chore(deps): Bump the mineures group across 1 directory with 14 updates by dependabot[bot] · Pull Request #85 · Shaenn/aura

dependabot · 2026-11-09T23:27:49Z

Bumps the mineures group with 14 updates in the / directory:

Package	From	To
@fastify/static	`10.1.7`	`10.1.10`
fastify	`5.12.7`	`5.12.8`
mermaid	`12.2.0`	`12.3.0`
node-telegram-bot-api	`2.1.0`	`2.3.0`
vue	`3.5.44`	`3.5.45`
vue-i18n	`11.4.16`	`11.4.18`
autoprefixer	`10.6.1`	`10.6.2`
eslint	`10.12.0`	`10.14.0`
eslint-plugin-vue	`10.11.1`	`10.12.0`
globals	`17.13.0`	`17.14.0`
playwright	`1.64.1`	`1.65.0`
vitest	`5.0.4`	`5.1.0`
vue-eslint-parser	`10.4.1`	`10.4.2`
vue-tsc	`3.3.11`	`3.3.14`

Updates @fastify/static from 10.1.7 to 10.1.10

Release notes

Sourced from @fastify/static's releases.

v10.1.10

What's Changed

fix: use @fastify/error for forbidden path errors by @SkySails in fastify/fastify-static#624 The 403 response for forbidden paths now includes code: "FST_STATIC_FORBIDDEN_PATH"; the error no longer has a status property, use statusCode.

New Contributors

@SkySails made their first contribution in fastify/fastify-static#624

Full Changelog: fastify/fastify-static@v10.1.9...v10.1.10

v10.1.9

What's Changed

chore: bump fastify/workflows/.github/workflows/reusable-release.yml from b1a11bce713bc857e52b2231fec3c89071ad3135 to 731d0cca9a6a5b9586dad6b0326d49001ab9216f by @dependabot[bot] in fastify/fastify-static#621

build(deps): bump glob from ^13.0.0 to ^14.0.0 by @mcollina in fastify/fastify-static#627

fix: return callNotFound for directories without index file by @mcollina in fastify/fastify-static#626

fix: try every encoding in a root before falling back to the next root by @RaphaelFakhri in fastify/fastify-static#629

New Contributors

@RaphaelFakhri made their first contribution in fastify/fastify-static#629

Full Changelog: fastify/fastify-static@v10.1.8...v10.1.9

v10.1.8

What's Changed

docs: document the dotfiles option and its default by @mcollina in fastify/fastify-static#619

Full Changelog: fastify/fastify-static@v10.1.7...v10.1.8

Commits

a006a4f Bumped v10.1.10
3677646 fix: use @fastify/error for forbidden path errors (#624)
d4e7392 Bumped v10.1.9
44b5a14 fix: try every encoding in a root before falling back to the next root (#629)
55c7bc9 fix: return callNotFound for directories without index file (#626)
2d0c537 build(deps): bump glob from ^13.0.0 to ^14.0.0
8f2bf52 chore: bump fastify/workflows/.github/workflows/reusable-release.yml
4e0e7e3 Bumped v10.1.8
b2974e0 chore: lower min-release-age to 6 days to unblock 10.1.8 release
5b382cd docs: document the dotfiles option and its default
Additional commits viewable in compare view

Updates fastify from 5.12.7 to 5.12.8

Release notes

Sourced from fastify's releases.

v5.12.8

⚠️ Security Release

Fix for GHSA-3qgw-9275-xf8w

What's Changed

[Backport 5.x] fix(types): restore this context in route shorthand hooks by @github-actions[bot] in fastify/fastify#7055

[Backport 5.x] fix(reply): send stream trailers after the stream actually finishes by @github-actions[bot] in fastify/fastify#7111

[Backport 5.x] test(server): assert the server is listening instead of a literal by @github-actions[bot] in fastify/fastify#7112

[Backport 5.x] feat: add routerOptions.compile to use find-my-way compiler mode by @Tony133 in fastify/fastify#7116

[Backport 5.x] fix: clamp error statusCode between 400 and 599 with 500 fallback by @github-actions[bot] in fastify/fastify#7122

[Backport 5.x] fix: contain synchronous throws from custom content type parsers by @github-actions[bot] in fastify/fastify#7123

[Backport 5.x] docs(serverless): clarify per-route observability on serverless platf… by @github-actions[bot] in fastify/fastify#7134

[Backport 5.x] feat(hooks): support disposables in onClose hook (#5669) by @github-actions[bot] in fastify/fastify#7136

[Backport 5.x] fix(types): allow socket path strings in addresses by @github-actions[bot] in fastify/fastify#7138

[Backport 5.x] fix(types): add logSerializers to RouteShorthandOptions by @github-actions[bot] in fastify/fastify#7145

[Backport 5.x] test: do not assert a HEAD response body through inject() by @github-actions[bot] in fastify/fastify#7149

[Backport 5.x] docs(request): reorganize Request reference by properties and methods by @Tony133 in fastify/fastify#7150

[Backport 5.x] docs(reply): reorganize Reply reference by properties and methods by @Tony133 in fastify/fastify#7151

[Backport 5.x] docs: remove plugins that do not support Fastify v5 by @Tony133 in fastify/fastify#7152

[Backport 5.x] perf(request): hoist port regex to module level by @github-actions[bot] in fastify/fastify#7153

[Backport 5.x] fix(decorators): evaluate instance getters once in getDecorator by @github-actions[bot] in fastify/fastify#7154

[Backport 5.x] docs: clarify that maxParamLength does not prevent ReDoS by @github-actions[bot] in fastify/fastify#7158

[Backport 5.x] docs: fix syntax errors in code examples by @github-actions[bot] in fastify/fastify#7160

Full Changelog: fastify/fastify@v5.12.7...v5.12.8

Commits

0c7413a Bumped v5.12.8
0ffe18f test: make handlerTimeout ended-but-not-finished test deterministic
8e7c2b7 test: restore 100% coverage for handlerTimeout abort paths
15fbadf [Backport 5.x] fix: abort streaming response when handlerTimeout fires after ...
18a7049 docs: fix syntax errors in code examples (#7159)
c410867 docs: clarify that maxParamLength does not prevent ReDoS (#7140)
0fa6bc2 [Backport 5.x] fix(decorators): evaluate instance getters once in getDecorato...
0873d55 perf(request): hoist port regex to module level (#7110)
25cd11e [Backport 5.x] docs: remove plugins that do not support Fastify v5 (#7152)
d60a57b [Backport 5.x] docs(reply): reorganize Reply reference by properties and meth...
Additional commits viewable in compare view

Updates mermaid from 12.2.0 to 12.3.0

Release notes

Sourced from mermaid's releases.

mermaid@12.3.0

Minor Changes

#8164 592d0e4 Thanks @filipsajdak! - feat: add the open-arrow and hollow-circle edge markers, so a notation can tell two kinds of flow apart by whether the head is filled

#8165 5c8aa5d Thanks @filipsajdak! - feat: add the BPMN element shapes - events, gateways, activities, data objects, data stores and text annotations - each reporting where a line meets what is drawn

#8470 692d22a Thanks @openmindednewby! - feat: flowchart edges accept a step number (e1@{ step: 1 }); a dot travels the edges in step order and loops, hidden under prefers-reduced-motion

#8478 56aa105 Thanks @openmindednewby! - feat: add flowchart.stepDuration to set how many seconds each step of the flowchart step animation lasts

#8479 800f7ef Thanks @openmindednewby! - feat: highlight the flowchart edge whose step is playing, in sync with the step animation dot

#8480 50d6294 Thanks @openmindednewby! - feat: add flowchart.stepNumbers to show each step edge's number in a badge

Patch Changes

#8443 2ff8286 Thanks @knsv-bot! - fix: agentflow renders the a[/…/] short form as an input instead of falling back to a task with a SHAPE_UNSUPPORTED warning

#8661 b200b27 Thanks @pbrolin47! - fix: Bump DOMPurify to 3.4.17 to address GHSA-55q2-fjhq-7xh7 and GHSA-6688-9rhm-gjv2

#8633 686f350 Thanks @sidharthv96! - chore: Remove the uuid dependency and the unused legacy ER diagram renderer

#8661 7eec083 Thanks @pbrolin47! - fix: Stop an edge from a node inside a subgraph from crossing an edge from the subgraph itself to the same node with ELK 0.10+ (e.g. outer --> a with da --> a, or three --> two with two --> c2)

#8532 42d3760 Thanks @Devehab! - fix: upgrade bundled elkjs from 0.9.3 to 0.12.0, which is licensed EPL-2.0 OR GPL-3.0-or-later, so GPL-3.0 projects can ship mermaid with ELK

#8162 d5ca27a Thanks @filipsajdak! - fix(swimlanes): size a lane that holds a nested subgraph (TB drew it as an empty 0x0 box, and likewise an outer group holding lanes), and grow LR and RL lanes by the nested group's padding

#8405 b4299f2 Thanks @filipsajdak! - fix: do not draw a stray empty swimlane when a node is listed in two lanes, and warn about it and about a subgraph nested in a lane

#8385 37d0ace Thanks @filipsajdak! - fix(swimlanes): keep two arrowheads that land on one face of a node apart when a sibling edge is straightened

#8385 38e810a Thanks @filipsajdak! - fix(swimlanes): an edge routed round the outside of a diamond now arrives at one of its vertices instead of ending in empty space beside it

#8385 25d7e31 Thanks @filipsajdak! - fix(swimlanes): a second edge leaving a diamond on the same level as its target now leaves from a free vertex instead of running beside the first

#8171 a4750b4 Thanks @filipsajdak! - fix: dock a swimlane edge on the shape it points at, so a line reaches an event's ring instead of stopping at the room its caption reserves

#8385 67315b9 Thanks @filipsajdak! - fix: an edge label no longer pushes the nodes it joins a rank apart

#8385 21a1f5c Thanks @filipsajdak! - fix(swimlanes): stop the crossing cleanup from joining two routes at a corner so they read as one line

#8385 e14bc3a Thanks @filipsajdak! - fix(swimlanes): an edge no longer arrives at the vertex of a hexagon that another edge leaves from

#8459 edd162f Thanks @Yun-seoung! - fix: Allow flowchart edge IDs regardless of whitespace after the node shape

Edge IDs may no longer contain [ ] ( ) { } |.

#8402 4f2bade Thanks @pcp-cmd! - fix: Render use case include and extend relationship labels with UML guillemets.

Commits

2086904 Merge pull request #8671 from mermaid-js/changeset-release/master
41781cb Version Packages
30b486a Merge pull request #8661 from mermaid-js/release/12.3.0
86340ba docs: set the release version for the flowchart step animation options
bc18724 Additional fix since one flowchart diagram failed with crossing edges
7eec083 fix(elk): keep an edge reversed into a subgraph from crossing the edges into it
370c4af Merge pull request #8633 from mermaid-js/chore/remove-uuid
74e5ee8 Merge branch 'develop' into chore/remove-uuid
6e588f8 Merge pull request #8642 from mermaid-js/chore/e2e-speedup
b6933f0 ci(e2e): speed up Playwright runs
Additional commits viewable in compare view

Updates node-telegram-bot-api from 2.1.0 to 2.3.0

Release notes

Sourced from node-telegram-bot-api's releases.

2.3.0 adds a durable S3 session store, makes bot.command() ignore commands addressed to other bots, makes ctx.reply() answer where the message came from (business connections, forum topics), and stops a graceful shutdown from redelivering the update that was being handled. This release rolls up 2.3.0-rc0 and 2.3.0-rc1; the notes below describe the final 2.3.0 behavior.

Session storage

New S3SessionStorage (exported from the core node-telegram-bot-api): a durable, cross-instance session backend for any S3-compatible object store (AWS S3, Cloudflare R2, MinIO, DigitalOcean Spaces). It speaks the S3 REST API directly over fetch with AWS Signature V4 signing, so it is runtime-agnostic (Node 19+, Bun, Deno, Workers, edge). fetch and crypto are injectable, so Node 18 can pass node:crypto's webcrypto. There is no per-object TTL - use a bucket lifecycle rule on the prefix.
import { createSession, S3SessionStorage } from "node-telegram-bot-api";
bot.use(createSession({
store: new S3SessionStorage({
bucket: "my-bot-sessions",
region: "us-east-1",
credentials: { accessKeyId: "...", secretAccessKey: "..." },
prefix: "sessions/", // optional; endpoint targets R2 / MinIO / Spaces
}),
initial: () => ({ count: 0 }),
}));
Dispatch

bot.command(name, ...) now ignores commands addressed to another bot. In a group, /start@some_bot runs the handler only when @some_bot is this bot's username (compared case-insensitively); /start@other_bot falls through to downstream middleware, and a bare /start still always matches. The bot's identity is exposed as bot.botInfo and, in handlers, ctx.me.

ctx.reply() now answers where the incoming message came from instead of the bare chat (#1386, #1387):

business_connection_id for business_message, edited_business_message and deleted_business_messages - previously the bot replied as itself (403 if the customer never started it).

message_thread_id for forum-topic messages (only when is_topic_message is set) - previously the reply landed in General. A plain reply/comment thread is still not followed.

direct_messages_topic_id for channel direct-messages chats, where it is required.

For a callback query, these come from the message the button is attached to. Anything passed in other still wins; pass undefined for a key to opt out.

ctx.reply() now throws for guest_message updates, pointing to api.answerGuestQuery with the message's guest_query_id: a guest bot is not a member of the chat, so sendMessage there cannot reach it.

Polling

Stopping the bot (bot.stop(), or SIGINT/SIGTERM via run()) while a handler runs no longer leaves that update unconfirmed (#1385, #1388). The loop used to exit before the next getUpdates carried the new offset, so a deploy's SIGTERM during a slow handler made Telegram redeliver the update on restart and non-idempotent handlers ran twice. On stop, longPoll now sends one final best-effort getUpdates({ offset, limit: 1, timeout: 0 }), capped at 5s. Updates that were never handled (the rest of a batch) are still redelivered, and an update whose bot.catch() throws (fail-loud) is never confirmed.

Uploads

InputFile uploads no longer throw ReferenceError: crypto is not defined on Node 18: the multipart boundary no longer needs the global WebCrypto, so uploads work across the full supported Node 18.2+ range (#1378).

Upgrading from 2.2.0

bot.init() (run by startPolling(), run() and the first handleUpdate()) now calls getMe() once to learn the bot's identity. Tests that inject a fake fetch need to answer getMe.

Handlers that relied on ctx.reply() landing in the bare chat for business or forum-topic messages now reply in the business connection / topic; pass { business_connection_id: undefined } or { message_thread_id: undefined } to keep the old target.

ctx.reply() in a guest_message handler now throws; use api.answerGuestQuery.

Full changelog: yagop/node-telegram-bot-api@v2.2.0...v2.3.0

2.3.0-rc1

Dispatch

... (truncated)

Changelog

Sourced from node-telegram-bot-api's changelog.

[2.3.0][2.3.0] - 2026-11-04

Stable release of the 2.3.0 line. It includes everything from 2.3.0-rc0 and 2.3.0-rc1 (see below), plus the following changes.

Polling

Stopping the polling loop (bot.stop(), or SIGINT/SIGTERM via run()) while a handler runs no longer leaves that update unconfirmed (#1385). Telegram only confirms updates when a later getUpdates carries their offset, and the loop used to exit before sending it, so the handled update was redelivered on the next start and non-idempotent handlers ran twice. On abort, longPoll now sends one final getUpdates({ offset, limit: 1, timeout: 0 }) (best effort, capped at 5s) for updates that were handled but not yet confirmed. Updates the loop never handled - the rest of a batch - are still redelivered, and the update whose bot.catch() throws (fail-loud) is never confirmed.

Dispatch

ctx.reply() now answers where the incoming message came from instead of the bare chat (#1386). It fills business_connection_id for business_message, edited_business_message and deleted_business_messages (previously the bot replied as itself, and got a 403 if the customer never started it); message_thread_id for forum-topic messages, only when is_topic_message is set (previously the reply landed in General; a plain reply/comment thread is still not followed); and direct_messages_topic_id for channel direct-messages chats, where it is required. For a callback query the values come from the message the button is attached to. Options passed in other still take precedence; pass undefined for a key to opt out.

ctx.reply() now throws for guest_message updates, pointing to api.answerGuestQuery with the message's guest_query_id: a guest bot is not a member of the chat, so sendMessage there can never reach it.

[2.3.0-rc1][2.3.0-rc1] - 2026-11-03

Dispatch

bot.command(name, ...) now ignores commands addressed to another bot: in a group, /start@some_bot runs the handler only when @some_bot is this bot's own username (compared case-insensitively, as Telegram usernames are); /start@other_bot falls through to downstream middleware, and a bare /start still always matches. The command name itself stays case-sensitive. To make the comparison, the bot learns its own @username via getMe(), called once inside bot.init() and kept for the process lifetime (a bot's username is permanent, so there is no refresh). The bot's identity is exposed as bot.botInfo (User | undefined) and to handlers as ctx.me.

[2.3.0-rc0][2.3.0-rc0] - 2026-11-03

Session storage

... (truncated)

Commits

466bc50 Merge pull request #1389 from yagop/version/2.3.0
7777f1c 2.3.0
a48dd8a Merge pull request #1388 from yagop/fix/longpoll-confirm-on-stop
5760954 test(longpoll): pin the confirm deadline, dropped confirm results, caller offset
1c7ffef test(longpoll): use the generated GetUpdatesParams type
05ece91 test(longpoll): expand GetUpdatesParams, re-attach fakeApi doc comment
be6a5ff refactor(longpoll): split option resolution and the retry loop out of longPoll
09cf742 fix(longpoll): confirm handled updates when polling stops
53f72d6 Merge pull request #1387 from yagop/fix/reply-business-topic-context
b811a86 fix(context): keep business connection and forum topic in ctx.reply
Additional commits viewable in compare view

Updates vue from 3.5.44 to 3.5.45

Release notes

Sourced from vue's releases.

v3.5.45

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

Changelog

Sourced from vue's changelog.

3.5.45 (2026-11-05)

Bug Fixes

compiler-core: copy loc in cloneLoc instead of recomputing it (#16092) (3cee79a), closes #16091

compiler-dom: preserve static boolean binding semantics (#16055) (05db7e8), closes #16051

compiler-sfc: respect catch and switch lexical scopes (fix #16098) (#16101) (0f20152)

hmr: retry reloads after pending async roots resolve (#16060) (fbaa794)

hydration: only update component el when replacing its host node (#16001) (51fd0cb)

KeepAlive: cache a resolved Suspense child right away (#16119) (716a29e)

KeepAlive: unmount a child deactivated before it was cached (#15981) (02d2c2b)

reactivity: run onScopeDispose in a stopped scope (#16108) (21dd33c)

runtime-core: anchor on the async placeholder when a component root has no el (#16122) (b5abf8c)

runtime-core: call directive mounted hooks with the latest binding (#16120) (6416207), closes #12460 #12482

runtime-core: remove the placeholder of an unmounted pending async component (#15982) (2b9a0bb)

runtime-core: render nothing for a component whose async setup rejects (#16111) (f64bfa5)

runtime-core: skip stopped error boundaries for async failures (#16061) (0326ed8)

runtime-dom: treat disablepictureinpicture and disableremoteplayback as boolean attributes (#15952) (ef81ddc)

suspense: do not mount the fallback after the boundary is unmounted (#15939) (4fd6a6b)

suspense: drop the unmount hooks of a pending branch when the boundary is unmounted (d04b662)

suspense: enter transitions nested in the pending branch on reveal (#16121) (b8074de), closes #12435 #15294

suspense: keep a discarded component marked unmounted (1dc8cdf)

suspense: keep the async root update retry across a discarded pending branch (#16107) (06bea73)

suspense: keep the internal cleanup of a discarded component (79b80b7)

suspense: keep the timeout counting when the root is switched again while pending (#16143) (a045acd)

suspense: patch same-root updates of nested boundaries in retained content (#16109) (2dbcea8), closes #15878

suspense: release parent dep on suspensible unmount (#15870) (46e5dbf)

suspense: resolve async deps whose pending cycle was discarded (#15980) (f7d0811)

suspense: resolve the boundary when an async setup rejects without an error handler in dev (#16110) (a14aa0b)

suspense: skip a root replacement in a retained nested boundary showing its fallback (#16125) (a47af77)

suspense: skip the out-in afterLeave of an unmounted boundary (#16115) (85e71c0), closes #11037 #11059

transition: handle leave immediately done in out-in mode (#11824) (70599b5), closes #15727

transition: switch modes around a keyed suspense boundary (#16124) (ff0b341)

types: add dialog closedby attribute (#16064) (24c9d0b)

v-model: respect number modifier for Set select values (0ff253b)

Performance Improvements

compiler-sfc: skip unused tsconfig include enumeration (#15899) (1612403), closes #15898

compiler-ssr: render static style attributes at compile time (#16010) (2629c89)

mark internal initializers as pure (#16012) (34fbeb1)

runtime-core: copy raw attrs when setup context attrs are passed as vnode props (#16129) (823c744)

Commits

8b479a8 release: v3.5.45
9f9b71c chore(deps): bump source-map-js from 1.2.1 to 1.2.2 (#16150)
1d718d2 chore(deps): update dependency @types/node to v26 (#16087)
68583ce chore(deps): bump undici from 8.9.0 to 8.12.3 (#16149)
91f2625 chore(deps): bump fast-uri from 3.1.0 to 3.1.9 (#16148)
a8ab1f8 chore(deps): update build (#15918)
a0d1388 chore(deps): update dependency minimatch to v11 [security] (#16145)
923f70d fix(deps): update compiler (#15920)
3cb1161 chore(deps): update lint (#15921)
0ce9e16 chore(deps): update dawidd6/action-download-artifact action to v28 (#16086)
Additional commits viewable in compare view

Updates vue-i18n from 11.4.16 to 11.4.18

Release notes

Sourced from vue-i18n's releases.

v11.4.18

escapeParameter: The sanitizer now also turns <script> in translations into text. A <script> does not run with v-html in the browser, but it runs when the translation is rendered on the server (SSR). (#2757) See GHSA-jrxq-gc2q-9357.

What's Changed

🔒 Security Fixes

fix(shared): neutralize script elements in sanitizeTranslatedHtml by @kazupon in intlify/vue-i18n#2757

Full Changelog: intlify/vue-i18n@v11.4.17...v11.4.18

v11.4.17

install is synchronous: app.use(i18n) now throws the errors in install. They were unhandled rejections, which left the app half-installed (and ended Node.js processes without a handler for them), so if app.use(i18n) throws after you update, the install was failing before, too. i18n.install() returns undefined instead of a Promise that never settled in development without the devtools. (#2741)

Legacy API: A regular expression in silentTranslationWarn or silentFallbackWarn now suppresses the warnings for the keys that match it. As an option of createI18n, it suppressed all the warnings, and set to the property, it suppressed the warnings for the keys that did not match it. (#2744)

escapeParameter: The sanitizer now also disables javascript: URLs in xlink:href, and turns <base>, <animate> and <set> in translations into text. SVG animations with <animate> or <set> in HTML messages no longer run while escapeParameter (escapeParameterHtml in the Legacy API) is enabled. (#2756) See GHSA-473g-cvf6-mfxj.

What's Changed

🐛 Bug Fixes

fix: make install synchronous like other Vue plugins, so that app.use() throws its errors by @kazupon in intlify/vue-i18n#2741

fix: make a regular expression in silentTranslationWarn and silentFallbackWarn suppress the warnings for the keys that match it by @kazupon in intlify/vue-i18n#2744

🔒 Security Fixes

fix(shared): neutralize xlink:href, base and SVG animations in sanitizeTranslatedHtml by @kazupon in intlify/vue-i18n#2756

📝️ Documentations

docs: describe what missingWarn and fallbackWarn turn off, and how to warn only when no locale has the key by @kazupon in intlify/vue-i18n#2745

Full Changelog: intlify/vue-i18n@v11.4.16...v11.4.17

Changelog

Sourced from vue-i18n's changelog.

v11.4.18 (2026-11-03T10:49:56.188Z)

This changelog is generated by GitHub Releases

What's Changed

🔒 Security Fixes

fix(shared): neutralize script elements in sanitizeTranslatedHtml by @kazupon in intlify/vue-i18n#2757

Full Changelog: intlify/vue-i18n@v11.4.17...v11.4.18

v11.4.17 (2026-11-01T11:52:26.220Z)

This changelog is generated by GitHub Releases

What's Changed

🐛 Bug Fixes

fix: make install synchronous like other Vue plugins, so that app.use() throws its errors by @kazupon in intlify/vue-i18n#2741

fix: make a regular expression in silentTranslationWarn and silentFallbackWarn suppress the warnings for the keys that match it by @kazupon in intlify/vue-i18n#2744

🔒 Security Fixes

fix(shared): neutralize xlink:href, base and SVG animations in sanitizeTranslatedHtml by @kazupon in intlify/vue-i18n#2756

📝️ Documentations

docs: describe what missingWarn and fallbackWarn turn off, and how to warn only when no locale has the key by @kazupon in intlify/vue-i18n#2745

Full Changelog: intlify/vue-i18n@v11.4.16...v11.4.17

Commits

73ed6ec release: v11.4.18
e26d251 release: v11.4.17
See full diff in compare view

Updates autoprefixer from 10.6.1 to 10.6.2

Release notes

Sourced from autoprefixer's releases.

10.6.2

Added /* autoprefixer: ignore next warning */ (by @dualfroz).

Fixed losing unprefixed selectors in old browsers in grouping (by @ybai08).

Fixed selector duplicates on multiple Autoprefixer runs.

Fixed case-insensitive pseudo-selector prefixing (by @jakezwang).

Fixed -webkit-cross-fade() for images with numbers (by @mkantautas).

Fixed source maps for Grid prefixes (by @dualfroz).

Changelog

Sourced from autoprefixer's changelog.

10.6.2

Added /* autoprefixer: ignore next warning */ (by @dualfroz).

Fixed losing unprefixed selectors in old browsers in grouping (by @ybai08).

Fixed selector duplicates on multiple Autoprefixer runs.

Fixed case-insensitive pseudo-selector prefixing (by @jakezwang).

Fixed -webkit-cross-fade() for images with numbers (by @mkantautas).

Fixed source maps for Grid prefixes (by @dualfroz).

Commits

a7dbf4d Release 10.6.2 version
c3cd98d Fix selector duplicates on multiple Autoprefixer runs
5ae399e Keep unprefixed selectors in prefixed grouping rules (#1561)
50ca3e2 Fix -webkit-cross-fade() for images with numbers (#1562)
0efb61b Add /* autoprefixer: ignore next warning */ control comment (#1560)
7ca1fad Set source for Grid prefixes in source maps (#1559)
c6d89bc Fix case-insensitive pseudo-selector prefixing (#1558)
See full diff in compare view

Updates eslint from 10.12.0 to 10.14.0

Release notes

Sourced from eslint's releases.

v10.14.0

Features

d23a7f9 feat: fix property descriptor handling in func-name-matching (#21400) (xbinaryx)

Bug Fixes

4a12580 fix: require minimatch 10.2.6 to avoid vulnerable brace-expansion (#21460) (lumir)

827a8f3 fix: no-restricted-globals crash on global objects as property values (#21449) (xbinaryx)

161558a fix: handle LS, PS and empty hashbang comments (#21419) (lumir)

6194939 fix: no-invalid-this crash on accessor fields without initializer (#21442) (xbinaryx)

9155e14 fix: Update @humanfs/node dependency version (#21434) (Nicholas C. Zakas)

cb2b9d4 fix: avoid invalid object-shorthand fixes for super methods (#21323) (dvd233)

Bumps the mineures group with 14 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@fastify/static](https://github.com/fastify/fastify-static) | `10.1.7` | `10.1.10` | | [fastify](https://github.com/fastify/fastify) | `5.12.7` | `5.12.8` | | [mermaid](https://github.com/mermaid-js/mermaid) | `12.2.0` | `12.3.0` | | [node-telegram-bot-api](https://github.com/yagop/node-telegram-bot-api) | `2.1.0` | `2.3.0` | | [vue](https://github.com/vuejs/core) | `3.5.44` | `3.5.45` | | [vue-i18n](https://github.com/intlify/vue-i18n/tree/HEAD/packages/vue-i18n) | `11.4.16` | `11.4.18` | | [autoprefixer](https://github.com/postcss/autoprefixer) | `10.6.1` | `10.6.2` | | [eslint](https://github.com/eslint/eslint) | `10.12.0` | `10.14.0` | | [eslint-plugin-vue](https://github.com/vuejs/eslint-plugin-vue) | `10.11.1` | `10.12.0` | | [globals](https://github.com/sindresorhus/globals) | `17.13.0` | `17.14.0` | | [playwright](https://github.com/microsoft/playwright) | `1.64.1` | `1.65.0` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.4` | `5.1.0` | | [vue-eslint-parser](https://github.com/vuejs/vue-eslint-parser) | `10.4.1` | `10.4.2` | | [vue-tsc](https://github.com/vuejs/language-tools/tree/HEAD/packages/tsc) | `3.3.11` | `3.3.14` | Updates `@fastify/static` from 10.1.7 to 10.1.10 - [Release notes](https://github.com/fastify/fastify-static/releases) - [Commits](fastify/fastify-static@v10.1.7...v10.1.10) Updates `fastify` from 5.12.7 to 5.12.8 - [Release notes](https://github.com/fastify/fastify/releases) - [Commits](fastify/fastify@v5.12.7...v5.12.8) Updates `mermaid` from 12.2.0 to 12.3.0 - [Release notes](https://github.com/mermaid-js/mermaid/releases) - [Commits](https://github.com/mermaid-js/mermaid/compare/mermaid@12.2.0...mermaid@12.3.0) Updates `node-telegram-bot-api` from 2.1.0 to 2.3.0 - [Release notes](https://github.com/yagop/node-telegram-bot-api/releases) - [Changelog](https://github.com/yagop/node-telegram-bot-api/blob/master/CHANGELOG.md) - [Commits](yagop/node-telegram-bot-api@v2.1.0...v2.3.0) Updates `vue` from 3.5.44 to 3.5.45 - [Release notes](https://github.com/vuejs/core/releases) - [Changelog](https://github.com/vuejs/core/blob/main/CHANGELOG.md) - [Commits](vuejs/core@v3.5.44...v3.5.45) Updates `vue-i18n` from 11.4.16 to 11.4.18 - [Release notes](https://github.com/intlify/vue-i18n/releases) - [Changelog](https://github.com/intlify/vue-i18n/blob/v11.4.18/CHANGELOG.md) - [Commits](https://github.com/intlify/vue-i18n/commits/v11.4.18/packages/vue-i18n) Updates `autoprefixer` from 10.6.1 to 10.6.2 - [Release notes](https://github.com/postcss/autoprefixer/releases) - [Changelog](https://github.com/postcss/autoprefixer/blob/main/CHANGELOG.md) - [Commits](postcss/autoprefixer@10.6.1...10.6.2) Updates `eslint` from 10.12.0 to 10.14.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.12.0...v10.14.0) Updates `eslint-plugin-vue` from 10.11.1 to 10.12.0 - [Release notes](https://github.com/vuejs/eslint-plugin-vue/releases) - [Changelog](https://github.com/vuejs/eslint-plugin-vue/blob/master/CHANGELOG.md) - [Commits](vuejs/eslint-plugin-vue@v10.11.1...v10.12.0) Updates `globals` from 17.13.0 to 17.14.0 - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](sindresorhus/globals@v17.13.0...v17.14.0) Updates `playwright` from 1.64.1 to 1.65.0 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.64.1...v1.65.0) Updates `vitest` from 5.0.4 to 5.1.0 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.1.0/packages/vitest) Updates `vue-eslint-parser` from 10.4.1 to 10.4.2 - [Release notes](https://github.com/vuejs/vue-eslint-parser/releases) - [Commits](vuejs/vue-eslint-parser@v10.4.1...v10.4.2) Updates `vue-tsc` from 3.3.11 to 3.3.14 - [Release notes](https://github.com/vuejs/language-tools/releases) - [Changelog](https://github.com/vuejs/language-tools/blob/master/CHANGELOG.md) - [Commits](https://github.com/vuejs/language-tools/commits/v3.3.14/packages/tsc) --- updated-dependencies: - dependency-name: "@fastify/static" dependency-version: 10.1.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: mineures - dependency-name: fastify dependency-version: 5.12.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: mineures - dependency-name: mermaid dependency-version: 12.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: mineures - dependency-name: node-telegram-bot-api dependency-version: 2.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: mineures - dependency-name: vue dependency-version: 3.5.45 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: mineures - dependency-name: vue-i18n dependency-version: 11.4.18 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: mineures - dependency-name: autoprefixer dependency-version: 10.6.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: mineures - dependency-name: eslint dependency-version: 10.14.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: mineures - dependency-name: eslint-plugin-vue dependency-version: 10.12.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: mineures - dependency-name: globals dependency-version: 17.14.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: mineures - dependency-name: playwright dependency-version: 1.65.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: mineures - dependency-name: vitest dependency-version: 5.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: mineures - dependency-name: vue-eslint-parser dependency-version: 10.4.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: mineures - dependency-name: vue-tsc dependency-version: 3.3.14 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: mineures ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 9, 2026

Navigation Menu

Repository navigation

chore(deps): Bump the mineures group across 1 directory with 14 updates - #85

chore(deps): Bump the mineures group across 1 directory with 14 updates#85
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/mineures-c9cb62ad65

dependabot Bot commented on behalf of github Nov 9, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Nov 9, 2026

v10.1.10

What's Changed

New Contributors

v10.1.9

What's Changed

New Contributors

v10.1.8

What's Changed

v5.12.8

⚠️ Security Release

What's Changed

mermaid@12.3.0

Minor Changes

Patch Changes

Session storage

Dispatch

Polling

Uploads

Upgrading from 2.2.0

2.3.0-rc1

Dispatch

[2.3.0][2.3.0] - 2026-11-04

Polling

Dispatch

[2.3.0-rc1][2.3.0-rc1] - 2026-11-03

Dispatch

[2.3.0-rc0][2.3.0-rc0] - 2026-11-03

Session storage

v3.5.45

3.5.45 (2026-11-05)

Bug Fixes

Performance Improvements

v11.4.18

What's Changed

🔒 Security Fixes

v11.4.17

What's Changed

🐛 Bug Fixes

🔒 Security Fixes

📝️ Documentations

v11.4.18 (2026-11-03T10:49:56.188Z)

What's Changed

🔒 Security Fixes

v11.4.17 (2026-11-01T11:52:26.220Z)

What's Changed

🐛 Bug Fixes

🔒 Security Fixes

📝️ Documentations

10.6.2

10.6.2

v10.14.0

Features

Bug Fixes

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants