Skip to content

Bump the npm-minor-patch group with 3 updates - #52

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-patch-ae6d139738
Closed

Bump the npm-minor-patch group with 3 updates#52
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-patch-ae6d139738

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 15, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm-minor-patch group with 3 updates: dompurify, marked and vitest.

Updates dompurify from 3.4.16 to 3.4.17

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.17

  • Fixed an issue with IN_PLACE, SAFE_FOR_TEMPLATES and shadow roots, thanks @​manus-pi
  • Fixed IN_PLACE handling of nodes that hooks or custom elements tough during sanitization, thanks @​uttej-badwane
  • Fixed the SMIL attributeName guard in XHTML mode, thanks @​Koukyosyumei
  • Hardened several smaller edge cases (namespaces, literal-text elements, isValidAttribute()), thanks @​artiphishell
  • Added a purify-edge test runner as a compatibility check, thanks @​anzal1
  • Clarified the IN_PLACE documentation in the README about possible risks
  • Updated several dependencies
Commits

Updates marked from 18.1.0 to 18.1.1

Release notes

Sourced from marked's releases.

v18.1.1

18.1.1 (2026-10-12)

Bug Fixes

  • cli: honor an explicitly empty string input (#4113) (ec3a4e5)
  • end blockquote before a lazy line after a heading, hr or html block (#4115) (9e64a6a)
  • keep a backslash in a code span from hiding emphasis (#4117) (6a57018)
  • keep a decoded character reference from forming a new one (#4111) (6bbac0c), closes #38 #112
  • let indented and type 3-5 html blocks interrupt a paragraph (#4124) (eaa1fff)
  • make walkTokens linear by appending values in place (#4121) (627d9ae), closes #4120
  • match pre, script, style and textarea as whole tag names (#4114) (0db74cb)
  • preserve enclosing link state after parsing images (#4123) (cc07bb9)
  • respect tab stops in list continuation indentation (#4119) (4bd2528)

Performance Improvements

  • avoid repeated raw string copies in nested lists (#4082) (7e8754d)
Commits
  • cdbdc01 chore(release): 18.1.1 [skip ci]
  • 2134976 docs: add AGENTS.md (#4125)
  • 699a969 chore(deps-dev): bump handlebars from 4.7.9 to 4.7.10 (#4133)
  • 6a57018 fix: keep a backslash in a code span from hiding emphasis (#4117)
  • eaa1fff fix: let indented and type 3-5 html blocks interrupt a paragraph (#4124)
  • 7e8754d perf: avoid repeated raw string copies in nested lists (#4082)
  • cc07bb9 fix: preserve enclosing link state after parsing images (#4123)
  • 627d9ae fix: make walkTokens linear by appending values in place (#4121)
  • 4bd2528 fix: respect tab stops in list continuation indentation (#4119)
  • 9e64a6a fix: end blockquote before a lazy line after a heading, hr or html block (#4115)
  • Additional commits viewable in compare view

Updates vitest from 5.0.3 to 5.0.4

Release notes

Sourced from vitest's releases.

v5.0.4

   🚀 Features

   🐞 Bug Fixes

... (truncated)

Commits
  • 6a11cf6 chore: release v5.0.4 (#11554)
  • 58c86ed chore(deps): update all non-major dependencies (#11550)
  • 0fa80f5 fix(coverage): filenames containing brackets incorrectly showing as uncovered...
  • bf04b9c fix(browser): run browser instances as workers (#11525)
  • 3e3624c refactor: resolve maxWorkers once in config (#11524)
  • 26642f7 fix: respect root in projects (#11521)
  • c06012a feat(experimental): add an option to cache dependencies instead of statically...
  • 4ef000a fix(coverage): allowExternal fails to include uncovered files (#11513)
  • 1da6640 feat: support test.ui.theme option (#11499)
  • b618afd fix(vm): bind this to module.exports (#11504)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the npm-minor-patch group with 3 updates
dd826f7 
Bumps the npm-minor-patch group with 3 updates: [dompurify](https://github.com/cure53/DOMPurify), [marked](https://github.com/markedjs/marked) and [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest).


Updates `dompurify` from 3.4.16 to 3.4.17
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.16...3.4.17)

Updates `marked` from 18.1.0 to 18.1.1
- [Release notes](https://github.com/markedjs/marked/releases)
- [Commits](markedjs/marked@v18.1.0...v18.1.1)

Updates `vitest` from 5.0.3 to 5.0.4
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.4/packages/vitest)

---
updated-dependencies:
- dependency-name: dompurify
  dependency-version: 3.4.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: marked
  dependency-version: 18.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: vitest
  dependency-version: 5.0.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 15, 2026
mt3hr added a commit that referenced this pull request Oct 15, 2026
@mt3hr
Update 依存を上げる — Dependabot の PR 2本（npm 3本・Actions 3本）を取り込み、Nightly を赤…
7186f53 
…くしていた Go 標準ライブラリの脆弱性（1.26.9 へ）と braces（例外リスト）を片付ける

Dependabot が出していた PR 2本（#52・#53）を1コミットで取り込む。PR はマージせずに閉じる。
あわせて、Nightly が govulncheck と npm audit の2ジョブで赤いまま続いていた原因をここで直す。
Nightly が赤い間はリリースゲートも通らない。

## PR の取り込み

- npm: dompurify 3.4.16 → 3.4.17、marked 18.1.0 → 18.1.1、vitest 5.0.3 → 5.0.4（PR #52 と同じ差分）
- GitHub Actions: actions/setup-node 7.0.0 → 7.1.0、github/codeql-action の init / analyze 4.38.2 → 4.38.3
  （PR #53 と同じ差分。ピン留めの SHA がタグ v7.1.0 / v4.38.3 の指すコミットと一致することを確かめた）

## govulncheck: Go 1.26.6 → 1.26.9

Go 1.26.6 の標準ライブラリ（net/http・net/textproto・crypto/tls）に、呼び出し経路のある脆弱性が挙がっていた
（GO-2026-6603 ほか、修正は 1.26.9。govulncheck の出力）。src/server と src/plugins/ の9モジュールの go 指令を
1.26.9 へ上げる。go mod tidy の差分は go 指令の行だけ。資料の「Go 1.26.6 以上」の表記も揃える。
x/net 側の同じ脆弱性は前のコミットの x/net 0.60.0 で直っている。

## npm audit: braces（GHSA-vfj7-8cjw-p6xm）を例外リストで通す

修正版が無い（公開中の最新 3.0.3 が対象範囲）。@vue/eslint-config-typescript と shx から fast-glob → micromatch 経由で
入る開発用依存で、上流の各パッケージの最新版も同じ経路を引くので、依存を上げても消えない。
Dependabot は開発用依存として自動で却下していたので、アラート一覧には出ず Nightly だけが赤かった。

Nightly の npm audit の判定を src/tools/npm_audit_gate.mjs に移す。npm audit --json を全依存と --omit=dev の2回回し、
high 以上は今までどおり落とすが、src/tools/npm_audit_allowlist.json に GHSA ID で名指しした advisory だけは
①本番依存に出てこない ②パッケージ名と対象範囲が advisory の今の内容と一致する ③見直し期限（review_by）を過ぎていない
の間に限って通す。npm audit の出力が読めないとき・via の形が変わって advisory を拾えないときも落とす。
例外リストはリリースゲートの DEPENDENCY_MANIFESTS に入れる（触ったら Nightly を回し直すまでゲートは通らない）。
--omit=dev だけにする・閾値を critical に上げる・continue-on-error にする案を採らなかった理由は ADR-0902 に書いた。

## 確認

verify_docs・test_tools（新しいテスト 23件を含む。テスト件数）・npm run build（vue-tsc と vite build）・
test_client_unit・test_server・vet_plugins・test_plugins。govulncheck は Go 1.26.9 で影響ありが0件。
判定スクリプトは実物の npm audit で braces を例外として通し、本番依存だけの監査は0件だった。
E2E はローカルでは回していない（PATH 上の gkill_server を使うため）。
@mt3hr

mt3hr commented Oct 15, 2026

Copy link
Copy Markdown
Owner

main の 7186f53 で取り込みました（差分はこの PR と同じ）。

@mt3hr mt3hr closed this Oct 15, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 15, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/npm-minor-patch-ae6d139738 branch October 15, 2026 18:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@mt3hr