Skip to content

chore(deps): bump the management-production group in /management with 12 updates - #28

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/management/management-production-0e203f2f3b
Closed

chore(deps): bump the management-production group in /management with 12 updates#28
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/management/management-production-0e203f2f3b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Apr 25, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the management-production group in /management with 12 updates:

Package From To
@dnd-kit/abstract 0.1.21 0.4.0
@internationalized/date 3.12.0 3.12.1
@tailwindcss/vite 4.2.2 4.2.4
@unovis/ts 1.6.4 1.6.5
@unovis/vue 1.6.4 1.6.5
axios 1.14.0 1.15.2
dompurify 3.3.3 3.4.1
reka-ui 2.9.5 2.9.6
tailwindcss 4.2.2 4.2.4
vue 3.5.32 3.5.33
vue-i18n 10.0.8 11.4.0
vue-router 5.0.4 5.0.6

Updates @dnd-kit/abstract from 0.1.21 to 0.4.0

Release notes

Sourced from @​dnd-kit/abstract's releases.

@​dnd-kit/abstract@​0.4.0

Minor Changes

  • #1923 cde61e4 Thanks @​clauderic! - Batch entity identity changes to prevent collision oscillation during virtualized sorting.

    When entities swap ids (e.g. as react-window recycles DOM nodes during a drag), multiple registry updates could fire in an interleaved order, causing the collision detector to momentarily see stale or duplicate entries and oscillate between targets.

    Entity id changes are now deferred to a microtask and flushed atomically in a single batch(), ensuring:

    • The collision notifier skips detection while id changes are pending
    • The registry cleans up ghost registrations (stale keys left behind after an id swap)

  • #1915 9b24dff Thanks @​clauderic! - Redesign event type system to follow the DOM EventMap pattern. Introduces DragDropEventMap for event object types and DragDropEventHandlers for event handler signatures, replacing the ambiguously named DragDropEvents. Event type aliases (CollisionEvent, DragStartEvent, etc.) now derive directly from DragDropEventMap rather than using Parameters<> extraction.

    Migration guide

    • DragDropEvents has been split into two types:
      • DragDropEventMap — maps event names to event object types (like WindowEventMap)
      • DragDropEventHandlers — maps event names to (event, manager) => void handler signatures
    • If you were importing DragDropEvents to type event objects, use DragDropEventMap instead: 
      // Before
type MyEvent = Parameters<DragDropEvents<D, P, M>['dragend']>[0];
// After
type MyEvent = DragDropEventMap<D, P, M>['dragend'];
    • If you were importing DragDropEvents to type event handlers, use DragDropEventHandlers instead: 
      // Before
const handler: DragDropEvents<D, P, M>['dragend'] = (event, manager) => {};
// After
const handler: DragDropEventHandlers<D, P, M>['dragend'] = (
  event,
  manager
) => {};
    • The DragDropEvents re-export from @dnd-kit/react and @dnd-kit/solid has been removed. Import DragDropEventMap or DragDropEventHandlers from @dnd-kit/abstract directly if needed.
    • Convenience aliases (CollisionEvent, DragStartEvent, DragEndEvent, etc.) are unchanged and continue to work as before.

  • #1938 e69387d Thanks @​clauderic! - Added per-entity plugin configuration and moved feedback from the Draggable entity to the Feedback plugin.

    Draggable entities now accept a plugins property for per-entity plugin configuration, using the existing Plugin.configure() pattern. Plugins can read per-entity options via source.pluginConfig(PluginClass).

    The feedback property ('default' | 'move' | 'clone' | 'none') has been moved from the Draggable entity to FeedbackOptions. Drop animation can also now be configured per-draggable.

    Plugins listed in an entity's plugins array are auto-registered on the manager if not already present. The Sortable class now uses this generic mechanism instead of its own custom registration logic.

    Migration guide

    The feedback property has been moved from the draggable/sortable hook input to per-entity Feedback plugin configuration.

... (truncated)

Commits
  • ebc564e Merge pull request #1907 from clauderic/changeset-release/main
  • 4f071cb Version Packages
  • 5e7735f Merge pull request #2001 from lixiaoyan/feat/feedback-callback
  • 412047b Merge pull request #2007 from clauderic/chore/upgrade-turborepo
  • cf33af0 chore: remove turborepo agent skill from repo
  • 7a02b46 chore: upgrade turborepo from 2.5.2 to 2.9.0
  • fab49db Merge pull request #2006 from clauderic/claude/docs-mobile-fixes
  • 2d2bb7a Add GitHub icon to mobile header
  • 671a95a Pure CSS CodeGroup tabs — zero JavaScript for tab switching
  • f1423c0 Fix CodeGroup: SSR-only Shiki with DOM-based tab switching
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​dnd-kit/abstract since your current version.


Updates @internationalized/date from 3.12.0 to 3.12.1

Release notes

Sourced from @​internationalized/date's releases.

React Spectrum S2 v1.3.0

In this release we are excited to announce support for expandable rows in TableView, highlight selection in TreeView, and window scrolling in collection components! Window scrolling enables virtualized collections to automatically scroll with the rest of the page – no height needed. In addition, we've updated the set of available workflow icons, and reduced the number of dependencies installed when using S2 by over 90% – see the full release notes for details.

To help assist with migrations from S1 to S2, we've added a new end to end migration Agent skill that you can use with your agent of choice. Our existing S2 Agent skill has also been updated to greatly improve its ability to select the proper S2 component to use from context, so be sure to update.

Full release notes

React Spectrum S2 v1.2.0

In this release, we are excited to announce that ListView and unavailable menu items are now available! In addition, we have added ActionBar support for TreeView and custom renderer support for the Picker's display value. We also shipped multiple TableView fixes and a set of documentation improvements including a Typography search view now available in the main search menu.

Thanks to all of our contributors for the updates in this release.

Full release notes

React Spectrum S2 v1.1.0

It’s our first release of the new year and we’ve got plenty of exciting treats we’re bringing to the table. We’ve added a variety of new features to our documentation site including a new dark/light mode switch in the site header. Our search menu also now features a Colors section where you can browse the Spectrum-defined colors and search by name or hex value to find close or exact matches. We also now offer our docs in the form of Agent Skills that can be installed locally and used by your favorite AI coding tools.

This release also includes several bugs fixes, such as properly rendering menus when rendered from within a popover and updates to TreeView disabledBehavior styling to match the latest designs.

Full Release Notes

Commits
  • ca74817 Publish
  • 2d2cc15 fix: prevent items from getting continually loaded in S2 TreeView (#9921)
  • beda778 fix: broken compound selector exposed by browserslist bump (Table virtualizer...
  • c7c4c67 fix: v3 docs build (#9919)
  • efc581c fix: nightly packing too many files (#9917)
  • 5c5bda5 docs: improve S2 agent skill (#9908)
  • 988c120 docs: Update RangeCalendar for api consitency, add docs for nonce, and TagGro...
  • 21c4dfb chore: Revert 9875 and move disabledBehavior example in TableView docs (#9914)
  • 9e18b4a chore: fix S2 datepicker errorMessage type (#9909)
  • b65a4aa Revert "fix: make aria test utils helpers work with vitest-browser-react (#97...
  • Additional commits viewable in compare view

Updates @tailwindcss/vite from 4.2.2 to 4.2.4

Release notes

Sourced from @​tailwindcss/vite's releases.

v4.2.4

Fixed

  • Ensure imports in @import and @plugin still resolve correctly when using Vite aliases in @tailwindcss/vite (#19947)

v4.2.3

Fixed

  • Canonicalization: improve canonicalizations for tracking-* utilities by preferring non-negative utilities (e.g. -tracking-tighter → tracking-wider) (#19827)
  • Fix crash due to invalid characters in candidate (exceeding valid unicode code point range) (#19829)
  • Ensure query params in imports are considered unique resources when using @tailwindcss/webpack (#19723)
  • Canonicalization: collapse arbitrary values into shorthand utilities (e.g. px-[1.2rem] py-[1.2rem] → p-[1.2rem]) (#19837)
  • Canonicalization: collapse border-{t,b}-* into border-y-*, border-{l,r}-* into border-x-*, and border-{t,r,b,l}-* into border-* (#19842)
  • Canonicalization: collapse scroll-m{t,b}-* into scroll-my-*, scroll-m{l,r}-* into scroll-mx-*, and scroll-m{t,r,b,l}-* into scroll-m-* (#19842)
  • Canonicalization: collapse scroll-p{t,b}-* into scroll-py-*, scroll-p{l,r}-* into scroll-px-*, and scroll-p{t,r,b,l}-* into scroll-p-* (#19842)
  • Canonicalization: collapse overflow-{x,y}-* into overflow-* (#19842)
  • Canonicalization: collapse overscroll-{x,y}-* into overscroll-* (#19842)
  • Read from --placeholder-color instead of --background-color for placeholder-* utilities (#19843)
  • Upgrade: ensure files are not emptied out when killing the upgrade process while it's running (#19846)
  • Upgrade: use config.content when migrating from Tailwind CSS v3 to Tailwind CSS v4 (#19846)
  • Upgrade: never migrate files that are ignored by git (#19846)
  • Add .env and .env.* to default ignored content files (#19846)
  • Canonicalization: migrate overflow-ellipsis into text-ellipsis (#19849)
  • Canonicalization: migrate start-full → inset-s-full, start-auto → inset-s-auto, start-px → inset-s-px, and start-<number> → inset-s-<number> as well as negative versions (#19849)
  • Canonicalization: migrate end-full → inset-e-full, end-auto → inset-e-auto, end-px → inset-e-px, and end-<number> → inset-e-<number> as well as negative versions (#19849)
  • Canonicalization: move the - sign inside the arbitrary value -left-[9rem] → left-[-9rem] (#19858)
  • Canonicalization: move the - sign outside the arbitrary value ml-[calc(-1*var(--width))] → -ml-(--width) (#19858)
  • Improve performance when scanning JSONL / NDJSON files (#19862)
  • Support NODE_PATH environment variable in standalone CLI (#19617)
Changelog

Sourced from @​tailwindcss/vite's changelog.

[4.2.4] - 2026-04-21

Fixed

  • Ensure imports in @import and @plugin still resolve correctly when using Vite aliases in @tailwindcss/vite (#19947)

[4.2.3] - 2026-04-20

Fixed

  • Canonicalization: improve canonicalizations for tracking-* utilities by preferring non-negative utilities (e.g. -tracking-tighter → tracking-wider) (#19827)
  • Fix crash due to invalid characters in candidate (exceeding valid unicode code point range) (#19829)
  • Ensure query params in imports are considered unique resources when using @tailwindcss/webpack (#19723)
  • Canonicalization: collapse arbitrary values into shorthand utilities (e.g. px-[1.2rem] py-[1.2rem] → p-[1.2rem]) (#19837)
  • Canonicalization: collapse border-{t,b}-* into border-y-*, border-{l,r}-* into border-x-*, and border-{t,r,b,l}-* into border-* (#19842)
  • Canonicalization: collapse scroll-m{t,b}-* into scroll-my-*, scroll-m{l,r}-* into scroll-mx-*, and scroll-m{t,r,b,l}-* into scroll-m-* (#19842)
  • Canonicalization: collapse scroll-p{t,b}-* into scroll-py-*, scroll-p{l,r}-* into scroll-px-*, and scroll-p{t,r,b,l}-* into scroll-p-* (#19842)
  • Canonicalization: collapse overflow-{x,y}-* into overflow-* (#19842)
  • Canonicalization: collapse overscroll-{x,y}-* into overscroll-* (#19842)
  • Read from --placeholder-color instead of --background-color for placeholder-* utilities (#19843)
  • Upgrade: ensure files are not emptied out when killing the upgrade process while it's running (#19846)
  • Upgrade: use config.content when migrating from Tailwind CSS v3 to Tailwind CSS v4 (#19846)
  • Upgrade: never migrate files that are ignored by git (#19846)
  • Add .env and .env.* to default ignored content files (#19846)
  • Canonicalization: migrate overflow-ellipsis into text-ellipsis (#19849)
  • Canonicalization: migrate start-full → inset-s-full, start-auto → inset-s-auto, start-px → inset-s-px, and start-<number> → inset-s-<number> as well as negative versions (#19849)
  • Canonicalization: migrate end-full → inset-e-full, end-auto → inset-e-auto, end-px → inset-e-px, and end-<number> → inset-e-<number> as well as negative versions (#19849)
  • Canonicalization: move the - sign inside the arbitrary value -left-[9rem] → left-[-9rem] (#19858)
  • Canonicalization: move the - sign outside the arbitrary value ml-[calc(-1*var(--width))] → -ml-(--width) (#19858)
  • Improve performance when scanning JSONL / NDJSON files (#19862)
  • Support NODE_PATH environment variable in standalone CLI (#19617)
Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​tailwindcss/vite since your current version.


Updates @unovis/ts from 1.6.4 to 1.6.5

Release notes

Sourced from @​unovis/ts's releases.

1.6.5

What's Changed

Full Changelog: f5/unovis@1.6.4...1.6.5

Commits
  • 14e5609 Release: 1.6.5
  • 14a326f Misc: Update all dependency licenses
  • 7e65aa5 Component | Topojson: Fix pan and zoom then click node to resize position bug
  • 19b685c Component | TopoJSONMap: Resize enhancements
  • dac178e React: Fix build issue
  • 80b50a2 Component | TopoJSON: Make sure attirbutes get applied on point updates
  • 11b8965 Component | TopoJSON: Add smartTransition to area label
  • e543481 Component | TopoJSON: Remove type any
  • 083744b Component | TopoJSON: Move certain functions to modules
  • f975954 Component | TopoJSON: Update style.ts to the new css variabel definitations
  • Additional commits viewable in compare view

Updates @unovis/vue from 1.6.4 to 1.6.5

Release notes

Sourced from @​unovis/vue's releases.

1.6.5

What's Changed

Full Changelog: f5/unovis@1.6.4...1.6.5

Commits
  • 14e5609 Release: 1.6.5
  • 14a326f Misc: Update all dependency licenses
  • d4a22d2 Misc | Vue: Fix autogen script and build issue
  • 45e9014 Component | TopoJSON: Remove PointDatum GenericDataRecord type
  • 44c3b83 Misc | Release: Fix update version script
  • See full diff in compare view

Updates axios from 1.14.0 to 1.15.2

Release notes

Sourced from axios's releases.

v1.15.2

This release delivers prototype-pollution hardening for the Node HTTP adapter, adds an opt-in allowedSocketPaths allowlist to mitigate SSRF via Unix domain sockets, fixes a keep-alive socket memory leak, and ships supply-chain hardening across CI and security docs.

🔒 Security Fixes

  • Prototype Pollution Hardening (HTTP Adapter): Hardened the Node HTTP adapter and resolveConfig/mergeConfig/validator paths to read only own properties and use null-prototype config objects, preventing polluted auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser from influencing requests. (#10779)
  • SSRF via socketPath: Rejects non-string socketPath values and adds an opt-in allowedSocketPaths config option to restrict permitted Unix domain socket paths, returning AxiosError ERR_BAD_OPTION_VALUE on mismatch. (#10777)
  • Supply-chain Hardening: Added .npmrc with ignore-scripts=true, lockfile lint CI, non-blocking reproducible build diff, scoped CODEOWNERS, expanded SECURITY.md/THREATMODEL.md with provenance verification (npm audit signatures), 60-day resolution policy, and maintainer incident-response runbook. (#10776)

🚀 New Features

  • allowedSocketPaths Config Option: New request config option (and TypeScript types) to allowlist Unix domain socket paths used by the Node http adapter; backwards compatible when unset. (#10777)

🐛 Bug Fixes

  • Keep-alive Socket Memory Leak: Installs a single per-socket error listener tracking the active request via kAxiosSocketListener/kAxiosCurrentReq, eliminating per-request listener accumulation, MaxListenersExceededWarning, and linear heap growth under concurrent or long-running keep-alive workloads (fixes #10780). (#10788)

🔧 Maintenance & Chores

  • Changelog: Updated CHANGELOG.md with v1.15.1 release notes. (#10781)

Full Changelog

v1.15.1

This release ships a coordinated set of security hardening fixes across headers, body/redirect limits, multipart handling, and XSRF/prototype-pollution vectors, alongside a broad sweep of bug fixes, test migrations, and threat-model documentation updates.

🔒 Security Fixes

  • Header Injection Hardening: Tightened validation and sanitisation across request header construction to close the header-injection attack surface. (#10749)
  • CRLF Stripping in Multipart Headers: Correctly strips CR/LF from multipart header values to prevent injection via field names and filenames. (#10758)
  • Prototype Pollution / Auth Bypass: Replaced unsafe in checks with hasOwnProperty to prevent authentication bypass via prototype pollution on config objects, with additional regression tests. (#10761, #10760)
  • withXSRFToken Truthy Bypass: Short-circuits on any truthy non-boolean value, so an ambiguous config no longer silently leaks the XSRF token cross-origin. (#10762)
  • maxBodyLength With Zero Redirects: Enforces maxBodyLength even when maxRedirects is set to 0, closing a bypass path for oversized request bodies. (#10753)
  • Streamed Response maxContentLength Bypass: Applies maxContentLength to streamed responses that previously bypassed the cap. (#10754)
  • Follow-up CVE Completion: Completes an earlier incomplete CVE fix to fully close the regression window. (#10755)

🚀 New Features

  • AI-Based Docs Translations: Initial scaffold for AI-assisted translations of the documentation site. (#10705)
  • Location Request Header Type: Adds Location to CommonRequestHeadersList for accurate typing of redirect-aware requests. (#7528)

🐛 Bug Fixes

  • FormData Handling: Removes Content-Type when no boundary is present on FormData fetch requests, supports multi-select fields, cancels request.body instead of the source stream on fetch abort, and fixes a recursion bug in form-data serialisation. (#7314, #10676, #10702, #10726)
  • HTTP Adapter: Handles socket-only request errors without leaking keep-alive listeners. (#10576)
  • Progress Events: Clamps loaded to total for computable upload/download progress events. (#7458)
  • Types: Aligns runWhen type with the runtime behaviour in InterceptorManager and makes response header keys case-insensitive. (#7529, #10677)
  • buildFullPath: Uses strict equality in the base/relative URL check. (#7252)
  • AxiosURLSearchParams Regex: Improves the regex used for param serialisation to avoid edge-case mismatches. (#10736)
  • Resilient Value Parsing: Parses out header/config values instead of throwing on malformed input. (#10687)

... (truncated)

Changelog

Sourced from axios's changelog.

v1.15.2 - April 21, 2026

This release delivers prototype-pollution hardening for the Node HTTP adapter, adds an opt-in allowedSocketPaths allowlist to mitigate SSRF via Unix domain sockets, fixes a keep-alive socket memory leak, and ships supply-chain hardening across CI and security docs.

🔒 Security Fixes

  • Prototype Pollution Hardening (HTTP Adapter): Hardened the Node HTTP adapter and resolveConfig/mergeConfig/validator paths to read only own properties and use null-prototype config objects, preventing polluted auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser from influencing requests. (#10779)
  • SSRF via socketPath: Rejects non-string socketPath values and adds an opt-in allowedSocketPaths config option to restrict permitted Unix domain socket paths, returning AxiosError ERR_BAD_OPTION_VALUE on mismatch. (#10777)
  • Supply-chain Hardening: Added .npmrc with ignore-scripts=true, lockfile lint CI, non-blocking reproducible build diff, scoped CODEOWNERS, expanded SECURITY.md/THREATMODEL.md with provenance verification (npm audit signatures), 60-day resolution policy, and maintainer incident-response runbook. (#10776)

🚀 New Features

  • allowedSocketPaths Config Option: New request config option (and TypeScript types) to allowlist Unix domain socket paths used by the Node http adapter; backwards compatible when unset. (#10777)

🐛 Bug Fixes

  • Keep-alive Socket Memory Leak: Installs a single per-socket error listener tracking the active request via kAxiosSocketListener/kAxiosCurrentReq, eliminating per-request listener accumulation, MaxListenersExceededWarning, and linear heap growth under concurrent or long-running keep-alive workloads (fixes #10780). (#10788)

🔧 Maintenance & Chores

  • Changelog: Updated CHANGELOG.md with v1.15.1 release notes. (#10781)

Full Changelog

v1.15.1 - April 19, 2026

This release ships a coordinated set of security hardening fixes across headers, body/redirect limits, multipart handling, and XSRF/prototype-pollution vectors, alongside a broad sweep of bug fixes, test migrations, and threat-model documentation updates.

🔒 Security Fixes

  • Header Injection Hardening: Tightened validation and sanitisation across request header construction to close the header-injection attack surface. (#10749)

  • CRLF Stripping in Multipart Headers: Correctly strips CR/LF from multipart header values to prevent injection via field names and filenames. (#10758)

  • Prototype Pollution / Auth Bypass: Replaced unsafe in checks with hasOwnProperty to prevent authentication bypass via prototype pollution on config objects, with additional regression tests. (#10761, #10760)

  • withXSRFToken Truthy Bypass: Short-circuits on any truthy non-boolean value, so an ambiguous config no longer silently leaks the XSRF token cross-origin. (#10762)

  • maxBodyLength With Zero Redirects: Enforces maxBodyLength even when maxRedirects is set to 0, closing a bypass path for oversized request bodies. (#10753)

  • Streamed Response maxContentLength Bypass: Applies maxContentLength to streamed responses that previously bypassed the cap. (#10754)

  • Follow-up CVE Completion: Completes an earlier incomplete CVE fix to fully close the regression window. (#10755)

🚀 New Features

  • AI-Based Docs Translations: Initial scaffold for AI-assisted translations of the documentation site. (#10705)

... (truncated)

Commits

Updates dompurify from 3.3.3 to 3.4.1

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.1

  • Fixed an issue with on-handler stripping for HTML-spec-reserved custom element names (font-face, color-profile, missing-glyph, font-face-src, font-face-uri, font-face-format, font-face-name) under permissive CUSTOM_ELEMENT_HANDLING
  • Fixed a case-sensitivity gap in the annotation-xml check that allowed mixed-case variants to bypass the basic-custom-element exclusion in XHTML mode
  • Fixed SANITIZE_NAMED_PROPS repeatedly prefixing already-prefixed id and name values on subsequent sanitization
  • Fixed the IN_PLACE root-node check to explicitly guard against non-string nodeName (DOM-clobbering robustness)
  • Removed a duplicate slot entry from the default HTML attribute allow-list
  • Strengthened the fast-check fuzz harness with explicit XSS invariants, an expanded seed-payload corpus, an additional idempotence property for SANITIZE_NAMED_PROPS, and a negative-control assertion ensuring the invariants actually fire
  • Added regression and pinning tests covering the above fixes and two accepted-behavior contracts (SAFE_FOR_TEMPLATES greedy scrub, hook-added attribute handling)
  • Extended CodeQL analysis to run on 3.x and 2.x maintenance branches

DOMPurify 3.4.0

Most relevant changes:

  • Fixed a problem with FORBID_TAGS not winning over ADD_TAGS, thanks @​kodareef5
  • Fixed several minor problems and typos regarding MathML attributes, thanks @​DavidOliver
  • Fixed ADD_ATTR/ADD_TAGS function leaking into subsequent array-based calls, thanks @​1Jesper1
  • Fixed a missing SAFE_FOR_TEMPLATES scrub in RETURN_DOM path, thanks @​bencalif
  • Fixed a prototype pollution via CUSTOM_ELEMENT_HANDLING, thanks @​trace37labs
  • Fixed an issue with ADD_TAGS function form bypassing FORBID_TAGS, thanks @​eddieran
  • Fixed an issue with ADD_ATTR predicates skipping URI validation, thanks @​christos-eth
  • Fixed an issue with USE_PROFILES prototype pollution, thanks @​christos-eth
  • Fixed an issue leading to possible mXSS via Re-Contextualization, thanks @​researchatfluidattacks and others
  • Fixed an issue with closing tags leading to possible mXSS, thanks @​frevadiscor
  • Fixed a problem with the type dentition patcher after Node version bump
  • Fixed freezing BS runs by reducing the tested browsers array
  • Bumped several dependencies where possible
  • Added needed files for OpenSSF scorecard checks

Published Advisories are here: https://github.com/cure53/DOMPurify/security/advisories?state=published

Commits
  • 5b0cdbb chore: merge main into 3.x for 3.4.1 release (#1301)
  • 09f5911 test: added three more browsers to test setup (OSX, mobile)
  • 5b16e0b Getting 3.x branch ready for 3.4.0 release (#1250)
  • See full diff in compare view
Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates reka-ui from 2.9.5 to 2.9.6

Release notes

Sourced from reka-ui's releases.

v2.9.6

   🐞 Bug Fixes

    View changes on GitHub
Commits
  • e5667c2 chore: release v2.9.6
  • 836f2e9 fix(MonthPicker, YearPicker): preserve day/month when selecting (#2594)
  • 1d77296 fix(TimeField): change focus after pressing 0 more than once on hour segment ...
  • fbd9f04 chore(deps): update dependency vite to ^8.0.8 (#2592)
  • 70e7286 fix: export missing TimeRange type (#2590)
  • 68a490b Revert "chore(deps): bump vite from 5.4.21 to 8.0.5 (#2584)"
  • See full diff in compare view

Updates tailwindcss from 4.2.2 to 4.2.4

Release notes

Sourced from tailwindcss's releases.

v4.2.4

Fixed

  • Ensure imports in @import and @plugin still resolve correctly when using Vite aliases in @tailwindcss/vite (#19947)

v4.2.3

Fixed

  • Canonicalization: improve canonicalizations for tracking-* utilities by preferring non-negative utilities (e.g. -tracking-tighter → tracking-wider) (#19827)
  • Fix crash due to invalid characters in candidate (exceeding valid unicode code point range) (#19829)
  • Ensure query params in imports are considered unique resources when using @tailwindcss/webpack (#19723)
  • Canonicalization: collapse arbitrary values into shorthand utilities (e.g. px-[1.2rem] py-[1.2rem] → p-[1.2rem]) (#19837)
  • Canonicalization: collapse border-{t,b}-* into border-y-*, border-{l,r}-* into border-x-*, and border-{t,r,b,l}-* into border-* (#19842)
  • Canonicalization: collapse scroll-m{t,b}-* into scroll-my-*, scroll-m{l,r}-* into scroll-mx-*, and scroll-m{t,r,b,l}-* into scroll-m-* (#19842)
  • Canonicalization: collapse scroll-p{t,b}-* into scroll-py-*, scroll-p{l,r}-* into scroll-px-*, and scroll-p{t,r,b,l}-* into scroll-p-* (#19842)
  • Canonicalization: collapse overflow-{x,y}-* into overflow-* (#19842)
  • Canonicalization: collapse overscroll-{x,y}-* into overscroll-* (#19842)
  • Read from --placeholder-color instead of --background-color for placeholder-* utilities (#19843)
  • Upgrade: ensure files are not emptied out when killing the upgrade process while it's running (#19846)
  • Upgrade: use config.content when migrating from Tailwind CSS v3 to Tailwind CSS v4 (#19846)
  • Upgrade: never migrate files that are ignored by git (#19846)
  • Add .env and .env.* to default ignored content files (#19846)
  • Canonicalization: migrate overflow-ellipsis into text-ellip...

    Description has been truncated

@dependabot
chore(deps): bump the management-production group
f2fa705 
Bumps the management-production group in /management with 12 updates:

| Package | From | To |
| --- | --- | --- |
| [@dnd-kit/abstract](https://github.com/clauderic/dnd-kit) | `0.1.21` | `0.4.0` |
| [@internationalized/date](https://github.com/adobe/react-spectrum) | `3.12.0` | `3.12.1` |
| [@tailwindcss/vite](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-vite) | `4.2.2` | `4.2.4` |
| [@unovis/ts](https://github.com/f5/unovis/tree/HEAD/packages/ts) | `1.6.4` | `1.6.5` |
| [@unovis/vue](https://github.com/f5/unovis/tree/HEAD/packages/vue) | `1.6.4` | `1.6.5` |
| [axios](https://github.com/axios/axios) | `1.14.0` | `1.15.2` |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.3.3` | `3.4.1` |
| [reka-ui](https://github.com/unovue/reka-ui) | `2.9.5` | `2.9.6` |
| [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `4.2.2` | `4.2.4` |
| [vue](https://github.com/vuejs/core) | `3.5.32` | `3.5.33` |
| [vue-i18n](https://github.com/intlify/vue-i18n/tree/HEAD/packages/vue-i18n) | `10.0.8` | `11.4.0` |
| [vue-router](https://github.com/vuejs/router) | `5.0.4` | `5.0.6` |


Updates `@dnd-kit/abstract` from 0.1.21 to 0.4.0
- [Release notes](https://github.com/clauderic/dnd-kit/releases)
- [Commits](https://github.com/clauderic/dnd-kit/compare/@dnd-kit/abstract@0.1.21...@dnd-kit/abstract@0.4.0)

Updates `@internationalized/date` from 3.12.0 to 3.12.1
- [Release notes](https://github.com/adobe/react-spectrum/releases)
- [Commits](https://github.com/adobe/react-spectrum/compare/@internationalized/date@3.12.0...@internationalized/date@3.12.1)

Updates `@tailwindcss/vite` from 4.2.2 to 4.2.4
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.2.4/packages/@tailwindcss-vite)

Updates `@unovis/ts` from 1.6.4 to 1.6.5
- [Release notes](https://github.com/f5/unovis/releases)
- [Commits](https://github.com/f5/unovis/commits/1.6.5/packages/ts)

Updates `@unovis/vue` from 1.6.4 to 1.6.5
- [Release notes](https://github.com/f5/unovis/releases)
- [Commits](https://github.com/f5/unovis/commits/1.6.5/packages/vue)

Updates `axios` from 1.14.0 to 1.15.2
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.14.0...v1.15.2)

Updates `dompurify` from 3.3.3 to 3.4.1
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.3.3...3.4.1)

Updates `reka-ui` from 2.9.5 to 2.9.6
- [Release notes](https://github.com/unovue/reka-ui/releases)
- [Commits](unovue/reka-ui@v2.9.5...v2.9.6)

Updates `tailwindcss` from 4.2.2 to 4.2.4
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.2.4/packages/tailwindcss)

Updates `vue` from 3.5.32 to 3.5.33
- [Release notes](https://github.com/vuejs/core/releases)
- [Changelog](https://github.com/vuejs/core/blob/main/CHANGELOG.md)
- [Commits](vuejs/core@v3.5.32...v3.5.33)

Updates `vue-i18n` from 10.0.8 to 11.4.0
- [Release notes](https://github.com/intlify/vue-i18n/releases)
- [Changelog](https://github.com/intlify/vue-i18n/blob/master/CHANGELOG.md)
- [Commits](https://github.com/intlify/vue-i18n/commits/v11.4.0/packages/vue-i18n)

Updates `vue-router` from 5.0.4 to 5.0.6
- [Release notes](https://github.com/vuejs/router/releases)
- [Commits](vuejs/router@v5.0.4...v5.0.6)

---
updated-dependencies:
- dependency-name: "@dnd-kit/abstract"
  dependency-version: 0.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: management-production
- dependency-name: "@internationalized/date"
  dependency-version: 3.12.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: management-production
- dependency-name: "@tailwindcss/vite"
  dependency-version: 4.2.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: management-production
- dependency-name: "@unovis/ts"
  dependency-version: 1.6.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: management-production
- dependency-name: "@unovis/vue"
  dependency-version: 1.6.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: management-production
- dependency-name: axios
  dependency-version: 1.15.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: management-production
- dependency-name: dompurify
  dependency-version: 3.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: management-production
- dependency-name: reka-ui
  dependency-version: 2.9.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: management-production
- dependency-name: tailwindcss
  dependency-version: 4.2.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: management-production
- dependency-name: vue
  dependency-version: 3.5.33
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: management-production
- dependency-name: vue-i18n
  dependency-version: 11.4.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: management-production
- dependency-name: vue-router
  dependency-version: 5.0.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: management-production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Apr 25, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot @github

dependabot Bot commented on behalf of github May 2, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this May 2, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/management/management-production-0e203f2f3b branch May 2, 2026 08:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants