chore(deps): update all non-major dependencies by renovate[bot] · Pull Request #1661 · stacksjs/stx

renovate · 2026-03-30T10:54:40Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Type	Update
@cwcss/crosswind	`^0.1.3` → `^0.2.4`	dependencies	minor
@cwcss/crosswind	`^0.2.0` → `^0.2.4`	dependencies	patch
@iconify/json (source)	`^2.2.463` → `^2.2.479`	devDependencies	patch
@stacksjs/clapp	`^0.2.0` → `^0.2.10`	dependencies	patch
@stacksjs/ts-cloud	`^0.2.3` → `^0.2.15`	dependencies	patch
@types/bun (source)	`^1.3.11` → `^1.3.14`	devDependencies	patch
@types/vscode (source)	`^1.110.0` → `^1.120.0`	devDependencies	minor
@vscode/vsce (source)	`^3.7.2-12` → `^3.9.1`	devDependencies	minor
actions/cache	`v5.0.3` → `v5.0.5`	action	patch
bun (source)	`>=1.3.11` → `>=1.3.14`	peerDependencies	patch
bunfig	`^0.15.6` → `^0.15.13`	dependencies	patch
dompurify	`^3.3.3` → `^3.4.6`	dependencies	minor
ejs	`^5.0.1` → `^5.0.2`	dependencies	patch
happy-dom	`^20.8.9` → `^20.9.0`	dependencies	minor
isomorphic-dompurify	`^3.7.1` → `^3.14.0`	dependencies	minor
jsdom	`^29.0.1` → `^29.1.1`	devDependencies	minor
liquidjs	`^10.25.2` → `^10.27.0`	dependencies	minor
markdown-it	`^14.1.1` → `^14.2.0`	dependencies	minor
marked (source)	`^17.0.5` → `^17.0.6`	dependencies	patch
oven-sh/setup-bun	`v2.1.2` → `v2.2.0`	action	minor
pickier	`^0.1.20` → `^0.1.32`	devDependencies	patch
prettier (source)	`^3.8.1` → `^3.8.3`	dependencies	patch
sanitize-html (source)	`^2.17.2` → `^2.17.4`	dependencies	patch
tinybench	`^6.0.0` → `^6.0.2`	dependencies	patch
ts-broadcasting	`^0.0.4` → `^0.0.5`	dependencies	patch
typescript (source)	`^6.0.2` → `^6.0.3`	devDependencies	patch
ws	`^8.20.0` → `^8.21.0`	dependencies	minor

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

cwcss/crosswind (@cwcss/crosswind)

`v0.2.4`

Compare Source

Compare changes

🚀 Features

rules: table display family, flow-root/list-item/contents, arbitrary accent/caret (f31d55c)

🧹 Chores

release v0.2.4 (09382bd)

Contributors

Chris <chrisbreuer93@gmail.com>

`v0.2.3`

Compare Source

Compare changes

🧹 Chores

release v0.2.3 (0af1adb)
split and minify dist (23aef98)

Contributors

Chris <chrisbreuer93@gmail.com>

`v0.2.2`

Compare Source

Compare changes

🐛 Bug Fixes

build: emit dist/index.js + dist/cli.js to match exports/bin paths (1544b47)

🧹 Chores

release v0.2.2 (a0ceda7)

Contributors

Chris <chrisbreuer93@gmail.com>

`v0.2.1`

Compare Source

Compare changes

🚀 Features

add css alias (bcc203d)
rules: pure-CSS iconify rule for any @iconify-json/* collection (d57a427)

🐛 Bug Fixes

add setup-bun to publish-commit job (1a02e04)
resolve typecheck errors (e6caa08)

🤖 Continuous Integration

drop redundant setup-bun (pantry installs bun via deps.yaml) (b506af1)

🧹 Chores

release v0.2.1 (fb65a3d)
remove headwind refs (2290f5e)
fresh install to pick up dtsx 0.9.14 and bunfig 0.15.9 (074e1fa)
fresh install to pick up pickier 0.1.21 (c7d15c0)
cascade order improvements (126617c)
several minor improvements (04caac1)
improve arbitrary values (36d341d)
wip (38d57fd)
merge and resolve conflict (1e00cce)
fix lint errors (12526b8)
minor improvements (0a2924a)
improve group-has-* and peer-has-* (7de7dc3)
several minor improvements (cc6ffe4)

Contributors

Chris <chrisbreuer93@gmail.com>
glennmichael123 gtorregosa@gmail.com

`v0.2.0`

Compare Source

Compare changes

🚀 Features

improve arbitrary values (9c6af1e)
handle arbitrary bracket opacity on named colors (af6f0f3)

🐛 Bug Fixes

resolve typecheck errors (8876156)
resolve typecheck errors (18bbc68)

🧹 Chores

release v0.2.0 (74a6cfa)
update lockfile (a95e37f)
release updates (c3908da)
adjust test (ce9472c)
repo cleanup and modernization (9f1d450)
repo cleanup and modernization (f5e5369)
remove unocss (4446ec1)
remove @stacksjs/docs (8ca150e)
remove redundant docs/.vitepress (9496179)
use Pantry action for publish-commit and add job dependencies (35b820a)
fix better-dx version to ^0.2.7 (4afffd7)
migrate to better-dx (2489f19)

`v0.1.6`

Compare Source

`v0.1.5`

Compare Source

Full Changelog: cwcss/crosswind@v0.1.4...v0.1.5

iconify/icon-sets (@iconify/json)

stacksjs/clapp (@stacksjs/clapp)

`v0.2.10`

Compare Source

`v0.2.9`

Compare Source

`v0.2.8`

Compare Source

`v0.2.7`

Compare Source

`v0.2.6`

Compare Source

`v0.2.5`

Compare Source

`v0.2.4`

Compare Source

`v0.2.3`

Compare Source

stacksjs/ts-cloud (@stacksjs/ts-cloud)

`v0.2.15`

Compare Source

`v0.2.14`

Compare Source

`v0.2.13`

Compare Source

`v0.2.12`

Compare Source

`v0.2.11`

Compare Source

`v0.2.10`

Compare Source

`v0.2.9`

Compare Source

`v0.2.8`

Compare Source

`v0.2.7`

Compare Source

`v0.2.6`

Compare Source

`v0.2.5`

Compare Source

Microsoft/vsce (@vscode/vsce)

`v3.9.1`

Compare Source

Changes:

#1266: fix: module type mismatch

This list of changes was auto generated.

`v3.9.0`

Compare Source

Changes:

#1263: fix: build regressions in 3.8.1
#1261: Add override for serialize-javascript

This list of changes was auto generated.

`v3.8.1`

Compare Source

Changes:

#1259: chore: update @azure/identity to 4.13.1 and modernize TypeScript/Node.js configuration

This list of changes was auto generated.

`v3.8.0`

Compare Source

Changes:

#1258: fix: run npm audit fix
#1255: Bump brace-expansion
#1253: Bump picomatch from 2.3.1 to 2.3.2
#1252: Bump yauzl from 2.10.0 to 3.2.1
#1250: Bump underscore from 1.13.1 to 1.13.8
#1249: Bump minimatch
#1243: Bump markdown-it from 14.1.0 to 14.1.1
#1244: Bump qs from 6.14.1 to 6.14.2
#1239: Bump @isaacs/brace-expansion from 5.0.0 to 5.0.1
#1238: Bump lodash from 4.17.21 to 4.17.23

See More

#1234: Bump qs from 6.11.0 to 6.14.1
#1233: Return non-zero exit code when signature verification fails
#1232: Audit npm package
#1228: Bump jws

This list of changes was auto generated.

`v3.7.2-13`

Compare Source

Changes:

#1258: fix: run npm audit fix

This list of changes was auto generated.

actions/cache (actions/cache)

`v5.0.5`

Compare Source

What's Changed

Update ts-http-runtime dependency by @yacaovsnc in #1747

Full Changelog: actions/cache@v5...v5.0.5

`v5.0.4`

Compare Source

oven-sh/bun (bun)

`v1.3.14`: Bun v1.3.14

Compare Source

To install Bun v1.3.14

curl -fsSL https://bun.sh/install | bash

# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.sh/install.ps1|iex"

To upgrade to Bun v1.3.14:

bun upgrade

Read Bun v1.3.14's release notes on Bun's blog

Thanks to 11 contributors!

`v1.3.13`: Bun v1.3.13

Compare Source

To install Bun v1.3.13

curl -fsSL https://bun.sh/install | bash

# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.sh/install.ps1|iex"

To upgrade to Bun v1.3.13:

bun upgrade

Read Bun v1.3.13's release notes on Bun's blog

Thanks to 8 contributors!

`v1.3.12`: Bun v1.3.12

Compare Source

To install Bun v1.3.12

curl -fsSL https://bun.sh/install | bash

# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.sh/install.ps1|iex"

To upgrade to Bun v1.3.12:

bun upgrade

Read Bun v1.3.12's release notes on Bun's blog

Thanks to 8 contributors!

stacksjs/bunfig (bunfig)

`v0.15.13`

Compare Source

`v0.15.12`

Compare Source

`v0.15.11`

Compare Source

`v0.15.10`

Compare Source

`v0.15.9`

Compare Source

`v0.15.8`

Compare Source

`v0.15.7`

Compare Source

cure53/DOMPurify (dompurify)

`v3.4.6`: DOMPurify 3.4.6

Compare Source

Fixed several issues with DOM Clobbering in IN_PLACE mode, thanks @offset & @Bankde
Hardened the checks for cross-realm IN_PLACE and Shadow DOM sanitization, thanks @offset & @Bankde
Added more test coverage for IN_PLACE and general DOM Clobbering attacks
Bumped several dependencies where possible

⚠️ This release is not yet final, thanks to GitHub being incompetent: https://www.githubstatus.com/ ⚠️

`v3.4.5`

Compare Source

`v3.4.4`: DOMPurify 3.4.4

Compare Source

Added the selectedcontent element to default allow-list, thanks @lukewarlow
Added the command and commandfor attributes to default allowed-list, thanks @lukewarlow
Added better template scrubbing for IN_PLACE operations, thanks @DEMON1A
Added stronger checks for cross-realm windows, thanks @DEMON1A & @fg0x0
Updated demo website and made sure it uses the latest from main
Updated existing workflows, fuzzer, dependabot, etc., added more tests
Bumped several dependencies where possible

`v3.4.3`

Compare Source

`v3.4.2`: DOMPurify 3.4.2

Compare Source

Fixed an issue with URI validation on attributes allowed via ADD_ATTR callback, thanks @nelstrom
Fixed an issue with source maps referring to non-existing files, thanks @cmdcolin
Updated existing workflows, fuzzer, release signing, etc., added more tests
Bumped several dependencies where possible

`v3.4.1`: DOMPurify 3.4.1

Compare Source

Fixed an issue with on-handler stripping for HTML-spec-reserved custom element names (font-face, color-profile, missing-glyph, font-face-src, font-face-uri, font-face-format, font-face-name) under permissive CUSTOM_ELEMENT_HANDLING
Fixed a case-sensitivity gap in the annotation-xml check that allowed mixed-case variants to bypass the basic-custom-element exclusion in XHTML mode
Fixed SANITIZE_NAMED_PROPS repeatedly prefixing already-prefixed id and name values on subsequent sanitization
Fixed the IN_PLACE root-node check to explicitly guard against non-string nodeName (DOM-clobbering robustness)
Removed a duplicate slot entry from the default HTML attribute allow-list
Strengthened the fast-check fuzz harness with explicit XSS invariants, an expanded seed-payload corpus, an additional idempotence property for SANITIZE_NAMED_PROPS, and a negative-control assertion ensuring the invariants actually fire
Added regression and pinning tests covering the above fixes and two accepted-behavior contracts (SAFE_FOR_TEMPLATES greedy scrub, hook-added attribute handling)
Extended CodeQL analysis to run on 3.x and 2.x maintenance branches

`v3.4.0`: DOMPurify 3.4.0

Compare Source

Most relevant changes:

Fixed a problem with FORBID_TAGS not winning over ADD_TAGS, thanks @kodareef5
Fixed several minor problems and typos regarding MathML attributes, thanks @DavidOliver
Fixed ADD_ATTR/ADD_TAGS function leaking into subsequent array-based calls, thanks @1Jesper1
Fixed a missing SAFE_FOR_TEMPLATES scrub in RETURN_DOM path, thanks @bencalif
Fixed a prototype pollution via CUSTOM_ELEMENT_HANDLING, thanks @trace37labs
Fixed an issue with ADD_TAGS function form bypassing FORBID_TAGS, thanks @eddieran
Fixed an issue with ADD_ATTR predicates skipping URI validation, thanks @christos-eth
Fixed an issue with USE_PROFILES prototype pollution, thanks @christos-eth
Fixed an issue leading to possible mXSS via Re-Contextualization, thanks @researchatfluidattacks and others
Fixed a problem with the type dentition patcher after Node version bump
Fixed freezing BS runs by reducing the tested browsers array
Bumped several dependencies where possible
Added needed files for OpenSSF scorecard checks

Published Advisories are here:
https://github.com/cure53/DOMPurify/security/advisories?state=published

mde/ejs (ejs)

`v5.0.2`

Compare Source

Version 5.0.2

capricorn86/happy-dom (happy-dom)

`v20.9.0`

Compare Source

🎨 Features

Adds support for event listener properties on Window (e.g. Window.onkeydown) - By @capricorn86 in task #2131

kkomelin/isomorphic-dompurify (isomorphic-dompurify)

`v3.14.0`: : Updated dependencies

Compare Source

What's Changed

chore(deps): bump dompurify from 3.4.3 to 3.4.5 by @dependabot[bot]
chore: Allowed esbuild and disallowed lefthook for ci.
chore: Added homepage URL to package.json.

Full Changelog: kkomelin/isomorphic-dompurify@3.13.0...3.14.0

`v3.13.0`: : Updated dependencies

Compare Source

What's Changed

chore(deps-dev): bump vitest from 4.1.5 to 4.1.6 by @dependabot[bot] in #435
chore(deps-dev): bump @types/jsdom from 28.0.1 to 28.0.3 by @dependabot[bot] in #436
chore(deps-dev): bump @biomejs/biome from 2.4.14 to 2.4.15 by @dependabot[bot] in #434
chore(deps): bump dompurify from 3.4.2 to 3.4.3 by @dependabot[bot] in #437

Full Changelog: kkomelin/isomorphic-dompurify@3.12.0...3.13.0

`v3.12.0`: : Updated dependencies

Compare Source

What's Changed

chore(deps): bump dompurify from 3.4.1 to 3.4.2 by @dependabot[bot] in #430
chore(deps): bump jsdom from 29.1.0 to 29.1.1 by @dependabot[bot] in #431
chore(deps-dev): bump @biomejs/biome from 2.4.13 to 2.4.14 by @dependabot[bot] in #432

Full Changelog: kkomelin/isomorphic-dompurify@3.11.0...3.12.0

`v3.11.0`: : Export hook-related TypeScript types

Compare Source

What's Changed

chore(deps-dev): bump @biomejs/biome from 2.4.12 to 2.4.13 by @dependabot[bot] in #426
chore(deps): bump jsdom from 29.0.2 to 29.1.0 by @dependabot[bot] in #428
feat: export hook-related TypeScript types (#427) by @kkomelin in #429 (thanks @amankumarsaini28 for requesting this update)

Full Changelog: kkomelin/isomorphic-dompurify@3.10.0...3.11.0

`v3.10.0`: : Updated dependencies

Compare Source

What's Changed

chore(deps-dev): bump lefthook from 2.1.5 to 2.1.6 by @dependabot[bot] in #422
chore(deps-dev): bump typescript from 6.0.2 to 6.0.3 by @dependabot[bot] in #423
chore(deps-dev): bump vitest from 4.1.4 to 4.1.5 by @dependabot[bot] in #425
chore(deps): bump dompurify from 3.4.0 to 3.4.1 by @dependabot[bot] in #424

Full Changelog: kkomelin/isomorphic-dompurify@3.9.0...3.10.0

`v3.9.0`: : Updated dompurify and others

Compare Source

What's Changed

Updated DOMPurify to 3.4.0
Updated dev dependencies (Biome, Vitest)

Full Changelog: kkomelin/isomorphic-dompurify@3.8.0...3.9.0

`v3.8.0`: : Updated dependencies

Compare Source

Dependency updates:

bump jsdom from 29.0.1 to 29.0.2
bump @biomejs/biome from 2.4.8 to 2.4.10
bump vitest from 4.1.1 to 4.1.3
bump lefthook from 2.1.4 to 2.1.5

jsdom/jsdom (jsdom)

`v29.1.1`

Compare Source

`v29.1.0`

Compare Source

`v29.0.2`

Compare Source

Significantly improved and sped up getComputedStyle(). Computed value rules are now applied across a broader set of properties, and include fixes related to inheritance, defaulting keywords, custom properties, and color-related values such as currentcolor and system colors. (@asamuzaK)
Fixed CSS 'background' and 'border' shorthand parsing. (@asamuzaK)

harttle/liquidjs (liquidjs)

`v10.27.0`

Compare Source

Features

context: null-prototype scope frames via createScope (#899) (47d3f1b)

`v10.26.0`

Compare Source

Bug Fixes

date: cap strftime widths and account padding in memoryLimit (#895) (3129d46)
enforce renderLimit for empty renderTemplates calls (#894) (5b9c346)
propagate ownPropertyOnly into Context.spawn() for {% render %} (#893) (dbbf628)
security: block Object.prototype filter/tag lookups (RCE) (#897) (457fae0)
strip html newline tags (#892) (26ea285)
strip_html: rewrite as linear single-pass scan to avoid ReDoS (#896) (3616a74)

Features

add sha256 and hmac_sha256 filters for cryptographic operations (#889) (1c816d4)

10.25.7 (2026-04-23)

Bug Fixes

filters: support Buffer input in base64_encode to prevent binary data corruption (#881) (0ee6dbb)

10.25.6 (2026-04-19)

Bug Fixes

nested block for layout (#883) (e2311df)

10.25.5 (2026-04-07)

Bug Fixes

enforce root containment for renderFile/parseFile lookups (#870) (f41c1fc)
null date should return empty (#868) (#872) (4f9a499)
rounding negative away from zero when half (#873) (1cdf10b)

10.25.4 (2026-04-07)

Bug Fixes

sort and sort_natural fi

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

netlify · 2026-03-30T10:57:44Z

❌ Deploy Preview for stacks-stx failed. Why did it fail? →

Name	Link
🔨 Latest commit	`7497332`
🔍 Latest deploy log	https://app.netlify.com/projects/stacks-stx/deploys/6a15a580069bac00084ee561

renovate Bot added dependencies minor labels Mar 30, 2026

renovate Bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from d44b38d to f967bb5 Compare April 6, 2026 07:00

renovate Bot force-pushed the renovate/all-minor-patch branch 12 times, most recently from 503ec2d to c150acb Compare April 13, 2026 16:49

renovate Bot force-pushed the renovate/all-minor-patch branch 12 times, most recently from 56dfb3f to 647aeb2 Compare April 19, 2026 10:52

renovate Bot force-pushed the renovate/all-minor-patch branch 23 times, most recently from f2e4eca to eb78bc3 Compare May 2, 2026 18:23

renovate Bot force-pushed the renovate/all-minor-patch branch 6 times, most recently from 5f029a7 to d79d996 Compare May 4, 2026 00:04

chore(deps): update all non-major dependencies

7497332

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): update all non-major dependencies#1661

chore(deps): update all non-major dependencies#1661
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

renovate Bot commented Mar 30, 2026 •

edited

Loading

Uh oh!

netlify Bot commented Mar 30, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

🚀 Features

🧹 Chores

Contributors

🧹 Chores

Contributors

🐛 Bug Fixes

🧹 Chores

Contributors

🚀 Features

🐛 Bug Fixes

🤖 Continuous Integration

🧹 Chores

Contributors

🚀 Features

🐛 Bug Fixes

🧹 Chores

Changes:

Changes:

Changes:

Changes:

Changes:

What's Changed

v1.3.14: Bun v1.3.14

Thanks to 11 contributors!

v1.3.13: Bun v1.3.13

Thanks to 8 contributors!

v1.3.12: Bun v1.3.12

Thanks to 8 contributors!

v3.4.6: DOMPurify 3.4.6

v3.4.4: DOMPurify 3.4.4

v3.4.2: DOMPurify 3.4.2

v3.4.1: DOMPurify 3.4.1

v3.4.0: DOMPurify 3.4.0

🎨 Features

v3.14.0: : Updated dependencies

What's Changed

v3.13.0: : Updated dependencies

What's Changed

v3.12.0: : Updated dependencies

What's Changed

v3.11.0: : Export hook-related TypeScript types

What's Changed

v3.10.0: : Updated dependencies

What's Changed

v3.9.0: : Updated dompurify and others

What's Changed

v3.8.0: : Updated dependencies

Features

Bug Fixes

Features

10.25.7 (2026-04-23)

Bug Fixes

10.25.6 (2026-04-19)

Bug Fixes

10.25.5 (2026-04-07)

Bug Fixes

10.25.4 (2026-04-07)

Bug Fixes

Configuration

Uh oh!

netlify Bot commented Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ Deploy Preview for stacks-stx failed. Why did it fail? →

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

renovate Bot commented Mar 30, 2026 •

edited

Loading

`v1.3.14`: Bun v1.3.14

`v1.3.13`: Bun v1.3.13

`v1.3.12`: Bun v1.3.12

`v3.4.6`: DOMPurify 3.4.6

`v3.4.4`: DOMPurify 3.4.4

`v3.4.2`: DOMPurify 3.4.2

`v3.4.1`: DOMPurify 3.4.1

`v3.4.0`: DOMPurify 3.4.0

`v3.14.0`: : Updated dependencies

`v3.13.0`: : Updated dependencies

`v3.12.0`: : Updated dependencies

`v3.11.0`: : Export hook-related TypeScript types

`v3.10.0`: : Updated dependencies

`v3.9.0`: : Updated dompurify and others

`v3.8.0`: : Updated dependencies

netlify Bot commented Mar 30, 2026 •

edited

Loading