Skip to content

chore(deps): bump the app-dependencies group with 5 updates - #129

Merged
Go2Engle merged 2 commits into
mainfrom
dependabot/npm_and_yarn/app-dependencies-139a65ffe7
Oct 20, 2026
Merged

chore(deps): bump the app-dependencies group with 5 updates#129
Go2Engle merged 2 commits into
mainfrom
dependabot/npm_and_yarn/app-dependencies-139a65ffe7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 19, 2026

Copy link
Copy Markdown
Contributor

Bumps the app-dependencies group with 5 updates:

Package From To
lucide-react 1.54.0 1.57.0
marked 18.1.0 18.1.1
react 19.3.0 19.3.1
react-dom 19.3.0 19.3.1
sanitize-html 2.18.0 2.18.1

Updates lucide-react from 1.54.0 to 1.57.0

Release notes

Sourced from lucide-react's releases.

Version 1.57.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.56.0...1.57.0

Version 1.56.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.55.0...1.56.0

Version 1.55.0

What's Changed

... (truncated)

Commits
  • 3f1255e chore(deps-dev): bump @​vitejs/plugin-react (#4995)
  • 949bc6d test(lucide-react): add tests for DynamicIcon fallback and ref forwarding (#4...
  • See full diff in compare view

Updates marked from 18.1.0 to 18.1.1

Release notes

Sourced from marked's releases.

v18.1.1

18.1.1 (2026-10-12)

Bug Fixes

  • cli: honor an explicitly empty string input (#4113) (ec3a4e5)
  • end blockquote before a lazy line after a heading, hr or html block (#4115) (9e64a6a)
  • keep a backslash in a code span from hiding emphasis (#4117) (6a57018)
  • keep a decoded character reference from forming a new one (#4111) (6bbac0c), closes #38 #112
  • let indented and type 3-5 html blocks interrupt a paragraph (#4124) (eaa1fff)
  • make walkTokens linear by appending values in place (#4121) (627d9ae), closes #4120
  • match pre, script, style and textarea as whole tag names (#4114) (0db74cb)
  • preserve enclosing link state after parsing images (#4123) (cc07bb9)
  • respect tab stops in list continuation indentation (#4119) (4bd2528)

Performance Improvements

  • avoid repeated raw string copies in nested lists (#4082) (7e8754d)
Commits
  • cdbdc01 chore(release): 18.1.1 [skip ci]
  • 2134976 docs: add AGENTS.md (#4125)
  • 699a969 chore(deps-dev): bump handlebars from 4.7.9 to 4.7.10 (#4133)
  • 6a57018 fix: keep a backslash in a code span from hiding emphasis (#4117)
  • eaa1fff fix: let indented and type 3-5 html blocks interrupt a paragraph (#4124)
  • 7e8754d perf: avoid repeated raw string copies in nested lists (#4082)
  • cc07bb9 fix: preserve enclosing link state after parsing images (#4123)
  • 627d9ae fix: make walkTokens linear by appending values in place (#4121)
  • 4bd2528 fix: respect tab stops in list continuation indentation (#4119)
  • 9e64a6a fix: end blockquote before a lazy line after a heading, hr or html block (#4115)
  • Additional commits viewable in compare view

Updates react from 19.3.0 to 19.3.1

Release notes

Sourced from react's releases.

19.3.1 (October 14th, 2026)

React Server Components

Commits

Updates react-dom from 19.3.0 to 19.3.1

Release notes

Sourced from react-dom's releases.

19.3.1 (October 14th, 2026)

React Server Components

Commits

Updates sanitize-html from 2.18.0 to 2.18.1

Changelog

Sourced from sanitize-html's changelog.

2.18.1 (2026-10-14)

Changes

  • Remove the deepmerge dependency, which was used only to combine tag-specific and * (all tags) entries in allowedClasses and allowedStyles. That is now done by a few lines of code within sanitize-html.

    This is not a fix for a vulnerability in sanitize-html. Security scanners such as Snyk now report CVE-2026-93753 in deepmerge, which can affect applications that merge untrusted objects, such as parsed JSON request bodies. sanitize-html only ever merged the developer's own configuration, never anything taken from the HTML being sanitized, so it was not exploitable through sanitize-html. Since we needed only a small part of what deepmerge does, we removed the dependency so that these reports no longer appear for sanitize-html users.

Security

  • Since 2.18.0, the fallback markup of a discarded <iframe> was re-sanitized by a recursive call with no limit, one level per nested unclosed <iframe>. A few kilobytes of crafted input could throw RangeError: Maximum call stack size exceeded with the default options, and the nestingLimit option was not enforced across the fallback because each nested call started counting from zero. The fallback of a discarded <iframe> is still sanitized and kept, but only up to eight nested <iframe> elements (deeper fallback is escaped as text, as before 2.18.0), and the current nesting depth now carries into the nested call so nestingLimit applies to the whole output. Only 2.18.0 was affected, and the exception is thrown synchronously, so applications that catch errors from sanitizeHtml only lost the affected request (CWE-674, GHSA-c9rx-x947-fp3h).

    Thanks to hkmj19, JohnBeckley, and amikhailovstiltsoft for reporting the vulnerability.

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the app-dependencies group with 5 updates
334354a 
Bumps the app-dependencies group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.54.0` | `1.57.0` |
| [marked](https://github.com/markedjs/marked) | `18.1.0` | `18.1.1` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.3.0` | `19.3.1` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.3.0` | `19.3.1` |
| [sanitize-html](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html) | `2.18.0` | `2.18.1` |


Updates `lucide-react` from 1.54.0 to 1.57.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.57.0/packages/lucide-react)

Updates `marked` from 18.1.0 to 18.1.1
- [Release notes](https://github.com/markedjs/marked/releases)
- [Commits](markedjs/marked@v18.1.0...v18.1.1)

Updates `react` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react)

Updates `react-dom` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom)

Updates `sanitize-html` from 2.18.0 to 2.18.1
- [Changelog](https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md)
- [Commits](https://github.com/apostrophecms/apostrophe/commits/sanitize-html@2.18.1/packages/sanitize-html)

---
updated-dependencies:
- dependency-name: lucide-react
  dependency-version: 1.57.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: app-dependencies
- dependency-name: marked
  dependency-version: 18.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: app-dependencies
- dependency-name: react
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: app-dependencies
- dependency-name: react-dom
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: app-dependencies
- dependency-name: sanitize-html
  dependency-version: 2.18.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: app-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 19, 2026
@Go2Engle
Go2Engle merged commit 2c932f7 into main Oct 20, 2026
5 checks passed
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/app-dependencies-139a65ffe7 branch October 20, 2026 16:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Go2Engle