fffd06ffad9bc81c61a840188">1b793c0</a>)</li>
<li><strong>dev:</strong> handle errors in <code>watchChange</code> hook
(<a
href="https://redirect.github.com/vitejs/vite/issues/22188">#22188</a>)
(<a
href="https://github.com/vitejs/vite/commit/fc08bdab9bba871b03689f2f6997c3a4ba4351da">fc08bda</a>)</li>
<li><strong>optimizer:</strong> handle more chars that will be sanitized
(<a
href="https://redirect.github.com/vitejs/vite/issues/22208">#22208</a>)
(<a
href="https://github.com/vitejs/vite/commit/3f24533ac4845ed22547279d1721bd82a35345e3">3f24533</a>)</li>
<li>skip fallback sourcemap generation for <code>?raw</code> imports (<a
href="https://redirect.github.com/vitejs/vite/issues/22148">#22148</a>)
(<a
href="https://github.com/vitejs/vite/commit/3ec9cdaac7936ca32d0956c4cb1eb6e172945996">3ec9cda</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>align the descriptions in READMEs (<a
href="https://redirect.github.com/vitejs/vite/issues/22231">#22231</a>)
(<a
href="https://github.com/vitejs/vite/commit/44c42b97639bb6ad777e66d752b2829cccb9a27a">44c42b9</a>)</li>
<li>fix reuses wording in dev environment comment (<a
href="https://redirect.github.com/vitejs/vite/issues/22173">#22173</a>)
(<a
href="https://github.com/vitejs/vite/commit/9163412fdfec7fb1656529713326a5b5c5e986ea">9163412</a>)</li>
<li>fix wording in sass error comment (<a
href="https://redirect.github.com/vitejs/vite/issues/22214">#22214</a>)
(<a
href="https://github.com/vitejs/vite/commit/bc5c6a7a498845dff20dc410c395355b79a4b753">bc5c6a7</a>)</li>
<li>update build CLI defaults (<a
href="https://redirect.github.com/vitejs/vite/issues/22261">#22261</a>)
(<a
href="https://github.com/vitejs/vite/commit/605bb97994678a1bb70a8de9a85c29d5f5d48c5a">605bb97</a>)</li>
</ul>
<h3>Miscellaneous Chores</h3>
<ul>
<li><strong>deps:</strong> update dependency dotenv-expand to v13 (<a
href="https://redirect.github.com/vitejs/vite/issues/22271">#22271</a>)
(<a
href="https://github.com/vitejs/vite/commit/0a3887da18812cacb254c616e4dd35631e776fda">0a3887d</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vitejs/vite/commit/ce729f5fa1a5adca373b2adcb0e1b18099164a14"><code>ce729f5</code></a>
release: v8.0.9</li>
<li><a
href="https://github.com/vitejs/vite/commit/605bb97994678a1bb70a8de9a85c29d5f5d48c5a"><code>605bb97</code></a>
docs: update build CLI defaults (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22261">#22261</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/c28e9c12a849f80e6fdc93f42283ad2863ab9dbc"><code>c28e9c1</code></a>
fix(deps): update all non-major dependencies (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22268">#22268</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/0a3887da18812cacb254c616e4dd35631e776fda"><code>0a3887d</code></a>
chore(deps): update dependency dotenv-expand to v13 (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22271">#22271</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/868f1411a6f474baa4417f2d6524692dd452f760"><code>868f141</code></a>
fix(bundled-dev): reject requests to HMR patch files in non potentially
trust...</li>
<li><a
href="https://github.com/vitejs/vite/commit/3ec9cdaac7936ca32d0956c4cb1eb6e172945996"><code>3ec9cda</code></a>
fix: skip fallback sourcemap generation for <code>?raw</code> imports
(<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22148">#22148</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/3f24533ac4845ed22547279d1721bd82a35345e3"><code>3f24533</code></a>
fix(optimizer): handle more chars that will be sanitized (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22208">#22208</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/1b793c0e1726467fffd06ffad9bc81c61a840188"><code>1b793c0</code></a>
fix: detect Deno workspace root (fix <a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22237">#22237</a>)
(<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22238">#22238</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/fc08bdab9bba871b03689f2f6997c3a4ba4351da"><code>fc08bda</code></a>
fix(dev): handle errors in <code>watchChange</code> hook (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22188">#22188</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/374bb5d597fcd0485e929565c698d8ed219136f8"><code>374bb5d</code></a>
fix(css): use unique key for cssEntriesMap to prevent same-basename
collision...</li>
<li>Additional commits viewable in <a
href="https://github.com/vitejs/vite/commits/v8.0.9/packages/vite">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=vite&package-manager=npm_and_yarn&previous-version=8.0.8&new-version=8.0.9)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-27 10:09:18 +02:00
dependabot[bot]anddependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> f0c250a954 build(deps): Bump uuid from 13.0.0 to 14.0.0 (#185) 
Bumps [uuid](https://github.com/uuidjs/uuid) from 13.0.0 to 14.0.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/uuidjs/uuid/releases">uuid's
releases</a>.</em></p>
<blockquote>
<h2>v14.0.0</h2>
<h2><a
href="https://github.com/uuidjs/uuid/compare/v13.0.0...v14.0.0">14.0.0</a>
(2026-04-19)</h2>
<h3>⚠ BREAKING CHANGES</h3>
<ul>
<li>expect <code>crypto</code> to be global everywhere (requires
node@20+) (<a
href="https://redirect.github.com/uuidjs/uuid/issues/935">#935</a>)</li>
<li>drop node@18 support (<a
href="https://redirect.github.com/uuidjs/uuid/issues/934">#934</a>)</li>
</ul>
<h3>Features</h3>
<ul>
<li>drop node@18 support (<a
href="https://redirect.github.com/uuidjs/uuid/issues/934">#934</a>) (<a
href="https://github.com/uuidjs/uuid/commit/dc4ddb87272ed2843faccd130bcc41d492688bd3">dc4ddb8</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>expect <code>crypto</code> to be global everywhere (requires
node@20+) (<a
href="https://redirect.github.com/uuidjs/uuid/issues/935">#935</a>) (<a
href="https://github.com/uuidjs/uuid/commit/f2c235f93059325fa43e1106e624b5291bb523c4">f2c235f</a>)</li>
<li>Use GITHUB_TOKEN for release-please and enable npm provenance (<a
href="https://redirect.github.com/uuidjs/uuid/issues/925">#925</a>) (<a
href="https://github.com/uuidjs/uuid/commit/ffa31383e8e4e1f0b4e22e504561272041b8738c">ffa3138</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md">uuid's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/uuidjs/uuid/compare/v13.0.0...v14.0.0">14.0.0</a>
(2026-04-19)</h2>
<h3>Security</h3>
<ul>
<li>Fixes <a
href="https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq">GHSA-w5hq-g745-h8pq</a>:
<code>v3()</code>, <code>v5()</code>, and <code>v6()</code> did not
validate that writes would remain within the bounds of a caller-supplied
buffer, allowing out-of-bounds writes when an invalid
<code>offset</code> was provided. A <code>RangeError</code> is now
thrown if <code>offset &lt; 0</code> or <code>offset + 16 &gt;
buf.length</code>.</li>
</ul>
<h3>⚠ BREAKING CHANGES</h3>
<ul>
<li><code>crypto</code> is now expected to be globally defined (requires
node@20+) (<a
href="https://redirect.github.com/uuidjs/uuid/issues/935">#935</a>)</li>
<li>drop node@18 support (<a
href="https://redirect.github.com/uuidjs/uuid/issues/934">#934</a>)</li>
<li>upgrade minimum supported TypeScript version to 5.4.3, in keeping
with the project's policy of supporting TypeScript versions released
within the last two years</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/uuidjs/uuid/commit/7c1ea087a8149b57380fc8bb7f68c3a215cb6e4b"><code>7c1ea08</code></a>
chore(main): release 14.0.0 (<a
href="https://redirect.github.com/uuidjs/uuid/issues/926">#926</a>)</li>
<li><a
href="https://github.com/uuidjs/uuid/commit/3d2c5b0342f0fcb52a5ac681c3d47c13e7444b34"><code>3d2c5b0</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/uuidjs/uuid/commit/f2c235f93059325fa43e1106e624b5291bb523c4"><code>f2c235f</code></a>
fix!: expect <code>crypto</code> to be global everywhere (requires
node@20+) (<a
href="https://redirect.github.com/uuidjs/uuid/issues/935">#935</a>)</li>
<li><a
href="https://github.com/uuidjs/uuid/commit/529ef0899f5dd503d2ee90d690585d63d78bc212"><code>529ef08</code></a>
chore: upgrade TypeScript and fixup types (<a
href="https://redirect.github.com/uuidjs/uuid/issues/927">#927</a>)</li>
<li><a
href="https://github.com/uuidjs/uuid/commit/086fd7976f11433edf9ac80be876b3ad243fe087"><code>086fd79</code></a>
chore: update dependencies (<a
href="https://redirect.github.com/uuidjs/uuid/issues/933">#933</a>)</li>
<li><a
href="https://github.com/uuidjs/uuid/commit/dc4ddb87272ed2843faccd130bcc41d492688bd3"><code>dc4ddb8</code></a>
feat!: drop node@18 support (<a
href="https://redirect.github.com/uuidjs/uuid/issues/934">#934</a>)</li>
<li><a
href="https://github.com/uuidjs/uuid/commit/0f1f9c9c9cedbae5a1d363d5406c5dfbabe81404"><code>0f1f9c9</code></a>
chore: switch to Biome for parsing and linting (<a
href="https://redirect.github.com/uuidjs/uuid/issues/932">#932</a>)</li>
<li><a
href="https://github.com/uuidjs/uuid/commit/e2879e64bf125add903c1eff6e0860542c605013"><code>e2879e6</code></a>
chore: use maintained version of npm-run-all (<a
href="https://redirect.github.com/uuidjs/uuid/issues/930">#930</a>)</li>
<li><a
href="https://github.com/uuidjs/uuid/commit/ffa31383e8e4e1f0b4e22e504561272041b8738c"><code>ffa3138</code></a>
fix: Use GITHUB_TOKEN for release-please and enable npm provenance (<a
href="https://redirect.github.com/uuidjs/uuid/issues/925">#925</a>)</li>
<li><a
href="https://github.com/uuidjs/uuid/commit/0423d49df2dc8efc300c804731d25f4d7e0fccc4"><code>0423d49</code></a>
docs: remove obsolete v1 option notes (<a
href="https://redirect.github.com/uuidjs/uuid/issues/915">#915</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/uuidjs/uuid/compare/v13.0.0...v14.0.0">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for uuid since your current version.</p>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=uuid&package-manager=npm_and_yarn&previous-version=13.0.0&new-version=14.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-27 10:08:17 +02:00
Martin a963caaf5b small refactoring: use constants in layout logic (#186) 2026-04-27 08:34:56 +02:00
Martin eab14c8932 top-langs: add hide_values option (#181) 
based on https://github.com/anuraghazra/github-readme-stats/pull/4850 by
@claw-explorer

This PR adds a new hide_values query parameter for the Top Languages
card that hides the percentage/byte display values while keeping
progress bars and chart visualizations intact.

<img width="300" height="245" alt="top-langs5"
src="https://github.com/user-attachments/assets/6c7486c3-5611-41c0-95ff-0d9183cea320"
/>
<img width="300" height="350" alt="top-langs"
src="https://github.com/user-attachments/assets/a0cc5bed-3f8e-4934-9c30-3e7d5a240865"
/>
<img width="350" height="215" alt="top-langs2"
src="https://github.com/user-attachments/assets/9d9c06cc-aa0d-4e47-9cdd-bce298583742"
/>
<img width="300" height="350" alt="top-langs3"
src="https://github.com/user-attachments/assets/f4a51889-0b8f-4289-a082-e2107208a123"
/>
<img width="300" height="140" alt="top-langs4"
src="https://github.com/user-attachments/assets/d88c2ea2-0422-482b-aade-8cf5799f12cd"
/>
 2026-04-25 20:29:08 +02:00
dependabot[bot]anddependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> 457c457cab build(deps-dev): Bump eslint-plugin-react-hooks from 7.0.1 to 7.1.0 in the eslint group (#178) 
Bumps the eslint group with 1 update:
[eslint-plugin-react-hooks](https://github.com/facebook/react/tree/HEAD/packages/eslint-plugin-react-hooks).

Updates `eslint-plugin-react-hooks` from 7.0.1 to 7.1.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/facebook/react/releases">eslint-plugin-react-hooks's
releases</a>.</em></p>
<blockquote>
<h2>eslint-plugin-react-hooks@7.1.0 (April 16, 2026)</h2>
<p>This release adds ESLint v10 support, improves performance by
skipping compilation for non-React files, and includes compiler lint
improvements including better <code>set-state-in-effect</code>
detection, improved ref validation, and more helpful error
reporting.</p>
<ul>
<li>Add ESLint v10 support. (<a
href="https://github.com/azat-io"><code>@​azat-io</code></a> in <a
href="https://redirect.github.com/facebook/react/pull/35720">#35720</a>)</li>
<li>Skip compilation for non-React files to improve performance. (<a
href="https://github.com/josephsavona"><code>@​josephsavona</code></a>
in <a
href="https://redirect.github.com/facebook/react/pull/35589">#35589</a>)</li>
<li>Fix exhaustive deps bug with Flow type casting. (<a
href="https://github.com/jorge-cab"><code>@​jorge-cab</code></a> in <a
href="https://redirect.github.com/facebook/react/pull/35691">#35691</a>)</li>
<li>Fix <code>useEffectEvent</code> checks in component syntax. (<a
href="https://github.com/jbrown215"><code>@​jbrown215</code></a> in <a
href="https://redirect.github.com/facebook/react/pull/35041">#35041</a>)</li>
<li>Improved <code>set-state-in-effect</code> validation with fewer
false negatives. (<a
href="https://github.com/jorge-cab"><code>@​jorge-cab</code></a> in <a
href="https://redirect.github.com/facebook/react/pull/35134">#35134</a>,
<a
href="https://github.com/josephsavona"><code>@​josephsavona</code></a>
in <a
href="https://redirect.github.com/facebook/react/pull/35147">#35147</a>,
<a href="https://github.com/jackpope"><code>@​jackpope</code></a> in <a
href="https://redirect.github.com/facebook/react/pull/35214">#35214</a>,
<a
href="https://github.com/chesnokov-tony"><code>@​chesnokov-tony</code></a>
in <a
href="https://redirect.github.com/facebook/react/pull/35419">#35419</a>,
<a href="https://github.com/jsleitor"><code>@​jsleitor</code></a> in <a
href="https://redirect.github.com/facebook/react/pull/36107">#36107</a>)</li>
<li>Improved ref validation for non-mutating functions and event handler
props. (<a
href="https://github.com/josephsavona"><code>@​josephsavona</code></a>
in <a
href="https://redirect.github.com/facebook/react/pull/35893">#35893</a>,
<a href="https://github.com/kolvian"><code>@​kolvian</code></a> in <a
href="https://redirect.github.com/facebook/react/pull/35062">#35062</a>)</li>
<li>Compiler now reports all errors instead of stopping at the first.
(<a
href="https://github.com/josephsavona"><code>@​josephsavona</code></a>
in <a
href="https://redirect.github.com/facebook/react/pull/35873">#35873</a>–<a
href="https://redirect.github.com/facebook/react/pull/35884">#35884</a>)</li>
<li>Improved source locations and error display in compiler diagnostics.
(<a href="https://github.com/nathanmarks"><code>@​nathanmarks</code></a>
in <a
href="https://redirect.github.com/facebook/react/pull/35348">#35348</a>,
<a
href="https://github.com/josephsavona"><code>@​josephsavona</code></a>
in <a
href="https://redirect.github.com/facebook/react/pull/34963">#34963</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/facebook/react/blob/main/packages/eslint-plugin-react-hooks/CHANGELOG.md">eslint-plugin-react-hooks's
changelog</a>.</em></p>
<blockquote>
<h2>7.1.0</h2>
<p>This release adds ESLint v10 support, improves performance by
skipping compilation for non-React files, and includes compiler lint
improvements including better <code>set-state-in-effect</code>
detection, improved ref validation, and more helpful error
reporting.</p>
<ul>
<li>Add ESLint v10 support. (<a
href="https://github.com/azat-io"><code>@​azat-io</code></a> in <a
href="https://redirect.github.com/facebook/react/pull/35720">#35720</a>)</li>
<li>Skip compilation for non-React files to improve performance. (<a
href="https://github.com/josephsavona"><code>@​josephsavona</code></a>
in <a
href="https://redirect.github.com/facebook/react/pull/35589">#35589</a>)</li>
<li>Fix exhaustive deps bug with Flow type casting. (<a
href="https://github.com/jorge-cab"><code>@​jorge-cab</code></a> in <a
href="https://redirect.github.com/facebook/react/pull/35691">#35691</a>)</li>
<li>Fix <code>useEffectEvent</code> checks in component syntax. (<a
href="https://github.com/jbrown215"><code>@​jbrown215</code></a> in <a
href="https://redirect.github.com/facebook/react/pull/35041">#35041</a>)</li>
<li>Improved <code>set-state-in-effect</code> validation with fewer
false negatives. (<a
href="https://github.com/jorge-cab"><code>@​jorge-cab</code></a> in <a
href="https://redirect.github.com/facebook/react/pull/35134">#35134</a>,
<a
href="https://github.com/josephsavona"><code>@​josephsavona</code></a>
in <a
href="https://redirect.github.com/facebook/react/pull/35147">#35147</a>,
<a href="https://github.com/jackpope"><code>@​jackpope</code></a> in <a
href="https://redirect.github.com/facebook/react/pull/35214">#35214</a>,
<a
href="https://github.com/chesnokov-tony"><code>@​chesnokov-tony</code></a>
in <a
href="https://redirect.github.com/facebook/react/pull/35419">#35419</a>,
<a href="https://github.com/jsleitor"><code>@​jsleitor</code></a> in <a
href="https://redirect.github.com/facebook/react/pull/36107">#36107</a>)</li>
<li>Improved ref validation for non-mutating functions and event handler
props. (<a
href="https://github.com/josephsavona"><code>@​josephsavona</code></a>
in <a
href="https://redirect.github.com/facebook/react/pull/35893">#35893</a>,
<a href="https://github.com/kolvian"><code>@​kolvian</code></a> in <a
href="https://redirect.github.com/facebook/react/pull/35062">#35062</a>)</li>
<li>Compiler now reports all errors instead of stopping at the first.
(<a
href="https://github.com/josephsavona"><code>@​josephsavona</code></a>
in <a
href="https://redirect.github.com/facebook/react/pull/35873">#35873</a>–<a
href="https://redirect.github.com/facebook/react/pull/35884">#35884</a>)</li>
<li>Improved source locations and error display in compiler diagnostics.
(<a href="https://github.com/nathanmarks"><code>@​nathanmarks</code></a>
in <a
href="https://redirect.github.com/facebook/react/pull/35348">#35348</a>,
<a
href="https://github.com/josephsavona"><code>@​josephsavona</code></a>
in <a
href="https://redirect.github.com/facebook/react/pull/34963">#34963</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/facebook/react/commits/eslint-plugin-react-hooks@7.1.0/packages/eslint-plugin-react-hooks">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=eslint-plugin-react-hooks&package-manager=npm_and_yarn&previous-version=7.0.1&new-version=7.1.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-25 12:33:42 +02:00
dependabot[bot]anddependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> 609578da0c build(deps-dev): Bump typescript from 6.0.2 to 6.0.3 in the typescript group (#179) 
Bumps the typescript group with 1 update:
[typescript](https://github.com/microsoft/TypeScript).

Updates `typescript` from 6.0.2 to 6.0.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/microsoft/TypeScript/releases">typescript's
releases</a>.</em></p>
<blockquote>
<h2>TypeScript 6.0.3</h2>
<p>For release notes, check out the <a
href="https://devblogs.microsoft.com/typescript/announcing-typescript-6-0/">release
announcement blog post</a>.</p>
<ul>
<li><a
href="https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93&amp;q=milestone%3A%22TypeScript+6.0.0%22">fixed
issues query for TypeScript 6.0.0 (Beta)</a>.</li>
<li><a
href="https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93&amp;q=milestone%3A%22TypeScript+6.0.1%22">fixed
issues query for TypeScript 6.0.1 (RC)</a>.</li>
<li><a
href="https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93&amp;q=milestone%3A%22TypeScript+6.0.2%22">fixed
issues query for TypeScript 6.0.2 (Stable)</a>.</li>
<li><a
href="https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93&amp;q=milestone%3A%22TypeScript+6.0.3%22">fixed
issues query for TypeScript 6.0.3 (Stable)</a>.</li>
</ul>
<p>Downloads are available on:</p>
<ul>
<li><a href="https://www.npmjs.com/package/typescript">npm</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/microsoft/TypeScript/commit/050880ce59e30b356b686bd3144efe24f875ebc8"><code>050880c</code></a>
Bump version to 6.0.3 and LKG</li>
<li><a
href="https://github.com/microsoft/TypeScript/commit/eeae9dd0f17aa494658e4ec079dc002e02dd625e"><code>eeae9dd</code></a>
🤖 Pick PR <a
href="https://redirect.github.com/microsoft/TypeScript/issues/63401">#63401</a>
(Also check package name validity in...) into release-6.0 (#...</li>
<li><a
href="https://github.com/microsoft/TypeScript/commit/ad1c695fada682764bb510dd680e8f175ae54094"><code>ad1c695</code></a>
🤖 Pick PR <a
href="https://redirect.github.com/microsoft/TypeScript/issues/63368">#63368</a>
(Harden ATA package name filtering) into release-6.0 (<a
href="https://redirect.github.com/microsoft/TypeScript/issues/63372">#63372</a>)</li>
<li><a
href="https://github.com/microsoft/TypeScript/commit/0725fb4664a1d5ec94040b6d94db77dc1cc354e4"><code>0725fb4</code></a>
🤖 Pick PR <a
href="https://redirect.github.com/microsoft/TypeScript/issues/63310">#63310</a>
(Mark class property initializers as...) into release-6.0 (#...</li>
<li>See full diff in <a
href="https://github.com/microsoft/TypeScript/compare/v6.0.2...v6.0.3">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=typescript&package-manager=npm_and_yarn&previous-version=6.0.2&new-version=6.0.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-25 12:32:52 +02:00
Martin c3f338780b fix login, unify backend and frontend in 1 vercel project (#180) 2026-04-25 12:24:58 +02:00
Martin c4a4220448 fix backend build (#177) 2026-04-23 21:37:19 +02:00
Martin 9d8a7b7f0c 'plugin-react-swc' -> 'plugin-react' (#168) 
I upgraded several dependencies yesterday, including vite. Running `pnpm
run dev:frontend` now prints:
> [vite:react-swc] We recommend switching to `@vitejs/plugin-react` for
improved performance as no swc plugins are used. More information at
https://vite.dev/rolldown

So in this PR I switch to `@vitejs/plugin-react`. Unless you had a
specific reason to use `@vitejs/plugin-react-swc` instead?
 2026-04-23 21:27:20 +02:00
Martin 0898dbfb00 re-build lockfile (#176) 
Running `pnpm upgrade -r` in my previous PR didn't upgrade everything,
because of a bug in pnpm: https://github.com/pnpm/pnpm/issues/9900

So I deleted the lockfile and node_modules and re-installed everything
in order to upgrade all dependencies.
 2026-04-22 21:06:14 +02:00
Martin 6d3145c3d8 run pnpm upgrade (#175) 2026-04-22 20:07:52 +02:00
Martin 5156a811cb exclude 'pg' from frontend build (#169) 
closes #142
 2026-04-22 19:34:43 +02:00
Martinanddependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> e263e5dfc4 upgrade pnpm and vite (#174) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-22 18:50:59 +02:00
dependabot[bot]anddependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> f8094ab5d3 build(deps-dev): Bump prettier from 3.8.2 to 3.8.3 (#173) 
Bumps [prettier](https://github.com/prettier/prettier) from 3.8.2 to
3.8.3.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/prettier/prettier/releases">prettier's
releases</a>.</em></p>
<blockquote>
<h2>3.8.3</h2>
<ul>
<li>SCSS: Prevent trailing comma in <code>if()</code> function (<a
href="https://redirect.github.com/prettier/prettier/pull/18471">prettier/prettier#18471</a>
by <a href="https://github.com/kovsu"><code>@​kovsu</code></a>)</li>
</ul>
<p>🔗 <a
href="https://github.com/prettier/prettier/blob/3.8.3/CHANGELOG.md#383">Changelog</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/prettier/prettier/blob/main/CHANGELOG.md">prettier's
changelog</a>.</em></p>
<blockquote>
<h1>3.8.3</h1>
<p><a
href="https://github.com/prettier/prettier/compare/3.8.2...3.8.3">diff</a></p>
<h4>SCSS: Prevent trailing comma in <code>if()</code> function (<a
href="https://redirect.github.com/prettier/prettier/pull/18471">#18471</a>
by <a href="https://github.com/kovsu"><code>@​kovsu</code></a>)</h4>
<!-- raw HTML omitted -->
<pre lang="scss"><code>// Input
$value: if(sass(false): 1; else: -1);
<p>// Prettier 3.8.2<br />
$value: if(<br />
sass(false): 1; else: -1,<br />
);</p>
<p>// Prettier 3.8.3<br />
$value: if(sass(false): 1; else: -1);<br />
</code></pre></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/prettier/prettier/commit/d7108a79ec745c04292aabf22c4c1adbd690b191"><code>d7108a7</code></a>
Release 3.8.3</li>
<li><a
href="https://github.com/prettier/prettier/commit/177f90898170d363ef64fde663e4d13170688bfe"><code>177f908</code></a>
Prevent trailing comma in SCSS <code>if()</code> function (<a
href="https://redirect.github.com/prettier/prettier/issues/18471">#18471</a>)</li>
<li><a
href="https://github.com/prettier/prettier/commit/1cd40668c3d6f2f4cf9d87bbc9096d92361b2606"><code>1cd4066</code></a>
Release <code>@​prettier/plugin-oxc</code><a
href="https://github.com/0"><code>@​0</code></a>.1.4</li>
<li><a
href="https://github.com/prettier/prettier/commit/a8700e245038cd8cc0cf28ef06ffedbcb3fc2dfc"><code>a8700e2</code></a>
Update oxc-parser to v0.125.0</li>
<li><a
href="https://github.com/prettier/prettier/commit/752157c78eca6f0a30e5d5cb513b682c5ecfa01e"><code>752157c</code></a>
Fix tests</li>
<li><a
href="https://github.com/prettier/prettier/commit/053fd418e180b12fa2014260212fae831f5fc5ec"><code>053fd41</code></a>
Bump Prettier dependency to 3.8.2</li>
<li><a
href="https://github.com/prettier/prettier/commit/904c6365ec46726fd0e21021c52ae934b7e5abc6"><code>904c636</code></a>
Clean changelog_unreleased</li>
<li><a
href="https://github.com/prettier/prettier/commit/dc1f7fcc508d116cbf1644d69a1f0eb93e40d4a4"><code>dc1f7fc</code></a>
Update dependents count</li>
<li>See full diff in <a
href="https://github.com/prettier/prettier/compare/3.8.2...3.8.3">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=prettier&package-manager=npm_and_yarn&previous-version=3.8.2&new-version=3.8.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-22 18:24:46 +02:00
Marco Pasqualetti 9c0f4a8390 chore(dependabot): add groups (#171) 
Adds groups configuration to the Dependabot `npm` ecosystem block,
consolidating related packages into single PRs instead of one PR per
package
 2026-04-22 18:12:08 +02:00
dependabot[bot]anddependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> 1779475e1b build(deps-dev): Bump typescript-eslint from 8.58.1 to 8.58.2 (#166) 
Bumps
[typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint)
from 8.58.1 to 8.58.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/releases">typescript-eslint's
releases</a>.</em></p>
<blockquote>
<h2>v8.58.2</h2>
<h2>8.58.2 (2026-04-13)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li>remove tsbuildinfo cache file from published packages (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12187">#12187</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-condition] use
assignability checks in checkTypePredicates (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12147">#12147</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Abhijeet Singh <a
href="https://github.com/cseas"><code>@​cseas</code></a></li>
<li>송재욱</li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.58.2">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases">releases</a> on our
website.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md">typescript-eslint's
changelog</a>.</em></p>
<blockquote>
<h2>8.58.2 (2026-04-13)</h2>
<h3>🩹 Fixes</h3>
<ul>
<li>remove tsbuildinfo cache file from published packages (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12187">#12187</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Abhijeet Singh <a
href="https://github.com/cseas"><code>@​cseas</code></a></li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.58.2">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases">releases</a> on our
website.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/90c2803a4c250e0343598d41e973f95e743bf4ce"><code>90c2803</code></a>
chore(release): publish 8.58.2</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/b3315fd7ba53b7da218e5675cd960939b80a76ab"><code>b3315fd</code></a>
chore: convert import eslint to import js - followup (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint/issues/12100">#12100</a>)</li>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/be6b49a02d68db9bdc8985e7e9e1598700fda2fa"><code>be6b49a</code></a>
fix: remove tsbuildinfo cache file from published packages (<a
href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint/issues/12187">#12187</a>)</li>
<li>See full diff in <a
href="https://github.com/typescript-eslint/typescript-eslint/commits/v8.58.2/packages/typescript-eslint">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=typescript-eslint&package-manager=npm_and_yarn&previous-version=8.58.1&new-version=8.58.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-21 14:12:15 +02:00
Martin b474572598 remove node 22 (#170) 2026-04-21 14:11:24 +02:00
martin-mfg 4cabac4bc1 upgrade react to v19 2026-04-21 09:09:30 +02:00
Martinanddependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> d2a2274eeb build(deps-dev): Bump typescript from 5.9.3 to 6.0.2 (#165) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-20 20:53:34 +02:00
dependabot[bot]anddependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> 30e2233ae4 build(deps): Bump vite from 7.3.1 to 8.0.8 (#147) 
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite)
from 7.3.1 to 8.0.8.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite/releases">vite's
releases</a>.</em></p>
<blockquote>
<h2>v8.0.8</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.8/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.7</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.7/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.6</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.6/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.5</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.5/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.4</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.4/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>create-vite@8.0.3</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/create-vite@8.0.3/packages/create-vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.3</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.3/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>create-vite@8.0.2</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/create-vite@8.0.2/packages/create-vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.2</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.2/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>create-vite@8.0.1</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/create-vite@8.0.1/packages/create-vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.1</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.1/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>plugin-legacy@8.0.1</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/plugin-legacy@8.0.1/packages/plugin-legacy/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>create-vite@8.0.0</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/create-vite@8.0.0/packages/create-vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>plugin-legacy@8.0.0</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/plugin-legacy@8.0.0/packages/plugin-legacy/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.0</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.0/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.0-beta.18</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.0-beta.18/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v8.0.0-beta.17</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v8.0.0-beta.17/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md">vite's
changelog</a>.</em></p>
<blockquote>
<h2><!-- raw HTML omitted --><a
href="https://github.com/vitejs/vite/compare/v8.0.7...v8.0.8">8.0.8</a>
(2026-04-09)<!-- raw HTML omitted --></h2>
<h3>Features</h3>
<ul>
<li>update rolldown to 1.0.0-rc.15 (<a
href="https://redirect.github.com/vitejs/vite/issues/22201">#22201</a>)
(<a
href="https://github.com/vitejs/vite/commit/6baf587255936e91348cbe624caefd10e8c607ab">6baf587</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>avoid <code>dns.getDefaultResultOrder</code> temporary (<a
href="https://redirect.github.com/vitejs/vite/issues/22202">#22202</a>)
(<a
href="https://github.com/vitejs/vite/commit/15f1c15ac9be343ee4f317fd025c3d67f0c7bd53">15f1c15</a>)</li>
<li><strong>ssr:</strong> class property keys hoisting matching imports
(<a
href="https://redirect.github.com/vitejs/vite/issues/22199">#22199</a>)
(<a
href="https://github.com/vitejs/vite/commit/e1376018cd516d6970534fce495e24f9ee683ce3">e137601</a>)</li>
</ul>
<h2><!-- raw HTML omitted --><a
href="https://github.com/vitejs/vite/compare/v8.0.6...v8.0.7">8.0.7</a>
(2026-04-07)<!-- raw HTML omitted --></h2>
<h3>Bug Fixes</h3>
<ul>
<li>use sync dns.getDefaultResultOrder instead of dns.promises (<a
href="https://redirect.github.com/vitejs/vite/issues/22185">#22185</a>)
(<a
href="https://github.com/vitejs/vite/commit/5c05b04db6f3f64af60ff6525eb5f04bc330fbb5">5c05b04</a>)</li>
</ul>
<h2><!-- raw HTML omitted --><a
href="https://github.com/vitejs/vite/compare/v8.0.5...v8.0.6">8.0.6</a>
(2026-04-07)<!-- raw HTML omitted --></h2>
<h3>Features</h3>
<ul>
<li>update rolldown to 1.0.0-rc.13 (<a
href="https://redirect.github.com/vitejs/vite/issues/22097">#22097</a>)
(<a
href="https://github.com/vitejs/vite/commit/51d3e48980bf3e352d31ecde49d1aa56859918e0">51d3e48</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><strong>css:</strong> avoid mutating sass error multiple times (<a
href="https://redirect.github.com/vitejs/vite/issues/22115">#22115</a>)
(<a
href="https://github.com/vitejs/vite/commit/d5081c2f3e73f3fc06956d8cf5f2cf06463c2325">d5081c2</a>)</li>
<li><strong>optimize-deps:</strong> hoist CJS interop assignment (<a
href="https://redirect.github.com/vitejs/vite/issues/22156">#22156</a>)
(<a
href="https://github.com/vitejs/vite/commit/17a8f9edfcd3b9344668120a84e3328aeada3c97">17a8f9e</a>)</li>
</ul>
<h3>Performance Improvements</h3>
<ul>
<li>early return in <code>getLocalhostAddressIfDiffersFromDNS</code>
when DNS order is <code>verbatim</code> (<a
href="https://redirect.github.com/vitejs/vite/issues/22151">#22151</a>)
(<a
href="https://github.com/vitejs/vite/commit/56ec25613dba6cc71911f7af6e545ebcb77ec012">56ec256</a>)</li>
</ul>
<h3>Miscellaneous Chores</h3>
<ul>
<li><strong>create-vite:</strong> remove unnecessary DOM.Iterable (<a
href="https://redirect.github.com/vitejs/vite/issues/22168">#22168</a>)
(<a
href="https://github.com/vitejs/vite/commit/bdc53ab1e67f7e2e000112eeed9c85413ddb0e9e">bdc53ab</a>)</li>
<li>replace remaining prettier script (<a
href="https://redirect.github.com/vitejs/vite/issues/22179">#22179</a>)
(<a
href="https://github.com/vitejs/vite/commit/af71fb26dd15098b9523efc3d8ed04f27553174b">af71fb2</a>)</li>
</ul>
<h2><!-- raw HTML omitted --><a
href="https://github.com/vitejs/vite/compare/v8.0.4...v8.0.5">8.0.5</a>
(2026-04-06)<!-- raw HTML omitted --></h2>
<h3>Bug Fixes</h3>
<ul>
<li>apply server.fs check to env transport (<a
href="https://redirect.github.com/vitejs/vite/issues/22159">#22159</a>)
(<a
href="https://github.com/vitejs/vite/commit/f02d9fde0b195afe3ea2944414186962fbbe41e0">f02d9fd</a>)</li>
<li>avoid path traversal with optimize deps sourcemap handler (<a
href="https://redirect.github.com/vitejs/vite/issues/22161">#22161</a>)
(<a
href="https://github.com/vitejs/vite/commit/79f002f2286c03c88c7b74c511c7f9fc6dc46694">79f002f</a>)</li>
<li>check <code>server.fs</code> after stripping query as well (<a
href="https://redirect.github.com/vitejs/vite/issues/22160">#22160</a>)
(<a
href="https://github.com/vitejs/vite/commit/a9a3df299378d9cbc5f069e3536a369f8188c8ff">a9a3df2</a>)</li>
<li>disallow referencing files outside the package from sourcemap (<a
href="https://redirect.github.com/vitejs/vite/issues/22158">#22158</a>)
(<a
href="https://github.com/vitejs/vite/commit/f05f50173461789e0f1323fe06b51f18ca41c132">f05f501</a>)</li>
</ul>
<h2><!-- raw HTML omitted --><a
href="https://github.com/vitejs/vite/compare/v8.0.3...v8.0.4">8.0.4</a>
(2026-04-06)<!-- raw HTML omitted --></h2>
<h3>Features</h3>
<ul>
<li>allow esbuild 0.28 as peer deps (<a
href="https://redirect.github.com/vitejs/vite/issues/22155">#22155</a>)
(<a
href="https://github.com/vitejs/vite/commit/b0da97372f5dba73e78035d1cc7680466ff6cf7f">b0da973</a>)</li>
<li><strong>hmr:</strong> truncate list of files on hmr update (<a
href="https://redirect.github.com/vitejs/vite/issues/21535">#21535</a>)
(<a
href="https://github.com/vitejs/vite/commit/d00e806d7be15ebbfe7875e9244963d80ee8b142">d00e806</a>)</li>
<li><strong>optimizer:</strong> log when dependency scanning or bundling
takes over 1s (<a
href="https://redirect.github.com/vitejs/vite/issues/21797">#21797</a>)
(<a
href="https://github.com/vitejs/vite/commit/f61a1ab33b05dc6f6a7eda6e8bc9c4c5b9aab133">f61a1ab</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vitejs/vite/commit/6e585dcb05a3b159fba7ae57f7faf0b1eca7a390"><code>6e585dc</code></a>
release: v8.0.8</li>
<li><a
href="https://github.com/vitejs/vite/commit/e1376018cd516d6970534fce495e24f9ee683ce3"><code>e137601</code></a>
fix(ssr): class property keys hoisting matching imports (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22199">#22199</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/15f1c15ac9be343ee4f317fd025c3d67f0c7bd53"><code>15f1c15</code></a>
fix: avoid <code>dns.getDefaultResultOrder</code> temporary (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22202">#22202</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/6baf587255936e91348cbe624caefd10e8c607ab"><code>6baf587</code></a>
feat: update rolldown to 1.0.0-rc.15 (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22201">#22201</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/fdb2e6f63894d8c458c1778f3df77afe537f2bb2"><code>fdb2e6f</code></a>
release: v8.0.7</li>
<li><a
href="https://github.com/vitejs/vite/commit/5c05b04db6f3f64af60ff6525eb5f04bc330fbb5"><code>5c05b04</code></a>
fix: use sync dns.getDefaultResultOrder instead of dns.promises (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22185">#22185</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/7b3086fae4170252e4cd53f3988f207a943ac5cb"><code>7b3086f</code></a>
release: v8.0.6</li>
<li><a
href="https://github.com/vitejs/vite/commit/af71fb26dd15098b9523efc3d8ed04f27553174b"><code>af71fb2</code></a>
chore: replace remaining prettier script (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22179">#22179</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/51d3e48980bf3e352d31ecde49d1aa56859918e0"><code>51d3e48</code></a>
feat: update rolldown to 1.0.0-rc.13 (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22097">#22097</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/17a8f9edfcd3b9344668120a84e3328aeada3c97"><code>17a8f9e</code></a>
fix(optimize-deps): hoist CJS interop assignment (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22156">#22156</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/vitejs/vite/commits/v8.0.8/packages/vite">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-20 20:22:40 +02:00
dependabot[bot]anddependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> 4c2628fa67 build(deps): Bump axios from 1.13.5 to 1.15.0 (#153) 
Bumps [axios](https://github.com/axios/axios) from 1.13.5 to 1.15.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/axios/axios/releases">axios's
releases</a>.</em></p>
<blockquote>
<h2>v1.15.0</h2>
<p>This release delivers two critical security patches, adds runtime
support for Deno and Bun, and includes significant CI hardening,
documentation improvements, and routine dependency updates.</p>
<h2>⚠️ Important Changes</h2>
<ul>
<li><strong>Deprecation:</strong> <code>url.parse()</code> usage has
been replaced to address Node.js deprecation warnings. If you are on a
recent version of Node.js, this resolves console warnings you may have
been seeing. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10625">#10625</a></strong>)</li>
</ul>
<h2>🔒 Security Fixes</h2>
<ul>
<li><strong>Proxy Handling:</strong> Fixed a <code>no_proxy</code>
hostname normalisation bypass that could lead to Server-Side Request
Forgery (SSRF). (<strong><a
href="https://redirect.github.com/axios/axios/issues/10661">#10661</a></strong>)</li>
<li><strong>Header Injection:</strong> Fixed an unrestricted cloud
metadata exfiltration vulnerability via a header injection chain.
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10660">#10660</a></strong>)</li>
</ul>
<h2>🚀 New Features</h2>
<ul>
<li><strong>Runtime Support:</strong> Added compatibility checks and
documentation for Deno and Bun environments. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10652">#10652</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10653">#10653</a></strong>)</li>
</ul>
<h2>🔧 Maintenance &amp; Chores</h2>
<ul>
<li><strong>CI Security:</strong> Hardened workflow permissions to least
privilege, added the <code>zizmor</code> security scanner, pinned action
versions, and gated npm publishing with OIDC and environment protection.
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10618">#10618</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10619">#10619</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10627">#10627</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10637">#10637</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10666">#10666</a></strong>)</li>
<li><strong>Dependencies:</strong> Bumped
<code>serialize-javascript</code>, <code>handlebars</code>,
<code>picomatch</code>, <code>vite</code>, and
<code>denoland/setup-deno</code> to latest versions. Added a 7-day
Dependabot cooldown period. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10574">#10574</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10572">#10572</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10568">#10568</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10663">#10663</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10664">#10664</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10665">#10665</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10669">#10669</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10670">#10670</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10616">#10616</a></strong>)</li>
<li><strong>Documentation:</strong> Unified docs, improved
<code>beforeRedirect</code> credential leakage example, clarified
<code>withCredentials</code>/<code>withXSRFToken</code> behaviour,
HTTP/2 support notes, async/await timeout error handling, header case
preservation, and various typo fixes. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10649">#10649</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10624">#10624</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/7452">#7452</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/7471">#7471</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10654">#10654</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10644">#10644</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10589">#10589</a></strong>)</li>
<li><strong>Housekeeping:</strong> Removed stale files, regenerated
lockfile, and updated sponsor scripts and blocks. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10584">#10584</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10650">#10650</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10582">#10582</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10640">#10640</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10659">#10659</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10668">#10668</a></strong>)</li>
<li><strong>Tests:</strong> Added regression coverage for urlencoded
<code>Content-Type</code> casing. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10573">#10573</a></strong>)</li>
</ul>
<h2>🌟 New Contributors</h2>
<p>We are thrilled to welcome our new contributors. Thank you for
helping improve Axios:</p>
<ul>
<li><strong><a
href="https://github.com/raashish1601"><code>@​raashish1601</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10573">#10573</a></strong>)</li>
<li><strong><a
href="https://github.com/Kilros0817"><code>@​Kilros0817</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10625">#10625</a></strong>)</li>
<li><strong><a
href="https://github.com/ashstrc"><code>@​ashstrc</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10624">#10624</a></strong>)</li>
<li><strong><a
href="https://github.com/Abhi3975"><code>@​Abhi3975</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10589">#10589</a></strong>)</li>
<li><strong><a
href="https://github.com/theamodhshetty"><code>@​theamodhshetty</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/7452">#7452</a></strong>)</li>
</ul>
<h2>v1.14.0</h2>
<p>This release focuses on compatibility fixes, adapter stability
improvements, and test/tooling modernisation.</p>
<h2>⚠️ Important Changes</h2>
<ul>
<li><strong>Breaking Changes:</strong> None identified in this
release.</li>
<li><strong>Action Required:</strong> If you rely on env-based proxy
behaviour or CJS resolution edge-cases, validate your integration after
upgrade (notably <code>proxy-from-env</code> v2 alignment and
<code>main</code> entry compatibility fix).</li>
</ul>
<h2>🚀 New Features</h2>
<ul>
<li><strong>Runtime Features:</strong> No new end-user features were
introduced in this release.</li>
<li><strong>Test Coverage Expansion:</strong> Added broader smoke/module
test coverage for CJS and ESM package usage. (<a
href="https://redirect.github.com/axios/axios/pull/7510">#7510</a>)</li>
</ul>
<h2>🐛 Bug Fixes</h2>
<ul>
<li><strong>Headers:</strong> Trim trailing CRLF in normalised header
values. (<a
href="https://redirect.github.com/axios/axios/pull/7456">#7456</a>)</li>
<li><strong>HTTP/2:</strong> Close detached HTTP/2 sessions on timeout
to avoid lingering sessions. (<a
href="https://redirect.github.com/axios/axios/pull/7457">#7457</a>)</li>
<li><strong>Fetch Adapter:</strong> Cancel <code>ReadableStream</code>
created during request-stream capability probing to prevent async
resource leaks. (<a
href="https://redirect.github.com/axios/axios/pull/7515">#7515</a>)</li>
<li><strong>Proxy Handling:</strong> Fixed env proxy behavior with
<code>proxy-from-env</code> v2 usage. (<a
href="https://redirect.github.com/axios/axios/pull/7499">#7499</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/axios/axios/blob/v1.x/CHANGELOG.md">axios's
changelog</a>.</em></p>
<blockquote>
<h2>v1.15.0 — April 7, 2026</h2>
<p>This release delivers two critical security patches targeting header
injection and SSRF via proxy bypass, adds official runtime support for
Deno and Bun, and includes significant CI security hardening.</p>
<h2>🔒 Security Fixes</h2>
<ul>
<li>
<p><strong>Header Injection (CRLF):</strong> Rejects any header value
containing <code>\r</code> or <code>\n</code> characters to block CRLF
injection chains that could be used to exfiltrate cloud metadata (IMDS).
Behavior change: headers with CR/LF now throw <code>&quot;Invalid
character in header content&quot;</code>. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10660">#10660</a></strong>)</p>
</li>
<li>
<p><strong>SSRF via <code>no_proxy</code> Bypass:</strong> Introduces a
<code>shouldBypassProxy</code> helper that normalises hostnames (strips
trailing dots, handles bracketed IPv6) before evaluating
<code>no_proxy</code>/<code>NO_PROXY</code> rules, closing a gap that
could cause loopback or internal hosts to be inadvertently proxied.
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10661">#10661</a></strong>)</p>
</li>
</ul>
<h2>🚀 New Features</h2>
<ul>
<li><strong>Deno &amp; Bun Runtime Support:</strong> Added full smoke
test suites for Deno and Bun, with CI workflows that run both runtimes
before any release is cut. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10652">#10652</a></strong>)</li>
</ul>
<h2>🐛 Bug Fixes</h2>
<ul>
<li><strong>Node.js v22 Compatibility:</strong> Replaced deprecated
<code>url.parse()</code> calls with the WHATWG
<code>URL</code>/<code>URLSearchParams</code> API across examples,
sandbox, and tests, eliminating <code>DEP0169</code> deprecation
warnings on Node.js v22+. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10625">#10625</a></strong>)</li>
</ul>
<h2>🔧 Maintenance &amp; Chores</h2>
<ul>
<li>
<p><strong>CI Security Hardening:</strong> Added <a
href="https://github.com/zizmorcore/zizmor">zizmor</a> GitHub Actions
security scanner; switched npm publish to OIDC Trusted Publishing
(removing the long-lived <code>NODE_AUTH_TOKEN</code>); pinned all
action references to full commit SHAs; narrowed workflow permissions to
least privilege; gated the publish step behind a dedicated
<code>npm-publish</code> environment; and blocked the sponsor-block
workflow from running on forks. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10618">#10618</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10619">#10619</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10627">#10627</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10637">#10637</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10641">#10641</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10666">#10666</a></strong>)</p>
</li>
<li>
<p><strong>Docs:</strong> Clarified HTTP/2 support and the unsupported
<code>httpVersion</code> option; added documentation for header case
preservation; improved the <code>beforeRedirect</code> example to
prevent accidental credential leakage. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10644">#10644</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10654">#10654</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10624">#10624</a></strong>)</p>
</li>
<li>
<p><strong>Dependencies:</strong> Bumped <code>picomatch</code>,
<code>handlebars</code>, <code>serialize-javascript</code>,
<code>vite</code> (×3), <code>denoland/setup-deno</code>, and 4
additional dev dependencies to latest versions. (<strong><a
href="https://redirect.github.com/axios/axios/issues/10564">#10564</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10565">#10565</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10567">#10567</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10568">#10568</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10572">#10572</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10574">#10574</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10663">#10663</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10664">#10664</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10665">#10665</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10669">#10669</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10670">#10670</a></strong>)</p>
</li>
</ul>
<h2>🌟 New Contributors</h2>
<p>We are thrilled to welcome our new contributors. Thank you for
helping improve axios:</p>
<ul>
<li><strong><a
href="https://github.com/Kilros0817"><code>@​Kilros0817</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10625">#10625</a></strong>)</li>
<li><strong><a
href="https://github.com/shaanmajid"><code>@​shaanmajid</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10616">#10616</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10617">#10617</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10618">#10618</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10619">#10619</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10637">#10637</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10641">#10641</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10666">#10666</a></strong>)</li>
<li><strong><a
href="https://github.com/ashstrc"><code>@​ashstrc</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10624">#10624</a></strong>,
<strong><a
href="https://redirect.github.com/axios/axios/issues/10644">#10644</a></strong>)</li>
<li><strong><a
href="https://github.com/Abhi3975"><code>@​Abhi3975</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10589">#10589</a></strong>)</li>
<li><strong><a
href="https://github.com/raashish1601"><code>@​raashish1601</code></a></strong>
(<strong><a
href="https://redirect.github.com/axios/axios/issues/10573">#10573</a></strong>)</li>
</ul>
<p><a
href="https://github.com/axios/axios/compare/v1.14.0...v1.15.0">Full
Changelog</a></p>
<hr />
<h2>v1.14.0 — March 27, 2026</h2>
<p>This release fixes a security vulnerability in the
<code>formidable</code> dependency, resolves a CommonJS compatibility
regression, hardens proxy and HTTP/2 handling, and modernises the build
and test toolchain.</p>
<h2>🔒 Security Fixes</h2>
<ul>
<li><strong>Formidable Vulnerability:</strong> Upgraded
<code>formidable</code> from v2 to v3 to address a reported
arbitrary-file vulnerability. Updated test server and assertions to
align with the v3 API. (<strong><a
href="https://redirect.github.com/axios/axios/issues/7533">#7533</a></strong>)</li>
</ul>
<h2>🐛 Bug Fixes</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/axios/axios/commit/772a4e54ecc4cc2421e2b746daff0aca10f359d7"><code>772a4e5</code></a>
chore(release): prepare release 1.15.0 (<a
href="https://redirect.github.com/axios/axios/issues/10671">#10671</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/4b071371be2f810b4bc7797a13838e0f806ebb22"><code>4b07137</code></a>
chore(deps-dev): bump vite from 8.0.0 to 8.0.5 in /tests/smoke/esm (<a
href="https://redirect.github.com/axios/axios/issues/10663">#10663</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/51e57b39db251bfe3d34af5c943dfea18e06c8b6"><code>51e57b3</code></a>
chore(deps-dev): bump vite from 8.0.2 to 8.0.5 (<a
href="https://redirect.github.com/axios/axios/issues/10664">#10664</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/fba1a77930f0c459677b729161627234b88c90aa"><code>fba1a77</code></a>
chore(deps-dev): bump vite from 8.0.2 to 8.0.5 in /tests/module/esm (<a
href="https://redirect.github.com/axios/axios/issues/10665">#10665</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/0bf6e28eac86e87da2b60bbf5ea4237910e1a08e"><code>0bf6e28</code></a>
chore(deps): bump denoland/setup-deno in the github-actions group (<a
href="https://redirect.github.com/axios/axios/issues/10669">#10669</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/8107157c572ee4a54cb28c01ab7f7f3d895ba661"><code>8107157</code></a>
chore(deps-dev): bump the development_dependencies group with 4 updates
(<a
href="https://redirect.github.com/axios/axios/issues/10670">#10670</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/e66530e3302d56176befd0778155dafea2487542"><code>e66530e</code></a>
ci: require npm-publish environment for releases (<a
href="https://redirect.github.com/axios/axios/issues/10666">#10666</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/49f23cbfe4d308a075281c5f798d4c68f648cbe2"><code>49f23cb</code></a>
chore(sponsor): update sponsor block (<a
href="https://redirect.github.com/axios/axios/issues/10668">#10668</a>)</li>
<li><a
href="https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1"><code>3631854</code></a>
fix: unrestricted cloud metadata exfiltration via header injection chain
(<a
href="https://redirect.github.com/axios/axios/issues/10">#10</a>...</li>
<li><a
href="https://github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df"><code>fb3befb</code></a>
fix: no_proxy hostname normalization bypass leads to ssrf (<a
href="https://redirect.github.com/axios/axios/issues/10661">#10661</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/axios/axios/compare/v1.13.5...v1.15.0">compare
view</a></li>
</ul>
</details>
<details>
<summary>Install script changes</summary>
<p>This version modifies <code>prepare</code> script that runs during
installation. Review the package contents before updating.</p>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-20 19:18:24 +02:00
dependabot[bot]anddependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> 9dcfce415d build(deps-dev): Bump eslint from 10.1.0 to 10.2.0 (#151) 
Bumps [eslint](https://github.com/eslint/eslint) from 10.1.0 to 10.2.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/eslint/eslint/releases">eslint's
releases</a>.</em></p>
<blockquote>
<h2>v10.2.0</h2>
<h2>Features</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/586ec2f43092779acc957866db4abe999112d1e1"><code>586ec2f</code></a>
feat: Add <code>meta.languages</code> support to rules (<a
href="https://redirect.github.com/eslint/eslint/issues/20571">#20571</a>)
(Copilot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/14207dee3939dc87cfa8b2fcfc271fff2cfd6471"><code>14207de</code></a>
feat: add <code>Temporal</code> to <code>no-obj-calls</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/20675">#20675</a>)
(Pixel998)</li>
<li><a
href="https://github.com/eslint/eslint/commit/bbb2c93a2b31bd30924f32fe69a9acf41f9dfe35"><code>bbb2c93</code></a>
feat: add Temporal to ES2026 globals (<a
href="https://redirect.github.com/eslint/eslint/issues/20672">#20672</a>)
(Pixel998)</li>
</ul>
<h2>Bug Fixes</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/542cb3e6442a4e6ee3457c799e2a0ee23bef0c6a"><code>542cb3e</code></a>
fix: update first-party dependencies (<a
href="https://redirect.github.com/eslint/eslint/issues/20714">#20714</a>)
(Francesco Trotta)</li>
</ul>
<h2>Documentation</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/a2af743ea60f683d0e0de9d98267c1e7e4f5e412"><code>a2af743</code></a>
docs: add <code>language</code> to configuration objects (<a
href="https://redirect.github.com/eslint/eslint/issues/20712">#20712</a>)
(Francesco Trotta)</li>
<li><a
href="https://github.com/eslint/eslint/commit/845f23f1370892bf07d819497ac518c9e65090d6"><code>845f23f</code></a>
docs: Update README (GitHub Actions Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/5fbcf5958b897cc4df5d652924d18428db37f7ee"><code>5fbcf59</code></a>
docs: remove <code>sourceType</code> from ts playground link (<a
href="https://redirect.github.com/eslint/eslint/issues/20477">#20477</a>)
(Tanuj Kanti)</li>
<li><a
href="https://github.com/eslint/eslint/commit/8702a474659be786b6b1392e5e7c0c56355ae4a4"><code>8702a47</code></a>
docs: Update README (GitHub Actions Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/ddeaded2ab36951383ff67c60fb64ec68d29a46a"><code>ddeaded</code></a>
docs: Update README (GitHub Actions Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/2b4496691266547784a7f7ad1989ce53381bab91"><code>2b44966</code></a>
docs: add Major Releases section to Manage Releases (<a
href="https://redirect.github.com/eslint/eslint/issues/20269">#20269</a>)
(Milos Djermanovic)</li>
<li><a
href="https://github.com/eslint/eslint/commit/eab65c700ebb16a6e790910c720450c9908961fd"><code>eab65c7</code></a>
docs: update <code>eslint</code> versions in examples (<a
href="https://redirect.github.com/eslint/eslint/issues/20664">#20664</a>)
(루밀LuMir)</li>
<li><a
href="https://github.com/eslint/eslint/commit/3e4a29903bf31f0998e45ad9128a265bce1edc56"><code>3e4a299</code></a>
docs: update ESM Dependencies policies with note for own-usage packages
(<a
href="https://redirect.github.com/eslint/eslint/issues/20660">#20660</a>)
(Milos Djermanovic)</li>
</ul>
<h2>Chores</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/8120e30f833474f47acc061d24d164e9f022264f"><code>8120e30</code></a>
refactor: extract no unmodified loop condition (<a
href="https://redirect.github.com/eslint/eslint/issues/20679">#20679</a>)
(kuldeep kumar)</li>
<li><a
href="https://github.com/eslint/eslint/commit/46e8469786be1b2bbb522100e1d44624d98d3745"><code>46e8469</code></a>
chore: update dependency markdownlint-cli2 to ^0.22.0 (<a
href="https://redirect.github.com/eslint/eslint/issues/20697">#20697</a>)
(renovate[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/01ed3aa68477f81a7188e1498cf4906e02015b7c"><code>01ed3aa</code></a>
test: add unit tests for unicode utilities (<a
href="https://redirect.github.com/eslint/eslint/issues/20622">#20622</a>)
(Manish chaudhary)</li>
<li><a
href="https://github.com/eslint/eslint/commit/811f4930f82ee2b6ac8eae75cade9bed63de0781"><code>811f493</code></a>
ci: remove <code>--legacy-peer-deps</code> from types integration tests
(<a
href="https://redirect.github.com/eslint/eslint/issues/20667">#20667</a>)
(Milos Djermanovic)</li>
<li><a
href="https://github.com/eslint/eslint/commit/6b86fcfc5c75d6a3b8a2cf7bcdb3ef60635a9a03"><code>6b86fcf</code></a>
chore: update dependency npm-run-all2 to v8 (<a
href="https://redirect.github.com/eslint/eslint/issues/20663">#20663</a>)
(renovate[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/632c4f83bf32b77981c7d395cacddd1bb172ee25"><code>632c4f8</code></a>
chore: add <code>prettier</code> update commit to
<code>.git-blame-ignore-revs</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/20662">#20662</a>)
(루밀LuMir)</li>
<li><a
href="https://github.com/eslint/eslint/commit/b0b0f21927e03ba092400e3c70d7058f537765c8"><code>b0b0f21</code></a>
chore: update dependency eslint-plugin-regexp to ^3.1.0 (<a
href="https://redirect.github.com/eslint/eslint/issues/20659">#20659</a>)
(Milos Djermanovic)</li>
<li><a
href="https://github.com/eslint/eslint/commit/228a2dd4b272c17f516ee3541f1dd69eca0a8ab0"><code>228a2dd</code></a>
chore: update dependency eslint-plugin-eslint-plugin to ^7.3.2 (<a
href="https://redirect.github.com/eslint/eslint/issues/20661">#20661</a>)
(Milos Djermanovic)</li>
<li><a
href="https://github.com/eslint/eslint/commit/3ab4d7e244df244102de9d0d250b2ff12456a785"><code>3ab4d7e</code></a>
test: Add tests for eslintrc-style keys (<a
href="https://redirect.github.com/eslint/eslint/issues/20645">#20645</a>)
(kuldeep kumar)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/000128c29235c5a8c35c7ef817dbccc4e42130ca"><code>000128c</code></a>
10.2.0</li>
<li><a
href="https://github.com/eslint/eslint/commit/1988fad70e361fe1c8df7804930a66e6a9bfc698"><code>1988fad</code></a>
Build: changelog update for 10.2.0</li>
<li><a
href="https://github.com/eslint/eslint/commit/542cb3e6442a4e6ee3457c799e2a0ee23bef0c6a"><code>542cb3e</code></a>
fix: update first-party dependencies (<a
href="https://redirect.github.com/eslint/eslint/issues/20714">#20714</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/a2af743ea60f683d0e0de9d98267c1e7e4f5e412"><code>a2af743</code></a>
docs: add <code>language</code> to configuration objects (<a
href="https://redirect.github.com/eslint/eslint/issues/20712">#20712</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/845f23f1370892bf07d819497ac518c9e65090d6"><code>845f23f</code></a>
docs: Update README</li>
<li><a
href="https://github.com/eslint/eslint/commit/5fbcf5958b897cc4df5d652924d18428db37f7ee"><code>5fbcf59</code></a>
docs: remove <code>sourceType</code> from ts playground link (<a
href="https://redirect.github.com/eslint/eslint/issues/20477">#20477</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/8702a474659be786b6b1392e5e7c0c56355ae4a4"><code>8702a47</code></a>
docs: Update README</li>
<li><a
href="https://github.com/eslint/eslint/commit/ddeaded2ab36951383ff67c60fb64ec68d29a46a"><code>ddeaded</code></a>
docs: Update README</li>
<li><a
href="https://github.com/eslint/eslint/commit/8120e30f833474f47acc061d24d164e9f022264f"><code>8120e30</code></a>
refactor: extract no unmodified loop condition (<a
href="https://redirect.github.com/eslint/eslint/issues/20679">#20679</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/46e8469786be1b2bbb522100e1d44624d98d3745"><code>46e8469</code></a>
chore: update dependency markdownlint-cli2 to ^0.22.0 (<a
href="https://redirect.github.com/eslint/eslint/issues/20697">#20697</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/eslint/eslint/compare/v10.1.0...v10.2.0">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-20 19:12:46 +02:00
dependabot[bot]anddependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> ae341596f3 build(deps): Bump pg from 8.18.0 to 8.20.0 (#150) 
Bumps
[pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg) from
8.18.0 to 8.20.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md">pg's
changelog</a>.</em></p>
<blockquote>
<h2>pg@8.20.0</h2>
<ul>
<li>Add <a
href="https://redirect.github.com/brianc/node-postgres/pull/3620">onConnect</a>
callback to pg.Pool constructor options allowing for async
initialization of newly created &amp; connected pooled clients.</li>
</ul>
<h2>pg@8.19.0</h2>
<ul>
<li><a
href="https://redirect.github.com/brianc/node-postgres/pull/3603">Deprecate
interal query queue</a>.</li>
<li>Pass connection parameters <a
href="https://redirect.github.com/brianc/node-postgres/pull/3602">to
password callback</a>.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/brianc/node-postgres/commit/c9070cc8d526fca65780cedc25c1966b57cf7532"><code>c9070cc</code></a>
Publish</li>
<li><a
href="https://github.com/brianc/node-postgres/commit/ad36e3c9e80fae771d636328420cebe7d544baae"><code>ad36e3c</code></a>
fix: typo in deprecation notice for <code>client.query()</code> (<a
href="https://github.com/brianc/node-postgres/tree/HEAD/packages/pg/issues/3618">#3618</a>)</li>
<li><a
href="https://github.com/brianc/node-postgres/commit/f2d7d1146cc87024a5fa503dce13c59ff5196d26"><code>f2d7d11</code></a>
Publish</li>
<li><a
href="https://github.com/brianc/node-postgres/commit/5a4bafc2b06fe4f12e83be723bf783a171d1959b"><code>5a4bafc</code></a>
Deprecate Client's internal query queue (<a
href="https://github.com/brianc/node-postgres/tree/HEAD/packages/pg/issues/3603">#3603</a>)</li>
<li><a
href="https://github.com/brianc/node-postgres/commit/a215bfb5bac4b8b12cd69c9a7f5807eb628a8771"><code>a215bfb</code></a>
Typo fix in PgPass deprecation (funciton) (<a
href="https://github.com/brianc/node-postgres/tree/HEAD/packages/pg/issues/3605">#3605</a>)</li>
<li><a
href="https://github.com/brianc/node-postgres/commit/01e05567207872d22f486881300c1ebc2eb48727"><code>01e0556</code></a>
fix(pg-query-stream): invoke <code>this.callback</code> on cursor
end/error (<a
href="https://github.com/brianc/node-postgres/tree/HEAD/packages/pg/issues/2810">#2810</a>)</li>
<li><a
href="https://github.com/brianc/node-postgres/commit/e6e36920075e2c8b2f9ee5d085c7059b80d39fc8"><code>e6e3692</code></a>
Pass connection parameters to password callback (<a
href="https://github.com/brianc/node-postgres/tree/HEAD/packages/pg/issues/3602">#3602</a>)</li>
<li><a
href="https://github.com/brianc/node-postgres/commit/d80d883944d818234b09f85b3844061ae2d9b906"><code>d80d883</code></a>
test: Fix TLS connection test ending too early</li>
<li><a
href="https://github.com/brianc/node-postgres/commit/f332f283e923d137fa0499d121b79fbaedaf7de1"><code>f332f28</code></a>
fix: Connection timeout handling for native clients in connected state
(<a
href="https://github.com/brianc/node-postgres/tree/HEAD/packages/pg/issues/3512">#3512</a>)</li>
<li><a
href="https://github.com/brianc/node-postgres/commit/b2e9cb13e29f1054ddfa6feba4d27949ec6969ff"><code>b2e9cb1</code></a>
Remove testAsync - its redundant (<a
href="https://github.com/brianc/node-postgres/tree/HEAD/packages/pg/issues/3588">#3588</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/brianc/node-postgres/commits/pg@8.20.0/packages/pg">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-20 19:10:19 +02:00
dependabot[bot]anddependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> c63bf09478 build(deps-dev): Bump @types/node from 24.12.0 to 24.12.2 (#148) 
Bumps
[@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)
from 24.12.0 to 24.12.2.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-20 19:05:45 +02:00
dependabot[bot]anddependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> c772f6ae56 build(deps-dev): Bump @vitejs/plugin-react-swc from 4.2.3 to 4.3.0 (#129) 
Bumps
[@vitejs/plugin-react-swc](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react-swc)
from 4.2.3 to 4.3.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite-plugin-react/releases"><code>@​vitejs/plugin-react-swc</code>'s
releases</a>.</em></p>
<blockquote>
<h2>plugin-react-swc@4.3.0</h2>
<h3>Add Vite 8 to peerDependencies range <a
href="https://redirect.github.com/vitejs/vite-plugin-react/pull/1142">#1142</a></h3>
<p>This plugin is compatible with Vite 8.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react-swc/CHANGELOG.md"><code>@​vitejs/plugin-react-swc</code>'s
changelog</a>.</em></p>
<blockquote>
<h2>4.3.0 (2026-03-12)</h2>
<h3>Add Vite 8 to peerDependencies range <a
href="https://redirect.github.com/vitejs/vite-plugin-react/pull/1142">#1142</a></h3>
<p>This plugin is compatible with Vite 8.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/vitejs/vite-plugin-react/commits/v4.3.0/packages/plugin-react-swc">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-20 18:54:56 +02:00
dependabot[bot]anddependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> d5e7217b4f build(deps-dev): Bump jsdom from 28.1.0 to 29.0.2 (#145) 
Bumps [jsdom](https://github.com/jsdom/jsdom) from 28.1.0 to 29.0.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/jsdom/jsdom/releases">jsdom's
releases</a>.</em></p>
<blockquote>
<h2>v29.0.2</h2>
<ul>
<li>Significantly improved and sped up <code>getComputedStyle()</code>.
Computed value rules are now applied across a broader set of properties,
and include fixes related to inheritance, defaulting keywords, custom
properties, and color-related values such as <code>currentcolor</code>
and system colors. (<a
href="https://github.com/asamuzaK"><code>@​asamuzaK</code></a>)</li>
<li>Fixed CSS <code>'background</code>' and <code>'border'</code>
shorthand parsing. (<a
href="https://github.com/asamuzaK"><code>@​asamuzaK</code></a>)</li>
</ul>
<h2>v29.0.1</h2>
<ul>
<li>Fixed CSS parsing of <code>'border'</code>,
<code>'background'</code>, and their sub-shorthands containing keywords
or <code>var()</code>. (<a
href="https://github.com/asamuzaK"><code>@​asamuzaK</code></a>)</li>
<li>Fixed <code>getComputedStyle()</code> to return a more functional
<code>CSSStyleDeclaration</code> object, including indexed access
support, which regressed in v29.0.0.</li>
</ul>
<h2>v29.0.0</h2>
<p>Breaking changes:</p>
<ul>
<li>Node.js v22.13.0+ is now the minimum supported v22 version (was
v22.12.0+).</li>
</ul>
<p>Other changes:</p>
<ul>
<li>Overhauled the CSSOM implementation, replacing the <a
href="https://www.npmjs.com/package/@acemir/cssom"><code>@acemir/cssom</code></a>
and <a
href="https://github.com/jsdom/cssstyle"><code>cssstyle</code></a>
dependencies with fresh internal implementations built on webidl2js
wrappers and the <a
href="https://www.npmjs.com/package/css-tree"><code>css-tree</code></a>
parser. Serialization, parsing, and API behavior is improved in various
ways, especially around edge cases.</li>
<li>Added <code>CSSCounterStyleRule</code> and
<code>CSSNamespaceRule</code> to jsdom <code>Window</code>s.</li>
<li>Added <code>cssMediaRule.matches</code> and
<code>cssSupportsRule.matches</code> getters.</li>
<li>Added proper media query parsing in <code>MediaList</code>, using
<code>css-tree</code> instead of naive comma-splitting. Invalid queries
become <code>&quot;not all&quot;</code> per spec.</li>
<li>Added <code>cssKeyframeRule.keyText</code> getter/setter
validation.</li>
<li>Added <code>cssStyleRule.selectorText</code> setter validation:
invalid selectors are now rejected.</li>
<li>Added <code>styleSheet.ownerNode</code>,
<code>styleSheet.href</code>, and <code>styleSheet.title</code>.</li>
<li>Added bad port blocking per the <a
href="https://fetch.spec.whatwg.org/#bad-port">fetch specification</a>,
preventing fetches to commonly-abused ports.</li>
<li>Improved <code>Document</code> initialization performance by lazily
initializing the CSS selector engine, avoiding ~0.5 ms of overhead per
<code>Document</code>. (<a
href="https://github.com/thypon"><code>@​thypon</code></a>)</li>
<li>Fixed a memory leak when stylesheets were removed from the
document.</li>
<li>Fixed <code>CSSStyleDeclaration</code> modifications to properly
trigger custom element reactions.</li>
<li>Fixed nested <code>@media</code> rule parsing.</li>
<li>Fixed <code>CSSStyleSheet</code>'s &quot;disallow modification&quot;
flag not being checked in all mutation methods.</li>
<li>Fixed <code>XMLHttpRequest</code>'s <code>response</code> getter
returning parsed JSON during the <code>LOADING</code> state instead of
<code>null</code>.</li>
<li>Fixed <code>getComputedStyle()</code> crashing in XHTML documents
when stylesheets contained at-rules such as <code>@page</code> or
<code>@font-face</code>.</li>
<li>Fixed a potential hang in synchronous <code>XMLHttpRequest</code>
caused by a race condition with the worker thread's idle timeout.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/jsdom/jsdom/commit/2a1e2cdb443e276b28ca49937cf7a7d6fa0a4806"><code>2a1e2cd</code></a>
29.0.2</li>
<li><a
href="https://github.com/jsdom/jsdom/commit/4097d66ba188805a408b5186b4b8036bf582b40f"><code>4097d66</code></a>
Resolve computed CSS values lazily in CSSStyleDeclaration</li>
<li><a
href="https://github.com/jsdom/jsdom/commit/cf5523ff92978fc08f7e40c0f44053946101d064"><code>cf5523f</code></a>
Add more test cases for nested color-mix with currentColor</li>
<li><a
href="https://github.com/jsdom/jsdom/commit/b33b61657e563ec841cb7a29c98ad236cc71c0b0"><code>b33b616</code></a>
Add test that getComputedStyle() works with !important</li>
<li><a
href="https://github.com/jsdom/jsdom/commit/6bf559c416654641d3ca197982d646eac6de85ae"><code>6bf559c</code></a>
Add test for custom property inheritance in computed styles</li>
<li><a
href="https://github.com/jsdom/jsdom/commit/68176571d00c50441fc3a428e1315fc1fb3b2bab"><code>6817657</code></a>
Fix border shorthand handling</li>
<li><a
href="https://github.com/jsdom/jsdom/commit/470f5c5943d001f9abf8396734fc0c6f11174784"><code>470f5c5</code></a>
Consolidate color helpers</li>
<li><a
href="https://github.com/jsdom/jsdom/commit/3db53cb2cb14aef35717cbec75b6bd638b1224a7"><code>3db53cb</code></a>
Fix background shorthand handlers</li>
<li><a
href="https://github.com/jsdom/jsdom/commit/678e84093ad44b444be6e0317b84396832ff39c6"><code>678e840</code></a>
Remove some longhand property files</li>
<li><a
href="https://github.com/jsdom/jsdom/commit/d526a07432982dcb89597e469c0fb00ba54884bb"><code>d526a07</code></a>
Add regression test for getComputedStyle() liveness</li>
<li>Additional commits viewable in <a
href="https://github.com/jsdom/jsdom/compare/v28.1.0...v29.0.2">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by [GitHub Actions](<a
href="https://www.npmjs.com/~GitHub">https://www.npmjs.com/~GitHub</a>
Actions), a new releaser for jsdom since your current version.</p>
</details>
<details>
<summary>Install script changes</summary>
<p>This version modifies <code>prepare</code> script that runs during
installation. Review the package contents before updating.</p>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-20 18:46:33 +02:00