chore(deps): update all non-major dependencies by renovate[bot] · Pull Request #1750 · stacksjs/stx

renovate · 2026-06-03T11:55:27Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Type	Update
@11ty/eleventy (source)	`^3.1.5` → `^3.1.6`	dependencies	patch
@iconify/json (source)	`^2.2.463` → `^2.2.489`	devDependencies	patch
@stacksjs/clapp	`^0.2.0` → `^0.2.10`	dependencies	patch
@stacksjs/ts-cloud	`^0.2.3` → `^0.5.17`	dependencies	minor
@types/bun (source)	`^1.3.11` → `^1.3.14`	devDependencies	patch
@types/vscode (source)	`^1.110.0` → `^1.125.0`	devDependencies	minor
@vscode/vsce (source)	`^3.7.2-12` → `^3.9.2`	devDependencies	minor
actions/cache	`v5.0.3` → `v5.0.5`	action	patch
actions/checkout	`v6.0.2` → `v6.0.3`	action	patch
bun (source)	`>=1.3.11` → `>=1.3.14`	peerDependencies	patch
bunfig	`^0.15.6` → `^0.15.14`	dependencies	patch
dompurify	`^3.3.3` → `^3.4.11`	dependencies	minor
ejs	`^5.0.1` → `^5.0.2`	dependencies	patch
happy-dom	`^20.8.9` → `^20.10.6`	dependencies	minor
isomorphic-dompurify	`^3.7.1` → `^3.18.0`	dependencies	minor
js-yaml	`^4.1.1` → `^4.2.0`	dependencies	minor
jsdom	`^29.0.1` → `^29.1.1`	devDependencies	minor
liquidjs	`^10.25.2` → `^10.27.0`	dependencies	minor
markdown-it	`^14.1.1` → `^14.2.0`	dependencies	minor
marked (source)	`^17.0.5` → `^17.0.6`	dependencies	patch
oven-sh/setup-bun	`v2.1.2` → `v2.2.0`	action	minor
prettier (source)	`^3.8.1` → `^3.8.4`	dependencies	patch
sanitize-html (source)	`^2.17.2` → `^2.17.5`	dependencies	patch
tinybench	`^6.0.0` → `^6.0.2`	dependencies	patch
ts-broadcasting	`^0.0.4` → `^0.0.5`	dependencies	patch
typescript (source)	`^6.0.2` → `^6.0.3`	devDependencies	patch
vscode-languageserver-types (source)	`^3.17.5` → `^3.18.0`	devDependencies	minor
ws	`^8.20.0` → `^8.21.0`	dependencies	minor

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

11ty/eleventy (@11ty/eleventy)

`v3.1.6`: Eleventy v3.1.6: Everybody wants to do Maintenance

Compare Source

Fixes Node 26 module.register deprecation warning shown in console #4283 (fixed in v4 alphas in #4271)
Minor dependency upgrades for npm audit fixes
- liquidjs upgrade from 1.25.0 to 1.27.0
- markdown-it upgrade from 14.1.1 to 14.2.0
Adds Node 26 to CI for v3 branch
Opt out of package manager cache for GitHub Actions CI release workflow (hardening security)

Milestone: https://github.com/11ty/eleventy/milestone/52?closed=1
Full Changelog: 11ty/buildawesome@v3.1.5...v3.1.6

iconify/icon-sets (@iconify/json)

stacksjs/clapp (@stacksjs/clapp)

`v0.2.10`

Compare Source

`v0.2.9`

Compare Source

`v0.2.8`

Compare Source

`v0.2.7`

Compare Source

`v0.2.6`

Compare Source

`v0.2.5`

Compare Source

`v0.2.4`

Compare Source

`v0.2.3`

Compare Source

stacksjs/ts-cloud (@stacksjs/ts-cloud)

`v0.5.17`

Compare Source

`v0.5.16`

Compare Source

`v0.5.15`

Compare Source

`v0.5.14`

Compare Source

`v0.5.13`

Compare Source

`v0.5.12`

Compare Source

`v0.5.11`

Compare Source

`v0.5.10`

Compare Source

`v0.5.9`

Compare Source

`v0.5.8`

Compare Source

`v0.5.7`

Compare Source

`v0.5.6`

Compare Source

`v0.5.5`

Compare Source

`v0.5.4`

Compare Source

`v0.5.3`

Compare Source

`v0.5.2`

Compare Source

`v0.5.1`

Compare Source

`v0.5.0`

Compare Source

`v0.4.2`

Compare Source

`v0.4.1`

Compare Source

`v0.4.0`

Compare Source

`v0.3.1`

Compare Source

`v0.3.0`

Compare Source

`v0.2.27`

Compare Source

`v0.2.26`

Compare Source

`v0.2.25`

Compare Source

`v0.2.24`

Compare Source

`v0.2.23`

Compare Source

`v0.2.22`

Compare Source

`v0.2.21`

Compare Source

`v0.2.20`

Compare Source

`v0.2.19`

Compare Source

`v0.2.18`

Compare Source

`v0.2.17`

Compare Source

`v0.2.16`

Compare Source

`v0.2.15`

Compare Source

`v0.2.14`

Compare Source

`v0.2.13`

Compare Source

`v0.2.12`

Compare Source

`v0.2.11`

Compare Source

`v0.2.10`

Compare Source

`v0.2.9`

Compare Source

`v0.2.8`

Compare Source

`v0.2.7`

Compare Source

`v0.2.6`

Compare Source

`v0.2.5`

Compare Source

Microsoft/vsce (@vscode/vsce)

`v3.9.2`

Compare Source

Changes:

#1283: fix: skip APIScan
#1282: chore: bump CI to Node 22 and fix build
#1279: Bump the uuid test fixture version to 100.0.0
#1278: Bump tmp from 0.2.4 to 0.2.6
#1277: Bump qs from 6.14.2 to 6.15.2
#1276: Bump uuid and @azure/msal-node
#1274: Run npm audit fix
#1272: Bump fast-uri from 3.0.6 to 3.1.2
#1267: Bump minimatch from 10.2.2 to 10.2.3
#1247: Update minimatch dependency to v10

This list of changes was auto generated.

`v3.9.1`

Compare Source

Changes:

#1266: fix: module type mismatch

This list of changes was auto generated.

`v3.9.0`

Compare Source

Changes:

#1263: fix: build regressions in 3.8.1
#1261: Add override for serialize-javascript

This list of changes was auto generated.

`v3.8.1`

Compare Source

Changes:

#1259: chore: update @azure/identity to 4.13.1 and modernize TypeScript/Node.js configuration

This list of changes was auto generated.

`v3.8.0`

Compare Source

Changes:

#1258: fix: run npm audit fix
#1255: Bump brace-expansion
#1253: Bump picomatch from 2.3.1 to 2.3.2
#1252: Bump yauzl from 2.10.0 to 3.2.1
#1250: Bump underscore from 1.13.1 to 1.13.8
#1249: Bump minimatch
#1243: Bump markdown-it from 14.1.0 to 14.1.1
#1244: Bump qs from 6.14.1 to 6.14.2
#1239: Bump @isaacs/brace-expansion from 5.0.0 to 5.0.1
#1238: Bump lodash from 4.17.21 to 4.17.23

See More

#1234: Bump qs from 6.11.0 to 6.14.1
#1233: Return non-zero exit code when signature verification fails
#1232: Audit npm package
#1228: Bump jws

This list of changes was auto generated.

`v3.7.2-13`

Compare Source

Changes:

#1258: fix: run npm audit fix

This list of changes was auto generated.

actions/cache (actions/cache)

`v5.0.5`

Compare Source

What's Changed

Update ts-http-runtime dependency by @yacaovsnc in #1747

Full Changelog: actions/cache@v5...v5.0.5

`v5.0.4`

Compare Source

What's Changed

Add release instructions and update maintainer docs by @Link- in #1696
Potential fix for code scanning alert no. 52: Workflow does not contain permissions by @Link- in #1697
Fix workflow permissions and cleanup workflow names / formatting by @Link- in #1699
docs: Update examples to use the latest version by @XZTDean in #1690
Fix proxy integration tests by @Link- in #1701
Fix cache key in examples.md for bun.lock by @RyPeck in #1722
Update dependencies & patch security vulnerabilities by @Link- in #1738

New Contributors

@XZTDean made their first contribution in #1690
@RyPeck made their first contribution in #1722

Full Changelog: actions/cache@v5...v5.0.4

actions/checkout (actions/checkout)

`v6.0.3`

Compare Source

Fix checkout init for SHA-256 repositories by @yaananth in #2439
fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in #2414

oven-sh/bun (bun)

`v1.3.14`: Bun v1.3.14

Compare Source

To install Bun v1.3.14

curl -fsSL https://bun.sh/install | bash

# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.sh/install.ps1|iex"

To upgrade to Bun v1.3.14:

bun upgrade

Read Bun v1.3.14's release notes on Bun's blog

Thanks to 11 contributors!

`v1.3.13`: Bun v1.3.13

Compare Source

To install Bun v1.3.13

curl -fsSL https://bun.sh/install | bash

# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.sh/install.ps1|iex"

To upgrade to Bun v1.3.13:

bun upgrade

Read Bun v1.3.13's release notes on Bun's blog

Thanks to 8 contributors!

`v1.3.12`: Bun v1.3.12

Compare Source

To install Bun v1.3.12

curl -fsSL https://bun.sh/install | bash

# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.sh/install.ps1|iex"

To upgrade to Bun v1.3.12:

bun upgrade

Read Bun v1.3.12's release notes on Bun's blog

Thanks to 8 contributors!

stacksjs/bunfig (bunfig)

`v0.15.14`

Compare Source

`v0.15.13`

Compare Source

`v0.15.12`

Compare Source

`v0.15.11`

Compare Source

`v0.15.10`

Compare Source

`v0.15.9`

Compare Source

`v0.15.8`

Compare Source

`v0.15.7`

Compare Source

cure53/DOMPurify (dompurify)

`v3.4.11`: DOMPurify 3.4.11

Compare Source

Fixed an issue with a leaky config for hooks via setConfig, thanks @trace37labs
Bumped vulnerable development dependencies to arrive at plain 0 with npm audit
Updated the osv-scanner suppression list as no vulnerable dependencies are left for now
Updated up the linting tool-chain and removed now-redundant lint directives
Updated the documentation is several spots, README, wiki, etc.
Bumped several dependencies where possible

`v3.4.10`: DOMPurify 3.4.10

Compare Source

Refactored codebase for clarity: extracted the public type declarations into types.ts
Decomposed the three largest sanitizer functions into focused helpers
Removed duplicated defaults and dead branches, consolidated SAFE_FOR_TEMPLATES scrubbing into single shared path
Improved per-node performance by hoisting the mXSS probe regexes and testing textContent before innerHTML
Added a deterministic micro-benchmark harness (npm run bench) with a --compare mode
Reduced CI cost by running the full three-engine browser suite once per PR
Refreshed the demos/ folder so every demo runs again, and added a SVG-via-<img> demo
Documented the bench and test:happydom scripts in the README
Completed the Attack Classes & Bypass History wiki page
Bumped several dependencies where possible

`v3.4.9`: DOMPurify 3.4.9

Compare Source

Further improved the handling of Trusted Types config options, thanks @offset
Further improved the handling of IN_PLACE sanitization, thanks @mozfreddyb
Added more test coverage for IN_PLACE and Trusted Types related usage
Bumped several dependencies where possible
Updated README and wiki with more accurate documentation & attack samples

`v3.4.8`: DOMPurify 3.4.8

Compare Source

Cleaned up the repository root, renamed some and removed unneeded files
Fixed an issue with handling of Trusted Types policies, thanks @fulstadev
Fixed the node iterator for better template scrubbing, thanks @IamLeandrooooo
Included formerly missing LICENSE-MPL in published npm package, thanks @asamuzaK
Bumped several dependencies where possible

`v3.4.7`: DOMPurify 3.4.7

Compare Source

Hardened the handling of Shadow Roots when using IN_PLACE, thanks @GameZoneHacker
Removed a problem leading to permanent hook pollution, thanks @offset
Refactored the test suite and expanded test coverage significantly

`v3.4.6`: DOMPurify 3.4.6

Compare Source

Fixed several issues with DOM Clobbering in IN_PLACE mode, thanks @offset & @Bankde
Hardened the checks for cross-realm IN_PLACE and Shadow DOM sanitization, thanks @offset & @Bankde
Added more test coverage for IN_PLACE and general DOM Clobbering attacks
Bumped several dependencies where possible

`v3.4.5`: DOMPurify 3.4.5

Compare Source

Fixed a bypass caused by the new HTML element selectedcontent added in 3.4.4, thanks @KabirAcharya

Note that this is a security release for an issue introduced in 3.4.4 and should be upgraded to immediately.

`v3.4.4`: DOMPurify 3.4.4

Compare Source

Added the selectedcontent element to default allow-list, thanks @lukewarlow
Added the command and commandfor attributes to default allowed-list, thanks @lukewarlow
Added better template scrubbing for IN_PLACE operations, thanks @DEMON1A
Added stronger checks for cross-realm windows, thanks @DEMON1A & @fg0x0
Updated demo website and made sure it uses the latest from main
Updated existing workflows, fuzzer, dependabot, etc., added more tests
Bumped several dependencies where possible

🚨 This release had been flagged as deprecated, please use DOMPurify 3.4.5 instead 🚨

`v3.4.3`: DOMPurify 3.4.3

Compare Source

Fixed an issue with handling of nested Shadow DOM trees, thanks @fishjojo1
Fixed the template regexes to be more robust against ReDoS attacks, thanks @aleung27
Updated the node iteration code to catch more Shadow DOM related issues
Updated Playwright and added Node 26 to test matrix
Updated existing workflows, fuzzer, release signing, etc., added more tests
Bumped several dependencies where possible

`v3.4.2`: DOMPurify 3.4.2

Compare Source

Fixed an issue with URI validation on attributes allowed via ADD_ATTR callback, thanks @nelstrom
Fixed an issue with source maps referring to non-existing files, thanks @cmdcolin
Updated existing workflows, fuzzer, release signing, etc., added more tests
Bumped several dependencies where possible

`v3.4.1`: DOMPurify 3.4.1

Compare Source

Fixed an issue with on-handler stripping for HTML-spec-reserved custom element names (font-face, color-profile, missing-glyph, font-face-src, font-face-uri, font-face-format, font-face-name) under permissive CUSTOM_ELEMENT_HANDLING
Fixed a case-sensitivity gap in the annotation-xml check that allowed mixed-case variants to bypass the basic-custom-element exclusion in XHTML mode
Fixed SANITIZE_NAMED_PROPS repeatedly prefixing already-prefixed id and name values on subsequent sanitization
Fixed the IN_PLACE root-node check to explicitly guard against non-string nodeName (DOM-clobbering robustness)
Removed a duplicate slot entry from the default HTML attribute allow-list
Strengthened the fast-check fuzz harness with explicit XSS invariants, an expanded seed-payload corpus, an additional idempotence property for SANITIZE_NAMED_PROPS, and a negative-control assertion ensuring the invariants actually fire
Added regression and pinning tests covering the above fixes and two accepted-behavior contracts (SAFE_FOR_TEMPLATES greedy scrub, hook-added attribute handling)
Extended CodeQL analysis to run on 3.x and 2.x maintenance branches

`v3.4.0`: DOMPurify 3.4.0

Compare Source

Most relevant changes:

Fixed a problem with FORBID_TAGS not winning over ADD_TAGS, thanks @kodareef5
Fixed several minor problems and typos regarding MathML attributes, thanks @DavidOliver
Fixed ADD_ATTR/ADD_TAGS function leaking into subsequent array-based calls, thanks @1Jesper1
Fixed a missing SAFE_FOR_TEMPLATES scrub in RETURN_DOM path, thanks @bencalif
Fixed a prototype pollution via CUSTOM_ELEMENT_HANDLING, thanks @trace37labs
Fixed an issue with ADD_TAGS function form bypassing FORBID_TAGS, thanks @eddieran
Fixed an issue with ADD_ATTR predicates skipping URI validation, thanks @christos-eth
Fixed an issue with USE_PROFILES prototype pollution, thanks @christos-eth
Fixed an issue leading to possible mXSS via Re-Contextualization, thanks @researchatfluidattacks and others
Fixed an issue with closing tags leading to possible mXSS, thanks @frevadiscor
Fixed a problem with the type dentition patcher after Node version bump
Fixed freezing BS runs by reducing the tested browsers array
Bumped several dependencies where possible
Added needed files for OpenSSF scorecard checks

Published Advisories are here:
https://github.com/cure53/DOMPurify/security/advisories?state=published

mde/ejs (ejs)

`v5.0.2`

Compare Source

Version 5.0.2

capricorn86/happy-dom (happy-dom)

`v20.10.6`

Compare Source

👷‍♂️ Patch fixes

Await NodeJS internal Re

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

netlify · 2026-06-03T11:55:36Z

❌ Deploy Preview for stacks-stx failed. Why did it fail? →

Name	Link
🔨 Latest commit	`53b88b5`
🔍 Latest deploy log	https://app.netlify.com/projects/stacks-stx/deploys/6a38f4c81dd2a900088d5e5a

renovate Bot added dependencies patch labels Jun 3, 2026

renovate Bot force-pushed the renovate/all-minor-patch branch 10 times, most recently from 7eb80d4 to 5f7ba13 Compare June 10, 2026 11:11

renovate Bot force-pushed the renovate/all-minor-patch branch 15 times, most recently from 590d7ae to faeb62c Compare June 17, 2026 12:01

renovate Bot force-pushed the renovate/all-minor-patch branch 11 times, most recently from 82e8bb3 to 1cd8556 Compare June 19, 2026 12:02

chore(deps): update all non-major dependencies

53b88b5

renovate Bot force-pushed the renovate/all-minor-patch branch from 1cd8556 to 53b88b5 Compare June 22, 2026 08:39

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): update all non-major dependencies#1750

chore(deps): update all non-major dependencies#1750
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

renovate Bot commented Jun 3, 2026 •

edited

Loading

Uh oh!

netlify Bot commented Jun 3, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Jun 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v3.1.6: Eleventy v3.1.6: Everybody wants to do Maintenance

Changes:

Changes:

Changes:

Changes:

Changes:

Changes:

What's Changed

What's Changed

New Contributors

v1.3.14: Bun v1.3.14

Thanks to 11 contributors!

v1.3.13: Bun v1.3.13

Thanks to 8 contributors!

v1.3.12: Bun v1.3.12

Thanks to 8 contributors!

v3.4.11: DOMPurify 3.4.11

v3.4.10: DOMPurify 3.4.10

v3.4.9: DOMPurify 3.4.9

v3.4.8: DOMPurify 3.4.8

v3.4.7: DOMPurify 3.4.7

v3.4.6: DOMPurify 3.4.6

v3.4.5: DOMPurify 3.4.5

v3.4.4: DOMPurify 3.4.4

v3.4.3: DOMPurify 3.4.3

v3.4.2: DOMPurify 3.4.2

v3.4.1: DOMPurify 3.4.1

v3.4.0: DOMPurify 3.4.0

👷‍♂️ Patch fixes

Configuration

Uh oh!

netlify Bot commented Jun 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ Deploy Preview for stacks-stx failed. Why did it fail? →

Uh oh!

Reviewers

renovate Bot commented Jun 3, 2026 •

edited

Loading

`v3.1.6`: Eleventy v3.1.6: Everybody wants to do Maintenance

`v1.3.14`: Bun v1.3.14

`v1.3.13`: Bun v1.3.13

`v1.3.12`: Bun v1.3.12

`v3.4.11`: DOMPurify 3.4.11

`v3.4.10`: DOMPurify 3.4.10

`v3.4.9`: DOMPurify 3.4.9

`v3.4.8`: DOMPurify 3.4.8

`v3.4.7`: DOMPurify 3.4.7

`v3.4.6`: DOMPurify 3.4.6

`v3.4.5`: DOMPurify 3.4.5

`v3.4.4`: DOMPurify 3.4.4

`v3.4.3`: DOMPurify 3.4.3

`v3.4.2`: DOMPurify 3.4.2

`v3.4.1`: DOMPurify 3.4.1

`v3.4.0`: DOMPurify 3.4.0

netlify Bot commented Jun 3, 2026 •

edited

Loading