Skip to content

Bump the npm_and_yarn group across 26 directories with 14 updates - #4

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/database/BaijiMangaViewer/npm_and_yarn-abe45876ff
Open

Bump the npm_and_yarn group across 26 directories with 14 updates#4
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/database/BaijiMangaViewer/npm_and_yarn-abe45876ff

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 10, 2026

Copy link
Copy Markdown

Bumps the npm_and_yarn group with 1 update in the /database/BaijiMangaViewer directory: sharp.
Bumps the npm_and_yarn group with 1 update in the /database/Bdash directory: mysql2.
Bumps the npm_and_yarn group with 1 update in the /database/BitShares directory: immutable.
Bumps the npm_and_yarn group with 1 update in the /database/BotFramework-Emulator directory: xmldom.
Bumps the npm_and_yarn group with 1 update in the /database/Buckets directory: qs.
Bumps the npm_and_yarn group with 1 update in the /database/CPod directory: sanitize-html.
Bumps the npm_and_yarn group with 1 update in the /database/Jan directory: pacote.
Bumps the npm_and_yarn group with 1 update in the /database/Kanon directory: csv-parse.
Bumps the npm_and_yarn group with 1 update in the /database/Knowte directory: nanoid.
Bumps the npm_and_yarn group with 1 update in the /database/Mochi directory: csv-parse.
Bumps the npm_and_yarn group with 1 update in the /database/MyDeck directory: jsondiffpatch.
Bumps the npm_and_yarn group with 1 update in the /database/ShuffleStudy directory: sanitize-html.
Bumps the npm_and_yarn group with 1 update in the /database/Tropy directory: sharp.
Bumps the npm_and_yarn group with 1 update in the /database/Tusk directory: decode-uri-component.
Bumps the npm_and_yarn group with 1 update in the /database/Webchain_Wallet directory: immutable.
Bumps the npm_and_yarn group with 2 updates in the /database/Whalebird directory: sanitize-html and axios.
Bumps the npm_and_yarn group with 1 update in the /database/cumulonimbus directory: sanitize-html.
Bumps the npm_and_yarn group with 1 update in the /database/falcon-sql-client directory: csv-parse.
Bumps the npm_and_yarn group with 1 update in the /database/hubii-core directory: immutable.
Bumps the npm_and_yarn group with 1 update in the /database/isle-editor directory: csv-parse.
Bumps the npm_and_yarn group with 1 update in the /database/polar-bookshelf directory: sanitize-html.
Bumps the npm_and_yarn group with 1 update in the /database/snapshot-slider directory: nodemailer.
Bumps the npm_and_yarn group with 2 updates in the /database/upterm directory: immutable and csv-parse.
Bumps the npm_and_yarn group with 1 update in the /database/youtube-music-desktop directory: axios.
Bumps the npm_and_yarn group with 1 update in the /database/zeltrez directory: axios.
Bumps the npm_and_yarn group with 1 update in the /database/zmNinja directory: cordova-plugin-inappbrowser.

Updates sharp from 0.17.3 to 0.35.4

Release notes

Sourced from sharp's releases.

v0.35.4

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.3

v0.35.4-rc.0

... (truncated)

Commits
  • 7f1a0a2 Release v0.35.4
  • f927818 Upgrade to sharp-libvips v1.3.3
  • e802092 Prerelease v0.35.4-rc.0
  • e13eb2f CI: Fix wasm32 build (#4589)
  • a82a0b3 Upgrade to libvips v8.18.6
  • 8044fe4 Bound resize dimensions to coordinate limit
  • 147f859 Docs: changelog entries for #4578 #4584
  • ee5bfb8 Tests: use yauzl directly rather than via extract-zip wrapper
  • 7a77889 Bump uraimo/run-on-arch-action from 3.1.0 to 3.2.0 (#4588)
  • ea5bef2 Improve support for input Streams finishing before output is requested (#4584)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for sharp since your current version.


Updates mysql2 from 1.5.1 to 3.23.1

Release notes

Sourced from mysql2's releases.

v3.23.1

3.23.1 (2026-07-19)

Bug Fixes

  • security: fix unbounded decompression of server-supplied compressed packets, reported by alanturing881 (7c48343)
  • parser: call typeCast for NULL values in the binary protocol (#4394) (01f1092)

v3.23.0

3.23.0 (2026-07-13)

Features

  • return unsafe integers inside JSON columns as exact strings with supportBigNumbers (#4388) (a26ff14)
  • sql-escaper: add Temporal support when escaping values (#4392) (6b933f6)
  • support MariaDB data types (UUID, INET4, INET6, VECTOR, JSON) via extended type metadata; run CI against MariaDB (#4373) (5034e57)

v3.22.6

3.22.6 (2026-07-07)

Bug Fixes

  • sql-escaper: resolve multi statement and expand object regressions (#4380) (1b927a9)

v3.22.5

3.22.5 (2026-06-06)

Bug Fixes

  • keep 00:00:00 time for TIMESTAMP in binary protocol with dateStrings (#4327) (2af33a1)

v3.22.4

3.22.4 (2026-05-24)

Bug Fixes

v3.22.3

3.22.3 (2026-04-24)

Bug Fixes

  • allow resetOnRelease in connection config validation (#4278) (e72f923)

... (truncated)

Changelog

Sourced from mysql2's changelog.

3.23.1 (2026-07-19)

Bug Fixes

  • security: fix unbounded decompression of server-supplied compressed packets, reported by alanturing881 (7c48343)
  • parser: call typeCast for NULL values in the binary protocol (#4394) (01f1092)

3.23.0 (2026-07-13)

Features

  • return unsafe integers inside JSON columns as exact strings with supportBigNumbers (#4388) (a26ff14)
  • sql-escaper: add Temporal support when escaping values (#4392) (6b933f6)
  • support MariaDB data types (UUID, INET4, INET6, VECTOR, JSON) via extended type metadata; run CI against MariaDB (#4373) (5034e57)

3.22.6 (2026-07-07)

Bug Fixes

  • sql-escaper: resolve multi statement and expand object regressions (#4380) (1b927a9)

3.22.5 (2026-06-06)

Bug Fixes

  • keep 00:00:00 time for TIMESTAMP in binary protocol with dateStrings (#4327) (2af33a1)

3.22.4 (2026-05-26)

Bug Fixes

3.22.3 (2026-04-24)

Bug Fixes

  • allow resetOnRelease in connection config validation (#4278) (e72f923)

3.22.2 (2026-04-21)

Bug Fixes

... (truncated)

Commits
  • 3de28fb chore(master): release 3.23.1 (#4408)
  • 01f1092 fix(parser): call typeCast for NULL values in the binary protocol (#3368) (#4...
  • 534c552 build(deps): bump lucide-react from 1.24.0 to 1.25.0 in /website (#4407)
  • 7c48343 Merge commit from fork
  • 3e13d7b docs: establish security charter (#4404)
  • 26c135b build(deps): bump websocket-driver from 0.7.4 to 0.7.5 in /website (#4403)
  • f86cfb1 chore(master): release 3.23.0 (#4387)
  • 6316492 build(deps): bump the docusaurus group in /website with 2 updates (#4396)
  • 6b933f6 feat(sql-escaper): add Temporal support when escaping values (#4392)
  • 457c316 build(deps): bump lucide-react from 1.23.0 to 1.24.0 in /website (#4391)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for mysql2 since your current version.


Updates immutable from 3.8.2 to 4.3.9

Release notes

Sourced from immutable's releases.

v4.3.9

What's changed

Full Changelog: immutable-js/immutable-js@v4.3.8...v4.3.9

v4.3.8

Fix Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

v4.3.7

What's Changed

Full Changelog: immutable-js/immutable-js@v4.3.6...v4.3.7

v4.3.6

What's Changed

Internals

New Contributors

Full Changelog: immutable-js/immutable-js@v4.3.5...v4.3.6

v4.3.5

What's Changed

New Contributors

Full Changelog: immutable-js/immutable-js@v4.3.4...v4.3.5

4.3.4

What's Changed

... (truncated)

Changelog

Sourced from immutable's changelog.

4.3.9

5.1.7

  • fix(Repeat): lastIndexOf returned size instead of size - 1 by @​chatman-media in immutable-js/immutable-js#2227. Fixes CVE CVE-2026-29063
  • fix(IndexedCollection): has(index) on a lazy Seq of unknown size now checks index existence instead of searching for a value equal to the index #2203
  • [TypeScript]: reduce/reduceRight without an initial value now infer the result type from the collection's values when the reducer returns a value (e.g. list.reduce((a, b) => a + b) infers number), matching Array#reduce. Previously an explicit type argument was required. #2205

5.1.6

  • fix(reverseFactory): read reversedSequence.size in __iterator instead of this #2196

5.1.5

  • Fix Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

5.1.4

Documentation

Internal

5.1.3

TypeScript

Documentation

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for immutable since your current version.


Updates xmldom from 0.1.27 to 0.6.0

Release notes

Sourced from xmldom's releases.

0.6.0

0.6.0

Fixes

0.5.0

Fixes

  • Avoid misinterpretation of malicious XML input - GHSA-h6q6-9hqw-rwfv (CVE-2021-21366)

    • Improve error reporting; throw on duplicate attribute BREAKING CHANGE: It is currently not clear how to consistently deal with duplicate attributes, so it's also safer for our users to fail when detecting them. It's possible to configure the DOMParser.errorHandler before parsing, to handle those errors differently.

      To accomplish this and also be able to verify it in tests I needed to

      • create a new Error type ParseError and export it
      • Throw ParseError from errorHandler.fatalError and prevent those from being caught in XMLReader.
      • export DOMHandler constructor as __DOMHandler

    • Preserve quotes in DOCTYPE declaration Since the only purpose of parsing the DOCTYPE is to be able to restore it when serializing, we decided that it would be best to leave the parsed publicId and systemId as is, including any quotes. BREAKING CHANGE: If somebody relies on the actual unquoted values of those ids, they will need to take care of either single or double quotes and the right escaping. (Without this change this would not have been possible because the SAX parser already dropped the information about the quotes that have been used in the source.)

      https://www.w3.org/TR/2006/REC-xml11-20060816/#dtd https://www.w3.org/TR/2006/REC-xml11-20060816/#IDAX1KS (External Entity Declaration)

  • Fix breaking preprocessors' directives when parsing attributes [#171](https://github.com/xmldom/xmldom/issues/171)
  • fix(dom): Escape ]]> when serializing CharData [#181](https://github.com/xmldom/xmldom/issues/181)
  • Switch to (only) MIT license (drop problematic LGPL license option) [#178](https://github.com/xmldom/xmldom/issues/178)
  • Export DOMException; remove custom assertions; etc. [#174](https://github.com/xmldom/xmldom/issues/174)

Docs

0.4.0

Fixes

Docs

... (truncated)

Changelog

Sourced from xmldom's changelog.

0.6.0

Published to npm: 2021-04-17 16:41 UTC by @​karfau as xmldom

Fixes

0.5.0

Published to npm: 2021-03-09 03:59 UTC by @​brodybits as xmldom

Fixes

  • Avoid misinterpretation of malicious XML input - GHSA-h6q6-9hqw-rwfv (CVE-2021-21366)

    • Improve error reporting; throw on duplicate attribute
      BREAKING CHANGE: It is currently not clear how to consistently deal with duplicate attributes, so it's also safer for our users to fail when detecting them. It's possible to configure the DOMParser.errorHandler before parsing, to handle those errors differently.

      To accomplish this and also be able to verify it in tests I needed to

      • create a new Error type ParseError and export it
      • Throw ParseError from errorHandler.fatalError and prevent those from being caught in XMLReader.
      • export DOMHandler constructor as __DOMHandler

    • Preserve quotes in DOCTYPE declaration Since the only purpose of parsing the DOCTYPE is to be able to restore it when serializing, we decided that it would be best to leave the parsed publicId and systemId as is, including any quotes. BREAKING CHANGE: If somebody relies on the actual unquoted values of those ids, they will need to take care of either single or double quotes and the right escaping. (Without this change this would not have been possible because the SAX parser already dropped the information about the quotes that have been used in the source.)

      https://www.w3.org/TR/2006/REC-xml11-20060816/#dtd https://www.w3.org/TR/2006/REC-xml11-20060816/#IDAX1KS (External Entity Declaration)

  • Fix breaking preprocessors' directives when parsing attributes [#171](https://github.com/xmldom/xmldom/issues/171)

  • fix(dom): Escape ]]> when serializing CharData [#181](https://github.com/xmldom/xmldom/issues/181)

  • Switch to (only) MIT license (drop problematic LGPL license option) [#178](https://github.com/xmldom/xmldom/issues/178)

  • Export DOMException; remove custom assertions; etc. [#174](https://github.com/xmldom/xmldom/issues/174)

Docs

0.4.0

Published to npm: 2020-10-27 00:44 UTC by @​brodybits as xmldom

Fixes

... (truncated)

Commits
  • c80a161 xmldon version 0.6.0
  • bc36efd chore: regenerate package-lock.json
  • 8a92704 Update eslint -> ^7.23.0 - devDependencies (#202)
  • b12106e Update @​stryker-mutator/core -> ^4.5.1 - devDependencies (#192)
  • af4642e docs: Update Changelog (#197)
  • 5869d76 test(stryker): Replace line numbers by error index (#201)
  • a681852 fix: Escape < when serializing attribute values (#199)
  • bb12247 Update eslint-config-prettier -> 8 - devDependencies (#187)
  • 48c51b3 Update eslint -> ^7.22.0 - devDependencies (#185)
  • 82b0481 refactor!: Avoid empty namespace value like xmlns:ds="" (#168)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by karfau, a new releaser for xmldom since your current version.


Updates qs from 6.4.0 to 6.16.0

Changelog

Sourced from qs's changelog.

6.16.0

  • [New] stringify: add a depth option to bound recursion depth (default Infinity)
  • [Fix] stringify: serialize Date values when a filter is provided
  • [Fix] parse: enforce arrayLimit on comma groups under []= when throwOnLimitExceeded is set
  • [Fix] parse: flatten a collection appended to an overflowed array (#571)
  • [Fix] utils: isBuffer: do not invoke a non-callable constructor.isBuffer
  • [Fix] stringify: do not let allowEmptyArrays skip cycle detection (or drop own keys) on an empty array with own properties
  • [Fix] stringify: encode dots in a top-level key with a primitive value when encodeDotInKeys is set (#562)
  • [Docs] threat model: clarify stringify deep-nesting DoS is caller-bounded
  • [Docs] clarify arrayLimit is a representation threshold, not an element-count cap
  • [Tests] parse: remove a test that pinned []= comma groups escaping arrayLimit
  • [Tests] stringify: pin current encodeDotInKeys separator-dot behavior
  • [Dev Deps] update @ljharb/eslint-config, eslint
  • [Dev Deps] update eslint, evalmd

6.15.3

  • [Fix] parse: enforce throwOnLimitExceeded for cumulative array growth via combine/merge
  • [Fix] utils: respect encoding of surrogate pairs across chunks (#559)
  • [Robustness] parse: throw the arrayLimit error before splitting oversized comma values
  • [Robustness] utils.merge / utils.assign: avoid invoking __proto__ setter when copying own properties
  • [Robustness] utils: enforce arrayLimit consistently across merge's array paths
  • [Perf] utils: make compact O(n) via a side-channel visited-set instead of Array.indexOf
  • [Deps] update side-channel
  • [Dev Deps] update eslint, mock-property, tape
  • [Tests] parse: characterize current lenient handling of unbalanced bracket keys (#558)

6.15.2

  • [Fix] stringify: skip null/undefined entries in arrayFormat: 'comma' + encodeValuesOnly instead of crashing in encoder
  • [Fix] stringify: use configured delimiter after charsetSentinel (#555)
  • [Fix] stringify: apply formatter to encoded key under strictNullHandling (#554)
  • [Fix] stringify: skip null/undefined filter-array entries instead of crashing in encoder (#551)
  • [Fix] parse: handle nested bracket groups and add regression tests (#530); changes output for some unbalanced bracket keys (see #558)
  • [readme] fix grammar (#550)
  • [Dev Deps] update @ljharb/eslint-config
  • [Tests] add regression tests for keys containing percent-encoded bracket text

6.15.1

  • [Fix] parse: parameterLimit: Infinity with throwOnLimitExceeded: true silently drops all parameters
  • [Deps] update @ljharb/eslint-config
  • [Dev Deps] update @ljharb/eslint-config, iconv-lite
  • [Tests] increase coverage

6.15.0

  • [New] parse: add strictMerge option to wrap object/primitive conflicts in an array (#425, #122)
  • [Fix] duplicates option should not apply to bracket notation keys (#514)

6.14.2

  • [Fix] parse: mark overflow objects for indexed notation exceeding arrayLimit (#546)
  • [Fix] arrayLimit means max count, not max index, in combine/merge/parseArrayValue
  • [Fix] parse: throw on arrayLimit exceeded with indexed notation when throwOnLimitExceeded is true (#529)

... (truncated)

Commits
  • bb9379e v6.16.0
  • 62fd254 [Fix] stringify: serialize Date values when a filter is provided
  • 8859c37 [Fix] parse: enforce arrayLimit on comma groups under []= when `throwOn...
  • 8079adc [Tests] parse: remove a test that pinned []= comma groups escaping `array...
  • d56f48c [Fix] parse: flatten a collection appended to an overflowed array
  • e83d321 [Fix] utils: isBuffer: do not invoke a non-callable constructor.isBuffer
  • 7e87a07 [Dev Deps] update @ljharb/eslint-config, eslint
  • 9a76af2 [Dev Deps] update eslint, evalmd
  • 3a890d4 [Dev Deps] update eslint, evalmd
  • b433a9b [Fix] stringify: do not let allowEmptyArrays skip cycle detection (or dro...
  • Additional commits viewable in compare view
Install script changes

This version modifies prepublish script that runs during installation. Review the package contents before updating.


Updates sanitize-html from 1.27.5 to 2.17.7

Changelog

Sourced from sanitize-html's changelog.

2.17.7 (2026-08-13)

Security

  • Fixed an XSS / URL scheme policy bypass affecting configurations that allow the SVG animation elements (animate, animateColor, animateMotion, animateTransform or set) together with attributeName and one of the animation value attributes. The default configuration was not affected, as these elements are not in the default allowedTags. apostrophecms was not affected. Thanks to koyokr for responsibly disclosing the vulnerability (GHSA-g8qq-57p8-ggw5).

2.17.6 (2026-07-10)

Fixes

  • Allow transformTags to emit text when textFilter is set, even if the tag is initially empty. This is consistent with the documentation. Thanks to spokodev for the fix.

Security

  • Fixed an XSS/allowlist bypass in which the contents of a raw-text element (textarea or xmp) nested inside an svg or math root were re-emitted without HTML-escaping. sanitize-html treated that content as inert raw text because htmlparser2 10.x classified raw-text elements by tag name and ignored the namespace, but a real HTML5 parser treats textarea/xmp as ordinary foreign elements inside SVG/MathML and re-parses their contents as live markup. As a result, markup and event-handler attributes that the allowlist never permitted (for example <svg><textarea><img src=x onerror=alert(1)>) could survive sanitization and execute in the browser. This is now fixed on two fronts: htmlparser2 was upgraded to 12.x, which is namespace-aware and parses textarea/xmp inside SVG/MathML as ordinary elements, so their non-allowlisted children (such as the injected img) are dropped by the allowlist instead of being preserved as raw text; and any raw-text content sanitize-html still emits for these tags (at HTML integration points such as foreignObject/mtext, or outside foreign content) is always HTML-escaped. The default configuration is not affected; the precondition is an allowedTags that includes svg or math together with textarea or xmp. Thanks to khoadb175 for responsibly disclosing the vulnerability.
  • Fixed a mutation-XSS / allowedTags bypass affecting configurations that allow the textarea or xmp raw-text tags. htmlparser2 10.x did not recognize an end tag with a trailing solidus (e.g. </textarea/>) as closing the element, so it kept the following markup as raw text, but a spec-compliant browser treats </textarea/> as a valid close and parses that markup as a live element. Because raw-text content was re-emitted without escaping, a payload such as <textarea></textarea/><img src=x onerror=...> could smuggle non-allowlisted, executable markup through the sanitizer. The default configuration was not affected. This is now defended at two layers: htmlparser2 was upgraded to 12.x, whose tokenizer closes these end tags correctly, and the raw text sanitize-html emits for these tags is always escaped so no < can reopen a tag when the output is re-parsed (textarea, an RCDATA element whose entities htmlparser2 decodes, is escaped like normal text, while xmp, a raw-text element, has only its angle brackets escaped to avoid double-encoding already-encoded entities). Because htmlparser2 is ESM-only from version 11 onward, sanitize-html now requires Node.js >=22.12.0 (the first 22.x release in which require() of an ES module is available unflagged). Thanks to bibu123456 for reporting the vulnerability and Kayiz-PT for coordinating the disclosure (GHSA-jxwj-j7wr-gfrw).

2.17.5 (2026-06-10)

Security

  • Added a number of new attributes to be protected against unsafe URLs, e.g. javascript: and similar. None of these are used in the default configuration of sanitize-html or apostrophe or likely to be used there, and some attributes, like an action for a form, are inherently unsafe to allow if XSS protection is your goal. Nevertheless it makes sense to block certain URL types where they are not appropriate. Some attributes are not supported at all by modern browsers but are included for completeness. Thanks to crattack for reporting the vulnerability.
  • Address a potential vulnerability when nonTextTags is configured in a nonstandard way. While it is never a good idea to remove known non-text tags from the standard list e.g. script, styles, etc., this change ensures that doing so does not result in nested tags being passed through without sanitization when they are not expressly allowed. (ApostropheCMS would never trigger this situation.) Thanks to Dipanshu singh for pointing out the issue and contributing the fix.

2.17.4

Changes

  • sanitize-html and launder now share a single implementation of naughtyHref, based on that which previously existed in sanitize-html.

Security

  • Security vulnerability: the xmp tag could be used to pass forbidden markup through sanitize-html, even when xmp itself is not explicitly allowed All users of sanitize-html should update immediately. Thanks to Vincenzo Turturro for reporting the vulnerability.

2.17.3 (2026-04-15)

Security

  • Fix vulnerability introduced in version 2.17.2 that allowed XSS attacks if the developer chose to permit option tags. There was no vulnerability when not explicitly allowing option tags.

2.17.2 (2026-03-19)

Changes

  • Upgrade htmlparser2 from 8.x to 10.1.0. This improves security by correctly decoding zero-padded numeric character references (e.g., &[#0000001](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html/issues/0000001)) that previously bypassed javascript: URL detection. Also fixes double-encoding of entities inside raw text elements like textarea and option.

2.17.1 (2026-02-18)

Fixes

... (truncated)

Commits

Updates pacote from 17.0.7 to 22.0.0

Release notes

Sourced from pacote's releases.

v22.0.0

22.0.0 (2026-06-15)

⚠️ BREAKING CHANGES

  • pacote now supports node ^22.22.2 || ^24.15.0 || >=26.0.0
  • git specs using the https or git+https protocol now resolve to git+https URLs instead of being switched to git+ssh. Shortcut specs (e.g. github:user/repo, user/repo) and git+ssh/git:// specs are unchanged.

Features

Bug Fixes

Description has been truncated

@dependabot
Bump the npm_and_yarn group across 26 directories with 14 updates
f9483d2 
Bumps the npm_and_yarn group with 1 update in the /database/BaijiMangaViewer directory: [sharp](https://github.com/lovell/sharp).
Bumps the npm_and_yarn group with 1 update in the /database/Bdash directory: [mysql2](https://github.com/sidorares/node-mysql2).
Bumps the npm_and_yarn group with 1 update in the /database/BitShares directory: [immutable](https://github.com/immutable-js/immutable-js).
Bumps the npm_and_yarn group with 1 update in the /database/BotFramework-Emulator directory: [xmldom](https://github.com/xmldom/xmldom).
Bumps the npm_and_yarn group with 1 update in the /database/Buckets directory: [qs](https://github.com/ljharb/qs).
Bumps the npm_and_yarn group with 1 update in the /database/CPod directory: [sanitize-html](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html).
Bumps the npm_and_yarn group with 1 update in the /database/Jan directory: [pacote](https://github.com/npm/pacote).
Bumps the npm_and_yarn group with 1 update in the /database/Kanon directory: [csv-parse](https://github.com/adaltas/node-csv/tree/HEAD/packages/csv-parse).
Bumps the npm_and_yarn group with 1 update in the /database/Knowte directory: [nanoid](https://github.com/ai/nanoid).
Bumps the npm_and_yarn group with 1 update in the /database/Mochi directory: [csv-parse](https://github.com/adaltas/node-csv/tree/HEAD/packages/csv-parse).
Bumps the npm_and_yarn group with 1 update in the /database/MyDeck directory: [jsondiffpatch](https://github.com/benjamine/jsondiffpatch).
Bumps the npm_and_yarn group with 1 update in the /database/ShuffleStudy directory: [sanitize-html](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html).
Bumps the npm_and_yarn group with 1 update in the /database/Tropy directory: [sharp](https://github.com/lovell/sharp).
Bumps the npm_and_yarn group with 1 update in the /database/Tusk directory: [decode-uri-component](https://github.com/SamVerschueren/decode-uri-component).
Bumps the npm_and_yarn group with 1 update in the /database/Webchain_Wallet directory: [immutable](https://github.com/immutable-js/immutable-js).
Bumps the npm_and_yarn group with 2 updates in the /database/Whalebird directory: [sanitize-html](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html) and [axios](https://github.com/axios/axios).
Bumps the npm_and_yarn group with 1 update in the /database/cumulonimbus directory: [sanitize-html](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html).
Bumps the npm_and_yarn group with 1 update in the /database/falcon-sql-client directory: [csv-parse](https://github.com/adaltas/node-csv/tree/HEAD/packages/csv-parse).
Bumps the npm_and_yarn group with 1 update in the /database/hubii-core directory: [immutable](https://github.com/immutable-js/immutable-js).
Bumps the npm_and_yarn group with 1 update in the /database/isle-editor directory: [csv-parse](https://github.com/adaltas/node-csv/tree/HEAD/packages/csv-parse).
Bumps the npm_and_yarn group with 1 update in the /database/polar-bookshelf directory: [sanitize-html](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html).
Bumps the npm_and_yarn group with 1 update in the /database/snapshot-slider directory: [nodemailer](https://github.com/nodemailer/nodemailer).
Bumps the npm_and_yarn group with 2 updates in the /database/upterm directory: [immutable](https://github.com/immutable-js/immutable-js) and [csv-parse](https://github.com/adaltas/node-csv/tree/HEAD/packages/csv-parse).
Bumps the npm_and_yarn group with 1 update in the /database/youtube-music-desktop directory: [axios](https://github.com/axios/axios).
Bumps the npm_and_yarn group with 1 update in the /database/zeltrez directory: [axios](https://github.com/axios/axios).
Bumps the npm_and_yarn group with 1 update in the /database/zmNinja directory: [cordova-plugin-inappbrowser](https://github.com/apache/cordova-plugin-inappbrowser).


Updates `sharp` from 0.17.3 to 0.35.4
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](lovell/sharp@v0.17.3...v0.35.4)

Updates `mysql2` from 1.5.1 to 3.23.1
- [Release notes](https://github.com/sidorares/node-mysql2/releases)
- [Changelog](https://github.com/sidorares/node-mysql2/blob/master/Changelog.md)
- [Commits](sidorares/node-mysql2@v1.5.1...v3.23.1)

Updates `immutable` from 3.8.2 to 4.3.9
- [Release notes](https://github.com/immutable-js/immutable-js/releases)
- [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md)
- [Commits](immutable-js/immutable-js@v3.8.2...v4.3.9)

Updates `xmldom` from 0.1.27 to 0.6.0
- [Release notes](https://github.com/xmldom/xmldom/releases)
- [Changelog](https://github.com/xmldom/xmldom/blob/master/CHANGELOG.md)
- [Commits](xmldom/xmldom@0.1.27...0.6.0)

Updates `qs` from 6.4.0 to 6.16.0
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.4.0...v6.16.0)

Updates `sanitize-html` from 1.27.5 to 2.17.7
- [Changelog](https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md)
- [Commits](https://github.com/apostrophecms/apostrophe/commits/sanitize-html@2.17.7/packages/sanitize-html)

Updates `pacote` from 17.0.7 to 22.0.0
- [Release notes](https://github.com/npm/pacote/releases)
- [Changelog](https://github.com/npm/pacote/blob/main/CHANGELOG.md)
- [Commits](npm/pacote@v17.0.7...v22.0.0)

Updates `csv-parse` from 2.5.0 to 7.0.2
- [Changelog](https://github.com/adaltas/node-csv/blob/master/packages/csv-parse/CHANGELOG.md)
- [Commits](https://github.com/adaltas/node-csv/commits/csv-parse@7.0.2/packages/csv-parse)

Updates `nanoid` from 2.1.11 to 6.0.1
- [Release notes](https://github.com/ai/nanoid/releases)
- [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md)
- [Commits](ai/nanoid@2.1.11...6.0.1)

Updates `csv-parse` from 4.16.3 to 7.0.2
- [Changelog](https://github.com/adaltas/node-csv/blob/master/packages/csv-parse/CHANGELOG.md)
- [Commits](https://github.com/adaltas/node-csv/commits/csv-parse@7.0.2/packages/csv-parse)

Updates `jsondiffpatch` from 0.4.1 to 0.7.6
- [Release notes](https://github.com/benjamine/jsondiffpatch/releases)
- [Commits](https://github.com/benjamine/jsondiffpatch/commits)

Updates `sanitize-html` from 1.27.5 to 2.17.7
- [Changelog](https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md)
- [Commits](https://github.com/apostrophecms/apostrophe/commits/sanitize-html@2.17.7/packages/sanitize-html)

Updates `sharp` from 0.23.4 to 0.35.4
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](lovell/sharp@v0.17.3...v0.35.4)

Updates `decode-uri-component` from 0.2.2 to 0.5.0
- [Release notes](https://github.com/SamVerschueren/decode-uri-component/releases)
- [Commits](SamVerschueren/decode-uri-component@v0.2.2...v0.5.0)

Updates `immutable` from 3.8.1 to 4.3.9
- [Release notes](https://github.com/immutable-js/immutable-js/releases)
- [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md)
- [Commits](immutable-js/immutable-js@v3.8.2...v4.3.9)

Updates `sanitize-html` from 1.27.5 to 2.17.7
- [Changelog](https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md)
- [Commits](https://github.com/apostrophecms/apostrophe/commits/sanitize-html@2.17.7/packages/sanitize-html)

Updates `axios` from 0.19.2 to 1.20.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v0.19.2...v1.20.0)

Updates `sanitize-html` from 1.27.5 to 2.17.7
- [Changelog](https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md)
- [Commits](https://github.com/apostrophecms/apostrophe/commits/sanitize-html@2.17.7/packages/sanitize-html)

Updates `csv-parse` from 2.5.0 to 7.0.2
- [Changelog](https://github.com/adaltas/node-csv/blob/master/packages/csv-parse/CHANGELOG.md)
- [Commits](https://github.com/adaltas/node-csv/commits/csv-parse@7.0.2/packages/csv-parse)

Updates `immutable` from 3.8.2 to 4.3.9
- [Release notes](https://github.com/immutable-js/immutable-js/releases)
- [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md)
- [Commits](immutable-js/immutable-js@v3.8.2...v4.3.9)

Updates `csv-parse` from 4.16.3 to 7.0.2
- [Changelog](https://github.com/adaltas/node-csv/blob/master/packages/csv-parse/CHANGELOG.md)
- [Commits](https://github.com/adaltas/node-csv/commits/csv-parse@7.0.2/packages/csv-parse)

Updates `sanitize-html` from 1.27.5 to 2.17.7
- [Changelog](https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md)
- [Commits](https://github.com/apostrophecms/apostrophe/commits/sanitize-html@2.17.7/packages/sanitize-html)

Updates `nodemailer` from 4.7.0 to 10.0.3
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](nodemailer/nodemailer@v4.7.0...v10.0.3)

Updates `immutable` from 3.8.1 to 4.3.9
- [Release notes](https://github.com/immutable-js/immutable-js/releases)
- [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md)
- [Commits](immutable-js/immutable-js@v3.8.2...v4.3.9)

Updates `csv-parse` from 1.2.3 to 7.0.2
- [Changelog](https://github.com/adaltas/node-csv/blob/master/packages/csv-parse/CHANGELOG.md)
- [Commits](https://github.com/adaltas/node-csv/commits/csv-parse@7.0.2/packages/csv-parse)

Updates `axios` from 0.18.1 to 1.20.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v0.19.2...v1.20.0)

Updates `axios` from 0.16.2 to 1.20.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v0.19.2...v1.20.0)

Updates `cordova-plugin-inappbrowser` from 1.7.2 to 7.0.0
- [Release notes](https://github.com/apache/cordova-plugin-inappbrowser/releases)
- [Changelog](https://github.com/apache/cordova-plugin-inappbrowser/blob/master/RELEASENOTES.md)
- [Commits](apache/cordova-plugin-inappbrowser@1.7.2...rel/7.0.0)

---
updated-dependencies:
- dependency-name: sharp
  dependency-version: 0.35.4
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: mysql2
  dependency-version: 3.23.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: immutable
  dependency-version: 4.3.9
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: xmldom
  dependency-version: 0.6.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.16.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: sanitize-html
  dependency-version: 2.17.7
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: pacote
  dependency-version: 22.0.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: csv-parse
  dependency-version: 7.0.2
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: nanoid
  dependency-version: 6.0.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: csv-parse
  dependency-version: 7.0.2
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: jsondiffpatch
  dependency-version: 0.7.6
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: sanitize-html
  dependency-version: 2.17.7
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: sharp
  dependency-version: 0.35.4
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: decode-uri-component
  dependency-version: 0.5.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: immutable
  dependency-version: 4.3.9
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: sanitize-html
  dependency-version: 2.17.7
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: axios
  dependency-version: 1.20.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: sanitize-html
  dependency-version: 2.17.7
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: csv-parse
  dependency-version: 7.0.2
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: immutable
  dependency-version: 4.3.9
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: csv-parse
  dependency-version: 7.0.2
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: sanitize-html
  dependency-version: 2.17.7
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: nodemailer
  dependency-version: 10.0.3
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: immutable
  dependency-version: 4.3.9
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: csv-parse
  dependency-version: 7.0.2
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: axios
  dependency-version: 1.20.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: axios
  dependency-version: 1.20.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: cordova-plugin-inappbrowser
  dependency-version: 7.0.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants