2026.08.20

What's Changed

• Bump brace-expansion by @dependabot[bot] in #14379
• Bump undici from 7.28.0 to 7.29.0 by @dependabot[bot] in #14378
• Group dependabot updates for ssdlc-actions together by @diox in #14394
• Bump dompurify from 3.4.12 to 3.4.13 by @dependabot[bot] in #14388
• Bump mozilla/ssdlc-actions/.github/workflows/ssdlc-sbom.yml to v1.2 by @dependabot[bot] in #14395
• Bump mozilla/ssdlc-actions/.github/workflows/code-security-analysis-public-repo.yml from 1 to 1.2 by @dependabot[bot] in #14374
• Remove duplicate open-pull-requests-limit: 99 in dependabot npm config by @diox in #14402
• Create SECURITY.md by @eviljeff in #14400
• Fix locales in SSR single image by @nothingrandom in #14401

Full Changelog: 2026.08.06...2026.08.20