chore(deps): update npm (runtime)

[renovate]

Note

Mend has cancelled the proposed renaming of the Renovate GitHub app being renamed to mend[bot].

This notice will be removed on 2025-10-07.

---

This PR contains the following updates:

Package	Change	Age	Confidence
@fontsource-variable/figtree (source)	5.2.9 -> 5.2.10
dompurify	3.2.6 -> 3.2.7
fast-equals	5.2.2 -> 5.3.2
hls.js	1.6.12 -> 1.6.13
swiper (source)	12.0.1 -> 12.0.2
vue (source)	3.5.21 -> 3.5.22

---

Release Notes

fontsource/font-files (@​fontsource-variable/figtree)

v5.2.10

Compare Source

cure53/DOMPurify (dompurify)

v3.2.7: DOMPurify 3.2.7

Compare Source

• Added new attributes and elements to default allow-list, thanks @​elrion018
• Added tagName parameter to custom element attributeNameCheck, thanks @​nelstrom
• Added better check for animated href attributes, thanks @​llamakko
• Updated and improved the bundled types, thanks @​ssi02014
• Updated several tests to better align with new browser encoding behaviors
• Improved the handling of potentially risky content inside CDATA elements, thanks @​securityMB & @​terjanq
• Improved the regular expression for raw-text elements to cover textareas, thanks @​securityMB & @​terjanq

planttheidea/fast-equals (fast-equals)

v5.3.2

Compare Source

• #​154 - Use include with "files" instead of exclude with .npmignore (Thanks @​43081j)
• #​155 - Upgrade build dependencies to resolve security vulnerabilities

v5.3.1

Compare Source

• #​153 - Avoid publishing .yarn folder

v5.3.0

Compare Source

• #​150 - Add support for unknownTagComparators in custom configuration (thanks to @​mrcljx for the idea)

video-dev/hls.js (hls.js)

v1.6.13

Compare Source

Summary

HLS.js v1.6.13 includes bug fixes and improvements over the last release.

The initPTS fix addresses an edge-case introduced in v1.6.6 with #​7311, where hls.js began using MSE timestampOffset in place or remapping media timestamps.

The content protection related fixes address issues resulting from an expectation for a KEYID attribute or a key ID value in the EXT-X-KEY tag or its URI.

Changes Since The Last Release

• Fix seeking back in live with timestamp wrapping (#​7537) @​robwalch
  • Fixes "fragParsingError" after seeking back in live - regression introduced in 1.6.6 with #​7311 (#​7536) @​bmarshall
• Use Widevine KEYID or parse PlayReady when level keys are present (#​7545)
  • Fixes FairPlay parsing error - regression introduced in 1.6.11 (#​7542) @​Jason239
• Get KEYID from init segment 'tenc' when not found elsewhere (#​7547)
  • Fixes Widevine key parsing error - regression introduced in 1.6.11 with #​7527 (#​7541) @​AfLosada

Demo Page

Get demo url from https://github.com/video-dev/hls.js/tree/deployments

API and Breaking Changes

If you are upgrading from version v0.14.17 or lower, see the MIGRATING guide for API changes between v0.14.x and v1.0.0.

Feedback

Please provide feedback via Issues in GitHub. For more details on how to contribute to HLS.js, see our CONTRIBUTING guide.

nolimits4web/Swiper (swiper)

v12.0.2

Compare Source

Features

• navigation: add styles for when buttons set before slider (4588c57), closes #​8085
• navigation: new addIcons parameter to add SVG icons to nav buttons (b955b0c), closes #​8088 #​8087

vuejs/core (vue)

v3.5.22

Compare Source

Bug Fixes

• compiler-core: identifiers in switch-case should not be inferred as references (#​13923) (5953c9f)
• compiler-dom: nodes with v-once shouldn't be stringified (#​13878) (95c1975)
• compiler-sfc: add support for @vue-ignore in runtime type resolution (#​13906) (ba7f7f9)
• compiler-sfc: enhance inferRuntimeType to support TSMappedType with indexed access (#​13848) (e388f1a), closes #​13847
• compiler-sfc: ensure css custom properties do not start with a digit (#​13870) (9c27951)
• compiler-sfc: ensure props bindings register before compiling template (#​13922) (abd5638), closes #​13920
• compiler-ssr: ensure v-show has a higher priority in SSR (#​12171) (836b829), closes #​12162
• custom-element: properly mount multiple Teleports in custom element component w/ shadowRoot false (#​13900) (5e1e791), closes #​13899
• custom-element: set prop runs pending mutations before disconnect (#​13897) (c4a88cd), closes #​13315
• custom-element: use PatchFlags.BAIL for slot when props are present (#​13907) (5358bca), closes #​13904
• reactivity: respect readonly during ref unwrapping (#​13905) (aba7fed), closes #​13903
• reactivity: update iterator to check for completion instead of value presence (#​13761) (2078f8b)
• runtime-core: simplify block-tracking disabling in h helper (#​13841) (75220c7)
• transition-group: run forceReflow on the correct document (fix #​13849) (#​13853) (1be5ddf)
• types: more precise types for Events and added missing definitions (#​9675) (8bb8fb2)
• types: set dom stub type to never instead of {} (#​13915) (8620a61), closes #​11564
• types: widen directive arg type from string to any (#​13758) (4b71706), closes #​13757

Features

• custom-element: allow specifying additional options for shadowRoot in custom elements (#​12965) (47e628d), closes #​12964

Reverts

• Revert "fix(hmr): prevent VUE_HMR_RUNTIME from being overwritten by vue runtime in 3rd-party libraries" (#​13925) (6b68f72), closes #​13925

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[jellyfin-bot]

Cloudflare Pages deployment

Latest commit	eeac1b3
Status	✅ Deployed!
Preview URL	https://a3069c73.jf-vue.pages.dev
Preview alias	https://renovate-npm--runtime.jf-vue.pages.dev
Type	🔀 Preview

View build logs

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud