Skip to content

Bump the npm-dependencies group across 1 directory with 10 updates - #1310

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-dependencies-492f038c6b
Open

Bump the npm-dependencies group across 1 directory with 10 updates#1310
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-dependencies-492f038c6b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm-dependencies group with 10 updates in the / directory:

Package From To
@hey-api/openapi-ts 0.98.1 0.99.0
choices.js 11.2.3 11.2.4
driver.js 1.4.0 1.8.0
exifreader 4.40.5 4.44.0
vue 3.5.35 3.5.42
@vitejs/plugin-vue 6.0.7 6.0.8
autoprefixer 10.5.0 10.5.4
postcss 8.5.15 8.5.26
prettier 3.8.3 3.9.6
sass 1.100.0 1.103.1

Updates @hey-api/openapi-ts from 0.98.1 to 0.99.0

Changelog

Sourced from @​hey-api/openapi-ts's changelog.

0.99.0

Minor Changes

To better represent its functionality, the plugin.symbols property has been renamed to plugin.imports.

Plugin duplicates behavior

If you specified the same plugin multiple times, only the last instance would be used. We eventually added a warning for this behavior, but that didn't treat the root issue. This release changes that by merging duplicate plugin configurations.

Removed plugin.external() function

This function was used to reference external symbols. All plugins now use the Imports API, which allows you to reference external symbols in a type-safe way through plugin.imports.

Patch Changes

  • api: replace ~ fields with $ (#4086) (d5ca286) by @​mrlubos

  • config: add Presets API (3b4ee7a) by @​mrlubos

  • plugin(@​hey-api/client-angular): fix: send an empty object request body when explicitly provided in flat parameters mode (#4070) (ab522ef) by @​matthewjamesadam

  • client: use getBaseUrl() function to determine default value (#3772) (4026955) by @​mrlubos

  • plugin(zod): improve discriminator handling (680b947) by @​mrlubos

  • plugin(@​tanstack/preact-query): fix: strip initialData from the inferred result types for infinite query options (7a4b0cf) by @​mrlubos

  • plugin(@​tanstack/solid-query): fix: strip initialData from the inferred result types for infinite query options (7a4b0cf) by @​mrlubos

  • plugin(valibot): support custom regular expression error messages with x-pattern-message (#4117) (3ed3afb) by @​pullfrog

  • plugin(@​hey-api/client-next): fix: send an empty object request body when explicitly provided in flat parameters mode (#4070) (f6d4512) by @​matthewjamesadam

  • plugin(@​hey-api/client-axios): fix: send an empty object request body when explicitly provided in flat parameters mode (#4070) (f6d4512) by @​matthewjamesadam

  • plugin(zod): support creating optional request schemas (11315c7) by @​mrlubos

  • plugin(@​tanstack/react-query): fix: strip initialData from the inferred result types for infinite query options (7a4b0cf) by @​mrlubos

  • plugin(@​hey-api/client-ky): fix: send an empty object request body when explicitly provided in flat parameters mode (#4070) (f6d4512) by @​matthewjamesadam

... (truncated)

Commits

Updates choices.js from 11.2.3 to 11.2.4

Release notes

Sourced from choices.js's releases.

v11.2.4

Changes

🐛 Bug Fixes

🔧 Maintenance

Contributors

@​AysajanE, @​Xon, @​dependabot, @​dependabot[bot], @​terminalchai and @​totallytavi

Changelog

Sourced from choices.js's changelog.

[11.2.4] (2026-07-)

Bugfixes

  • Focus input synchronously to open iOS keyboard (Fix #1373) #1418
  • Fix addItemFilter config option regression from v10.2.0 #1419
  • Fix incorrect aria-expanded attribute for text backing field (Fix #1016) #1391
  • Fix arrow-key navigation did not start from the selected choice when no choice is currently highlighted #1400

Maintenance

  • Update unit test framework to vitest v4.1.10
Commits
  • 0951c89 Update CHANGELOG.md
  • 54fca94 build assets
  • 783951b Code golf
  • 3d9744a Merge pull request #1391 from terminalchai/fix/html-invalid-markup-1016
  • d579859 fix: keep dropdown aria-expanded for select elements
  • 0d4d842 fix: remove invalid dropdown aria-expanded
  • 897cd3f Merge pull request #1400 from terminalchai/fix/direction-key-start-from-selec...
  • b6d7b72 Merge pull request #1428 from Choices-js/fix-dropdown-event-ordering
  • 529da87 Preserve ordering between opening the dropdown and the focus event
  • 9ed4f46 Merge pull request #1426 from Choices-js/dependabot/npm_and_yarn/immutable-4.3.9
  • Additional commits viewable in compare view

Updates driver.js from 1.4.0 to 1.8.0

Release notes

Sourced from driver.js's releases.

1.8.0

Added

  • Hints: pulsing beacons that open a popover on click; overlay optional, the page stays interactive. driver.js/hints, ~5KB gzip. Guide. (#363)
  • advanceOnClick (driver and step level) to advance the tour by clicking the highlighted element itself. (#606)
  • waitForElement (driver and step level) to wait up to N ms for a step's element before treating it as missing. (#606)
  • sideEffects field in package.json for better tree-shaking.

Changed

  • Popover internals shared between tours and hints; tour behaviour verified unchanged against 1.7.0.
  • Build migrated from vite to tsdown; artifact names, exports map and CDN globals unchanged, sizes within ±2%.

Fixed

  • skipMissingElement: the last reachable step now shows Done and runs onDoneClick; step queries like isLastStep() account for skips. (#616)

1.7.0

Added

  • skipMissingElement option to skip a step whose target element is missing (#489, #395)
  • index on the options passed to every hook (#490)
  • --driver-popover-font-family CSS variable to set the popover font (#607)

Changed

  • The popover title and description now render in the default font stack. Set --driver-popover-font-family to use your own.

Fixed

  • Icon fonts placed inside a step description are no longer overridden (#510, #512)
  • Each driver() call keeps its own config, steps and state, (#571)
  • Popover no longer jumps when its content has images that load after render.

1.6.0

Added

  • animationDuration config to control how long the highlight transition takes. (#104)
  • allowScroll config to lock body scroll while a tour is active.
  • onDoneClick hook, fired when the done button on the final step is clicked. (#500)

... (truncated)

Commits
  • ccc94cb 1.8.0
  • b93a4fc Add advanceOnClick and waitForElement
  • ab56c56 Fix missing step and button texts #616
  • 3821035 Increase beacon indicator size
  • 8678291 Refactor tests
  • e2aa992 Reorganize internals and unify step popover
  • b4d221f Add onButtonClick to take over the hint button
  • 09484c7 Clean up the hints module
  • 95df19e Give the hint popover and its arrow one seamless shadow
  • 24763f9 Anchor overlay-mode hints to the element and enlarge the hint arrow
  • Additional commits viewable in compare view

Updates exifreader from 4.40.5 to 4.44.0

Release notes

Sourced from exifreader's releases.

4.44.0: Real tags for XMP rdf:value children, and XMP parsing repairs

Changed

  • The value of an XMP tag that comes from an rdf:value element with child elements is now an object of regular tags instead of the parser's internal nodes. Each child is keyed by its local name (Inner instead of my:Inner) and has value, attributes, and description like any other tag, which is what the TypeScript definitions have described all along. The description of the tag itself follows the new names, for example Inner: 42 where it used to be my:Inner: 42.
  • The content of an rdf:value element is now parsed much as the content of the tag element itself would have been. A list written directly inside rdf:value is therefore a list tag now, so a qualified value written as an rdf:Alt with xml:lang keeps both its text and its language where it used to come back as raw parser nodes. Such a list also takes the place of any sibling elements inside the same rdf:value.
  • Two further consequences of that parsing, if you read these values: a child without a namespace prefix lands under the name undefined, as an element without a prefix does everywhere else in the output, so two such children collapse into one; and a child that holds elements of its own, without being marked rdf:parseType="Resource" itself, is kept without them.
  • The value object of such a tag still has no prototype, as it has since 4.43.0. A child of it named __proto__ is kept under that name, and so is one nested further down.

Fixed

  • An XMP element or attribute named __proto__ is now kept as a tag under that name. Such a name was used in a plain property assignment, which JavaScript takes as a request to replace the prototype of the object holding the tag, so the tag was lost and the fields of the tag object showed up as properties of the object it should have been stored in, including among the top level XMP tags.
  • The description of an XMP tag written as a list is now always a string. When ExifReader has a description function for the tag that neither handles a list nor throws on one, for example tiff:Orientation or tiff:XResolution, the list itself became the description, where the TypeScript definitions promise a string. The descriptions of the list items joined together are used instead.
  • An XMP tag with more than one rdf:value child element is no longer lost or returned without a value. The last rdf:value now wins, which is how a repeated tag is handled.
  • An XMP tag with more than one rdf:Bag, rdf:Seq, or rdf:Alt element is no longer dropped from the output. The last one now wins, as it does for any other repeated element.
  • An XMP packet in need of a namespace repair no longer loses all of its tags when a comment, processing instruction, or CDATA section before the root element contains something that looks like a tag. The repair now also places the declarations correctly in a self-closing root element and no longer cuts the root tag short at a > inside a quoted attribute value.
  • An XMP packet in need of a namespace repair no longer loses all of its tags when its root element declares one of its prefixes with an empty namespace URI, as in xmlns:p="", and that prefix also appears somewhere other than as an element or attribute name.
  • An XMP packet in need of a namespace repair no longer loses all of its tags when an attribute value on its root element contains text that looks like a namespace declaration, as in note='xmlns:p="urn:z"', and the prefix it names is used in the packet without a real declaration.
  • An XMP tag written as a list (rdf:Bag, rdf:Seq, or rdf:Alt) is no longer dropped from the output when ExifReader has a description function for the tag that throws on a list, for example exif:GPSLatitude, exif:GPSLongitude, or exif:ColorSpace. Such a tag is now returned with its list value, and its description is the descriptions of the list items joined together.

Full Changelog: mattiasw/ExifReader@v4.43.0...v4.44.0

4.43.0: Denial-of-service hardening for HEIC, AVIF, Exif, MPF and XMP

Changed

  • An XMP tag value that comes from an rdf:value element with child elements is now an object without a prototype, so that a child element named __proto__ can be kept under its own name. Such an object has no inherited methods, so e.g. hasOwnProperty cannot be called on it.

Fixed

  • A PNG tIME chunk with a date field too wide for its zero-padded width, e.g. a month byte of 200, no longer makes load() throw a RangeError that also discards all other metadata in the file. The field is now rendered at its natural width in the Modify Date description.
  • A Photoshop 8BIM resource whose declared size runs past the end of the available data no longer makes load() throw. The resource value is truncated to the bytes that are present, and the walk also stops cleanly when the data ends in the middle of a resource header, so the resources preceding a malformed one are still returned.
  • A namespace prefix named after a JavaScript object property, for example __proto__ or constructor, is now handled like any other prefix when a missing namespace declaration is repaired. An XMP element or attribute without a prefix and named after such a property is now handled like any other one too. Such an element previously got a wrong value, or was lost altogether, and its description could come back as an inherited JavaScript value instead of text.
  • An XMP packet no longer loses all of its tags when its root element declares a namespace prefix containing a dot, such as xmlns:xmp.iid="...", that name also appears before a colon somewhere in the packet, and some other prefix is used where it is not declared. A prefix of any shape was lost the same way when its declaration put whitespace around the equals sign, as in xmlns:xmp = "...".

Security

  • Fixed a denial-of-service vulnerability where a crafted HEIC or AVIF file could make metadata parsing allocate far more memory, and take far longer, than the size of the file warrants. The item list of an iloc box was bounded by the size of the whole file rather than by the length the box itself declares. Items and their extents are now bounded by the length their own box declares, or by the end of the available data when that comes first.
  • Fixed a second denial-of-service vulnerability of the same class, one level up in the generic box walk. A HEIC or AVIF box was only checked for where it started inside its container, never for how far it read, which made the iloc bound bypassable by wrapping each iloc in a container. A box is now bounded by the container that declares it, and one that over-declares is read only as far as its container reaches.
  • Fixed a denial-of-service vulnerability where a crafted image or XMP file could make ExifReader spend quadratic time repairing an undeclared XML namespace prefix before parsing. Both quadratic paths, de-duplicating the found prefixes and scanning the packet for prefix usages, are now linear. This affects environments where a DOM parser is available: web browsers, and Node.js when the domParser option is used or when @xmldom/xmldom is installed.
  • Fixed a denial-of-service vulnerability where a crafted image could make Exif parsing decode far more tag data than the file actually contains. Each tag value was bounded on its own, but nothing bounded their sum. The decoded values of an IFD and the sub-IFDs it points to are now bounded together by a small multiple of the size of the data being parsed.
  • Fixed a denial-of-service vulnerability where a crafted JPEG could make MPF (Multi-Picture Format) parsing allocate far more memory than the size of the file warrants. Nothing bounded the number of extracted sub-image copies or their sum, so a file of around 128 KiB could retain more than a gigabyte. The total size of the extracted sub-images is now bounded to a small multiple of the input size, and offsets or sizes of 2 GiB or more are handled.

Full Changelog: mattiasw/ExifReader@v4.42.0...v4.43.0

4.42.0: ICC parsing hardened against oversized profiles

Changed

  • An ICC profile whose declared size is larger than all the data available for the file no longer produces ICC tags. This affects files truncated to fewer bytes than the ICC profile declares, and partial reads using the length option, which could previously still return tags for such a profile.

Security

... (truncated)

Changelog

Sourced from exifreader's changelog.

[4.44.0] - 2026-08-21

Changed

  • The value of an XMP tag that comes from an rdf:value element with child elements is now an object of regular tags instead of the parser's internal nodes. Each child is keyed by its local name (Inner instead of my:Inner) and has value, attributes, and description like any other tag, which is what the TypeScript definitions have described all along. The description of the tag itself follows the new names, for example Inner: 42 where it used to be my:Inner: 42.
  • The content of an rdf:value element is now parsed much as the content of the tag element itself would have been. A list written directly inside rdf:value is therefore a list tag now, so a qualified value written as an rdf:Alt with xml:lang keeps both its text and its language where it used to come back as raw parser nodes. Such a list also takes the place of any sibling elements inside the same rdf:value.
  • Two further consequences of that parsing, if you read these values: a child without a namespace prefix lands under the name undefined, as an element without a prefix does everywhere else in the output, so two such children collapse into one; and a child that holds elements of its own, without being marked rdf:parseType="Resource" itself, is kept without them.
  • The value object of such a tag still has no prototype, as it has since 4.43.0. A child of it named __proto__ is kept under that name, and so is one nested further down, which is new (see the entry below).

Fixed

  • An XMP element or attribute named __proto__ is now kept as a tag under that name. Such a name was used in a plain property assignment, which JavaScript takes as a request to replace the prototype of the object holding the tag, so the tag was lost and the fields of the tag object (value, attributes, and description) showed up as properties of the object it should have been stored in, including among the top level XMP tags, where the image had no such tags. The value of an rdf:value element with child elements was the only place already protected, since 4.43.0.
  • The description of an XMP tag written as a list is now always a string. When ExifReader has a description function for the tag that neither handles a list nor throws on one, for example tiff:Orientation or tiff:XResolution, the function handed the list back unchanged and the list itself became the description, where the TypeScript definitions promise a string. The descriptions of the list items joined together are used instead, which is what a list without a description function gets. Together with the entry below about a description function that throws, a list description is now a string whatever the function does with it.
  • An XMP tag with more than one rdf:value child element is no longer lost or returned without a value. The repeated elements were collected into a list that the value parser did not recognize, which left the tag with a value of undefined and the description "undefined", and which threw for an item of an rdf:Bag, rdf:Seq, or rdf:Alt, dropping the whole list tag. The last

... (truncated)

Commits
  • ea2fd0b 4.44.0
  • ac88702 Update changelog for 4.44.0
  • 5181400 Ignore XMP namespace declarations inside quoted attribute values
  • 94a1abd Keep an XMP tag named proto instead of replacing a prototype
  • 76c0fbd Parse the children of an XMP rdf:value element as tags
  • 52dfeb3 Recognize XMP namespace declarations with an empty namespace URI
  • 7422ea2 Keep an XMP list tag whose description function throws
  • f76d401 Fix XMP namespace repair inserting declarations into a comment
  • d26a227 Bump globals from 17.9.0 to 17.11.0 in the all-dependencies group
  • b3fc865 4.43.0
  • Additional commits viewable in compare view

Updates vue from 3.5.35 to 3.5.42

Release notes

Sourced from vue's releases.

v3.5.42

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.41

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.40

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.39

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.38

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.37

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

Changelog

Sourced from vue's changelog.

3.5.42 (2026-08-27)

Bug Fixes

  • hydration: handle async component unmount before lazy hydration (#15252) (6e1814a)
  • hydration: handle moving unresolved async fragment (#15263) (a72036f)
  • runtime-core: avoid caching unmounted suspense children (#15291) (b535917), closes #15288
  • runtime-core: keep .trim result when combined with .number v-model modifier (#15346) (f8d42e1)
  • runtime-core: resolve $el for dev root comment fragment (#15313) (8654f35), closes #12680
  • runtime-dom: support !important on CSS custom properties in style binding (#15348) (31da934)
  • server-renderer: reject CR in attribute names (#15266) (a2b40db)
  • shared: correctly compare Map and Set values (#15328) (ef82a26), closes #15320
  • suspense: don't treat the leaving branch as the fallback while its mount is pending (#15333) (cd19745), closes #15332
  • v-model: re-sync select when model is overridden in change handler (#15298) (6eaecc1), closes #10505

3.5.41 (2026-08-05)

Bug Fixes

3.5.40 (2026-07-16)

Bug Fixes

3.5.39 (2026-06-25)

... (truncated)

Commits
  • d63616c release: v3.5.42
  • b8543dc Revert "fix(compiler-core): handle invalid static arg in same-name v-bind sho...
  • 3857716 fix(compiler-core): handle invalid static arg in same-name v-bind shorthand (...
  • 31da934 fix(runtime-dom): support !important on CSS custom properties in style bindin...
  • f8d42e1 fix(runtime-core): keep .trim result when combined with .number v-model modif...
  • cd19745 fix(suspense): don't treat the leaving branch as the fallback while its mount...
  • 8654f35 fix(runtime-core): resolve $el for dev root comment fragment (#15313)
  • ef82a26 fix(shared): correctly compare Map and Set values (#15328)
  • 6eaecc1 fix(v-model): re-sync select when model is overridden in change handler (#15298)
  • b535917 fix(runtime-core): avoid caching unmounted suspense children (#15291)
  • Additional commits viewable in compare view

Updates @vitejs/plugin-vue from 6.0.7 to 6.0.8

Release notes

Sourced from @​vitejs/plugin-vue's releases.

plugin-vue@6.0.8

Please refer to CHANGELOG.md for details.

Changelog

Sourced from @​vitejs/plugin-vue's changelog.

6.0.8 (2026-07-14)

Features

  • plugin-vue: add forced vapor mode option (#766) (d59c3c0)

Bug Fixes

  • deps: update all non-major dependencies (#781) (d369e5a)
Commits

Updates autoprefixer from 10.5.0 to 10.5.4

Release notes

Sourced from autoprefixer's releases.

10.5.4

10.5.3

10.5.2

  • Moved -webkit-fill-available before -moz-available, so Firefox will use -webkit- version which is closer to stretch.

10.5.1

Changelog

Sourced from autoprefixer's changelog.

10.5.4

10.5.3

10.5.2

  • Moved -webkit-fill-available before -moz-available, so Firefox will use -webkit- version which is closer to stretch.

10.5.1

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for autoprefixer since your current version.


Updates postcss from 8.5.15 to 8.5.26

Release notes

Sourced from postcss's releases.

8.5.26

  • Fixed list.split() regression (by @​lazerg).
  • Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

  • Fixed 8.5.17 visitor regression.
  • Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

  • Preserve the BOM after the processing (by @​hdimer).

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

8.5.19

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

  • Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

  • Fixed Maximum call stack size exceeded error.
  • Fixed Prototype hijacking for postcss.fromJSON().
  • Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

Changelog

Sourced from postcss's changelog.

8.5.26

  • Fixed list.split() regression (by @​lazerg).
  • Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

  • Fixed 8.5.17 visitor regression.
  • Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

  • Preserve the BOM after the processing (by @​hdimer).

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

8.5.19

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

  • Restricted loading previous source maps file to the opts.from folder ...

    Description has been truncated

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Aug 28, 2026
@dependabot
Bump the npm-dependencies group across 1 directory with 10 updates
e9bc569 
Bumps the npm-dependencies group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@hey-api/openapi-ts](https://github.com/hey-api/hey-api/tree/HEAD/packages/openapi-ts) | `0.98.1` | `0.99.0` |
| [choices.js](https://github.com/Choices-js/Choices) | `11.2.3` | `11.2.4` |
| [driver.js](https://github.com/nilbuild/driver.js/tree/HEAD/packages/driver) | `1.4.0` | `1.8.0` |
| [exifreader](https://github.com/mattiasw/ExifReader) | `4.40.5` | `4.44.0` |
| [vue](https://github.com/vuejs/core) | `3.5.35` | `3.5.42` |
| [@vitejs/plugin-vue](https://github.com/vitejs/vite-plugin-vue/tree/HEAD/packages/plugin-vue) | `6.0.7` | `6.0.8` |
| [autoprefixer](https://github.com/postcss/autoprefixer) | `10.5.0` | `10.5.4` |
| [postcss](https://github.com/postcss/postcss) | `8.5.15` | `8.5.26` |
| [prettier](https://github.com/prettier/prettier) | `3.8.3` | `3.9.6` |
| [sass](https://github.com/sass/dart-sass) | `1.100.0` | `1.103.1` |



Updates `@hey-api/openapi-ts` from 0.98.1 to 0.99.0
- [Release notes](https://github.com/hey-api/hey-api/releases)
- [Changelog](https://github.com/hey-api/hey-api/blob/main/packages/openapi-ts/CHANGELOG.md)
- [Commits](https://github.com/hey-api/hey-api/commits/@hey-api/openapi-ts@0.99.0/packages/openapi-ts)

Updates `choices.js` from 11.2.3 to 11.2.4
- [Release notes](https://github.com/Choices-js/Choices/releases)
- [Changelog](https://github.com/Choices-js/Choices/blob/main/CHANGELOG.md)
- [Commits](Choices-js/Choices@v11.2.3...v11.2.4)

Updates `driver.js` from 1.4.0 to 1.8.0
- [Release notes](https://github.com/nilbuild/driver.js/releases)
- [Commits](https://github.com/nilbuild/driver.js/commits/1.8.0/packages/driver)

Updates `exifreader` from 4.40.5 to 4.44.0
- [Release notes](https://github.com/mattiasw/ExifReader/releases)
- [Changelog](https://github.com/mattiasw/ExifReader/blob/main/CHANGELOG.md)
- [Commits](mattiasw/ExifReader@v4.40.5...v4.44.0)

Updates `vue` from 3.5.35 to 3.5.42
- [Release notes](https://github.com/vuejs/core/releases)
- [Changelog](https://github.com/vuejs/core/blob/main/CHANGELOG.md)
- [Commits](vuejs/core@v3.5.35...v3.5.42)

Updates `@vitejs/plugin-vue` from 6.0.7 to 6.0.8
- [Release notes](https://github.com/vitejs/vite-plugin-vue/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-vue/blob/main/packages/plugin-vue/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-vue/commits/plugin-vue@6.0.8/packages/plugin-vue)

Updates `autoprefixer` from 10.5.0 to 10.5.4
- [Release notes](https://github.com/postcss/autoprefixer/releases)
- [Changelog](https://github.com/postcss/autoprefixer/blob/main/CHANGELOG.md)
- [Commits](postcss/autoprefixer@10.5.0...10.5.4)

Updates `postcss` from 8.5.15 to 8.5.26
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.15...8.5.26)

Updates `prettier` from 3.8.3 to 3.9.6
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.8.3...3.9.6)

Updates `sass` from 1.100.0 to 1.103.1
- [Release notes](https://github.com/sass/dart-sass/releases)
- [Changelog](https://github.com/sass/dart-sass/blob/main/CHANGELOG.md)
- [Commits](sass/dart-sass@1.100.0...1.103.1)

---
updated-dependencies:
- dependency-name: "@hey-api/openapi-ts"
  dependency-version: 0.99.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: "@vitejs/plugin-vue"
  dependency-version: 6.0.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: autoprefixer
  dependency-version: 10.5.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: choices.js
  dependency-version: 11.2.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: driver.js
  dependency-version: 1.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: exifreader
  dependency-version: 4.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: postcss
  dependency-version: 8.5.26
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: prettier
  dependency-version: 3.9.6
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: sass
  dependency-version: 1.103.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: vue
  dependency-version: 3.5.41
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/npm-dependencies-492f038c6b branch from 82990ef to e9bc569 Compare September 4, 2026 17:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants