Skip to content

build(deps): bump the backend-dependencies group across 1 directory with 10 updates - #503

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/Backend/backend-dependencies-668ae6f747
Closed

build(deps): bump the backend-dependencies group across 1 directory with 10 updates#503
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/Backend/backend-dependencies-668ae6f747

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the backend-dependencies group with 10 updates in the /Backend directory:

Package From To
js-yaml 5.4.3 5.5.0
sanitize-html 2.18.0 2.18.1
@swc/cli 0.8.1 0.8.2
@swc/core 1.16.13 1.16.20
@types/node 26.6.4 26.6.6
eslint 10.12.0 10.13.0
eslint-plugin-prettier 5.5.6 5.5.7
prettier 3.9.9 3.9.10
ts-jest 29.4.14 29.4.15
typescript-eslint 8.71.1 8.72.1

Updates js-yaml from 5.4.3 to 5.5.0

Changelog

Sourced from js-yaml's changelog.

[5.5.0] - 2026-10-16

Changed

  • Updated argparse to v3.
  • Updated development dependencies.

Fixed

  • Correct percent-encoding of shorthand and verbatim tags.
  • Reject ,, ], and } at the start of block plain scalars, #801.
  • Report the exact position of non-printable characters in errors, #801.
Commits
  • cb62b2d 5.5.0 released
  • 87aed90 Deps bump
  • 3aec511 Fix error positions for non-printable characters, #801
  • 11aa483 Reject flow indicators at the start of block plain scalars, #801
  • 339d8e0 Refactor tag encoder and decoder to match the YAML specification
  • See full diff in compare view

Updates sanitize-html from 2.18.0 to 2.18.1

Changelog

Sourced from sanitize-html's changelog.

2.18.1 (2026-10-14)

Changes

  • Remove the deepmerge dependency, which was used only to combine tag-specific and * (all tags) entries in allowedClasses and allowedStyles. That is now done by a few lines of code within sanitize-html.

    This is not a fix for a vulnerability in sanitize-html. Security scanners such as Snyk now report CVE-2026-93753 in deepmerge, which can affect applications that merge untrusted objects, such as parsed JSON request bodies. sanitize-html only ever merged the developer's own configuration, never anything taken from the HTML being sanitized, so it was not exploitable through sanitize-html. Since we needed only a small part of what deepmerge does, we removed the dependency so that these reports no longer appear for sanitize-html users.

Security

  • Since 2.18.0, the fallback markup of a discarded <iframe> was re-sanitized by a recursive call with no limit, one level per nested unclosed <iframe>. A few kilobytes of crafted input could throw RangeError: Maximum call stack size exceeded with the default options, and the nestingLimit option was not enforced across the fallback because each nested call started counting from zero. The fallback of a discarded <iframe> is still sanitized and kept, but only up to eight nested <iframe> elements (deeper fallback is escaped as text, as before 2.18.0), and the current nesting depth now carries into the nested call so nestingLimit applies to the whole output. Only 2.18.0 was affected, and the exception is thrown synchronously, so applications that catch errors from sanitizeHtml only lost the affected request (CWE-674, GHSA-c9rx-x947-fp3h).

    Thanks to hkmj19, JohnBeckley, and amikhailovstiltsoft for reporting the vulnerability.

Commits

Updates @swc/cli from 0.8.1 to 0.8.2

Changelog

Sourced from @​swc/cli's changelog.

0.8.2

Patch Changes

  • 2cbd470: Publish TypeScript declarations, and keep compiled test and mock files out of the package
  • d3f4a92: Skip the write when emitted output is byte-identical, and write through a temp file plus rename so watch consumers never read a partially written file
Commits

Updates @swc/core from 1.16.13 to 1.16.20

Changelog

Sourced from @​swc/core's changelog.

[1.16.20] - 2026-10-22

Bug Fixes

  • (es/codegen) Disambiguate TSX generic arrows (#12505) (2c9d198)

  • (es/codegen) Preserve non-null token boundaries (#12504) (410ae3a)

  • (es/codegen) Parenthesize typed arrow parameters (#12503) (aa1ffd6)

  • (es/codegen) Preserve TypeScript token boundaries (#12523) (9f36ae0)

  • (es/codegen) Emit space after div if rhs starts with a regex (#12544) (dddf716)

  • (es/codegen) Preserve optional call type arguments (#12549) (f7bef4d)

  • (es/compat) Scope private access modes to each member (#12526) (c0e3fa1)

  • (es/fixer) Preserve TypeScript expression grouping (#12518) (b9d3f8f)

  • (es/fixer) Preserve TypeScript operand grouping (#12539) (7c4a214)

  • (es/fixer) Avoid panicking on recovered parenthesized assignment targets (#12551) (ec34371)

  • (es/fixer) Preserve optional chain boundaries (#12550) (01d5630)

  • (es/fixer) Wrap function declarations in sloppy-mode loop bodies (#12567) (76ff943)

  • (es/minifier) Bound literal expressions copied by the sequential inliner (#12521) (60c700f)

  • (es/minifier) Preserve rest array identity when its reference runs more than once (#12546) (4768dbe)

  • (es/minifier) Keep trimLeft and trimRight on string literals (#12574) (663ffb0)

... (truncated)

Commits
  • 566c595 chore: Publish 1.16.20 with swc_core v82.2.0
  • 196ac57 chore: Publish 1.16.20-nightly-20261022.1 with swc_core v82.2.0
  • 6d71046 chore: Publish 1.16.19-nightly-20261015.1 with swc_core v82.1.1
  • 63ced3b chore: Publish 1.16.18 with swc_core v82.0.2
  • ff4257e chore: Publish 1.16.18-nightly-20261011.1 with swc_core v82.0.2
  • d2bfb94 chore: Publish 1.16.17 with swc_core v82.0.1
  • 5274627 chore: Publish 1.16.17-nightly-20261011.1 with swc_core v82.0.1
  • f8269e6 chore: Publish 1.16.16-nightly-20261007.1 with swc_core v82.0.0
  • 3e034f2 chore: Publish 1.16.15-nightly-20261007.1 with swc_core v82.0.0
  • d6b897c chore: Publish 1.16.14-nightly-20261006.1 with swc_core v82.0.0
  • See full diff in compare view

Updates @types/node from 26.6.4 to 26.6.6

Commits

Updates eslint from 10.12.0 to 10.13.0

Release notes

Sourced from eslint's releases.

v10.13.0

Features

  • 48d5cc4 feat: report references inside IIFEs in no-use-before-define (#21238) (Irfan fandi)
  • a39d9fb feat: add globalThis to no-obj-calls (#21382) (synthex-byte)
  • 66ac583 feat: check yield* expressions in no-unsafe-optional-chaining (#21399) (xbinaryx)

Bug Fixes

  • 87bd2ce fix: avoid redeclared let when no-var and one-var fix together (#21389) (Daniel Pinto)

Documentation

  • 4783a68 docs: Update README (GitHub Actions Bot)
  • 43f0ac9 docs: clarify parameter description in getText (#21287) (lumir)

Chores

  • b59d889 chore: update github/codeql-action action to v4.38.3 (#21412) (renovate[bot])
  • 95e51a0 ci: re-enable @typescript-eslint/typescript-eslint in ecosystem tests (#21410) (Francesco Trotta)
  • 317fcb3 chore: update ecosystem plugins (#21409) (ESLint Bot)
  • b92decf perf: skip no-redeclare scan for single-declaration variables (#21365) (James Ross)
  • 47b7063 chore: update dependency @​eslint/json to ^2.1.1 (#21398) (renovate[bot])
  • e5aea41 chore: update ecosystem plugins (#21390) (ESLint Bot)
Commits

Updates eslint-plugin-prettier from 5.5.6 to 5.5.7

Release notes

Sourced from eslint-plugin-prettier's releases.

v5.5.7

Patch Changes

  • #796 7e53ecd Thanks @​OskarEichler! - Fix fallback diagnostic locations for all supported line endings.

  • #805 1b7c433 Thanks @​JounQin! - Report a clear error when the sync worker fails to load, so a missing prettier dependency now fails fast with Cannot find package 'prettier' instead of hanging ESLint indefinitely.

New Contributors

Full Changelog: prettier/eslint-plugin-prettier@v5.5.6...v5.5.7

Changelog

Sourced from eslint-plugin-prettier's changelog.

5.5.7

Patch Changes

  • #796 7e53ecd Thanks @​OskarEichler! - Fix fallback diagnostic locations for all supported line endings.

  • #805 1b7c433 Thanks @​JounQin! - Report a clear error when the sync worker fails to load, so a missing prettier dependency now fails fast with Cannot find package 'prettier' instead of hanging ESLint indefinitely.

Commits
  • e6dd27a chore: keep packageManager when cleaning package.json for release (#808)
  • 7544956 chore: release eslint-plugin-prettier (#799)
  • e3e5238 ci: enable npm publish provenance for changesets v3 (#807)
  • 7c923c4 build(deps): Bump http-cache-semantics from 4.2.0 to 4.3.0 (#806)
  • 1b7c433 fix: bump synckit to surface worker failures instead of hanging (#805)
  • a6b3feb docs: explain line endings and endOfLine behavior (#804)
  • 2f6ba1d ci: exercise the getLocFromIndex ponyfill on ESLint 9 (#803)
  • cf1d2c5 chore(deps): update (#802)
  • 9f14a55 chore(deps): update all dependencies (#788)
  • 7e53ecd fix: map fallback source locations to actual line starts (#796)
  • Additional commits viewable in compare view

Updates prettier from 3.9.9 to 3.9.10

Release notes

Sourced from prettier's releases.

3.9.10

  • Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#20266 by @​fisker)

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.10

diff

Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#20266 by @​fisker)

See micromark/micromark-extension-gfm-table@4f43ead for details.

Commits
  • 1172b82 Release 3.9.10
  • d014227 Update micromark-extension-gfm-table to fix the table parse issue on perfor...
  • 953b908 Bump Prettier dependency to 3.9.9
  • ad8a6bf Clean changelog_unreleased
  • See full diff in compare view

Updates ts-jest from 29.4.14 to 29.4.15

Release notes

Sourced from ts-jest's releases.

v29.4.15

Please refer to CHANGELOG.md for details.

Changelog

Sourced from ts-jest's changelog.

29.4.15 (2026-10-15)

Bug Fixes

  • compiler: resolve modules with tsconfig options regardless of cache state (268746c), closes #5216
  • support .cjs config files in config:migrate (4001b4e), closes #4485
Commits
  • 197d4de chore(release): 29.4.15
  • ebad800 build(deps): update dependency node to v24.22.0
  • e5f6e98 test(compiler): clean up temp dirs from module resolution tests
  • 77dbb18 test(compiler): make module resolution tests path-independent on Windows
  • 268746c fix(compiler): resolve modules with tsconfig options regardless of cache state
  • 1536201 build(deps): update dependency vite to ^8.3.4
  • 141e39c build(deps): update dependency @​babel/core to ^8.0.7
  • 6a6686e build(deps-dev): bump shell-quote from 1.10.0 to 1.12.0 in /examples
  • 98e6e50 build(deps): bump proxy-addr from 2.0.7 to 2.0.8 in /website
  • d2439ff build(deps): bump compression from 1.8.1 to 1.8.2 in /website
  • Additional commits viewable in compare view

Updates typescript-eslint from 8.71.1 to 8.72.1

Release notes

Sourced from typescript-eslint's releases.

v8.72.1

8.72.1 (2026-10-26)

🩹 Fixes

  • eslint-plugin: [no-unnecessary-condition] false positives on unresolved conditional types (#13062)
  • eslint-plugin: [no-unnecessary-type-assertion] bound recursive type traversal instead of catching stack overflows (#13039)
  • typescript-estree: use one Program per tsconfig for the project service in single-run mode (#12988)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.72.0

8.72.0 (2026-10-19)

🚀 Features

  • eslint-plugin: lazy load rules (#13010)
  • eslint-plugin: [await-thenable] add allowMixedPromiseArrays option (#12992)
  • typescript-estree: error on abstract keyword that precedes export (#13019)

🩹 Fixes

  • ast-spec: add JSXFragment to JSXAttribute['value'] (#13051)
  • eslint-plugin: [prefer-readonly-parameter-types] check where allowed type aliases are declared (#13016)
  • eslint-plugin: [no-deprecated] report deprecated properties in object literals (#12704)
  • eslint-plugin: use isTypeLiteralType instead of type.isLiteral() to include bigint literals on TS < 5.0 (#13053)
  • eslint-plugin: [require-array-sort-compare] check tuples (#13058)
  • eslint-plugin: [require-array-sort-compare] ignore extra this type argument on TS < 5.1 (#13055)
  • type-utils: discriminateAnyType crashes when calling getAwaitedType on awaited type in TS < 5.0 (#13054)
  • typescript-estree: include leading and trailing comments & whitespace in Program range (#12991)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.71.2

... (truncated)

Changelog

Sourced from typescript-eslint's changelog.

8.72.1 (2026-10-26)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.72.0 (2026-10-19)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.71.2 (2026-10-12)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the backend-dependencies group across 1 directory w…
bf438b3 
…ith 10 updates

Bumps the backend-dependencies group with 10 updates in the /Backend directory:

| Package | From | To |
| --- | --- | --- |
| [js-yaml](https://github.com/nodeca/js-yaml) | `5.4.3` | `5.5.0` |
| [sanitize-html](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html) | `2.18.0` | `2.18.1` |
| [@swc/cli](https://github.com/swc-project/pkgs/tree/HEAD/packages/cli) | `0.8.1` | `0.8.2` |
| [@swc/core](https://github.com/swc-project/swc/tree/HEAD/packages/core) | `1.16.13` | `1.16.20` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.4` | `26.6.6` |
| [eslint](https://github.com/eslint/eslint) | `10.12.0` | `10.13.0` |
| [eslint-plugin-prettier](https://github.com/prettier/eslint-plugin-prettier) | `5.5.6` | `5.5.7` |
| [prettier](https://github.com/prettier/prettier) | `3.9.9` | `3.9.10` |
| [ts-jest](https://github.com/kulshekhar/ts-jest) | `29.4.14` | `29.4.15` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.71.1` | `8.72.1` |



Updates `js-yaml` from 5.4.3 to 5.5.0
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@5.4.3...5.5.0)

Updates `sanitize-html` from 2.18.0 to 2.18.1
- [Changelog](https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md)
- [Commits](https://github.com/apostrophecms/apostrophe/commits/sanitize-html@2.18.1/packages/sanitize-html)

Updates `@swc/cli` from 0.8.1 to 0.8.2
- [Changelog](https://github.com/swc-project/pkgs/blob/main/packages/cli/CHANGELOG.md)
- [Commits](https://github.com/swc-project/pkgs/commits/HEAD/packages/cli)

Updates `@swc/core` from 1.16.13 to 1.16.20
- [Release notes](https://github.com/swc-project/swc/releases)
- [Changelog](https://github.com/swc-project/swc/blob/main/CHANGELOG.md)
- [Commits](https://github.com/swc-project/swc/commits/v1.16.20/packages/core)

Updates `@types/node` from 26.6.4 to 26.6.6
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `eslint` from 10.12.0 to 10.13.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.12.0...v10.13.0)

Updates `eslint-plugin-prettier` from 5.5.6 to 5.5.7
- [Release notes](https://github.com/prettier/eslint-plugin-prettier/releases)
- [Changelog](https://github.com/prettier/eslint-plugin-prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/eslint-plugin-prettier@v5.5.6...v5.5.7)

Updates `prettier` from 3.9.9 to 3.9.10
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.9.9...3.9.10)

Updates `ts-jest` from 29.4.14 to 29.4.15
- [Release notes](https://github.com/kulshekhar/ts-jest/releases)
- [Changelog](https://github.com/kulshekhar/ts-jest/blob/main/CHANGELOG.md)
- [Commits](kulshekhar/ts-jest@v29.4.14...v29.4.15)

Updates `typescript-eslint` from 8.71.1 to 8.72.1
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.72.1/packages/typescript-eslint)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 5.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-dependencies
- dependency-name: sanitize-html
  dependency-version: 2.18.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-dependencies
- dependency-name: "@swc/cli"
  dependency-version: 0.8.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: backend-dependencies
- dependency-name: "@swc/core"
  dependency-version: 1.16.20
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: backend-dependencies
- dependency-name: "@types/node"
  dependency-version: 26.6.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: backend-dependencies
- dependency-name: eslint
  dependency-version: 10.13.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: backend-dependencies
- dependency-name: eslint-plugin-prettier
  dependency-version: 5.5.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: backend-dependencies
- dependency-name: prettier
  dependency-version: 3.9.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: backend-dependencies
- dependency-name: ts-jest
  dependency-version: 29.4.15
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: backend-dependencies
- dependency-name: typescript-eslint
  dependency-version: 8.72.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: backend-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added backend Imported from docs/ISSUES_100.md (label "backend"). dependencies Imported from docs/ISSUES_100.md (label "dependencies"). labels Nov 2, 2026
@dependabot @github

dependabot Bot commented on behalf of github Nov 9, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Nov 9, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/Backend/backend-dependencies-668ae6f747 branch November 9, 2026 03:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

backend Imported from docs/ISSUES_100.md (label "backend"). dependencies Imported from docs/ISSUES_100.md (label "dependencies").

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants