Skip to content

chore(deps): bump the npm_and_yarn group across 1 directory with 2 updates - #276

Merged
rubenvdlinde merged 1 commit into
developmentfrom
dependabot/npm_and_yarn/npm_and_yarn-20534e3d56
Aug 30, 2026
Merged

chore(deps): bump the npm_and_yarn group across 1 directory with 2 updates#276
rubenvdlinde merged 1 commit into
developmentfrom
dependabot/npm_and_yarn/npm_and_yarn-20534e3d56

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 30, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 2 updates in the / directory: fast-xml-parser and js-yaml.

Updates fast-xml-parser from 4.5.7 to 5.11.1

Release notes

Sourced from fast-xml-parser's releases.

v5.11.1

What's Changed

New Contributors

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.11.0...v5.11.1

v5.11.0

What's Changed

New Contributors

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.10.1...v5.11.0

v5.10.1

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.10.0...v5.10.1

v5.10.0

What's Changed

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.9.3...v5.10.0

v5.9.3

What's Changed

New Contributors

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.9.2...v5.9.3

v5.9.2

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.9.1...v5.9.2

v5.9.1

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.9.0...v5.9.1

... (truncated)

Changelog

Sourced from fast-xml-parser's changelog.

Note: If you find missing information about particular minor version, that version must have been changed without any functional change in this library.

Note: Due to some last quick changes on v4, detail of v4.5.3 & v4.5.4 are not updated here. v4.5.4x is the last tag of v4 in github repository. I'm extremely sorry for the confusion

5.11.1 / 2026-08-27

  • fix: validator; Replace regex with a single-pass scanner for attribute tokens, eliminating quadratic behavior on long whitespace runs.

5.11.0 / 2026-08-16

  • feat: support for endIndex in node metadata (#850) [By Pavel Dranichnikov]
  • fix: don't crash on a closing tag with no matching opening tag (#861) [By Haïm Dimer]
  • fix: DOCTYPE to read SYSTEM/PUBLIC
  • deps: strnum v2.4.2

5.10.1 / 2026-07-17

  • fix: multiple DOCTYPE declarations.
  • deps: @nodable/entities for treeshaking

5.10.0 / 2026-07-11

  • upgrade:
    • xml-naming v0.3.0: cache support
    • PEM v1.6.2: sibling bug fix
    • is-unsafe v2.0.0: tree shaking

*5.9.3 / 2026-06-19

  • update strnum

*5.9.2 / 2026-06-17

  • dummy release to test changes in github action

*5.9.1 / 2026-06-17

  • dummy release to test release from github action

*5.9.0 / 2026-06-15

  • update strnum to 2.3.0
    • you can set hex, binary, enotation, infinity, unicode
  • validate unsafe HTML or XML data in doctype entities unsing 'is-unsafe' library. User can override rules by overriding EntityDecoder.

*5.8.0 / 2026-05-12

  • integrate xml-naming to validate DOCTYPE entity name and notation name (using qname becaue of backward compatibility)
    • This will consider xml-version as well. '1.0' is default
  • update strnum to 2.3.0
    • You can set octal and binary parsing which is bydeault off
  • update fast-xml-builder to 1.2.0
    • can sanitize tag names if found invalid
    • fix format output

5.7.3 / 2006-05-05

  • fix: alwaysCreateTextNode should create text node when attributes are present for self closing node

... (truncated)

Commits

Updates js-yaml from 4.1.1 to 4.3.2

Changelog

Sourced from js-yaml's changelog.

4.3.2 - 2026-08-26

Changed

  • [backport] Hard-limit merge sequence size to 100.

Security

  • [backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

4.3.1 - 2026-07-31

Security

  • [backport] Remove quadratic complexity from !!omap duplicate key detection.

4.3.0 - 2026-06-27

Added

  • [backport] Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.

Fixed

  • Restore umd builds back to es5.

Removed

  • [backport] maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

[4.2.0] - 2026-06-01

Added

  • Added docs/safety.md with notes about processing untrusted YAML.
  • Added maxDepth (100) loader option. Not a problem, but gives a better exception instead of RangeError on stack overflow.
  • Added maxMergeSeqLength (20) loader option. Not a problem after merge fix, but an additional restriction for safety.
  • Added sourcemaps to dist/ builds.

Changed

  • Stop resolving numbers with underscores as numeric scalars, #627.
  • Switched dev toolchains to Vite / neostandard.
  • Updated demo.
  • Reorganized tests.
  • dist/ files are no longer kept in the repository.

Fixed

  • Fix parsing of properties on the first implicit block mapping key, #62.
  • Fix trailing whitespace handling when folding flow scalar lines, #307.
  • Reject top-level block scalars without content indentation, #280.
  • Ensure numbers survive round-trip, #737.
  • Fix test coverage for issue #221.
  • Fix flow scalar trailing whitespace folding, #307.

... (truncated)

Commits
  • 79ca68d 4.3.2 released
  • d90b661 Backport merge limits from v5.4.1
  • 86e91b8 4.3.1 released
  • c3cc4b0 Backport quadratic complexity fix for !!omap
  • 33d05b5 4.3.0 released
  • 663bfab Drop demo publish, to not override new v5 one.
  • 1cb8c7b Add v4-legacy tag for publish
  • 02f27af Restore umd builds back to es5
  • 8be84ed Fix es5 compatibility
  • 59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 30, 2026
@rubenvdlinde

Copy link
Copy Markdown
Contributor

@dependabot rebase

…dates

Bumps the npm_and_yarn group with 2 updates in the / directory: [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) and [js-yaml](https://github.com/nodeca/js-yaml).


Updates `fast-xml-parser` from 4.5.7 to 5.11.1
- [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases)
- [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md)
- [Commits](NaturalIntelligence/fast-xml-parser@v4.5.7...v5.11.1)

Updates `js-yaml` from 4.1.1 to 4.3.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.1...4.3.2)

---
updated-dependencies:
- dependency-name: fast-xml-parser
  dependency-version: 5.11.1
  dependency-type: indirect
- dependency-name: js-yaml
  dependency-version: 4.3.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/npm_and_yarn-20534e3d56 branch from 6b13878 to fafc553 Compare August 30, 2026 16:54
@rubenvdlinde
rubenvdlinde merged commit 725ef44 into development Aug 30, 2026
41 of 44 checks passed
@rubenvdlinde
rubenvdlinde deleted the dependabot/npm_and_yarn/npm_and_yarn-20534e3d56 branch August 30, 2026 17:56
rubenvdlinde added a commit that referenced this pull request Aug 31, 2026
… at all (#304)

* fix(eslint): migrate to flat config, the fleet's standard

eslint could not run here at all once its version moved:

  Oops! Something went wrong! :(
  ESLint: 10.9.1
  ESLint couldn't find an eslint.config.* file.

versioniq was the LAST app in the fleet still on .eslintrc.cjs; every
other one already ships eslint.config.mjs. That was invisible while the
lockfile held eslint 8.57.1, and surfaced the moment a Dependabot group
bump pulled eslint 10 -- which requires flat config.

  development branch   eslint 8.57.1   .eslintrc.cjs works
  dependabot #276      eslint 10.9.1   crashes before linting a file

This takes hermiq's eslint.config.mjs, which documents itself as the
fleet's canonical shape ('copy it verbatim; only the last two blocks
should differ'), and keeps versioniq's own rules in those two blocks with
their original rationales.

The jsdoc rules from .eslintrc.cjs are NOT carried over: the canonical
config already scopes them and already declares the  tag that
gate-16 needs. Re-declaring them unscoped aborts the whole run -- which
it did, once, before this was corrected.

Fixing the config surfaced 247 findings it had been unable to report.
194 were auto-fixable. Of the rest:

  24x import-extensions/extensions   relative imports now carry .ts,
                                     checked against the file on disk
                                     rather than appended blindly
   4x no-use-before-define           two refs declared 90 lines below
                                     their first use, moved above it

Verified: eslint exits 0 (113 warnings, 0 errors), stylelint exits 0,
webpack build compiles, vitest 11 files / 58 tests pass.

* fix(stylelint): give stylelint a configuration at all

Aligning the lockfile for the eslint migration moved stylelint 16 -> 17,
and 17 refused to start:

  ConfigurationError: No rules found within configuration.
  Have you provided a "rules" property?

The cause was not the upgrade. This app declared
`@nextcloud/stylelint-config` as a devDependency and then never extended
it -- no config file of any kind, and no `stylelint` key in package.json.
stylelint 16 tolerated that silently.

A declared linter with no rules is not a lenient linter, it is an absent
one: the package was installed on every CI run and judged nothing. The
16 -> 17 move did not break stylelint here, it revealed that stylelint
had never been running.

It now has a config pointing at the package it already depended on,
written as `export default` rather than `module.exports` because this
package is `"type": "module"` and a `.js` config file is therefore an ES
module -- CommonJS there throws `ReferenceError: module is not defined in
ES module scope`.

With stylelint finally running it reported 70 findings; 59 were
auto-fixable and the remainder were logical-property warnings
(padding-left -> padding-inline-start), which are warnings and do not
fail the run.

The v3 stylelint stack is now declared explicitly rather than inherited:
stylelint ^17.14.1, @nextcloud/stylelint-config ^3.2.2,
stylelint-config-recommended-scss ^17.0.1,
stylelint-config-recommended-vue ^1.6.1 and stylelint-config-html ^1.1.0
-- the same set shillinq and zaakafhandelapp run green.

Note on the previous commit: its message lost the word `spec` from one
sentence. Backticks in a double-quoted `-m` string were expanded by the
shell before git saw them. It should read "already declares the `spec`
tag that gate-16 requires". Left uncorrected because amending would need
a force-push onto a shared branch.

Verified: eslint exits 0 (113 warnings, 0 errors), stylelint exits 0,
webpack build compiles, vitest 11 files / 58 tests pass.

---------

Co-authored-by: Conduction Release Bot <release-bot@conduction.nl>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant