[dependabot]

Bumps the npm_and_yarn group with 4 updates in the /serverpackcreator-homepage directory: quasar, fast-uri, node-forge and postcss-selector-parser.
Bumps the npm_and_yarn group with 2 updates in the /serverpackcreator-web-frontend directory: serialize-javascript and happy-dom.

Updates quasar from 2.11.10 to 2.32.2

Release notes

Sourced from quasar's releases.

quasar-v2.32.2

Security fixes

• fix(openURL): DOM clobbering of the iOS SafariViewController bridge -> on iOS, attacker-controlled HTML rendered into the page (a <a id="SafariViewController"> through QEditor, or QSelect / QChatMessage with HTML rendering enabled) shadowed the native bridge global, so every later openURL() call threw TypeError: window.SafariViewController.isAvailable is not a function and the URL never opened. openURL() now hands the URL to the bridge only when it exposes the expected isAvailable() and show() functions, and opens a regular window otherwise (GHSA-89vp-x45c-52cq)

Fixes

• fix(types): framework.config.globalNodes -> the option has been honored since #8634 (it sets the CSS class of the nodes Quasar appends to <body> for portals, Notify, Loading and LoadingBar) but was never declared in QuasarUIConfiguration, so a typed quasar.config file or app.use(Quasar, { config: { globalNodes } }) rejected it. It is typed now, with its class member documented

Donations

Quasar Framework is an open-source MIT-licensed project made possible due to the generous contributions by sponsors and backers. If Quasar is useful in your workflow and you want to support ongoing maintenance, please consider the following:

• Becoming a sponsor on Github
• One-off donation via PayPal

quasar-v2.32.1

Changes

• fix(QExpansionItem): group with several items opened on mount -> two or more items of the same group that both start with model-value: true (or default-opened) threw on mount since v2.32.0 and were left with every body visible under a collapsed header. The group sibling that has to close is now settled closed before its content element is ready, with after-hide emitted as usual (#18547)

Donations

Quasar Framework is an open-source MIT-licensed project made possible due to the generous contributions by sponsors and backers. If Quasar is useful in your workflow and you want to support ongoing maintenance, please consider the following:

• Becoming a sponsor on Github
• One-off donation via PayPal

quasar-v2.32.0

[!IMPORTANT] Behavior changes worth checking before you upgrade:

• QImg now renders its <img> into the SSR/SSG HTML whenever the box shape is known (ratio, initial-ratio or height set), instead of waiting for hydration. The markup a crawler or a no-JS client sees changes accordingly. Images with none of the three keep deferring to the client, unless you opt in with the new ssr-prerender prop.
• The .q-responsive__filler element no longer exists, and neither does QImg's filler node: the ratio now sits on the component root through CSS aspect-ratio. A QVideo with an explicit width resolves its ratio against that width instead of the parent's, and a QResponsive inside a height-clamped parent keeps its ratio by narrowing rather than squishing its content (Chromium and Firefox; WebKit keeps the previous full-width box).
• QExpansionItem and QTree no longer render a QSlideTransition around their content; they drive the slide on the content element themselves, so the two extra component instances per item (per tree node) are gone from the tree. Their duration prop is now a real Number prop on the component itself rather than a passthrough to the child.
• On Chromium, QSlideTransition, QExpansionItem, QTree and the vertical QStep no longer write inline height/transition styles while sliding: the slide runs as a Web Animation over a calc-size(auto, size) keyframe. Only overflow-y is written during the slide. Firefox and Safari keep the previous measuring CSS transition unchanged.
• QInput autogrow textareas are sized by the browser through CSS field-sizing: content where it is supported (Chromium 123+, Safari 26+), so no inline height/overflow styles appear on the textarea any more and a max-height scrolls natively. Older engines keep the JS measuring fallback.
• QParallax registers no scroll or resize listener and no IntersectionObserver where it can ride a view timeline (currently everything but Firefox). The scroll event and the content slot scope still work, but they are what forces the JS tracking back on, so use the slot only where you need its scope.

New

• feat(QImg): render the image in the SSR HTML; new prop -> ssr-prerender -> until now QImg only set the image source once the client had mounted, so under SSR/SSG the browser started fetching it after the JS bundle had downloaded and the app had hydrated: the preload scanner never saw it, crawlers and no-JS clients got an empty box, and any hero image behind QImg was a late LCP by construction. The server and the pre-hydration client now render the <img> themselves, visible from the first paint like a native image, with the placeholder underneath; on mount the component reconciles against the element it finds instead of trusting load events, so an image that finished before hydration still goes through the regular load (or error) path. Only images whose box shape is known (ratio, initial-ratio or height) are server-rendered by default, since otherwise the box would visibly snap from the default ratio to the natural one at hydration; the new ssr-prerender Boolean prop opts the rest in
• feat(QDrawer): pan event with the stage of the swipe gestures -> the swipe-to-open and swipe-to-close gestures ran silently: an app could only learn that the drawer had opened or closed after the fact, through the model and the show/hide events, never that a swipe was in progress, so content mounted on open only came in once the drawer had already been dragged fully into view and the swipe itself showed an empty panel. QDrawer now emits pan with the gesture type ('open' or 'close') and its stage: 'start' once the pan is detected, 'end' when it crossed the threshold and show()/hide() ran, 'cancel' when the finger let go short of it and the drawer sprang back
• feat(QParallax): refresh() method -> everything the component settles at mount (the scrolling container and the way the media is moved along it, the media size, the position) was only re-checked on the events it listens to, so an ancestor changing its overflow, a media swapped without a load event or a scroll-target that only appears later left it stale with no way to tell it so. refresh() re-runs all three

Other

• perf(QParallax): the media moves on a view timeline where the browser has one -> the media now rides an Element.animate() on a ViewTimeline of the component root wherever the API exists and nothing scrollable sits between the root and its scroll target. The browser then moves it on its own thread, in step with the scroll whatever the main thread is doing, where the JS tracking wrote its transform a frame behind (one scroll step off in every other compositor frame) and stalled together with the main thread; the keyframes carry the exact numbers the JS tracking used, so the movement itself is unchanged. On that path the component registers no scroll or resize listener and no IntersectionObserver at all, the tracking being created only where the scroll event or the content slot needs the percentage, and there it reads the timeline's own progress instead of measuring. Firefox, and any layout the timeline cannot express (an overflow: hidden wrapper, a scroll-target that is not the nearest scroll container), keep the JS tracking, itself now measuring once per frame instead of once per scroll event. The media is also no longer left hidden until the first measurement, and a media without a natural size yet no longer measures a display: none box
• perf(QSlideTransition): slide on a Web Animation where calc-size() is supported -> the height slide (so QExpansionItem, QTree and the vertical QStep) measured the content on every toggle, one scrollHeight read on show and two on hide, each forcing a layout: toggling N nodes in one tick (QTree expand/collapse all, filtering) forced N layouts on show and 2N on hide. Where the engine sizes a calc-size(auto, size) keyframe at layout (Chromium 129+) the slide is now an Element.animate() between 0 and that keyframe: no measurement, no forced layout, the height tracked live while sliding, and an interrupted slide of a kept element played backwards. Engines without calc-size() keep the measuring CSS transition, untouched. Chromium 153 headless, 200 boxes toggled in one tick: forced layouts on show 219 -> 20 and on hide 418 -> 19, layout time 13.7ms -> 8.4ms and 22.2ms -> 6.3ms
• perf(QExpansionItem/QTree): slide the content directly, without QSlideTransition -> both components own their content element and its visibility, so the QSlideTransition + Transition pair per item (two component instances, per tree node) only relayed the slide hooks to a v-show. They now call the slide engine on the element themselves. Chromium 153 headless, a QTree with 780 nodes (155 parents) mounted expanded, median of 12 mounts: 43.1ms -> 32.3ms
• perf(QInput): size autogrow textareas with CSS field-sizing where supported -> autogrow textareas now get field-sizing: content and skip the JS measuring routine entirely on browsers that implement the property: no rAF layout thrash per keystroke, no inline height/overflow writes, no scrollTop juggling, and the browser handles a max-height with native scrolling. Browsers below the property's floor (Chromium before 123, Safari before 26) keep the routine, which also coalesces to one measurement per frame now (a keystroke used to schedule two) and cancels a pending frame when autogrow turns off or the component unmounts. Height parity between the two paths was verified in Chromium, Firefox and WebKit across plain, labeled, outlined, filled, dense, max-height and custom font-size cases
• refactor(ui): size QImg, QResponsive and QVideo ratio boxes with CSS aspect-ratio -> the padding-bottom percentage hack needed a dedicated filler element in QImg and QResponsive (plus a width-inheriting wrapper in the latter) and a zero-height root in QVideo. aspect-ratio is under the Baseline floor, so the ratio now sits on the root element itself and those nodes are gone: one element fewer per QImg, two fewer per QResponsive. See the note at the top
• perf(use-position-engine): resolve the CSS anchor verdict once at import -> a QMenu or QTooltip setup now reads a boolean constant instead of calling into a cached support probe

Donations

Quasar Framework is an open-source MIT-licensed project made possible due to the generous contributions by sponsors and backers. If Quasar is useful in your workflow and you want to support ongoing maintenance, please consider the following:

• Becoming a sponsor on Github

... (truncated)

Commits

• ae3b653 chore(ui): bump version
• 7e0733d fix(types): declare framework.config.globalNodes
• 52d874b Merge commit from fork
• b60539b chore(ui): bump version
• b69f609 fix(QExpansionItem): settle a group sibling closed before its content ref is ...
• 54199e5 chore(ui): bump version
• f3bbd39 feat(QImg): render the image in the SSR HTML; new prop -> ssr-prerender
• 5e687df feat(QDrawer): emit a "pan" event with the stage of the swipe gestures
• dcdbd3c perf(QExpansionItem/QTree): slide the content directly, without QSlideTransition
• 61436f0 perf(QSlideTransition): slide on a Web Animation where calc-size() is supported
• Additional commits viewable in compare view

Updates fast-uri from 3.1.8 to 3.1.9

Release notes

Sourced from fast-uri's releases.

v3.1.9

Security

This security release fixes four URI parsing and normalization vulnerabilities in fast-uri 3.x. Applications that process untrusted URI input should upgrade to v3.1.9.

• Medium — URI scheme spoofing through percent-encoded schemes (GHSA-w74x-v6f9-j3xg, CVE-2026-110306): percent-encoded scheme input is now rejected instead of being decoded into a live scheme.
• Medium — Host confusion during domain-host canonicalization (GHSA-wjr9-j795-jxcr, CVE-2026-110180): malformed domain hosts containing ambiguous delimiters or stripped control characters are now rejected instead of being silently rewritten.
• Low — Incorrect relative-reference normalization (GHSA-xhq7-xmqj-769h, CVE-2026-110095): dot-segment removal now preserves the resolution semantics of relative references.
• Low — Scheme injection in suffix references (GHSA-333x-w4r6-6crp, CVE-2026-110725): first-segment colons in path-only suffix references are now escaped so the output is not reparsed as a scheme.

Upgrade with:

npm install fast-uri@3.1.9

Thanks to @​zekth for reporting the scheme, host, and relative-reference issues, and to @​UlisesGascon for finding the suffix-reference issue and reviewing the remediations.

What's Changed

• ci: enable trusted publishing releases (v3.x) by @​mcollina in fastify/fast-uri#229

Full Changelog: fastify/fast-uri@v3.1.8...v3.1.9

Commits

• 0def703 Bumped v3.1.9
• a1d0da2 test: generate only relative path references
• 9eb8759 fix: preserve relative paths in suffix and relative resolution
• 54c30f7 docs: note suffix-reference authority ambiguity
• 39e6493 fix: escape a first-segment colon in suffix references
• 745183c test: cover first-segment colon in suffix references
• ddfc6a5 fix(SEC-03): reject non reg-name characters in domain hosts
• d86a8d2 fix: keep a colon-first segment behind "./" in relative normalization
• eb483b5 test: cover colon-first relative references in normalization
• b110a35 fix(SEC-02): preserve meaning of relative references during normalization
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for fast-uri since your current version.

Updates node-forge from 1.4.0 to 1.4.2

Changelog

Sourced from node-forge's changelog.

1.4.2 - 2026-10-27

Fixed

• [pem] Convert non-string input to a string in pem.decode() as before 1.4.1. The 1.4.1 PEM ReDoS fix (GHSA-7wch-p9px-956x) caused a TypeError for Buffer input, which is used by node-jose. (#1165)

1.4.1 - 2026-10-27

Notes

• This release involved coordinating many security reports from many groups, people, and robots over too long period of time. Thank you for your reports and patience.
• Claude Code was used to help organize, track, untangle, merge, test, validate, fix, and improve it all. Further verification of fixes would be welcome.
• Tracking credits was challenging for some issues due to multiple email and GitHub reports, incomplete contact details, or combining of partial reports and fixes. Please let us know if there are credits changes needed here or in advisory data.

Security

• HIGH: Signature forgery in RSA-PKCS due to ASN.1 extra field in DigestAlgorithm.
  • RSASSA PKCS#1 v1.5 signature verification accepts forged signatures for low public exponent keys (e=3). The fix for CVE-2026-33894 only checked the element count of the outer DigestInfo. Attackers can add "garbage" elements inside the nested DigestAlgorithm SEQUENCE in order to construct a signature that passes verification, enabling Bleichenbacher style forgery.
  • Reported by Geo (@​geo-chen).
  • CVE ID: CVE-2026-85393
  • GHSA ID: GHSA-2g46-22mc-6gwp
• HIGH: Signature forgery in RSA-PKCS due to non-canonical DigestInfo encoding.
  • RSASSA PKCS#1 v1.5 signature verification accepts non-canonical DigestInfo encodings, such as NULL parameters with content, non-minimal length encodings, and non-canonical OIDs. These provide attackers space to construct forged signatures for low public exponent keys (e=3), similar to CVE-2026-33894 and CVE-2026-85393.
  • Reported by Oren Yomtov (Fireblocks), Bronson Yen (Calif.io, in collaboration with Claude and Anthropic Research), Kamil Hałajda, @​pzartech, @​antonlissone, and @​Brechard.
  • CVE ID: CVE-TBD
  • GHSA ID: GHSA-6qrw-m8cv-hcxf
• HIGH: ASN.1 resource exhaustion via BIT STRING decoding.
  • An Uncontrolled Recursion (CWE-674) and Uncontrolled Resource Consumption (CWE-400) vulnerability in node-forge versions 1.4.0 and below enables remote, unauthenticated attackers to exhaust CPU and memory with small crafted DER or PEM inputs (certificates, keys, and other structures parsed

... (truncated)

Commits

• 7928054 Release 1.4.2.
• 1d8c245 Update changelog.
• ce5b576 Convert non-string input in pem.decode().
• c1d64ef Fix changelog typo.
• 453d196 Start 1.4.2-0.
• 8a91737 Release 1.4.1.
• fdd1b9f Update changelog.
• 4c1c3e3 Add changelog release notes.
• 0b455eb Ignore TLS heartbeat requests before the handshake.
• e96c47b Fix jsbn modInverse hang with negative inputs.
• Additional commits viewable in compare view

Updates postcss-selector-parser from 6.1.4 to 6.1.5

Release notes

Sourced from postcss-selector-parser's releases.

6.1.5

• fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (CVE-2026-104844 / GHSA-rj75-hqrm-r3gf, reported by Wayde Shi), backported from 7.1.6 (#346 by @​bradyshutt)

The 6.x line is now in security-only maintenance

This release exists because the advisory above covers every published 6.x version, and until now the only remediation on offer was an upgrade to 7.x. 6.1.5 is the patched version for the 6.x line.

The line is kept alive for the installed base that cannot move to 7 yet, Tailwind CSS 3 in particular, which depends on ^6.1.2. From here on it receives security fixes only: no features, no other bug fixes, no type changes. Everything else goes to 7.x, where this package is actively developed. Tailwind CSS 4 no longer depends on this package at all, so this line is expected to retire on its own.

6.1.5 is published under the legacy-v6 npm dist-tag, so npm install postcss-selector-parser keeps resolving to 7.x. Existing ^6 ranges pick up 6.1.5 as usual.

Changelog

Sourced from postcss-selector-parser's changelog.

6.1.5 - 2026-10-19

• fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (CVE-2026-104844 / GHSA-rj75-hqrm-r3gf, reported by Wayde Shi), backported from 7.1.6 (#346 by @​bradyshutt)

The 6.x line is now in security-only maintenance

This release exists because the advisory above covers every published 6.x version, and until now the only remediation on offer was an upgrade to 7.x. 6.1.5 is the patched version for the 6.x line.

The line is kept alive for the installed base that cannot move to 7 yet, Tailwind CSS 3 in particular, which depends on ^6.1.2. From here on it receives security fixes only: no features, no other bug fixes, no type changes. Everything else goes to 7.x, where this package is actively developed. Tailwind CSS 4 no longer depends on this package at all, so this line is expected to retire on its own.

6.1.5 is published under the legacy-v6 npm dist-tag, so npm install postcss-selector-parser keeps resolving to 7.x. Existing ^6 ranges pick up 6.1.5 as usual.

Commits

• d90b6e3 6.1.5
• 70b0779 fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerabil...
• fb22e12 6.1.4
• 99d9299 fix: tolerate non-node children when serializing selectors
• 08ac3e5 6.1.3
• bd927e2 npm audit fix + update CI
• b6330e5 Improve fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (clo...
• 053e949 Fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (#316)
• 0b773f1 fix: improve typings of constructor helpers (#292)
• 29843e3 chore(deps-dev): bump braces from 3.0.2 to 3.0.3 (#291)
• Additional commits viewable in compare view

Updates serialize-javascript from 7.1.2 to 7.1.4

Release notes

Sourced from serialize-javascript's releases.

v7.1.4

What's Changed

• Fix methods containing nested functions and arrows by @​Shubham-Padkonde in yahoo/serialize-javascript#231
• docs: add SECURITY.md by @​redonkulus in yahoo/serialize-javascript#237
• release: v7.1.4 by @​redonkulus in yahoo/serialize-javascript#238

Note on method serialization

Concise methods ({ m() {} }), including async, generator and computed-key methods, are now serialized correctly when their bodies contain a nested arrow function or function declaration. Previously these were emitted unchanged, producing invalid output that failed to deserialize (#118). Class expressions continue to be emitted as-is.

Reporting security issues

This repo now has a security policy. Please report vulnerabilities privately through GitHub's private vulnerability reporting rather than public issues.

Full Changelog: yahoo/serialize-javascript@v7.1.3...v7.1.4

v7.1.3

See: GHSA-m5mm-p8h7-m29v

What's Changed

• fix: escape </script at the end of a serialized function body by @​redonkulus in yahoo/serialize-javascript#235
• Fix serialization of Dates with expanded ISO years by @​Shubham-Padkonde in yahoo/serialize-javascript#232
• fix: ignore functions without mutating input objects by @​Shubham-Padkonde in yahoo/serialize-javascript#233
• release: v7.1.3 by @​redonkulus in yahoo/serialize-javascript#236

Note on ignoreFunction

With ignoreFunction: true, function values are now omitted the same way JSON.stringify omits them, without deleting them from the input object. Functions inside arrays are emitted as null (previously this produced Array.prototype.slice.call(...) output).

New Contributors

• @​Shubham-Padkonde made their first contribution in yahoo/serialize-javascript#232

Full Changelog: yahoo/serialize-javascript@v7.1.2...v7.1.3

Commits

• 05c5ceb release: v7.1.4 (#238)
• fdb853d Fix methods containing nested functions and arrows (#231)
• f7dfeae docs: add SECURITY.md pointing to private vulnerability reporting (#237)
• 4d36b82 release: v7.1.3 (#236)
• 45e5397 fix: ignore functions without mutating input objects (#233)
• e978a1b fix: serialize Dates with expanded ISO years (#232)
• 2864b3c fix: escape </script at the end of a serialized function body (#235)
• See full diff in compare view

Updates happy-dom from 20.14.6 to 21.0.4

Release notes

Sourced from happy-dom's releases.

v21.0.4

👷‍♂️ Patch fixes

• Fixed a code injection vulnerability in the ESM compiler - By @​capricorn86
• Fixed cross-origin isolation so opaque-origin data: iframes cannot access their parent or top window - By @​capricorn86

v21.0.3

👷‍♂️ Patch fixes

• Fixes security vulnerability where authorization header was forwarded when redirecting - By @​capricorn86

v21.0.2

👷‍♂️ Patch fixes

• Fixes SSRF security vulnerability by doing a target-origin bypass in the proxy server in @​happy-dom/server-renderer - By @​capricorn86

v21.0.1

👷‍♂️ Patch fixes

• Adds aliases --css and --iframe for enabling CSS and iframe loading to @​happy-dom/server-renderer - By @​capricorn86

v21.0.0

💣 Breaking Changes

• Disables CSS and IFrame loading by default to prevent server-side request forgery (SSRF) - By @​capricorn86
  • An attacker could embed <iframe> or <link rel="stylesheet"> elements in untrusted HTML to make Happy DOM send HTTP requests from the server to attacker-chosen URLs, including internal services. This could allow access to otherwise unreachable endpoints or trigger unintended actions, depending on the application and its network access.
  • The settings property disableCSSFileLoading has been deprecated
  • Added the new settings properties enableCSSFileLoading and enableIframePageLoading
  • If you don't believe that you are at risk, you can keep the same behavior as in <=v20.14.6 by sending in { enableCSSFileLoading: true, enableIframePageLoading: true } as broswer settings (e.g. new Window({ settings }));

Commits

• fd16352 fix: Fixed a code injection vulnerability in the ESM compiler (#2537)
• 75ab0fb fix: Fixed cross-origin isolation so opaque-origin data: iframes cannot acces...
• 875ef5c fix: Fixes security vulnerability where authorization header was forwarded wh...
• 1f3ffdf fix: Fixes SSRF security vulnerability by doing a target-origin bypass in the...
• f55c7e0 chore: Update security documentation (#2509)
• 2b91e68 fix: Adds alias for enabling CSS and iframe loading in server-renderer (#2503)
• 0a99c75 BREAKING CHANGE: Disables CSS and IFrame loading by default (#2502)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.