Skip to content

Bump jsdom from 30.1.1 to 30.1.2 in the npm-minor-patch group - #45

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-patch-137f01ae01
Closed

Bump jsdom from 30.1.1 to 30.1.2 in the npm-minor-patch group#45
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-patch-137f01ae01

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 7, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm-minor-patch group with 1 update: jsdom.

Updates jsdom from 30.1.1 to 30.1.2

Release notes

Sourced from jsdom's releases.

v30.1.2

  • Updated URLs to support Unicode v18.0.0 in internationalized domain names.
  • Reduced package size and memory use for CSS property definitions. (@​scttcper)
  • Fixed severe slowdowns when building large DOM trees, including SVG charts with D3, which regressed in v30.1.0. (@​cmdcolin)
  • Fixed exponentially slow reads of empty inherited CSS custom properties in deeply nested documents, and custom properties incorrectly inheriting past an initial reset. (@​scttcper)
  • Fixed getComputedStyle() returning stale results after editing stylesheet declarations, selectors, or media queries, including in imported stylesheets.
  • Fixed selector matching and computed styles after changes to form control checkedness, indeterminacy, selection, values, and validity, including during form resets and canceled clicks.
  • Fixed computed styles for :focus, :focus-visible, :focus-within, and selectors containing them after focus changes, including inside focus and blur listeners. (@​asamuzaK)
  • Fixed element.focus() incorrectly focusing elements hidden by 'display', including through shadow hosts and slots, and elements excluded by shadow DOM slot assignment. (@​asamuzaK)
  • Fixed getComputedStyle() throwing for elements without inline-style support, including XML and MathML elements.
  • Fixed a memory leak where stylesheet parsing retained the last parsed stylesheet's window after window.close().
  • Fixed memory growth from long-lived MutationObserver instances retaining bookkeeping for garbage-collected nodes. (@​scttcper)
  • Fixed retained select.selectedOptions collections becoming stale after selection changes and form resets.
  • Fixed rejection of negative CSS sizing values, including for 'min-width', 'min-height', 'max-width', and 'max-height', which regressed in v30.1.0.
  • Fixed handling of deeply nested color-mix() expressions, including exceptions during color resolution. (@​asamuzaK)
Commits
  • a23bfb7 30.1.2
  • 64a75d2 Update dependencies and dev dependencies
  • 7bf9653 Invalidate styles after CSSOM and control state changes
  • fe9009c Update focused area handling
  • a8d28b3 Release windows retained by stylesheet parsing
  • 05a2c01 Deduplicate generated CSS property metadata
  • 1efa190 Reduce generated CSS property data
  • a372e12 Avoid Document named-property rebuilds after irrelevant tree mutations
  • b2cd235 Update css-color
  • 0542d2b Release idle MutationObserver bookkeeping
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump jsdom from 30.1.1 to 30.1.2 in the npm-minor-patch group
1d15d46 
Bumps the npm-minor-patch group with 1 update: [jsdom](https://github.com/jsdom/jsdom).


Updates `jsdom` from 30.1.1 to 30.1.2
- [Release notes](https://github.com/jsdom/jsdom/releases)
- [Commits](jsdom/jsdom@v30.1.1...v30.1.2)

---
updated-dependencies:
- dependency-name: jsdom
  dependency-version: 30.1.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 7, 2026
mt3hr added a commit that referenced this pull request Oct 7, 2026
@mt3hr
Update 依存を上げる — 推移依存の脆弱性3件（katex・source-map-js・shell-quote）を解消し、Depen…
6bf73ad 
…dabot の PR 5本（jsdom・vite-plugin-pwa 2・go-git ほか）を取り込む

前のコミットを push したあとの再スキャンで Dependabot アラートが3件開き、
続けて Dependabot が PR 5本（#45〜#49）を出した。まとめて1コミットで取り込み、PR はマージせずに閉じる。

## アラート3件（どれも推移依存）

- katex 0.16.47 → 0.19.0（GHSA-238p-pmpm-9mq7、low）。mermaid が `^0.16.47` で固定しており
  （最新の mermaid 12.1.0 も同じ）、修正版 0.18.2 は範囲外で 0.16 系への backport も無いので、
  既存の overrides と同じ下限の形で `"katex": ">=0.18.2"` を足す。
  gkill は mermaid.core（katex を外部から `import("katex")` で読む版）を使うので、overrides が実際の描画に効く。
  mermaid の呼び方は `renderToString(式, { throwOnError, displayMode, output: "mathml" | "htmlAndMathml" })`
  だけで、0.17 / 0.18 / 0.19 の破壊的変更（内部 API `__defineFunction`・内部 CSS クラス名の接頭辞・
  strict の警告の出し方）には当たらない
- source-map-js 1.2.1 → 1.2.2（GHSA-68fv-2mgg-jv7q、high。PR #49 と同じ）。postcss / Vue のコンパイラ /
  css-tree / vue-i18n のコンパイラの範囲内なので lock の更新だけ
- shell-quote 1.10.0 → 1.12.0（GHSA-pqg4-j6r4-53mv、critical。開発用依存。PR #48 と同じ）。
  npm-run-all2 の範囲内なので lock の更新だけ

残る braces（GHSA-vfj7-8cjw-p6xm）は修正版がまだ出ておらず（最新の 3.0.3 が対象範囲）、
ESLint 設定経由の開発用依存なので Dependabot が自動で却下している。今回は触らない。

## そのほかの PR

- jsdom 30.1.1 → 30.1.2（PR #45。CSS パーサ群・whatwg-url・undici などの推移依存もいっしょに動く）
- vite-plugin-pwa 1.3.0 → 2.0.0（PR #47、メジャー）。破壊的変更は「Node 20.19.0 以上が必須」と
  「@vite-pwa/assets-generator 2 系を peer として許す」の2点だけ。gkill の前提は Node 20.19 以上で、
  CI・Nightly・リリースの WSL とも Node 24。assets-generator は使っていない。workbox-build は 7.4.1 のまま
- go-git 5.19.2 → 5.19.3（PR #46。src/server と archived_git プラグイン。sha1cd 0.6.0 → 0.7.0、
  klauspost/cpuid が依存から外れる）。HTTP のリダイレクト先へ認証情報を持ち越さない修正と、
  packfile の循環デルタで再帰し続けない修正を含む。`go mod tidy` は9モジュールで打ち、差分は PR と一致した

npm の lock の版の動きは PR #45 / #47 / #48 / #49 を合わせたものと一致し、違いは PR の無い katex だけ。

検証: katex を mermaid と同じ引数で描画（mathml / htmlAndMathml の両方で <math> を出す）、
npm run build（run-p 経由なので shell-quote も通る。Vite ビルドと、serviceWorker.js へのプリキャッシュ一覧の注入）、
test_client_unit 2519 件全件成功（テスト件数）、test_tools 99 件全件成功（テスト件数）、
vet_plugins / test_plugins、test_server、npm run verify_docs OK。
型検査は PR #45 / #47 の CI が同じ版で通している
@mt3hr

mt3hr commented Oct 7, 2026

Copy link
Copy Markdown
Owner

main へ直接取り込んだので閉じます（6bf73ade）。

@mt3hr mt3hr closed this Oct 7, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 7, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/npm-minor-patch-137f01ae01 branch October 7, 2026 23:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@mt3hr