[dependabot]

Bumps the backend-dependencies group with 11 updates in the /Backend directory:

Package	From	To
js-yaml	5.4.3	5.5.0
sanitize-html	2.18.0	2.18.1
@swc/cli	0.8.1	0.8.2
@swc/core	1.16.13	1.16.22
@types/node	26.6.4	26.6.6
eslint	10.12.0	10.14.0
eslint-plugin-prettier	5.5.6	5.5.7
globals	17.13.0	17.14.0
prettier	3.9.9	3.9.10
ts-jest	29.4.14	29.4.15
typescript-eslint	8.71.1	8.72.1

Updates js-yaml from 5.4.3 to 5.5.0

Changelog

Sourced from js-yaml's changelog.

[5.5.0] - 2026-10-16

Changed

• Updated argparse to v3.
• Updated development dependencies.

Fixed

• Correct percent-encoding of shorthand and verbatim tags.
• Reject ,, ], and } at the start of block plain scalars, #801.
• Report the exact position of non-printable characters in errors, #801.

Commits

• cb62b2d 5.5.0 released
• 87aed90 Deps bump
• 3aec511 Fix error positions for non-printable characters, #801
• 11aa483 Reject flow indicators at the start of block plain scalars, #801
• 339d8e0 Refactor tag encoder and decoder to match the YAML specification
• See full diff in compare view

Updates sanitize-html from 2.18.0 to 2.18.1

Changelog

Sourced from sanitize-html's changelog.

2.18.1 (2026-10-14)

Changes

• Remove the deepmerge dependency, which was used only to combine tag-specific and * (all tags) entries in allowedClasses and allowedStyles. That is now done by a few lines of code within sanitize-html.

  This is not a fix for a vulnerability in sanitize-html. Security scanners such as Snyk now report CVE-2026-93753 in deepmerge, which can affect applications that merge untrusted objects, such as parsed JSON request bodies. sanitize-html only ever merged the developer's own configuration, never anything taken from the HTML being sanitized, so it was not exploitable through sanitize-html. Since we needed only a small part of what deepmerge does, we removed the dependency so that these reports no longer appear for sanitize-html users.

Security

• Since 2.18.0, the fallback markup of a discarded <iframe> was re-sanitized by a recursive call with no limit, one level per nested unclosed <iframe>. A few kilobytes of crafted input could throw RangeError: Maximum call stack size exceeded with the default options, and the nestingLimit option was not enforced across the fallback because each nested call started counting from zero. The fallback of a discarded <iframe> is still sanitized and kept, but only up to eight nested <iframe> elements (deeper fallback is escaped as text, as before 2.18.0), and the current nesting depth now carries into the nested call so nestingLimit applies to the whole output. Only 2.18.0 was affected, and the exception is thrown synchronously, so applications that catch errors from sanitizeHtml only lost the affected request (CWE-674, GHSA-c9rx-x947-fp3h).

  Thanks to hkmj19, JohnBeckley, and amikhailovstiltsoft for reporting the vulnerability.

Commits

• a48dd9f Latest release q4 m1 2026: changelog, package.json (#5667)
• 06e4b37 Latest reconciliation q4 m1 2026 (#5664)
• See full diff in compare view

Updates @swc/cli from 0.8.1 to 0.8.2

Changelog

Sourced from @​swc/cli's changelog.

0.8.2

Patch Changes

• 2cbd470: Publish TypeScript declarations, and keep compiled test and mock files out of the package
• d3f4a92: Skip the write when emitted output is byte-identical, and write through a temp file plus rename so watch consumers never read a partially written file

Commits

• See full diff in compare view

Updates @swc/core from 1.16.13 to 1.16.22

Changelog

Sourced from @​swc/core's changelog.

[1.16.22] - 2026-11-05

Bug Fixes

• (ci) Break the publish dependency cycle and guard it in CI (#12681) (3ad7952)

• (deps) Update Wasmtime and zstd for security advisories (#12638) (1e1266f)

• (es/fixer) Preserve the parentheses of string literal statements so they do not become directives (#12633) (75848ac)

• (es/minifier) Fold never-assigned variables in conditions (#12650) (77429a4)

• (es/minifier) Do not reassociate inexact float multiplications (#12657) (5f28be2)

• (es/minifier) Stop checking fn param for ref (#12675) (811a2af)

• (es/regexp) Fix unicode property escape expansion for v and bare \P{...} (#12651) (dcad8b9)

• (es/typescript) Fix merged namespace bindings and enum evaluation (#12455) (c902730)

• (es/typescript) Move minified semantic tests to swc to break the publish dependency cycle (#12663) (fd3d637)

• (sourcemap) Preserve sources without embedded content when flattening (#12680) (c7661e6)

• (testing) Ignore hidden ancestors of the workspace in unignore_fixture (#12652) (42b480d)

Miscellaneous Tasks

• (deps) Update node.js to v26 (#12645) (25a2c8e)

• (es/preset-env) Upgrade browserslist-rs to 0.22.0 (#12678) (c5ad386)

Performance

... (truncated)

Commits

• 0cf74ca chore: Publish 1.16.22 with swc_core v84.0.1
• 39d12c8 chore: Publish 1.16.22-nightly-20261105.1 with swc_core v84.0.1
• 836adfa chore: Publish 1.16.21 with swc_core v83.0.0
• 4291d57 chore: Publish 1.16.21-nightly-20261031.1 with swc_core v83.0.0
• b517954 chore: Publish 1.16.21-nightly-20261030.1 with swc_core v83.0.0
• 56f4407 fix(deps): update npm (#12461)
• 566c595 chore: Publish 1.16.20 with swc_core v82.2.0
• 196ac57 chore: Publish 1.16.20-nightly-20261022.1 with swc_core v82.2.0
• 6d71046 chore: Publish 1.16.19-nightly-20261015.1 with swc_core v82.1.1
• 63ced3b chore: Publish 1.16.18 with swc_core v82.0.2
• Additional commits viewable in compare view

Updates @types/node from 26.6.4 to 26.6.6

Commits

• See full diff in compare view

Updates eslint from 10.12.0 to 10.14.0

Release notes

Sourced from eslint's releases.

v10.14.0

Features

• d23a7f9 feat: fix property descriptor handling in func-name-matching (#21400) (xbinaryx)

Bug Fixes

• 4a12580 fix: require minimatch 10.2.6 to avoid vulnerable brace-expansion (#21460) (lumir)
• 827a8f3 fix: no-restricted-globals crash on global objects as property values (#21449) (xbinaryx)
• 161558a fix: handle LS, PS and empty hashbang comments (#21419) (lumir)
• 6194939 fix: no-invalid-this crash on accessor fields without initializer (#21442) (xbinaryx)
• 9155e14 fix: Update @​humanfs/node dependency version (#21434) (Nicholas C. Zakas)
• cb2b9d4 fix: avoid invalid object-shorthand fixes for super methods (#21323) (dvd233)
• 5ee3915 fix: yoda invalid autofix at statement start (#21424) (Daniel Pinto)

Documentation

• 0f94f47 docs: remove zh-hans from docs language switcher (#21437) (lumir)
• dab466e docs: Update README (GitHub Actions Bot)
• 97431f8 docs: replace --rulesdir with a virtual plugin in custom rules docs (#21452) (Pixel)
• 7697550 docs: Update README (GitHub Actions Bot)
• 0c699d5 docs: Remove Tidelift commercial support (#21416) (Milos Djermanovic)
• 0880666 docs: update loadESLint() documentation for v10 (#21374) (Minseon Kim)
• e06fe87 docs: Revise AI acknowledgment options in PR template (#21414) (Nicholas C. Zakas)

Chores

• 0e2ab70 ci: disable eslint-plugin-unicorn ecosystem test (#21462) (Francesco Trotta)
• 6e3f988 chore: update github/codeql-action action to v4.39.1 (#21450) (renovate[bot])
• a031c40 chore: update ecosystem plugins (#21445) (ESLint Bot)
• 67d2ca2 chore: add troubleshooting page URL to circular fixes warning message (#21429) (Milos Djermanovic)
• 276021d chore: update github/codeql-action action to v4.39.0 (#21432) (renovate[bot])
• 449724e chore: update ecosystem plugins (#21420) (ESLint Bot)
• 8ffeb8c chore: update dependency prettier to v3.9.10 (#21417) (renovate[bot])

v10.13.0

Features

• 48d5cc4 feat: report references inside IIFEs in no-use-before-define (#21238) (Irfan fandi)
• a39d9fb feat: add globalThis to no-obj-calls (#21382) (synthex-byte)
• 66ac583 feat: check yield* expressions in no-unsafe-optional-chaining (#21399) (xbinaryx)

Bug Fixes

• 87bd2ce fix: avoid redeclared let when no-var and one-var fix together (#21389) (Daniel Pinto)

Documentation

• 4783a68 docs: Update README (GitHub Actions Bot)
• 43f0ac9 docs: clarify parameter description in getText (#21287) (lumir)

Chores

• b59d889 chore: update github/codeql-action action to v4.38.3 (#21412) (renovate[bot])
• 95e51a0 ci: re-enable @typescript-eslint/typescript-eslint in ecosystem tests (#21410) (Francesco Trotta)
• 317fcb3 chore: update ecosystem plugins (#21409) (ESLint Bot)
• b92decf perf: skip no-redeclare scan for single-declaration variables (#21365) (James Ross)
• 47b7063 chore: update dependency @​eslint/json to ^2.1.1 (#21398) (renovate[bot])

... (truncated)

Commits

• 12cbff4 10.14.0
• 6b696e7 Build: changelog update for 10.14.0
• 0e2ab70 ci: disable eslint-plugin-unicorn ecosystem test (#21462)
• 4a12580 fix: require minimatch 10.2.6 to avoid vulnerable brace-expansion (#21460)
• 0f94f47 docs: remove zh-hans from docs language switcher (#21437)
• dab466e docs: Update README
• 827a8f3 fix: no-restricted-globals crash on global objects as property values (#21449)
• 97431f8 docs: replace --rulesdir with a virtual plugin in custom rules docs (#21452)
• 6e3f988 chore: update github/codeql-action action to v4.39.1 (#21450)
• 161558a fix: handle LS, PS and empty hashbang comments (#21419)
• Additional commits viewable in compare view

Updates eslint-plugin-prettier from 5.5.6 to 5.5.7

Release notes

Sourced from eslint-plugin-prettier's releases.

v5.5.7

Patch Changes

• #796 7e53ecd Thanks @​OskarEichler! - Fix fallback diagnostic locations for all supported line endings.

• #805 1b7c433 Thanks @​JounQin! - Report a clear error when the sync worker fails to load, so a missing prettier dependency now fails fast with Cannot find package 'prettier' instead of hanging ESLint indefinitely.

New Contributors

• @​truongbo17 made their first contribution in prettier/eslint-plugin-prettier#798
• @​OskarEichler made their first contribution in prettier/eslint-plugin-prettier#796

Full Changelog: prettier/eslint-plugin-prettier@v5.5.6...v5.5.7

Changelog

Sourced from eslint-plugin-prettier's changelog.

5.5.7

Patch Changes

• #796 7e53ecd Thanks @​OskarEichler! - Fix fallback diagnostic locations for all supported line endings.

• #805 1b7c433 Thanks @​JounQin! - Report a clear error when the sync worker fails to load, so a missing prettier dependency now fails fast with Cannot find package 'prettier' instead of hanging ESLint indefinitely.

Commits

• e6dd27a chore: keep packageManager when cleaning package.json for release (#808)
• 7544956 chore: release eslint-plugin-prettier (#799)
• e3e5238 ci: enable npm publish provenance for changesets v3 (#807)
• 7c923c4 build(deps): Bump http-cache-semantics from 4.2.0 to 4.3.0 (#806)
• 1b7c433 fix: bump synckit to surface worker failures instead of hanging (#805)
• a6b3feb docs: explain line endings and endOfLine behavior (#804)
• 2f6ba1d ci: exercise the getLocFromIndex ponyfill on ESLint 9 (#803)
• cf1d2c5 chore(deps): update (#802)
• 9f14a55 chore(deps): update all dependencies (#788)
• 7e53ecd fix: map fallback source locations to actual line starts (#796)
• Additional commits viewable in compare view

Updates globals from 17.13.0 to 17.14.0

Release notes

Sourced from globals's releases.

v17.14.0

• Update globals (2026-11-01) (#355) 7abfb5d

---

sindresorhus/globals@v17.13.0...v17.14.0

Commits

• 3080111 17.14.0
• c61cc23 Tweaks
• 7abfb5d Update globals (2026-11-01) (#355)
• See full diff in compare view

Updates prettier from 3.9.9 to 3.9.10

Release notes

Sourced from prettier's releases.

3.9.10

• Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#20266 by @​fisker)

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.10

diff

Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#20266 by @​fisker)

See micromark/micromark-extension-gfm-table@4f43ead for details.

Commits

• 1172b82 Release 3.9.10
• d014227 Update micromark-extension-gfm-table to fix the table parse issue on perfor...
• 953b908 Bump Prettier dependency to 3.9.9
• ad8a6bf Clean changelog_unreleased
• See full diff in compare view

Updates ts-jest from 29.4.14 to 29.4.15

Release notes

Sourced from ts-jest's releases.

v29.4.15

Please refer to CHANGELOG.md for details.

Changelog

Sourced from ts-jest's changelog.

29.4.15 (2026-10-15)

Bug Fixes

• compiler: resolve modules with tsconfig options regardless of cache state (268746c), closes #5216
• support .cjs config files in config:migrate (4001b4e), closes #4485

Commits

• 197d4de chore(release): 29.4.15
• ebad800 build(deps): update dependency node to v24.22.0
• e5f6e98 test(compiler): clean up temp dirs from module resolution tests
• 77dbb18 test(compiler): make module resolution tests path-independent on Windows
• 268746c fix(compiler): resolve modules with tsconfig options regardless of cache state
• 1536201 build(deps): update dependency vite to ^8.3.4
• 141e39c build(deps): update dependency @​babel/core to ^8.0.7
• 6a6686e build(deps-dev): bump shell-quote from 1.10.0 to 1.12.0 in /examples
• 98e6e50 build(deps): bump proxy-addr from 2.0.7 to 2.0.8 in /website
• d2439ff build(deps): bump compression from 1.8.1 to 1.8.2 in /website
• Additional commits viewable in compare view

Updates typescript-eslint from 8.71.1 to 8.72.1

Release notes

Sourced from typescript-eslint's releases.

v8.72.1

8.72.1 (2026-10-26)

🩹 Fixes

• eslint-plugin: [no-unnecessary-condition] false positives on unresolved conditional types (#13062)
• eslint-plugin: [no-unnecessary-type-assertion] bound recursive type traversal instead of catching stack overflows (#13039)
• typescript-estree: use one Program per tsconfig for the project service in single-run mode (#12988)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Josh Ghoulberg 👻

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.72.0

8.72.0 (2026-10-19)

🚀 Features

• eslint-plugin: lazy load rules (#13010)
• eslint-plugin: [await-thenable] add allowMixedPromiseArrays option (#12992)
• typescript-estree: error on abstract keyword that precedes export (#13019)

🩹 Fixes

• ast-spec: add JSXFragment to JSXAttribute['value'] (#13051)
• eslint-plugin: [prefer-readonly-parameter-types] check where allowed type aliases are declared (#13016)
• eslint-plugin: [no-deprecated] report deprecated properties in object literals (#12704)
• eslint-plugin: use isTypeLiteralType instead of type.isLiteral() to include bigint literals on TS < 5.0 (#13053)
• eslint-plugin: [require-array-sort-compare] check tuples (#13058)
• eslint-plugin: [require-array-sort-compare] ignore extra this type argument on TS < 5.1 (#13055)
• type-utils: discriminateAnyType crashes when calling getAwaitedType on awaited type in TS < 5.0 (#13054)
• typescript-estree: include leading and trailing comments & whitespace in Program range (#12991)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Junichiro Kasuya @​jksy
• Mitch Fultz @​fitchmultz
• Shaan GS @​ShaanGS

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.71.2

... (truncated)

Changelog

Sourced from typescript-eslint's changelog.

8.72.1 (2026-10-26)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.72.0 (2026-10-19)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.71.2 (2026-10-12)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

• 4ad6b75 chore(release): publish 8.72.1
• 7757694 chore: cleanup typecheck & build and fix race condition (#13071)
• a4c2603 chore(release): publish 8.72.0
• 7488d68 chore(release): publish 8.71.2
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions