Skip to content

chore(deps): bump the npm group across 1 directory with 15 updates - #3634

Open
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/glances/outputs/static/npm-119f35bb9a
Open

chore(deps): bump the npm group across 1 directory with 15 updates#3634
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/glances/outputs/static/npm-119f35bb9a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm group with 14 updates in the /glances/outputs/static directory:

Package From To
sanitize-html 2.17.5 2.17.6
vue 3.5.38 3.5.40
eslint 10.5.0 10.8.0
eslint-plugin-vue 10.9.2 10.10.0
globals 17.6.0 17.8.0
html-webpack-plugin 5.6.7 5.6.8
less 4.6.4 4.8.1
less-loader 12.3.3 13.0.0
sass 1.101.0 1.102.0
sass-loader 16.0.8 17.0.0
typescript-eslint 8.61.0 8.65.0
webpack 5.107.2 5.109.2
webpack-cli 7.2.1 7.2.2
webpack-dev-server 5.2.6 6.0.0

Updates sanitize-html from 2.17.5 to 2.17.6

Changelog

Sourced from sanitize-html's changelog.

2.17.6 (2026-07-10)

Fixes

  • Allow transformTags to emit text when textFilter is set, even if the tag is initially empty. This is consistent with the documentation. Thanks to spokodev for the fix.

Security

  • Fixed an XSS/allowlist bypass in which the contents of a raw-text element (textarea or xmp) nested inside an svg or math root were re-emitted without HTML-escaping. sanitize-html treated that content as inert raw text because htmlparser2 10.x classified raw-text elements by tag name and ignored the namespace, but a real HTML5 parser treats textarea/xmp as ordinary foreign elements inside SVG/MathML and re-parses their contents as live markup. As a result, markup and event-handler attributes that the allowlist never permitted (for example <svg><textarea><img src=x onerror=alert(1)>) could survive sanitization and execute in the browser. This is now fixed on two fronts: htmlparser2 was upgraded to 12.x, which is namespace-aware and parses textarea/xmp inside SVG/MathML as ordinary elements, so their non-allowlisted children (such as the injected img) are dropped by the allowlist instead of being preserved as raw text; and any raw-text content sanitize-html still emits for these tags (at HTML integration points such as foreignObject/mtext, or outside foreign content) is always HTML-escaped. The default configuration is not affected; the precondition is an allowedTags that includes svg or math together with textarea or xmp. Thanks to khoadb175 for responsibly disclosing the vulnerability.
  • Fixed a mutation-XSS / allowedTags bypass affecting configurations that allow the textarea or xmp raw-text tags. htmlparser2 10.x did not recognize an end tag with a trailing solidus (e.g. </textarea/>) as closing the element, so it kept the following markup as raw text, but a spec-compliant browser treats </textarea/> as a valid close and parses that markup as a live element. Because raw-text content was re-emitted without escaping, a payload such as <textarea></textarea/><img src=x onerror=...> could smuggle non-allowlisted, executable markup through the sanitizer. The default configuration was not affected. This is now defended at two layers: htmlparser2 was upgraded to 12.x, whose tokenizer closes these end tags correctly, and the raw text sanitize-html emits for these tags is always escaped so no < can reopen a tag when the output is re-parsed (textarea, an RCDATA element whose entities htmlparser2 decodes, is escaped like normal text, while xmp, a raw-text element, has only its angle brackets escaped to avoid double-encoding already-encoded entities). Because htmlparser2 is ESM-only from version 11 onward, sanitize-html now requires Node.js >=22.12.0 (the first 22.x release in which require() of an ES module is available unflagged). Thanks to bibu123456 for reporting the vulnerability and Kayiz-PT for coordinating the disclosure (GHSA-jxwj-j7wr-gfrw).
Commits

Updates vue from 3.5.38 to 3.5.40

Release notes

Sourced from vue's releases.

v3.5.40

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.39

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

Changelog

Sourced from vue's changelog.

3.5.40 (2026-07-16)

Bug Fixes

3.5.39 (2026-06-25)

Bug Fixes

Commits

Updates @vue/compiler-sfc from 3.5.38 to 3.5.40

Release notes

Sourced from @​vue/compiler-sfc's releases.

v3.5.40

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.39

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

Changelog

Sourced from @​vue/compiler-sfc's changelog.

3.5.40 (2026-07-16)

Bug Fixes

3.5.39 (2026-06-25)

Bug Fixes

Commits

Updates eslint from 10.5.0 to 10.8.0

Release notes

Sourced from eslint's releases.

v10.8.0

Features

  • 2fee9bb feat: export ConfigObject from eslint/config (#21082) (sethamus)

Bug Fixes

  • 6b8d2f7 fix: escape reserved characters in rule id in html formatter (#21129) (Francesco Trotta)
  • 9091071 fix: prevent no-unreachable-loop crash when all loop types are ignored (#21116) (Pixel)
  • e23fafe fix: prefer-object-spread add semicolon when adding parenthesis (#21081) (synthex-byte)
  • 20b5ad0 fix: quadratic-time regex in prefer-template (#21096) (Milos Djermanovic)
  • 8b6f6c0 fix: apply ignore configs to computed methods in class-methods-use-this (#21094) (Pixel)
  • b2c608c fix: NewExpression with parenthesized callee in preserve-caught-error (#21083) (Francesco Trotta)

Documentation

  • 6ddf858 docs: fix broken Specify Parser Options anchor link (#21106) (Minsu)
  • 784dfbe docs: Clarify no-eq-null description (#21120) (Park Harin)
  • 7ec733a docs: Fix typos and grammar in glossary (#21095) (Marry (Subin Yang))
  • 92bb13f docs: replace quake link (#21108) (Jung Hyeon Jun)
  • 68eb4a5 docs: fix broken Specify Globals anchor links in rule pages (#21103) (Minsu)
  • d28f697 docs: replace Code Climate CLI links with Qlty CLI links (#21099) (Jung Hyeon Jun)
  • eccc68d docs: correct --suppressions-location option description (#21093) (Ga eun Lee)
  • c5963f7 docs: Update README (GitHub Actions Bot)

Chores

  • 4fbf46d test: pin webpack version to 5.108.4 (#21137) (Francesco Trotta)
  • 2d063e2 chore: update HTTP URLs to HTTPS in JSDoc and comments (#21101) (Bo Hyun Kim)
  • eccbe7b test: add error locations to no-class-assign (#21123) (devoil)
  • e7d1e43 ci: bump actions/setup-go from 6 to 7 (#21118) (dependabot[bot])
  • e9d66d0 ci: bump actions/setup-node from 6 to 7 (#21119) (dependabot[bot])
  • ee225b6 test: Add error location details to no-eq-null rule (#21117) (Park Harin)
  • 044a627 chore: update minimatch to ^10.2.5 (#21107) (김채영)
  • fb09aa8 chore: update ecosystem plugins (#21115) (ESLint Bot)
  • 5abd878 test: add error locations to no-proto (#21114) (Gihyeon Jeong / 정기현)
  • 9715887 test: Add error location details to no-div-regex (#21110) (Park Harin)
  • a746ec6 test: add error locations to no-new-wrappers (#21109) (Gihyeon Jeong / 정기현)
  • 8dde645 test: add error locations to no-ex-assign (#21102) (devoil)
  • 13ab0ec test: add error locations to no-label-var (#21098) (Gihyeon Jeong / 정기현)
  • a99906f test: Add error location details to no-delete-var rule (#21105) (Park Harin)
  • c47e8dc chore: add missing backticks to languages/js/index.js (#21104) (beeen)
  • 0174428 chore: add missing backticks to translate-cli-options.js (#21097) (dongkyu lee)
  • 3d36589 chore: add missing backticks to serialization.js (#21091) (이규환)
  • dcc9312 test: add error locations to eqeqeq (#21090) (Ga eun Lee)
  • 2710b18 ci: Add explicit permissions to rebuild-docs-sites workflow (#21089) (Marry (Subin Yang))
  • 5d2f866 chore: update dependency prettier to v3.9.5 (#21086) (renovate[bot])
  • d584e31 chore: fix failing ecosystem test for eslint-plugin-unicorn (#21084) (Francesco Trotta)
  • bf3eda0 chore: update ecosystem plugins (#21079) (ESLint Bot)

v10.7.0

Features

  • cf2a9bf feat: add errorClassNames option to preserve-caught-error rule (#21032) (sethamus)
  • f8b873a feat: max-nested-callbacks option for constructor callbacks (#21063) (fnx)

... (truncated)

Commits

Updates eslint-plugin-vue from 10.9.2 to 10.10.0

Release notes

Sourced from eslint-plugin-vue's releases.

v10.10.0

Minor Changes

Patch Changes

  • Updated @eslint-community/eslint-utils, semver and xml-name-validator dependencies (#3094)
Changelog

Sourced from eslint-plugin-vue's changelog.

10.10.0

Minor Changes

Patch Changes

  • Updated @eslint-community/eslint-utils, semver and xml-name-validator dependencies (#3094)
Commits

Updates globals from 17.6.0 to 17.8.0

Release notes

Sourced from globals's releases.

v17.8.0

  • Update globals (2026-07-01) (#347) 7394811

sindresorhus/globals@v17.7.0...v17.8.0

v17.7.0

  • Update globals (2026-06-22) (#345) 33b75f9

sindresorhus/globals@v17.6.0...v17.7.0

Commits

Updates html-webpack-plugin from 5.6.7 to 5.6.8

Changelog

Sourced from html-webpack-plugin's changelog.

5.6.8 (2026-07-25)

Bug Fixes

  • extend @​rspack/core peer dependency range (#1893) (8057b14)
Commits

Updates less from 4.6.4 to 4.8.1

Release notes

Sourced from less's releases.

Release v4.8.1

Changes

See CHANGELOG.md for details.

Installation

npm install less@4.8.1

Release v4.8.0

Changes

See CHANGELOG.md for details.

Installation

npm install less@4.8.0

Release v4.7.0

Changes

See CHANGELOG.md for details.

Installation

npm install less@4.7.0

Release v4.6.7

Changes

See CHANGELOG.md for details.

Installation

npm install less@4.6.7

Release v4.6.6

Changes

See CHANGELOG.md for details.

Installation

... (truncated)

Changelog

Sourced from less's changelog.

v4.8.1 (2026-07-26)

Changes

  • #4483 fix(release): sync release version from PR title (@​matthew-dean)
  • #4479 fix: leave math functions for the browser when an argument is a runtime CSS var() (@​Lfan-ke)
  • #4477 fix: forwarding an unset variadic no longer overrides callee defaults (@​Lfan-ke)
  • #4474 chore: release v4.8.0 — deprecate legacy identifier forms and dynamic @​charset (@​app/github-actions)

v4.8.0 (2026-07-22)

Changes

  • #4473 fix(mixing): resolves issue #4234 (@​puckowski)
  • #4472 Fix boolean() parsing for comparisons between inline condition expressions (@​app/copilot-swe-agent)

Deprecation Warnings

  • #4475 Deprecate numeric-leading and dash-only variable names, dash-only mixin names, and dynamic @charset interpolation for removal in Less 5.x. Less 4 preserves the existing output while warning; migrate names to valid identifiers and use a static quoted @charset declaration. (@​matthew-dean)

v4.7.0 (2026-07-18)

Changes

v4.6.7 (2026-06-20)

Changes

  • #4457 Fix failing "Request Copilot review" CI job (@​app/copilot-swe-agent)
  • #4451 chore: release v4.6.6 (@​app/github-actions)

v4.6.6 (2026-06-14)

Changes

... (truncated)

Commits

Updates less-loader from 12.3.3 to 13.0.0

Release notes

Sourced from less-loader's releases.

v13.0.0

Major Changes

  • Minimum supported Node.js version is now >= 22.11.0. (by @​alexander-akait in #590)

  • The package now ships native ESM as well as CommonJS. "type": "module" is set, and an exports map exposes dist/esm/index.js to import and dist/cjs/index.js to require. Less is loaded via dynamic import() instead of require(). (by @​alexander-akait in #593)

  • lessLogAsWarnOrErr now defaults to true. Less warnings and errors are emitted as webpack warnings and errors by default. Set the option to false to restore the previous behavior of logging silently. (by @​alexander-akait in #600)

Minor Changes

Patch Changes

  • Track files loaded synchronously by Less (e.g. data-uri() and custom functions installed via @plugin) as webpack file dependencies. See #492. (by @​alexander-akait in #596)

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

Changelog

Sourced from less-loader's changelog.

13.0.0

Major Changes

  • Minimum supported Node.js version is now >= 22.11.0. (by @​alexander-akait in #590)

  • The package now ships native ESM as well as CommonJS. "type": "module" is set, and an exports map exposes dist/esm/index.js to import and dist/cjs/index.js to require. Less is loaded via dynamic import() instead of require(). (by @​alexander-akait in #593)

  • lessLogAsWarnOrErr now defaults to true. Less warnings and errors are emitted as webpack warnings and errors by default. Set the option to false to restore the previous behavior of logging silently. (by @​alexander-akait in #600)

Minor Changes

Patch Changes

  • Track files loaded synchronously by Less (e.g. data-uri() and custom functions installed via @plugin) as webpack file dependencies. See #492. (by @​alexander-akait in #596)

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for less-loader since your current version.


Updates sass from 1.101.0 to 1.102.0

Release notes

Sourced from sass's releases.

Dart Sass 1.102.0

To install Sass 1.102.0, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

  • Use the 2.4 gamma transfer function for rec2020, as specified by the latest draft of CSS Color 4.

See the full changelog for changes in earlier releases.

Dart Sass 1.101.7

To install Sass 1.101.7, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

  • No user-visible changes.

See the full changelog for changes in earlier releases.

Dart Sass 1.101.6

To install Sass 1.101.6, download one of the packages below and

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 30, 2026
@dependabot
chore(deps): bump the npm group across 1 directory with 15 updates
505cb35 
Bumps the npm group with 14 updates in the /glances/outputs/static directory:

| Package | From | To |
| --- | --- | --- |
| [sanitize-html](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html) | `2.17.5` | `2.17.6` |
| [vue](https://github.com/vuejs/core) | `3.5.38` | `3.5.40` |
| [eslint](https://github.com/eslint/eslint) | `10.5.0` | `10.8.0` |
| [eslint-plugin-vue](https://github.com/vuejs/eslint-plugin-vue) | `10.9.2` | `10.10.0` |
| [globals](https://github.com/sindresorhus/globals) | `17.6.0` | `17.8.0` |
| [html-webpack-plugin](https://github.com/jantimon/html-webpack-plugin) | `5.6.7` | `5.6.8` |
| [less](https://github.com/less/less.js) | `4.6.4` | `4.8.1` |
| [less-loader](https://github.com/webpack/less-loader) | `12.3.3` | `13.0.0` |
| [sass](https://github.com/sass/dart-sass) | `1.101.0` | `1.102.0` |
| [sass-loader](https://github.com/webpack/sass-loader) | `16.0.8` | `17.0.0` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.61.0` | `8.65.0` |
| [webpack](https://github.com/webpack/webpack) | `5.107.2` | `5.109.2` |
| [webpack-cli](https://github.com/webpack/webpack-cli) | `7.2.1` | `7.2.2` |
| [webpack-dev-server](https://github.com/webpack/webpack-dev-server) | `5.2.6` | `6.0.0` |



Updates `sanitize-html` from 2.17.5 to 2.17.6
- [Changelog](https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md)
- [Commits](https://github.com/apostrophecms/apostrophe/commits/HEAD/packages/sanitize-html)

Updates `vue` from 3.5.38 to 3.5.40
- [Release notes](https://github.com/vuejs/core/releases)
- [Changelog](https://github.com/vuejs/core/blob/main/CHANGELOG.md)
- [Commits](vuejs/core@v3.5.38...v3.5.40)

Updates `@vue/compiler-sfc` from 3.5.38 to 3.5.40
- [Release notes](https://github.com/vuejs/core/releases)
- [Changelog](https://github.com/vuejs/core/blob/main/CHANGELOG.md)
- [Commits](https://github.com/vuejs/core/commits/v3.5.40/packages/compiler-sfc)

Updates `eslint` from 10.5.0 to 10.8.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.5.0...v10.8.0)

Updates `eslint-plugin-vue` from 10.9.2 to 10.10.0
- [Release notes](https://github.com/vuejs/eslint-plugin-vue/releases)
- [Changelog](https://github.com/vuejs/eslint-plugin-vue/blob/master/CHANGELOG.md)
- [Commits](vuejs/eslint-plugin-vue@v10.9.2...v10.10.0)

Updates `globals` from 17.6.0 to 17.8.0
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](sindresorhus/globals@v17.6.0...v17.8.0)

Updates `html-webpack-plugin` from 5.6.7 to 5.6.8
- [Release notes](https://github.com/jantimon/html-webpack-plugin/releases)
- [Changelog](https://github.com/jantimon/html-webpack-plugin/blob/main/CHANGELOG.md)
- [Commits](jantimon/html-webpack-plugin@v5.6.7...v5.6.8)

Updates `less` from 4.6.4 to 4.8.1
- [Release notes](https://github.com/less/less.js/releases)
- [Changelog](https://github.com/less/less.js/blob/master/CHANGELOG.md)
- [Commits](https://github.com/less/less.js/commits/v4.8.1)

Updates `less-loader` from 12.3.3 to 13.0.0
- [Release notes](https://github.com/webpack/less-loader/releases)
- [Changelog](https://github.com/webpack/less-loader/blob/main/CHANGELOG.md)
- [Commits](webpack/less-loader@v12.3.3...v13.0.0)

Updates `sass` from 1.101.0 to 1.102.0
- [Release notes](https://github.com/sass/dart-sass/releases)
- [Changelog](https://github.com/sass/dart-sass/blob/main/CHANGELOG.md)
- [Commits](sass/dart-sass@1.101.0...1.102.0)

Updates `sass-loader` from 16.0.8 to 17.0.0
- [Release notes](https://github.com/webpack/sass-loader/releases)
- [Changelog](https://github.com/webpack/sass-loader/blob/main/CHANGELOG.md)
- [Commits](webpack/sass-loader@v16.0.8...v17.0.0)

Updates `typescript-eslint` from 8.61.0 to 8.65.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.65.0/packages/typescript-eslint)

Updates `webpack` from 5.107.2 to 5.109.2
- [Release notes](https://github.com/webpack/webpack/releases)
- [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md)
- [Commits](webpack/webpack@v5.107.2...v5.109.2)

Updates `webpack-cli` from 7.2.1 to 7.2.2
- [Release notes](https://github.com/webpack/webpack-cli/releases)
- [Changelog](https://github.com/webpack/webpack-cli/blob/main/CHANGELOG.md)
- [Commits](https://github.com/webpack/webpack-cli/compare/webpack-cli@7.2.1...webpack-cli@7.2.2)

Updates `webpack-dev-server` from 5.2.6 to 6.0.0
- [Release notes](https://github.com/webpack/webpack-dev-server/releases)
- [Changelog](https://github.com/webpack/webpack-dev-server/blob/main/CHANGELOG.md)
- [Commits](webpack/webpack-dev-server@v5.2.6...v6.0.0)

---
updated-dependencies:
- dependency-name: "@vue/compiler-sfc"
  dependency-version: 3.5.40
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: eslint
  dependency-version: 10.8.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: eslint-plugin-vue
  dependency-version: 10.10.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: globals
  dependency-version: 17.8.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: html-webpack-plugin
  dependency-version: 5.6.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: less
  dependency-version: 4.8.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: less-loader
  dependency-version: 13.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm
- dependency-name: sanitize-html
  dependency-version: 2.17.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: sass
  dependency-version: 1.102.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: sass-loader
  dependency-version: 17.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm
- dependency-name: typescript-eslint
  dependency-version: 8.65.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: vue
  dependency-version: 3.5.40
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: webpack
  dependency-version: 5.109.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: webpack-cli
  dependency-version: 7.2.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: webpack-dev-server
  dependency-version: 6.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title Bump the npm group across 1 directory with 15 updates chore(deps): bump the npm group across 1 directory with 15 updates Aug 1, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/glances/outputs/static/npm-119f35bb9a branch from a7fd917 to 505cb35 Compare August 1, 2026 09:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants